@specific.dev/spectest 0.120.1 → 0.122.0

package/src/components/k3s-concurrency.test.ts

@@ -1,5 +1,7 @@
-import { expect, test } from "bun:test";
+import { expect, spyOn, test } from "bun:test";
 import { k3s } from "./k3s";
+import * as imageLoader from "../harness/k3s-image-loader";
+import { COMPONENT_RUNTIME } from "../harness/component-images";
 
 function deferred() {
   let resolve!: () => void;
@@ -22,7 +24,7 @@ test("registry, Traefik, and every declared pull start without waiting for one a
     waitForRollout: async () => {},
   }, exec: async (_name: string, args: string[]) => {
     if (args[3] === "pull") await enter(args.at(-1)!);
-    return { exitCode: 0, stdout: "", stderr: "" };
+    return { exitCode: 0, stdout: args[0] === "kubectl" ? JSON.stringify({ items: [{ metadata: { name: "cluster" }, status: { conditions: [{ type: "Ready", status: "True" }] } }] }) : "", stderr: "" };
   } } as never).then(() => { finished = true; });
   try {
     await Promise.race([allStarted.promise, Bun.sleep(1000).then(() => { throw new Error(`serialized setup: ${[...started]}`); })]);
@@ -49,7 +51,7 @@ test("a failed infrastructure rollout waits for other rollouts and image pulls t
     },
   }, exec: async (_name: string, args: string[]) => {
     if (args[3] === "pull") await hold();
-    return { exitCode: 0, stdout: "", stderr: "" };
+    return { exitCode: 0, stdout: args[0] === "kubectl" ? JSON.stringify({ items: [{ metadata: { name: "cluster" }, status: { conditions: [{ type: "Ready", status: "True" }] } }] }) : "", stderr: "" };
   } } as never).then(() => { finished = true; }, error => { finished = true; return error; });
   try {
     await started.promise;
@@ -58,3 +60,74 @@ test("a failed infrastructure rollout waits for other rollouts and image pulls t
   expect(await work).toBe(failure);
   expect(active).toBe(0);
 });
+
+test("all nodes pull concurrently while readiness and Traefik are pending; local pulls only wait for registry", async () => {
+  const nodes = ["cluster", "cluster-node-2", "cluster-node-3"];
+  const pulls = new Set<string>();
+  const allPulling = deferred(), registryStarted = deferred(), registryReady = deferred();
+  const nodesReady = deferred(), traefikReady = deferred(), pullsDone = deferred();
+  let finished = false;
+  const work = k3s({ nodes: 3, registry: { host: "registry.test" }, images: ["alpine:3.20", "registry.test/app:1"] }).setup!({
+    name: "cluster", helpers: {
+      apply: async () => {},
+      waitForRollout: async (name: string) => {
+        if (name === "traefik") await traefikReady.promise;
+        else { registryStarted.resolve(); await registryReady.promise; }
+      },
+    }, exec: async (name: string, args: string[]) => {
+      if (args[0] === "kubectl") {
+        await nodesReady.promise;
+        return { exitCode: 0, stderr: "", stdout: JSON.stringify({ items: nodes.map(name => ({ metadata: { name }, status: { conditions: [{ type: "Ready", status: "True" }] } })) }) };
+      }
+      if (args[3] === "pull") {
+        pulls.add(`${name}/${args.at(-1)}`);
+        if (pulls.size === 6) allPulling.resolve();
+        await pullsDone.promise;
+      }
+      return { exitCode: 0, stderr: "", stdout: "" };
+    },
+  } as never).then(() => { finished = true; });
+  try {
+    await registryStarted.promise;
+    // The runtimes and external pulls can progress without Node readiness.
+    await Bun.sleep(0);
+    expect(pulls.size).toBe(3);
+    expect([...pulls].every(pull => pull.endsWith("alpine:3.20"))).toBe(true);
+    registryReady.resolve();
+    await Promise.race([allPulling.promise, Bun.sleep(1000).then(() => { throw new Error(`serialized node pulls: ${[...pulls]}`); })]);
+    expect(finished).toBe(false);
+    for (const node of nodes) expect(pulls.has(`${node}/registry.test/app:1`)).toBe(true);
+  } finally {
+    registryReady.resolve(); nodesReady.resolve(); traefikReady.resolve(); pullsDone.resolve();
+    await work;
+  }
+});
+
+test("one prepared build fans out to every runtime and failed imports drain the other nodes", async () => {
+  const nodes = ["cluster", "cluster-node-2", "cluster-node-3"];
+  const prepared = [{ source: "prepared-once", reference: "example.test/app:v1" }];
+  const allStarted = deferred(), release = deferred();
+  const started: string[] = [];
+  const failure = new Error("agent import failed");
+  const loader = spyOn(imageLoader, "loadK3sBuildImages").mockImplementation(async (node, images) => {
+    expect(images).toBe(prepared);
+    started.push(node);
+    if (started.length === 3) allStarted.resolve();
+    if (node === "cluster-node-2") throw failure;
+    await release.promise;
+  });
+  let finished = false;
+  const work = k3s({ nodes: 3, registry: false, traefik: false, images: [{ reference: prepared[0].reference, content: "FROM scratch" }] }).setup!({
+    name: "cluster", helpers: {},
+    [COMPONENT_RUNTIME]: { images: prepared, gateway: "127.0.0.1", caBundle: null },
+    exec: async (_name: string, args: string[]) => ({ exitCode: 0, stderr: "", stdout: args[0] === "kubectl"
+      ? JSON.stringify({ items: nodes.map(name => ({ metadata: { name }, status: { conditions: [{ type: "Ready", status: "True" }] } })) }) : "" }),
+  } as never).then(() => { finished = true; }, error => { finished = true; return error; });
+  try {
+    await allStarted.promise;
+    expect(started).toEqual(nodes);
+    expect(finished).toBe(false);
+    release.resolve();
+    expect(await work).toBe(failure);
+  } finally { release.resolve(); await work; loader.mockRestore(); }
+});

