541a32a9cb
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 0s
CD Pipeline / cancel-stale-cd (push) Has been skipped
CD Pipeline / tests (push) Successful in 2m38s
CD Pipeline / build-and-deploy (push) Failing after 24m19s
CD Pipeline / post-deploy-checks (push) Has been skipped
125 lines
4.1 KiB
Python
125 lines
4.1 KiB
Python
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
from urllib.parse import urlparse
|
|
|
|
import yaml
|
|
|
|
ROOT = Path(__file__).resolve().parents[3]
|
|
EXPECTED_ORDER = {
|
|
"OLLAMA_URL": "http://34.143.170.20:11434",
|
|
"OLLAMA_SECONDARY_URL": "http://34.21.145.224:11434",
|
|
"OLLAMA_FALLBACK_URL": "http://192.168.0.111:11434",
|
|
}
|
|
|
|
|
|
def _load_single_doc(path: Path) -> dict:
|
|
docs = [doc for doc in yaml.safe_load_all(path.read_text()) if doc]
|
|
assert docs, f"no YAML documents in {path}"
|
|
return docs[0]
|
|
|
|
|
|
def _load_named_doc(path: Path, *, name: str) -> dict:
|
|
docs = [doc for doc in yaml.safe_load_all(path.read_text()) if doc]
|
|
return next(doc for doc in docs if doc["metadata"]["name"] == name)
|
|
|
|
|
|
def test_prod_configmap_preserves_ollama_policy_order() -> None:
|
|
configmap = _load_single_doc(ROOT / "k8s/awoooi-prod/04-configmap.yaml")
|
|
|
|
assert configmap["data"] | EXPECTED_ORDER == configmap["data"]
|
|
assert {configmap["data"][key] for key in EXPECTED_ORDER} == set(EXPECTED_ORDER.values())
|
|
|
|
|
|
def test_prod_deployment_preserves_ollama_policy_order() -> None:
|
|
deployment = _load_single_doc(ROOT / "k8s/awoooi-prod/06-deployment-api.yaml")
|
|
env = {
|
|
item["name"]: item.get("value")
|
|
for item in deployment["spec"]["template"]["spec"]["containers"][0]["env"]
|
|
}
|
|
|
|
assert {key: env[key] for key in EXPECTED_ORDER} == EXPECTED_ORDER
|
|
assert {env[key] for key in EXPECTED_ORDER} == set(EXPECTED_ORDER.values())
|
|
|
|
|
|
def test_retired_host110_ollama_proxy_is_absent_from_runtime_manifests() -> None:
|
|
for relative in (
|
|
"k8s/awoooi-prod/04-configmap.yaml",
|
|
"k8s/awoooi-prod/06-deployment-api.yaml",
|
|
"k8s/awoooi-dev/02-configmap.yaml",
|
|
):
|
|
text = (ROOT / relative).read_text(encoding="utf-8")
|
|
assert "192.168.0.110:11435" not in text
|
|
assert "192.168.0.110:11436" not in text
|
|
assert "192.168.0.110:11437" not in text
|
|
|
|
|
|
def test_prod_network_policy_allows_only_canonical_ollama_egress() -> None:
|
|
policy = _load_named_doc(
|
|
ROOT / "k8s/awoooi-prod/02-network-policy.yaml",
|
|
name="allow-required-egress",
|
|
)
|
|
ollama_rules = [
|
|
rule
|
|
for rule in policy["spec"]["egress"]
|
|
if any(int(port["port"]) == 11434 for port in rule.get("ports", []))
|
|
]
|
|
|
|
assert len(ollama_rules) == 1
|
|
assert ollama_rules[0]["ports"] == [{"protocol": "TCP", "port": 11434}]
|
|
assert {
|
|
target["ipBlock"]["cidr"] for target in ollama_rules[0]["to"]
|
|
} == {
|
|
f"{urlparse(url).hostname}/32" for url in EXPECTED_ORDER.values()
|
|
}
|
|
|
|
host110_rules = [
|
|
rule
|
|
for rule in policy["spec"]["egress"]
|
|
if any(
|
|
target.get("ipBlock", {}).get("cidr") == "192.168.0.110/32"
|
|
for target in rule.get("to", [])
|
|
)
|
|
]
|
|
assert host110_rules
|
|
assert {11434, 11435, 11436, 11437}.isdisjoint(
|
|
{
|
|
int(port["port"])
|
|
for rule in host110_rules
|
|
for port in rule.get("ports", [])
|
|
}
|
|
)
|
|
|
|
|
|
def test_host111_allowlist_admits_k3s_direct_and_retires_host110_transport() -> None:
|
|
playbook = (
|
|
ROOT / "infra/ansible/playbooks/111-ollama-fallback.yml"
|
|
).read_text(encoding="utf-8")
|
|
assert "192.168.0.120/32" in playbook
|
|
assert "192.168.0.121/32" in playbook
|
|
assert "192.168.0.110/32" not in playbook
|
|
|
|
retired_deployer = (
|
|
ROOT / "ops/nginx/deploy-ollama-proxy-110.sh"
|
|
).read_text(encoding="utf-8")
|
|
assert "exit 78" in retired_deployer
|
|
assert "NGINX_CONF=" not in retired_deployer
|
|
assert "proxy_pass" not in retired_deployer
|
|
|
|
|
|
def test_nginx_catalog_cannot_recreate_retired_host110_ollama_transport() -> None:
|
|
for relative in (
|
|
"infra/ansible/playbooks/nginx-sync.yml",
|
|
"infra/ansible/playbooks/nginx-sync-readonly.yml",
|
|
):
|
|
text = (ROOT / relative).read_text(encoding="utf-8")
|
|
assert "hosts: host_110" not in text
|
|
assert "110-ollama-proxy.conf" not in text
|
|
assert "11435" not in text
|
|
assert "11436" not in text
|
|
assert "11437" not in text
|
|
|
|
assert not (
|
|
ROOT / "infra/ansible/roles/nginx/templates/110-ollama-proxy.conf.j2"
|
|
).exists()
|