11 Commits

Author	SHA1	Message	Date
Niklas Ye	4007f54279	Default TerdutServer.spec.replicas to 2 and switch to RollingUpdate ... Mirrors charts/terdut-server's own deployment.yaml change: v0.36.0 put the sweeper, the notifier and the migration runner each behind a Postgres advisory lock, and gave incident creation its own conflict resolution, so the Recreate strategy and replicas-stays-at-1 guidance this controller carried (explicitly tracking that chart's comment) are no longer load-bearing. spec.replicas' +kubebuilder:default moves 1 -> 2 (config/crd/bases and the chart's CRD template regenerated via controller-gen and kubebuilder's helm plugin respectively, then hand-verified identical to the generator's own output rather than trusting a bulk regen -- the plugin's --output-dir charts writes a fresh charts/chart scaffold rather than updating charts/terdut-operator in place, so only the diff was taken, not the whole tree). terdutserver_deployment.go's same-value fallback (reachable only for a TerdutServer stored before this default existed) moves with it, and its Strategy changes from Recreate to RollingUpdate with no explicit maxUnavailable/maxSurge -- the 25%/25% default rounds to 0/1 at replicas: 2, already zero-downtime. DESIGN.md's three places asserting multi-replica isn't a supported topology (the illustrative spec.replicas YAML, spec.pod.affinity's rationale, and the HPA deferred-feature note) are corrected to match; the HPA note now gives its own standing reason (no scaling metric or bounds decided yet) rather than a contradiction that no longer holds. The chart's optional terdutServer.replicas sample value moves 1 -> 2 alongside it. image.tag must be v0.36.0 or newer for any of this to hold -- stated in both the CRD field's doc comment and the chart value's comment, not enforced in code, same stance the chart takes on every other version-coupled assumption. Co-authored-by: Claude <noreply@anthropic.com>	2026-10-03 12:35:18 +02:00
Niklas Ye	a0ea13955e	TerdutTeam: mint and surface a real invite link (spec.invite) ... The actual fix for the human-onboarding gap niklas/terdut-server#23 found -- not a terdut-server change at all. A team-scoped credential is already owner-equivalent for POST/GET/DELETE /api/teams/{teamID}/invites (requireTeamOwner's synthetic-membership mechanism, ratified not accidental per that repo's SERVICE-ACCOUNTS.md), and invite redemption bypasses signup_mode entirely -- this TerdutTeam controller just never grew a feature to use either fact. New spec.invite{enabled, role (member|owner, default member), maxUses (1-100, default 1)} and status.inviteSecretRef. The Secret lives in the TerdutTeam's OWN namespace, not the operator's: unlike status.credentialsSecretRef (a durable, high-privilege credential, kept operator-side per DESIGN.md §6), an invite is bounded and limited-use, meant for this namespace's own human operators to read and hand out -- same precedent as TerdutAlertSource's status.webhookURLSecretRef, same- namespace and OwnerReference'd so deleting the TerdutTeam garbage-collects it automatically. internal/controller/terdutteam_invite.go: mints on first spec.invite.enabled, refreshes a day ahead of terdut-server's fixed 7-day TTL (reading the Secret's own stored expiresAt, no extra server round-trip per reconcile), revokes server-side and deletes the Secret when flipped back to false. A lost invite Secret is silently re-minted rather than treated as unrecoverable the way TerdutAlertSource's webhook key is -- nothing external holds a durable dependency on one specific invite link staying stable, it's read once by one human and handed out. New tdclient.Invite/CreateInvite/RevokeInvite. New envtest coverage: mint into the team's own namespace, refresh-before-expiry, revoke-on-disable (internal/controller/terdutteam_controller_test.go's new "spec.invite" Describe block), plus the fake server growing invite support (terdutserver_controller_test.go) -- its handleTeamSubPath dispatcher was split further (deadman switches into their own handleDeadmanSubPath, matching the existing handleIntegrationSubPath precedent) to stay under golangci-lint's gocyclo threshold with the new route added. examples/demo updated to prove this end to end: 02-team-platform.yaml turns on spec.invite; run-demo.sh's bootstrap_login/join_demo_teams (the psql signup_mode flip + a direct team_members INSERT) are replaced by redeem_platform_invite (reads status.inviteSecretRef, a real POST /api/signup with the invite token) and join_payments_team (POST /api/teams/{teamID}/members using Payments' own credential and alice's user id resolved via GET /api/users, deliberately not given its own spec.invite, so the demo shows both onboarding paths this feature unlocks) -- zero kubectl exec/psql calls remain anywhere in the script. README.md's "First login" section rewritten to match; it no longer documents the admin-token curl call that 403s against current terdut-server (niklas/terdut-server#23). Depends on niklas/terdut-server#24 (the callerMayManageServiceAccount fix for terdut-operator#3) being released before this is deployed for real -- not required to build or test this change itself, since the envtest fake never modeled that authorization gap to begin with.	2026-10-02 22:04:56 +02:00
Niklas Ye	6a699d4341	Let TerdutServer customize its pod, and never manage its own ingress ... spec.pod (api/v1alpha1/terdutserver_types.go): annotations, nodeSelector, tolerations, affinity, topologySpreadConstraints, resources, pod and container securityContext, serviceAccountName, extraEnv/extraEnvFrom, extraVolumes/extraVolumeMounts, imagePullSecrets, and an optional disruptionBudget. All direct corev1 passthrough -- no wrapper types buy anything for any of these, matching how CloudNativePG and the Zalando postgres-operator both expose the same knobs, and matching this repo's own SweeperSpec precedent ("wrap only when a round-trip through a different type buys something"). affinity is pure user-supplied passthrough, not a toggle-plus-generated-default the way a multi-replica cluster operator's pod anti-affinity usually is: this operator never auto-generates one, since spec.replicas above 1 isn't a supported topology (the sweeper/notifier singleton constraint). Considered and declined for this round: priorityClassName, pod labels beyond annotations, and a HorizontalPodAutoscaler -- the last of those would directly contradict the singleton constraint above. disruptionBudget is the one field here that isn't a plain PodTemplateSpec knob: when set, the controller now reconciles a PodDisruptionBudget selecting the TerdutServer's own pods (new terdutserver_pdb.go); clearing it deletes any it previously created. New RBAC marker on poddisruptionbudgets to match. Driven by a public-release pass: looking past this project's own use case at what a mature, general-purpose operator CRD exposes here (researched against Zalando postgres-operator and CloudNativePG specifically), not just the fields this install happened to need. Separately, and found while answering a question about exposing TerdutServer through Istio instead of Gateway API: spec.networking's own doc comment quietly promised a Gateway API HTTPRoute this operator would build eventually ("a near-term follow-up, not deferred"). That promise is wrong for a public release -- an operator managing someone's ingress mechanism for them is a worse default than not touching it at all, and a surprise HTTPRoute appearing once that follow-up eventually landed would have been exactly backwards for an Istio (or plain-Ingress, or intentionally-unexposed) install. Made the non-goal explicit and permanent instead (DESIGN.md §1), removed the dead `gatewayListener` field it was the only consumer of (zero runtime call sites anywhere -- setting it already had no effect, so this is a schema cleanup, not a behavior change), and corrected ROADMAP.md's framing. hostname/servicePort stay: both are live (TERDUT_PUBLIC_URL, container/Service port), this operator just never acts on hostname for exposure. Added examples/networking (Gateway API HTTPRoute, Istio VirtualService) showing how to expose the plain ClusterIP Service the operator already creates -- outside the operator itself, as illustrations, not as something examples/demo applies automatically. No new terdut-server version requirement: both changes are CRD/controller- only, nothing about the API this operator's bootstrap flow depends on changed.	2026-10-02 18:50:38 +02:00