package/src/components/k3s-docker.test.ts

@@ -0,0 +1,140 @@
+// Real k3s nodes on an isolated Docker network. Snapshot acceptance lives in
+// examples/k3s-multinode, which runs through Spectest's actual VM lifecycle.
+// SPECTEST_TEST_K3S_DOCKER=1 bun test sdk/src/components/k3s-docker.test.ts
+import { expect, test } from "bun:test";
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { defineEnvironment, type ServiceDefinition, type ServiceSetupContext } from "../index";
+import { k3s, type K3sHelpers } from "./k3s";
+
+async function run(args: string[], stdin = "") {
+  const child = Bun.spawn(args, { stdin: new Blob([stdin]), stdout: "pipe", stderr: "pipe" });
+  const [exitCode, stdout, stderr] = await Promise.all([child.exited, new Response(child.stdout).text(), new Response(child.stderr).text()]);
+  return { exitCode, stdout, stderr };
+}
+async function checked(args: string[], stdin = "") {
+  const result = await run(args, stdin);
+  if (result.exitCode) throw new Error(`${args.slice(0, 4).join(" ")}: ${result.stderr}\n${result.stdout}`);
+  return result.stdout;
+}
+
+for (const count of [1, 3]) test.skipIf(!process.env.SPECTEST_TEST_K3S_DOCKER)(`${count} real nodes: readiness, images, routing, registry and restart`, async () => {
+  const name = `spectest-k3s-${process.pid}-${count}`;
+  const root = mkdtempSync(join(tmpdir(), `${name}-`));
+  const services = defineEnvironment({ name, services: { [name]: k3s({ nodes: count, images: ["busybox:1.37"] }) } }).config.services;
+  const names = Object.keys(services);
+  const primary = services[name] as ServiceDefinition<K3sHelpers>;
+  const image = (primary.image as { reference: string }).reference;
+  const volumes = new Set<string>();
+  const exec = (node: string, args: string[]) => run(["docker", "exec", node, ...args]);
+  const kubectl = (args: string[], stdin = "") => checked(["docker", "exec", "-i", name, "kubectl", ...args], stdin);
+  const helpers = {
+    apply: async (yaml: string) => { await kubectl(["apply", "-f", "-"], yaml); },
+    waitForRollout: async (deployment: string, opts: { namespace: string }) => {
+      await kubectl(["rollout", "status", `deployment/${deployment}`, "-n", opts.namespace, "--timeout=120s"]);
+    },
+  };
+  try {
+    await checked(["docker", "pull", image]);
+    await checked(["docker", "network", "create", name]);
+    const start = async (node: string) => {
+      const service = services[node];
+      const args = ["docker", "run", "-d", "--privileged", "--cgroupns=host", "--name", node, "--hostname", node,
+        "--network", name, "--network-alias", `${node}.internal`, "--tmpfs", "/run", "--tmpfs", "/var/run"];
+      for (const volume of service.volumes ?? []) {
+        // This opt-in test uses fresh stores, not any developer's cache mounts.
+        if (volume.source) throw new Error("Docker regression requires no guest image-cache manifest");
+        const source = volume.name ?? `${node}-store`;
+        volumes.add(source);
+        args.push("-v", `${source}:${volume.target}`);
+      }
