HAL9000
b0ff11ccef
- Extract AWS-specific logic into cloud_aws.py and cloud_providers.py to keep all files under the 500-line limit (cloud.py: 490 lines, cloud_aws.py: 498 lines, cloud_providers.py: 181 lines) - Fix sandbox test regression: change cloud_resources.feature sandbox create scenario from "aws" to "gcp" provider (AWS no longer raises NotImplementedError) - Add ImportError handling to step_sandbox_create/commit/rollback in cloud_resources_steps.py - Remove all 9 type: ignore comments from production code using proper type narrowing and boto3/botocore type stubs in typings/ - Move plan_id validation before logger.info() in all three sandbox methods (fail-fast principle) - Fix exception suppression: discover_aws_resources() now propagates exceptions instead of catching bare Exception - Move deferred imports (PhysVirt, ResourceCapabilities, _derive_child_id) to module level in cloud_aws.py - Split cloud_aws_sdk_steps.py (755 lines) into focused modules: cloud_aws_helpers.py, cloud_aws_session_steps.py, cloud_aws_discover_steps.py, cloud_aws_sandbox_steps.py - Add CHANGELOG.md entry for AWS SDK integration feature - Update robot/helper_cloud_resources.py to handle ImportError/ NotImplementedError for AWS sandbox operations ISSUES CLOSED: #1021
245 lines
12 KiB
Gherkin
245 lines
12 KiB
Gherkin
Feature: Cloud Infrastructure Resources
|
|
As a CleverAgents user
|
|
I want to define cloud infrastructure resources (aws, gcp, azure)
|
|
So that I can register and validate cloud provider configurations
|
|
|
|
# ── AWS resource type ─────────────────────────────────────
|
|
|
|
Scenario: AWS account resource type definition is valid
|
|
Given a cloud resource type definition for "aws-account"
|
|
Then the cloud type name should be "aws-account"
|
|
And the cloud type sandbox_strategy should be "none"
|
|
And the cloud type resource_kind should be "physical"
|
|
And the cloud type should be built_in
|
|
|
|
Scenario: AWS account resource type has correct CLI args
|
|
Given a cloud resource type definition for "aws-account"
|
|
Then the cloud type should have 5 cli_args
|
|
And the cloud type cli_args should include "access-key-id"
|
|
And the cloud type cli_args should include "secret-access-key"
|
|
And the cloud type cli_args should include "session-token"
|
|
And the cloud type cli_args should include "region"
|
|
And the cloud type cli_args should include "profile"
|
|
|
|
Scenario: AWS account type inherits from cloud-account
|
|
Given a cloud resource type definition for "aws-account"
|
|
Then the cloud type should inherit from "cloud-account"
|
|
|
|
Scenario: AWS credential resolution from env vars
|
|
Given AWS environment variables are set
|
|
When I resolve credentials for provider "aws"
|
|
Then the resolved credential "access-key-id" should not be None
|
|
And the resolved credential "secret-access-key" should not be None
|
|
And the resolved credential "region" should not be None
|
|
|
|
Scenario: AWS credential validation passes with env vars
|
|
Given AWS environment variables are set
|
|
When I resolve credentials for provider "aws"
|
|
And I validate credentials for provider "aws"
|
|
Then there should be no cloud validation errors
|
|
|
|
Scenario: AWS credential validation fails without credentials
|
|
Given no cloud environment variables are set
|
|
When I resolve credentials for provider "aws"
|
|
And I validate credentials for provider "aws"
|
|
Then there should be cloud validation errors
|
|
And the cloud validation errors should mention "access-key-id"
|
|
And the cloud validation errors should mention "secret-access-key"
|
|
|
|
Scenario: AWS profile name satisfies credential requirements
|
|
Given AWS profile environment variable is set to "my-profile"
|
|
When I resolve credentials for provider "aws"
|
|
And I validate credentials for provider "aws"
|
|
Then there should be no cloud validation errors
|
|
|
|
# ── GCP resource type ─────────────────────────────────────
|
|
|
|
Scenario: GCP resource type definition is valid
|
|
Given a cloud resource type definition for "gcp"
|
|
Then the cloud type name should be "gcp"
|
|
And the cloud type sandbox_strategy should be "none"
|
|
And the cloud type resource_kind should be "physical"
