test: upgrade master to master tests

Verify upgrade flow using the same version of the installer.
Run that with disk encryption enabled.

Signed-off-by: Artem Chernyshev <artem.0xD2@gmail.com>

.drone.jsonnet

@@ -354,6 +354,7 @@ local integration_qemu = Step("e2e-qemu", privileged=true, depends_on=[load_arti
 local integration_provision_tests_prepare = Step("provision-tests-prepare", privileged=true, depends_on=[load_artifacts]);
 local integration_provision_tests_track_0 = Step("provision-tests-track-0", privileged=true, depends_on=[integration_provision_tests_prepare], environment={"IMAGE_REGISTRY": local_registry});
 local integration_provision_tests_track_1 = Step("provision-tests-track-1", privileged=true, depends_on=[integration_provision_tests_prepare], environment={"IMAGE_REGISTRY": local_registry});
+local integration_provision_tests_track_2 = Step("provision-tests-track-2", privileged=true, depends_on=[integration_provision_tests_prepare], environment={"IMAGE_REGISTRY": local_registry});
 
 local integration_cilium = Step("e2e-cilium-1.9.4", target="e2e-qemu", privileged=true, depends_on=[load_artifacts], environment={
         "SHORT_INTEGRATION_TEST": "yes",
@@ -408,13 +409,15 @@ local integration_pipelines = [
   Pipeline('integration-qemu', default_pipeline_steps + [integration_qemu, push_edge]) + integration_trigger(['integration-qemu']),
   Pipeline('integration-provision-0', default_pipeline_steps + [integration_provision_tests_prepare, integration_provision_tests_track_0]) + integration_trigger(['integration-provision', 'integration-provision-0']),
   Pipeline('integration-provision-1', default_pipeline_steps + [integration_provision_tests_prepare, integration_provision_tests_track_1]) + integration_trigger(['integration-provision', 'integration-provision-1']),
+  Pipeline('integration-provision-2', default_pipeline_steps + [integration_provision_tests_prepare, integration_provision_tests_track_2]) + integration_trigger(['integration-provision', 'integration-provision-2']),
   Pipeline('integration-misc', default_pipeline_steps + [integration_cilium, integration_uefi, integration_disk_image]) + integration_trigger(['integration-misc']),
   Pipeline('integration-qemu-encrypted', default_pipeline_steps + [integration_qemu_encrypted]) + integration_trigger(['integration-qemu-encrypted']),
 
   // cron pipelines, triggered on schedule events
   Pipeline('cron-integration-qemu', default_pipeline_steps + [integration_qemu, push_edge], [default_cron_pipeline]) + cron_trigger(['thrice-daily', 'nightly']),
   Pipeline('cron-integration-provision-0', default_pipeline_steps + [integration_provision_tests_prepare, integration_provision_tests_track_0], [default_cron_pipeline]) + cron_trigger(['thrice-daily', 'nightly']),
   Pipeline('cron-integration-provision-1', default_pipeline_steps + [integration_provision_tests_prepare, integration_provision_tests_track_1], [default_cron_pipeline]) + cron_trigger(['thrice-daily', 'nightly']),
+  Pipeline('cron-integration-provision-2', default_pipeline_steps + [integration_provision_tests_prepare, integration_provision_tests_track_2], [default_cron_pipeline]) + cron_trigger(['thrice-daily', 'nightly']),
   Pipeline('cron-integration-misc', default_pipeline_steps + [integration_cilium, integration_uefi, integration_disk_image], [default_cron_pipeline]) + cron_trigger(['thrice-daily', 'nightly']),
   Pipeline('cron-integration-qemu-encrypted', default_pipeline_steps + [integration_qemu_encrypted], [default_cron_pipeline]) + cron_trigger(['thrice-daily', 'nightly']),
 ];

internal/integration/api/apply-config.go

@@ -270,6 +270,8 @@ func (suite *ApplyConfigSuite) TestApplyConfigRotateEncryptionSecrets() {
 			return nil
 		}, assertRebootedRebootTimeout)
 
+		suite.ClearConnectionRefused(suite.ctx, node)
+
 		// Verify configuration change
 		var newProvider config.Provider
 

internal/integration/provision/upgrade.go

@@ -18,6 +18,7 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/suite"
+	"github.com/talos-systems/go-blockdevice/blockdevice/encryption"
 	"github.com/talos-systems/go-retry/retry"
 	talosnet "github.com/talos-systems/net"
 	corev1 "k8s.io/api/core/v1"
@@ -66,6 +67,7 @@ type upgradeSpec struct {
 