+      for (const [i, file] of (service.files ?? []).entries()) {
+        const path = join(root, `${node}-${i}`);
+        writeFileSync(path, file.content.replaceAll("{{SPECTEST_SERVICE}}", node));
+        args.push("-v", `${path}:${file.path}:ro`);
+      }
+      await checked([...args, "--entrypoint", "sh", image, "-c", service.command!]);
+    };
+    await Promise.all(names.filter(node => node !== name).map(start));
+    await start(name);
+    const deadline = Date.now() + 120_000;
+    while ((await exec(name, ["kubectl", "get", "--raw=/readyz"])).exitCode !== 0) {
+      if ((await checked(["docker", "inspect", "--format", "{{.State.Running}}", name])).trim() !== "true") throw new Error("Server exited during startup");
+      if (Date.now() >= deadline) throw new Error("API server readiness timed out");
+      await Bun.sleep(250);
+    }
+    await primary.setup!({ name, helpers, exec } as unknown as ServiceSetupContext<K3sHelpers>);
+    await helpers.apply(JSON.stringify({ apiVersion: "apps/v1", kind: "DaemonSet", metadata: { name: "web" }, spec: {
+      selector: { matchLabels: { app: "web" } }, template: { metadata: { labels: { app: "web" } }, spec: {
+        containers: [{ name: "web", image: "busybox:1.37", imagePullPolicy: "Never",
+          command: ["sh", "-ec", "mkdir /www; echo hello >/www/index.html; exec httpd -f -p 8080 -h /www"],
+          readinessProbe: { httpGet: { path: "/", port: 8080 } } }],
+      } },
+    } }));
+    await kubectl(["rollout", "status", "daemonset/web", "--timeout=90s"]);
+    const pods = JSON.parse(await kubectl(["get", "pods", "-l", "app=web", "-o", "json"])).items;
+    expect(pods).toHaveLength(count);
+    expect(new Set(pods.map((pod: any) => pod.spec.nodeName)).size).toBe(count);
+    await Promise.all(pods.map(async (pod: any) => {
+      for (const target of pods) expect((await kubectl(["exec", pod.metadata.name, "--", "wget", "-T", "5", "-qO-", `http://${target.status.podIP}:8080`])).trim()).toBe("hello");
+    }));
+    await helpers.apply(JSON.stringify({ apiVersion: "v1", kind: "List", items: [
+      { apiVersion: "v1", kind: "Service", metadata: { name: "web" }, spec: { selector: { app: "web" }, ports: [{ port: 80, targetPort: 8080 }] } },
+      { apiVersion: "networking.k8s.io/v1", kind: "Ingress", metadata: { name: "web" }, spec: { rules: [{ host: "web.test", http: { paths: [{
+        path: "/", pathType: "Prefix", backend: { service: { name: "web", port: { number: 80 } } },
+      }] } }] } },
+    ] }));
+    const ingressDeadline = Date.now() + 30_000;
+    for (;;) {
+      const response = await exec(name, ["wget", "-T", "5", "-qO-", "--header=Host: web.test", "http://127.0.0.1"]);
+      if (response.exitCode === 0 && response.stdout.trim() === "hello") break;
+      if (Date.now() >= ingressDeadline) throw new Error(`Ingress failed: ${response.stderr}`);
+      await Bun.sleep(250);
+    }
+    // Publish from the server, then resolve and pull the tag on every node.
+    const registryImage = `${name}.internal:5000/busybox:smoke`;
