lab/bastion/src/bastion/tests/kickstart-layout.test.ts

import { describe, it, expect } from "vitest";
import { renderInstallKickstart } from "../src/templates/install.ks.js";
import type { InstallKickstartParams } from "../src/templates/install.ks.js";
import { SUPPORTED_ROLES, LEGACY_ROLES, v2Layout, type Role } from "@lab/shared";

/**
 * Partition-layout tests.
 *
 * The existing ksvalidator test only sees the MAIN kickstart body. The actual
 * layout is written by %pre into /tmp/part.ks inside a heredoc, so until now
 * nothing validated it at all -- a broken layout rendered, shipped and was only
 * discovered on the installed machine.
 *
 * These parse the heredocs. Following tests/ubuntu-autoinstall.test.ts:
 * "A `toContain` assertion would not have caught that; only parsing does."
 */

function baseParams(over: Partial<InstallKickstartParams> = {}): InstallKickstartParams {
  return {
    hostname: "test-node", disk: "nvme0n1", role: "worker", domain: "ad.itaz.eu",
    fedoraVersion: "43", timezone: "Europe/Warsaw", locale: "en_US.UTF-8",
    serverIp: "192.168.8.11", httpPort: 8080, syslogPort: 5514,
    sshKeys: ["ssh-ed25519 AAAA test"], adminUser: "michal",
    ...over,
  };
}

/** Pull every `cat >[>] /tmp/part.ks << PARTEOF ... PARTEOF` body out of the script. */
function partKsBlocks(ks: string): string[] {
  const out: string[] = [];
  const re = /cat >>?\s*\/tmp\/part\.ks\s*<<\s*PARTEOF\n([\s\S]*?)\nPARTEOF/g;
  let m: RegExpExecArray | null;
  while ((m = re.exec(ks)) !== null) out.push(m[1]!);
  return out;
}

interface Logvol { mount: string; name: string; fs: string; size?: number; useExisting: boolean }

function parseLogvols(block: string): Logvol[] {
  return block.split("\n")
    .filter((l) => l.trim().startsWith("logvol "))
    .map((line) => {
      const parts = line.trim().split(/\s+/);
      const get = (flag: string) => {
        const p = parts.find((x) => x.startsWith(`${flag}=`));
        return p ? p.slice(flag.length + 1) : undefined;
      };
      return {
        mount: parts[1]!,
        name: get("--name") ?? "",
        fs: get("--fstype") ?? "",
        ...(get("--size") ? { size: Number(get("--size")) } : {}),
        useExisting: parts.includes("--useexisting"),
      };
    });
}

/** The fresh-install block is the one that also creates the PV. */
function freshBlock(ks: string): string {
  const b = partKsBlocks(ks).find((x) => x.includes("part pv.01"));
  if (!b) throw new Error("no fresh-install part.ks block found");
  return b;
}

describe("v1 is frozen — existing machines must reinstall identically", () => {
  it.each(LEGACY_ROLES)("%s v1 fresh layout is unchanged", (role) => {
    const lvs = parseLogvols(freshBlock(renderInstallKickstart(baseParams({ role }))));
    const byName = Object.fromEntries(lvs.map((l) => [l.name, l]));

    // The exact v1 sizes, in MiB. If one of these changes, every existing box
    // in the fleet would be re-laid-out on its next reinstall.
    expect(byName["swap"]!.size).toBe(27648);
    expect(byName["root"]!.size).toBe(33792);
    expect(byName["var"]!.size).toBe(102400);
    expect(byName["varlog"]!.size).toBe(10240);
    expect(byName["home"]!.size).toBe(10240);
    expect(byName["srv"]!.size).toBe(20480);
  });

  it("v1 gives rancher to infra and worker only — the historical bug, preserved", () => {
    const has = (r: Role) => freshBlock(renderInstallKickstart(baseParams({ role: r }))).includes("--name=rancher");
    expect(has("infra")).toBe(true);
    expect(has("worker")).toBe(true);
    expect(has("labcontroller")).toBe(false); // the bug, deliberately kept in v1
    expect(has("vanilla")).toBe(false);
  });

  it("v1 is the default — no caller has to opt out", () => {
    const ks = renderInstallKickstart(baseParams({ role: "worker" }));
    expect(parseLogvols(freshBlock(ks)).find((l) => l.name === "root")!.size).toBe(33792);
  });
});

