Niklas Ye
c9c52af2f7
CI / test (push) Successful in 1m41s
Implements ROADMAP.md Stage 2 against terdut-server's now-real
GET /api/teams?name= (TEAM-LOOKUP.md, landed in terdut-server just
before this commit) -- without it, the adopt-on-409 pattern this
controller depends on for team creation had no server-side lookup to
call, the same gap TerdutServer's own bootstrap flow hit and fixed in
Stage 1.
- api/v1alpha1: TerdutTeamSpec per DESIGN.md §4.2 (serverRef, displayName,
oidc). status.credentialsSecretRef drops namespace for key, matching
the fix already applied to TerdutServer's.
- internal/controller:
- terdutteam_controller.go: resolves serverRef (same-namespace by
default; cross-namespace gated by the target TerdutServer's
spec.allowedTeams, DESIGN.md §4.6), waits for that TerdutServer to be
Bootstrapped (no cross-controller RPC -- reads its
status.credentialsSecretRef directly, DESIGN.md §5), creates the team
and mints its team-scoped credential using the TerdutServer's
instance-scoped one, then applies rename/oidc-groups with the
team-scoped credential every reconcile (both are idempotent PUTs of
the whole resource -- applied unconditionally rather than diffed
against a stored last-applied value, same "cheap because it's small"
reasoning §5 already gives the escalation policy's whole-policy PUT).
- terdutteam_allowedteams.go: the §4.6 consent check in isolation from
any client, unit-tested directly against hand-built inputs.
- terdutteam_bootstrap.go: create-or-adopt-on-409 for the team itself
(via TEAM-LOOKUP.md) and for its team-scoped service account (via the
same GET-by-name+mint-new-key pattern Stage 1 already uses for the
instance account).
- secrets.go: extracted TerdutServer's write/read-credential-Secret
helpers into free functions, now shared by both controllers rather
than duplicated.
- Finalizer deletes the team server-side (owner-gated, needs the
team-scoped credential -- confirmed against source that an
instance-scoped one does not satisfy requireTeamOwner, same finding
as TEAM-LOOKUP.md's) and cleans up its credentials Secret. A team
created but never fully reconciled to Ready (no team-scoped
credential ever minted) is left orphaned server-side on delete -- a
known, documented limitation (terdut-server has no delete path that
doesn't require owner-equivalent access), not a silent gap.
- internal/tdclient: Team type, CreateTeam, GetTeamByName, RenameTeam,
DeleteTeam, SetTeamOIDCGroups, CreateTeamServiceAccount -- matching
terdut-server's real handlers' shapes field-for-field, same as Stage
1's client additions.
- Tests: envtest covering the happy path, both not-ready reasons
(ServerRefNotFound, WaitingForServer), cross-namespace allow/deny
(default-closed and explicit All), both adopt-on-409 paths (team
itself, team-scoped service account), and deletion. Extended the shared
fakeTerdutServer (Stage 1) with team endpoints rather than writing a
second, separately-drifting fake. 72.8%/30.6% coverage, 0 lint issues.
Verified locally: make fmt lint test build all clean.
