Niklas Ye
e1103f2b7d
Credentials: the TerdutServer controller generates <name>-operator-key in the server's own namespace (owned by it) and hands it to the pods as TERDUT_OPERATOR_KEY; the server creates its instance-scoped account from it at every start. A replaced Secret rolls the pods. The bootstrap handshake, the checkpoint Secret, per-team service accounts and credentials Secrets, BootstrapStateLost and credentials.deletionPolicy are gone. CRDs: TerdutServer, TerdutTeam and TerdutAlertSource. TerdutEscalationRule and TerdutDeadmanSwitch become spec.escalation and spec.deadmanSwitches[] on the team (matched by name, extras removed); team invites are removed. A team is created under the identity <namespace>/<name> (external_id), so a retry, a lost status or a deleted team heal by repeating the same call, and a display name owned by another team is TeamNameTaken instead of an adoption. The server resolves escalation usernames (UnknownUser condition). OIDC claim names and trustEmail are spec fields. Fixes: query values are URL-escaped; every delete treats 404 as success; deleting a team no longer depends on allowedTeams consent; a switch or integration deleted on the server is recreated; unnamed switches take the CR's name. Cleanup: scaffold e2e test, AGENTS.md, devcontainer, unused config/ pieces and Client.Version() removed; DESIGN.md, README, ROADMAP and the demo (run-demo.sh, manifests) rewritten for the new design. Secret RBAC stays cluster-wide, now stated in DESIGN.md section 9. Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN
297 lines
11 KiB
Go
297 lines
11 KiB
Go
package controller
|
|
|
|
import (
|
|
"context"
|
|
"net/http/httptest"
|
|
"strconv"
|
|
|
|
. "github.com/onsi/ginkgo/v2"
|
|
. "github.com/onsi/gomega"
|
|
corev1 "k8s.io/api/core/v1"
|
|
"k8s.io/apimachinery/pkg/api/meta"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/apimachinery/pkg/types"
|
|
"sigs.k8s.io/controller-runtime/pkg/reconcile"
|
|
|
|
terdutv1alpha1 "git.ryuvia.com/niklas/terdut-operator/api/v1alpha1"
|
|
"git.ryuvia.com/niklas/terdut-operator/internal/tdclient"
|
|
)
|
|
|
|
var _ = Describe("TerdutAlertSource Controller", func() {
|
|
const operatorNamespace = "default"
|
|
|
|
var (
|
|
reconciler *TerdutAlertSourceReconciler
|
|
fake *fakeTerdutServer
|
|
fakeSrv *httptest.Server
|
|
srv *terdutv1alpha1.TerdutServer
|
|
team *terdutv1alpha1.TerdutTeam
|
|
srcName string
|
|
srcKey types.NamespacedName
|
|
)
|
|
|
|
BeforeEach(func(ctx SpecContext) {
|
|
fake, fakeSrv = newFakeTerdutServer()
|
|
DeferCleanup(fakeSrv.Close)
|
|
|
|
srv = readyTerdutServer(ctx, uniqueName("asserver"))
|
|
team = readyTerdutTeam(ctx, operatorNamespace, uniqueName("asteam"), srv, fakeSrv.URL)
|
|
|
|
reconciler = &TerdutAlertSourceReconciler{
|
|
Client: k8sClient,
|
|
Scheme: k8sClient.Scheme(),
|
|
NewClient: func(string) *tdclient.Client { return tdclient.New(fakeSrv.URL) },
|
|
}
|
|
srcName = uniqueName("alertsource")
|
|
srcKey = types.NamespacedName{Name: srcName, Namespace: operatorNamespace}
|
|
})
|
|
|
|
AfterEach(func(ctx SpecContext) {
|
|
as := &terdutv1alpha1.TerdutAlertSource{}
|
|
if err := k8sClient.Get(ctx, srcKey, as); err == nil {
|
|
as.Finalizers = nil
|
|
_ = k8sClient.Update(ctx, as)
|
|
_ = k8sClient.Delete(ctx, as)
|
|
}
|
|
_ = k8sClient.Delete(ctx, &corev1.Secret{ObjectMeta: metav1.ObjectMeta{
|
|
Name: srcName + "-terdut-webhook", Namespace: operatorNamespace,
|
|
}})
|
|
|
|
teamKey := types.NamespacedName{Name: team.Name, Namespace: operatorNamespace}
|
|
