Refactor zync capabilities

Author: mastastny

doc/GATEWAYS.md

@@ -7,8 +7,8 @@
 * `STANDARD_GATEWAY`: Default gateway deployed by 3scale, which means tests that deploy their own APIcast can run.
 * `LOGS`: Allows getting APIcast logs through `get_logs()` method
 * `JAEGER`: Allows configuring the APIcast to send data to Jaeger through `connect_jaeger()` method
-* `ZYNC`: Zync is enabled in the 3scale deployment. Determined by the gateway type — absent when `ZyncLessApicast` is used. Tests that rely on zync functionality (route creation, OAuth client sync) require this capability.
-* `SSO`: RHSSO/RHBK is configured and zync is enabled (`ZYNC` capability is present and RHSSO password is set in config). Tests using OIDC/OAuth authentication require this capability.
+* `ZYNC_ROUTES`: Zync creates OCP routes for APIcast endpoints. Absent when `ZyncLessApicast` is used or `threescale.zync_routes_disabled: true` is set.
+* `ZYNC_OIDC_SYNC`: Zync is running and syncs OIDC clients with RHSSO/RHBK. Absent only when `ZyncLessApicast` is used (zync completely disabled).
 
 
 # Gateway type configuration
@@ -22,19 +22,34 @@ gateway:
     kind: "SystemApicast"
 ```
 ## ZyncLess APIcast
-*Description*: Variant of System APIcast for 3scale deployments where zync is disabled. Since zync is not available
-to create OCP routes for APIcast endpoints, this gateway creates and manages them via lifecycle hooks.
-Requires `spec/zync/enabled: false` in the APIManager CR — will raise an error at startup if zync is enabled.
+*Description*: Variant of System APIcast for 3scale deployments where zync is completely disabled. Since zync is not
+available to create OCP routes for APIcast endpoints, this gateway creates and manages them via lifecycle hooks.
+Requires `spec/zync/enabled: false` in the APIManager CR — capability provider raises an error if zync is enabled.
 Note: when using this gateway, OCP routes for the 3scale admin portal, master, and developer portal must be
 created manually as zync is also responsible for those.
 
 *Capabilities*: "APICAST, CUSTOM_ENVIRONMENT, PRODUCTION_GATEWAY, SAME_CLUSTER, LOGS, JAEGER, STANDARD_GATEWAY"
-(no `ZYNC` or `SSO` capability — RHSSO/OIDC tests are automatically skipped)
+(no `ZYNC_ROUTES` or `ZYNC_OIDC_SYNC` — all zync-dependent tests are automatically skipped)
 ```
 gateway:
   default:
     kind: "ZyncLessApicast"
 ```
+
+## System APIcast with zync routes disabled
+*Description*: Standard System APIcast for 3scale deployments where zync is running but not creating OCP routes
+(e.g. when routes are managed externally). Set `threescale.zync_routes_disabled: true` in config.
+Capability provider raises an error at startup if this config does not match the actual gateway type.
+
+*Capabilities*: "APICAST, CUSTOM_ENVIRONMENT, PRODUCTION_GATEWAY, SAME_CLUSTER, LOGS, JAEGER, STANDARD_GATEWAY, ZYNC_OIDC_SYNC"
+(no `ZYNC_ROUTES` — route creation tests are automatically skipped)
+```
+threescale:
+  zync_routes_disabled: true
+gateway:
+  default:
+    kind: "SystemApicast"
+```
 ## Container APIcast
 *Description*: Similar to Self-managed APIcast (at least for now), used for interop testing.
 Expects gateway deployed remotely without any access to it.

