freemo
c65e8a5285
CI / benchmark-publish (pull_request) Has been skipped
CI / build (pull_request) Successful in 16s
CI / lint (pull_request) Successful in 17s
CI / quality (pull_request) Successful in 29s
CI / typecheck (pull_request) Successful in 59s
CI / security (pull_request) Successful in 59s
CI / unit_tests (pull_request) Successful in 3m9s
CI / integration_tests (pull_request) Successful in 3m34s
CI / e2e_tests (pull_request) Successful in 3m54s
CI / docker (pull_request) Successful in 55s
CI / coverage (pull_request) Successful in 6m1s
CI / build (push) Successful in 15s
CI / lint (push) Successful in 16s
CI / quality (push) Successful in 27s
CI / typecheck (push) Successful in 38s
CI / benchmark-regression (push) Has been skipped
CI / security (push) Successful in 48s
CI / unit_tests (push) Successful in 3m14s
CI / integration_tests (push) Successful in 3m30s
CI / docker (push) Successful in 56s
CI / e2e_tests (push) Successful in 4m43s
CI / coverage (push) Successful in 6m1s
CI / benchmark-publish (push) Successful in 19m50s
CI / benchmark-regression (pull_request) Successful in 37m17s
Implement cloud resource types (aws, gcp, azure) with credential fields, region/tenant metadata, and stubbed sandbox strategies. Credential resolution uses environment variables and profile names with no secrets logged. Key changes: - Add CloudResourceHandler with aws/gcp/azure type definitions - Add credential resolution from env vars and profile names - Add stubbed sandbox strategies (validate config, raise NotImplementedError) - Register cloud types in bootstrap_builtin_types - Credential masking via existing redaction patterns - Add Behave BDD tests, Robot integration tests, ASV benchmarks ISSUES CLOSED: #343
246 lines
12 KiB
Gherkin
246 lines
12 KiB
Gherkin
Feature: Cloud Infrastructure Resources
|
|
As a CleverAgents user
|
|
I want to define cloud infrastructure resources (aws, gcp, azure)
|
|
So that I can register and validate cloud provider configurations
|
|
|
|
# ── AWS resource type ─────────────────────────────────────
|
|
|
|
Scenario: AWS account resource type definition is valid
|
|
Given a cloud resource type definition for "aws-account"
|
|
Then the cloud type name should be "aws-account"
|
|
And the cloud type sandbox_strategy should be "none"
|
|
And the cloud type resource_kind should be "physical"
|
|
And the cloud type should be built_in
|
|
|
|
Scenario: AWS account resource type has correct CLI args
|
|
Given a cloud resource type definition for "aws-account"
|
|
Then the cloud type should have 5 cli_args
|
|
And the cloud type cli_args should include "access-key-id"
|
|
And the cloud type cli_args should include "secret-access-key"
|
|
And the cloud type cli_args should include "session-token"
|
|
And the cloud type cli_args should include "region"
|
|
And the cloud type cli_args should include "profile"
|
|
|
|
Scenario: AWS account type inherits from cloud-account
|
|
Given a cloud resource type definition for "aws-account"
|
|
Then the cloud type should inherit from "cloud-account"
|
|
|
|
Scenario: AWS credential resolution from env vars
|
|
Given AWS environment variables are set
|
|
When I resolve credentials for provider "aws"
|
|
Then the resolved credential "access-key-id" should not be None
|
|
And the resolved credential "secret-access-key" should not be None
|
|
And the resolved credential "region" should not be None
|
|
|
|
Scenario: AWS credential validation passes with env vars
|
|
Given AWS environment variables are set
|
|
When I resolve credentials for provider "aws"
|
|
And I validate credentials for provider "aws"
|
|
Then there should be no cloud validation errors
|
|
|
|
Scenario: AWS credential validation fails without credentials
|
|
Given no cloud environment variables are set
|
|
When I resolve credentials for provider "aws"
|
|
And I validate credentials for provider "aws"
|
|
Then there should be cloud validation errors
|
|
And the cloud validation errors should mention "access-key-id"
|
|
And the cloud validation errors should mention "secret-access-key"
|
|
|
|
Scenario: AWS profile name satisfies credential requirements
|
|
Given AWS profile environment variable is set to "my-profile"
|
|
When I resolve credentials for provider "aws"
|
|
And I validate credentials for provider "aws"
|
|
Then there should be no cloud validation errors
|
|
|
|