|
|
And the cloud type should be built_in
|
|
|
|
Scenario: GCP resource type has correct CLI args
|
|
Given a cloud resource type definition for "gcp"
|
|
Then the cloud type should have 3 cli_args
|
|
And the cloud type cli_args should include "service-account-json-path"
|
|
And the cloud type cli_args should include "project-id"
|
|
And the cloud type cli_args should include "region"
|
|
|
|
Scenario: GCP credential resolution from env vars
|
|
Given GCP environment variables are set
|
|
When I resolve credentials for provider "gcp"
|
|
Then the resolved credential "service-account-json-path" should not be None
|
|
And the resolved credential "project-id" should not be None
|
|
|
|
Scenario: GCP credential validation passes with env vars
|
|
Given GCP environment variables are set
|
|
When I resolve credentials for provider "gcp"
|
|
And I validate credentials for provider "gcp"
|
|
Then there should be no cloud validation errors
|
|
|
|
Scenario: GCP credential validation fails without credentials
|
|
Given no cloud environment variables are set
|
|
When I resolve credentials for provider "gcp"
|
|
And I validate credentials for provider "gcp"
|
|
Then there should be cloud validation errors
|
|
And the cloud validation errors should mention "service-account-json-path"
|
|
And the cloud validation errors should mention "project-id"
|
|
|
|
# ── Azure resource type ───────────────────────────────────
|
|
|
|
Scenario: Azure resource type definition is valid
|
|
Given a cloud resource type definition for "azure"
|
|
Then the cloud type name should be "azure"
|
|
And the cloud type sandbox_strategy should be "none"
|
|
And the cloud type resource_kind should be "physical"
|
|
And the cloud type should be built_in
|
|
|
|
Scenario: Azure resource type has correct CLI args
|
|
Given a cloud resource type definition for "azure"
|
|
Then the cloud type should have 5 cli_args
|
|
And the cloud type cli_args should include "subscription-id"
|
|
And the cloud type cli_args should include "tenant-id"
|
|
And the cloud type cli_args should include "client-id"
|
|
And the cloud type cli_args should include "client-secret"
|
|
And the cloud type cli_args should include "region"
|
|
|
|
Scenario: Azure credential resolution from env vars
|
|
Given Azure environment variables are set
|
|
When I resolve credentials for provider "azure"
|
|
Then the resolved credential "subscription-id" should not be None
|
|
And the resolved credential "tenant-id" should not be None
|
|
And the resolved credential "client-id" should not be None
|
|
And the resolved credential "client-secret" should not be None
|
|
|
|
Scenario: Azure credential validation passes with env vars
|
|
Given Azure environment variables are set
|
|
When I resolve credentials for provider "azure"
|
|
And I validate credentials for provider "azure"
|
|
Then there should be no cloud validation errors
|
|
|
|
Scenario: Azure credential validation fails without credentials
|
|
Given no cloud environment variables are set
|
|
When I resolve credentials for provider "azure"
|
|
And I validate credentials for provider "azure"
|
|
Then there should be cloud validation errors
|
|
And the cloud validation errors should mention "subscription-id"
|
|
And the cloud validation errors should mention "tenant-id"
|
|
And the cloud validation errors should mention "client-id"
|
|
And the cloud validation errors should mention "client-secret"
|
|
|
|
# ── Cloud hierarchy types ────────────────────────────────
|
|
|
|
Scenario: Generic cloud-account base type exists
|
|
Given a cloud resource type definition for "cloud-account"
|
|
Then the cloud type name should be "cloud-account"
|
|
And the cloud type should be built_in
|
|
And the cloud type should not be user_addable
|
|
|
|
Scenario: AWS VPC inherits from cloud-network
|
|
Given a cloud resource type definition for "aws-vpc"
|
|
Then the cloud type should inherit from "cloud-network"
|
|
And the cloud type should not be user_addable
|
|
|
|
Scenario: AWS S3 bucket inherits from cloud-object-store
|
|
Given a cloud resource type definition for "aws-s3-bucket"
|
|
Then the cloud type should inherit from "cloud-object-store"
|
|
