test: add fuzz testing infrastructure

.github/workflows/fuzz.yaml

@@ -0,0 +1,143 @@
+name: Fuzz Tests
+
+on:
+  schedule:
+    - cron: "17 3 * * *"
+  push:
+    branches:
+      - main
+    paths:
+      - "python/**"
+      - "controller/**"
+      - "protocol/**"
+      - "scripts/fuzz.py"
+      - ".github/workflows/fuzz.yaml"
+  workflow_dispatch:
+    inputs:
+      fuzz_time:
+        description: "Fuzz duration per job (e.g. 30m, 2h, 6h)"
+        default: "30m"
+  pull_request:
+    paths:
+      - "python/**"
+      - "controller/**"
+      - "protocol/**"
+      - "scripts/fuzz.py"
+      - ".github/workflows/fuzz.yaml"
+
+concurrency:
+  group: fuzz-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  matrix:
+    if: github.repository_owner == 'jumpstarter-dev'
+    runs-on: ubuntu-latest
+    outputs:
+      go_targets: ${{ steps.targets.outputs.go_targets }}
+      fuzz_time: ${{ steps.duration.outputs.time }}
+      timeout_minutes: ${{ steps.duration.outputs.timeout_minutes }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: targets
+        run: echo "go_targets=$(python3 scripts/fuzz.py --list-go-targets)" >> "$GITHUB_OUTPUT"
+      - id: duration
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          FUZZ_TIME_INPUT: ${{ inputs.fuzz_time }}
+        run: |
+          if [ "$EVENT_NAME" = "schedule" ]; then
+            TIME_VAL="2h"
+          elif [ "$EVENT_NAME" = "push" ]; then
+            TIME_VAL="6h"
+          elif [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            if [ -z "$FUZZ_TIME_INPUT" ] || ! echo "$FUZZ_TIME_INPUT" | grep -qE '^([0-9]+h)([0-9]+m)?([0-9]+s)?$|^([0-9]+m)([0-9]+s)?$|^([0-9]+s)$|^[0-9]+$'; then
+              echo "::error::Invalid fuzz_time format: $FUZZ_TIME_INPUT"
+              exit 1
+            fi
+            TIME_VAL="$FUZZ_TIME_INPUT"
+          else
+            TIME_VAL="5m"
+          fi
+          echo "time=$TIME_VAL" >> "$GITHUB_OUTPUT"
+          TOTAL_SECONDS=0
+          REMAINING="$TIME_VAL"
+          if echo "$REMAINING" | grep -q 'h'; then
+            HOURS=$(echo "$REMAINING" | sed 's/h.*//')
+            REMAINING=$(echo "$REMAINING" | sed 's/[^h]*h//')
+            TOTAL_SECONDS=$((TOTAL_SECONDS + HOURS * 3600))
+          fi
+          if echo "$REMAINING" | grep -q 'm'; then
+            MINUTES=$(echo "$REMAINING" | sed 's/m.*//')
+            REMAINING=$(echo "$REMAINING" | sed 's/[^m]*m//')
+            TOTAL_SECONDS=$((TOTAL_SECONDS + MINUTES * 60))
+          fi
+          if echo "$REMAINING" | grep -qE '^[0-9]+s?$'; then
+            SECS=$(echo "$REMAINING" | sed 's/s//')
+            if [ -n "$SECS" ]; then
+              TOTAL_SECONDS=$((TOTAL_SECONDS + SECS))
+            fi
+          fi
+          TIMEOUT_MINUTES=$(( (TOTAL_SECONDS + 59) / 60 + 30 ))
+          echo "timeout_minutes=$TIMEOUT_MINUTES" >> "$GITHUB_OUTPUT"
+
+  fuzz-python:
+    needs: matrix
+    runs-on: ubuntu-latest
+    timeout-minutes: ${{ fromJson(needs.matrix.outputs.timeout_minutes) }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+
+      - name: Fuzz Python
+        env:
+          FUZZ_TIME: ${{ needs.matrix.outputs.fuzz_time }}
+        run: python3 scripts/fuzz.py --time "$FUZZ_TIME" --python-only
+
+      - name: Upload Hypothesis examples
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: hypothesis-examples
+          path: python/.hypothesis/
+          if-no-files-found: ignore
+
+  fuzz-go:
+    needs: matrix
+    runs-on: ubuntu-latest
+    timeout-minutes: ${{ fromJson(needs.matrix.outputs.timeout_minutes) }}
+    strategy:
+      fail-fast: false
+      matrix:
+        target: ${{ fromJson(needs.matrix.outputs.go_targets) }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: controller/go.mod
+          cache-dependency-path: controller/go.sum
+
+      - name: Restore Go fuzz cache
+        uses: actions/cache@v5
+        with:
+          path: ~/.cache/go-build/fuzz
+          key: go-fuzz-${{ matrix.target.name }}-${{ runner.os }}-${{ hashFiles('controller/**/*_fuzz_test.go') }}
+          restore-keys: |
+            go-fuzz-${{ matrix.target.name }}-${{ runner.os }}-
+
+      - name: Fuzz ${{ matrix.target.name }}
+        env:
+          FUZZ_TIME: ${{ needs.matrix.outputs.fuzz_time }}
+          GO_TARGET: ${{ matrix.target.name }}
+        run: python3 scripts/fuzz.py --time "$FUZZ_TIME" --go-target "$GO_TARGET"
+
+      - name: Upload crash reproducers
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: go-crash-${{ matrix.target.name }}
+          path: controller/**/testdata/fuzz/${{ matrix.target.name }}/
+          if-no-files-found: ignore

