feat: add ctest package and base for test suite

This change adds ctest package which adds DefaultSuite and helper functions.

Signed-off-by: Dmitriy Matrenichev <dmitry.matrenichev@siderolabs.com>

internal/app/machined/pkg/controllers/ctest/ctest.go

@@ -0,0 +1,131 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package ctest provides basic types and functions for controller testing.
+package ctest
+
+import (
+	"context"
+	"log"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller/runtime"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+	"github.com/talos-systems/go-retry/retry"
+
+	"github.com/talos-systems/talos/pkg/logging"
+)
+
+// DefaultSuite is a base suite for controller testing.
+type DefaultSuite struct { //nolint:govet
+	suite.Suite
+
+	state state.State
+
+	runtime *runtime.Runtime
+	wg      sync.WaitGroup
+
+	ctx       context.Context //nolint:containedctx
+	ctxCancel context.CancelFunc
+
+	AfterSetup    func(suite *DefaultSuite)
+	AfterTearDown func(suite *DefaultSuite)
+}
+
+// SetupTest is a function for setting up a test.
+func (suite *DefaultSuite) SetupTest() {
+	suite.ctx, suite.ctxCancel = context.WithTimeout(context.Background(), 3*time.Minute)
+
+	suite.state = state.WrapCore(namespaced.NewState(inmem.Build))
+
+	var err error
+
+	suite.runtime, err = runtime.NewRuntime(suite.state, logging.Wrap(log.Writer()))
+	suite.Require().NoError(err)
+
+	suite.startRuntime()
+
+	if suite.AfterSetup != nil {
+		suite.AfterSetup(suite)
+	}
+}
+
+func (suite *DefaultSuite) startRuntime() {
+	suite.wg.Add(1)
+
+	go func() {
+		defer suite.wg.Done()
+
+		suite.Assert().NoError(suite.runtime.Run(suite.ctx))
+	}()
+}
+
+// Runtime returns the runtime of the suite.
+func (suite *DefaultSuite) Runtime() *runtime.Runtime {
+	return suite.runtime
+}
+
+// State returns the state of the suite.
+func (suite *DefaultSuite) State() state.State {
+	return suite.state
+}
+
+// Ctx returns the context of the suite.
+func (suite *DefaultSuite) Ctx() context.Context {
+	return suite.ctx
+}
+
+// AssertWithin asserts that fn returns within the given duration without an error.
+func (suite *DefaultSuite) AssertWithin(d time.Duration, rate time.Duration, fn func() error) {
+	retryer := retry.Constant(d, retry.WithUnits(rate))
+	suite.Assert().NoError(retryer.Retry(fn))
+}
+
+// TearDownTest is a function for tearing down a test.
+func (suite *DefaultSuite) TearDownTest() {
+	suite.T().Log("tear down")
+
+	suite.ctxCancel()
+
+	suite.wg.Wait()
+
+	if suite.AfterTearDown != nil {
+		suite.AfterTearDown(suite)
+	}
+}
+
+// Suite is a type which dectibes the suite type.
+type Suite interface {
+	T() *testing.T
+	Require() *require.Assertions
+	State() state.State
+	Ctx() context.Context
+}
+
+// UpdateWithConflicts is a type safe wrapper around state.UpdateWithConflicts which uses the provided suite.
+func UpdateWithConflicts[T resource.Resource](suite Suite, res T, updateFn func(T) error, options ...state.UpdateOption) T { //nolint:ireturn
+	suite.T().Helper()
+	result, err := safe.StateUpdateWithConflicts(suite.Ctx(), suite.State(), res.Metadata(), updateFn, options...)
+	suite.Require().NoError(err)
+
+	return result
+}
+
+// GetUsingResource is a type safe wrapper around state.StateGetResource which uses the provided suite.
+func GetUsingResource[T resource.Resource](suite Suite, res T, options ...state.GetOption) (T, error) { //nolint:ireturn
+	return safe.StateGetResource(suite.Ctx(), suite.State(), res, options...)
+}
+
+// Get is a type safe wrapper around state.Get which uses the provided suite.
+func Get[T resource.Resource](suite Suite, ptr resource.Pointer, options ...state.GetOption) (T, error) { //nolint:ireturn
+	return safe.StateGet[T](suite.Ctx(), suite.State(), ptr, options...)
+}

internal/app/machined/pkg/controllers/secrets/api_cert_sans_test.go

@@ -6,65 +6,36 @@
 package secrets_test
 
 import (
-	"context"
 	"fmt"
-	"log"
 	"reflect"
-	"sync"
 	"testing"
 	"time"
 
-	"github.com/cosi-project/runtime/pkg/controller/runtime"
 	"github.com/cosi-project/runtime/pkg/resource"
 	"github.com/cosi-project/runtime/pkg/state"
-	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
-	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
 	"github.com/stretchr/testify/suite"
 	"github.com/talos-systems/go-retry/retry"
 	"inet.af/netaddr"
 
+	"github.com/talos-systems/talos/internal/app/machined/pkg/controllers/ctest"
 	secretsctrl "github.com/talos-systems/talos/internal/app/machined/pkg/controllers/secrets"
-	"github.com/talos-systems/talos/pkg/logging"
 	"github.com/talos-systems/talos/pkg/machinery/resources/k8s"
 	"github.com/talos-systems/talos/pkg/machinery/resources/network"
 	"github.com/talos-systems/talos/pkg/machinery/resources/secrets"
 )
 
