Fix binding image fetch and add test

Author: akclace

Makefile

@@ -180,11 +180,12 @@ fullrelease: ## Tag+push openrun, pkg/binding and all bindings under one version
 >   echo "Error: bindings tags for v$$version already exist:" $$(git -C ../bindings tag -l "*/v$$version")
 >   exit 1
 > fi
-> # openrun server + pkg/binding SDK: tag and push. The SDK tag must be on the
-> # remote before the bindings release, whose go mod tidy resolves it.
+> # openrun server + pkg/binding SDK: tag, then push the current branch and
+> # both tags. The SDK tag must be on the remote before the bindings release,
+> # whose go mod tidy resolves it.
 > git tag -a "v$$version" -m "Release v$$version"
 > git tag -a "pkg/binding/v$$version" -m "Release pkg/binding/v$$version"
-> git push origin "v$$version" "pkg/binding/v$$version"
+> git push origin HEAD "v$$version" "pkg/binding/v$$version"
 > # Bindings: update every provider module to the new SDK version, tag each
 > # module and push; the bindings release workflow builds and publishes each
 > # provider (binaries + OCI image) from its pushed tag

deploy/obs/update_obs.sh

@@ -10,7 +10,7 @@
 #   OBS_PROJECT  target OBS project (default: home:ajayvk:openrun)
 #   DRY_RUN=1    prepare everything and show the pending change, skip commit
 #
-# Requires: osc with credentials configured, go >= version in go.mod, git.
+# Requires: osc with credentials configured, the Go minor version in go.mod, git.
 
 set -euo pipefail
 
@@ -54,10 +54,14 @@ mv "$WORK/embed.go" internal/server/list_apps/embed.go
 rm -rf apps
 
 # Distro toolchains lag behind Go patch releases; the minor version is what
-# actually gates the language level, so drop the patch from the go directive.
+# actually gates the language level, so drop the patch from the main module and
+# local module dependencies before creating vendor metadata.
 echo "==> Relaxing go.mod patch version and vendoring modules"
-sed -E 's/^go ([0-9]+\.[0-9]+)\.[0-9]+$/go \1/' go.mod > go.mod.new && mv go.mod.new go.mod
-go mod vendor
+for mod_file in go.mod pkg/binding/go.mod; do
+    sed -E 's/^go ([0-9]+\.[0-9]+)\.[0-9]+$/go \1/' "$mod_file" > "$mod_file.new"
+    mv "$mod_file.new" "$mod_file"
+done
+GOTOOLCHAIN=local go mod vendor
 CGO_ENABLED=0 GOTOOLCHAIN=local go build -mod=vendor -o /dev/null ./cmd/openrun
 
 echo "==> Creating source tarball"

tests/kube_bindings/Dockerfile

@@ -0,0 +1,3 @@
+FROM scratch
+COPY openrun-binding-fixture-linux /openrun-binding-fixture
+ENTRYPOINT ["/openrun-binding-fixture"]

tests/kube_bindings/openrun-binding-fixture-linux

@@ -748,6 +748,29 @@ if [[ -n "$KUBE_REGISTRY_URL" ]] && contains_any "test_kubernetes.yaml"; then
   kubectl create namespace "$KUBE_TEST_NAMESPACE" --dry-run=client -o yaml | kubectl apply -f -
   kubectl create namespace "${KUBE_TEST_NAMESPACE}-apps" --dry-run=client -o yaml | kubectl apply -f -
 
+  # OCI binding provider distribution test setup: the fixture provider is
+  # built once for the host (registered with the local server through
+  # bindings.preinstalled_dir, as the chart's shared volume would be) and once
+  # for the cluster platform, packaged as a FROM scratch image and pushed to
+  # the test registry (pulled by the init container in test_kubernetes.yaml).
+  KUBE_BINDINGS_DIR="$(pwd)/kube_bindings"
+  rm -rf "$KUBE_BINDINGS_DIR"
+  mkdir -p "$KUBE_BINDINGS_DIR/preinstalled"
+  (cd ../internal/bindings/testdata/fixtureprovider && \
+    GOWORK=off CGO_ENABLED=0 go build -o "$KUBE_BINDINGS_DIR/preinstalled/openrun-binding-fixture" .)
+  KUBE_NODE_ARCH=$(kubectl get nodes -o jsonpath='{.items[0].status.nodeInfo.architecture}')
+  (cd ../internal/bindings/testdata/fixtureprovider && \
+    GOWORK=off CGO_ENABLED=0 GOOS=linux GOARCH="$KUBE_NODE_ARCH" go build -o "$KUBE_BINDINGS_DIR/openrun-binding-fixture-linux" .)
+  cat <<EOF > "$KUBE_BINDINGS_DIR/Dockerfile"
+FROM scratch
+COPY openrun-binding-fixture-linux /openrun-binding-fixture
+ENTRYPOINT ["/openrun-binding-fixture"]
+EOF
+  export KUBE_BINDING_IMAGE="$KUBE_REGISTRY_URL/openrun-binding-fixture:cli-test"
+  $CONTAINER_TOOL build --platform "linux/$KUBE_NODE_ARCH" -q -t "$KUBE_BINDING_IMAGE" "$KUBE_BINDINGS_DIR"
+  $CONTAINER_TOOL push "$KUBE_BINDING_IMAGE"
+  export KUBE_TEST_NAMESPACE
+
   cat <<EOF > config_k8s.toml
 [http]
 port = $K8S_HTTP_PORT
@@ -762,6 +785,9 @@ use_node_port = true
 [registry]
 url="$KUBE_REGISTRY_URL"
 insecure = true
+[bindings]
+preinstalled_dir = "$KUBE_BINDINGS_DIR/preinstalled"
+disable_install = true
 [app_config]
 container.health_attempts_after_startup = 20
 container.health_timeout_secs = 1
@@ -774,6 +800,12 @@ container.status_check_interval_secs = 60
 EOF
 