Makefile

@@ -30,6 +30,12 @@ help:
 	@echo "  make e2e-full   - Full setup + run (for CI or first time)"
 	@echo "  make e2e-clean  - Clean up e2e test environment (delete cluster, certs, etc.)"
 	@echo ""
+	@echo "Fuzz testing:"
+	@echo "  make fuzz                   - Run all fuzz tests for FUZZ_TIME (default 30m)"
+	@echo "  make fuzz-python            - Run Python hypothesis fuzz tests for FUZZ_TIME"
+	@echo "  make fuzz-go                - Run Go native fuzz tests for FUZZ_TIME"
+	@echo "  FUZZ_TIME=2h make fuzz      - Override total fuzz duration"
+	@echo ""
 	@echo "Per-project targets:"
 	@echo "  make build-<project>  - Build specific project"
 	@echo "  make test-<project>   - Test specific project"
@@ -159,6 +165,19 @@ e2e-clean:
 	@echo "Note: You may need to manually remove the dex entry from /etc/hosts:"
 	@echo "  sudo sed -i.bak '/dex.dex.svc.cluster.local/d' /etc/hosts"
 
+# Fuzz testing
+FUZZ_TIME ?= 30m
+
+.PHONY: fuzz fuzz-python fuzz-go
+fuzz:
+	@python3 scripts/fuzz.py --time $(FUZZ_TIME)
+
+fuzz-python:
+	@python3 scripts/fuzz.py --time $(FUZZ_TIME) --python-only
+
+fuzz-go:
+	@python3 scripts/fuzz.py --time $(FUZZ_TIME) --go-only
+
 # Backward compatibility alias
 .PHONY: test-e2e
 test-e2e: e2e-run

controller/.gitignore

@@ -28,3 +28,6 @@ go.work
 *~
 
 goreleaser/
+
+# Fuzz corpus (regressions are injected as f.Add() seeds in source)
+**/testdata/fuzz/

controller/api/v1alpha1/client_helpers_fuzz_test.go

@@ -0,0 +1,61 @@
+package v1alpha1
+
+import (
+	"strings"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+func FuzzClientUsernames(f *testing.F) {
+	f.Add("internal:", "my-client", "default", "uid-123", "", false)
+	f.Add("internal:", "client", "ns", "uid", "oidc:user@example.com", true)
+	f.Add("prefix:", "name", "namespace", "uid", "", false)
+	f.Add("", "name", "ns", "uid", "user", true)
+
+	f.Fuzz(func(t *testing.T, prefix, name, namespace, uid, customUsername string, hasCustom bool) {
+		c := &Client{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      name,
+				Namespace: namespace,
+				UID:       types.UID(uid),
+			},
+		}
+		if hasCustom {
+			c.Spec.Username = &customUsername
+		}
+
+		usernames := c.Usernames(prefix)
+
+		if len(usernames) == 0 {
+			t.Fatal("Usernames returned empty slice")
+		}
+
+		expectedInternal := prefix + c.InternalSubject()
+		if usernames[0] != expectedInternal {
+			t.Errorf("first username = %q, expected %q", usernames[0], expectedInternal)
+		}
+
+		if !strings.HasPrefix(usernames[0], prefix) {
+			t.Errorf("first username %q does not start with prefix %q", usernames[0], prefix)
+		}
+
+		internalSubject := c.InternalSubject()
+		if !strings.HasPrefix(internalSubject, "client:") {
+			t.Errorf("InternalSubject() = %q does not start with 'client:'", internalSubject)
+		}
+
+		if hasCustom {
+			if len(usernames) != 2 {
+				t.Errorf("expected 2 usernames with custom username, got %d", len(usernames))
+			} else if usernames[1] != customUsername {
+				t.Errorf("second username = %q, expected custom %q", usernames[1], customUsername)
+			}
+		} else {
+			if len(usernames) != 1 {
+				t.Errorf("expected 1 username without custom username, got %d", len(usernames))
+			}
+		}
+	})
+}

