Niklas Ye
1be7cf2b7f
CI / test (push) Successful in 1m41s
Implements the narrowed Stage 1 scope from ROADMAP.md, against the bootstrap-flow fix from DESIGN.md §4.1/§6 (the earlier self-registration flow couldn't work unauthenticated against terdut-server's real AuthMiddleware -- see that commit for the full trace). - api/v1alpha1: TerdutServer with spec.endpoint + spec.credentialsSecretRef + spec.allowedTeams (image/replicas/networking/database deferred to Stage 5, per DESIGN.md's own narrowing). SecretKeyRef has no namespace field -- always the operator's own, by construction. - internal/controller: TerdutServerReconciler implements exactly the bring-your-own path -- adopt spec.credentialsSecretRef if the Secret exists and has data under the given key, probe GET /api/version as a reachability check, set Ready/Bootstrapped conditions accordingly. Self-registration (the /api/bootstrap race) is not implemented; unset spec.credentialsSecretRef reports Ready: False, reason: CredentialsSecretRefRequired, not an attempt at a flow that would fail unauthenticated anyway. No finalizer: this stage creates nothing server-side and adopts rather than generates its Secret, so there's nothing to clean up on delete yet. - internal/tdclient: minimal terdut-server API client (Version only, the one call this stage needs), styled after terdut-tui's own internal/api/client.go per terdut/CLAUDE.md's mirroring convention. - Tests: envtest suite covering all four not-ready paths plus the happy path (fake terdut-server via httptest.Server, per DESIGN.md §11), and a focused unit suite for tdclient. 75.6%/82.4% coverage. - Event recording uses the new events.k8s.io/v1 recorder API (mgr.GetEventRecorder), not the deprecated GetEventRecorderFor -- caught by golangci-lint's staticcheck before it shipped. Verified locally: make fmt lint test build all clean, 0 lint issues, all specs pass.
234 lines
7.2 KiB
YAML
234 lines
7.2 KiB
YAML
# Adds namespace to all resources.
|
|
namespace: terdut-operator-system
|
|
|
|
# Value of this field is prepended to the
|
|
# names of all resources, e.g. a deployment named
|
|
# "wordpress" becomes "alices-wordpress".
|
|
# Note that it should also match with the prefix (text before '-') of the namespace
|
|
# field above.
|
|
namePrefix: terdut-operator-
|
|
|
|
# Labels to add to all resources and selectors.
|
|
#labels:
|
|
#- includeSelectors: true
|
|
# pairs:
|
|
# someName: someValue
|
|
|
|
resources:
|
|
- ../crd
|
|
- ../rbac
|
|
- ../manager
|
|
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
|
|
# crd/kustomization.yaml
|
|
#- ../webhook
|
|
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
|
|
#- ../certmanager
|
|
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
|
|
#- ../prometheus
|
|
# [METRICS] Expose the controller manager metrics service.
|
|
- metrics_service.yaml
|
|
# [NETWORK POLICY] Control ingress to metrics and webhook ports.
|
|
# Allow metrics traffic from pods in namespaces labeled 'metrics: enabled'.
|
|
# Allow webhook traffic from all sources.
|
|
#- ../network-policy
|
|
|
|
# Uncomment the patches line if you enable Metrics
|
|
patches:
|
|
# [METRICS] The following patch will enable the metrics endpoint using HTTPS and the port :8443.
|
|
# More info: https://book.kubebuilder.io/reference/metrics
|
|
- path: manager_metrics_patch.yaml
|
|
target:
|
|
kind: Deployment
|
|
|
|
# Uncomment the patches line if you enable Metrics and CertManager
|
|
# [METRICS-WITH-CERTS] To enable metrics protected with certManager, uncomment the following line.
|
|
# This patch will protect the metrics with certManager self-signed certs.
|
|
#- path: cert_metrics_manager_patch.yaml
|
|
# target:
|
|
# kind: Deployment
|
|
|
|
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
|
|
# crd/kustomization.yaml
|
|
#- path: manager_webhook_patch.yaml
|
|
# target:
|
|
# kind: Deployment
|
|
|
|
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
|
|
# Uncomment the following replacements to add the cert-manager CA injection annotations
|
|
#replacements:
|
|
# - source: # Uncomment the following block to enable certificates for metrics
|
|
# kind: Service
|
|
# version: v1
|
|
# name: controller-manager-metrics-service
|
|
# fieldPath: metadata.name
|
|
# targets:
|
|
# - select:
|
|
# kind: Certificate
|
|
# group: cert-manager.io
|
|
# version: v1
|
|
# name: metrics-certs
|
|
# fieldPaths:
|
|
# - spec.dnsNames.0
|
|
# - spec.dnsNames.1
|
|
# options:
|
|
# delimiter: '.'
|
|
# index: 0
|
|
# create: true
|
|
# - select: # Uncomment the following to set the Service name for TLS config in Prometheus ServiceMonitor
|
|
# kind: ServiceMonitor
|
|
# group: monitoring.coreos.com
|
|
# version: v1
|
|
# name: controller-manager-metrics-monitor
|
|
# fieldPaths:
|
|
# - spec.endpoints.0.tlsConfig.serverName
|
|
# options:
|
|
# delimiter: '.'
|
|
# index: 0
|
|
# create: true
|
|
|
|
# - source:
|
|
# kind: Service
|
|
# version: v1
|
|
# name: controller-manager-metrics-service
|
|
# fieldPath: metadata.namespace
|
|
# targets:
|
|
# - select:
|
|
# kind: Certificate
|
|
# group: cert-manager.io
|
|
# version: v1
|
|
# name: metrics-certs
|
|
# fieldPaths:
|
|
# - spec.dnsNames.0
|
|
# - spec.dnsNames.1
|
|
# options:
|
|
# delimiter: '.'
|
|
# index: 1
|
|
# create: true
|
|
# - select: # Uncomment the following to set the Service namespace for TLS in Prometheus ServiceMonitor
|
|
# kind: ServiceMonitor
|
|
# group: monitoring.coreos.com
|
|
# version: v1
|
|
# name: controller-manager-metrics-monitor
|
|
# fieldPaths:
|
|
# - spec.endpoints.0.tlsConfig.serverName
|
|
# options:
|
|
# delimiter: '.'
|
|
# index: 1
|
|
# create: true
|
|
|
|
# - source: # Uncomment the following block if you have any webhook
|
|
# kind: Service
|
|
# version: v1
|
|
# name: webhook-service
|
|
# fieldPath: .metadata.name # Name of the service
|
|
# targets:
|
|
# - select:
|
|
# kind: Certificate
|
|
# group: cert-manager.io
|
|
# version: v1
|
|
# name: serving-cert
|
|
# fieldPaths:
|
|
# - .spec.dnsNames.0
|
|
# - .spec.dnsNames.1
|
|
# options:
|
|
# delimiter: '.'
|
|
# index: 0
|
|
# create: true
|
|
# - source:
|
|
# kind: Service
|
|
# version: v1
|
|
# name: webhook-service
|
|
# fieldPath: .metadata.namespace # Namespace of the service
|
|
# targets:
|
|
# - select:
|
|
# kind: Certificate
|
|
# group: cert-manager.io
|
|
# version: v1
|
|
# name: serving-cert
|
|
# fieldPaths:
|
|
# - .spec.dnsNames.0
|
|
# - .spec.dnsNames.1
|
|
# options:
|
|
# delimiter: '.'
|
|
# index: 1
|
|
# create: true
|
|
|
|
# - source: # Uncomment the following block if you have a ValidatingWebhook (--programmatic-validation)
|
|
# kind: Certificate
|
|
# group: cert-manager.io
|
|
# version: v1
|
|
# name: serving-cert # This name should match the one in certificate.yaml
|
|
# fieldPath: .metadata.namespace # Namespace of the certificate CR
|
|
# targets:
|
|
# - select:
|
|
# kind: ValidatingWebhookConfiguration
|
|
# fieldPaths:
|
|
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
|
|
# options:
|
|
# delimiter: '/'
|
|
# index: 0
|
|
# create: true
|
|
# - source:
|
|
# kind: Certificate
|
|
# group: cert-manager.io
|
|
# version: v1
|
|
# name: serving-cert
|
|
# fieldPath: .metadata.name
|
|
# targets:
|
|
# - select:
|
|
# kind: ValidatingWebhookConfiguration
|
|
# fieldPaths:
|
|
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
|
|
# options:
|
|
# delimiter: '/'
|
|
# index: 1
|
|
# create: true
|
|
|
|
# - source: # Uncomment the following block if you have a DefaultingWebhook (--defaulting )
|
|
# kind: Certificate
|
|
# group: cert-manager.io
|
|
# version: v1
|
|
# name: serving-cert
|
|
# fieldPath: .metadata.namespace # Namespace of the certificate CR
|
|
# targets:
|
|
# - select:
|
|
# kind: MutatingWebhookConfiguration
|
|
# fieldPaths:
|
|
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
|
|
# options:
|
|
# delimiter: '/'
|
|
# index: 0
|
|
# create: true
|
|
# - source:
|
|
# kind: Certificate
|
|
# group: cert-manager.io
|
|
# version: v1
|
|
# name: serving-cert
|
|
# fieldPath: .metadata.name
|
|
# targets:
|
|
# - select:
|
|
# kind: MutatingWebhookConfiguration
|
|
# fieldPaths:
|
|
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
|
|
# options:
|
|
# delimiter: '/'
|
|
# index: 1
|
|
# create: true
|
|
|
|
# - source: # Uncomment the following block if you have a ConversionWebhook (--conversion)
|
|
# kind: Certificate
|
|
# group: cert-manager.io
|
|
# version: v1
|
|
# name: serving-cert
|
|
# fieldPath: .metadata.namespace # Namespace of the certificate CR
|
|
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
|
|
# +kubebuilder:scaffold:crdkustomizecainjectionns
|
|
# - source:
|
|
# kind: Certificate
|
|
# group: cert-manager.io
|
|
# version: v1
|
|
# name: serving-cert
|
|
# fieldPath: .metadata.name
|
|
# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD.
|
|
# +kubebuilder:scaffold:crdkustomizecainjectionname
|