Niklas Ye	b4ccdb09d5	Stage 5: installer chart + release infra, kind e2e pass through the chart ... Chart (charts/terdut-operator) generated via kubebuilder's own helm/v2-alpha plugin from config/'s kustomize output -- CRDs + manager Deployment/RBAC come from the same markers every other stage already generates, one source of truth. Hand-added on top: the optional terdutServer values block (DESIGN.md §10's "helm install and get a server" path, off by default) and the release-skill plumbing -- .release.conf, release-vars/helm-lint/push/ helm-package/helm-push/release Makefile targets, .gitea/workflows/release.yaml (test -> image/chart -> scan-image) -- mirroring terdut-server's own shape (registry/namespace convention, multi-arch buildx push, trivy/govulncheck/ gitleaks scans). ci.yaml gains security and chart jobs to match. Two real issues caught while wiring this, fixed before either shipped: - Dockerfile's builder stage didn't pin --platform=$BUILDPLATFORM, which would have made a multi-arch release build fail outright on this org's runners (no binfmt registration) -- same fix terdut-server's own Dockerfile already needed for the same reason. - govulncheck found one real, reachable finding: google.golang.org/grpc v1.82.1 (transitive via controller-runtime's otel exporter), fixed by bumping to v1.83.1. Full golden-path kind e2e pass, this time through `helm install` rather than raw kustomize: TerdutServer (real terdut-server v0.33.0 image) -> TerdutTeam -> one of each child kind, each confirmed Ready and then independently confirmed against terdut-server's own API from inside the cluster (not just the operator's own status). Deleted every CR in reverse order and confirmed server-side cleanup the same independent way for all three child kinds, the team, and the server. No new bugs found -- Stage 1's own kind pass already caught what a real cluster catches that envtest can't. Also dropped the kubebuilder helm plugin's default .github/workflows/ scaffold, same as Stage 0 already did for the main scaffold: this org runs on Gitea, not GitHub. Not done here, deliberately: an actual tagged release. release-preflight found no terdut-operator/ entry under Ryuvia/charts yet to bump -- that one-time wrapper bootstrap is a decision about deploying this operator for real, not a side effect of finishing this stage. make fmt lint test helm-lint build all clean.	2026-10-01 14:47:10 +02:00
Niklas Ye	048f4448c4	Stage 4: TerdutAlertSource ... Covers webhook Secret generation/ownership (DESIGN.md §4.5, §7), the WebhookSecretLost fail-closed condition, and the kind-change delete-and-recreate rotation path. Idempotent-create here is deliberately neither adopt-on-409 (Team/service-account) nor list-and-match-by-name (TerdutDeadmanSwitch): terdut-server shows the webhook key exactly once, at creation, and never again, so no server-side lookup could ever recover it after a crash. Instead the generated webhook Secret itself -- written immediately after the POST, before status is ever touched -- is this CR's only durable record that a create already succeeded; found with status.integrationID still unset on a later reconcile, it's read back directly rather than POSTing a second, orphaned integration. Found missing with status.integrationID *set* instead, that's the already-designed WebhookSecretLost case: fail closed, not self-healed, since the key is genuinely gone and recreating it would rotate a live webhook URL with no spec change to explain why. Renaming (PATCH) never touches the key, so it's applied unconditionally every reconcile, same as the escalation policy's whole-policy PUT. A spec.kind change is the one case with no in-place update verb at all: DELETE the old integration, delete the stale webhook Secret, then run the same create path fresh -- fires a Warning event since this breaks whatever still sends to the old URL. Also: fakeTerdutServer grows POST/PATCH/DELETE .../integrations routes behind a new handleIntegrationSubPath, split out of handleTeamSubPath to stay under gocyclo's threshold; three goconst-flagged test literals ("does-not-exist", "unready") and one unparam-flagged test helper parameter (bootstrapReadyTerdutServer's always-"default" namespace) get shared/removed now that a fourth same-shaped caller made the repetition concrete enough for the linter to flag. DESIGN.md §13 gains one honest gap found while grounding this stage, not introduced by it: no child CRD specially detects a mid-life teamRef change; all three always resolve spec.teamRef fresh and trust the already-stored server-side id remains valid there. make fmt lint test build all clean; internal/controller envtest coverage holds at 71.6%.	2026-10-01 14:13:19 +02:00