# ── GCP resource type ─────────────────────────────────────
|
|
|
|
Scenario: GCP resource type definition is valid
|
|
Given a cloud resource type definition for "gcp"
|
|
Then the cloud type name should be "gcp"
|
|
And the cloud type sandbox_strategy should be "none"
|
|
And the cloud type resource_kind should be "physical"
|
|
And the cloud type should be built_in
|
|
|
|
Scenario: GCP resource type has correct CLI args
|
|
Given a cloud resource type definition for "gcp"
|
|
Then the cloud type should have 3 cli_args
|
|
And the cloud type cli_args should include "service-account-json-path"
|
|
And the cloud type cli_args should include "project-id"
|
|
And the cloud type cli_args should include "region"
|
|
|
|
Scenario: GCP credential resolution from env vars
|
|
Given GCP environment variables are set
|
|
When I resolve credentials for provider "gcp"
|
|
Then the resolved credential "service-account-json-path" should not be None
|
|
And the resolved credential "project-id" should not be None
|
|
|
|
Scenario: GCP credential validation passes with env vars
|
|
Given GCP environment variables are set
|
|
When I resolve credentials for provider "gcp"
|
|
And I validate credentials for provider "gcp"
|
|
Then there should be no cloud validation errors
|
|
|
|
Scenario: GCP credential validation fails without credentials
|
|
Given no cloud environment variables are set
|
|
When I resolve credentials for provider "gcp"
|
|
And I validate credentials for provider "gcp"
|
|
Then there should be cloud validation errors
|
|
And the cloud validation errors should mention "service-account-json-path"
|
|
And the cloud validation errors should mention "project-id"
|
|
|
|
# ── Azure resource type ───────────────────────────────────
|
|
|
|
Scenario: Azure resource type definition is valid
|
|
Given a cloud resource type definition for "azure"
|
|
Then the cloud type name should be "azure"
|
|
And the cloud type sandbox_strategy should be "none"
|
|
And the cloud type resource_kind should be "physical"
|
|
And the cloud type should be built_in
|
|
|
|
Scenario: Azure resource type has correct CLI args
|
|
Given a cloud resource type definition for "azure"
|
|
Then the cloud type should have 5 cli_args
|
|
And the cloud type cli_args should include "subscription-id"
|
|
And the cloud type cli_args should include "tenant-id"
|
|
And the cloud type cli_args should include "client-id"
|
|
And the cloud type cli_args should include "client-secret"
|
|
And the cloud type cli_args should include "region"
|
|
|
|
Scenario: Azure credential resolution from env vars
|
|
Given Azure environment variables are set
|
|
When I resolve credentials for provider "azure"
|
|
Then the resolved credential "subscription-id" should not be None
|
|
And the resolved credential "tenant-id" should not be None
|
|
And the resolved credential "client-id" should not be None
|
|
And the resolved credential "client-secret" should not be None
|
|
|
|
Scenario: Azure credential validation passes with env vars
|
|
Given Azure environment variables are set
|
|
When I resolve credentials for provider "azure"
|
|
And I validate credentials for provider "azure"
|
|
Then there should be no cloud validation errors
|
|
|
|
Scenario: Azure credential validation fails without credentials
|
|
Given no cloud environment variables are set
|
|
When I resolve credentials for provider "azure"
|
|
And I validate credentials for provider "azure"
|
|
Then there should be cloud validation errors
|
|
And the cloud validation errors should mention "subscription-id"
|
|
And the cloud validation errors should mention "tenant-id"
|
|
And the cloud validation errors should mention "client-id"
|
|
And the cloud validation errors should mention "client-secret"
|
|
|
|
# ── Cloud hierarchy types ────────────────────────────────
|
|
|
|
Scenario: Generic cloud-account base type exists
|
|
Given a cloud resource type definition for "cloud-account"
|
|
Then the cloud type name should be "cloud-account"
|
|
And the cloud type should be built_in
|
|
And the cloud type should not be user_addable
|
|
|
|
Scenario: AWS VPC inherits from cloud-network
|
|
Given a cloud resource type definition for "aws-vpc"
|
|
Then the cloud type should inherit from "cloud-network"
|
|
And the cloud type should not be user_addable
|
|
|
|
Scenario: AWS S3 bucket inherits from cloud-object-store
|
|
