test(terraform): add plan-level tests for 032-fabric-rti and 072-azure-local-host

[Shivam Sharma (ShivamSharma43)]

Pull Request

Description

Adds plan-level Terraform tests for two more of the untested components listed in #152: 032-fabric-rti and 072-azure-local-host. Each component gets a tests/base.tftest.hcl and a tests/setup module, following the pattern from #821. All runs use command = plan with mock_provider, so no Azure credentials are needed.

Related Issue

Relates to #152

This covers 2 more of the 11 components in that issue, so it does not close it. It doesn't touch the components in #821 or the open #861 and #862.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Blueprint modification or addition
• Component modification or addition
• Documentation update
• CI/CD pipeline change
• Other (please describe): tests only, no changes to component code

Implementation Details

032-fabric-rti (mocks azurerm and fabric). The assertions decode the generated eventstream.json Content token and check the DAG it describes:

• create_minimal_eventstream: with only a workspace, the EventStream uses the es-<prefix>-<env>-<instance> name and the bundled template. The definition has no sources, destinations, streams or operators, retention defaults to 7 days and throughput to Medium. No source connection is looked up.
• create_eventstream_with_destinations: the CI-style DAG (one custom endpoint, a default stream, an Eventhouse and a Lakehouse destination). Checks the uuidv5 node IDs, the default stream name (<eventstream>-stream), the { name = ... } input-node shape, Eventhouse before Lakehouse ordering, and the defaults for Eventhouse tableName and dataIngestionMode and Lakehouse schema. Also checks the provided retention and throughput, and that one source connection is looked up per custom endpoint with the generated source ID.
• create_eventstream_with_operators: a filter and a union operator feeding a derived stream. Checks that the default stream comes before derived streams, the documented operator order, and the filter's expressionType default.
• create_eventstream_with_custom_template: eventstream_template_file_path and template_tokens replace the generated template and Content token.

072-azure-local-host (mocks azapi, azurerm and tls; azurerm_client_config is overridden so the tenant and subscription are fixed):

• create_default_configuration: the connected cluster name (arck-...), parent resource group, ProvisionedCluster kind, Azure RBAC on with no admin groups, and tenant from the current client. Also checks the logical network lookup's name and subscription-scoped parent, and the provisioned cluster's custom location. Covers the node-pool, control-plane, pod CIDR and CSI driver defaults, and that no extra agent pools are planned.
• create_with_custom_cluster_settings: the SSH key, control plane IP/count/size, node pool count/size, Kubernetes version, pod CIDR, load balancer count, CSI drivers and Azure Hybrid Benefit are passed through.
• create_with_admin_groups: with enable_azure_rbac = false, the admin group IDs and the provided tenant ID are used.
• reject_disabled_rbac_without_admin_groups: disabling Azure RBAC without admin groups fails the aad_profile validation.
• create_additional_nodepools: one agent pool per additional_nodepools entry, with the Linux/CBLMariner defaults and overrides, and the custom location.

Neither component has ci/terraform/*.tfvars, so the required inputs come from the setup module, as in the other component tests.

Testing Performed

• Terraform plan/apply
• Blueprint deployment test
• Unit tests
• Integration tests
• Bug fix includes regression test (see Test Policy)
• Manual validation
• Other: terraform test (plan-level, mock providers)

Run with no ARM_* or AZURE_* variables set:

• terraform init -backend=false and terraform test in each component, with Terraform 1.16.5 and 1.15.0: 032-fabric-rti 5 passed, 0 failed; 072-azure-local-host 6 passed, 0 failed.
• terraform validate in each component: valid.
• terraform fmt -check -recursive on both tests/ directories: no changes.
• tflint --disable-rule=terraform_required_providers --recursive with the repo .tflint.hcl: no findings.

I also checked that the tests fail when the component is wrong. I broke a copy of each: dropping the Eventhouse tableName default, changing the default stream ID, swapping stream order, sending admin groups even with RBAC on, ignoring the provided tenant ID, and hard-coding the agent pool OS SKU. Each change made at least one run fail.

Validation Steps

1. cd src/000-cloud/032-fabric-rti/terraform && terraform init -backend=false && terraform test
2. cd src/000-cloud/072-azure-local-host/terraform && terraform init -backend=false && terraform test

No Azure login is needed for either.

Checklist

• I have updated the documentation accordingly
• I have added tests to cover my changes
• All new and existing tests passed
• I have run terraform fmt on all Terraform code
• I have run terraform validate on all Terraform code
• I have run az bicep format on all Bicep code
• I have run az bicep build to validate all Bicep code
• I have checked for any sensitive data/tokens that should not be committed
• Lint checks pass (run applicable linters for changed file types)

Security Review

• No credentials, secrets, or tokens are hardcoded or logged
• RBAC and identity changes follow least-privilege principles
• No new network exposure or public endpoints introduced without justification
• Dependency additions or updates have been reviewed for known vulnerabilities
• Container image changes use pinned digests or SHA references

Additional Notes

The new tests pass on their own. I did not run the existing tests in other components, since most of them need an Azure subscription. The SSH key in create_with_custom_cluster_settings is a placeholder string, not a real key.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Katrien De Graeve (katriendg)]

This looks good, thanks for your contribution.