Niklas Ye
e1103f2b7d
Credentials: the TerdutServer controller generates <name>-operator-key in the server's own namespace (owned by it) and hands it to the pods as TERDUT_OPERATOR_KEY; the server creates its instance-scoped account from it at every start. A replaced Secret rolls the pods. The bootstrap handshake, the checkpoint Secret, per-team service accounts and credentials Secrets, BootstrapStateLost and credentials.deletionPolicy are gone. CRDs: TerdutServer, TerdutTeam and TerdutAlertSource. TerdutEscalationRule and TerdutDeadmanSwitch become spec.escalation and spec.deadmanSwitches[] on the team (matched by name, extras removed); team invites are removed. A team is created under the identity <namespace>/<name> (external_id), so a retry, a lost status or a deleted team heal by repeating the same call, and a display name owned by another team is TeamNameTaken instead of an adoption. The server resolves escalation usernames (UnknownUser condition). OIDC claim names and trustEmail are spec fields. Fixes: query values are URL-escaped; every delete treats 404 as success; deleting a team no longer depends on allowedTeams consent; a switch or integration deleted on the server is recreated; unnamed switches take the CR's name. Cleanup: scaffold e2e test, AGENTS.md, devcontainer, unused config/ pieces and Client.Version() removed; DESIGN.md, README, ROADMAP and the demo (run-demo.sh, manifests) rewritten for the new design. Secret RBAC stays cluster-wide, now stated in DESIGN.md section 9. Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN
65 lines
2.4 KiB
Go
65 lines
2.4 KiB
Go
package controller
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
apierrors "k8s.io/apimachinery/pkg/api/errors"
|
|
"k8s.io/apimachinery/pkg/api/meta"
|
|
"sigs.k8s.io/controller-runtime/pkg/client"
|
|
|
|
terdutv1alpha1 "git.ryuvia.com/niklas/terdut-operator/api/v1alpha1"
|
|
"git.ryuvia.com/niklas/terdut-operator/internal/tdclient"
|
|
)
|
|
|
|
// childError carries a condition reason/message, the same role teamError and
|
|
// databaseError play for their own controllers: an expected,
|
|
// requeue-and-retry outcome, not a reconcile failure.
|
|
type childError struct {
|
|
reason string
|
|
message string
|
|
}
|
|
|
|
func (e *childError) Error() string { return e.message }
|
|
|
|
// resolveTeamAndClient finds the TerdutTeam a child (TerdutAlertSource) names,
|
|
// requires it to be Ready, and returns a client for its server authenticated
|
|
// with that server's operator key. The server is read from the team's own
|
|
// serverRef: consent was already checked when the team went Ready, and does not
|
|
// gate a resource the team owns.
|
|
func resolveTeamAndClient(
|
|
ctx context.Context, c client.Client, namespace string,
|
|
ref terdutv1alpha1.TerdutTeamRef, newClient func(string) *tdclient.Client,
|
|
) (*terdutv1alpha1.TerdutTeam, *tdclient.Client, *childError) {
|
|
var team terdutv1alpha1.TerdutTeam
|
|
if err := c.Get(ctx, client.ObjectKey{Namespace: namespace, Name: ref.Name}, &team); err != nil {
|
|
if apierrors.IsNotFound(err) {
|
|
return nil, nil, &childError{
|
|
reason: terdutv1alpha1.ReasonTeamRefNotFound,
|
|
message: fmt.Sprintf("TerdutTeam %q not found in namespace %q", ref.Name, namespace),
|
|
}
|
|
}
|
|
return nil, nil, &childError{reason: terdutv1alpha1.ReasonTeamRefNotFound, message: err.Error()}
|
|
}
|
|
if team.Status.TeamID == 0 || !meta.IsStatusConditionTrue(team.Status.Conditions, terdutv1alpha1.ConditionReady) {
|
|
return nil, nil, &childError{
|
|
reason: terdutv1alpha1.ReasonWaitingForTeam,
|
|
message: fmt.Sprintf("TerdutTeam %q is not Ready yet", ref.Name),
|
|
}
|
|
}
|
|
|
|
srvNS := team.Spec.ServerRef.Namespace
|
|
if srvNS == "" {
|
|
srvNS = team.Namespace
|
|
}
|
|
var srv terdutv1alpha1.TerdutServer
|
|
if err := c.Get(ctx, client.ObjectKey{Namespace: srvNS, Name: team.Spec.ServerRef.Name}, &srv); err != nil {
|
|
return nil, nil, &childError{reason: terdutv1alpha1.ReasonWaitingForTeam, message: err.Error()}
|
|
}
|
|
key, err := readOperatorKey(ctx, c, &srv)
|
|
if err != nil {
|
|
return nil, nil, &childError{reason: terdutv1alpha1.ReasonWaitingForTeam, message: err.Error()}
|
|
}
|
|
return &team, newClient(serviceURL(&srv)).WithToken(key), nil
|
|
}
|