108 lines
5.0 KiB
Modula-2
108 lines
5.0 KiB
Modula-2
module git.ryuvia.com/niklas/terdut-operator
|
|
|
|
go 1.26.0
|
|
|
|
require (
|
|
github.com/onsi/ginkgo/v2 v2.27.4
|
|
github.com/onsi/gomega v1.39.0
|
|
k8s.io/api v0.37.0
|
|
k8s.io/apimachinery v0.37.0
|
|
k8s.io/client-go v0.37.0
|
|
sigs.k8s.io/controller-runtime v0.25.0
|
|
)
|
|
|
|
require (
|
|
cel.dev/expr v0.25.1 // indirect
|
|
github.com/Masterminds/semver/v3 v3.4.0 // indirect
|
|
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/blang/semver/v4 v4.0.0 // indirect
|
|
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/emicklei/go-restful/v3 v3.13.0 // indirect
|
|
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/fsnotify/fsnotify v1.9.0 // indirect
|
|
github.com/fxamacker/cbor/v2 v2.9.1 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-logr/zapr v1.3.0 // indirect
|
|
github.com/go-openapi/jsonpointer v1.0.0 // indirect
|
|
github.com/go-openapi/jsonreference v1.0.0 // indirect
|
|
github.com/go-openapi/swag v0.27.1 // indirect
|
|
github.com/go-openapi/swag/cmdutils v0.27.1 // indirect
|
|
github.com/go-openapi/swag/conv v0.27.1 // indirect
|
|
github.com/go-openapi/swag/fileutils v0.27.1 // indirect
|
|
github.com/go-openapi/swag/jsonutils v0.27.1 // indirect
|
|
github.com/go-openapi/swag/loading v0.27.1 // indirect
|
|
github.com/go-openapi/swag/mangling v0.27.1 // indirect
|
|
github.com/go-openapi/swag/netutils v0.27.1 // indirect
|
|
github.com/go-openapi/swag/pools v0.27.1 // indirect
|
|
github.com/go-openapi/swag/stringutils v0.27.1 // indirect
|
|
github.com/go-openapi/swag/typeutils v0.27.1 // indirect
|
|
github.com/go-openapi/swag/yamlutils v0.27.1 // indirect
|
|
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
|
|
github.com/google/cel-go v0.29.2 // indirect
|
|
github.com/google/gnostic-models v0.7.0 // indirect
|
|
github.com/google/go-cmp v0.7.0 // indirect
|
|
github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
github.com/prometheus/client_golang v1.24.0 // indirect
|
|
github.com/prometheus/client_model v0.6.2 // indirect
|
|
github.com/prometheus/common v0.70.0 // indirect
|
|
github.com/prometheus/procfs v0.21.1 // indirect
|
|
github.com/spf13/cobra v1.10.2 // indirect
|
|
github.com/spf13/pflag v1.0.10 // indirect
|
|
github.com/x448/float16 v0.8.4 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
|
|
go.opentelemetry.io/otel v1.44.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.44.0 // indirect
|
|
go.opentelemetry.io/otel/sdk v1.44.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.44.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.10.0 // indirect
|
|
go.uber.org/multierr v1.11.0 // indirect
|
|
go.uber.org/zap v1.27.1 // indirect
|
|
go.yaml.in/yaml/v2 v2.4.4 // indirect
|
|
go.yaml.in/yaml/v3 v3.0.4 // indirect
|
|
golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
|
|
golang.org/x/mod v0.37.0 // indirect
|
|
golang.org/x/net v0.57.0 // indirect
|
|
golang.org/x/oauth2 v0.36.0 // indirect
|
|
golang.org/x/sync v0.22.0 // indirect
|
|
golang.org/x/sys v0.47.0 // indirect
|
|
golang.org/x/term v0.45.0 // indirect
|
|
golang.org/x/text v0.40.0 // indirect
|
|
golang.org/x/time v0.15.0 // indirect
|
|
golang.org/x/tools v0.47.0 // indirect
|
|
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
|
|
google.golang.org/grpc v1.82.1 // indirect
|
|
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
|
|
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
|
|
gopkg.in/inf.v0 v0.9.1 // indirect
|
|
k8s.io/apiextensions-apiserver v0.37.0 // indirect
|
|
k8s.io/apiserver v0.37.0 // indirect
|
|
k8s.io/component-base v0.37.0 // indirect
|
|
k8s.io/klog/v2 v2.140.0 // indirect
|
|
k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
|
|
k8s.io/streaming v0.37.0 // indirect
|
|
k8s.io/utils v0.0.0-20260626114624-be93311217bd // indirect
|
|
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.36.0 // indirect
|
|
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
|
|
sigs.k8s.io/randfill v1.0.0 // indirect
|
|
sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect
|
|
sigs.k8s.io/yaml v1.6.0 // indirect
|
|
)
|