60 lines
2.8 KiB
Bash
60 lines
2.8 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
set -Eeuo pipefail
|
|
|
|
readonly ROOT="$(cd -- "$(dirname -- "$BASH_SOURCE")/../.." && pwd -P)"
|
|
readonly APPLY="$ROOT/scripts/bootstrap/apply-private-dns.sh"
|
|
readonly LAN="$ROOT/infrastructure/networking/private-dns/host/dnsmasq-lan.conf"
|
|
readonly TAIL="$ROOT/infrastructure/networking/private-dns/host/dnsmasq-tailscale.conf"
|
|
readonly CORE="$ROOT/infrastructure/networking/private-dns/kubernetes/coredns-custom.yaml"
|
|
readonly BUSYBOX='docker.io/library/busybox:1.37.0@sha256:7a3ebe5bfd1a4a19797d20b0c0bb39d44393e9a03fd852c0865b0f540d868df0'
|
|
readonly -a HOSTS=(
|
|
git.learn.hyeonworks.com
|
|
id.learn.hyeonworks.com
|
|
storage-admin.learn.hyeonworks.com
|
|
db-admin.learn.hyeonworks.com
|
|
grafana.learn.hyeonworks.com
|
|
)
|
|
|
|
fail() {
|
|
printf 'FAIL: %s\n' "$*" >&2
|
|
exit 1
|
|
}
|
|
|
|
pass() {
|
|
printf 'PASS: %s\n' "$*"
|
|
}
|
|
|
|
for file in "$APPLY" "$LAN" "$TAIL" "$CORE"; do
|
|
[[ -f "$file" && ! -L "$file" ]] || fail "missing regular source: $file"
|
|
done
|
|
bash -n "$APPLY"
|
|
|
|
for host in "${HOSTS[@]}"; do
|
|
grep -Fqx "address=/$host/192.168.0.107" "$LAN" || fail "LAN source lacks $host"
|
|
grep -Fqx "address=/$host/100.92.240.34" "$TAIL" || fail "Tail source lacks $host"
|
|
grep -Fq "192.168.0.107 $host" "$CORE" || fail "CoreDNS source lacks $host"
|
|
done
|
|
pass 'all five private names are source-bound for LAN, Tail, and Pods'
|
|
|
|
grep -Fq 'PUBLIC_PRIVATE_HOSTS=(storage-admin.learn.hyeonworks.com db-admin.learn.hyeonworks.com grafana.learn.hyeonworks.com)' "$APPLY" ||
|
|
fail 'public A/AAAA absence set is not exact'
|
|
grep -Fq 'PRIVATE_HOSTS=(git.learn.hyeonworks.com id.learn.hyeonworks.com storage-admin.learn.hyeonworks.com db-admin.learn.hyeonworks.com grafana.learn.hyeonworks.com)' "$APPLY" ||
|
|
fail 'private resolver verification set is not exact'
|
|
grep -Fq "readonly BUSYBOX_IMAGE=\"$BUSYBOX\"" "$APPLY" || fail 'BusyBox pin constant is not exact'
|
|
grep -Fq -- '--image="$BUSYBOX_IMAGE"' "$APPLY" || fail 'Pod smoke does not use the pinned BusyBox constant'
|
|
for host in "${HOSTS[@]}"; do
|
|
grep -Fq "nslookup $host" "$APPLY" || fail "Pod smoke omits $host"
|
|
done
|
|
pass 'apply source checks public absence and all five resolver paths with pinned BusyBox'
|
|
|
|
grep -Fq 'managed_listeners_are_exact' "$APPLY" || fail 'repeat execution has no exact managed-listener classifier'
|
|
grep -Fq 'lan_was_active=' "$APPLY" || fail 'rollback does not snapshot LAN active state'
|
|
grep -Fq 'tail_was_active=' "$APPLY" || fail 'rollback does not snapshot Tail active state'
|
|
grep -Fq 'lan_was_enabled=' "$APPLY" || fail 'rollback does not snapshot LAN enabled state'
|
|
grep -Fq 'tail_was_enabled=' "$APPLY" || fail 'rollback does not snapshot Tail enabled state'
|
|
grep -Fq 'restore_service_state' "$APPLY" || fail 'rollback does not restore managed service state'
|
|
pass 'repeat execution and rollback service-state contracts are present'
|
|
|
|
printf 'PRIVATE DNS OBSERVABILITY CONTRACT PASS\n'
|