Niklas Ye	fb9e6a38dc	Stage 3: TerdutEscalationRule + TerdutDeadmanSwitch ... Both child CRDs resolve their own teamRef -> TerdutTeam.status via the new shared resolveTeamAndClient helper (childref.go), never chaining up to TerdutServer (DESIGN.md §5) -- TerdutTeam.status.serverEndpoint, added in this same stage, is what makes that literally true. TerdutEscalationRule: one PUT /api/teams/{id}/escalation per reconcile (an upsert server-side, confirmed against source), resolving each "user" target's username to a user_id via GET /api/users first and reporting Ready: False, reason: UnknownUser if it doesn't resolve. No DELETE exists for this resource, so its delete path PUTs an empty policy as the closest available undo. TerdutDeadmanSwitch: real create/update-in-place/delete, using terdut-server v0.33.0's PUT (added specifically for this operator). No unique-name constraint server-side, so idempotent-create here is GET-list-and-match-by-name rather than adopt-on-409. Extends tdclient with User/GetUserByUsername, the escalation request types + SetEscalation, and DeadmanSwitch + its CRUD methods. Also folds ConditionTeamReady into the single shared ConditionReady constant, since both were literally "Ready" and Stage 3 would otherwise have needed a third same-valued constant. internal/controller/terdutserver_controller_test.go's fakeTerdutServer grows GET /api/users, PUT .../escalation, and the full dead man's switch collection/item routes, replacing the old parseTeamPath/handleTeamByID pair with a more general parseTeamSubPath/handleTeamSubPath dispatcher that still covers every existing Stage 1/2 route unchanged. make fmt lint test build all clean; envtest coverage for internal/controller: 50.5% -> 71.7%.	2026-10-01 13:50:08 +02:00
Niklas Ye	c9c52af2f7	Stage 2: TerdutTeam (create, mint team credential, rename/oidc-groups, delete) ... Implements ROADMAP.md Stage 2 against terdut-server's now-real GET /api/teams?name= (TEAM-LOOKUP.md, landed in terdut-server just before this commit) -- without it, the adopt-on-409 pattern this controller depends on for team creation had no server-side lookup to call, the same gap TerdutServer's own bootstrap flow hit and fixed in Stage 1. - api/v1alpha1: TerdutTeamSpec per DESIGN.md §4.2 (serverRef, displayName, oidc). status.credentialsSecretRef drops namespace for key, matching the fix already applied to TerdutServer's. - internal/controller: - terdutteam_controller.go: resolves serverRef (same-namespace by default; cross-namespace gated by the target TerdutServer's spec.allowedTeams, DESIGN.md §4.6), waits for that TerdutServer to be Bootstrapped (no cross-controller RPC -- reads its status.credentialsSecretRef directly, DESIGN.md §5), creates the team and mints its team-scoped credential using the TerdutServer's instance-scoped one, then applies rename/oidc-groups with the team-scoped credential every reconcile (both are idempotent PUTs of the whole resource -- applied unconditionally rather than diffed against a stored last-applied value, same "cheap because it's small" reasoning §5 already gives the escalation policy's whole-policy PUT). - terdutteam_allowedteams.go: the §4.6 consent check in isolation from any client, unit-tested directly against hand-built inputs. - terdutteam_bootstrap.go: create-or-adopt-on-409 for the team itself (via TEAM-LOOKUP.md) and for its team-scoped service account (via the same GET-by-name+mint-new-key pattern Stage 1 already uses for the instance account). - secrets.go: extracted TerdutServer's write/read-credential-Secret helpers into free functions, now shared by both controllers rather than duplicated. - Finalizer deletes the team server-side (owner-gated, needs the team-scoped credential -- confirmed against source that an instance-scoped one does not satisfy requireTeamOwner, same finding as TEAM-LOOKUP.md's) and cleans up its credentials Secret. A team created but never fully reconciled to Ready (no team-scoped credential ever minted) is left orphaned server-side on delete -- a known, documented limitation (terdut-server has no delete path that doesn't require owner-equivalent access), not a silent gap. - internal/tdclient: Team type, CreateTeam, GetTeamByName, RenameTeam, DeleteTeam, SetTeamOIDCGroups, CreateTeamServiceAccount -- matching terdut-server's real handlers' shapes field-for-field, same as Stage 1's client additions. - Tests: envtest covering the happy path, both not-ready reasons (ServerRefNotFound, WaitingForServer), cross-namespace allow/deny (default-closed and explicit All), both adopt-on-409 paths (team itself, team-scoped service account), and deletion. Extended the shared fakeTerdutServer (Stage 1) with team endpoints rather than writing a second, separately-drifting fake. 72.8%/30.6% coverage, 0 lint issues. Verified locally: make fmt lint test build all clean.	2026-10-01 11:09:40 +02:00