if err := k8sClient.Get(ctx, teamKey, team); err == nil {
|
|
team.Finalizers = nil
|
|
_ = k8sClient.Update(ctx, team)
|
|
_ = k8sClient.Delete(ctx, team)
|
|
}
|
|
|
|
srvKey := types.NamespacedName{Name: srv.Name, Namespace: operatorNamespace}
|
|
if err := k8sClient.Get(ctx, srvKey, srv); err == nil {
|
|
srv.Finalizers = nil
|
|
_ = k8sClient.Update(ctx, srv)
|
|
_ = k8sClient.Delete(ctx, srv)
|
|
}
|
|
})
|
|
|
|
createSource := func(ctx context.Context, teamRef terdutv1alpha1.TerdutTeamRef, kind, name string) {
|
|
as := &terdutv1alpha1.TerdutAlertSource{
|
|
ObjectMeta: metav1.ObjectMeta{Name: srcName, Namespace: operatorNamespace},
|
|
Spec: terdutv1alpha1.TerdutAlertSourceSpec{TeamRef: teamRef, Kind: kind, Name: name},
|
|
}
|
|
Expect(k8sClient.Create(ctx, as)).To(Succeed())
|
|
}
|
|
|
|
reconcileOnce := func(ctx context.Context) {
|
|
_, err := reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: srcKey})
|
|
Expect(err).NotTo(HaveOccurred())
|
|
}
|
|
|
|
readyCondition := func(ctx context.Context) metav1.Condition {
|
|
as := &terdutv1alpha1.TerdutAlertSource{}
|
|
Expect(k8sClient.Get(ctx, srcKey, as)).To(Succeed())
|
|
c := meta.FindStatusCondition(as.Status.Conditions, terdutv1alpha1.ConditionReady)
|
|
Expect(c).NotTo(BeNil())
|
|
return *c
|
|
}
|
|
|
|
sameTeamRef := func() terdutv1alpha1.TerdutTeamRef {
|
|
return terdutv1alpha1.TerdutTeamRef{Name: team.Name}
|
|
}
|
|
|
|
webhookSecret := func(ctx context.Context) corev1.Secret {
|
|
var secret corev1.Secret
|
|
Expect(k8sClient.Get(ctx, types.NamespacedName{
|
|
Name: srcName + "-terdut-webhook", Namespace: operatorNamespace,
|
|
}, &secret)).To(Succeed())
|
|
return secret
|
|
}
|
|
|
|
Describe("the happy path", func() {
|
|
It("creates the integration and writes the webhook Secret", func(ctx SpecContext) {
|
|
createSource(ctx, sameTeamRef(), "alertmanager", "prod-alertmanager")
|
|
reconcileOnce(ctx) // finalizer
|
|
reconcileOnce(ctx) // create
|
|
|
|
cond := readyCondition(ctx)
|
|
Expect(cond.Status).To(Equal(metav1.ConditionTrue))
|
|
Expect(cond.Reason).To(Equal(terdutv1alpha1.ReasonChildAdopted))
|
|
|
|
as := &terdutv1alpha1.TerdutAlertSource{}
|
|
Expect(k8sClient.Get(ctx, srcKey, as)).To(Succeed())
|
|
Expect(as.Status.IntegrationID).NotTo(BeZero())
|
|
Expect(as.Status.LastAppliedKind).To(Equal("alertmanager"))
|
|
Expect(as.Status.WebhookURLSecretRef).NotTo(BeNil())
|
|
Expect(as.Status.WebhookURLSecretRef.Name).To(Equal(srcName + "-terdut-webhook"))
|
|
|
|
secret := webhookSecret(ctx)
|
|
Expect(secret.Data[webhookSecretKeyDataKey]).NotTo(BeEmpty())
|
|
Expect(secret.Data[webhookSecretURLKey]).NotTo(BeEmpty())
|
|
Expect(secret.OwnerReferences).To(HaveLen(1), "same-namespace generated Secret should be owner-referenced, not finalizer-cleaned")
|
|
|
|
created, ok := fake.integrations[team.Status.TeamID][as.Status.IntegrationID]
|
|
Expect(ok).To(BeTrue())
|
|
Expect(created.Name).To(Equal("prod-alertmanager"))
|
|
Expect(created.Kind).To(Equal("alertmanager"))
|
|
})
|
|
})
|
|
|
|
Describe("renaming", func() {
|
|
It("PATCHes the new name without rotating the key", func(ctx SpecContext) {
|
|
createSource(ctx, sameTeamRef(), "alertmanager", "prod-alertmanager")
|
|
reconcileOnce(ctx)
|
|
reconcileOnce(ctx)
|
|
Expect(readyCondition(ctx).Status).To(Equal(metav1.ConditionTrue))
|
|
|
|
as := &terdutv1alpha1.TerdutAlertSource{}
|
|
Expect(k8sClient.Get(ctx, srcKey, as)).To(Succeed())
|
|
integrationID := as.Status.IntegrationID
|
|
secretBefore := webhookSecret(ctx)
|
|
|
|
as.Spec.Name = "prod-alertmanager-renamed"
|
