Background
Follow-up to PR #8886, which added ShellSpec coverage for parts/linux/cloud-init/artifacts/init-aks-custom-cloud.sh.
The extracted determine_cert_endpoint_mode() function is the direct behavioral surface of RCV1P's cloud selection. It is now unit-tested for 8 inputs (ussec, usnat, USSecWest, USNatEast, usgovvirginia, chinaeast2, francesouth, empty).
However, there is no test that verifies the refresh_location env-var/arg2 handoff into it actually happens at the script top-level — that is currently covered only by a grep/static assertion. If a future refactor accidentally passes $1 instead of $refresh_location to determine_cert_endpoint_mode, all unit tests still pass because:
- ShellSpec sources the script with
__SOURCED__ set, so the ${__SOURCED__:+return 0} guard returns before the top-level "main" (where the handoff lives) ever loads.
- Shell functions enforce no arity/signature, so passing the wrong-but-valid argument fails silently.
Proposed work
Add a script-level ShellSpec example (the "Option B" discussed in #8886) that runs the whole script and asserts the runtime wiring, e.g.:
LOCATION=usseceast bash init-aks-custom-cloud.sh ca-refresh
and asserts the emitted AKS.CSE.rcv1p.certEndpointMode event says mode=legacy.
This locks the entire RCV1P mode-selection wiring end-to-end (arg/env → refresh_location → determine_cert_endpoint_mode → emitted mode), not just the isolated function. A dedicated ussec → legacy script-level case would catch the "USSec node silently gets rcv1p" regression that unit tests structurally cannot.
Why it wasn't done in #8886
Confirmed in-PR discussion (rchincha + Devinwong): valid concern, but out of scope for #8886 (a "no logic change / add coverage" PR). It needs more than a one-line test.
Implementation notes (from #8886 investigation)
Running the whole script under ShellSpec needs a few test seams so it doesn't exit early or hit the network in the CI container (Debian, root):
- Make
EVENTS_LOGGING_DIR overridable so the emitted event file can be captured/inspected by the test.
- Make the top-level
/etc/os-release path overridable (the Debian ShellSpec container fails OS detection otherwise and exits before reaching the mode-selection logic).
- Stub
curl on PATH (e.g. returning \n200) so the cert-retrieval path doesn't make real wireserver calls.
- Tolerate
/root/AzureCACertificates writes (harmless in the root container) or make that path overridable.
Then assert on the captured AKS.CSE.rcv1p.certEndpointMode event content (mode=legacy for usseceast, mode=rcv1p for a commercial region, etc.).
Acceptance criteria
Filed as a follow-up so it can be picked up in a separate session/PR once #8886 merges.
Background
Follow-up to PR #8886, which added ShellSpec coverage for
parts/linux/cloud-init/artifacts/init-aks-custom-cloud.sh.The extracted
determine_cert_endpoint_mode()function is the direct behavioral surface of RCV1P's cloud selection. It is now unit-tested for 8 inputs (ussec,usnat,USSecWest,USNatEast,usgovvirginia,chinaeast2,francesouth, empty).However, there is no test that verifies the
refresh_locationenv-var/arg2 handoff into it actually happens at the script top-level — that is currently covered only by a grep/static assertion. If a future refactor accidentally passes$1instead of$refresh_locationtodetermine_cert_endpoint_mode, all unit tests still pass because:__SOURCED__set, so the${__SOURCED__:+return 0}guard returns before the top-level "main" (where the handoff lives) ever loads.Proposed work
Add a script-level ShellSpec example (the "Option B" discussed in #8886) that runs the whole script and asserts the runtime wiring, e.g.:
and asserts the emitted
AKS.CSE.rcv1p.certEndpointModeevent saysmode=legacy.This locks the entire RCV1P mode-selection wiring end-to-end (arg/env →
refresh_location→determine_cert_endpoint_mode→ emitted mode), not just the isolated function. A dedicatedussec → legacyscript-level case would catch the "USSec node silently gets rcv1p" regression that unit tests structurally cannot.Why it wasn't done in #8886
Confirmed in-PR discussion (rchincha + Devinwong): valid concern, but out of scope for #8886 (a "no logic change / add coverage" PR). It needs more than a one-line test.
Implementation notes (from #8886 investigation)
Running the whole script under ShellSpec needs a few test seams so it doesn't exit early or hit the network in the CI container (Debian, root):
EVENTS_LOGGING_DIRoverridable so the emitted event file can be captured/inspected by the test./etc/os-releasepath overridable (the Debian ShellSpec container fails OS detection otherwise and exits before reaching the mode-selection logic).curlonPATH(e.g. returning\n200) so the cert-retrieval path doesn't make real wireserver calls./root/AzureCACertificateswrites (harmless in the root container) or make that path overridable.Then assert on the captured
AKS.CSE.rcv1p.certEndpointModeevent content (mode=legacyforusseceast,mode=rcv1pfor a commercial region, etc.).Acceptance criteria
init-aks-custom-cloud.shend-to-end and asserts the emittedcertEndpointModeevent for at least aussec*/usnat*(→legacy) case and a commercial (→rcv1p) case.refresh_locationhandoff intodetermine_cert_endpoint_modeis broken (verified by temporarily reintroducing the$1bug).make shellspec-ci) andmake validate-shell(shellcheck) stays clean.init-aks-custom-cloud.shbeyond adding overridable test seams.Filed as a follow-up so it can be picked up in a separate session/PR once #8886 merges.