test(k8s): refuse-and-raise semantics + post-rebase import/registry fixes

Align k8s tests with the refuse-and-raise release semantics and fix stale
import paths and registry names introduced by the earlier rebase.

Author: fgogolli

src/orb/providers/aws/configuration/template_extension.py

@@ -31,7 +31,7 @@ class AWSTemplateExtensionConfig(BaseModel):
     fleet_role: Optional[str] = Field(None, description="IAM role for Spot Fleet")
     key_name: Optional[str] = Field(None, description="Default key name")
     user_data_script: Optional[str] = Field(None, description="User data script")
-    instance_profile: Optional[str] = Field(None, description="Instance profile")
+    machine_role: Optional[str] = Field(None, description="IAM instance profile / machine role")
 
     # AWS pricing and allocation defaults
     max_spot_price: Optional[float] = Field(None, description="Maximum price for Spot instances")

src/orb/providers/aws/infrastructure/adapters/template_adapter.py

@@ -133,22 +133,6 @@ def extend_template_fields(self, template: Template) -> Template:
         if not template.provider_api:
             template.provider_api = self._determine_provider_api(template)
 
-        # Extend with AWS-specific provider data
-        if not template.provider_data:
-            template.provider_data = {}
-
-        if "aws" not in template.provider_data:
-            template.provider_data["aws"] = {}
-
-        # Add AWS-specific provider data
-        template.provider_data["aws"].update(
-            {
-                "fleet_type": getattr(template, "fleet_type", None),
-                "supported_fields": self._AWS_SUPPORTED_FIELDS,
-                "validation_enabled": True,
-            }
-        )
-
         return template
 
     def resolve_template_references(self, template: Template) -> Template:

src/orb/providers/k8s/domain/template/k8s_template_aggregate.py

@@ -3,18 +3,17 @@
 Mirrors :class:`orb.providers.aws.domain.template.aws_template_aggregate.AWSTemplate`
 for the kubernetes provider.  ``K8sTemplate`` is a strongly-typed
 ``Template`` subclass: kubernetes-specific operator-supplied fields live as
-flat first-class attributes rather than as opaque entries under
-``Template.provider_data['k8s']``.
+flat first-class attributes on the subclass.
 
 Generic provisioning concepts continue to be expressed on the parent
 ``Template``:
 
-* ``image_id``         — container image string consumed by the spec builders.
-* ``tags``             — operator tags; merged into the pod ``metadata.labels``
+* ``image_id``       — container image string consumed by the spec builders.
+* ``tags``           — operator tags; merged into the pod ``metadata.labels``
   surface at spec-build time.
-* ``max_instances``    — quota cap; the per-request replica count comes from
+* ``max_instances``  — quota cap; the per-request replica count comes from
   ``request.requested_count``.
-* ``instance_profile`` — falls back as the ``serviceAccountName`` when
+* ``machine_role``   — falls back as the ``serviceAccountName`` when
   :attr:`K8sTemplate.service_account` is not set.
 
 Upcasting an arbitrary ``Template`` to a ``K8sTemplate`` is safe via
@@ -561,11 +560,10 @@ def _promote_extensions_and_defaults(self) -> K8sTemplate:
            backwards compatibility with operators who set kubernetes fields
            via the DTO surface rather than via the typed template
            directly.
-        2. Fall back to :attr:`Template.instance_profile` for
+        2. Fall back to :attr:`Template.machine_role` for
            :attr:`service_account` when the latter is unset.  This honours
-           the documented mapping of the generic ``instance_profile``
-           field (see :class:`Template` line 57) onto the kubernetes
-           ``serviceAccountName`` concept.
+           the documented mapping of the generic ``machine_role``
+           field onto the kubernetes ``serviceAccountName`` concept.
         """
         # Promote provider_config dict entries onto typed fields.
         pc = getattr(self, "provider_config", None)
@@ -632,9 +630,9 @@ def _promote_extensions_and_defaults(self) -> K8sTemplate:
             if self.volumes is None and pc.get("volumes") is not None:
                 object.__setattr__(self, "volumes", _coerce_volumes(pc.get("volumes")))
 
