trident-acl-agent: add storm trident-acl-agent E2E test harness, test images, and pipeline

.pipelines/templates/e2e-template.yml

@@ -270,6 +270,11 @@ stages:
       dependsOnStage: ${{ parameters.baseImageArtifactStage }}
       testSecureBoot: ${{ parameters.testSecureBoot }}
 
+  # Validate trident-acl-agent (storm A/B update scenario against a real tridentd)
+  - template: stages/testing_acl_agent/trident-acl-agent-test.yml
+    parameters:
+      dependsOnStage: ${{ parameters.baseImageArtifactStage }}
+
   # TESTING stages for PRERELEASE
   - ${{ if eq(parameters.stageType, 'pre') }}:
       # Functional Testing

.pipelines/templates/stages/testing_acl_agent/trident-acl-agent-test.yml

@@ -0,0 +1,137 @@
+parameters:
+  - name: dependsOnStage
+    type: string
+    default: ""
+
+  - name: micBuildType
+    displayName: MIC Build Type
+    type: string
+    values:
+      - dev
+      - preview
+      - release
+    default: release
+
+  - name: micVersion
+    displayName: MIC Version
+    type: string
+    default: "*.*.*"
+
+  - name: baseimgAzlVersion
+    displayName: Base Image AZL version
+    type: string
+    default: "3.0"
+
+  - name: verboseLogging
+    displayName: "Enable verbose logging"
+    type: boolean
+    default: false
+
+stages:
+  - stage: BuildImagesAclAgent
+    displayName: Build Base and Update Images for trident-acl-agent
+    dependsOn:
+      - PrepareSSHKeys
+      - GetTridentBinaries_rpms_amd64
+      - ${{ if ne(parameters.dependsOnStage, '') }}:
+          - ${{ parameters.dependsOnStage }}
+
+    jobs:
+      - template: ../trident_images/build-image.yml
+        parameters:
+          label: "acl-agent-base"
+          makeTarget: "artifacts/trident-vm-acl-agent-testimage.qcow2"
+          baseimgType: qemu_guest
+          baseimgAzlVersion: ${{ parameters.baseimgAzlVersion }}
+          micBuildType: ${{ parameters.micBuildType }}
+          micVersion: ${{ parameters.micVersion }}
+          useStagedSshKeys: true
+
+      - template: ../trident_images/build-image.yml
+        parameters:
+          label: "acl-agent-update"
+          makeTarget: "artifacts/trident-vm-acl-agent-update-testimage.cosi"
+          baseimgType: qemu_guest
+          baseimgAzlVersion: ${{ parameters.baseimgAzlVersion }}
+          micBuildType: ${{ parameters.micBuildType }}
+          micVersion: ${{ parameters.micVersion }}
+          useStagedSshKeys: true
+
+  - stage: TridentAclAgentTest
+    displayName: Validate trident-acl-agent
+    dependsOn:
+      - BuildingTools
+      - BuildImagesAclAgent
+
+    jobs:
+      - job: AclAgentStormTest
+        displayName: Run storm aclagent scenario
+        timeoutInMinutes: 30
+        pool:
+          type: linux
+          name: trident-ubuntu-1es-pool-eastus2
+          hostArchitecture: amd64
+
+        variables:
+          ob_outputDirectory: /tmp/output
+          ob_artifactBaseName: "aclagent-storm-test"
+
+        steps:
+          - template: ../common_tasks/checkout_trident.yml
+          - template: ../common_tasks/avoid-pypi-usage.yml
+
+          - task: DownloadPipelineArtifact@2
+            inputs:
+              buildType: current
+              artifactName: image-acl-agent-base
+              targetPath: "$(Build.ArtifactStagingDirectory)"
+            displayName: Download Base Image (qcow2)
+
+          - task: DownloadPipelineArtifact@2
+            inputs:
+              buildType: current
+              artifactName: image-acl-agent-update
+              targetPath: "$(Build.ArtifactStagingDirectory)"
+            displayName: Download Update Image (cosi)
+
+          - task: DownloadPipelineArtifact@2
+            inputs:
+              buildType: current
+              artifactName: ssh-keys
+              targetPath: "$(Build.ArtifactStagingDirectory)/ssh"
+            displayName: Download SSH Keys
+
+          - task: DownloadPipelineArtifact@2
+            displayName: "Download go-tools"
+            inputs:
+              buildType: current
+              artifactName: "go-tools"
+              patterns: |
+                storm-trident
+              targetPath: "$(TRIDENT_SOURCE_DIR)/bin"
+
+          - bash: |
+              set -eux
+              chmod +x $(TRIDENT_SOURCE_DIR)/bin/storm-trident
+              cp $(Build.ArtifactStagingDirectory)/ssh/id_rsa* ~/.ssh/
+              chmod -R 700 ~/.ssh/
+              mkdir -p $(ob_outputDirectory)
+            displayName: Set up SSH keys and output directory
+            workingDirectory: $(TRIDENT_SOURCE_DIR)
+
+          - bash: |
+              set -eux
+              ls -la $(Build.ArtifactStagingDirectory)/
+            displayName: List downloaded image artifacts
+
+          - bash: |
+              set -eux
+
+              FLAGS="-a --verbose"
+
+              sudo ./bin/storm-trident run aclagent $FLAGS \
+                --output-path $(ob_outputDirectory) \
+                --artifacts-dir $(Build.ArtifactStagingDirectory) \
+                --ssh-private-key-path ~/.ssh/id_rsa
+            displayName: "🧪 Run trident-acl-agent A/B update + rollback scenario"
+            workingDirectory: $(TRIDENT_SOURCE_DIR)