+func TestAPICertSANsSuite(t *testing.T) {
+	suite.Run(t, &APICertSANsSuite{
+		DefaultSuite: ctest.DefaultSuite{
+			AfterSetup: func(suite *ctest.DefaultSuite) {
+				suite.Require().NoError(suite.Runtime().RegisterController(&secretsctrl.APICertSANsController{}))
+			},
+		},
+	})
+}
+
 type APICertSANsSuite struct {
-	suite.Suite
+	ctest.DefaultSuite
-
-	state state.State
-
-	runtime *runtime.Runtime
-	wg      sync.WaitGroup
-
-	ctx       context.Context //nolint:containedctx
-	ctxCancel context.CancelFunc
-}
-
-func (suite *APICertSANsSuite) SetupTest() {
-	suite.ctx, suite.ctxCancel = context.WithTimeout(context.Background(), 3*time.Minute)
-
-	suite.state = state.WrapCore(namespaced.NewState(inmem.Build))
-
-	var err error
-
-	suite.runtime, err = runtime.NewRuntime(suite.state, logging.Wrap(log.Writer()))
-	suite.Require().NoError(err)
-
-	suite.Require().NoError(suite.runtime.RegisterController(&secretsctrl.APICertSANsController{}))
-
-	suite.startRuntime()
-}
-
-func (suite *APICertSANsSuite) startRuntime() {
-	suite.wg.Add(1)
-
-	go func() {
-		defer suite.wg.Done()
-
-		suite.Assert().NoError(suite.runtime.Run(suite.ctx))
-	}()
 }
 
 func (suite *APICertSANsSuite) TestReconcileControlPlane() {
@@ -72,12 +43,12 @@ func (suite *APICertSANsSuite) TestReconcileControlPlane() {
 
 	rootSecrets.TypedSpec().CertSANDNSNames = []string{"some.org"}
 	rootSecrets.TypedSpec().CertSANIPs = []netaddr.IP{netaddr.MustParseIP("10.4.3.2"), netaddr.MustParseIP("10.2.1.3")}
-	suite.Require().NoError(suite.state.Create(suite.ctx, rootSecrets))
+	suite.Require().NoError(suite.State().Create(suite.Ctx(), rootSecrets))
 
 	hostnameStatus := network.NewHostnameStatus(network.NamespaceName, network.HostnameID)
 	hostnameStatus.TypedSpec().Hostname = "bar"
 	hostnameStatus.TypedSpec().Domainname = "some.org"
-	suite.Require().NoError(suite.state.Create(suite.ctx, hostnameStatus))
+	suite.Require().NoError(suite.State().Create(suite.Ctx(), hostnameStatus))
 
 	nodeAddresses := network.NewNodeAddress(
 		network.NamespaceName,
@@ -87,13 +58,11 @@ func (suite *APICertSANsSuite) TestReconcileControlPlane() {
 		netaddr.MustParseIPPrefix("10.2.1.3/24"),
 		netaddr.MustParseIPPrefix("172.16.0.1/32"),
 	}
-	suite.Require().NoError(suite.state.Create(suite.ctx, nodeAddresses))
+	suite.Require().NoError(suite.State().Create(suite.Ctx(), nodeAddresses))
 
-	suite.Assert().NoError(
+	suite.AssertWithin(10*time.Second, 100*time.Millisecond, func() error {
-		retry.Constant(10*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
+		certSANs, err := ctest.Get[*secrets.CertSAN](
-			func() error {
+			suite,
-				certSANs, err := suite.state.Get(
-					suite.ctx,
 			resource.NewMetadata(
 				secrets.NamespaceName,
 				secrets.CertSANType,
@@ -109,29 +78,24 @@ func (suite *APICertSANsSuite) TestReconcileControlPlane() {
 			return err
 		}
 
-				spec := certSANs.(*secrets.CertSAN).TypedSpec()
+		spec := certSANs.TypedSpec()
 
 		suite.Assert().Equal([]string{"bar", "bar.some.org", "some.org"}, spec.DNSNames)
 		suite.Assert().Equal("[10.2.1.3 10.4.3.2 172.16.0.1]", fmt.Sprintf("%v", spec.IPs))
 		suite.Assert().Equal("bar.some.org", spec.FQDN)
 
 		return nil
-			},
+	})
-		),
-	)
 
-	_, err := suite.state.UpdateWithConflicts(suite.ctx, rootSecrets.Metadata(), func(r resource.Resource) error {
+	ctest.UpdateWithConflicts(suite, rootSecrets, func(rootSecrets *secrets.OSRoot) error {
-		r.(*secrets.OSRoot).TypedSpec().CertSANDNSNames = []string{"other.org"}
+		rootSecrets.TypedSpec().CertSANDNSNames = []string{"other.org"}
 
 		return nil
 	})
-	suite.Require().NoError(err)
 
