3 Commits

Author	SHA1	Message	Date
Niklas Ye	6a699d4341	Let TerdutServer customize its pod, and never manage its own ingress ... spec.pod (api/v1alpha1/terdutserver_types.go): annotations, nodeSelector, tolerations, affinity, topologySpreadConstraints, resources, pod and container securityContext, serviceAccountName, extraEnv/extraEnvFrom, extraVolumes/extraVolumeMounts, imagePullSecrets, and an optional disruptionBudget. All direct corev1 passthrough -- no wrapper types buy anything for any of these, matching how CloudNativePG and the Zalando postgres-operator both expose the same knobs, and matching this repo's own SweeperSpec precedent ("wrap only when a round-trip through a different type buys something"). affinity is pure user-supplied passthrough, not a toggle-plus-generated-default the way a multi-replica cluster operator's pod anti-affinity usually is: this operator never auto-generates one, since spec.replicas above 1 isn't a supported topology (the sweeper/notifier singleton constraint). Considered and declined for this round: priorityClassName, pod labels beyond annotations, and a HorizontalPodAutoscaler -- the last of those would directly contradict the singleton constraint above. disruptionBudget is the one field here that isn't a plain PodTemplateSpec knob: when set, the controller now reconciles a PodDisruptionBudget selecting the TerdutServer's own pods (new terdutserver_pdb.go); clearing it deletes any it previously created. New RBAC marker on poddisruptionbudgets to match. Driven by a public-release pass: looking past this project's own use case at what a mature, general-purpose operator CRD exposes here (researched against Zalando postgres-operator and CloudNativePG specifically), not just the fields this install happened to need. Separately, and found while answering a question about exposing TerdutServer through Istio instead of Gateway API: spec.networking's own doc comment quietly promised a Gateway API HTTPRoute this operator would build eventually ("a near-term follow-up, not deferred"). That promise is wrong for a public release -- an operator managing someone's ingress mechanism for them is a worse default than not touching it at all, and a surprise HTTPRoute appearing once that follow-up eventually landed would have been exactly backwards for an Istio (or plain-Ingress, or intentionally-unexposed) install. Made the non-goal explicit and permanent instead (DESIGN.md §1), removed the dead `gatewayListener` field it was the only consumer of (zero runtime call sites anywhere -- setting it already had no effect, so this is a schema cleanup, not a behavior change), and corrected ROADMAP.md's framing. hostname/servicePort stay: both are live (TERDUT_PUBLIC_URL, container/Service port), this operator just never acts on hostname for exposure. Added examples/networking (Gateway API HTTPRoute, Istio VirtualService) showing how to expose the plain ClusterIP Service the operator already creates -- outside the operator itself, as illustrations, not as something examples/demo applies automatically. No new terdut-server version requirement: both changes are CRD/controller- only, nothing about the API this operator's bootstrap flow depends on changed.	2026-10-02 18:50:38 +02:00
Niklas Ye	ae97d28444	Add wait-for-postgres init container to the generated Deployment ... This operator's own Deployment template crash-looped a few times against a from-scratch postgres-operator cluster still doing initdb and Patroni leader election -- exactly the gap examples/demo's own README just documented for it. terdut-server's ping-retry budget on startup (internal/db/db.go in that repo) is sized for a much shorter, different race (NetworkPolicy propagation, a few seconds), not genuine first-time cluster creation, so it exhausted and the process exited before ever binding its HTTP port -- a startupProbe cannot fix that, since the crash happens before there is anything to probe. Same root cause and same fix as charts/terdut-server's own deployment.yaml template as of that repo's v0.33.2. waitForPostgresContainer reuses dbEnv unchanged: both of resolveDatabaseEnv's two paths (DSN, postgresClusterRef) put TERDUT_DB_DSN first, so it's already exactly what pg_isready needs, and pg_isready needs no credentials, so dbEnv's optional PGPASSWORD riding along too is harmless rather than load-bearing. Covered by the existing envtest suite (asserts on Containers[0], the main container, unaffected by adding InitContainers) -- `make test` passes unchanged, 71.7% coverage on internal/controller. Updates examples/demo's own README, which no longer needs to warn about this.	2026-10-02 10:11:55 +02:00