+    await checked(["docker", "exec", name, "ctr", "-n", "k8s.io", "images", "tag", "docker.io/library/busybox:1.37", registryImage]);
+    const arch = (await checked(["docker", "exec", name, "uname", "-m"])).trim() === "aarch64" ? "arm64" : "amd64";
+    // The local push path selects a single manifest. The transfer service's
+    // platform filter still pushes the original multi-platform index.
+    await checked(["docker", "exec", name, "ctr", "-n", "k8s.io", "images", "push", "--local", "--plain-http",
+      "--platform", `linux/${arch}`, registryImage]);
+    const tags = await checked(["docker", "exec", name, "wget", "-qO-", `http://${name}.internal:5000/v2/busybox/tags/list`]);
+    expect(JSON.parse(tags).tags).toContain("smoke");
+    await Promise.all(names.map(async node => {
+      await checked(["docker", "exec", node, "crictl", "--runtime-endpoint", "unix:///run/k3s/containerd/containerd.sock", "pull", registryImage]);
+    }));
+    // Restart an agent (or the server for the default topology) and make sure
+    // another kubelet hasn't destroyed its pod cgroups while it was absent.
+    const restarted = names.at(-1)!;
+    await checked(["docker", "restart", restarted]);
+    const restartDeadline = Date.now() + 120_000;
+    while ((await exec(name, ["kubectl", "get", "--raw=/readyz"])).exitCode !== 0) {
+      if (Date.now() >= restartDeadline) throw new Error("Server did not recover after restart");
+      await Bun.sleep(250);
+    }
+    await kubectl(["wait", "node", restarted, "--for=condition=Ready", "--timeout=120s"]);
+    await kubectl(["rollout", "status", "daemonset/web", "--timeout=120s"]);
+    for (const pod of pods) {
+      for (;;) {
+        const response = await exec(name, ["kubectl", "exec", pod.metadata.name, "--", "wget", "-T", "5", "-qO-", "http://web.default.svc.cluster.local"]);
+        if (response.exitCode === 0 && response.stdout.trim() === "hello") break;
+        if (Date.now() >= restartDeadline) throw new Error(`Pod did not recover after restart: ${response.stderr}`);
+        await Bun.sleep(250);
+      }
+    }
+  } catch (error) {
+    console.error((await run(["docker", "exec", name, "kubectl", "logs", "-n", "kube-system", "deployment/spectest-registry", "--tail=25"])).stdout);
+    for (const node of names) console.error(`${node}:\n${(await run(["docker", "logs", "--tail", "60", node])).stderr}`);
+    throw error;
+  } finally {
+    await Promise.all(names.map(node => run(["docker", "rm", "-fv", node])));
+    // These trees are deliberately outside Docker's own container cgroups.
+    await run(["docker", "run", "--rm", "--privileged", "--cgroupns=host", "--entrypoint", "sh", image, "-c",
+      'for node in "$@"; do find "/sys/fs/cgroup/spectest-$node" -depth -type d -exec rmdir {} \\; 2>/dev/null; done', "sh", ...names]);
+    await Promise.all([...volumes].map(volume => run(["docker", "volume", "rm", volume])));
+    await run(["docker", "network", "rm", name]);
+    rmSync(root, { recursive: true, force: true });
+  }
+}, 600_000);