-	suite.Assert().NoError(
+	suite.AssertWithin(10*time.Second, 100*time.Millisecond, func() error {
-		retry.Constant(10*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
+		certSANs, err := ctest.Get[*secrets.CertSAN](
-			func() error {
+			suite,
-				certSANs, err := suite.state.Get(
-					suite.ctx,
 			resource.NewMetadata(
 				secrets.NamespaceName,
 				secrets.CertSANType,
@@ -143,7 +107,7 @@ func (suite *APICertSANsSuite) TestReconcileControlPlane() {
 			return err
 		}
 
-				spec := certSANs.(*secrets.CertSAN).TypedSpec()
+		spec := certSANs.TypedSpec()
 
 		expectedDNSNames := []string{"bar", "bar.some.org", "other.org"}
 
@@ -152,19 +116,5 @@ func (suite *APICertSANsSuite) TestReconcileControlPlane() {
 		}
 
 		return nil
-			},
+	})
-		),
-	)
-}
-
-func (suite *APICertSANsSuite) TearDownTest() {
-	suite.T().Log("tear down")
-
-	suite.ctxCancel()
-
-	suite.wg.Wait()
-}
-
-func TestAPICertSANsSuite(t *testing.T) {
-	suite.Run(t, new(APICertSANsSuite))
 }

internal/app/machined/pkg/controllers/secrets/api_test.go

@@ -6,26 +6,20 @@
 package secrets_test
 
 import (
-	"context"
 	stdlibx509 "crypto/x509"
 	"fmt"
-	"log"
-	"sync"
 	"testing"
 	"time"
 
-	"github.com/cosi-project/runtime/pkg/controller/runtime"
 	"github.com/cosi-project/runtime/pkg/resource"
 	"github.com/cosi-project/runtime/pkg/state"
-	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
-	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
 	"github.com/stretchr/testify/suite"
 	"github.com/talos-systems/crypto/x509"
 	"github.com/talos-systems/go-retry/retry"
 	"inet.af/netaddr"
 
+	"github.com/talos-systems/talos/internal/app/machined/pkg/controllers/ctest"
 	secretsctrl "github.com/talos-systems/talos/internal/app/machined/pkg/controllers/secrets"
-	"github.com/talos-systems/talos/pkg/logging"
 	"github.com/talos-systems/talos/pkg/machinery/config/types/v1alpha1/machine"
 	"github.com/talos-systems/talos/pkg/machinery/resources/config"
 	"github.com/talos-systems/talos/pkg/machinery/resources/network"
@@ -33,41 +27,18 @@ import (
 	"github.com/talos-systems/talos/pkg/machinery/role"
 )
 
+func TestAPISuite(t *testing.T) {
+	suite.Run(t, &APISuite{
+		DefaultSuite: ctest.DefaultSuite{
+			AfterSetup: func(suite *ctest.DefaultSuite) {
+				suite.Require().NoError(suite.Runtime().RegisterController(&secretsctrl.APIController{}))
+			},
+		},
+	})
+}
+
 type APISuite struct {
-	suite.Suite
+	ctest.DefaultSuite
-
-	state state.State
-
-	runtime *runtime.Runtime
-	wg      sync.WaitGroup
-
-	ctx       context.Context //nolint:containedctx
-	ctxCancel context.CancelFunc
-}
-
-func (suite *APISuite) SetupTest() {
-	suite.ctx, suite.ctxCancel = context.WithTimeout(context.Background(), 3*time.Minute)
-
-	suite.state = state.WrapCore(namespaced.NewState(inmem.Build))
-
-	var err error
-
-	suite.runtime, err = runtime.NewRuntime(suite.state, logging.Wrap(log.Writer()))
-	suite.Require().NoError(err)
-
-	suite.Require().NoError(suite.runtime.RegisterController(&secretsctrl.APIController{}))
-
-	suite.startRuntime()
-}
-
-func (suite *APISuite) startRuntime() {
-	suite.wg.Add(1)
-
-	go func() {
-		defer suite.wg.Done()
-
-		suite.Assert().NoError(suite.runtime.Run(suite.ctx))
-	}()
 }
 
 func (suite *APISuite) TestReconcileControlPlane() {
@@ -85,16 +56,16 @@ func (suite *APISuite) TestReconcileControlPlane() {
 	rootSecrets.TypedSpec().CertSANDNSNames = []string{"example.com"}
 	rootSecrets.TypedSpec().CertSANIPs = []netaddr.IP{netaddr.MustParseIP("10.4.3.2"), netaddr.MustParseIP("10.2.1.3")}
 	rootSecrets.TypedSpec().Token = "something"
-	suite.Require().NoError(suite.state.Create(suite.ctx, rootSecrets))
+	suite.Require().NoError(suite.State().Create(suite.Ctx(), rootSecrets))
 
 	machineType := config.NewMachineType()
 	machineType.SetMachineType(machine.TypeControlPlane)
-	suite.Require().NoError(suite.state.Create(suite.ctx, machineType))
+	suite.Require().NoError(suite.State().Create(suite.Ctx(), machineType))
 
 	networkStatus := network.NewStatus(network.NamespaceName, network.StatusID)
 	networkStatus.TypedSpec().AddressReady = true
 	networkStatus.TypedSpec().HostnameReady = true
-	suite.Require().NoError(suite.state.Create(suite.ctx, networkStatus))
+	suite.Require().NoError(suite.State().Create(suite.Ctx(), networkStatus))
 
 	certSANs := secrets.NewCertSAN(secrets.NamespaceName, secrets.CertSANAPIID)
 	certSANs.TypedSpec().Append(
@@ -108,13 +79,10 @@ func (suite *APISuite) TestReconcileControlPlane() {
 
 	certSANs.TypedSpec().FQDN = "foo.example.com"
 
