fix(e2e): unbreak LUKS cli-matrix cells — stdin to cryptsetup, diskful-only replica count (BUG-039)#152
Conversation
…039)
assert_luks_passphrase_opens piped the master passphrase into
on_node, but on_node runs kubectl exec without -i, so the pipe was
never forwarded and cryptsetup read an empty key-file ("Nothing to
read on input."). Every kernel-level passphrase assertion therefore
failed on every stand — reported as BUG-039 'LUKS data-plane broken'
— while the satellite had in fact formatted the backing device with
the correct master passphrase (verified live: the operator passphrase
opens the LUKS header once stdin is forwarded).
Add an on_node_stdin helper (kubectl exec -i, same Running-pod
selection) and route the assert through it. Keep cryptsetup stderr
and print it on the failure path — the old 2>/dev/null swallowed the
'Nothing to read on input' tell and masked the root cause.
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
…re cells (BUG-039) The three data-bearing LUKS cells waited for exactly 2 Resource CRDs after --auto-place=2, but on a 3-worker stand the controller adds (and flaps) a DISKLESS TIE_BREAKER witness, so the all-CRD count oscillates 2-3-2 and the equality check times out spuriously with 'did not autoplace 2 replicas'. Count diskful replicas via linstor_diskful_nodes instead — the convention the sibling encryption-passphrase-luks-rd and luks-rd-create cells already use. With the counting fixed, luks-resize-encrypted goes green on a live stand; luks-clone-encrypted and luks-snapshot-restore-encrypted now surface the real blocker (cross-node snapshot ship fails in the clone/restore engine), which is tracked separately as BUG-038. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
📝 WalkthroughWalkthroughThis PR improves test reliability by adding stdin forwarding infrastructure and refactoring replica-counting logic across LUKS encryption tests. It introduces ChangesTest Infrastructure and LUKS/Diskful Replica Fixes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request addresses BUG-039 in the end-to-end tests. It introduces a new helper function on_node_stdin to properly forward stdin via kubectl exec -i, resolving an issue where empty passphrases were being read by cryptsetup. Additionally, it updates several test scripts to use linstor_diskful_nodes for counting diskful replicas, preventing spurious timeouts caused by diskless tie-breaker witnesses. There are no review comments, and I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
1 participant
Summary
BUG-039 reported the LUKS data plane as broken at the release-candidate SHA: 6 of 8
luks-*cli-matrix cells failed on a live stand, including the new Secret-only flow cell from #143, withpassphrase does NOT open <node>:<backing-device>.Live debugging on a clean stand shows the product chain is correct end-to-end at the candidate SHA:
linstor encryption create-passphrase-> Secret -> satellite-side injection ->LuksPassphrasewire prop ->cryptsetup luksFormat. The backing LVs are formatted with the operator's master passphrase and the passphrase opens them — once the harness actually delivers it. Both root causes were in the L6 harness, not in the product:stdin never reached cryptsetup.
assert_luks_passphrase_openspiped the passphrase intoon_node, which runskubectl execwithout-i, so the pipe was dropped and cryptsetup read an empty key-file ("Nothing to read on input."). The kernel-level assertion could never pass on any stand, regardless of what key the satellite formatted with; the2>/dev/nullswallowed the tell. Fixed with a stdin-forwardingon_node_stdinhelper; cryptsetup stderr is now printed on the failure path.Tiebreaker counted as a replica. The clone/resize/snapshot-restore cells waited for exactly 2 Resource CRDs after
--auto-place=2, but on a 3-worker stand the controller adds (and flaps) a DISKLESS TIE_BREAKER witness, so the count oscillates 2-3-2 and the equality check times out spuriously ("did not autoplace 2 replicas"). Fixed by counting diskful replicas vialinstor_diskful_nodes, the convention the sibling cells already use.No product code changes.
Validation (live stand, candidate SHA)
encryption-passphrase-luks-rd(Secret-only flow): green 3/3 consecutive runsluks-rd-create-encrypted,luks-autoplace-encrypted,luks-resize-encrypted: green-ithe same command fails with "Nothing to read on input."luks-clone-encrypted/luks-snapshot-restore-encryptednow get past placement and surface the real blocker: cross-node snapshot ship fails in the clone/restore engine (zfs recv: invalid stream (bad magic number)), which is layer-independent (plainrd-clone-vd-data-planefails identically) and tracked separately as BUG-038.go test ./...clean,golangci-lint run0 issues, shellcheck introduces no new findingsSummary by CodeRabbit
Release Notes
Tests