control-plane.yaml

# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: LicenseRef-NvidiaProprietary

# NVIDIA CORPORATION, its affiliates and licensors retain all intellectual
# property and proprietary rights in and to this material, related
# documentation and any modifications thereto. Any use, reproduction,
# disclosure or distribution of this material and related documentation
# without an express license agreement from NVIDIA CORPORATION or
# its affiliates is strictly prohibited.

# Control Plane Validation - Canonical Configuration
#
# THE canonical control plane test suite. Provider configs import this
# file and override commands with platform-specific stubs.
#
# Architecture:
#   - Scripts: Platform-specific (YOU implement these) - CRUD operations
#   - Validations: Platform-agnostic (provided) - just check JSON output
#
# Contract:
#   Each script MUST print a JSON object to stdout. The validations
#   only inspect that JSON. As long as your scripts output the right
#   fields, the validations pass regardless of which cloud you use.
#
# Test groups:
#   1. API Health - Authentication and service connectivity
#   2. Access Key Lifecycle - Create, authenticate, disable, verify rejection, delete
#   3. Tenant Lifecycle - Create, list, get info, delete
#
# Quick start (new provider):
#   1. Create your provider folder: mkdir -p isvctl/configs/providers/my-isv/
#   2. Create providers/my-isv/control-plane.yaml with: import: ../../tests/control-plane.yaml
#   3. Override commands with your platform stubs
#   4. Run: uv run isvctl test run -f isvctl/configs/providers/my-isv/control-plane.yaml
#
# See also:
#   - AWS reference implementation: ../aws/control-plane.yaml + ../stubs/aws/control-plane/
#   - JSON schemas: isvctl/src/isvctl/config/output_schemas.py

version: "1.0"

commands:
  control_plane:
    phases: ["setup", "test", "teardown"]
    steps:
      # ═══════════════════════════════════════════════════════════════
      # SETUP: API Health Check
      # ═══════════════════════════════════════════════════════════════
      # YOUR SCRIPT must output JSON with at minimum:
      #   {
      #     "success": true,
      #     "platform": "control_plane",
      #     "account_id": "<account-id>",
      #     "tests": {"auth": {"passed": true}, "service_name": {"passed": true}}
      #   }
      - name: check_api
        phase: setup
        command: "python3 ../stubs/control-plane/check_api.py"
        args: ["--region", "{{region}}", "--services", "{{services}}"]
        timeout: 120

      # ═══════════════════════════════════════════════════════════════
      # SETUP: Create Resources
      # ═══════════════════════════════════════════════════════════════
      # Access key output:
      #   {
      #     "success": true,
      #     "platform": "control_plane",
      #     "username": "...",
      #     "access_key_id": "...",
      #     "secret_access_key": "..."
      #   }
      - name: create_access_key
        phase: setup
        command: "python3 ../stubs/control-plane/create_access_key.py"
        args: ["--region", "{{region}}"]
        timeout: 60

      # Tenant output:
      #   {
      #     "success": true,
      #     "platform": "control_plane",
      #     "tenant_name": "...",
      #     "tenant_id": "..."
      #   }
      - name: create_tenant
        phase: setup
        command: "python3 ../stubs/control-plane/create_tenant.py"
        args: ["--region", "{{region}}"]
        timeout: 60

      # ═══════════════════════════════════════════════════════════════
      # TEST: Access Key Lifecycle
      # ═══════════════════════════════════════════════════════════════
      - name: test_access_key
        phase: test
        command: "python3 ../stubs/control-plane/test_access_key.py"
        args:
          - "--access-key-id"
          - "{{steps.create_access_key.access_key_id}}"
          - "--secret-access-key"
          - "{{steps.create_access_key.secret_access_key}}"
          - "--region"
          - "{{region}}"
        sensitive_args: ["--secret-access-key"]
        timeout: 120

      - name: disable_access_key
        phase: test
        command: "python3 ../stubs/control-plane/disable_access_key.py"
        args:
          - "--username"
          - "{{steps.create_access_key.username}}"
          - "--access-key-id"
          - "{{steps.create_access_key.access_key_id}}"
          - "--region"
          - "{{region}}"
        timeout: 60

      - name: verify_key_rejected
        phase: test
        command: "python3 ../stubs/control-plane/verify_key_rejected.py"
        args:
          - "--access-key-id"
          - "{{steps.create_access_key.access_key_id}}"
          - "--secret-access-key"
          - "{{steps.create_access_key.secret_access_key}}"
          - "--region"
          - "{{region}}"
        sensitive_args: ["--secret-access-key"]
        timeout: 120

      # ═══════════════════════════════════════════════════════════════
      # TEST: Tenant Lifecycle
      # ═══════════════════════════════════════════════════════════════
      - name: list_tenants
        phase: test
        command: "python3 ../stubs/control-plane/list_tenants.py"
        args:
          - "--region"
          - "{{region}}"
          - "--target-group"
          - "{{steps.create_tenant.tenant_name}}"
        timeout: 60

      - name: get_tenant
        phase: test
        command: "python3 ../stubs/control-plane/get_tenant.py"
        args:
          - "--group-name"
          - "{{steps.create_tenant.tenant_name}}"
          - "--region"
          - "{{region}}"
        timeout: 60

      # ═══════════════════════════════════════════════════════════════
      # TEARDOWN: Cleanup Resources
      # ═══════════════════════════════════════════════════════════════
      - name: delete_access_key
        phase: teardown
        command: "python3 ../stubs/control-plane/delete_access_key.py"
        args:
          - "--username"
          - "{{steps.create_access_key.username}}"
          - "--access-key-id"
          - "{{steps.create_access_key.access_key_id}}"
        timeout: 60
        output_schema: teardown

      - name: delete_tenant
        phase: teardown
        command: "python3 ../stubs/control-plane/delete_tenant.py"
        args:
          - "--group-name"
          - "{{steps.create_tenant.tenant_name}}"
          - "--region"
          - "{{region}}"
        timeout: 60
        output_schema: teardown

tests:
  platform: control_plane
  cluster_name: "control-plane-validation"
  description: "Control plane: API health, access key lifecycle, tenant lifecycle"

  settings:
    # Provider-specific -- override in your provider config
    region: ""
    services: ""

  # ─── Validations ─────────────────────────────────────────────────
  # These are PROVIDER-AGNOSTIC. They only check JSON field names/values.
  validations:
    api_health:
      step: check_api
      checks:
        FieldExistsCheck:
          fields: ["account_id", "tests"]
        FieldValueCheck:
          field: "success"
          expected: true

    setup_checks:
      checks:
        AccessKeyCreatedCheck:
          step: create_access_key
        TenantCreatedCheck:
          step: create_tenant

    access_key_lifecycle:
      checks:
        AccessKeyAuthenticatedCheck:
          step: test_access_key
        AccessKeyDisabledCheck:
          step: disable_access_key
        AccessKeyRejectedCheck:
          step: verify_key_rejected

    tenant_lifecycle:
      checks:
        TenantListedCheck:
          step: list_tenants
        TenantInfoCheck:
          step: get_tenant

    teardown_checks:
      checks:
        StepSuccessCheck-delete_access_key:
          step: delete_access_key
        StepSuccessCheck-delete_tenant:
          step: delete_tenant

  exclude:
    markers: []