617c292594
openbao-deploy and openbao-overlay-apply now exit 2 without calling kubectl or helm. The two copies had drifted in both directions, so a deploy from either one reverted the other's changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 236506@bnt-lap001 Assistant-Session: 09087018-91e1-48c5-ab2f-acfbb62c92e4
34 lines
1.4 KiB
Python
34 lines
1.4 KiB
Python
"""The retained OpenBao package copy must not be applied from this repo.
|
|
|
|
rapp-openbao owns the package. Two deployable copies drifted apart, and a
|
|
deploy of one undid the other's changes (RPF-WP-0057). The write targets here
|
|
refuse before running kubectl or helm.
|
|
"""
|
|
import os
|
|
import pathlib
|
|
import subprocess
|
|
|
|
import pytest
|
|
|
|
ROOT = pathlib.Path(__file__).resolve().parents[1]
|
|
|
|
|
|
@pytest.mark.parametrize("target", ["openbao-overlay-apply", "openbao-deploy"])
|
|
def test_write_target_refuses_without_touching_cluster(target, tmp_path):
|
|
marker = tmp_path / "called"
|
|
fake = tmp_path / "fake"
|
|
fake.write_text(f"#!/bin/sh\ntouch {marker}\n")
|
|
fake.chmod(0o755)
|
|
env = dict(os.environ, KUBECTL_BIN=str(fake), HELM=str(fake), KUBECONFIG=str(tmp_path / "none"))
|
|
result = subprocess.run(["make", "-s", target], cwd=ROOT, env=env, capture_output=True, text=True)
|
|
assert result.returncode != 0
|
|
assert "owned by rapp-openbao" in result.stderr
|
|
assert f"cd ~/rapp-openbao && make {target}" in result.stderr
|
|
assert not marker.exists()
|
|
|
|
|
|
def test_dry_run_and_prerequisites_do_not_reach_the_write_path():
|
|
text = (ROOT / "Makefile").read_text()
|
|
for target in ("openbao-overlay-apply", "openbao-deploy"):
|
|
line = next(l for l in text.splitlines() if l.startswith(target + ":"))
|
|
assert line.split(":", 1)[1].split("##")[0].strip() == "", line
|