Niklas Ye
fb9e6a38dc
CI / test (push) Has been cancelled
Both child CRDs resolve their own teamRef -> TerdutTeam.status via the new
shared resolveTeamAndClient helper (childref.go), never chaining up to
TerdutServer (DESIGN.md §5) -- TerdutTeam.status.serverEndpoint, added in
this same stage, is what makes that literally true.
TerdutEscalationRule: one PUT /api/teams/{id}/escalation per reconcile
(an upsert server-side, confirmed against source), resolving each "user"
target's username to a user_id via GET /api/users first and reporting
Ready: False, reason: UnknownUser if it doesn't resolve. No DELETE exists
for this resource, so its delete path PUTs an empty policy as the closest
available undo.
TerdutDeadmanSwitch: real create/update-in-place/delete, using
terdut-server v0.33.0's PUT (added specifically for this operator). No
unique-name constraint server-side, so idempotent-create here is
GET-list-and-match-by-name rather than adopt-on-409.
Extends tdclient with User/GetUserByUsername, the escalation request types
+ SetEscalation, and DeadmanSwitch + its CRUD methods. Also folds
ConditionTeamReady into the single shared ConditionReady constant, since
both were literally "Ready" and Stage 3 would otherwise have needed a
third same-valued constant.
internal/controller/terdutserver_controller_test.go's fakeTerdutServer
grows GET /api/users, PUT .../escalation, and the full dead man's switch
collection/item routes, replacing the old parseTeamPath/handleTeamByID
pair with a more general parseTeamSubPath/handleTeamSubPath dispatcher
that still covers every existing Stage 1/2 route unchanged.
make fmt lint test build all clean; envtest coverage for
internal/controller: 50.5% -> 71.7%.
30 lines
805 B
YAML
30 lines
805 B
YAML
# This rule is not used by the project terdut-operator itself.
|
|
# It is provided to allow the cluster admin to help manage permissions for users.
|
|
#
|
|
# Grants read-only access to terdut.ryuvia.com resources.
|
|
# This role is intended for users who need visibility into these resources
|
|
# without permissions to modify them. It is ideal for monitoring purposes and limited-access viewing.
|
|
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: terdut-operator
|
|
app.kubernetes.io/managed-by: kustomize
|
|
name: terdutdeadmanswitch-viewer-role
|
|
rules:
|
|
- apiGroups:
|
|
- terdut.ryuvia.com
|
|
resources:
|
|
- terdutdeadmanswitches
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- terdut.ryuvia.com
|
|
resources:
|
|
- terdutdeadmanswitches/status
|
|
verbs:
|
|
- get
|