Skip to content

DAOS-18783 test: ftest coverage for per-pool node authentication#18335

Draft
mjmac wants to merge 5 commits into
masterfrom
mjmac/DAOS-18783-pr5-ftest
Draft

DAOS-18783 test: ftest coverage for per-pool node authentication#18335
mjmac wants to merge 5 commits into
masterfrom
mjmac/DAOS-18783-pr5-ftest

Conversation

@mjmac

@mjmac mjmac commented May 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Add ftest scenarios for the node-cert lifecycle (set-cert, get-cert,
add-client, delete-cert) and for revocation (revoke-client must evict
active handles and prevent reconnect with the old cert).

Features: pool_cert
Signed-off-by: Michael MacDonald github@macdonald.cx

@mjmac mjmac force-pushed the mjmac/DAOS-18783-pr5-ftest branch from 6cf98a9 to e3e2d3b Compare May 22, 2026 18:37
@github-actions

github-actions Bot commented May 22, 2026 •
edited
Loading

Copy link
Copy Markdown

Ticket title is 'Enable certificate-based client authentication'
Status is 'Open'
https://daosio.atlassian.net/browse/DAOS-18783

@daosbuild3

daosbuild3 commented May 24, 2026

Copy link
Copy Markdown
Collaborator

Test stage Functional on EL 9 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net//job/daos-stack/job/daos/view/change-requests/job/PR-18335/2/execution/node/1119/log

@mjmac mjmac force-pushed the mjmac/DAOS-18783-pr5-ftest branch from e3e2d3b to f8ab6ef Compare May 25, 2026 18:50
@daosbuild3

daosbuild3 commented May 26, 2026

Copy link
Copy Markdown
Collaborator

Test stage Functional on EL 9 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net//job/daos-stack/job/daos/view/change-requests/job/PR-18335/3/execution/node/985/log

@mjmac mjmac force-pushed the mjmac/DAOS-18783-pr5-ftest branch 3 times, most recently from 82f7ac0 to 34b0f69 Compare May 27, 2026 20:09
@daosbuild3

daosbuild3 commented May 28, 2026

Copy link
Copy Markdown
Collaborator

Test stage Functional on EL 9 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net//job/daos-stack/job/daos/view/change-requests/job/PR-18335/8/execution/node/1098/log

@mjmac mjmac force-pushed the mjmac/DAOS-18783-pr5-ftest branch from 34b0f69 to 852168e Compare May 29, 2026 01:52
@daosbuild3

daosbuild3 commented May 29, 2026

Copy link
Copy Markdown
Collaborator

Test stage NLT completed with status UNSTABLE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net/job/daos-stack/job/daos//view/change-requests/job/PR-18335/9/testReport/

@mjmac mjmac force-pushed the mjmac/DAOS-18783-pr5-ftest branch 2 times, most recently from 6994ff3 to 957a12e Compare May 30, 2026 14:27
@daosbuild3

daosbuild3 commented May 30, 2026

Copy link
Copy Markdown
Collaborator

Test stage Functional on EL 9 completed with status UNSTABLE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net/job/daos-stack/job/daos//view/change-requests/job/PR-18335/12/testReport/

@mjmac mjmac force-pushed the mjmac/DAOS-18783-pr5-ftest branch from 957a12e to 5059f6f Compare May 30, 2026 23:58
@daosbuild3

daosbuild3 commented May 31, 2026

Copy link
Copy Markdown
Collaborator

Test stage NLT completed with status UNSTABLE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net/job/daos-stack/job/daos//view/change-requests/job/PR-18335/13/testReport/

@mjmac mjmac force-pushed the mjmac/DAOS-18783-pr5-ftest branch from 5059f6f to a613864 Compare May 31, 2026 03:16
@daosbuild3

daosbuild3 commented May 31, 2026

Copy link
Copy Markdown
Collaborator

Test stage Functional on EL 9 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net//job/daos-stack/job/daos/view/change-requests/job/PR-18335/14/execution/node/1010/log

@mjmac mjmac force-pushed the mjmac/DAOS-18783-pr5-ftest branch 2 times, most recently from 91cbde4 to 730c3bb Compare May 31, 2026 13:23
@daosbuild3

daosbuild3 commented May 31, 2026

Copy link
Copy Markdown
Collaborator

Test stage Functional on EL 9 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net//job/daos-stack/job/daos/view/change-requests/job/PR-18335/16/execution/node/960/log

@mjmac mjmac force-pushed the mjmac/DAOS-18783-pr5-ftest branch 2 times, most recently from 8e0540d to 8005c57 Compare May 31, 2026 19:47
@daosbuild3

daosbuild3 commented May 31, 2026

Copy link
Copy Markdown
Collaborator

Test stage Unit Test completed with status UNSTABLE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net/job/daos-stack/job/daos//view/change-requests/job/PR-18335/18/testReport/

