Repository navigation
test(security): drift IT waits for the cluster to settle - #563
Merged
Merged
Conversation
SecurityApiIT.baselineEnablesDriftAndDriftIsEmptyWithoutOne failed on main (714c5ec, run 41132651885): 44 of 45 checks unchanged. It assumed two back-to-back audits agree because every check reads static broker config, but the topic checks read the live topic list, and the class's broker is fresh: half a second after start the app's DLQ consumer joins its group (21:47:35.069 in the run), which creates __consumer_offsets and auto-creates kates-dlq, between the baseline (35.051) and the drift read (35.191). A topic check then differs, as drift should report. The test now takes the baseline and drift pair again, every 200 ms for up to 30 s, until every check is unchanged. A baseline that did not round-trip through the V17 table never matches, so the test still fails on the bug it exists for, and its message lists the checks that drifted.
This was referenced Oct 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
mainis red since #561's merge (714c5ec, run 41132651885):SecurityApiIT.baselineEnablesDriftAndDriftIsEmptyWithoutOnesaw 44 of 45 checks unchanged. Nothing in #561 touches the security audit; this is a race the test always had.The test assumed two back-to-back audits agree "because every check reads static broker configuration". The topic checks (RF=1, under-replicated partitions, internal topic protection, topic count) read the live topic list, and this class's broker is fresh. In the failing run the app's DLQ consumer subscribed at 21:47:35.069, between the baseline (35.051) and the drift read (35.191). Its group join creates
__consumer_offsets, and its topickates-dlqis auto-created, so a topic check changed. Drift reporting that is correct behaviour; the test's premise was wrong.What
The test takes the baseline-then-drift pair again, every 200 ms for up to 30 s (
ItSupport.waitUntil), until every check is unchanged. A baseline that did not round-trip through the V17 table never matches however long it waits, so the test still fails on the bug it exists for. Its message now lists the checks that drifted.Test-only; no product change.
Tests
Locally, on real Postgres and Kafka (Testcontainers):
SecurityApiITalone, 3 runs: 12/12 each. The scoped run trips the JaCoCo coverage gate, as any single-IT run does.spotless:check../mvnw verify: 1783 unit tests and 98 ITs, 0 failures, coverage gate passed.I couldn't force the original race locally: it depends on startup timing.