-	suite.Require().NoError(suite.state.Create(suite.ctx, certSANs))
+	suite.Require().NoError(suite.State().Create(suite.Ctx(), certSANs))
-
+	suite.AssertWithin(10*time.Second, 100*time.Millisecond, func() error {
-	suite.Assert().NoError(
+		certs, err := ctest.Get[*secrets.API](
-		retry.Constant(10*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
+			suite,
-			func() error {
-				certs, err := suite.state.Get(
-					suite.ctx,
 			resource.NewMetadata(
 				secrets.NamespaceName,
 				secrets.APIType,
@@ -130,7 +98,7 @@ func (suite *APISuite) TestReconcileControlPlane() {
 			return err
 		}
 
-				apiCerts := certs.(*secrets.API).TypedSpec()
+		apiCerts := certs.TypedSpec()
 
 		suite.Assert().Equal(talosCA.CrtPEM, apiCerts.CA.Crt)
 		suite.Assert().Nil(apiCerts.CA.Key)
@@ -166,19 +134,5 @@ func (suite *APISuite) TestReconcileControlPlane() {
 		suite.Assert().Equal([]stdlibx509.ExtKeyUsage{stdlibx509.ExtKeyUsageClientAuth}, clientCert.ExtKeyUsage)
 
 		return nil
-			},
+	})
-		),
-	)
-}
-
-func (suite *APISuite) TearDownTest() {
-	suite.T().Log("tear down")
-
-	suite.ctxCancel()
-
-	suite.wg.Wait()
-}
-
-func TestAPISuite(t *testing.T) {
-	suite.Run(t, new(APISuite))
 }

internal/app/machined/pkg/controllers/secrets/kubelet_test.go

@@ -6,64 +6,35 @@
 package secrets_test
 
 import (
-	"context"
-	"log"
 	"net/url"
-	"sync"
 	"testing"
 	"time"
 
-	"github.com/cosi-project/runtime/pkg/controller/runtime"
 	"github.com/cosi-project/runtime/pkg/resource"
 	"github.com/cosi-project/runtime/pkg/state"
-	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
-	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
 	"github.com/stretchr/testify/suite"
 	"github.com/talos-systems/crypto/x509"
 	"github.com/talos-systems/go-retry/retry"
 
+	"github.com/talos-systems/talos/internal/app/machined/pkg/controllers/ctest"
 	secretsctrl "github.com/talos-systems/talos/internal/app/machined/pkg/controllers/secrets"
-	"github.com/talos-systems/talos/pkg/logging"
 	"github.com/talos-systems/talos/pkg/machinery/config/types/v1alpha1"
 	"github.com/talos-systems/talos/pkg/machinery/resources/config"
 	"github.com/talos-systems/talos/pkg/machinery/resources/secrets"
 )
 
+func TestKubeletSuite(t *testing.T) {
+	suite.Run(t, &KubeletSuite{
+		DefaultSuite: ctest.DefaultSuite{
+			AfterSetup: func(suite *ctest.DefaultSuite) {
+				suite.Require().NoError(suite.Runtime().RegisterController(&secretsctrl.KubeletController{}))
+			},
+		},
+	})
+}
+
 type KubeletSuite struct {
-	suite.Suite
+	ctest.DefaultSuite
-
-	state state.State
-
-	runtime *runtime.Runtime
-	wg      sync.WaitGroup
-
-	ctx       context.Context //nolint:containedctx
-	ctxCancel context.CancelFunc
-}
-
-func (suite *KubeletSuite) SetupTest() {
-	suite.ctx, suite.ctxCancel = context.WithTimeout(context.Background(), 3*time.Minute)
-
-	suite.state = state.WrapCore(namespaced.NewState(inmem.Build))
-
-	var err error
-
-	suite.runtime, err = runtime.NewRuntime(suite.state, logging.Wrap(log.Writer()))
-	suite.Require().NoError(err)
-
-	suite.Require().NoError(suite.runtime.RegisterController(&secretsctrl.KubeletController{}))
-
-	suite.startRuntime()
-}
-
-func (suite *KubeletSuite) startRuntime() {
-	suite.wg.Add(1)
-
-	go func() {
-		defer suite.wg.Done()
-
-		suite.Assert().NoError(suite.runtime.Run(suite.ctx))
-	}()
 }
 
 func (suite *KubeletSuite) TestReconcile() {
@@ -91,13 +62,13 @@ func (suite *KubeletSuite) TestReconcile() {
 		},
 	)
 
-	suite.Require().NoError(suite.state.Create(suite.ctx, cfg))
+	suite.Require().NoError(suite.State().Create(suite.Ctx(), cfg))
 
 	suite.Assert().NoError(
 		retry.Constant(10*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
 			func() error {
-				kubeletSecrets, err := suite.state.Get(
+				kubeletSecrets, err := ctest.Get[*secrets.Kubelet](
-					suite.ctx,
+					suite,
 					resource.NewMetadata(
 						secrets.NamespaceName,
 						secrets.KubeletType,
@@ -113,7 +84,7 @@ func (suite *KubeletSuite) TestReconcile() {
 					return err
 				}
 
