kitchen-ec2 3.22.9 → 3.22.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 54de858935bf91fcad58900283fd45042007c18d546797d098f29b955d177c87
-  data.tar.gz: 95fc2485b796d0e87974e17de7b34dd858c08fdb2d2433cbae6975983cea1501
+  metadata.gz: adbbc52b9c77d773ae78ebd08798d629a6781793d0e91ff46fb14eb080c70595
+  data.tar.gz: 8df7160b05b65d0187b24d9525ea458593db0c95cf9cef261683229752ca1cf6
 SHA512:
-  metadata.gz: dad42aca368360dd2d11c58583d13360f34fa77925a0fd40ede0c97da97092361c74ba7b61401918d7c1ae33732806fe8cdd7ddb84b2d23024dc21a20a94a835
-  data.tar.gz: 5e3a1ce54adf7425bce0c70816b212b0a2e8be36f35e9a1f8a58ebe971cfda2ace1c004e9dea91dc5d334021ba8df5f7541d1f891b1121021a9321f82d0f311c
+  metadata.gz: 956f2322fd4e6bb42ad179c677159be0acb108b30c651c940e95b3c6e266466a548a982f9bb9bcc6edeea3e3ae9734ddc37d80dad14cce80a78c268d733a97ba
+  data.tar.gz: f98fe3846db116988011feefebae241fec7145cbbc49aa45d3e82620c1ba5fa36ae15222125144cf37405d7f373db0c5fbcf32505b62453b9f677e84cfa3c765

data/lib/kitchen/driver/aws/instance_generator.rb

@@ -92,34 +92,29 @@ module Kitchen
             security_groups = []
             filters = [config[:security_group_filter]].flatten
             filters.each do |sg_filter|
-              r = {}
+              # Built up rather than assigned, so that a filter carrying both a
+              # name and a tag searches on both. Assigning meant the tag
+              # replaced the name outright, silently widening the search to
+              # whatever else carried that tag.
+              criteria = []
               if sg_filter[:name]
-                r[:filters] = [
-                  {
-                    name: "group-name",
-                    values: [sg_filter[:name]],
-                  },
-                  {
-                    name: "vpc-id",
-                    values: [vpc_id],
-                  },
-                ]
+                criteria << { name: "group-name", values: [sg_filter[:name]] }
               end
-
               if sg_filter[:tag]
-                r[:filters] = [
-                  {
-                    name: "tag:#{sg_filter[:tag]}",
-                    values: [sg_filter[:value]],
-                  },
-                  {
-                    name: "vpc-id",
-                    values: [vpc_id],
-                  },
-                ]
+                criteria << { name: "tag:#{sg_filter[:tag]}", values: [sg_filter[:value]] }
+              end
+
+              # Refused rather than sent: describe_security_groups with no
+              # filters returns every security group in the region, and all of
+              # them were then attached to the instance.
+              if criteria.empty?
+                raise "A security_group_filter needs a `name` or a `tag`, but " \
+                      "#{sg_filter.inspect} has neither."
               end
 
-              security_group = client.describe_security_groups(r).security_groups
+              criteria << { name: "vpc-id", values: [vpc_id] }
+
+              security_group = client.describe_security_groups(filters: criteria).security_groups
 
               if security_group.any?
                 security_group.each { |sg| security_groups.push(sg.group_id) }

data/lib/kitchen/driver/aws/standard_platform/debian.rb

@@ -98,6 +98,29 @@ module Kitchen
             search
           end
 
+          # Sort images newest release first, keeping backports images last.
+          #
+          # Debian publishes a backports image alongside each release, from the
+          # same account and under the same "debian-<release>-" prefix,
+          # differing only by the word "backports" in the name:
+          #
+          #     debian-12-backports-amd64-20260821-2577
+          #     debian-12-amd64-20260821-2577
+          #
+          # It runs the backports kernel rather than the release's own -- 6.12
+          # against 6.1 for Debian 12 -- and is often published minutes after
+          # its plain counterpart, so a tie broken on creation date handed
+          # every Debian platform the backports image.
+          #
+          # This is a preference rather than a filter, so a release with only
+          # backports images published is still selectable.
+          #
+          # @param images [Array<Aws::EC2::Image>] the images to sort
+          # @return [Array<Aws::EC2::Image>] the images, newest release first
+          def sort_by_version(images)
+            prefer(super) { |image| !image.name.include?("backports") }
+          end
+
           # Detect this platform from an EC2 image.
           #
           # Matching is done on the image name, which is the only reliable signal

data/lib/kitchen/driver/ec2.rb

@@ -19,6 +19,7 @@
 require "fileutils" unless defined?(FileUtils)
 require "sshkey" unless defined?(SSHKey)
 require "benchmark" unless defined?(Benchmark)
+require "open3" unless defined?(Open3)
 require "json" unless defined?(JSON)
 require "kitchen"
 require_relative "ec2_version"
@@ -229,6 +230,19 @@ module Kitchen
         end
       end
 
