domino_admin_toolkit.checks.conftest module

Pytest timeouts

• Per-test default: enforced via autouse TimeoutContext (SIGALRM soft path) plus

  HardTimeout in pytest_runtest_call (thread join backstop). Override with @pytest.mark.check_timeout(<seconds>) or @pytest.mark.timeout(seconds=…).

• Do not set module-level pytestmark = check_timeout(…) in this conftest: a

  conftest pytestmark does not apply to tests in other modules.

See docs/Timeouts.rst for details and examples.

domino_admin_toolkit.checks.conftest.autoscaler_pod_name(platform_namespace, k8s_client)

Find the single running cluster autoscaler pod. Skips if not found.

domino_admin_toolkit.checks.conftest.aws_region()

domino_admin_toolkit.checks.conftest.certificate_inventory_data(_cert_collection)

Per-cert inventory across all cluster namespaces (one row per cert).

domino_admin_toolkit.checks.conftest.chain_validation_data(_cert_collection)

Per-bundle chain validation results (one row per multi-cert bundle).

domino_admin_toolkit.checks.conftest.compact(request)

domino_admin_toolkit.checks.conftest.compute_namespace(k8s_client)

Get compute namespace. Works with both old and new client.

domino_admin_toolkit.checks.conftest.debug_flag(request)

domino_admin_toolkit.checks.conftest.domino_api_client(k8s_client)

domino_admin_toolkit.checks.conftest.domino_system_namespace(k8s_client)

Get domino-system namespace. Works with both old and new client.

Return type:

str

domino_admin_toolkit.checks.conftest.domino_version(domino_version_string)

Return type:

Version

domino_admin_toolkit.checks.conftest.domino_version_string(domino_api_client)

Return type:

str | None

domino_admin_toolkit.checks.conftest.event_service(k8s_client)

Centralized event service for efficient event querying.

Provides server-side filtering, aggregation, and caching capabilities.

domino_admin_toolkit.checks.conftest.field_namespace(k8s_client)

Get field namespace. Works with both old and new client.

domino_admin_toolkit.checks.conftest.fleetagent_config(domino_api_client)

domino_admin_toolkit.checks.conftest.flows_is_enabled(k8s_client)

domino_admin_toolkit.checks.conftest.get_all_kube_events(k8s_client, field_selector=None, weeks=2)

DEPRECATED: Use event_service.get_events() instead.

Legacy fixture for backward compatibility. This fixture loads ALL events and filters in Python (inefficient).

domino_admin_toolkit.checks.conftest.get_bad_pod_events(event_service)

Get warning pod events using optimized EventService.

Uses server-side filtering for better performance.

domino_admin_toolkit.checks.conftest.get_good_cluster_events(event_service)

Get normal cluster events (non-pod) using optimized EventService.

Uses server-side filtering for better performance.

domino_admin_toolkit.checks.conftest.get_good_pod_events(event_service)

Get normal pod events using optimized EventService.

Uses server-side filtering for better performance.

domino_admin_toolkit.checks.conftest.get_nucleus_dispatcher()

Description:

Tests Nucleus Dispatcher is reachable on port 80

domino_admin_toolkit.checks.conftest.get_prometheus_client()

Return type:

PrometheusConnect

domino_admin_toolkit.checks.conftest.get_warning_cluster_events(event_service)

Get warning cluster events (non-pod) using optimized EventService.

Uses server-side filtering for better performance.

domino_admin_toolkit.checks.conftest.is_cert_manager_installed(k8s_client)

True if cert-manager CRDs are present on the cluster.

Return type:

bool

domino_admin_toolkit.checks.conftest.is_domino_cloud(k8s_client)

Determines if the current deployment is a Domino Cloud deployment.

Args:

k8s_client: DominoKubernetesClient instance

Returns:

bool: True if the deployment is a Domino Cloud deployment, False otherwise.

domino_admin_toolkit.checks.conftest.is_domino_cloud_fixture(k8s_client)

domino_admin_toolkit.checks.conftest.is_karpenter_enabled(k8s_client)

Determines if the current deployment has Karpenter enabled by checking for Karpenter services.

Returns:

bool: True if Karpenter is enabled (service found), False otherwise.

domino_admin_toolkit.checks.conftest.is_karpenter_enabled_fixture(k8s_client)

domino_admin_toolkit.checks.conftest.k8s_client()

Kubernetes client using DominoKubernetesClient.

Provides access to Kubernetes resources through manager methods.

Example:

def test_pods(k8s_client, platform_namespace):

pods = k8s_client.pods.list_pods(namespace=platform_namespace) assert len(pods) > 0

domino_admin_toolkit.checks.conftest.karpenter_enabled(is_karpenter_enabled)

Description:

Runs tests that are only applicable to Karpenter-enabled deployments

Result:

Skips the test if Karpenter is not enabled in the deployment

domino_admin_toolkit.checks.conftest.ksm_node_inventory(prometheus_client_v2)

Node names kube-state-metrics currently reports — the yardstick for node-level coverage.