-				spec := kubeletSecrets.(*secrets.Kubelet).TypedSpec()
+				spec := kubeletSecrets.TypedSpec()
 
 				suite.Assert().Equal("https://foo:6443", spec.Endpoint.String())
 				suite.Assert().Equal(k8sCA, spec.CA)
@@ -125,15 +96,3 @@ func (suite *KubeletSuite) TestReconcile() {
 		),
 	)
 }
-
-func (suite *KubeletSuite) TearDownTest() {
-	suite.T().Log("tear down")
-
-	suite.ctxCancel()
-
-	suite.wg.Wait()
-}
-
-func TestKubeletSuite(t *testing.T) {
-	suite.Run(t, new(KubeletSuite))
-}

internal/app/machined/pkg/controllers/secrets/kubernetes_cert_sans_test.go

@@ -6,67 +6,38 @@
 package secrets_test
 
 import (
-	"context"
 	"fmt"
-	"log"
 	"net"
 	"net/url"
 	"reflect"
-	"sync"
 	"testing"
 	"time"
 
-	"github.com/cosi-project/runtime/pkg/controller/runtime"
 	"github.com/cosi-project/runtime/pkg/resource"
 	"github.com/cosi-project/runtime/pkg/state"
-	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
-	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
 	"github.com/stretchr/testify/suite"
 	"github.com/talos-systems/go-retry/retry"
 	"inet.af/netaddr"
 
+	"github.com/talos-systems/talos/internal/app/machined/pkg/controllers/ctest"
 	secretsctrl "github.com/talos-systems/talos/internal/app/machined/pkg/controllers/secrets"
-	"github.com/talos-systems/talos/pkg/logging"
 	"github.com/talos-systems/talos/pkg/machinery/resources/k8s"
 	"github.com/talos-systems/talos/pkg/machinery/resources/network"
 	"github.com/talos-systems/talos/pkg/machinery/resources/secrets"
 )
 
 type KubernetesCertSANsSuite struct {
-	suite.Suite
+	ctest.DefaultSuite
-
-	state state.State
-
-	runtime *runtime.Runtime
-	wg      sync.WaitGroup
-
-	ctx       context.Context //nolint:containedctx
-	ctxCancel context.CancelFunc
 }
 
-func (suite *KubernetesCertSANsSuite) SetupTest() {
+func TestKubernetesCertSANsSuite(t *testing.T) {
-	suite.ctx, suite.ctxCancel = context.WithTimeout(context.Background(), 3*time.Minute)
+	suite.Run(t, &KubernetesCertSANsSuite{
-
+		DefaultSuite: ctest.DefaultSuite{
-	suite.state = state.WrapCore(namespaced.NewState(inmem.Build))
+			AfterSetup: func(suite *ctest.DefaultSuite) {
-
+				suite.Require().NoError(suite.Runtime().RegisterController(&secretsctrl.KubernetesCertSANsController{}))
-	var err error
+			},
-
+		},
-	suite.runtime, err = runtime.NewRuntime(suite.state, logging.Wrap(log.Writer()))
+	})
-	suite.Require().NoError(err)
-
-	suite.Require().NoError(suite.runtime.RegisterController(&secretsctrl.KubernetesCertSANsController{}))
-
-	suite.startRuntime()
-}
-
-func (suite *KubernetesCertSANsSuite) startRuntime() {
-	suite.wg.Add(1)
-
-	go func() {
-		defer suite.wg.Done()
-
-		suite.Assert().NoError(suite.runtime.Run(suite.ctx))
-	}()
 }
 
 func (suite *KubernetesCertSANsSuite) TestReconcile() {
@@ -82,12 +53,12 @@ func (suite *KubernetesCertSANsSuite) TestReconcile() {
 	rootSecrets.TypedSpec().LocalEndpoint, err = url.Parse("https://localhost:6443/")
 	suite.Require().NoError(err)
 
-	suite.Require().NoError(suite.state.Create(suite.ctx, rootSecrets))
+	suite.Require().NoError(suite.State().Create(suite.Ctx(), rootSecrets))
 
 	hostnameStatus := network.NewHostnameStatus(network.NamespaceName, network.HostnameID)
 	hostnameStatus.TypedSpec().Hostname = "foo"
 	hostnameStatus.TypedSpec().Domainname = "example.com"
-	suite.Require().NoError(suite.state.Create(suite.ctx, hostnameStatus))
+	suite.Require().NoError(suite.State().Create(suite.Ctx(), hostnameStatus))
 
 	nodeAddresses := network.NewNodeAddress(
 		network.NamespaceName,
@@ -97,15 +68,11 @@ func (suite *KubernetesCertSANsSuite) TestReconcile() {
 		netaddr.MustParseIPPrefix("10.2.1.3/24"),
 		netaddr.MustParseIPPrefix("172.16.0.1/32"),
 	}
-	suite.Require().NoError(suite.state.Create(suite.ctx, nodeAddresses))
+	suite.Require().NoError(suite.State().Create(suite.Ctx(), nodeAddresses))
 