     rm -rf metadata run/openrun.sock
+    # The CLI commands in test_kubernetes.yaml run with CL_CONFIG_FILE=openrun.toml
+    # (commander replaces the environment with the yaml env map). In a full run the
+    # main test block has already written openrun.toml; create an empty one for
+    # standalone runs (`run_cli_tests.sh --kube-registry ... test_kubernetes.yaml`)
+    # so the CLI does not fail parsing a missing config file.
+    [[ -f openrun.toml ]] || : > openrun.toml
     CL_CONFIG_FILE=config_k8s.toml GOCOVERDIR=$GOCOVERDIR ../openrun server start &
     wait_for_http "$K8S_HTTP_PORT"
     wait_for_socket

tests/kube_bindings/preinstalled/openrun-binding-fixture

@@ -1,8 +1,16 @@
 config:
   env:
     CL_CONFIG_FILE: openrun.toml
+    # commander replaces the process environment with this map; OPENRUN_HOME
+    # anchors the CLI's socket/config resolution to the tests dir, and
+    # PATH/HOME are needed for kubectl (binary lookup + kubeconfig)
+    OPENRUN_HOME: .
+    PATH: ${PATH}
+    HOME: ${HOME}
     HTTP_PORT: ${HTTP_PORT}
     GOCOVERDIR: ${GOCOVERDIR}/../client
+    KUBE_BINDING_IMAGE: ${KUBE_BINDING_IMAGE}
+    KUBE_TEST_NAMESPACE: ${KUBE_TEST_NAMESPACE}
 tests:
   kubernetes010: # setup flask app
     command: rm -rf ./flaskapp && mkdir flaskapp && cp flask.py flaskapp/app.py
@@ -127,3 +135,67 @@ tests:
   kubernetes823: # health endpoint still serves the old, working version
     command: curl -sS localhost:${HTTP_PORT}/kube_verify
     stdout: "ok"
+
+  # Out-of-process binding providers, OCI distribution path: the harness built
+  # the fixture provider into bindings.preinstalled_dir (as the Helm chart's
+  # init containers populate the shared volume) and pushed it as a FROM
+  # scratch image to the test registry.
+  kubernetes900: # preinstalled provider is registered: its service type works
+    command: ../openrun service create --config url=fixture://kube fixture/kfx1
+    stdout: "Service fixture/kfx1 created"
+  kubernetes901: # binding create goes through the preinstalled provider
+    command: ../openrun binding create fixture/kfx1 /kube_fx1
+    stdout: "Binding /kube_fx1 created"
+  kubernetes902: # run-command round trip through the provider process
+    command: ../openrun binding run-command /kube_fx1 "echo:oci-ok" | jq -r '.echo'
+    stdout: "oci-ok"
+  kubernetes903: # disable_install rejects imperative provider install
+    command: ../openrun provider install fixture --version v0.1.0
+    stderr: "provider install is disabled"
+    exit-code: 1
+  kubernetes904: # disable_install rejects imperative provider uninstall
+    command: ../openrun provider uninstall fixture
+    stderr: "provider uninstall is disabled"
+    exit-code: 1
+  kubernetes910: # in-cluster export: init container copies the provider out of the scratch image
+    command: |
+      kubectl apply -n ${KUBE_TEST_NAMESPACE} -f - <<EOF
+      apiVersion: v1
+      kind: Pod
+      metadata:
+        name: binding-export-test
+      spec:
+        restartPolicy: Never
+        initContainers:
+          - name: binding-provider-fixture
+            image: ${KUBE_BINDING_IMAGE}
+            command: ["/openrun-binding-fixture", "export", "/providers"]
+            volumeMounts:
+              - name: providers
+                mountPath: /providers
+        containers:
+          - name: check
+            image: busybox:1.36
+            command: ["sh", "-c", "test -x /providers/openrun-binding-fixture && echo EXPORT_OK"]
+            volumeMounts:
+              - name: providers
+                mountPath: /providers
+        volumes:
+          - name: providers
+            emptyDir: {}
+      EOF
+    stdout: "pod/binding-export-test created"
+  kubernetes911: # exported binary is present and executable in the shared volume
+    command: kubectl wait -n ${KUBE_TEST_NAMESPACE} --for=jsonpath='{.status.phase}'=Succeeded pod/binding-export-test --timeout=120s && kubectl logs -n ${KUBE_TEST_NAMESPACE} binding-export-test -c check
+    stdout: "EXPORT_OK"
+  kubernetes912: # init container logged the export
+    command: kubectl logs -n ${KUBE_TEST_NAMESPACE} binding-export-test -c binding-provider-fixture
+    stdout: "exported /providers/openrun-binding-fixture"
+  kubernetes913: # cleanup export test pod
+    command: kubectl delete pod binding-export-test -n ${KUBE_TEST_NAMESPACE} --ignore-not-found
+  kubernetes920: # binding delete through the provider
+    command: ../openrun binding delete /kube_fx1
+    stdout: "Binding /kube_fx1 deleted"
+  kubernetes921: # service delete
+    command: ../openrun service delete fixture/kfx1
+    stdout: "Service fixture/kfx1 deleted"