 	UpgradePreserve bool
 	UpgradeStage    bool
+	WithEncryption  bool
 }
 
 const (
@@ -136,6 +138,32 @@ func upgradeStableReleaseToCurrent() upgradeSpec {
 	}
 }
 
+// upgradeCurrentReleaseToCurrent upgrades current version to the current version of Talos.
+func upgradeCurrentReleaseToCurrent() upgradeSpec {
+	installerImage := fmt.Sprintf("%s/%s:%s", DefaultSettings.TargetInstallImageRegistry, images.DefaultInstallerImageName, DefaultSettings.CurrentVersion)
+
+	return upgradeSpec{
+		ShortName: fmt.Sprintf("%s-%s", DefaultSettings.CurrentVersion, DefaultSettings.CurrentVersion),
+
+		SourceKernelPath:     helpers.ArtifactPath(constants.KernelAssetWithArch),
+		SourceInitramfsPath:  helpers.ArtifactPath(constants.InitramfsAssetWithArch),
+		SourceInstallerImage: installerImage,
+		SourceVersion:        DefaultSettings.CurrentVersion,
+		SourceK8sVersion:     currentK8sVersion,
+		SourceSelfHosted:     true,
+
+		TargetInstallerImage: installerImage,
+		TargetVersion:        DefaultSettings.CurrentVersion,
+		TargetK8sVersion:     currentK8sVersion,
+		TargetSelfHosted:     true,
+
+		MasterNodes: DefaultSettings.MasterNodes,
+		WorkerNodes: DefaultSettings.WorkerNodes,
+
+		WithEncryption: true,
+	}
+}
+
 // upgradeSingeNodePreserve upgrade last release of Talos to the current version of Talos for single-node cluster with preserve.
 func upgradeSingeNodePreserve() upgradeSpec {
 	return upgradeSpec{
@@ -326,6 +354,29 @@ func (suite *UpgradeSuite) setupCluster() {
 		}))
 	}
 
+	if suite.spec.WithEncryption {
+		genOptions = append(genOptions, generate.WithSystemDiskEncryption(&v1alpha1.SystemDiskEncryptionConfig{
+			StatePartition: &v1alpha1.EncryptionConfig{
+				EncryptionProvider: encryption.LUKS2,
+				EncryptionKeys: []*v1alpha1.EncryptionKey{
+					{
+						KeyNodeID: &v1alpha1.EncryptionKeyNodeID{},
+						KeySlot:   0,
+					},
+				},
+			},
+			EphemeralPartition: &v1alpha1.EncryptionConfig{
+				EncryptionProvider: encryption.LUKS2,
+				EncryptionKeys: []*v1alpha1.EncryptionKey{
+					{
+						KeyNodeID: &v1alpha1.EncryptionKeyNodeID{},
+						KeySlot:   0,
+					},
+				},
+			},
+		}))
+	}
+
 	versionContract, err := config.ParseContractFromVersion(suite.spec.SourceVersion)
 	suite.Require().NoError(err)
 
@@ -655,6 +706,7 @@ func init() {
 	allSuites = append(allSuites,
 		&UpgradeSuite{specGen: upgradeBetweenTwoLastReleases, track: 0},
 		&UpgradeSuite{specGen: upgradeStableReleaseToCurrent, track: 1},
+		&UpgradeSuite{specGen: upgradeCurrentReleaseToCurrent, track: 2},
 		&UpgradeSuite{specGen: upgradeSingeNodePreserve, track: 0},
 		&UpgradeSuite{specGen: upgradeSingeNodeStage, track: 1},
 	)

pkg/cluster/check/default.go

@@ -89,7 +89,7 @@ func DefaultClusterChecks() []ClusterCheck {
 		func(cluster ClusterInfo) conditions.Condition {
 			return conditions.PollingCondition("all k8s nodes to report schedulable", func(ctx context.Context) error {
 				return K8sAllNodesSchedulableAssertion(ctx, cluster)
-			}, 2*time.Minute, 5*time.Second)
+			}, 5*time.Minute, 5*time.Second)
 		},
 	}
 }