+      # A placement group is named either by ID or by name, never both: EC2
+      # rejects a RunInstances call carrying the pair. The payload generator
+      # therefore only applies each one when the other is absent, which means
+      # setting both silently drops both and the instance launches in no
+      # placement group at all, with nothing in the output to say so.
+      validations[:placement] = lambda do |_attr, val, _driver|
+        if val.is_a?(Hash) && val[:group_id] && val[:group_name]
+          warn "Cannot set both 'group_id' and 'group_name' under 'placement'. " \
+            "A placement group is identified by one or the other, so please set only one."
+          exit!
+        end
+      end
+
       # empty keys cause failures when tagging and they make no sense
       validations[:tags] = lambda do |_attr, val, _driver|
         # if someone puts the tags each on their own line it's an array not a hash
@@ -295,7 +309,8 @@ module Kitchen
             exit!
           end
 
-          allocate_host unless host_available?
+          # Remembered so that destroy releases this host and no other.
+          state[:allocated_host_id] = allocate_host unless host_available?
 
           info("Auto placement on one dedicated host out of: #{hosts_with_capacity.map(&:host_id).join(", ")}")
         end
@@ -438,11 +453,22 @@ module Kitchen
         delete_security_group(state)
         delete_key(state)
 
-        # Clean up dedicated hosts matching instance_type and unused (if allowed)
+        # Release the dedicated host this instance's create allocated, if it
+        # allocated one and nothing else is left running on it.
+        #
+        # Only that host. Dedicated hosts are a shared pool -- create places
+        # onto any managed host with room rather than always allocating, so
+        # most runs allocate nothing -- and releasing every empty managed host
+        # tore down hosts belonging to other suites, including one allocated
+        # seconds earlier by a concurrent run whose instance had not launched
+        # onto it yet.
         return unless config[:tenancy] == "host" && allow_deallocate_host?
 
-        empty_hosts = hosts_with_capacity.select { |host| host_unused?(host) }
-        empty_hosts.each { |host| deallocate_host(host.host_id) }
+        host_id = state.delete(:allocated_host_id)
+        return unless host_id
+
+        host = host_for_id(host_id)
+        deallocate_host(host_id) if host && host_unused?(host)
       end
 
       # The EC2 image this instance will be created from.
@@ -954,20 +980,35 @@ module Kitchen
       # @return [String] a PowerShell script wrapped in `<powershell>` tags
       def default_windows_user_data
         base_script = Kitchen::Util.outdent!(<<-EOH)
-	$OSVersion = (get-itemproperty -Path "HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" -Name ProductName).ProductName
-  If($OSVersion.contains('2016') -Or $OSVersion.contains('2019') -Or $OSVersion -eq 'Windows Server Datacenter') {
-    New-Item -ItemType Directory -Force -Path 'C:\\ProgramData\\Amazon\\EC2-Windows\\Launch\\Log'
-    $logfile='C:\\ProgramData\\Amazon\\EC2-Windows\\Launch\\Log\\kitchen-ec2.log'
-    # EC2Launch doesn't init extra disks by default
-    C:\\ProgramData\\Amazon\\EC2-Windows\\Launch\\Scripts\\InitializeDisks.ps1
-  } Else {
-     New-Item -ItemType Directory -Force -Path 'C:\\Program Files\\Amazon\\Ec2ConfigService\\Logs'
-     $logfile='C:\\Program Files\\Amazon\\Ec2ConfigService\\Logs\\kitchen-ec2.log'
-  }
-
-        # Logfile fail-safe in case the directory does not exist
+        # Log where the installed launch agent already logs, chosen by looking
+        # for it rather than by matching the OS against known release names.
+        # Writing into the directory of an agent that is not installed would
+        # invent a misleading empty tree.
+        $logdir = If (Test-Path 'C:\\ProgramData\\Amazon\\EC2Launch') {
+            'C:\\ProgramData\\Amazon\\EC2Launch\\log'
+        } ElseIf (Test-Path 'C:\\ProgramData\\Amazon\\EC2-Windows\\Launch') {
+            'C:\\ProgramData\\Amazon\\EC2-Windows\\Launch\\Log'
+        } ElseIf (Test-Path 'C:\\Program Files\\Amazon\\Ec2ConfigService') {
+            'C:\\Program Files\\Amazon\\Ec2ConfigService\\Logs'
+        } Else {
+            Join-Path $env:ProgramData 'Amazon\\kitchen-ec2'
+        }
+        New-Item -ItemType Directory -Force -Path $logdir | Out-Null
+        $logfile = Join-Path $logdir 'kitchen-ec2.log'
         New-Item $logfile -Type file -Force
 
