device-health-oracle: fix ClickHouse integration test authentication

Use explicit credentials and the testcontainers ClickHouse module options
(WithUsername, WithPassword, WithDatabase) to match the pattern used by
other integration tests in the repo. Switch to 23.3.8.21-alpine image
which is consistent with the rest of the codebase. Add CHANGELOG entry.

Author: nikw9944

CHANGELOG.md

@@ -8,6 +8,8 @@ All notable changes to this project will be documented in this file.
 
 ### Changes
 
+- Controlplane
+  - Add `controller_success` activation criterion to device-health-oracle that verifies devices have consistent controller call coverage over a configurable burn-in period by querying ClickHouse
 - Client
   - Rank devices and tunnel endpoints by minimum observed latency (`min_latency_ns`) instead of average when selecting a connection target, preferring paths with the best achievable round-trip time
 - Tools

controlplane/device-health-oracle/internal/worker/clickhouse_test.go

@@ -11,47 +11,55 @@ import (
 	"github.com/ClickHouse/clickhouse-go/v2"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"github.com/testcontainers/testcontainers-go"
+)
+
+const (
+	chTestUser     = "default"
+	chTestPassword = "testpass"
+	chTestDatabase = "default"
 )
 
 func setupClickHouseContainer(t *testing.T) (clickhouse.Conn, func()) {
 	t.Helper()
 	ctx := context.Background()
 
 	container, err := chmodule.Run(ctx,
-		"clickhouse/clickhouse-server:24.3",
+		"clickhouse/clickhouse-server:23.3.8.21-alpine",
+		chmodule.WithUsername(chTestUser),
+		chmodule.WithPassword(chTestPassword),
+		chmodule.WithDatabase(chTestDatabase),
 	)
 	require.NoError(t, err)
+	testcontainers.CleanupContainer(t, container)
 
-	host, err := container.Host(ctx)
-	require.NoError(t, err)
-
-	port, err := container.MappedPort(ctx, "9000/tcp")
+	connStr, err := container.ConnectionHost(ctx)
 	require.NoError(t, err)
 
 	conn, err := clickhouse.Open(&clickhouse.Options{
-		Addr: []string{fmt.Sprintf("%s:%s", host, port.Port())},
+		Addr: []string{connStr},
 		Auth: clickhouse.Auth{
-			Database: "default",
-			Username: "default",
+			Database: chTestDatabase,
+			Username: chTestUser,
+			Password: chTestPassword,
 		},
 	})
 	require.NoError(t, err)
 	require.NoError(t, conn.Ping(ctx))
 
 	// Create the table
-	err = conn.Exec(ctx, `
-		CREATE TABLE IF NOT EXISTS "default".controller_grpc_getconfig_success (
+	err = conn.Exec(ctx, fmt.Sprintf(`
+		CREATE TABLE IF NOT EXISTS "%s".controller_grpc_getconfig_success (
 			timestamp DateTime64(3),
 			device_pubkey LowCardinality(String)
 		) ENGINE = MergeTree
 		PARTITION BY toYYYYMM(timestamp)
 		ORDER BY (timestamp, device_pubkey)
-	`)
+	`, chTestDatabase))
 	require.NoError(t, err)
 
 	cleanup := func() {
 		_ = conn.Close()
-		_ = container.Terminate(ctx)
 	}
 
 	return conn, cleanup
@@ -66,7 +74,7 @@ func TestClickHouseClient_ControllerCallCoverage(t *testing.T) {
 	defer cleanup()
 
 	ctx := context.Background()
-	client := &ClickHouseClient{conn: conn, db: "default"}
+	client := &ClickHouseClient{conn: conn, db: chTestDatabase}
 
 	devicePubkey := "TestDevice123"
 	now := time.Now().Truncate(time.Second)
@@ -75,7 +83,7 @@ func TestClickHouseClient_ControllerCallCoverage(t *testing.T) {
 	for i := 0; i < 10; i++ {
 		ts := now.Add(-time.Duration(10-i) * time.Minute)
 		err := conn.Exec(ctx, fmt.Sprintf(
-			`INSERT INTO "default".controller_grpc_getconfig_success (timestamp, device_pubkey) VALUES (?, ?)`,
+			`INSERT INTO "%s".controller_grpc_getconfig_success (timestamp, device_pubkey) VALUES (?, ?)`, chTestDatabase,
 		), ts, devicePubkey)
 		require.NoError(t, err)
 	}
@@ -123,7 +131,7 @@ func TestClickHouseClient_ControllerCallCoverage_WithGaps(t *testing.T) {
 	defer cleanup()
 
 	ctx := context.Background()
-	client := &ClickHouseClient{conn: conn, db: "default"}
+	client := &ClickHouseClient{conn: conn, db: chTestDatabase}
 
 	devicePubkey := "GappyDevice789"
 	now := time.Now().Truncate(time.Second)
@@ -133,7 +141,7 @@ func TestClickHouseClient_ControllerCallCoverage_WithGaps(t *testing.T) {
 	for _, m := range gapMinutes {
 		ts := now.Add(-time.Duration(m) * time.Minute)
 		err := conn.Exec(ctx, fmt.Sprintf(
-			`INSERT INTO "default".controller_grpc_getconfig_success (timestamp, device_pubkey) VALUES (?, ?)`,
+			`INSERT INTO "%s".controller_grpc_getconfig_success (timestamp, device_pubkey) VALUES (?, ?)`, chTestDatabase,
 		), ts, devicePubkey)
 		require.NoError(t, err)
 	}