Passed cilium connectivity tests as a worker node

kernel-build/ensure-kconfig.sh

@@ -0,0 +1,127 @@
+#!/bin/sh
+set -eu
+
+CONFIG_FILE="${1:-}"
+EXPECTED_FILE="${2:-}"
+
+if [ -z "$CONFIG_FILE" ] || [ -z "$EXPECTED_FILE" ]; then
+    echo "usage: $0 <resolved-.config> <expected-fragment.config>" >&2
+    exit 2
+fi
+
+if [ ! -f "$CONFIG_FILE" ]; then
+    echo "error: config file not found: $CONFIG_FILE" >&2
+    exit 2
+fi
+
+if [ ! -f "$EXPECTED_FILE" ]; then
+    echo "error: expected config fragment not found: $EXPECTED_FILE" >&2
+    exit 2
+fi
+
+failed=0
+
+normalize_expected_line() {
+    line="$1"
+
+    case "$line" in
+        CONFIG_*=y|CONFIG_*=m)
+            echo "$line"
+            ;;
+        CONFIG_*=n)
+            sym="${line%%=*}"
+            echo "# $sym is not set"
+            ;;
+        "# CONFIG_"*" is not set")
+            echo "$line"
+            ;;
+        CONFIG_*=*)
+            echo "$line"
+            ;;
+        *)
+            return 1
+            ;;
+    esac
+}
+
+is_disabled_expected() {
+    expected="$1"
+
+    case "$expected" in
+        "# CONFIG_"*" is not set")
+            return 0
+            ;;
+        *)
+            return 1
+            ;;
+    esac
+}
+
+symbol_from_expected() {
+    expected="$1"
+
+    case "$expected" in
+        CONFIG_*=*)
+            echo "${expected%%=*}"
+            ;;
+        "# CONFIG_"*" is not set")
+            printf '%s\n' "$expected" | sed 's/^# \(CONFIG_[^ ]*\) is not set$/\1/'
+            ;;
+        *)
+            return 1
+            ;;
+    esac
+}
+
+check_expected_line() {
+    expected="$1"
+    sym="$(symbol_from_expected "$expected")"
+
+    actual="$(grep -E "^${sym}=|^# ${sym} is not set$" "$CONFIG_FILE" || true)"
+
+    if [ "$actual" = "$expected" ]; then
+        return 0
+    fi
+
+    # For disabled symbols, absence from the final .config is acceptable.
+    # Some Kconfig symbols do not exist on this arch/tree, and missing still means "not enabled".
+    if is_disabled_expected "$expected" && [ -z "$actual" ]; then
+        return 0
+    fi
+
+    echo "kconfig mismatch: $sym" >&2
+    echo "  expected: $expected" >&2
+    if [ -n "$actual" ]; then
+        echo "  actual:   $actual" >&2
+    else
+        echo "  actual:   <missing>" >&2
+    fi
+
+    failed=1
+}
+
+while IFS= read -r raw || [ -n "$raw" ]; do
+    # Strip leading/trailing whitespace.
+    line="$(printf '%s\n' "$raw" | sed 's/^[[:space:]]*//; s/[[:space:]]*$//')"
+
+    # Ignore blanks.
+    [ -z "$line" ] && continue
+
+    # Ignore normal comments, but keep '# CONFIG_FOO is not set'.
+    case "$line" in
+        "# CONFIG_"*" is not set") ;;
+        "#"*) continue ;;
+    esac
+
+    expected="$(normalize_expected_line "$line" || true)"
+    [ -z "${expected:-}" ] && continue
+
+    check_expected_line "$expected"
+done < "$EXPECTED_FILE"
+
+if [ "$failed" -ne 0 ]; then
+    echo "error: resolved kernel config does not satisfy $EXPECTED_FILE" >&2
+    exit 1
+fi
+
+echo "kernel config satisfies $EXPECTED_FILE"