test: platform-policy test harness improvements#2316
Closed
utkarash2991 wants to merge 2 commits into
Closed
Conversation
Two improvements for testing platform behavior (supautils policy against the rendered config and real roles): 1. Split testinfra/test_ami_nix.py (1400+ lines) into domain modules sharing the session-scoped EC2 fixture via conftest.py: test_postgrest, test_postgres, test_jit_pam, test_overrides, test_mitigations, test_apparmor. The AMI suite stays for artifact wiring checks; pytest now runs the whole directory. 2. Document (nix/tests/README.md) that the pg_regress suite already runs against the rendered supautils.conf.j2 with migrations applied via start-postgres-server, and establish the SET ROLE convention for platform-policy tests, with supautils_platform_policy.sql as the reference example (privileged-extension delegation as the non-superuser postgres role). Conf changes and their policy tests can now travel in the same PR.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
PostgreSQL Extension Dependency Analysis: PR #2316
SummaryNo extensions had dependencies with MAJOR version updates. Full Analysis ResultsPostgreSQL 15 Extension DependenciesPostgreSQL 17 Extension DependenciesOrioleDB 17 Extension Dependencies |
PostgreSQL Package Dependency Analysis: PR #2316
SummaryNo packages had MAJOR version updates. Full Analysis ResultsPostgreSQL 15 Dependency ChangesExtracting PostgreSQL 15 dependencies...
Runtime Closure Size
Raw Dependency ClosurePostgreSQL 17 Dependency ChangesExtracting PostgreSQL 17 dependencies...
Runtime Closure Size
Raw Dependency Closure |
The CLI variant's prime file doesn't create the postgres role or the full extension set, same reason pg_net_worker_privileges is skipped.
Contributor
Author
|
Scratching this in favor of folding the policy test directly into #2315, so the conf change and its test merge together. The testinfra split and docs are preserved on this branch if we want them later. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two improvements for testing platform behavior (supautils policy against the rendered config and real roles). Independent of the extension-version-restriction rollout (#2315), but gives tests like its future policy test a proper home.
1. testinfra split.
test_ami_nix.py→conftest.py(shared session-scoped EC2 fixture + helpers) and six domain modules (postgrest / postgres / jit_pam / overrides / mitigations / apparmor), all 27 tests preserved. One EC2 instance still serves the whole run. The workflow now runspytest testinfra/, so new AMI tests get their own module instead of growing one file.2. Platform-policy test pattern in nix/tests.
nix/tests/README.mddocuments what was implicit: the pg_regress suite runs against the renderedsupautils.conf.j2with real migrations/roles (viastart-postgres-server), so supautils policy is testable as the actual platform roles withSET ROLE— conf changes and their tests can travel in the same PR.supautils_platform_policy.sqlseeds the pattern (privileged-extension delegation as the non-superuserpostgresrole, previously uncovered);supautils_reserved_roles.sqlwas the existing precedent.Draft until the seed test's expected output is confirmed against CI (hand-written; will promote from
regression_outputif it diffs).PSQL-1159 follow-up context: the warn-mode policy test lands as a follow-up PR on this pattern once this and #2315 merge.