coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bound durable outbox storage and enforce process writer exclusion
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details
Build and Publish Container Image / build-and-push (push) Failing after 1m1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 18:43:52 +02:00
parent 2b064eee51
commit 0a05383195
14 changed files with 733 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

25
tests/test_outbox_chart.py
View file

@ -6,8 +6,8 @@ from pathlib import Path
import yaml
def render(*settings, succeeds=True):
command = ["helm", "template", "flex-auth", "charts/flex-auth", "-f", "values/stage2-canary.yaml"]
def render(*settings, succeeds=True, chart="flex-auth"):
command = ["helm", "template", "flex-auth", "charts/"+chart, "-f", "values/stage2-canary.yaml"]
for setting in settings:
command += ["--set", setting]
result = subprocess.run(command, capture_output=True, text=True, check=False)
@ -33,6 +33,7 @@ for auth in ((), ("callerAuth.mode=enforce", "callerAuth.binding=test=system:ser
container = pod["containers"][0]
args = container["args"]
assert args[args.index("--outbox-dir") + 1] == "/var/lib/flex-auth/outbox"
assert args[args.index("--outbox-max-bytes") + 1] == "67108864"
assert args[args.index("--emission-source") + 1] == "flex-auth.test"
assert deployment(documents)["spec"]["strategy"]["type"] == "Recreate"
pvc = next(d for d in documents if d["kind"] == "PersistentVolumeClaim")
@ -49,6 +50,26 @@ pod = deployment(existing)["spec"]["template"]["spec"]
assert any(v.get("persistentVolumeClaim", {}).get("claimName") == "retained-outbox" for v in pod["volumes"])
render(*enabled, "replicaCount=2", succeeds=False)
render("outbox.enabled=true", succeeds=False)
for chart in ("flex-auth", "access-engine"):
for value in ("0", "-1", "67108865", "1.0", "true", "null", "1e6", "999999999999999999999999999999"):
render(*enabled, "outbox.maxBytes="+value, succeeds=False, chart=chart)
for value in ("1", "67108864"):
docs=render(*enabled,"outbox.maxBytes="+value,chart=chart)
args=deployment(docs)["spec"]["template"]["spec"]["containers"][0]["args"]
assert args[args.index("--outbox-max-bytes")+1]==value
# Exercise actual YAML numeric decoding, including fractional/boolean values.
for chart in ("flex-auth", "access-engine"):
for value in (0.5, 1.5, 67108864.5, True, False, None, [], {}, 67108865):
with tempfile.TemporaryDirectory() as directory:
overlay = Path(directory) / "bound.yaml"
overlay.write_text(yaml.safe_dump({"outbox":{"maxBytes":value}}))
command = ["helm", "template", "flex-auth", "charts/"+chart,
"-f", "values/stage2-canary.yaml", "-f", str(overlay)]
for setting in enabled:
command += ["--set", setting]
result = subprocess.run(command, capture_output=True, text=True, check=False)
assert result.returncode != 0, f"accepted invalid capacity {value!r}"
assert "maxBytes" in result.stderr, result.stderr
print("optional outbox chart checks passed")
# Delivery rendering binds an existing admitted credential mount and narrow peers.