testsuite/capabilities/__init__.py

@@ -32,8 +32,8 @@ class Capability(enum.Enum):
     SCALING = "scaling"                         # If the current environment supports scaling of components
     FIPS = "fips"
     NOFIPS = "no-fips"
-    ZYNC = "zync"                                # Zync is enabled (gateway is not ZyncLessApicast)
-    SSO = "sso"                                  # RHSSO/RHBK is configured and zync is enabled
+    ZYNC_ROUTES = "zync-routes"                  # Zync creates OCP routes for APIcast endpoints
+    ZYNC_OIDC_SYNC = "zync-oidc-sync"            # Zync syncs OIDC clients with RHSSO/RHBK
     # fmt: on
 
 

testsuite/capabilities/providers.py

@@ -1,5 +1,6 @@
 """This module is where most of the capability providers should be to not have them scattered around"""
 
+from openshift_client import Missing
 from weakget import weakget
 
 from testsuite import gateways
@@ -67,25 +68,36 @@ def fips():
 CapabilityRegistry().register_provider(fips, {Capability.NOFIPS, Capability.FIPS})
 
 
-def zync():
-    """Zync is available when the gateway is not ZyncLessApicast,
-    unless zync_routes_disabled is set (zync runs but doesn't create routes)"""
-    if issubclass(gateways.default, ZyncLessApicast):
-        if not weakget(settings)["threescale"]["gateway"]["default"]["zync_routes_disabled"] % False:
-            return {}
-    return {Capability.ZYNC}
-
+def zync_capabilities():
+    """Determines zync capabilities based on gateway type and config.
 
-CapabilityRegistry().register_provider(zync, {Capability.ZYNC})
+    Case 1 (standard zync): gateway is not ZyncLessApicast and threescale.zync_routes_disabled is not set.
+    Provides ZYNC_ROUTES + ZYNC_OIDC_SYNC. Fails fast if APIManager has zync disabled.
 
+    Case 2 (zync without routes): threescale.zync_routes_disabled: true in config.
+    Provides only ZYNC_OIDC_SYNC.
 
-def sso():
-    """SSO is available when zync is enabled and RHSSO is configured in dynaconf"""
-    if Capability.ZYNC not in CapabilityRegistry():
-        return {}
-    if not weakget(settings)["rhsso"]["password"] % None:
+    Case 3 (zync disabled): gateway is ZyncLessApicast.
+    Provides no zync capabilities. Fails fast if APIManager has zync enabled.
+    """
+    if issubclass(gateways.default, ZyncLessApicast):
+        enabled = openshift().api_manager.get_path("spec/zync/enabled")
+        if enabled is Missing or enabled:
+            raise RuntimeError("ZyncLessApicast requires zync to be disabled in APIManager (spec/zync/enabled: false)")
         return {}
-    return {Capability.SSO}
+
+    zync_routes_disabled = weakget(settings)["threescale"]["zync_routes_disabled"] % False
+
+    if zync_routes_disabled:
+        return {Capability.ZYNC_OIDC_SYNC}
+
+    enabled = openshift().api_manager.get_path("spec/zync/enabled")
+    if enabled is not Missing and not enabled:
+        raise RuntimeError(
+            "Config expects standard zync but APIManager has zync disabled. "
+            "Use ZyncLessApicast gateway or set threescale.zync_routes_disabled: true."
+        )
+    return {Capability.ZYNC_ROUTES, Capability.ZYNC_OIDC_SYNC}
 
 
-CapabilityRegistry().register_provider(sso, {Capability.SSO})
+CapabilityRegistry().register_provider(zync_capabilities, {Capability.ZYNC_ROUTES, Capability.ZYNC_OIDC_SYNC})

testsuite/gateways/apicast/zyncless.py

@@ -3,10 +3,8 @@
 from typing import TYPE_CHECKING
 from urllib.parse import urlparse
 
-from openshift_client import Missing
 from threescale_api.resources import Service
 
-from testsuite.config import settings
 from testsuite.gateways.apicast.system import SystemApicast
 from testsuite.openshift.objects import Routes
 
@@ -27,13 +25,6 @@ def __init__(self, staging: bool, openshift: "Optional[OpenShiftClient]" = None)
         super().__init__(staging, openshift)
         self._routes: "List[str]" = []
 
-    def create(self):
-        zync_routes_disabled = settings["threescale"]["gateway"]["default"].get("zync_routes_disabled", False)
-        if not zync_routes_disabled:
-            enabled = self.openshift.api_manager.get_path("spec/zync/enabled")
-            if enabled is Missing or enabled:
-                raise RuntimeError("ZyncLessApicast requires zync to be disabled in the APIManager spec")
-
     @staticmethod
     def _route_name(service: Service, production: bool = False) -> str:
         env = "prod" if production else "stage"

testsuite/tests/conftest.py

@@ -99,6 +99,18 @@ def pytest_addoption(parser):
     parser.addoption("--sso-only", action="store_true", default=False, help="Run only tests that uses RHSSO/RHBK")
 
 
+def pytest_sessionstart(session: pytest.Session) -> None:
+    """Fail fast if zync configuration doesn't match the actual 3scale deployment.