-	suite.Assert().NoError(
+	suite.AssertWithin(10*time.Second, 100*time.Millisecond, func() error {
-		retry.Constant(10*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
+		certSANs, err := ctest.Get[*secrets.CertSAN](
-			func() error {
+			suite,
-				var certSANs resource.Resource
-
-				certSANs, err = suite.state.Get(
-					suite.ctx,
 			resource.NewMetadata(
 				secrets.NamespaceName,
 				secrets.CertSANType,
@@ -121,7 +88,7 @@ func (suite *KubernetesCertSANsSuite) TestReconcile() {
 			return err
 		}
 
-				spec := certSANs.(*secrets.CertSAN).TypedSpec()
+		spec := certSANs.TypedSpec()
 
 		suite.Assert().Equal(
 			[]string{
@@ -139,24 +106,19 @@ func (suite *KubernetesCertSANsSuite) TestReconcile() {
 		suite.Assert().Equal("[10.2.1.3 10.4.3.2 172.16.0.1]", fmt.Sprintf("%v", spec.IPs))
 
 		return nil
-			},
+	})
-		),
-	)
 
-	_, err = suite.state.UpdateWithConflicts(suite.ctx, rootSecrets.Metadata(), func(r resource.Resource) error {
+	ctest.UpdateWithConflicts(suite, rootSecrets, func(rootSecrets *secrets.KubernetesRoot) error {
-		r.(*secrets.KubernetesRoot).TypedSpec().Endpoint, err = url.Parse("https://some.other.url:6443/")
+		var err error
+		rootSecrets.TypedSpec().Endpoint, err = url.Parse("https://some.other.url:6443/")
 
 		return err
 	})
-	suite.Require().NoError(err)
 
-	suite.Assert().NoError(
+	suite.AssertWithin(10*time.Second, 100*time.Millisecond, func() error {
-		retry.Constant(10*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
-			func() error {
 		var certSANs resource.Resource
-
+		certSANs, err := ctest.Get[*secrets.CertSAN](
-				certSANs, err = suite.state.Get(
+			suite,
-					suite.ctx,
 			resource.NewMetadata(
 				secrets.NamespaceName,
 				secrets.CertSANType,
@@ -187,19 +149,5 @@ func (suite *KubernetesCertSANsSuite) TestReconcile() {
 		}
 
 		return nil
-			},
+	})
-		),
-	)
-}
-
-func (suite *KubernetesCertSANsSuite) TearDownTest() {
-	suite.T().Log("tear down")
-
-	suite.ctxCancel()
-
-	suite.wg.Wait()
-}
-
-func TestKubernetesCertSANsSuite(t *testing.T) {
-	suite.Run(t, new(KubernetesCertSANsSuite))
 }

internal/app/machined/pkg/controllers/secrets/kubernetes_test.go

@@ -6,28 +6,22 @@
 package secrets_test
 
 import (
-	"context"
 	stdlibx509 "crypto/x509"
 	"fmt"
-	"log"
 	"net"
 	"net/url"
-	"sync"
 	"testing"
 	"time"
 
-	"github.com/cosi-project/runtime/pkg/controller/runtime"
 	"github.com/cosi-project/runtime/pkg/resource"
 	"github.com/cosi-project/runtime/pkg/state"
-	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
-	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
 	"github.com/stretchr/testify/suite"
 	"github.com/talos-systems/crypto/x509"
 	"github.com/talos-systems/go-retry/retry"
 	"k8s.io/client-go/tools/clientcmd"
 
+	"github.com/talos-systems/talos/internal/app/machined/pkg/controllers/ctest"
 	secretsctrl "github.com/talos-systems/talos/internal/app/machined/pkg/controllers/secrets"
-	"github.com/talos-systems/talos/pkg/logging"
 	"github.com/talos-systems/talos/pkg/machinery/config/types/v1alpha1/machine"
 	"github.com/talos-systems/talos/pkg/machinery/constants"
 	"github.com/talos-systems/talos/pkg/machinery/resources/config"
@@ -36,41 +30,18 @@ import (
 	timeresource "github.com/talos-systems/talos/pkg/machinery/resources/time"
 )
 
+func TestKubernetesSuite(t *testing.T) {
+	suite.Run(t, &KubernetesSuite{
+		DefaultSuite: ctest.DefaultSuite{
+			AfterSetup: func(suite *ctest.DefaultSuite) {
+				suite.Require().NoError(suite.Runtime().RegisterController(&secretsctrl.KubernetesController{}))
+			},
+		},
+	})
+}
+
 type KubernetesSuite struct {
-	suite.Suite
+	ctest.DefaultSuite
-
-	state state.State
-
-	runtime *runtime.Runtime
-	wg      sync.WaitGroup
-
-	ctx       context.Context //nolint:containedctx
-	ctxCancel context.CancelFunc
-}
-
-func (suite *KubernetesSuite) SetupTest() {
-	suite.ctx, suite.ctxCancel = context.WithTimeout(context.Background(), 3*time.Minute)
-
-	suite.state = state.WrapCore(namespaced.NewState(inmem.Build))
-
-	var err error
-
-	suite.runtime, err = runtime.NewRuntime(suite.state, logging.Wrap(log.Writer()))
-	suite.Require().NoError(err)
-
-	suite.Require().NoError(suite.runtime.RegisterController(&secretsctrl.KubernetesController{}))
-
-	suite.startRuntime()
-}
-
-func (suite *KubernetesSuite) startRuntime() {
-	suite.wg.Add(1)
-
-	go func() {
-		defer suite.wg.Done()
-
-		suite.Assert().NoError(suite.runtime.Run(suite.ctx))
-	}()
 }
 
