y-cluster-validate-ystack

#!/usr/bin/env bash
[ -z "$DEBUG" ] || set -x
set -eo pipefail

YSTACK_HOME="$(cd "$(dirname "$0")/.." && pwd)"

CONTEXT=""

while [ $# -gt 0 ]; do
  case "$1" in
    --context=*) CONTEXT="${1#*=}"; shift ;;
    *) echo "Unknown flag: $1" >&2; exit 1 ;;
  esac
done

[ -z "$CONTEXT" ] && echo "Usage: y-cluster-validate-ystack --context=<name>" && exit 1

k() {
  kubectl --context="$CONTEXT" "$@"
}

# HTTP requests to cluster services via the K8s API proxy (works regardless of provisioner)
# Usage: kurl <namespace> <service[:port]> <path>
# Pass svc:port (e.g. y-kustomize:8944) when the service doesn't expose port 80.
kurl() {
  local ns="$1" svc="$2" path="$3"
  case "$svc" in
    *:*) k get --raw "/api/v1/namespaces/$ns/services/$svc/proxy/$path" ;;
    *)   k get --raw "/api/v1/namespaces/$ns/services/$svc:80/proxy/$path" ;;
  esac
}

PASS=0
FAIL=0
report() {
  local name="$1"
  local result="$2"
  if [ "$result" = "ok" ]; then
    PASS=$((PASS + 1))
    echo "[y-cluster-validate-ystack]   PASS  $name"
  else
    FAIL=$((FAIL + 1))
    echo "[y-cluster-validate-ystack]   FAIL  $name - $result"
  fi
}

run_pre_build_checks() {
  local phase="$1"
  echo "[y-cluster-validate-ystack] Pre-build checks ($phase)"

  k get ns ystack >/dev/null 2>&1 \
    && report "namespace ystack ($phase)" "ok" \
    || report "namespace ystack ($phase)" "not found"

  k get crd gateways.gateway.networking.k8s.io >/dev/null 2>&1 \
    && report "gateway-api CRDs ($phase)" "ok" \
    || report "gateway-api CRDs ($phase)" "not installed"

  k -n ystack get gateway ystack >/dev/null 2>&1 \
    && report "gateway ystack ($phase)" "ok" \
    || report "gateway ystack ($phase)" "not found"

  ROLLOUT=$(k -n blobs rollout status deploy/versitygw --timeout=5s 2>&1) \
    && report "versitygw rollout ($phase)" "ok" \
    || report "versitygw rollout ($phase)" "$ROLLOUT"

  CLUSTER_IP=$(k -n ystack get svc builds-registry -o=jsonpath='{.spec.clusterIP}' 2>/dev/null)
  if [ "$CLUSTER_IP" = "10.43.0.50" ]; then
    report "builds-registry clusterIP ($phase)" "ok"
  else
    report "builds-registry clusterIP ($phase)" "got '$CLUSTER_IP', expected 10.43.0.50"
  fi

  k -n ystack get httproute builds-registry >/dev/null 2>&1 \
    && report "httproute builds-registry ($phase)" "ok" \
    || report "httproute builds-registry ($phase)" "not found"

  PROD_IP=$(k -n ystack get svc prod-registry -o=jsonpath='{.spec.clusterIP}' 2>/dev/null)
  if [ "$PROD_IP" = "10.43.0.51" ]; then
    report "prod-registry clusterIP ($phase)" "ok"
  else
    report "prod-registry clusterIP ($phase)" "got '$PROD_IP', expected 10.43.0.51"
  fi

  k -n ystack get grpcroute buildkitd >/dev/null 2>&1 \
    && report "grpcroute buildkitd ($phase)" "ok" \
    || report "grpcroute buildkitd ($phase)" "not found"

  if k get ns monitoring >/dev/null 2>&1; then
    k -n monitoring get prometheus now >/dev/null 2>&1 \
      && report "prometheus now ($phase)" "ok" \
      || report "prometheus now ($phase)" "not found"

