Skip to content

chore(systemtest): keep UpCloud lanes out of the default set #516

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Myothas merged 1 commit into from
Oct 14, 2026
Merged

chore(systemtest): keep UpCloud lanes out of the default set #516

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 9 additions & 7 deletions .github/workflows/systemtest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,9 @@
# the platform and org the credential ids below live in)
# hetzner secrets SYSTEMTEST_SSH_KEY_CREDENTIAL_ID + SYSTEMTEST_HETZNER_CREDENTIAL_ID
# ovh secrets SYSTEMTEST_SSH_KEY_CREDENTIAL_ID + SYSTEMTEST_OVH_CREDENTIAL_ID
# upcloud secrets SYSTEMTEST_SSH_KEY_CREDENTIAL_ID + SYSTEMTEST_UPCLOUD_CREDENTIAL_ID
# upcloud (opt-in) secrets SYSTEMTEST_SSH_KEY_CREDENTIAL_ID + SYSTEMTEST_UPCLOUD_CREDENTIAL_ID
# (never scheduled: UpCloud is too costly to test on routinely, so
# only a dispatch naming upcloud or uks runs either lane)
# digitalocean secrets SYSTEMTEST_SSH_KEY_CREDENTIAL_ID + SYSTEMTEST_DIGITALOCEAN_CREDENTIAL_ID
# aws (opt-in) see below
# doks / uks / ovh_mks secret SYSTEMTEST_DIGITALOCEAN / _UPCLOUD / _OVH_CREDENTIAL_ID
Expand Down Expand Up @@ -81,13 +83,13 @@ on:
workflow_dispatch:
inputs:
providers:
description: 'Space-separated Ankra-managed providers to exercise (hetzner ovh upcloud digitalocean aws). Use "none" to skip the family. aws needs the SYSTEMTEST_AWS_* secrets and joins the scheduled default only when they exist.'
description: 'Space-separated Ankra-managed providers to exercise (hetzner ovh digitalocean upcloud aws). Use "none" to skip the family. upcloud is opt-in (never in the default: UpCloud is too costly to test on routinely). aws needs the SYSTEMTEST_AWS_* secrets and joins the scheduled default only when they exist.'
required: false
default: 'hetzner ovh upcloud digitalocean'
default: 'hetzner ovh digitalocean'
managed_providers:
description: 'Space-separated cloud-managed providers to exercise (doks uks gke ovh_mks aks eks). Use "none" to skip the family.'
description: 'Space-separated cloud-managed providers to exercise (doks gke ovh_mks aks eks uks). Use "none" to skip the family. uks is opt-in (never in the default: UpCloud is too costly to test on routinely).'
required: false
default: 'doks uks gke ovh_mks aks eks'
default: 'doks gke ovh_mks aks eks'
parallel:
description: 'Run the selected targets concurrently (1) or one at a time (0).'
required: false
Expand All @@ -113,8 +115,8 @@ jobs:
timeout-minutes: 240
env:
ANKRA_SYSTEMTEST_CONFIRM: 'yes'
ANKRA_SYSTEMTEST_PROVIDERS: ${{ github.event.inputs.providers || 'hetzner ovh upcloud digitalocean' }}
ANKRA_SYSTEMTEST_MANAGED_PROVIDERS: ${{ github.event.inputs.managed_providers || 'doks uks gke ovh_mks aks eks' }}
ANKRA_SYSTEMTEST_PROVIDERS: ${{ github.event.inputs.providers || 'hetzner ovh digitalocean' }}
ANKRA_SYSTEMTEST_MANAGED_PROVIDERS: ${{ github.event.inputs.managed_providers || 'doks gke ovh_mks aks eks' }}
ANKRA_SYSTEMTEST_PARALLEL: ${{ github.event.inputs.parallel || '1' }}
# Opt-in autoscaling step (see the header comment). Only a manual
# dispatch can turn it on: the schedule has no inputs, so it always
Expand Down
4 changes: 2 additions & 2 deletions systemtest/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -230,8 +230,8 @@ Common optional (defaults in parentheses):

| Variable | Default |
|---|---|
| `ANKRA_SYSTEMTEST_PROVIDERS` | `hetzner ovh upcloud digitalocean` (set to `""` to skip the Ankra-managed family; add `aws` for the opt-in AWS lane) |
| `ANKRA_SYSTEMTEST_MANAGED_PROVIDERS` | `doks uks gke ovh_mks aks eks` (set to `""` to skip the cloud-managed family) |
| `ANKRA_SYSTEMTEST_PROVIDERS` | `hetzner ovh digitalocean` (set to `""` to skip the Ankra-managed family; `upcloud` is opt-in only, as UpCloud is too costly to test on routinely; add `aws` for the opt-in AWS lane) |
| `ANKRA_SYSTEMTEST_MANAGED_PROVIDERS` | `doks gke ovh_mks aks eks` (set to `""` to skip the cloud-managed family; `uks` is opt-in only, for the same cost reason as `upcloud`) |
| `ANKRA_SYSTEMTEST_DISTRIBUTIONS` | `k3s` (Ankra-managed only; set `"k3s kubeadm"` to matrix-test both) |
| `ANKRA_SYSTEMTEST_PARALLEL` | `1` (run selected targets concurrently; set `0` for one-at-a-time) |
| `ANKRA_SYSTEMTEST_PLAN_ONLY` | `0` (`1`: print which lanes would run and what each skipped lane is missing, then stop; under GitHub Actions also writes the job summary and the `requested_lanes`/`skipped_lanes`/`runnable_lanes` step outputs) |
Expand Down
6 changes: 4 additions & 2 deletions systemtest/lifecycle_systemtest.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,11 +132,13 @@ if [ ! -x "$ANKRA_BIN" ]; then
fi