describe("v2-only roles have no v1 layout", () => {
  it.each(["standalone-cluster", "k8s-controller", "k8s-worker", "k8s-combo"] as const)(
    "%s defaults to v2 when no schema is given", (role) => {
      const lvs = parseLogvols(freshBlock(renderInstallKickstart(baseParams({ role }))));
      expect(lvs.find((l) => l.name === "root")!.size).toBe(32768);
      expect(lvs.some((l) => l.name === "rancher")).toBe(true);
    });

  it.each(["standalone-cluster", "k8s-controller", "k8s-worker", "k8s-combo"] as const)(
    "%s throws on an EXPLICIT v1 rather than silently dropping its volumes", (role) => {
      expect(() => renderInstallKickstart(baseParams({ role, schemaVersion: 1 }))).toThrow(/no v1 disk layout/);
    });
});

describe("v2 renders the shared layout", () => {
  it.each(SUPPORTED_ROLES)("%s v2 matches v2Layout() exactly", (role) => {
    const ks = renderInstallKickstart(baseParams({ role, schemaVersion: 2 }));
    const rendered = parseLogvols(freshBlock(ks));
    const expected = v2Layout(role);

    expect(rendered.map((l) => l.name).sort()).toEqual(expected.map((l) => l.name).sort());
    for (const spec of expected) {
      const got = rendered.find((l) => l.name === spec.name)!;
      expect(got.size).toBe(spec.sizeMib);
      expect(got.fs).toBe(spec.fs);
    }
  });

  it("v2 gives labcontroller a rancher LV — the v1 bug, fixed", () => {
    const ks = renderInstallKickstart(baseParams({ role: "labcontroller", schemaVersion: 2 }));
    const rancher = parseLogvols(freshBlock(ks)).find((l) => l.name === "rancher");
    expect(rancher).toBeDefined();
    expect(rancher!.size).toBe(256000);
  });

  it("v2 never uses --grow", () => {
    for (const role of SUPPORTED_ROLES) {
      const block = freshBlock(renderInstallKickstart(baseParams({ role, schemaVersion: 2 })));
      expect(block).not.toMatch(/logvol[^\n]*--grow/);
    }
  });

  it("v2 uses the larger EFI and /boot partitions", () => {
    const block = freshBlock(renderInstallKickstart(baseParams({ role: "worker", schemaVersion: 2 })));
    expect(block).toMatch(/part \/boot\/efi --fstype=efi --size=1024/);
    expect(block).toMatch(/part \/boot --fstype=ext4 --size=4096/);
  });
});

describe("reprovision protects existing data", () => {
  it("reprovision reads the on-disk schema instead of trusting the caller", () => {
    const ks = renderInstallKickstart(baseParams({ role: "worker", schemaVersion: 2 }));
    expect(ks).toContain("DISK_SCHEMA=v1");
    expect(ks).toMatch(/vgs --noheadings -o vg_tags .*grep -q lab-schema-v2/);
  });

  it("the reprovision branch never wipes the disk", () => {
    const ks = renderInstallKickstart(baseParams({ role: "worker" }));
    const repro = partKsBlocks(ks).find((b) => b.includes("--useexisting"))!;
    expect(repro).toContain("clearpart --none");
    expect(repro).not.toContain("clearpart --all");
  });

  it("preserved data volumes are never reformatted", () => {
    const ks = renderInstallKickstart(baseParams({ role: "worker" }));
    for (const lv of ["longhorn", "rancher", "home", "srv"]) {
      const re = new RegExp(`--name=${lv} --useexisting --noformat`);
      expect(ks).toMatch(re);
    }
  });
});

describe("the %pre block survives the /ks-auto extractor", () => {
  it("matches the same regex ks-auto uses to re-run %pre", () => {
    // routes/kickstart.ts re-extracts %pre with python:
    //   re.findall(r'%pre[^\n]*\n(.*?)%end', text, re.DOTALL)
    // A change that breaks this breaks ISO installs silently.
    for (const role of SUPPORTED_ROLES) {
      // v2-only roles throw at v1 by design, so only render the combinations
      // that are actually legal.
      // An explicit v1 is illegal for a v2-only role; everything else renders.
      const versions = (LEGACY_ROLES as readonly string[]).includes(role)
        ? ([1, 2] as const)
        : ([2] as const);
      for (const schemaVersion of versions) {
        const ks = renderInstallKickstart(baseParams({ role, schemaVersion }));
        const blocks = [...ks.matchAll(/%pre[^\n]*\n([\s\S]*?)%end/g)];
        expect(blocks.length).toBeGreaterThan(0);
        expect(blocks[0]![1]).toContain("/tmp/part.ks");
      }
    }
  });
});