+        # Extra EBS volumes are attached but left uninitialized: no launch
+        # agent partitions them by default, on any release. Done with the
+        # storage cmdlets rather than by calling a particular agent's script,
+        # so it does not matter which agent is installed. Only RAW disks are
+        # touched, so a volume that already carries a filesystem is never
+        # reformatted.
+        "Initializing any uninitialized volumes" >> $logfile
+        Get-Disk | Where-Object PartitionStyle -eq 'RAW' |
+          Initialize-Disk -PartitionStyle MBR -PassThru |
+          New-Partition -AssignDriveLetter -UseMaximumSize |
+          Format-Volume -FileSystem NTFS -Confirm:$false >> $logfile
+
         # Allow script execution
         Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force
         #PS Remoting and & winrm.cmd basic config
@@ -980,7 +1021,6 @@ module Kitchen
         & winrm.cmd set winrm/config '@{MaxTimeoutms="1800000"}' >> $logfile
         & winrm.cmd set winrm/config/winrs '@{MaxMemoryPerShellMB="1024"}' >> $logfile
         & winrm.cmd set winrm/config/winrs '@{MaxShellsPerUser="50"}' >> $logfile
-        & winrm.cmd set winrm/config/winrs '@{MaxMemoryPerShellMB="1024"}' >> $logfile
         #Firewall Config
         & netsh advfirewall firewall set rule name="Windows Remote Management (HTTP-In)" profile=public protocol=tcp localport=5985 remoteip=localsubnet new remoteip=any  >> $logfile
         Set-ItemProperty -Name LocalAccountTokenFilterPolicy -Path HKLM:\\software\\Microsoft\\Windows\\CurrentVersion\\Policies\\system -Value 1
@@ -1620,6 +1660,9 @@ module Kitchen
           return File.read(public_key_path).strip
         end
 
+        public_key = instance_connect_public_key_via_ssh_keygen(private_key_path)
+        return public_key if public_key
+
         begin
           key = SSHKey.new(File.read(private_key_path))
           key.ssh_public_key
@@ -1628,6 +1671,35 @@ module Kitchen
         end
       end
 
+      # Derive the public half of a private key with ssh-keygen.
+      #
+      # OpenSSH reads every key type EC2 can create. The sshkey gem handles
+      # only RSA and DSA, and raises "Neither PUB key nor PRIV key" on an
+      # ed25519 key -- which is exactly what `aws_ssh_key_type: ed25519`
+      # produces, so that documented setting could not be combined with
+      # Instance Connect at all.
+      #
+      # Falling back to the gem rather than requiring ssh-keygen keeps the RSA
+      # default working where OpenSSH is not installed.
+      #
+      # @param private_key_path [String] path to the private key
+      # @return [String, nil] the public key in OpenSSH format, or nil when
+      #   ssh-keygen is unavailable or could not read the key
+      def instance_connect_public_key_via_ssh_keygen(private_key_path)
+        output, status = Open3.capture2e("ssh-keygen", "-y", "-f", private_key_path)
+        return output.strip if status.success?
+
+        debug("ssh-keygen could not read #{private_key_path}: #{output.strip}")
+        nil
+      # ::StandardError, not StandardError: this file is nested inside `module
+      # Kitchen`, which defines Kitchen::StandardError. An unqualified constant
+      # resolves to that one, letting the Errno::ENOENT raised by a missing
+      # ssh-keygen escape the check meant to detect it.
+      rescue ::StandardError => e
+        debug("Could not run ssh-keygen: #{e.message}")
+        nil
+      end
+
       # SSM Session Manager Support Methods
 
       # The SSM Session Manager helper.

data/lib/kitchen/driver/ec2_version.rb

@@ -19,6 +19,6 @@
 module Kitchen
   module Driver
     # Version string for EC2 Test Kitchen driver
-    EC2_VERSION = "3.22.9".freeze
+    EC2_VERSION = "3.22.10".freeze
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kitchen-ec2
 version: !ruby/object:Gem::Version
-  version: 3.22.9
+  version: 3.22.10
 platform: ruby
 authors:
 - Test Kitchen Team