Makefile

@@ -1220,6 +1220,27 @@ artifacts/trident-vm-usr-verity-testimage.qcow2: \
 			--output-image-format qcow2 \
 			--config-file /repo/$(VM_IMAGE_PATH_PREFIX)/baseimg-usr-verity.yaml
 
+artifacts/trident-vm-acl-agent-testimage.qcow2: \
+	$(QEMU_GUEST_IMAGE) \
+	$(TRIDENT_VM_DEPENDENCIES) \
+	$(VM_IMAGE_PATH_PREFIX)/baseimg-acl-agent.yaml \
+	$(VM_IMAGE_PATH_PREFIX)/files/id_rsa.pub \
+	artifacts/rpm-overrides
+	@echo "Building $@ from $<"
+	docker run --rm \
+		--privileged \
+		-v ".:/repo:z" \
+		-v "/dev:/dev" \
+		${MIC_CONTAINER_IMAGE} \
+			--log-level debug \
+			--rpm-source /repo/bin/RPMS \
+			--rpm-source /repo/artifacts/rpm-overrides \
+			--build-dir /build \
+			--image-file /repo/$< \
+			--output-image-file /repo/$@ \
+			--output-image-format qcow2 \
+			--config-file /repo/$(VM_IMAGE_PATH_PREFIX)/baseimg-acl-agent.yaml
+
 artifacts/trident-vm-grub-verity-azure-testimage.vhd: \
 	$(CORE_SELINUX_IMAGE) \
 	$(TRIDENT_VM_DEPENDENCIES) \

docs/Development/Testing/Testing.md

@@ -54,6 +54,10 @@ manual rollback chains without using `netlaunch` or an installer ISO.
   rollback via `storm-trident run servicing`
 - [Rollback Tests](Rollback-Tests.md) — full rollback chain (A/B + runtime
   updates) via `storm-trident run rollback`
+- [Trident ACL Agent Tests](TridentAclAgent-Tests.md) — validates
+  `trident-acl-agent`'s annotation-driven update protocol against fake
+  Kubernetes API server and Nebraska/Omaha endpoints via
+  `storm-trident run aclagent`
 
 ## Code Coverage