Merge branch 'main' into feature/compliance-history

Author: guettli

Standards/scs-0007-v2-certification-integrators.md

@@ -39,7 +39,7 @@ As to remain backward compatibility with version 1 of this standard, the suffix
 
 ### General expectations
 
-The general expectation for certification is to provide proof of experience in setting up, operating and supporting SCS-compliant environments.
+The general expectation for certification is to provide proof of experience in setting up, operating and supporting SCS-compliant environments. This experience MUST remain in place for as long as the certification is valid.
 
 SCS is an open source community project with the goal of enabling digital sovereignty. As such, the commitment and support of this mission SHOULD be recognized and promoted beyond technical competence.
 

Tests/iaas/requirements.txt

@@ -5,26 +5,26 @@
 #    pip-compile requirements.in
 #
 boto3==1.42.86
-    # via -r requirements.in
+    # via -r iaas/requirements.in
 botocore==1.42.86
     # via
     #   boto3
     #   s3transfer
 certifi==2026.2.25
     # via
-    #   -c ../requirements.txt
+    #   -c iaas/../requirements.txt
     #   requests
 cffi==2.0.0
     # via
-    #   -c ../requirements.txt
+    #   -c iaas/../requirements.txt
     #   cryptography
 charset-normalizer==3.4.7
     # via
-    #   -c ../requirements.txt
+    #   -c iaas/../requirements.txt
     #   requests
 cryptography==46.0.7
     # via
-    #   -c ../requirements.txt
+    #   -c iaas/../requirements.txt
     #   openstacksdk
 decorator==5.2.1
     # via
@@ -34,7 +34,7 @@ dogpile-cache==1.5.0
     # via openstacksdk
 idna==3.11
     # via
-    #   -c ../requirements.txt
+    #   -c iaas/../requirements.txt
     #   requests
 iso8601==2.1.0
     # via
@@ -52,7 +52,7 @@ jsonpointer==3.1.1
 keystoneauth1==5.13.1
     # via openstacksdk
 openstacksdk==4.10.0
-    # via -r requirements.in
+    # via -r iaas/requirements.in
 os-service-types==1.8.2
     # via
     #   keystoneauth1
@@ -68,41 +68,41 @@ psutil==7.2.2
     # via openstacksdk
 pycparser==3.0
     # via
-    #   -c ../requirements.txt
+    #   -c iaas/../requirements.txt
     #   cffi
 python-dateutil==2.9.0.post0
     # via
-    #   -c ../requirements.txt
+    #   -c iaas/../requirements.txt
     #   botocore
 pyyaml==6.0.3
     # via
-    #   -c ../requirements.txt
+    #   -c iaas/../requirements.txt
     #   openstacksdk
 requests==2.33.1
     # via
-    #   -c ../requirements.txt
+    #   -c iaas/../requirements.txt
     #   keystoneauth1
 requestsexceptions==1.4.0
     # via openstacksdk
 s3transfer==0.16.0
     # via boto3
 six==1.17.0
     # via
-    #   -c ../requirements.txt
+    #   -c iaas/../requirements.txt
     #   python-dateutil
 stevedore==5.7.0
     # via
     #   dogpile-cache
     #   keystoneauth1
 typing-extensions==4.15.0
     # via
-    #   -c ../requirements.txt
+    #   -c iaas/../requirements.txt
     #   keystoneauth1
     #   openstacksdk
     #   os-service-types
-urllib3==2.6.3
+urllib3==2.7.0
     # via
-    #   -c ../requirements.txt
+    #   -c iaas/../requirements.txt
     #   botocore
     #   requests
 

Tests/kaas/plugin/cs_helper.py

@@ -41,13 +41,13 @@ def get_secret_data(api_instance: CoreV1Api, namespace, secret):
 
 def get_cluster_status(api_instance: CustomObjectsApi, namespace, name):
     return api_instance.get_namespaced_custom_object_status(
-        'cluster.x-k8s.io', 'v1beta1', namespace, 'clusters', name
+        'cluster.x-k8s.io', 'v1beta2', namespace, 'clusters', name
     )
 
 
 def delete_cluster(api_instance: CustomObjectsApi, namespace, name):
     """mimic `kubectl delete cluster`"""
     # beware: do not fiddle with propagation policy here, as this may lead to severe problems
     return api_instance.delete_namespaced_custom_object(
-        'cluster.x-k8s.io', 'v1beta1', namespace, 'clusters', name,
+        'cluster.x-k8s.io', 'v1beta2', namespace, 'clusters', name,
     )

