dohertj2/lmxopcua
1
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects Releases Wiki Activity

NAT opc-plc fixture: persistent PKI so CI can run the positive secure case; raise MIN_EXECUTED #818

New Issue
Closed
opened 2026-11-11 00:05:56 -05:00 by dohertj2 · 3 comments
dohertj2 commented 2026-11-11 00:05:56 -05:00
Owner
Copy Link
Copy Source

Follow-up to #813. The NAT fixture generates a new certificate whenever the container is recreated, so CI can only run the refusal form of the secure test. Give it a persistent PKI volume (and trust the cert in the CI browser trust store) so OPCUA_NAT_SERVER_CERT_TRUSTED=1 can run in CI. Once a hosted v2-integration run confirms the 3 NAT tests execute, raise MIN_EXECUTED by 3.

Follow-up to #813. The NAT fixture generates a new certificate whenever the container is recreated, so CI can only run the refusal form of the secure test. Give it a persistent PKI volume (and trust the cert in the CI browser trust store) so `OPCUA_NAT_SERVER_CERT_TRUSTED=1` can run in CI. Once a hosted v2-integration run confirms the 3 NAT tests execute, raise `MIN_EXECUTED` by 3.
dohertj2 added the type:infrapriority:p3 labels 2026-11-11 00:05:56 -05:00
dohertj2 commented 2026-11-11 10:10:09 -05:00
Author
Owner
Copy Link
Copy Source

Re-verified 2026-11-11 (worktree commit b57fb471, docs only). Persistent PKI from ae91e6b7 holds: on 10.100.0.35, /opt/otopcua-opcuaclient-nat compose == repo; container 55e75b949250 -> --force-recreate -> ddb3ca81b9dd, server cert SHA-1 1FBF87914070AA01D492AA7DBD31EC7F387BC6AE both times == committed Docker/nat/opc-plc-nat-server.der. NatPublishedEndpointBrowseTests 7/7 passed, 0 skipped, against the shared stack (committed cert; OPCUA_NAT_SERVER_CERT_TRUSTED is retired) AND against a CI-style throwaway docker run + docker-exec cert hand-off (OPCUA_NAT_SERVER_CERT). CI filter, local: Driver.OpcUaClient 9 / Browser 12 executed (13 -> 21, +8 => 448). MIN_EXECUTED NOT raised: no hosted v2-integration run has reached the test step (runs 1137, 1213 fail at 'TIMEOUT waiting for questdb', which is the first network probe) -> filed #860. Raise 440->448 once a hosted TRX shows 9/12.

Re-verified 2026-11-11 (worktree commit b57fb471, docs only). Persistent PKI from ae91e6b7 holds: on 10.100.0.35, /opt/otopcua-opcuaclient-nat compose == repo; container 55e75b949250 -> --force-recreate -> ddb3ca81b9dd, server cert SHA-1 1FBF87914070AA01D492AA7DBD31EC7F387BC6AE both times == committed Docker/nat/opc-plc-nat-server.der. NatPublishedEndpointBrowseTests 7/7 passed, 0 skipped, against the shared stack (committed cert; OPCUA_NAT_SERVER_CERT_TRUSTED is retired) AND against a CI-style throwaway docker run + docker-exec cert hand-off (OPCUA_NAT_SERVER_CERT). CI filter, local: Driver.OpcUaClient 9 / Browser 12 executed (13 -> 21, +8 => 448). MIN_EXECUTED NOT raised: no hosted v2-integration run has reached the test step (runs 1137, 1213 fail at 'TIMEOUT waiting for questdb', which is the first network probe) -> filed #860. Raise 440->448 once a hosted TRX shows 9/12.
dohertj2 commented 2026-11-11 11:28:52 -05:00
Author
Owner
Copy Link
Copy Source

The CI fixture-host bug blocking this is fixed in 4b68729a (#860), Pushed to master in e857135e. Once a hosted v2-integration run executes the NAT tests (9 + 12 executed in the two OpcUaClient projects), raise MIN_EXECUTED 440 → 448 (and the e2e floor 35 → 39 after a hosted e2e run).

The CI fixture-host bug blocking this is fixed in `4b68729a` (#860), Pushed to master in `e857135e`. Once a hosted `v2-integration` run executes the NAT tests (9 + 12 executed in the two OpcUaClient projects), raise `MIN_EXECUTED` 440 → 448 (and the e2e floor 35 → 39 after a hosted e2e run).
dohertj2 commented 2026-11-11 18:08:02 -05:00
Author
Owner
Copy Link
Copy Source

Done. Hosted run 1225 shows Driver.OpcUaClient.trx executed=9 and Driver.OpcUaClient.Browser.trx executed=12, with 0 skipped, so the NAT certificate hand-off works on the runner. MIN_EXECUTED in v2-integration.yml is raised from 440 to 448 (71740a5a, master 43f8b8e8). The v2-e2e.yml raise from 35 to 39 still needs a hosted e2e run; it is noted in scripts/ci/README.md.

Done. Hosted run 1225 shows `Driver.OpcUaClient.trx` executed=9 and `Driver.OpcUaClient.Browser.trx` executed=12, with 0 skipped, so the NAT certificate hand-off works on the runner. `MIN_EXECUTED` in `v2-integration.yml` is raised from 440 to **448** (`71740a5a`, master `43f8b8e8`). The `v2-e2e.yml` raise from 35 to 39 still needs a hosted e2e run; it is noted in scripts/ci/README.md.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
auto-managed
queue management
 blocked
Blocked by dependency or external hold
 cross-driver
queue management
 cross-repo
Needs coordinated change in another family repo (wire contract etc.)
 driver/abcip
queue management
 driver/ablegacy
queue management
 driver/focas
queue management
 driver/mqtt
MQTT / Sparkplug B broker-subscribe driver
 driver/opcuaclient
queue management
 driver/s7
queue management
 driver/twincat
queue management
 migrated
Migrated from a markdown backlog (2026-11 standardization)
 phase/1
queue management
 phase/2
queue management
 phase/3
queue management
 phase/4
queue management
 phase/5
queue management
 phase/6
queue management
 priority:p0
Must-have / blocking
 priority:p1
High priority
 priority:p2
Normal priority
 priority:p3
Low priority / nice to have
 queue/blocked
queue management
 queue/done
queue management
 queue/failed
queue management
 queue/in-progress
queue management
 queue/queued
queue management
 type:bug
Defect in shipped behaviour
 type:debt
Technical debt / hygiene
 type:deploy-gate
Rollout/deploy/migration step not yet done on an environment
 type:docs
Documentation work
 type:feature
Feature implementation
 type:followup
Follow-up deferred from a plan, PR or gate
 type:infra
Infrastructure and scaffolding
 type:review-finding
Unfixed finding from an architecture/code review
 type:test
Test work
No Label priority:p3 type:infra
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dohertj2 (dohertj2)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#818
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?