And the cloud type should not be user_addable
|
|
|
|
Scenario: AWS ECS cluster inherits from cloud-container-cluster
|
|
Given a cloud resource type definition for "aws-ecs-cluster"
|
|
Then the cloud type should inherit from "cloud-container-cluster"
|
|
|
|
Scenario: GCP type inherits from cloud-account
|
|
Given a cloud resource type definition for "gcp"
|
|
Then the cloud type should inherit from "cloud-account"
|
|
|
|
Scenario: Azure type inherits from cloud-account
|
|
Given a cloud resource type definition for "azure"
|
|
Then the cloud type should inherit from "cloud-account"
|
|
|
|
# ── Credential masking ────────────────────────────────────
|
|
|
|
Scenario: Credential values are masked in error messages
|
|
Given no cloud environment variables are set
|
|
When I resolve credentials for provider "aws"
|
|
And I validate credentials for provider "aws"
|
|
Then the cloud validation errors should not contain secrets
|
|
|
|
# ── SDK execution ────────────────────────────────────────
|
|
|
|
Scenario: Cloud handler resolve raises ImportError for AWS when boto3 not installed
|
|
Given a valid AWS cloud resource
|
|
When I call resolve on the cloud handler
|
|
Then a cloud ImportError or NotImplementedError should be raised
|
|
|
|
Scenario: Cloud handler resolve raises NotImplementedError for GCP
|
|
Given a valid GCP cloud resource
|
|
When I call resolve on the cloud handler
|
|
Then a cloud NotImplementedError should be raised
|
|
And the cloud error message should mention "gcp"
|
|
|
|
Scenario: Cloud handler resolve raises NotImplementedError for Azure
|
|
Given a valid Azure cloud resource
|
|
When I call resolve on the cloud handler
|
|
Then a cloud NotImplementedError should be raised
|
|
And the cloud error message should mention "azure"
|
|
|
|
# ── Missing credential error ──────────────────────────────
|
|
|
|
Scenario: Cloud handler raises ValueError for missing AWS credentials
|
|
Given an AWS cloud resource without credentials
|
|
When I call resolve on the cloud handler
|
|
Then a cloud ValueError should be raised
|
|
And the cloud error message should mention "access-key-id"
|
|
|
|
Scenario: Cloud handler raises ValueError for missing GCP credentials
|
|
Given a GCP cloud resource without credentials
|
|
When I call resolve on the cloud handler
|
|
Then a cloud ValueError should be raised
|
|
And the cloud error message should mention "service-account-json-path"
|
|
|
|
Scenario: Cloud handler raises ValueError for missing Azure credentials
|
|
Given an Azure cloud resource without credentials
|
|
When I call resolve on the cloud handler
|
|
Then a cloud ValueError should be raised
|
|
And the cloud error message should mention "subscription-id"
|
|
|
|
# ── Cloud sandbox strategy stubs ──────────────────────────
|
|
|
|
Scenario: Cloud sandbox create raises NotImplementedError
|
|
Given a cloud sandbox strategy for "gcp"
|
|
When I call create on the sandbox strategy
|
|
Then a cloud NotImplementedError should be raised
|
|
|
|
Scenario: Cloud sandbox commit raises NotImplementedError
|
|
Given a cloud sandbox strategy for "gcp"
|
|
When I call commit on the sandbox strategy
|
|
Then a cloud NotImplementedError should be raised
|
|
|
|
Scenario: Cloud sandbox rollback raises NotImplementedError
|
|
Given a cloud sandbox strategy for "azure"
|
|
When I call rollback on the sandbox strategy
|
|
Then a cloud NotImplementedError should be raised
|
|
|
|
Scenario: Cloud sandbox validate returns no errors with valid config
|
|
Given a cloud sandbox strategy for "aws"
|
|
And AWS environment variables are set
|
|
When I validate the cloud sandbox strategy
|
|
Then there should be no cloud validation errors
|
|
|
|
# ── Unknown provider ──────────────────────────────────────
|
|
|
|
Scenario: Unknown provider raises ValueError
|
|
When I try to resolve credentials for provider "alibaba"
|
|
Then a cloud ValueError should be raised
|
|
And the cloud error message should mention "alibaba"
|
|
|
|
# ── Handler protocol conformance ──────────────────────────
|
|
|
|
Scenario: CloudResourceHandler satisfies ResourceHandler protocol
|
|
Given a CloudResourceHandler instance
|
|
Then the cloud handler should satisfy the ResourceHandler protocol
|