-        # Service-account fallback to the generic instance_profile.
-        if self.service_account is None and self.instance_profile:
-            object.__setattr__(self, "service_account", self.instance_profile)
+        # Service-account fallback to the generic machine_role.
+        if self.service_account is None and self.machine_role:
+            object.__setattr__(self, "service_account", self.machine_role)
 
         return self
 

src/orb/providers/k8s/infrastructure/adapters/template_adapter.py

@@ -124,13 +124,11 @@ def validate_template(self, template: Template) -> list[str]:  # type: ignore[ov
         return errors
 
     def extend_template_fields(self, template: Template) -> Template:
-        """Attach kubernetes-specific provider data to *template* in place.
+        """Set kubernetes-specific defaults on *template*.
 
-        With the typed :class:`K8sTemplate` aggregate in place, the
-        kubernetes provider does not need to mirror operator-supplied
-        fields into ``template.provider_data["k8s"]`` — handlers read
-        the typed fields directly.  We still default ``provider_api``
-        to ``"Pod"`` when the template arrives without one.
+        With the typed :class:`K8sTemplate` aggregate in place, handlers read
+        typed fields directly.  We default ``provider_api`` to ``"Pod"``
+        when the template arrives without one.
         """
         if not template.provider_api:
             template.provider_api = self.get_provider_api()

tests/providers/aws/live/conftest.py

@@ -28,10 +28,17 @@ def pytest_collection_modifyitems(config, items):
     ``pytestmark`` only works at module-level — conftest-level constants
     are not picked up by pytest's marker discovery. The collection hook
     is the canonical place to bulk-apply markers across a directory.
+
+    ``items`` is the FULL collected list across the pytest session, not
+    just this subtree — filter to items whose path lives under this
+    conftest's directory so we do NOT accidentally mark tests outside
+    this live subtree as serial.
     """
+    subtree = str(Path(__file__).resolve().parent)
     marker = pytest.mark.serial
     for item in items:
-        item.add_marker(marker)
+        if str(item.path).startswith(subtree):
+            item.add_marker(marker)
 
 
 def _find_repo_root(start: Path) -> Path:

tests/providers/k8s/live/conftest.py

@@ -15,6 +15,7 @@
 import json
 import logging
 import uuid
+from pathlib import Path
 from typing import Generator
 
 import pytest
@@ -40,13 +41,17 @@ def pytest_collection_modifyitems(config: pytest.Config, items: list[pytest.Item
     ``pytestmark`` at module level is not picked up by conftest-level
     discovery; the collection hook is the canonical place to bulk-apply
     markers across a directory subtree.
-    """
-    import pathlib
 
-    live_dir = str(pathlib.Path(__file__).parent)
+    ``items`` is the FULL collected list across the pytest session, not
+    just this subtree — filter to items whose path lives under this
+    conftest's directory so we do NOT accidentally mark
+    unit/mocked/contract tests as serial when the parent
+    ``tests/providers/k8s`` directory is collected as a whole.
+    """
+    subtree = str(Path(__file__).resolve().parent)
     marker = pytest.mark.serial
     for item in items:
-        if str(item.fspath).startswith(live_dir):
+        if str(item.path).startswith(subtree):
             item.add_marker(marker)
 
 

tests/providers/k8s/unit/configuration/test_template_extension.py

@@ -131,10 +131,13 @@ class TestExtensionRegistration:
     """Verify the DTO config is wired into ``TemplateExtensionRegistry``."""
 
