From fa76272cbe09fc33da5dba356d5fd064b804ac5b Mon Sep 17 00:00:00 2001 From: politerealism Date: Mon, 12 Oct 2026 10:10:10 -0400 Subject: [PATCH 1/2] test(podman): run the e2e binaries that pass in the tmachine guest Remove ten binaries from podmanE2eFollowUpBinaries so the rootless tmachine e2e-podman archive runs them: credential_gating, forward_proxy_graphql_l7, forward_proxy_jsonrpc_l7, forward_proxy_l7_bypass, host_gateway_alias, landlock, no_proxy, podman_oci_identity, provider_refresh_handles, and websocket_conformance. All ten passed in two consecutive probe runs. Update the exclusion comments and TESTING.md to match what the remaining entries still need. Contributes to #3712. Signed-off-by: politerealism --- TESTING.md | 4 ++-- tests/artifacts.nix | 28 ++++++++-------------------- 2 files changed, 10 insertions(+), 22 deletions(-) diff --git a/TESTING.md b/TESTING.md index a1c2f9476e..0f255c1f36 100644 --- a/TESTING.md +++ b/TESTING.md @@ -305,8 +305,8 @@ Rust feature and preloads its Python workload image into the rootless Podman store. The separate `driver-podman` testsuite compares OpenShell and direct Podman user-namespace mappings for the default, `auto`, `keep-id`, and private profiles. The E2E archive excludes binaries that still depend on wrapper-owned -gateway controls, host fixtures, missing guest tools, or nondeterministic relay -setup. The `driver-podman` suite replaces the removed `podman_userns` E2E +gateway controls, SPIFFE fixtures, the caller driver-config setting, or other +guest setup. The `driver-podman` suite replaces the removed `podman_userns` E2E binary. `tests/artifacts.nix` keeps the follow-up exclusions explicit and uses the same filter for the generated inventory, so excluded binaries cannot appear as false passes or silently re-enter the archive. diff --git a/tests/artifacts.nix b/tests/artifacts.nix index c86d8f6d30..9d65c3ec09 100644 --- a/tests/artifacts.nix +++ b/tests/artifacts.nix @@ -96,32 +96,21 @@ let output = "artifacts/test-archives/${muslToolchain.target}/provider-refresh-keycloak-tests.tar"; }; - # Follow-up: migrate these wrapper-coupled tests once tmachine provides their - # managed-gateway controls, SPIFFE fixtures, caller driver-config setting, - # guest tools, and matching workload-image identity behavior. The corporate - # proxy and gateway-start binaries currently self-skip without wrapper-owned - # gateway metadata, so exclude them rather than report false passes. + # Follow-up: binaries that do not yet run in the rootless tmachine guest. They + # need wrapper-owned managed-gateway controls (restart, configuration), SPIFFE + # fixtures, the caller driver-config setting, or guest tools. The corporate + # proxy and gateway-start binaries self-skip without wrapper-owned gateway + # metadata, so exclude them rather than report false passes. podmanE2eFollowUpBinaries = [ - "credential_gating" "driver_config_volume" - "forward_proxy_graphql_l7" - "forward_proxy_jsonrpc_l7" - "forward_proxy_l7_bypass" - "host_gateway_alias" - "landlock" "local_driver_token_restart" - # Standalone tmachine runs can time out while opening the localhost relay. - # Follow up on making the relay setup deterministic before restoring it. - "no_proxy" "podman_corporate_proxy" "podman_gateway_start" - "podman_oci_identity" "provider_auto_create" - # The provider-refresh feature suite covers revoked Keycloak grants. This - # binary instead covers stable workload handles across repeated rotations - # and explicit refresh reconfiguration in a long-running sandbox. - "provider_refresh_handles" "provider_token_exchange" + # One test times out reaching support-container IPs from the sandbox in the + # rootless guest; the other tests in the binary pass. Nextest archive + # filters cannot select individual tests, so keep the complete binary here. "proxy_egress_pipeline" # Conformance covers stop/start workspace preservation and deletion while # stopped. The remaining canonical-main, TTY, attachment replay, and @@ -130,7 +119,6 @@ let "sandbox_lifecycle" # Needs a prebuilt musl DNS probe in guest artifact mode; tracked in #3009. "transparent_tcp" - "websocket_conformance" "workspace_lifecycle" ]; podmanE2eArchiveFilter = From f6f45074b1cfe5c83ab31407e6461b24b38a0662 Mon Sep 17 00:00:00 2001 From: politerealism Date: Mon, 12 Oct 2026 10:36:37 -0400 Subject: [PATCH 2/2] test(podman): explain why each remaining e2e binary is excluded Give every remaining podmanE2eFollowUpBinaries entry its own reason, and mark the five that the wrapper-based Podman lane still runs (driver_config_volume, local_driver_token_restart, podman_corporate_proxy, podman_gateway_start, provider_token_exchange) so it is clear they are covered there until tmachine provides what they need. Contributes to #3712. Signed-off-by: politerealism --- tests/artifacts.nix | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/tests/artifacts.nix b/tests/artifacts.nix index 9d65c3ec09..72fe4c2c36 100644 --- a/tests/artifacts.nix +++ b/tests/artifacts.nix @@ -96,17 +96,25 @@ let output = "artifacts/test-archives/${muslToolchain.target}/provider-refresh-keycloak-tests.tar"; }; - # Follow-up: binaries that do not yet run in the rootless tmachine guest. They - # need wrapper-owned managed-gateway controls (restart, configuration), SPIFFE - # fixtures, the caller driver-config setting, or guest tools. The corporate - # proxy and gateway-start binaries self-skip without wrapper-owned gateway - # metadata, so exclude them rather than report false passes. + # Follow-up: binaries that do not yet run in the rootless tmachine guest. Each + # entry says what it needs. Entries marked "wrapper lane" still run in the + # wrapper-based Podman lane (`mise run e2e:podman:ci`), so they are covered + # there until tmachine provides what they need. podmanE2eFollowUpBinaries = [ + # Needs the caller driver-config settings (`allow_driver_config`, + # `enable_bind_mounts`), which the tmachine gateway does not enable. Wrapper + # lane. "driver_config_volume" + # The next three self-skip without wrapper-owned gateway metadata (restart + # and configuration control), so exclude them rather than report false + # passes. Wrapper lane. "local_driver_token_restart" "podman_corporate_proxy" "podman_gateway_start" + # Its move to conformance is deferred until the isolation work in #4120; see + # #4246. "provider_auto_create" + # Needs the SPIFFE fixtures that the wrapper sets up. Wrapper lane. "provider_token_exchange" # One test times out reaching support-container IPs from the sandbox in the # rootless guest; the other tests in the binary pass. Nextest archive