Node-exporter-backed checks only see nodes where the exporter runs and is scraped, so they compare their own node set against this inventory. An empty tuple means the inventory is unavailable and coverage is unknown, never that the cluster has no nodes.

Return type:

tuple[str, ...]

domino_admin_toolkit.checks.conftest.kube_system_namespace(k8s_client)

Get kube-system namespace. Works with both old and new client.

domino_admin_toolkit.checks.conftest.mongo_client(k8s_client)

Return type:

MongoClient

Description:

Sanity test mongodb connectivity with a ping

Result:

The ping result is displayed along with operationTime, and clusterTime

Public Facing KB:

https://support.domino.ai/support/s/article/test-mongodb-py-Runbook-1718868052574

domino_admin_toolkit.checks.conftest.nucleus_dispatcher()

domino_admin_toolkit.checks.conftest.platform_namespace(k8s_client)

Get platform namespace.

domino_admin_toolkit.checks.conftest.prometheus_client()

Return type:

PrometheusConnect

domino_admin_toolkit.checks.conftest.prometheus_client_v2()

domino_admin_toolkit.checks.conftest.pytest_addoption(parser)

domino_admin_toolkit.checks.conftest.pytest_collection_modifyitems(items)

Mark every check collected under an opt-in folder with that folder’s marker.

A pytestmark in the subfolder’s own conftest.py would not work (a conftest pytestmark does not apply to tests in other modules); this hook sees the whole session’s items regardless of where it lives, so one copy covers every folder.

domino_admin_toolkit.checks.conftest.pytest_configure(config)

domino_admin_toolkit.checks.conftest.pytest_html_report_title(report)

domino_admin_toolkit.checks.conftest.pytest_html_results_table_header(cells)

domino_admin_toolkit.checks.conftest.pytest_html_results_table_row(report, cells)

domino_admin_toolkit.checks.conftest.pytest_json_modifyreport(json_report)

Redact the assembled pytest-json-report payload before it’s saved (RE-3358).

pytest-json-report captures log via its own logging.Handler, independent of report.sections - redacting sections above does not reach it. This hook fires from pytest_sessionfinish, after every test’s stdout/stderr/log/longrepr/metadata has been assembled into the final dict and before save_report() writes it to disk, so mutating the live dict here covers the JSON artifact regardless of which internal path produced each string. Must mutate in place: the hook’s return value is discarded by the caller.

domino_admin_toolkit.checks.conftest.pytest_runtest_call(item)

Hard backstop: run the call phase in a worker thread with a join deadline.

After HardTimeout completes, item.runtest is replaced with a no-op so pytest’s default pytest_runtest_call (and any later hookimpls that call runtest) do not execute the test body a second time.

Return type:

None

domino_admin_toolkit.checks.conftest.pytest_runtest_logreport(report)

Redact captured output and traceback text before pytest-html reads them (RE-3358).

pytest-html’s own pytest_runtest_logreport (BaseReport in pytest_html/basereport.py) is registered trylast=True and reads report.sections/report.longreprtext/ report.extras directly to build the HTML “log” panel (_process_logs). This hookimpl has normal priority, so pytest always calls it first for the same report - by the time pytest-html’s hook runs, all three are already scrubbed, regardless of how the HTML file later escapes it (self-contained reports HTML-entity-encode quotes, which would otherwise hide JSON-shaped secrets from a post-hoc text scan).

A failing check’s exception text is exactly where secrets tend to surface (a connection error embedding postgres://user:pass@host, an HTTP error body echoing a token), and that text lives in report.longrepr, not report.sections - the JSON report is safe because pytest_json_modifyreport scrubs the whole assembled dict including longrepr, but the HTML “log” panel reads report.longreprtext straight off the report object. longreprtext is a read-only property computed via longrepr.toterminal(), so the redacted text is written back onto report.longrepr itself; pytest’s toterminal falls back to str(longrepr) for plain strings, so longreprtext still renders fine.

domino_admin_toolkit.checks.conftest.pytest_runtest_makereport(item, call)

domino_admin_toolkit.checks.conftest.runner()

Fresh Runner instance for a single test function.

domino_admin_toolkit.checks.conftest.skip_domino_cloud(is_domino_cloud)

Description:

Skips tests that are not applicable to Domino Cloud deployments

Result:

Skips the test if the deployment is a Domino Cloud deployment

domino_admin_toolkit.checks.conftest.skip_karpenter_enabled(is_karpenter_enabled)

Description:

Skips tests that are not applicable to Karpenter-enabled deployments

Result:

Skips the test if Karpenter is enabled in the deployment