     def test_extension_registered_after_bootstrap(self) -> None:
-        """Running k8s extension registration wires the DTO config into the registry."""
-        # Registration is an explicit call, not an import side-effect — invoke it
-        # directly so the test is self-contained and order-independent (it must not
-        # rely on another test having bootstrapped the global registry first).
+        """Calling the explicit lifecycle hook registers the DTO config.
+
+        Module-level auto-registration was removed to keep import-time
+        side effects predictable; extension registration now runs through
+        the explicit ``initialize_k8s_provider`` path (or the standalone
+        ``register_k8s_extensions`` helper for tests).
+        """
         from orb.infrastructure.registry.template_extension_registry import (
             TemplateExtensionRegistry,
         )

tests/providers/k8s/unit/domain/template/test_k8s_template.py

@@ -5,7 +5,7 @@
 * the generic ``Template.image_id`` is the single source of truth for
   the container image; shadow fields are gone.
 * :attr:`K8sTemplate.service_account` falls back to
-  :attr:`Template.instance_profile` via the ``after`` model-validator.
+  :attr:`Template.machine_role` via the ``after`` model-validator.
 * :meth:`K8sTemplate.resolve_pod_labels` projects ``Template.tags`` into
   string-keyed string-valued k8s labels, dropping ``None`` entries.
 * :meth:`upcast_to_k8s_template` is a clean round-trip from a generic
@@ -103,30 +103,45 @@ def test_extension_config_does_not_define_container_image() -> None:
 
 
 # ---------------------------------------------------------------------------
-# service_account fallback to instance_profile
+# service_account fallback to machine_role
 # ---------------------------------------------------------------------------
 
 
-def test_service_account_falls_back_to_instance_profile() -> None:
+def test_service_account_falls_back_to_machine_role() -> None:
     t = K8sTemplate(
         template_id="tpl",
         image_id="busybox:latest",
-        instance_profile="my-svc-acct",
+        machine_role="my-svc-acct",
     )
     assert t.service_account == "my-svc-acct"
 
 
-def test_explicit_service_account_wins_over_instance_profile() -> None:
+def test_service_account_falls_back_to_machine_role_via_deprecated_instance_profile() -> None:
+    """Old instance_profile kwarg still works via the DeprecationWarning path."""
+    import warnings
+
+    with warnings.catch_warnings(record=True) as w:
+        warnings.simplefilter("always")
+        t = K8sTemplate(
+            template_id="tpl",
+            image_id="busybox:latest",
+            instance_profile="my-svc-acct",
+        )
+        assert any(issubclass(warning.category, DeprecationWarning) for warning in w)
+    assert t.service_account == "my-svc-acct"
+
+
+def test_explicit_service_account_wins_over_machine_role() -> None:
     t = K8sTemplate(
         template_id="tpl",
         image_id="busybox:latest",
-        instance_profile="instance-profile-name",
+        machine_role="machine-role-name",
         service_account="explicit-sa",
     )
     assert t.service_account == "explicit-sa"
 
 
-def test_no_instance_profile_leaves_service_account_unset() -> None:
+def test_no_machine_role_leaves_service_account_unset() -> None:
     t = K8sTemplate(template_id="tpl", image_id="busybox:latest")
     assert t.service_account is None
 
@@ -164,7 +179,7 @@ def test_upcast_from_generic_template_round_trips_cleanly() -> None:
         image_id="busybox:latest",
         max_instances=4,
         tags={"team": "ml"},
-        instance_profile="svc-acct",
+        machine_role="svc-acct",
     )
     k8s = upcast_to_k8s_template(base)
     assert isinstance(k8s, K8sTemplate)

tests/providers/k8s/unit/handlers/test_statefulset_handler.py

@@ -31,7 +31,6 @@
 from orb.domain.request.value_objects import RequestId, RequestType
 from orb.domain.template.template_aggregate import Template
 from orb.providers.k8s.configuration.config import K8sProviderConfig
-from orb.providers.k8s.exceptions.k8s_exceptions import K8sError
 from orb.providers.k8s.infrastructure.handlers.statefulset_handler import K8sStatefulSetHandler
 
 # ---------------------------------------------------------------------------
@@ -247,15 +246,19 @@ async def test_release_hosts_selective_highest_ordinal_no_warning() -> None:
 
