e2e: assert the actor DNS zone answers benign rcodes - #1082
Draft
Yuan Gao (ygao-g) wants to merge 2 commits into
Draft
e2e: assert the actor DNS zone answers benign rcodes#1082Yuan Gao (ygao-g) wants to merge 2 commits into
Yuan Gao (ygao-g) wants to merge 2 commits into
Conversation
Nothing in the e2e harness could query the actor DNS zone. Suites reach actors by port-forwarding atenet-router and passing the actor name as a Host header, so the zone CoreDNS actually serves went unasserted, and a suite that wanted to check it had no way to distinguish an empty answer from a server failure. Adds a DNS client that port-forwards the atenet DNS Service and reports the rcode class alongside the addresses, plus a helper for the router's ClusterIP in each family. First of two commits; the tests that use these follow. clusterIPsByFamily here is a stopgap that agent-substrate#938 replaces with internal/ipfamily.
The zone answered A queries and failed everything else -- AAAA for a valid actor, and any name in the zone that is not an actor -- and no test caught it, because Go's resolver masks a SERVFAIL that musl treats as fatal. These assert the rcode class rather than the record: a non-A qtype and a name that misses the actor regex must come back NODATA or NXDOMAIN, and an A query must carry the router's ClusterIP. A separate test covers the AAAA record, skipped where the router has no v6 address. Second of two commits. The assertions are red until agent-substrate#874 and agent-substrate#938 land, so this stays a draft until then. Part of agent-substrate#246.
This was referenced Aug 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #246. Draft until #874 and #938 land — the assertions are red before them.
The actor DNS zone has no test coverage. Both e2e suites reach actors by port-forwarding atenet-router and passing the actor name as a
Hostheader, so nothing ever queries the zone CoreDNS actually serves — the IPv6-only e2e job is green whether the zone is correct or not.Adds an e2e DNS client that queries the atenet DNS Service directly and reports the rcode class, then asserts that a non-A qtype and a name that misses the actor regex come back NODATA or NXDOMAIN rather than SERVFAIL, and that an A query carries the router's ClusterIP. A separate test covers the AAAA record and skips where the router has no v6 address.
ClusterIPsByFamilyhere duplicates the one #938 adds ininternal/ipfamily; it is deleted in favour of that package when this rebases onto main.🤖 Generated with Claude Code