Niklas Ye	1c45b7e80b	Stage 1: fix two real bugs the kind e2e pass caught, neither envtest could ... Ran a full kind end-to-end pass per ROADMAP.md's open item: real kind cluster, real disposable Postgres, the real terdut-server v0.33.0 image, the operator built into a real image and deployed as a real Pod (not `go run` against the cluster -- that was tried first and correctly failed on cluster DNS not resolving from outside the cluster network, which is expected, not a bug). Result: TerdutServer went Ready, the generated credentials Secret held a real tdsa_-prefixed service-account key, and that key successfully authenticated and exercised its real intended capability against the actual server (GET/POST /api/teams -> 200/201) -- confirmed from terdut-server's own access log, not just our side. Stage 1's actual goal (ROADMAP.md) is proven, not just asserted. Two real bugs surfaced that no envtest suite could have caught, since envtest's client bypasses RBAC entirely: - .dockerignore's `!**/*.go` doesn't work under podman (the scaffold's own comment already named this exact gotcha, buildah/containers#6417, and pointed at the fix) -- `docker build` was silently building from an empty source tree ("package cmd/main.go is not in std") until this was pinned down. Fixed by re-including cmd/api/internal by name, as that comment suggested doing if this happened. - The controller had no RBAC for events.k8s.io (the new events API GetEventRecorder uses, unlike the deprecated GetEventRecorderFor) -- every Event emission failed server-side ("Server rejected event (will not retry!)"), silently, since event-recording failure doesn't fail reconciliation. Reconciliation itself was never affected, but DESIGN.md §12's observability goal (every externally-visible action emits an Event) silently wasn't being met in any real deployment. Added +kubebuilder:rbac for events.k8s.io/events (create, patch); confirmed fixed by restarting the operator and checking `kubectl describe terdutserver` actually shows the Event afterward, not just that the log line stopped. Also noted, not fixed here (a different repo's bug): terdut-server's own GET /api/me 500s for a service-account caller rather than a clean 4xx -- that endpoint assumes a human user in context. Worth a terdut-server issue, not an operator concern.	2026-10-01 10:15:26 +02:00
Niklas Ye	8064876cb1	Stage 1: TerdutServer full lifecycle (Deployment, Service, both database ... paths, self-registration bootstrap) Replaces the bring-your-own-only Stage 1 (commit 1be7cf2) wholesale, per the redesign in the previous two commits: the operator creates every server it manages, so self-registration (DESIGN.md §6) is the only bootstrap path, and Deployment/Service/database management builds together with it (ROADMAP.md Stage 1) rather than behind a separate later stage. Grounded in terdut-server's actual chart (charts/terdut-server/templates/ deployment.yaml, values.yaml), not reconstructed from DESIGN.md's illustrative YAML alone -- env var names, the password-via-PGPASSWORD convention, the Recreate deployment strategy, /healthz probes, and the TERDUT_OPERATOR_MODE=true decision (always on here, unlike the chart's default-off: every write this operator's own future controllers make goes through a service account already) all match that source exactly. - api/v1alpha1: full TerdutServerSpec (image, replicas, networking, database, sweeper, deadman, notify, oidc, passwordLogin, allowedTeams). spec.database is a oneOf (dsn xor postgresClusterRef) via CEL XValidation. No spec.credentialsSecretRef -- removed entirely in the prior redesign commit, not carried forward. - internal/controller: - terdutserver_deployment.go: Deployment + Service via CreateOrUpdate, owned (OwnerReference), env built field-for-field against the chart. - terdutserver_database.go: both §8 paths. The Zalando path resolves the postgresql.acid.zalan.do CR by convention (database/role both "terdut", matching every DESIGN.md example) and only ever confirms its generated credentials Secret exists -- never reads the value, same "wire a secretKeyRef, don't read it" posture the DSN path takes. classifyClusterGetError is its own function specifically so the CRD-not-installed case (meta.IsNoMatchError) is unit-testable without a real client. - terdutserver_bootstrap.go: self-registration, checkpointed against both real crash windows (DESIGN.md §6 point 1) -- an admin-key checkpoint Secret, and adopt-via-GET+mint-new-key on a 409 from creating the service account. BootstrapStateLost is its own error type so