Tests/kaas/plugin/plugin_clusterstacks.py

@@ -15,6 +15,7 @@
 
 
 TEMPLATE_KEYS = ('cluster', 'clusterstack', 'kubeconfig')
+TIMEOUTS = [30] * 40 + [0]  # wait at most 1200 seconds (20 minutes); sentinel value at the end
 
 
 class _ClusterOps:
@@ -44,6 +45,7 @@ def _get_phase(self, co_api: _csh.CustomObjectsApi):
 
     def create(self, co_api: _csh.CustomObjectsApi, cluster_dict):
         # repeat this because it's possible that a cluster object exists that is in Deleting phase
+        timeouts = iter(TIMEOUTS)
         while True:
             logger.debug(f'creating cluster object for {self.name}')
             try:
@@ -60,8 +62,11 @@ def create(self, co_api: _csh.CustomObjectsApi, cluster_dict):
                 logger.debug(f'cluster object for {self.name} already present in phase {phase}')
                 if phase.lower() in ('provisioned', 'provisioning'):
                     break
-                logger.debug(f'waiting 30 s for cluster {self.name} to vanish or become provisioned')
-                time.sleep(30)
+                timeout = next(timeouts)
+                if not timeout:
+                    raise RuntimeError(f"Timeout error while waiting on Cluster {self.name}")
+                logger.debug(f'waiting {timeout} s for cluster {self.name} to vanish or become provisioned')
+                time.sleep(timeout)
             else:
                 break
 
@@ -78,23 +83,34 @@ def delete(self, co_api: _csh.CustomObjectsApi):
         # it will take at least 5 s (and way longer if the cluster is already running)
         logger.debug(f'cluster {self.name} deletion requested; waiting 8 s for it to vanish')
         time.sleep(8)
+        timeouts = iter(TIMEOUTS)
         while True:
             phase = self._get_phase(co_api)
             if phase is None:
+                logger.debug(f"Cluster {self.name} deleted.")
                 break
             if phase.lower() != 'deleting':
                 raise RuntimeError(f'cluster {self.name} in phase {phase}; expected: Deleting')
-            logger.debug(f'cluster {self.name} still deleting; waiting 30 s for it to vanish')
-            time.sleep(30)
+            timeout = next(timeouts)
+            if not timeout:
+                raise RuntimeError(f"Cluster {self.name} has not gone away in time")
+            logger.debug(f'cluster {self.name} still deleting; waiting {timeout} s for it to vanish')
+            time.sleep(timeout)
 
     def get_kubeconfig(self, core_api: _csh.CoreV1Api):
         return _csh.get_secret_data(core_api, self.namespace, self.secret_name)
 
     def wait_for_cluster_ready(self, co_api: _csh.CustomObjectsApi):
-        while not self._get_condition_ready(co_api):
-            logger.debug(f'waiting 30 s for cluster {self.name} to become ready')
-            time.sleep(30)
-        logger.debug(f'cluster {self.name} appears to be ready')
+        timeouts = iter(TIMEOUTS)
+        while True:
+            if self._get_condition_ready(co_api):
+                logger.debug(f'cluster {self.name} appears to be ready')
+                break
+            timeout = next(timeouts)
+            if not timeout:
+                raise RuntimeError(f"Cluster {self.name} has not become ready in time")
+            logger.debug(f'waiting {timeout} s for cluster {self.name} to become ready')
+            time.sleep(timeout)
 
 
 def load_templates(env, basepath, fn_map, keys=TEMPLATE_KEYS):

Tests/kaas/plugin/plugin_gardener.py

@@ -15,6 +15,7 @@
 
 
 TEMPLATE_KEYS = ('shoot', 'kubeconfig')
+TIMEOUTS = [30] * 40 + [0]  # wait at most 1200 seconds (20 minutes); sentinel value at the end
 
 
 class _ShootOps:
@@ -35,6 +36,7 @@ def create(self, co_api: _gh.CustomObjectsApi, shoot_dict):
         # Gardener shoot reconciliation is idempotent, so we can just try to create.
         # If it exists, we check its state.
         # repeat this because it's possible that a cluster object exists that is in state Delete
+        timeouts = iter(TIMEOUTS)
         while True:
             logger.debug(f"creating shoot object for {self.name}")
             try:
@@ -55,8 +57,11 @@ def create(self, co_api: _gh.CustomObjectsApi, shoot_dict):
                 if state == 'Failed':
                     raise RuntimeError(f"Shoot {self.name} is in Failed state. Please check the Gardener dashboard.")
 
