Testing Architecture

apiVersion: v1
kind: ConfigMap
metadata:
  name: ephpm-security-test-config
data:
  ephpm.toml: |
    [server]
    listen = "0.0.0.0:8080"
    document_root = "/var/www/html"

    [server.security]
    blocked_paths = ["/wp-config.php", "/vendor/*"]
    allowed_php_paths = ["/index.php", "/test.php", "/info.php"]
    trusted_proxies = ["10.0.0.0/8"]

    [server.request]
    max_body_size = 1024
    trusted_hosts = ["ephpm", "ephpm.default.svc.cluster.local"]

    [server.response]
    headers = [
        ["X-Frame-Options", "DENY"],
        ["Strict-Transport-Security", "max-age=63072000"],
    ]

# Default ephpm instance (standard config)
k8s_yaml('k8s/base/ephpm-single.yaml')

# Security-focused instance (blocked paths, allowlist, trusted hosts)
k8s_yaml('k8s/tests/ephpm-security.yaml')

# TLS instance (manual certs)
k8s_yaml('k8s/tests/ephpm-tls.yaml')

# Timeout instance (short timeouts for testing)
k8s_yaml('k8s/tests/ephpm-timeouts.yaml')

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: ephpm-cluster
spec:
  serviceName: ephpm-headless
  replicas: 3
  template:
    spec:
      containers:
        - name: ephpm
          env:
            - name: EPHPM_CLUSTER__ENABLED
              value: "true"
            - name: EPHPM_CLUSTER__JOIN
              value: "ephpm-headless.default.svc.cluster.local"
            - name: EPHPM_CLUSTER__SECRET
              valueFrom:
                secretKeyRef:
                  name: ephpm-cluster
                  key: secret
---
apiVersion: v1
kind: Service
metadata:
  name: ephpm-headless
spec:
  clusterIP: None
  selector:
    app: ephpm-cluster
  ports:
    - name: http
      port: 8080
    - name: gossip
      port: 7946
      protocol: UDP
    - name: data
      port: 7947
---
# Load-balanced service for client-facing requests
apiVersion: v1
kind: Service
metadata:
  name: ephpm-cluster-lb
spec:
  selector:
    app: ephpm-cluster
  ports:
    - name: http
      port: 8080

kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
  - role: control-plane
  - role: worker
  - role: worker
  - role: worker

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: partition-pod-0
spec:
  podSelector:
    matchLabels:
      statefulset.kubernetes.io/pod-name: ephpm-cluster-0
  policyTypes:
    - Ingress
    - Egress
  ingress: []   # block all inbound from other pods
  egress: []    # block all outbound to other pods

/// Query the Node API for cluster state.
async fn cluster_state(pod_url: &str) -> ClusterState {
    let resp = reqwest::get(format!("{pod_url}/api/kv/cluster")).await.unwrap();
    resp.json::<ClusterState>().await.unwrap()
}

/// Assert all pods see the expected number of cluster members.
async fn assert_cluster_size(pods: &[&str], expected: usize) {
    for pod in pods {
        let state = cluster_state(pod).await;
        assert_eq!(state.members.len(), expected, "pod {pod} sees wrong member count");
    }
}

/// Assert a key is accessible from a specific pod.
async fn assert_key_readable(pod_url: &str, key: &str, expected_value: &str) {
    let resp = reqwest::get(format!("{pod_url}/test-kv-get.php?key={key}")).await.unwrap();
    assert_eq!(resp.status(), 200);
    assert_eq!(resp.text().await.unwrap(), expected_value);
}

/// Wait for cluster to reach target size with timeout.
async fn wait_for_cluster(pods: &[&str], target_size: usize, timeout: Duration) {
    let deadline = Instant::now() + timeout;
    loop {
        let mut all_ready = true;
        for pod in pods {
            let state = cluster_state(pod).await;
            if state.members.len() != target_size {
                all_ready = false;
                break;
            }
        }
        if all_ready { return; }
        assert!(Instant::now() < deadline, "cluster did not reach size {target_size} within {timeout:?}");
        tokio::time::sleep(Duration::from_secs(1)).await;
    }
}

# .github/workflows/e2e.yml (extended)
jobs:
  e2e-single:
    strategy:
      matrix:
        php: ["8.4", "8.5"]
    steps:
      - uses: actions/checkout@v4
      - run: cargo xtask e2e-install
      - run: cargo xtask e2e --php-version ${{ matrix.php }} --suite single

  e2e-cluster:
    needs: e2e-single
    strategy:
      matrix:
        php: ["8.5"]   # cluster tests on latest PHP only
    steps:
      - uses: actions/checkout@v4
      - run: cargo xtask e2e-install
      - run: cargo xtask e2e --php-version ${{ matrix.php }} --suite cluster --workers 3