+    Only runs on the controller process, not on xdist workers."""
+    if hasattr(session.config, "workerinput"):
+        return
+    try:
+        _ = Capability.ZYNC_ROUTES in CapabilityRegistry()
+        _ = Capability.ZYNC_OIDC_SYNC in CapabilityRegistry()
+    except RuntimeError as e:
+        pytest.exit(f"Zync configuration mismatch: {e}", returncode=3)
+
+
 def pytest_configure(config: pytest.Config) -> None:
     """Ensure mutually exclusive options"""
     fuzz = config.getoption("--fuzz")
@@ -686,8 +698,8 @@ def rhsso_service_info(request, testconfig, tools, rhsso_kind, rhsso_route):
     Set up client for zync
     :return: dict with all important details
     """
-    if Capability.SSO not in CapabilityRegistry():
-        warn_and_skip("SSO capability not available: zync is disabled or RHSSO is not configured")
+    if Capability.ZYNC_OIDC_SYNC not in CapabilityRegistry():
+        warn_and_skip("ZYNC_OIDC_SYNC capability not available: zync is disabled or not running")
     rhsso = _resolve_rhsso(testconfig, tools, rhsso_route)
     if not rhsso:
         warn_and_skip("SSO admin password neither discovered not set in config", "fail")

testsuite/tests/custom_tenant/test_custom_tenant.py

@@ -9,7 +9,7 @@
 from testsuite.capabilities import Capability
 from testsuite.utils import blame
 
-pytestmark = pytest.mark.required_capabilities(Capability.ZYNC)
+pytestmark = pytest.mark.required_capabilities(Capability.ZYNC_ROUTES)
 
 
 @pytest.fixture(scope="session")

testsuite/tests/grafana/test_dashboards.py

@@ -8,7 +8,7 @@
 
 pytestmark = [
     pytest.mark.skipif(TESTED_VERSION < Version("2.9"), reason="TESTED_VERSION < Version('2.9')"),
-    pytest.mark.required_capabilities(Capability.OCP4, Capability.ZYNC),
+    pytest.mark.required_capabilities(Capability.OCP4, Capability.ZYNC_OIDC_SYNC),
     pytest.mark.issue("https://issues.redhat.com/browse/THREESCALE-7961"),
 ]
 

testsuite/tests/system/oidc/test_oidc_rhsso_flows.py

@@ -14,13 +14,15 @@
 import pytest
 from threescale_api.resources import Service
 
+from testsuite.capabilities import Capability
 from testsuite.rhsso import OIDCClientAuth
 from testsuite.utils import blame_desc
 
 pytestmark = [
     pytest.mark.issue("https://issues.jboss.org/browse/THREESCALE-1948"),
     pytest.mark.issue("https://issues.jboss.org/browse/THREESCALE-1949"),
     pytest.mark.issue("https://issues.jboss.org/browse/THREESCALE-1951"),
+    pytest.mark.required_capabilities(Capability.ZYNC_OIDC_SYNC),
 ]
 
 

testsuite/tests/system/oidc/test_openid_rhsso_will_delete_client.py

@@ -7,10 +7,11 @@
 from keycloak.exceptions import KeycloakGetError
 
 from testsuite import rawobj
+from testsuite.capabilities import Capability
 from testsuite.rhsso import OIDCClientAuthHook
 from testsuite.utils import randomize
 
-pytestmark = [pytest.mark.nopersistence]
+pytestmark = [pytest.mark.nopersistence, pytest.mark.required_capabilities(Capability.ZYNC_OIDC_SYNC)]
 
 
 @pytest.fixture(scope="module", autouse=True)

testsuite/tests/system/oidc/test_openid_rhsso_zync_sync.py

@@ -6,8 +6,11 @@
 import pytest
 from keycloak.exceptions import KeycloakGetError
 
+from testsuite.capabilities import Capability
 from testsuite.rhsso import OIDCClientAuthHook
 
+pytestmark = [pytest.mark.required_capabilities(Capability.ZYNC_OIDC_SYNC)]
+
 
 @pytest.fixture(scope="module", autouse=True)
 def rhsso_setup(lifecycle_hooks, rhsso_service_info):