 func (suite *KubernetesSuite) TestReconcile() {
@@ -111,16 +82,16 @@ func (suite *KubernetesSuite) TestReconcile() {
 	rootSecrets.TypedSpec().CertSANs = []string{"example.com"}
 	rootSecrets.TypedSpec().APIServerIPs = []net.IP{net.ParseIP("10.4.3.2"), net.ParseIP("10.2.1.3")}
 	rootSecrets.TypedSpec().DNSDomain = "cluster.remote"
-	suite.Require().NoError(suite.state.Create(suite.ctx, rootSecrets))
+	suite.Require().NoError(suite.State().Create(suite.Ctx(), rootSecrets))
 
 	machineType := config.NewMachineType()
 	machineType.SetMachineType(machine.TypeControlPlane)
-	suite.Require().NoError(suite.state.Create(suite.ctx, machineType))
+	suite.Require().NoError(suite.State().Create(suite.Ctx(), machineType))
 
 	networkStatus := network.NewStatus(network.NamespaceName, network.StatusID)
 	networkStatus.TypedSpec().AddressReady = true
 	networkStatus.TypedSpec().HostnameReady = true
-	suite.Require().NoError(suite.state.Create(suite.ctx, networkStatus))
+	suite.Require().NoError(suite.State().Create(suite.Ctx(), networkStatus))
 
 	certSANs := secrets.NewCertSAN(secrets.NamespaceName, secrets.CertSANKubernetesID)
 	certSANs.TypedSpec().Append(
@@ -137,19 +108,17 @@ func (suite *KubernetesSuite) TestReconcile() {
 		"10.4.3.2",
 		"172.16.0.1",
 	)
-	suite.Require().NoError(suite.state.Create(suite.ctx, certSANs))
+	suite.Require().NoError(suite.State().Create(suite.Ctx(), certSANs))
 
 	timeSync := timeresource.NewStatus()
 	*timeSync.TypedSpec() = timeresource.StatusSpec{
 		Synced: true,
 	}
-	suite.Require().NoError(suite.state.Create(suite.ctx, timeSync))
+	suite.Require().NoError(suite.State().Create(suite.Ctx(), timeSync))
 
-	suite.Assert().NoError(
+	suite.AssertWithin(10*time.Second, 100*time.Millisecond, func() error {
-		retry.Constant(10*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
+		certs, err := ctest.Get[*secrets.Kubernetes](
-			func() error {
+			suite,
-				certs, err := suite.state.Get(
-					suite.ctx,
 			resource.NewMetadata(
 				secrets.NamespaceName,
 				secrets.KubernetesType,
@@ -165,7 +134,7 @@ func (suite *KubernetesSuite) TestReconcile() {
 			return err
 		}
 
-				kubernetesCerts := certs.(*secrets.Kubernetes).TypedSpec()
+		kubernetesCerts := certs.TypedSpec()
 
 		apiCert, err := kubernetesCerts.APIServer.GetCert()
 		suite.Require().NoError(err)
@@ -246,19 +215,5 @@ func (suite *KubernetesSuite) TestReconcile() {
 		}
 
 		return nil
-			},
+	})
-		),
-	)
-}
-
-func (suite *KubernetesSuite) TearDownTest() {
-	suite.T().Log("tear down")
-
-	suite.ctxCancel()
-
-	suite.wg.Wait()
-}
-
-func TestKubernetesSuite(t *testing.T) {
-	suite.Run(t, new(KubernetesSuite))
 }

internal/app/machined/pkg/controllers/siderolink/manager_test.go

@@ -7,17 +7,12 @@ package siderolink_test
 import (
 	"context"
 	"fmt"
-	"log"
 	"net"
-	"sync"
 	"testing"
 	"time"
 
-	"github.com/cosi-project/runtime/pkg/controller/runtime"
 	"github.com/cosi-project/runtime/pkg/resource"
 	"github.com/cosi-project/runtime/pkg/state"
-	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
-	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
 	"github.com/siderolabs/go-pointer"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/suite"
@@ -27,24 +22,38 @@ import (
 	"google.golang.org/grpc"
 	"inet.af/netaddr"
 
+	"github.com/talos-systems/talos/internal/app/machined/pkg/controllers/ctest"
 	siderolinkctrl "github.com/talos-systems/talos/internal/app/machined/pkg/controllers/siderolink"
-	"github.com/talos-systems/talos/pkg/logging"
 	"github.com/talos-systems/talos/pkg/machinery/constants"
 	"github.com/talos-systems/talos/pkg/machinery/nethelpers"
 	"github.com/talos-systems/talos/pkg/machinery/resources/network"
 )
 
