niklas/terdut-operator
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

Authenticate with a seeded operator key; fold escalation and switches into TerdutTeam

Browse Source 
Credentials: the TerdutServer controller generates <name>-operator-key in
the server's own namespace (owned by it) and hands it to the pods as
TERDUT_OPERATOR_KEY; the server creates its instance-scoped account from it
at every start. A replaced Secret rolls the pods. The bootstrap handshake,
the checkpoint Secret, per-team service accounts and credentials Secrets,
BootstrapStateLost and credentials.deletionPolicy are gone.

CRDs: TerdutServer, TerdutTeam and TerdutAlertSource. TerdutEscalationRule
and TerdutDeadmanSwitch become spec.escalation and spec.deadmanSwitches[]
on the team (matched by name, extras removed); team invites are removed.
A team is created under the identity <namespace>/<name> (external_id), so a
retry, a lost status or a deleted team heal by repeating the same call, and
a display name owned by another team is TeamNameTaken instead of an
adoption. The server resolves escalation usernames (UnknownUser condition).
OIDC claim names and trustEmail are spec fields.

Fixes: query values are URL-escaped; every delete treats 404 as success;
deleting a team no longer depends on allowedTeams consent; a switch or
integration deleted on the server is recreated; unnamed switches take the
CR's name.

Cleanup: scaffold e2e test, AGENTS.md, devcontainer, unused config/ pieces
and Client.Version() removed; DESIGN.md, README, ROADMAP and the demo
(run-demo.sh, manifests) rewritten for the new design. Secret RBAC stays
cluster-wide, now stated in DESIGN.md section 9.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN
This commit is contained in:
Niklas Ye
2026-10-09 14:56:22 +02:00
parent b0a431f2a4
commit e1103f2b7d
92 changed files with 2082 additions and 7561 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/tdclient/client_test.go
+30 -69
View File
@@ -7,85 +7,46 @@ import (
"testing"
)
func TestVersion(t *testing.T) {
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if r.URL.Path != "/api/version" {
t.Errorf("unexpected path %q", r.URL.Path)
}
// Unauthenticated per terdut-server's own router.go comment: no
// Authorization header should be required, and none is sent here.
w.Header().Set("Content-Type", "application/json")
w.Write([]byte(`{"version":"v0.20.0"}`)) //nolint:errcheck
}))
defer srv.Close()
got, err := New(srv.URL).Version(context.Background())
if err != nil {
t.Fatalf("Version() error = %v", err)
}
if got != "v0.20.0" {
t.Errorf("Version() = %q, want %q", got, "v0.20.0")
}
}
func TestVersionUnreachable(t *testing.T) {
// A closed server: connection refused, the same shape a bad
// spec.endpoint produces against a real cluster.
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
srv.Close()
if _, err := New(srv.URL).Version(context.Background()); err == nil {
t.Fatal("Version() error = nil, want a connection error")
}
}
func TestVersionErrorStatus(t *testing.T) {
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusInternalServerError)
w.Write([]byte(`{"error":"internal error"}`)) //nolint:errcheck
}))
defer srv.Close()
_, err := New(srv.URL).Version(context.Background())
if err == nil {
t.Fatal("Version() error = nil, want a StatusError")
}
var statusErr *StatusError
if !asStatusError(err, &statusErr) {
t.Fatalf("Version() error = %v (%T), want *StatusError", err, err)
}
if statusErr.Code != http.StatusInternalServerError {
t.Errorf("StatusError.Code = %d, want %d", statusErr.Code, http.StatusInternalServerError)
}
if statusErr.Message != "internal error" {
t.Errorf("StatusError.Message = %q, want %q", statusErr.Message, "internal error")
}
}
// asStatusError is errors.As without importing errors twice in a tiny test
// file — kept local since no other test here needs it.
func asStatusError(err error, target **StatusError) bool {
se, ok := err.(*StatusError)
if !ok {
return false
}
*target = se
return true
}
func TestWithTokenSetsAuthorizationHeader(t *testing.T) {
var gotAuth string
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
gotAuth = r.Header.Get("Authorization")
w.Write([]byte(`{"version":"v0.20.0"}`)) //nolint:errcheck
w.WriteHeader(http.StatusNoContent)
}))
defer srv.Close()
c := New(srv.URL).WithToken("tdsa_abc123")
if _, err := c.Version(context.Background()); err != nil {
t.Fatalf("Version() error = %v", err)
if err := c.DeleteTeam(context.Background(), 1); err != nil {
t.Fatalf("DeleteTeam() error = %v", err)
}
if want := "Bearer tdsa_abc123"; gotAuth != want {
t.Errorf("Authorization header = %q, want %q", gotAuth, want)
}
}
// Every delete is idempotent: the thing already being gone is success, any
// other failure is not.
func TestDeletesTreatNotFoundAsSuccess(t *testing.T) {
status := http.StatusNotFound
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(status)
}))
defer srv.Close()
c := New(srv.URL)
ctx := context.Background()
for name, call := range map[string]func() error{
"team": func() error { return c.DeleteTeam(ctx, 1) },
"switch": func() error { return c.DeleteDeadmanSwitch(ctx, 1, 2) },
"integration": func() error { return c.DeleteIntegration(ctx, 1, 2) },
} {
status = http.StatusNotFound
if err := call(); err != nil {
t.Errorf("%s: 404 should be success, got %v", name, err)
}
status = http.StatusConflict
if err := call(); err == nil {
t.Errorf("%s: 409 should be an error", name)
}
}
}