    k -n monitoring get httproute prometheus-now >/dev/null 2>&1 \
      && report "httproute prometheus-now ($phase)" "ok" \
      || report "httproute prometheus-now ($phase)" "not found"
  else
    echo "[y-cluster-validate-ystack]   SKIP  prometheus - monitoring namespace not installed"
    echo "[y-cluster-validate-ystack]   SKIP  httproute prometheus-now - monitoring namespace not installed"
  fi

  k -n ystack get statefulset buildkitd >/dev/null 2>&1 \
    && report "buildkitd statefulset ($phase)" "ok" \
    || report "buildkitd statefulset ($phase)" "not found"

  echo "[y-cluster-validate-ystack] Waiting for registry rollout (up to 10s)"
  ROLLOUT_REG=$(k -n ystack rollout status deploy/registry --timeout=10s 2>&1) \
    && report "registry rollout ($phase)" "ok" \
    || report "registry rollout ($phase)" "$ROLLOUT_REG"

  echo "[y-cluster-validate-ystack] Registry access"
  CATALOG=$(kurl ystack builds-registry v2/_catalog 2>&1) && \
    echo "$CATALOG" | grep -q "repositories" \
    && report "registry v2 API ($phase)" "ok" \
    || report "registry v2 API ($phase)" "no response"

  echo "[y-cluster-validate-ystack] y-kustomize bases"
  if k -n ystack get deployment y-kustomize -o=jsonpath='{.status.readyReplicas}' 2>/dev/null | grep -q '^[1-9]'; then
    kurl ystack y-kustomize:8944 v1/blobs/setup-bucket-job/base-for-annotations.yaml | k apply --dry-run=client -f - >/dev/null 2>&1 \
      && report "y-kustomize blobs base ($phase)" "ok" \
      || report "y-kustomize blobs base ($phase)" "not serving valid YAML"
    kurl ystack y-kustomize:8944 v1/kafka/setup-topic-job/base-for-annotations.yaml | k apply --dry-run=client -f - >/dev/null 2>&1 \
      && report "y-kustomize kafka base ($phase)" "ok" \
      || report "y-kustomize kafka base ($phase)" "not serving valid YAML"
  else
    echo "[y-cluster-validate-ystack]   SKIP  y-kustomize blobs base ($phase) - deploy/y-kustomize not ready (likely host-side serve in use; v0.3.0 image not released)"
    echo "[y-cluster-validate-ystack]   SKIP  y-kustomize kafka base ($phase) - deploy/y-kustomize not ready (likely host-side serve in use; v0.3.0 image not released)"
  fi
}

echo "[y-cluster-validate-ystack] Dev cluster validation: context=$CONTEXT"

# Run 1: verify all resources exist and services respond
run_pre_build_checks "run-1"

# Targeted restarts to validate persistence
echo "[y-cluster-validate-ystack] Restarting stateful services to validate persistence"

if k get ns blobs >/dev/null 2>&1; then
  echo "[y-cluster-validate-ystack] Restarting versitygw"
  k -n blobs rollout restart deploy/versitygw
  k -n blobs rollout status deploy/versitygw --timeout=60s
fi

if k get ns ystack >/dev/null 2>&1; then
  echo "[y-cluster-validate-ystack] Restarting registry"
  k -n ystack rollout restart deploy/registry
  k -n ystack rollout status deploy/registry --timeout=60s
fi

# Run 2: confirm state survived restarts
run_pre_build_checks "run-2"

echo "[y-cluster-validate-ystack] Kafka topic create + produce + consume"
if k get ns kafka >/dev/null 2>&1; then
  TOPIC_NAME="y-cluster-validate-ystack"

  # Create topic via y-kustomize setup job
  k -n kafka delete job setup-topic 2>/dev/null || true # y-script-lint:disable=or-true # best-effort: previous-run leftover may not exist
  k apply -k "$YSTACK_HOME/kafka/validate-topic/" 2>&1 | head -5
  k -n kafka wait --for=condition=complete job/setup-topic --timeout=60s 2>&1 \
    && report "kafka topic create" "ok" \
    || report "kafka topic create" "job did not complete"