package/src/components/k3s-nodes.test.ts

@@ -0,0 +1,73 @@
+import { expect, test } from "bun:test";
+import { defineEnvironment } from "../index";
+import { k3s } from "./k3s";
+import { waitForK3sNodes } from "./k3s-nodes";
+import { loadAllYaml } from "@kubernetes/client-node";
+
+const ready = (name: string) => ({ metadata: { name }, status: { conditions: [{ type: "Ready", status: "True" }] } });
+const result = (stdout = "", exitCode = 0) => ({ stdout, stderr: "", exitCode });
+
+test("one and multiple nodes use the same topology and preserve primary overrides", () => {
+  const config = (nodes?: number) => defineEnvironment({ name: "test", services: {
+    cluster: { ...k3s({ nodes }), hostnames: ["apps.test"] },
+    app: { image: "alpine", dependsOn: ["cluster"] },
+  } }).config;
+  expect(JSON.stringify(config().services)).toEqual(JSON.stringify(config(1).services));
+  const one = config(1), three = config(3);
+  expect(Object.keys(three.services)).toEqual(["cluster", "cluster-node-2", "cluster-node-3", "app"]);
+  expect(three.services.cluster.dependsOn).toEqual(["cluster-node-2", "cluster-node-3"]);
+  expect(three.services.cluster.hostnames).toEqual(["apps.test"]);
+  expect(three.services["cluster-node-2"].hostnames).toBeUndefined();
+  expect(three.services.cluster.command).toBe(one.services.cluster.command);
+  for (const name of ["cluster-node-2", "cluster-node-3"]) {
+    const node = three.services[name];
+    expect(node.command).toContain("exec k3s agent");
+    expect(node.command).toContain("--server=https://cluster.internal:6443");
+    expect(node.command).toContain("--kubelet-arg=cgroup-root=/spectest-$(hostname)");
+    expect(node.dependsOn).toBeUndefined(); // joins while the server boots
+    expect(node.imageBuilds).toHaveLength(0); // build once, import into every node
+    expect(node.files?.find(f => f.path.endsWith("registries.yaml"))?.content).toContain("http://cluster.internal:5000");
+    expect(node.volumes?.find(v => v.name)?.name).toBe("spectest-k3s-cluster-join");
+  }
+});
+
+test("node counts and generated name collisions fail at configuration time", () => {
+  for (const nodes of [0, -1, 1.5, NaN, Infinity, "2", null]) expect(() => k3s({ nodes: nodes as number })).toThrow("positive integer");
+  expect(() => defineEnvironment({ name: "test", services: {
+    cluster: k3s({ nodes: 2 }), "cluster-node-2": { image: "alpine" },
+  } })).toThrow("produced by both");
+  const config = defineEnvironment({ name: "test", services: { first: k3s({ nodes: 2 }), second: k3s({ nodes: 2 }) } }).config;
+  expect(config.services.first.volumes?.[0].name).not.toBe(config.services.second.volumes?.[0].name);
+});
+
+test("all declared node identities must be Ready, not just a matching count", async () => {
+  let reads = 0;
+  await waitForK3sNodes("cluster", ["cluster", "cluster-node-2"], async () => result(JSON.stringify({
+    items: reads++ === 0 ? [ready("cluster"), ready("unrelated")] : [ready("cluster"), ready("cluster-node-2")],
+  })), 1000);
+  expect(reads).toBe(2);
+  await expect(waitForK3sNodes("cluster", ["cluster", "cluster-node-2"], async (_name, args) =>
+    result(args[0] === "kubectl" ? JSON.stringify({ items: [ready("cluster")] }) : "", args[0] === "kubectl" ? 0 : 1), 0))
+    .rejects.toThrow("cluster-node-2: not registered");
+});
+
+test("registry and ingress remain on the public node and boot markers clear on every node", async () => {
+  const manifests: any[] = [], cleared: string[] = [];
+  await k3s({ nodes: 3 }).setup!({ name: "cluster", helpers: {
+    apply: async (yaml: string) => { manifests.push(...loadAllYaml(yaml)); },
+    waitForRollout: async () => {},
+  }, exec: async (name: string, args: string[]) => {
+    if (args[0] === "rm") cleared.push(name);
+    return result(args[0] === "kubectl" ? JSON.stringify({ items: ["cluster", "cluster-node-2", "cluster-node-3"].map(ready) }) : "");
+  } } as never);
+  const deployments = manifests.filter(doc => doc.kind === "Deployment");
+  expect(deployments).toHaveLength(2);
+  for (const deployment of deployments) expect(deployment.spec.template.spec.nodeSelector).toEqual({ "kubernetes.io/hostname": "cluster" });
+  expect(cleared.sort()).toEqual(["cluster", "cluster-node-2", "cluster-node-3"]);
+});
+
+test("cluster identity arguments cannot silently invalidate node routing and readiness", () => {
+  for (const flag of ["--node-name=other", "--with-node-id", "--token-file=/tmp/token", "--disable-agent"]) {
+    expect(() => k3s({ extraArgs: [flag] })).toThrow("cluster identity");
+  }
+});