@mjmac mjmac force-pushed the mjmac/DAOS-18783-pr5-ftest branch 3 times, most recently from 1e53e2b to 8a7c057 Compare May 31, 2026 23:23
@daosbuild3

daosbuild3 commented Jun 1, 2026

Copy link
Copy Markdown
Collaborator

Test stage Functional on EL 9 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net//job/daos-stack/job/daos/view/change-requests/job/PR-18335/21/execution/node/1010/log

grom72
grom72 requested changes Jun 1, 2026
View reviewed changes

@grom72 grom72 left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The skip_substrings list was removed on purpose in SRE-3703 (#17953).
The new infrastructure (VM-based) created for NLT/FI testing execution in CI should solve the problems that have been happening before.

@mjmac mjmac force-pushed the mjmac/DAOS-18783-pr5-ftest branch from 8a7c057 to f5f18b8 Compare June 1, 2026 14:55
@daosbuild3

daosbuild3 commented Jun 1, 2026

Copy link
Copy Markdown
Collaborator

Test stage Functional on EL 9 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net//job/daos-stack/job/daos/view/change-requests/job/PR-18335/22/execution/node/1009/log

@mjmac mjmac force-pushed the mjmac/DAOS-18783-pr5-ftest branch from f5f18b8 to db5c0e3 Compare June 2, 2026 14:45
@daosbuild3

daosbuild3 commented Jun 2, 2026

Copy link
Copy Markdown
Collaborator

Test stage NLT completed with status UNSTABLE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net/job/daos-stack/job/daos//view/change-requests/job/PR-18335/23/testReport/

@mjmac mjmac changed the title mjmac/DAOS 18783 pr5 ftest DAOS-18783 test: ftest coverage for per-pool node authentication Jun 2, 2026
@mjmac

mjmac commented Jun 2, 2026

Copy link
Copy Markdown
Contributor Author

The skip_substrings list was removed on purpose in SRE-3703 (#17953). The new infrastructure (VM-based) created for NLT/FI testing execution in CI should solve the problems that have been happening before.

OK, thanks. Yeah, I had that as a temp hack. It's removed now.

@daosbuild3

daosbuild3 commented Jun 2, 2026

Copy link
Copy Markdown
Collaborator

Test stage Functional on EL 9 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net//job/daos-stack/job/daos/view/change-requests/job/PR-18335/23/execution/node/982/log

mjmac added 5 commits June 4, 2026 10:44
@mjmac
DAOS-18783 pool: add pool_ca and cert_watermarks byteval properties
1417bdd 
Reserve property storage on the pool for the per-pool CA bundle and
the per-CN revocation watermarks. The byteval length cap bounds
decode-time allocation.

Bump DAOS_POOL_GLOBAL_VERSION to 5 and gate the new wire format on
v5 so older engines never see byteval entries on a 2.8.0-era pool.

Signed-off-by: Michael MacDonald <github@macdonald.cx>
@mjmac
DAOS-18783 control: attach per-pool node cert to credentials
715124f 
Attach a per-pool node certificate and proof-of-possession to
pool connect credential requests. Bump the pool connect RPC to
v8 to carry the new fields; v7 peers continue to interoperate.

Signed-off-by: Michael MacDonald <github@macdonald.cx>
@mjmac
DAOS-18783 control: enforce per-pool node cert at connect
10af3d3 
Verify the per-pool node certificate and proof-of-possession when
a client connects to a pool that has a CA installed. Pools without
a CA continue to behave exactly as before.

Signed-off-by: Michael MacDonald <github@macdonald.cx>
@mjmac
DAOS-18783 control: dmg pool admin surface for node auth
4cc472d 
Add dmg subcommands and Control API for managing per-pool CAs
and client certificates.

Signed-off-by: Michael MacDonald <github@macdonald.cx>
@mjmac
DAOS-18783 test: ftest coverage for per-pool node authentication
cd910c7 
Add ftest scenarios for the node-cert lifecycle (set-cert, get-cert,
add-client, delete-cert) and for revocation (revoke-client must evict
active handles and prevent reconnect with the old cert).

Features: pool_cert
Signed-off-by: Michael MacDonald <github@macdonald.cx>
@mjmac mjmac force-pushed the mjmac/DAOS-18783-pr5-ftest branch from db5c0e3 to cd910c7 Compare June 4, 2026 14:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@grom72 grom72 grom72 requested changes

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@mjmac @daosbuild3 @grom72