Reconcile can route it to a condition instead of an infinite retry. - terdutserver_controller.go: ties it together -- finalizer add, DB resolution, Deployment/Service reconcile, wait for a ready replica, bootstrap, Ready/Bootstrapped/DatabaseReady conditions. Finalizer on delete only removes the generated Secrets: terdut-server's API can't delete a user or service account, only revoke keys, so there's nothing server-side to undo. - internal/tdclient: added Bootstrap, CreateInstanceServiceAccount, GetServiceAccountByName, CreateServiceAccountKey, matching terdut-server's real handlers' request/response shapes (internal/api/ users.go, service_accounts.go in that repo) field-for-field. - Tests: envtest suite covering the full DSN-path lifecycle end to end (finalizer -> Deployment/Service -> simulated readiness -> real bootstrap against an httptest.Server fake), the adopt-on-409 recovery path, BootstrapStateLost, both Zalando outcomes (cluster not found; cluster + Secret found -> real DSN -> Ready), and deletion. A minimal test-only stub of the Zalando CRD (internal/controller/testdata) lets envtest create fixture objects without a real postgres-operator installed. 74.0%/44.7% coverage, 0 lint issues. - Two things scoped down from §8's full ambition, called out in code and ROADMAP.md rather than silently dropped: no live watch on the Zalando-generated Secret for rotation (periodic resync notices eventually, not immediately), no Gateway API HTTPRoute creation from spec.networking (would add a new dependency; nothing about proving bootstrap works depends on external ingress existing). Both are near-term follow-ups. Verified locally: make fmt lint test build all clean.	2026-10-01 09:11:56 +02:00
Niklas Ye	1be7cf2b7f	Stage 1: TerdutServer, bring-your-own bootstrap credentials ... Implements the narrowed Stage 1 scope from ROADMAP.md, against the bootstrap-flow fix from DESIGN.md §4.1/§6 (the earlier self-registration flow couldn't work unauthenticated against terdut-server's real AuthMiddleware -- see that commit for the full trace). - api/v1alpha1: TerdutServer with spec.endpoint + spec.credentialsSecretRef + spec.allowedTeams (image/replicas/networking/database deferred to Stage 5, per DESIGN.md's own narrowing). SecretKeyRef has no namespace field -- always the operator's own, by construction. - internal/controller: TerdutServerReconciler implements exactly the bring-your-own path -- adopt spec.credentialsSecretRef if the Secret exists and has data under the given key, probe GET /api/version as a reachability check, set Ready/Bootstrapped conditions accordingly. Self-registration (the /api/bootstrap race) is not implemented; unset spec.credentialsSecretRef reports Ready: False, reason: CredentialsSecretRefRequired, not an attempt at a flow that would fail unauthenticated anyway. No finalizer: this stage creates nothing server-side and adopts rather than generates its Secret, so there's nothing to clean up on delete yet. - internal/tdclient: minimal terdut-server API client (Version only, the one call this stage needs), styled after terdut-tui's own internal/api/client.go per terdut/CLAUDE.md's mirroring convention. - Tests: envtest suite covering all four not-ready paths plus the happy path (fake terdut-server via httptest.Server, per DESIGN.md §11), and a focused unit suite for tdclient. 75.6%/82.4% coverage. - Event recording uses the new events.k8s.io/v1 recorder API (mgr.GetEventRecorder), not the deprecated GetEventRecorderFor -- caught by golangci-lint's staticcheck before it shipped. Verified locally: make fmt lint test build all clean, 0 lint issues, all specs pass.	2026-09-30 22:30:22 +02:00
Niklas Ye	c97571c4c4	Scaffold project with Kubebuilder v4 ... kubebuilder init --domain ryuvia.com --repo git.ryuvia.com/niklas/terdut-operator (--license none, no per-file header boilerplate -- terdut-server's source carries none either). Go 1.26.0/controller-runtime v0.25.0/controller-tools v0.22.0, whatever the current kubebuilder CLI (v4.16.0) scaffolds -- not pinned back to terdut-server's go 1.25.9, since this is a separate module with its own toolchain. Verified locally: build, vet, fmt all clean; `make lint` (golangci-lint, fetched into bin/) 0 issues; `make test` (controller-gen + setup-envtest, fetched into bin/, downloads real envtest binaries from storage.googleapis.com) passes. Dropped kubebuilder's default .github/workflows/* -- this org runs on Gitea, not GitHub; ci.yaml (next commit) is the only CI this repo gets.	2026-09-30 19:22:09 +02:00