package/src/components/k3s-nodes.ts

@@ -0,0 +1,35 @@
+import type { SpectestContext } from "../index.js";
+
+/** /readyz only checks the API server. Check the expected identities, not just
+ * a count: an unregistered agent must not be hidden by an unrelated node.
+ * This runs alongside image imports and infrastructure rollouts. */
+export async function waitForK3sNodes(
+  server: string, names: readonly string[], exec: SpectestContext["exec"], timeoutMs: number,
+): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  let detail = "no nodes registered";
+  for (;;) {
+    const result = await exec(server, ["kubectl", "get", "nodes", "-o", "json", "--request-timeout=5s"], { timeoutMs: 10_000 });
+    if (result.exitCode === 0) {
+      const nodes: { metadata?: { name?: string }; status?: { conditions?: { type: string; status: string; message?: string }[] } }[] = JSON.parse(result.stdout).items;
+      const pending = names.flatMap(name => {
+        const node = nodes.find(node => node.metadata?.name === name);
+        const ready = node?.status?.conditions?.find(condition => condition.type === "Ready");
+        return ready?.status === "True" ? [] : [`${name}: ${node ? ready?.message || `Ready=${ready?.status ?? "Unknown"}` : "not registered"}`];
+      });
+      if (!pending.length) return;
+      detail = pending.join("; ");
+    } else detail = result.stderr || result.stdout;
+    if (Date.now() >= deadline) {
+      // Agent startup errors otherwise look like a missing Kubernetes Node.
+      const diagnostics = await Promise.all(names.map(async name => {
+        try {
+          const result = await exec(name, ["sh", "-c", "test -S /run/k3s/containerd/containerd.sock"], { timeoutMs: 5_000 });
+          return `${name}: ${result.exitCode === 0 ? "containerd socket present" : result.stderr || "containerd socket missing"}`;
+        } catch (error) { return `${name}: ${String(error)}`; }
+      }));
+      throw new Error(`k3s(${server}): nodes did not become Ready within ${timeoutMs / 1000}s: ${detail}\n${diagnostics.join("\n")}`);
+    }
+    await new Promise(resolve => setTimeout(resolve, 250));
+  }
+}