Niklas Ye	8064876cb1	Stage 1: TerdutServer full lifecycle (Deployment, Service, both database ... paths, self-registration bootstrap) Replaces the bring-your-own-only Stage 1 (commit 1be7cf2) wholesale, per the redesign in the previous two commits: the operator creates every server it manages, so self-registration (DESIGN.md §6) is the only bootstrap path, and Deployment/Service/database management builds together with it (ROADMAP.md Stage 1) rather than behind a separate later stage. Grounded in terdut-server's actual chart (charts/terdut-server/templates/ deployment.yaml, values.yaml), not reconstructed from DESIGN.md's illustrative YAML alone -- env var names, the password-via-PGPASSWORD convention, the Recreate deployment strategy, /healthz probes, and the TERDUT_OPERATOR_MODE=true decision (always on here, unlike the chart's default-off: every write this operator's own future controllers make goes through a service account already) all match that source exactly. - api/v1alpha1: full TerdutServerSpec (image, replicas, networking, database, sweeper, deadman, notify, oidc, passwordLogin, allowedTeams). spec.database is a oneOf (dsn xor postgresClusterRef) via CEL XValidation. No spec.credentialsSecretRef -- removed entirely in the prior redesign commit, not carried forward. - internal/controller: - terdutserver_deployment.go: Deployment + Service via CreateOrUpdate, owned (OwnerReference), env built field-for-field against the chart. - terdutserver_database.go: both §8 paths. The Zalando path resolves the postgresql.acid.zalan.do CR by convention (database/role both "terdut", matching every DESIGN.md example) and only ever confirms its generated credentials Secret exists -- never reads the value, same "wire a secretKeyRef, don't read it" posture the DSN path takes. classifyClusterGetError is its own function specifically so the CRD-not-installed case (meta.IsNoMatchError) is unit-testable without a real client. - terdutserver_bootstrap.go: self-registration, checkpointed against both real crash windows (DESIGN.md §6 point 1) -- an admin-key checkpoint Secret, and adopt-via-GET+mint-new-key on a 409 from creating the service account. BootstrapStateLost is its own error type so Reconcile can route it to a condition instead of an infinite retry. - terdutserver_controller.go: ties it together -- finalizer add, DB resolution, Deployment/Service reconcile, wait for a ready replica, bootstrap, Ready/Bootstrapped/DatabaseReady conditions. Finalizer on delete only removes the generated Secrets: terdut-server's API can't delete a user or service account, only revoke keys, so there's nothing server-side to undo. - internal/tdclient: added Bootstrap, CreateInstanceServiceAccount, GetServiceAccountByName, CreateServiceAccountKey, matching terdut-server's real handlers' request/response shapes (internal/api/ users.go, service_accounts.go in that repo) field-for-field. - Tests: envtest suite covering the full DSN-path lifecycle end to end (finalizer -> Deployment/Service -> simulated readiness -> real bootstrap against an httptest.Server fake), the adopt-on-409 recovery path, BootstrapStateLost, both Zalando outcomes (cluster not found; cluster + Secret found -> real DSN -> Ready), and deletion. A minimal test-only stub of the Zalando CRD (internal/controller/testdata) lets envtest create fixture objects without a real postgres-operator installed. 74.0%/44.7% coverage, 0 lint issues. - Two things scoped down from §8's full ambition, called out in code and ROADMAP.md rather than silently dropped: no live watch on the Zalando-generated Secret for rotation (periodic resync notices eventually, not immediately), no Gateway API HTTPRoute creation from spec.networking (would add a new dependency; nothing about proving bootstrap works depends on external ingress existing). Both are near-term follow-ups. Verified locally: make fmt lint test build all clean.	2026-10-01 09:11:56 +02:00