Add the flux user to allow copy offload testing

Signed-off-by: Anthony Floeder <anthony.floeder@hpe.com>

Author: ajfloeder

tools/kind.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2021-2024 Hewlett Packard Enterprise Development LP
+# Copyright 2021-2026 Hewlett Packard Enterprise Development LP
 # Other additional copyright holders may be indicated within.
 #
 # The entirety of this work is licensed under the Apache License,
@@ -22,6 +22,42 @@
 set -e
 set -o pipefail
 
+usage() {
+    echo "Usage: $0 [--no-argocd] <CMD>"
+    echo
+    echo "Options:"
+    echo "  --no-argocd             Deploy without ArgoCD using the legacy overlay."
+    echo "                          Installs cert-manager, mpi-operator, and lustre"
+    echo "                          operators directly instead of via ArgoCD."
+    echo
+    echo "Commands:"
+    echo "  create                  Create a new KIND cluster."
+    echo "  destroy                 Destroy the existing KIND cluster."
+    echo "  reset                   Destroy the existing KIND cluster and create"
+    echo "                          a new cluster. Note: locally-built images are"
+    echo "                          not automatically reloaded -- re-run 'push' or"
+    echo "                          './nnf-deploy make kind-push' after a reset."
+    echo "  push                    Execute 'make kind-push' in each submodule dir."
+    echo "  argocd_attach <new_password>"
+    echo "                          Login to the argocd instance and set the new"
+    echo "                          password. Then add the Git repo to the instance."
+    echo "  argocd_login <new_password>"
+    echo "                          Only do the login to the argocd instance and set"
+    echo "                          the password."
+    echo "  argocd_add_git_repo     Only add the git repo to the argocd instance."
+    echo "  help                    Show this help message."
+}
+
+NO_ARGOCD=
+while [[ "$1" == --* ]]; do
+    case "$1" in
+    --no-argocd) NO_ARGOCD=1 ;;
+    --help) usage; exit 0 ;;
+    *) echo "Unknown option: $1"; exit 1 ;;
+    esac
+    shift
+done
+
 CMD="$1"
 shift
 
@@ -32,6 +68,22 @@ function clear_mock_fs {
     fi
 }
 
+# Create the integration test user on KIND Rabbit worker nodes.
+# The nnf-integration-test suite verifies that UID/GID exist on Rabbit nodes
+# (defaults: UID=1051 GID=1052, the flux user). Without this, the BeforeSuite
+# check fails and no tests run.
+function create_test_user {
+    local uid=${NNF_USER_ID:-1051}
+    local gid=${NNF_GROUP_ID:-1052}
+
+    echo "Creating test user (UID=$uid, GID=$gid) on KIND Rabbit worker nodes..."
+    for node in $(kind get nodes | grep -v control-plane); do
+        # Create group and user if they don't already exist
+        docker exec "$node" sh -c "getent group $gid >/dev/null 2>&1 || groupadd -g $gid testgroup"
+        docker exec "$node" sh -c "getent passwd $uid >/dev/null 2>&1 || useradd -u $uid -g $gid -M -s /bin/bash testuser"
+    done
+}
+
 function create_cluster {
     CONFIG=kind-config.yaml
 
@@ -92,10 +144,35 @@ EOF
 
     kind create cluster --wait 60s --image=kindest/node:v1.31.2 --config $CONFIG
 
+    # Inject any corporate/IT-installed CA certificates from the macOS system
+    # keychain into the KIND nodes. These certs live in System.keychain (not the
+    # Apple-shipped roots) and are typically added by corporate TLS inspection
+    # proxies (e.g. Zscaler). On machines without such a proxy this is a no-op.
+    if [[ "$(uname)" == "Darwin" ]]; then
+        local CORP_CAS=/tmp/kind-corp-cas.pem
+        security export -k /Library/Keychains/System.keychain -t certs -f pemseq -o "$CORP_CAS" 2>/dev/null || true
+        if [[ -s "$CORP_CAS" ]]; then
+            echo "Injecting corporate CA certificates into KIND nodes..."
+            for node in $(kind get nodes); do
+                docker cp "$CORP_CAS" "$node:/usr/local/share/ca-certificates/corp-cas.crt"
+                docker exec "$node" update-ca-certificates
+                docker exec "$node" systemctl restart containerd
+            done
+        fi
+        rm -f "$CORP_CAS"
+    fi
+
     # Use the same init routines that we use on real hardware.
     # This applies taints and labels to rabbit nodes, and installs other
     # services that rabbit software requires.
+    if [[ -n $NO_ARGOCD ]]; then
+        echo "Deploying without ArgoCD (legacy overlay mode)..."
+        cp config/overlay-legacy.yaml-template overlay-legacy.yaml
+    fi
     ./nnf-deploy init
+
+    # Create the test user on Rabbit nodes for integration tests
+    create_test_user
 }
 
 function have_argocd {
@@ -180,23 +257,7 @@ function push_submodules {
     done
 }
 
-usage() {
-    echo "Usage: $0 <CMD>"
-    echo
-    echo "  create                  Create a new KIND cluster."
-    echo "  destroy                 Destroy the existing KIND cluster."
-    echo "  reset                   Destroy the existing KIND cluster and create"
-    echo "                          a new cluster."
-    echo "  push                    Execute 'make kind-push' in each submodule dir."
-    echo "  argocd_attach <new_password>"
-    echo "                          Login to the argocd instance and set the new"
-    echo "                          password. Then add the Git repo to the instance."
-    echo "  argocd_login <new_password>"
-    echo "                          Only do the login to the argocd instance and set"
-    echo "                          the password."
-    echo "  argocd_add_git_repo     Only add the git repo to the argocd instance."
 
-}
 
 if [[ "$CMD" == "create" ]]; then
     create_cluster
@@ -213,6 +274,8 @@ elif [[ "$CMD" == "argocd_login" ]]; then
     argocd_login "$*"
 elif [[ "$CMD" == "argocd_add_git_repo" ]]; then
     argocd_add_git_repo
+elif [[ "$CMD" == "help" || "$CMD" == "--help" ]]; then
+    usage
 else
     usage
     exit 1