-                logger.debug(f'waiting 30 s for shoot {self.name} to proceed')
-                time.sleep(30)
+                timeout = next(timeouts)
+                if not timeout:
+                    raise RuntimeError(f"Timeout error while waiting on shoot {self.name}")
+                logger.debug(f'waiting {timeout} s for shoot {self.name} to proceed')
+                time.sleep(timeout)
             else:
                 break
 
@@ -74,41 +79,52 @@ def delete(self, co_api: _gh.CustomObjectsApi):
 
         logger.debug(f"Shoot {self.name} deletion requested; waiting 8 s for it to start deleting")
         time.sleep(8)
+        timeouts = iter(TIMEOUTS)
         while True:
             last_op = self._get_last_operation(co_api)
             if last_op is None:
                 logger.info(f"Shoot {self.name} has been deleted.")
                 break
 
-            if last_op.get('type') != 'Delete':
-                raise RuntimeError(f"Shoot {self.name} in unexpected state during deletion: {last_op!r}")
-            state = last_op.get('state', 'Unknown')
-            if state not in ('Processing', 'Succeeded'):
-                raise RuntimeError(f"Shoot {self.name} in unexpected state during deletion: state={state}")
+            timeout = next(timeouts)
+            if not timeout:
+                raise RuntimeError(f"Shoot {self.name} has not gone away in time")
 
-            if state == 'Processing':
+            state = last_op.get('state', 'Unknown')
+            if last_op.get('type') != 'Delete':
+                logger.debug(f"Shoot {self.name} in unexpected state during deletion: {last_op!r}; waiting {timeout} s")
+            elif state == 'Processing':
                 progress = last_op.get('progress', 0)
-                logger.debug(f"Shoot {self.name} is being deleted (progress: {progress} %); waiting 30 s")
+                logger.debug(f"Shoot {self.name} is being deleted (progress: {progress} %); waiting {timeout} s")
             elif state == 'Succeeded':
-                logger.info(f"Shoot {self.name} deletion succeeded, but object still exists. Waiting 30 s for it to vanish.")
-            time.sleep(30)
+                logger.info(f"Shoot {self.name} deletion succeeded, but object still exists. Waiting {timeout} s for it to vanish.")
+            else:
+                raise RuntimeError(f"Shoot {self.name} in unexpected state during deletion: state={state}")
+            time.sleep(timeout)
 
     def get_kubeconfig(self, api_client: ApiClient):
         return _gh.request_kubeconfig(api_client, self.namespace, self.name)
 
     def wait_for_shoot_ready(self, co_api: _gh.CustomObjectsApi):
-        last_op = self._get_last_operation(co_api)
-        while last_op is not None and last_op.get('state') not in ('Succeeded', 'Failed'):
+        timeouts = iter(TIMEOUTS)
+        while True:
+            last_op = self._get_last_operation(co_api)
+            if last_op is None:
+                raise RuntimeError(f"Shoot {self.name} object disappeared")
+
             state = last_op.get('state', 'Unknown')
+            if state == 'Succeeded':
+                logger.debug(f'shoot {self.name} appears to be ready')
+                return
+            if state not in ('Unknown', 'Processing'):
+                raise RuntimeError(f"Shoot {self.name} object in unexpected state {last_op.get('state')}")
+
+            timeout = next(timeouts)
+            if not timeout:
+                raise RuntimeError(f"Shoot {self.name} has not become ready in time")
             progress = last_op.get('progress', 0)
-            logger.debug(f'waiting 30 s for shoot {self.name} to become ready (current state: {state}, progress: {progress}%)')
-            time.sleep(30)
-            last_op = self._get_last_operation(co_api)
-        if last_op is None:
-            raise RuntimeError(f"Shoot {self.name} object disappeared or in state Failed")
-        if last_op.get('state') != 'Succeeded':
-            raise RuntimeError(f"Shoot {self.name} object in unexpected state {last_op.get('state')}")
-        logger.debug(f'shoot {self.name} appears to be ready')
+            logger.debug(f'waiting {timeout} s for shoot {self.name} to become ready (current state: {state}, progress: {progress}%)')
+            time.sleep(timeout)
 
 
 def load_templates(env, basepath, fn_map, keys=TEMPLATE_KEYS):