Given a cloud resource type definition for "aws-s3-bucket"
|
|
Then the cloud type should inherit from "cloud-object-store"
|
|
And the cloud type should not be user_addable
|
|
|
|
Scenario: AWS ECS cluster inherits from cloud-container-cluster
|
|
Given a cloud resource type definition for "aws-ecs-cluster"
|
|
Then the cloud type should inherit from "cloud-container-cluster"
|
|
|
|
Scenario: GCP type inherits from cloud-account
|
|
Given a cloud resource type definition for "gcp"
|
|
Then the cloud type should inherit from "cloud-account"
|
|
|
|
Scenario: Azure type inherits from cloud-account
|
|
Given a cloud resource type definition for "azure"
|
|
Then the cloud type should inherit from "cloud-account"
|
|
|
|
# ── Credential masking ────────────────────────────────────
|
|
|
|
Scenario: Credential values are masked in error messages
|
|
Given no cloud environment variables are set
|
|
When I resolve credentials for provider "aws"
|
|
And I validate credentials for provider "aws"
|
|
Then the cloud validation errors should not contain secrets
|
|
|
|
# ── Stub execution ────────────────────────────────────────
|
|
|
|
Scenario: Cloud handler resolve raises NotImplementedError for AWS
|
|
Given a valid AWS cloud resource
|
|
When I call resolve on the cloud handler
|
|
Then a cloud NotImplementedError should be raised
|
|
And the cloud error message should mention "aws"
|
|
|
|
Scenario: Cloud handler resolve raises NotImplementedError for GCP
|
|
Given a valid GCP cloud resource
|
|
When I call resolve on the cloud handler
|
|
Then a cloud NotImplementedError should be raised
|
|
And the cloud error message should mention "gcp"
|
|
|
|
Scenario: Cloud handler resolve raises NotImplementedError for Azure
|
|
Given a valid Azure cloud resource
|
|
When I call resolve on the cloud handler
|
|
Then a cloud NotImplementedError should be raised
|
|
And the cloud error message should mention "azure"
|
|
|
|
# ── Missing credential error ──────────────────────────────
|
|
|
|
Scenario: Cloud handler raises ValueError for missing AWS credentials
|
|
Given an AWS cloud resource without credentials
|
|
When I call resolve on the cloud handler
|
|
Then a cloud ValueError should be raised
|
|
And the cloud error message should mention "access-key-id"
|
|
|
|
Scenario: Cloud handler raises ValueError for missing GCP credentials
|
|
Given a GCP cloud resource without credentials
|
|
When I call resolve on the cloud handler
|
|
Then a cloud ValueError should be raised
|
|
And the cloud error message should mention "service-account-json-path"
|
|
|
|
Scenario: Cloud handler raises ValueError for missing Azure credentials
|
|
Given an Azure cloud resource without credentials
|
|
When I call resolve on the cloud handler
|
|
Then a cloud ValueError should be raised
|
|
And the cloud error message should mention "subscription-id"
|
|
|
|
# ── Cloud sandbox strategy stubs ──────────────────────────
|
|
|
|
Scenario: Cloud sandbox create raises NotImplementedError
|
|
Given a cloud sandbox strategy for "aws"
|
|
When I call create on the sandbox strategy
|
|
Then a cloud NotImplementedError should be raised
|
|
|
|
Scenario: Cloud sandbox commit raises NotImplementedError
|
|
Given a cloud sandbox strategy for "gcp"
|
|
When I call commit on the sandbox strategy
|
|
Then a cloud NotImplementedError should be raised
|
|
|
|
Scenario: Cloud sandbox rollback raises NotImplementedError
|
|
Given a cloud sandbox strategy for "azure"
|
|
When I call rollback on the sandbox strategy
|
|
Then a cloud NotImplementedError should be raised
|
|
|
|
Scenario: Cloud sandbox validate returns no errors with valid config
|
|
Given a cloud sandbox strategy for "aws"
|
|
And AWS environment variables are set
|
|
When I validate the cloud sandbox strategy
|
|
Then there should be no cloud validation errors
|
|
|
|
# ── Unknown provider ──────────────────────────────────────
|
|
|
|
Scenario: Unknown provider raises ValueError
|
|
When I try to resolve credentials for provider "alibaba"
|
|
Then a cloud ValueError should be raised
|
|
And the cloud error message should mention "alibaba"
|
|
|
|
# ── Handler protocol conformance ──────────────────────────
|
|
|
|
Scenario: CloudResourceHandler satisfies ResourceHandler protocol
|
|
Given a CloudResourceHandler instance
|
|
Then the cloud handler should satisfy the ResourceHandler protocol
|