+func TestManagerSuite(t *testing.T) {
+	var m ManagerSuite
+	m.AfterSetup = func(suite *ctest.DefaultSuite) {
+		lis, err := net.Listen("tcp", "localhost:0")
+		suite.Require().NoError(err)
+
+		m.s = grpc.NewServer()
+		pb.RegisterProvisionServiceServer(m.s, mockServer{})
+
+		go func() {
+			suite.Require().NoError(m.s.Serve(lis))
+		}()
+
+		cmdline := procfs.NewCmdline(fmt.Sprintf("%s=%s", constants.KernelParamSideroLink, lis.Addr().String()))
+
+		suite.Require().NoError(suite.Runtime().RegisterController(&siderolinkctrl.ManagerController{
+			Cmdline: cmdline,
+		}))
+	}
+
+	suite.Run(t, &m)
+}
+
 type ManagerSuite struct {
-	suite.Suite
+	ctest.DefaultSuite
-
-	state state.State
-
-	runtime *runtime.Runtime
-	wg      sync.WaitGroup
-
-	ctx       context.Context //nolint:containedctx
-	ctxCancel context.CancelFunc
-
 	s *grpc.Server
 }
 
@@ -68,62 +77,18 @@ func (srv mockServer) Provision(ctx context.Context, req *pb.ProvisionRequest) (
 	}, nil
 }
 
-func (suite *ManagerSuite) SetupTest() {
-	suite.ctx, suite.ctxCancel = context.WithTimeout(context.Background(), 3*time.Minute)
-
-	suite.state = state.WrapCore(namespaced.NewState(inmem.Build))
-
-	var err error
-
-	suite.runtime, err = runtime.NewRuntime(suite.state, logging.Wrap(log.Writer()))
-	suite.Require().NoError(err)
-
-	suite.startRuntime()
-
-	lis, err := net.Listen("tcp", "localhost:0")
-	suite.Require().NoError(err)
-
-	suite.s = grpc.NewServer()
-	pb.RegisterProvisionServiceServer(suite.s, mockServer{})
-
-	go func() {
-		suite.Require().NoError(suite.s.Serve(lis))
-	}()
-
-	cmdline := procfs.NewCmdline(fmt.Sprintf("%s=%s", constants.KernelParamSideroLink, lis.Addr().String()))
-
-	suite.Require().NoError(
-		suite.runtime.RegisterController(
-			&siderolinkctrl.ManagerController{
-				Cmdline: cmdline,
-			},
-		),
-	)
-}
-
-func (suite *ManagerSuite) startRuntime() {
-	suite.wg.Add(1)
-
-	go func() {
-		defer suite.wg.Done()
-
-		suite.Assert().NoError(suite.runtime.Run(suite.ctx))
-	}()
-}
-
 func (suite *ManagerSuite) TestReconcile() {
 	networkStatus := network.NewStatus(network.NamespaceName, network.StatusID)
 	networkStatus.TypedSpec().AddressReady = true
 
-	suite.Require().NoError(suite.state.Create(suite.ctx, networkStatus))
+	suite.Require().NoError(suite.State().Create(suite.Ctx(), networkStatus))
 
 	nodeAddress := netaddr.MustParseIPPrefix(mockNodeAddressPrefix)
 
-	suite.Assert().NoError(
+	suite.AssertWithin(10*time.Second, 100*time.Millisecond, func() error {
-		retry.Constant(5*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
+		addressResource, err := ctest.Get[*network.AddressSpec](
-			func() error {
+			suite,
-				addressResource, err := suite.state.Get(
+			resource.NewMetadata(
-					suite.ctx, resource.NewMetadata(
 				network.ConfigNamespaceName,
 				network.AddressSpecType,
 				network.LayeredID(
@@ -141,15 +106,16 @@ func (suite *ManagerSuite) TestReconcile() {
 			return err
 		}
 
-				address := addressResource.(*network.AddressSpec).TypedSpec()
+		address := addressResource.TypedSpec()
 
 		suite.Assert().Equal(nodeAddress, address.Address)
 		suite.Assert().Equal(network.ConfigOperator, address.ConfigLayer)
 		suite.Assert().Equal(nethelpers.FamilyInet6, address.Family)
 		suite.Assert().Equal(constants.SideroLinkName, address.LinkName)
 
-				linkResource, err := suite.state.Get(
+		linkResource, err := ctest.Get[*network.LinkSpec](
-					suite.ctx, resource.NewMetadata(
+			suite,
+			resource.NewMetadata(
 				network.ConfigNamespaceName,
 				network.LinkSpecType,
 				network.LayeredID(network.ConfigOperator, network.LinkID(constants.SideroLinkName)),
@@ -164,7 +130,7 @@ func (suite *ManagerSuite) TestReconcile() {
 			return err
 		}
 
-				link := linkResource.(*network.LinkSpec).TypedSpec()
+		link := linkResource.TypedSpec()
 
 		suite.Assert().Equal("wireguard", link.Kind)
 		suite.Assert().Equal(network.ConfigOperator, link.ConfigLayer)
@@ -186,23 +152,7 @@ func (suite *ManagerSuite) TestReconcile() {
 		)
 
 		return nil
-			},
+	})
-		),
-	)
-}
-
-func (suite *ManagerSuite) TearDownTest() {
-	suite.T().Log("tear down")
-
-	suite.s.Stop()
-
-	suite.ctxCancel()
-
-	suite.wg.Wait()
-}
-
-func TestManagerSuite(t *testing.T) {
-	suite.Run(t, new(ManagerSuite))
 }
 
 func TestParseJoinToken(t *testing.T) {