# Ankra-managed (self-managed VMs) providers. Set to "" to skip the family.
ANKRA_SYSTEMTEST_PROVIDERS="${ANKRA_SYSTEMTEST_PROVIDERS-hetzner ovh upcloud digitalocean}"
# upcloud and uks are opt-in only: UpCloud is too costly to test on routinely,
# so neither runs unless a caller names it.
ANKRA_SYSTEMTEST_PROVIDERS="${ANKRA_SYSTEMTEST_PROVIDERS-hetzner ovh digitalocean}"

# Cloud-managed (provider-native managed Kubernetes) providers, driven through
# `ankra cluster managed`. Set to "" to skip the family.
ANKRA_SYSTEMTEST_MANAGED_PROVIDERS="${ANKRA_SYSTEMTEST_MANAGED_PROVIDERS-doks uks gke ovh_mks aks eks}"
ANKRA_SYSTEMTEST_MANAGED_PROVIDERS="${ANKRA_SYSTEMTEST_MANAGED_PROVIDERS-doks gke ovh_mks aks eks}"

# Kubernetes distributions to exercise per Ankra-managed provider. Each
# (provider, distribution) pair becomes its own cluster with the distribution
Expand Down
28 changes: 23 additions & 5 deletions systemtest/lifecycle_systemtest_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,7 +117,11 @@ func TestLanePlan(t *testing.T) {
{
// The job summary CI shows: configured lanes run, the rest are
// counted and named by the repository secret they need.
name: "configured lanes run and the summary counts the skipped ones",
// The UpCloud credential is configured on purpose: UpCloud is
// too costly to test on routinely, so neither of its lanes is in
// the default set and a configured credential must not pull them
// back in.
name: "configured lanes run, the summary counts the skipped ones, and upcloud stays out of the default",
env: map[string]string{
"ANKRA_API_TOKEN": "token",
"SSH_KEY_CREDENTIAL_ID": "ssh",
Expand All @@ -130,15 +134,29 @@ func TestLanePlan(t *testing.T) {
wantOutput: []string{
"SKIP: ovh lane: missing SYSTEMTEST_OVH_CREDENTIAL_ID",
"SKIP: managed/doks lane: missing SYSTEMTEST_DIGITALOCEAN_CREDENTIAL_ID",
"::warning title=Lifecycle lanes skipped::7 of 10 provider lanes skipped",
"runnable: hetzner upcloud / managed: uks",
"::warning title=Lifecycle lanes skipped::7 of 8 provider lanes skipped",
"runnable: hetzner / managed: none",
},
rejectOutput: []string{"upcloud", "uks"},

@ankra-platform ankra-platform Bot Oct 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] Substring rejection patterns may be brittle

rejectOutput entries "upcloud" and "uks" are short substrings; if the plan output ever prints, say, a secret name like SYSTEMTEST_UPCLOUD_CREDENTIAL_ID or a lane table mentioning the opt-in lanes even when not requested, this test would fail spuriously. I can't see how rejectOutput is matched (substring vs line) or the full expected summary table, so this may be fine, but consider matching whole lane tokens if the harness allows it.

Ankra AI review. Read-only and advisory.

wantSummary: []string{
"**7 of 10 provider lanes skipped: missing SYSTEMTEST_OVH_CREDENTIAL_ID, SYSTEMTEST_DIGITALOCEAN_CREDENTIAL_ID, SYSTEMTEST_GKE_CREDENTIAL_ID, SYSTEMTEST_AKS_CREDENTIAL_ID, SYSTEMTEST_EKS_CREDENTIAL_ID**",
"**7 of 8 provider lanes skipped: missing SYSTEMTEST_OVH_CREDENTIAL_ID, SYSTEMTEST_DIGITALOCEAN_CREDENTIAL_ID, SYSTEMTEST_GKE_CREDENTIAL_ID, SYSTEMTEST_AKS_CREDENTIAL_ID, SYSTEMTEST_EKS_CREDENTIAL_ID**",
"| `hetzner` | Ankra-managed | runs | |",
"| `managed/gke` | cloud-managed | **skipped** | SYSTEMTEST_GKE_CREDENTIAL_ID |",
},
wantOutputs: []string{"requested_lanes=10", "skipped_lanes=7", "runnable_lanes=3"},
wantOutputs: []string{"requested_lanes=8", "skipped_lanes=7", "runnable_lanes=1"},
},
{
name: "the upcloud lanes still run when a caller names them",
env: map[string]string{
"ANKRA_API_TOKEN": "token",
"SSH_KEY_CREDENTIAL_ID": "ssh",
"UPCLOUD_CREDENTIAL_ID": "upcloud-id",
"ANKRA_SYSTEMTEST_PROVIDERS": "upcloud",
"ANKRA_SYSTEMTEST_MANAGED_PROVIDERS": "uks",
},
wantExit: 0,
wantOutput: []string{"runnable: upcloud / managed: uks"},
rejectOutput: []string{"SKIP"},
},
{
name: "without an API token or a saved login every lane is skipped",
Expand Down
Loading