package/src/components/k3s-registry.test.ts

@@ -1,28 +1,33 @@
 import { expect, test } from "bun:test";
-import { k3s } from "./k3s";
+import { k3s, type K3sOptions } from "./k3s";
+import { defineEnvironment } from "../index";
+
+function primary(options: K3sOptions = {}) {
+  return defineEnvironment({ name: "test", services: { cluster: k3s(options) } }).config.services.cluster;
+}
 import { REGISTRY_CONTENT, REGISTRY_DATA } from "../harness/registry-seed";
 
 test("HTTPS registry is component-owned, with explicit containerd trust and no Traefik dependency", () => {
-  const cluster = k3s({ registry: { host: "Registry.Test" }, traefik: false });
+  const cluster = primary({ registry: { host: "Registry.Test" }, traefik: false });
   expect(cluster.tls).toEqual([{ hostname: "registry.test", port: 5000 }]);
   const registries = cluster.files.find(file => file.path.endsWith("registries.yaml"))!.content;
   expect(registries).toContain('"registry.test":\n    tls:\n      ca_file:');
   expect(registries).not.toContain('"https://127.0.0.1');
-  expect(registries).toContain('"http://127.0.0.1:5000"');
+  expect(registries).toContain('"http://cluster.internal:5000"');
 });
 
 test("only builds targeting the configured registry require publication storage", () => {
   const image = { content: "FROM scratch", reference: "registry.test/codenode:latest" };
-  const cluster = k3s({ registry: { host: "registry.test" }, images: [image] });
+  const cluster = primary({ registry: { host: "registry.test" }, images: [image] });
   expect(cluster.imageBuilds).toHaveLength(1);
   expect(cluster.volumes.find(v => v.target === REGISTRY_DATA)?.source).toBe(
     "/var/lib/spectest-registries/{{SPECTEST_SERVICE}}",
   );
   expect(cluster.volumes.find(v => v.target === REGISTRY_CONTENT)?.readOnly).toBe(true);
   for (const registry of [undefined, false, true, { host: "other.test" }]) {
-    expect(k3s({ registry, images: [image] }).volumes.some(v => v.target === REGISTRY_DATA)).toBe(false);
+    expect(primary({ registry, images: [image] }).volumes.some(v => v.target === REGISTRY_DATA)).toBe(false);
   }
-  expect(k3s({ registry: { host: "registry.test" }, images: [image.reference] }).volumes.some(v => v.target === REGISTRY_DATA)).toBe(false);
+  expect(primary({ registry: { host: "registry.test" }, images: [image.reference] }).volumes.some(v => v.target === REGISTRY_DATA)).toBe(false);
 });
 
 test("registry host rejects ports, URLs, wildcard and reserved hostnames", () => {
@@ -35,7 +40,7 @@ test("registry host rejects ports, URLs, wildcard and reserved hostnames", () =>
 });
 
 test("registry upload URLs are relative and local pre-pulls wait for the registry", async () => {
-  const cluster = k3s({ registry: { host: "registry.test" }, traefik: false, images: ["registry.test/app:latest"] });
+  const cluster = primary({ registry: { host: "registry.test" }, traefik: false, images: ["registry.test/app:latest"] });
   let ready = false;
   await cluster.setup({ name: "cluster", helpers: {
     apply: async (manifest: string) => {
@@ -45,6 +50,6 @@ test("registry upload URLs are relative and local pre-pulls wait for the registr
     waitForRollout: async () => { ready = true; },
   }, exec: async (_name: string, args: string[]) => {
     if (args[3] === "pull") expect(ready).toBe(true);
-    return { exitCode: 0, stdout: "", stderr: "" };
+    return { exitCode: 0, stdout: args[0] === "kubectl" ? JSON.stringify({ items: [{ metadata: { name: "cluster" }, status: { conditions: [{ type: "Ready", status: "True" }] } }] }) : "", stderr: "" };
   } } as never);
 });