  # Verify topic exists
  y-cluster-kafka --context="$CONTEXT" topic list 2>&1 | grep -q "$TOPIC_NAME" \
    && report "kafka topic list" "ok" \
    || report "kafka topic list" "topic $TOPIC_NAME not found"

  # Produce a test message
  echo '{"validate":"ystack"}' | y-cluster-kafka --context="$CONTEXT" topic produce "$TOPIC_NAME" 2>&1 \
    && report "kafka topic produce" "ok" \
    || report "kafka topic produce" "failed"

  # Consume and verify
  CONSUMED=$(y-cluster-kafka --context="$CONTEXT" topic consume "$TOPIC_NAME" -n 1 -f '%v' 2>&1)
  echo "$CONSUMED" | grep -q '"validate"' \
    && report "kafka topic consume" "ok" \
    || report "kafka topic consume" "unexpected output: $CONSUMED"
else
  echo "[y-cluster-validate-ystack]   SKIP  kafka - namespace not installed"
fi

echo "[y-cluster-validate-ystack] Build + deploy (y-build)"
EXAMPLE_DIR="$YSTACK_HOME/examples/y-build"
REGISTRY_HOST="builds-registry.ystack.svc.cluster.local"
VALIDATE_IMAGE="$REGISTRY_HOST/ystack-validate/y-build-test:latest"
y-buildkitd-available --context="$CONTEXT" 2>&1 || true # y-script-lint:disable=or-true # advisory pre-check; y-build below is the real gate
echo "[y-cluster-validate-ystack] Building example image"
if BUILD_CONTEXT="$EXAMPLE_DIR" IMAGE="$VALIDATE_IMAGE" IMPORT_CACHE=false EXPORT_CACHE=false y-build; then
  report "y-build" "ok"

  kurl ystack builds-registry v2/ystack-validate/y-build-test/tags/list 2>&1 | grep -q '"latest"' \
    && report "y-build-test pushed" "ok" \
    || report "y-build-test pushed" "image not found in registry"

  # Node-side pull through the registries.yaml mirror. The build/push
  # path above goes pod -> Service ClusterIP, which works without any
  # mirror; this step exercises the path that the cluster-config
  # `registries:` block enables -- containerd on the node resolving
  # builds-registry.ystack.svc.cluster.local to its magic ClusterIP.
  # imagePullPolicy=Always forces a fetch even if a local cache exists.
  PULL_POD=y-build-test-pull
  k -n ystack delete pod "$PULL_POD" --ignore-not-found --wait=true >/dev/null 2>&1 || true # y-script-lint:disable=or-true # best-effort cleanup before run
  # The just-pushed image is built FROM ghcr.io/yolean/static-web-server,
  # a distroless image whose entrypoint is `sws` (no shell, no /bin/true).
  # Don't override --command; let sws run, and treat Pod-Ready as the
  # signal that containerd resolved + pulled via the registries.yaml
  # mirror. The post-run delete cleans up the long-running server.
  k -n ystack run "$PULL_POD" --image="$VALIDATE_IMAGE" \
    --image-pull-policy=Always --restart=Never >/dev/null
  if k -n ystack wait --for=condition=Ready "pod/$PULL_POD" --timeout=60s >/dev/null 2>&1; then
    report "y-build-test node pull (registries.yaml mirror)" "ok"
  else
    PULL_REASON=$(k -n ystack get pod "$PULL_POD" -o jsonpath='{.status.containerStatuses[0].state.waiting.reason}{"/"}{.status.phase}' 2>/dev/null)
    report "y-build-test node pull (registries.yaml mirror)" "pod state: ${PULL_REASON:-unknown}"
  fi
  k -n ystack delete pod "$PULL_POD" --ignore-not-found >/dev/null 2>&1 || true # y-script-lint:disable=or-true # best-effort cleanup
else
  report "y-build" "build failed"
fi

echo "[y-cluster-validate-ystack] Results: $PASS passed, $FAIL failed"

if [ "$FAIL" -gt 0 ]; then
  exit 1
fi