controller/api/v1alpha1/exporter_helpers_fuzz_test.go

@@ -0,0 +1,107 @@
+package v1alpha1
+
+import (
+	"strings"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+func FuzzExporterUsernames(f *testing.F) {
+	f.Add("internal:", "my-exporter", "default", "uid-123", "", false)
+	f.Add("internal:", "exporter", "ns", "uid", "custom-user", true)
+	f.Add("prefix:", "name", "namespace", "uid", "", false)
+	f.Add("", "name", "ns", "uid", "user", true)
+
+	f.Fuzz(func(t *testing.T, prefix, name, namespace, uid, customUsername string, hasCustom bool) {
+		e := &Exporter{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      name,
+				Namespace: namespace,
+				UID:       types.UID(uid),
+			},
+		}
+		if hasCustom {
+			e.Spec.Username = &customUsername
+		}
+
+		usernames := e.Usernames(prefix)
+
+		if len(usernames) == 0 {
+			t.Fatal("Usernames returned empty slice")
+		}
+
+		expectedInternal := prefix + e.InternalSubject()
+		if usernames[0] != expectedInternal {
+			t.Errorf("first username = %q, expected %q", usernames[0], expectedInternal)
+		}
+
+		if !strings.HasPrefix(usernames[0], prefix) {
+			t.Errorf("first username %q does not start with prefix %q", usernames[0], prefix)
+		}
+
+		if hasCustom {
+			if len(usernames) != 2 {
+				t.Errorf("expected 2 usernames with custom username, got %d", len(usernames))
+			} else if usernames[1] != customUsername {
+				t.Errorf("second username = %q, expected custom %q", usernames[1], customUsername)
+			}
+		} else {
+			if len(usernames) != 1 {
+				t.Errorf("expected 1 username without custom username, got %d", len(usernames))
+			}
+		}
+	})
+}
+
+func FuzzExporterToProtobuf(f *testing.F) {
+	f.Add("my-exporter", "default", "Available", "running fine")
+	f.Add("exp", "ns", "Offline", "")
+	f.Add("exp", "ns", "Unspecified", "msg")
+	f.Add("exp", "ns", "LeaseReady", "msg")
+	f.Add("exp", "ns", "UnknownStatus", "msg")
+
+	f.Fuzz(func(t *testing.T, name, namespace, statusValue, statusMessage string) {
+		e := &Exporter{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      name,
+				Namespace: namespace,
+			},
+			Status: ExporterStatus{
+				ExporterStatusValue: statusValue,
+				StatusMessage:       statusMessage,
+			},
+		}
+
+		pb := e.ToProtobuf()
+
+		expectedName := "namespaces/" + namespace + "/exporters/" + name
+		if pb.Name != expectedName {
+			t.Errorf("protobuf Name = %q, expected %q", pb.Name, expectedName)
+		}
+
+		if pb.StatusMessage != statusMessage {
+			t.Errorf("protobuf StatusMessage = %q, expected %q", pb.StatusMessage, statusMessage)
+		}
+	})
+}
+
+func FuzzExporterListToProtobuf(f *testing.F) {
+	f.Add("exp1", "exp2", "ns")
+
+	f.Fuzz(func(t *testing.T, name1, name2, namespace string) {
+		list := &ExporterList{
+			Items: []Exporter{
+				{ObjectMeta: metav1.ObjectMeta{Name: name1, Namespace: namespace}},
+				{ObjectMeta: metav1.ObjectMeta{Name: name2, Namespace: namespace}},
+			},
+		}
+
+		resp := list.ToProtobuf()
+
+		if len(resp.Exporters) != 2 {
+			t.Fatalf("expected 2 exporters in protobuf response, got %d", len(resp.Exporters))
+		}
+	})
+}