 
 @pytest.mark.asyncio
-async def test_release_hosts_selective_non_highest_ordinal_refused() -> None:
-    """When the victims are not the top-of-stack ordinals, the handler
-    raises K8sError and issues no scale patch.
-
-    Commit b4a77b1a deliberately changed this behaviour: silently evicting
-    different pods (the controller always picks the highest-ordinal set)
-    would cause data loss, so the handler refuses the request and tells
-    the caller which victims to supply instead.
+async def test_release_hosts_selective_non_highest_ordinal_raises_and_does_not_scale() -> None:
+    """When the victims include non-highest ordinals, the handler refuses
+    the request with ``K8sError`` and does NOT patch the StatefulSet.
+
+    The controller only supports scale-down from the top of the ordinal
+    stack; the previous warn-and-scale behaviour silently mutated a
+    different pod than the caller asked for, so the current
+    implementation raises instead — see the sibling test module
+    ``test_statefulset_release_reject.py`` for the guard function's own
+    unit coverage.
     """
+    from orb.providers.k8s.exceptions.k8s_exceptions import K8sError
+
     core_v1 = MagicMock()
     apps_v1 = MagicMock()
     apps_v1.read_namespaced_stateful_set.return_value = _make_statefulset_status(spec_replicas=5)
@@ -271,30 +274,22 @@ async def test_release_hosts_selective_non_highest_ordinal_refused() -> None:
     )
 
     # current=5, victims=[ordinal-1, ordinal-2] — non-highest ordinals.
-    # The controller would evict ordinals 3 and 4 instead, so the handler
-    # refuses rather than silently releasing the wrong pods.
-    with pytest.raises(K8sError) as exc_info:
+    with pytest.raises(K8sError, match="selective release refused"):
         await handler.release_hosts(["orb-deadbeef-1", "orb-deadbeef-2"], request.provider_data)
 
-    # The error message must mention the correct top-of-stack victims.
-    assert "orb-deadbeef-3" in str(exc_info.value) or "orb-deadbeef-4" in str(exc_info.value)
-
-    # Refusal happens before any scale patch — the StatefulSet must be
-    # left untouched.
+    # Nothing was mutated — neither a scale patch nor a pod deletion.
     apps_v1.patch_namespaced_stateful_set_scale.assert_not_called()
-
-    # Pods are NEVER deleted directly.
     core_v1.delete_namespaced_pod.assert_not_called()
     apps_v1.delete_namespaced_stateful_set.assert_not_called()
 
 
 @pytest.mark.asyncio
-async def test_release_hosts_selective_unparseable_victim_names_refused() -> None:
+async def test_release_hosts_selective_unparseable_victim_names_raises() -> None:
     """Victim names that do not parse as ``<statefulset>-<ordinal>`` are
-    refused with K8sError — an unparseable name cannot be the top-of-
-    stack ordinal, so honouring the request would silently evict the
-    wrong pods.
-    """
+    treated as non-top-of-stack and therefore refused, since the
+    controller cannot guarantee they will be the ones evicted."""
+    from orb.providers.k8s.exceptions.k8s_exceptions import K8sError
+
     core_v1 = MagicMock()
     apps_v1 = MagicMock()
     apps_v1.read_namespaced_stateful_set.return_value = _make_statefulset_status(spec_replicas=3)
@@ -309,15 +304,10 @@ async def test_release_hosts_selective_unparseable_victim_names_refused() -> Non
         namespace="orb-test",
     )
 
-    # Victim name does not match the StatefulSet's name prefix — its
-    # ordinal cannot be parsed, so the handler refuses rather than
-    # silently releasing the wrong pod.
-    with pytest.raises(K8sError):
+    with pytest.raises(K8sError, match="selective release refused"):
         await handler.release_hosts(["some-other-pod"], request.provider_data)
 
-    # Refusal happens before any scale patch.
     apps_v1.patch_namespaced_stateful_set_scale.assert_not_called()
-    # Pods are NEVER deleted directly.
     core_v1.delete_namespaced_pod.assert_not_called()
     apps_v1.delete_namespaced_stateful_set.assert_not_called()