Skip to content

fix(e2e): compare config digests in the kind image check #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
juancarlosm merged 2 commits into from
Oct 29, 2026
Merged

fix(e2e): compare config digests in the kind image check #21

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cec3ac6
fix(e2e): compare config digests in the kind image check
juancarlosm Oct 29, 2026
75c8937
fix(e2e): pull dstack and postgres inside the kind node
juancarlosm Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 19 additions & 9 deletions hack/cluster.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,15 +101,22 @@ build_stamp() {
# on paths that do not end with the node holding the new bytes, and every one
# of the four times this trap fired, the load — not the build — was what
# silently did nothing.
#
# Both sides compare the image CONFIG digest, which is what crictl reports as
# the id. The host's `docker image inspect .Id` is not usable for that: with
# Docker's containerd image store (the GitHub runner default since 2026-10-26)
# it is the manifest digest, so it never matches even when the load worked.
# docker save's manifest.json names the config blob under either store.
verify_image_in_node() {
local img="$1" host_id node_id
host_id="$(docker image inspect "${img}" --format '{{.Id}}' 2>/dev/null || true)"
host_id="$(docker save "${img}" 2>/dev/null | tar -xO manifest.json 2>/dev/null \
| sed -n 's/.*"Config":"[^"]*\([0-9a-f]\{64\}\)[^"]*".*/sha256:\1/p' | head -1 || true)"
if [ -z "${host_id}" ]; then
echo "hack/cluster.sh: ${img} was never built on the host" >&2
return 1
fi
node_id="$(docker exec "${CLUSTER_NAME}-control-plane" \
crictl inspecti "${img}" -o json 2>/dev/null \
crictl inspecti -o json "${img}" 2>/dev/null \
| sed -n 's/.*"id": "\(sha256:[0-9a-f]*\)".*/\1/p' | head -1 || true)"
if [ "${host_id}" != "${node_id}" ]; then
echo "hack/cluster.sh: ${img} in the node is '${node_id:-<absent>}'," >&2
Expand Down Expand Up @@ -188,13 +195,16 @@ build_and_load_images() {
done
[ "${failed}" -eq 0 ] || exit 1

# dstack is pulled once and loaded, so the cluster never reaches the
# network during a test run.
docker image inspect "${DSTACK_IMAGE}" >/dev/null 2>&1 || docker pull "${DSTACK_IMAGE}"
kind load docker-image "${DSTACK_IMAGE}" --name "${CLUSTER_NAME}"

docker image inspect "${POSTGRES_IMAGE}" >/dev/null 2>&1 || docker pull "${POSTGRES_IMAGE}"
kind load docker-image "${POSTGRES_IMAGE}" --name "${CLUSTER_NAME}"
# dstack and postgres are pulled once, so the cluster never reaches the
# network during a test run. The node pulls them itself: they are
# multi-arch, and with Docker's containerd image store the host keeps only
# its own platform while `docker save` exports the whole index, so
# `kind load` fails with "content digest ... not found".
local node="${CLUSTER_NAME}-control-plane" img
for img in "${DSTACK_IMAGE}" "${POSTGRES_IMAGE}"; do
docker exec "${node}" crictl inspecti -o json "${img}" >/dev/null 2>&1 \
|| docker exec "${node}" crictl pull "${img}"
done
}

# wait_for_operator_leadership blocks until squall-operator actually HOLDS its
Expand Down
Loading