Skip to content

Commit 096768b

Browse files
kvinwangkvinwang
committed
test(e2e): cover v0.5.11 mixed guest images
1 parent 815c155 commit 096768b

4 files changed

Lines changed: 54 additions & 38 deletions

File tree

‎test-suites/full-stack-compose/.env.example‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
# <store>/<image-name>/{bzImage,initramfs...,rootfs...,digest.txt,sha256sum.txt}
66
DSTACK_E2E_IMAGE_STORE=../../../meta-dstack/build/images
77
DSTACK_E2E_IMAGE_NAME=dstack-0.6.0
8+
DSTACK_E2E_OLD_IMAGE_NAME=dstack-0.5.11
89
DSTACK_E2E_PLATFORM=tdx
910

1011
# Exact released upgrade sources. Both are digest-pinned on Docker Hub and

‎test-suites/full-stack-compose/README.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,9 @@ would make a passing result irrelevant to production:
7373
- Docker and WireGuard kernel support
7474

7575
3. Provide an unpacked dstack image directory containing `digest.txt` and
76-
`sha256sum.txt`. Copy `.env.example` to `.env` when paths or ports differ.
76+
`sha256sum.txt` for both the current image (`DSTACK_E2E_IMAGE_NAME`) and the
77+
v0.5.11 compatibility image (`DSTACK_E2E_OLD_IMAGE_NAME`). Copy
78+
`.env.example` to `.env` when paths or ports differ.
7779

7880
## Run
7981

‎test-suites/full-stack-compose/scripts/render-config.sh‎

Lines changed: 47 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ VOLUMES_DIR=${DSTACK_E2E_VOLUMES_DIR:-$STATE_DIR/volumes}
1111
ARTIFACT_DIR=${DSTACK_E2E_ARTIFACT_DIR:-$STATE_DIR/artifacts}
1212
IMAGE_ROOT=${DSTACK_E2E_IMAGE_ROOT:-/images}
1313
IMAGE_NAME=${DSTACK_E2E_IMAGE_NAME:-dstack-0.6.0}
14+
OLD_IMAGE_NAME=${DSTACK_E2E_OLD_IMAGE_NAME:-dstack-0.5.11}
1415
PLATFORM=${DSTACK_E2E_PLATFORM:-tdx}
1516

1617
VMM_PORT=${DSTACK_E2E_VMM_PORT:-29080}
@@ -65,13 +66,6 @@ if ! getent ahostsv4 "$KMS_RPC_DOMAIN" >/dev/null 2>&1; then
6566
exit 1
6667
fi
6768

68-
image_dir="$IMAGE_ROOT/$IMAGE_NAME"
69-
if [[ ! -d "$image_dir" ]]; then
70-
echo "ERROR: image directory not found: $image_dir" >&2
71-
echo "Set DSTACK_E2E_IMAGE_STORE to a host directory containing $IMAGE_NAME/" >&2
72-
exit 1
73-
fi
74-
7569
digest_file=digest.txt
7670
if [[ "$PLATFORM" == "amd-sev-snp" || "$PLATFORM" == "sev-snp" || "$PLATFORM" == "snp" ]]; then
7771
PLATFORM=amd-sev-snp
@@ -81,33 +75,49 @@ elif [[ "$PLATFORM" != tdx ]]; then
8175
exit 1
8276
fi
8377

84-
if [[ ! -s "$image_dir/$digest_file" ]]; then
85-
echo "ERROR: missing $image_dir/$digest_file; production-compatible E2E never permits an unpinned OS image" >&2
86-
exit 1
87-
fi
88-
OS_IMAGE_HASH=$(tr -d '[:space:]' < "$image_dir/$digest_file")
89-
if [[ ! "$OS_IMAGE_HASH" =~ ^[0-9a-f]{64}$ ]]; then
90-
echo "ERROR: invalid OS image digest: $OS_IMAGE_HASH" >&2
91-
exit 1
92-
fi
78+
package_os_image() {
79+
local name=$1 image_dir="$IMAGE_ROOT/$1" image_hash
80+
if [[ ! -d "$image_dir" ]]; then
81+
echo "ERROR: image directory not found: $image_dir" >&2
82+
echo "Set DSTACK_E2E_IMAGE_STORE to a host directory containing $name/" >&2
83+
exit 1
84+
fi
85+
if [[ ! -s "$image_dir/$digest_file" ]]; then
86+
echo "ERROR: missing $image_dir/$digest_file; production-compatible E2E never permits an unpinned OS image" >&2
87+
exit 1
88+
fi
89+
image_hash=$(tr -d '[:space:]' < "$image_dir/$digest_file")
90+
if [[ ! "$image_hash" =~ ^[0-9a-f]{64}$ ]]; then
91+
echo "ERROR: invalid OS image digest for $name: $image_hash" >&2
92+
exit 1
93+
fi
94+
95+
# Build the exact flat archive consumed by the KMS verifier. Verify the
96+
# source first and include only files named by sha256sum.txt.
97+
(
98+
cd "$image_dir"
99+
sha256sum -c sha256sum.txt >&2
100+
mapfile -t measured_files < <(awk '{print $2}' sha256sum.txt)
101+
for file in "${measured_files[@]}"; do
102+
[[ "$file" != */* && -f "$file" ]] || {
103+
echo "ERROR: unsafe or missing measured image file: $file" >&2
104+
exit 1
105+
}
106+
done
107+
tar -czf "$ARTIFACT_DIR/os/mr_${image_hash}.tar.gz.tmp" \
108+
sha256sum.txt "${measured_files[@]}"
109+
)
110+
mv "$ARTIFACT_DIR/os/mr_${image_hash}.tar.gz.tmp" \
111+
"$ARTIFACT_DIR/os/mr_${image_hash}.tar.gz"
112+
printf '%s' "$image_hash"
113+
}
93114

94-
# Build the exact flat archive consumed by the KMS verifier. Verify the source
95-
# first and include only the measured files named by sha256sum.txt.
96-
(
97-
cd "$image_dir"
98-
sha256sum -c sha256sum.txt
99-
mapfile -t measured_files < <(awk '{print $2}' sha256sum.txt)
100-
for file in "${measured_files[@]}"; do
101-
[[ "$file" != */* && -f "$file" ]] || {
102-
echo "ERROR: unsafe or missing measured image file: $file" >&2
103-
exit 1
104-
}
105-
done
106-
tar -czf "$ARTIFACT_DIR/os/mr_${OS_IMAGE_HASH}.tar.gz.tmp" \
107-
sha256sum.txt "${measured_files[@]}"
108-
)
109-
mv "$ARTIFACT_DIR/os/mr_${OS_IMAGE_HASH}.tar.gz.tmp" \
110-
"$ARTIFACT_DIR/os/mr_${OS_IMAGE_HASH}.tar.gz"
115+
OS_IMAGE_HASH=$(package_os_image "$IMAGE_NAME")
116+
if [[ "$OLD_IMAGE_NAME" == "$IMAGE_NAME" ]]; then
117+
OLD_OS_IMAGE_HASH=$OS_IMAGE_HASH
118+
else
119+
OLD_OS_IMAGE_HASH=$(package_os_image "$OLD_IMAGE_NAME")
120+
fi
111121

112122
token_file="$STATE_DIR/gateway-admin-token"
113123
if [[ ! -s "$token_file" ]]; then
@@ -237,8 +247,10 @@ VM_DIR=$VM_DIR
237247
ARTIFACT_DIR=$ARTIFACT_DIR
238248
IMAGE_ROOT=$IMAGE_ROOT
239249
IMAGE_NAME=$IMAGE_NAME
250+
OLD_IMAGE_NAME=$OLD_IMAGE_NAME
240251
PLATFORM=$PLATFORM
241252
OS_IMAGE_HASH=$OS_IMAGE_HASH
253+
OLD_OS_IMAGE_HASH=$OLD_OS_IMAGE_HASH
242254
VMM_PORT=$VMM_PORT
243255
AUTH_PORT=$AUTH_PORT
244256
ARTIFACT_PORT=$ARTIFACT_PORT
@@ -271,5 +283,6 @@ echo " auth: http://10.0.2.2:${AUTH_PORT}"
271283
echo " artifacts: http://10.0.2.2:${ARTIFACT_PORT}"
272284
echo " old KMS: https://${KMS_RPC_DOMAIN}:${KMS_OLD_HOST_PORT}"
273285
echo " latest KMS: https://${KMS_RPC_DOMAIN}:${KMS_LATEST_HOST_PORT}"
274-
echo " image: ${IMAGE_NAME} (${OS_IMAGE_HASH})"
286+
echo " current image: ${IMAGE_NAME} (${OS_IMAGE_HASH})"
287+
echo " old image: ${OLD_IMAGE_NAME} (${OLD_OS_IMAGE_HASH})"
275288
echo " gateway app: ${GATEWAY_APP_ID}"

‎test-suites/full-stack-compose/scripts/runner.sh‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -568,12 +568,12 @@ render_app() {
568568
}
569569

570570
deploy_app() {
571-
local label=$1 mode=$2 kms_url=$3 out vm_id
571+
local label=$1 mode=$2 kms_url=$3 guest_image=${4:-$IMAGE_NAME} out vm_id
572572
render_app "$label" "$mode"
573573
log "deploying $label app CVM (forced TDX $mode)"
574574
if ! out=$("${VMM_CLI[@]}" deploy \
575575
--name "${SUITE_PREFIX}-${label}" \
576-
--image "$IMAGE_NAME" \
576+
--image "$guest_image" \
577577
--compose "$WORK_DIR/${label}.app-compose.json" \
578578
--kms-url "$kms_url" \
579579
--gateway-url "$GATEWAY1_URL" \
@@ -806,7 +806,7 @@ phase_upgrade() {
806806
gateway_version 2 old
807807
bootstrap_gateway
808808

809-
deploy_app legacy legacy "$KMS_OLD_URL"
809+
deploy_app legacy legacy "$KMS_OLD_URL" "$OLD_IMAGE_NAME"
810810
verify_app_via_gateway legacy 1
811811
verify_app_via_gateway legacy 2
812812
capture_kms_identity old "$KMS_OLD_HOST_PORT" "$(cat "$WORK_DIR/legacy.app_id")"

0 commit comments

Comments
 (0)