|
Expect(k8sClient.Update(ctx, as)).To(Succeed())
|
|
reconcileOnce(ctx)
|
|
|
|
Expect(fake.integrations[team.Status.TeamID][integrationID].Name).To(Equal("prod-alertmanager-renamed"))
|
|
|
|
Expect(k8sClient.Get(ctx, srcKey, as)).To(Succeed())
|
|
Expect(as.Status.IntegrationID).To(Equal(integrationID), "renaming must not rotate the integration id")
|
|
secretAfter := webhookSecret(ctx)
|
|
Expect(secretAfter.Data[webhookSecretKeyDataKey]).To(Equal(secretBefore.Data[webhookSecretKeyDataKey]), "renaming must not rotate the webhook key")
|
|
})
|
|
})
|
|
|
|
Describe("a kind change", func() {
|
|
It("deletes the old integration, mints a new one, and rotates the webhook Secret", func(ctx SpecContext) {
|
|
createSource(ctx, sameTeamRef(), "alertmanager", "prod-alertmanager")
|
|
reconcileOnce(ctx)
|
|
reconcileOnce(ctx)
|
|
Expect(readyCondition(ctx).Status).To(Equal(metav1.ConditionTrue))
|
|
|
|
as := &terdutv1alpha1.TerdutAlertSource{}
|
|
Expect(k8sClient.Get(ctx, srcKey, as)).To(Succeed())
|
|
oldIntegrationID := as.Status.IntegrationID
|
|
secretBefore := webhookSecret(ctx)
|
|
|
|
// terdut-server only supports one kind today (DESIGN.md §4.5),
|
|
// so there's no second real value to rotate to -- this fake
|
|
// server doesn't validate kind at all, so re-POSTing under the
|
|
// same literal string still exercises the full
|
|
// delete-then-create rotation path and produces a fresh id
|
|
// and key, which is everything this test needs to verify.
|
|
as.Spec.Kind = "alertmanager"
|
|
as.Status.LastAppliedKind = "something-else"
|
|
Expect(k8sClient.Status().Update(ctx, as)).To(Succeed())
|
|
reconcileOnce(ctx)
|
|
|
|
Expect(fake.integrationDelete[oldIntegrationID]).To(BeTrue())
|
|
|
|
Expect(k8sClient.Get(ctx, srcKey, as)).To(Succeed())
|
|
Expect(as.Status.IntegrationID).NotTo(Equal(oldIntegrationID))
|
|
Expect(as.Status.LastAppliedKind).To(Equal("alertmanager"))
|
|
|
|
secretAfter := webhookSecret(ctx)
|
|
Expect(secretAfter.Data[webhookSecretKeyDataKey]).NotTo(Equal(secretBefore.Data[webhookSecretKeyDataKey]), "a kind rotation must mint a new webhook key")
|
|
})
|
|
})
|
|
|
|
Describe("crash recovery between POST and status write", func() {
|
|
It("adopts the webhook Secret's own record instead of minting a second integration", func(ctx SpecContext) {
|
|
createSource(ctx, sameTeamRef(), "alertmanager", "prod-alertmanager")
|
|
reconcileOnce(ctx) // finalizer only -- status.integrationID stays 0
|
|
|
|
// Simulate a previous reconcile that got as far as writing the
|
|
// Secret (the only durable record this resource can have, per
|
|
// its own controller comment) but crashed before status.
|
|
secret := &corev1.Secret{
|
|
ObjectMeta: metav1.ObjectMeta{Name: srcName + "-terdut-webhook", Namespace: operatorNamespace},
|
|
Data: map[string][]byte{
|
|
webhookSecretURLKey: []byte("https://terdut.example.invalid/api/integrations/orphaned-key/alertmanager"),
|
|
webhookSecretKeyDataKey: []byte("orphaned-key"),
|
|
webhookSecretIntegrationIDKey: []byte(strconv.FormatInt(999, 10)),
|
|
},
|
|
}
|
|
Expect(k8sClient.Create(ctx, secret)).To(Succeed())
|
|
|
|
reconcileOnce(ctx)
|
|
|
|
as := &terdutv1alpha1.TerdutAlertSource{}
|
|
Expect(k8sClient.Get(ctx, srcKey, as)).To(Succeed())
|
|
Expect(as.Status.IntegrationID).To(Equal(int64(999)))
|
|
Expect(fake.integrations[team.Status.TeamID]).To(BeEmpty(), "should never have called POST at all")
|
|
Expect(readyCondition(ctx).Status).To(Equal(metav1.ConditionTrue))
|
|
})
|
|
})
|
|
|
|
Describe("webhook Secret loss", func() {
|
|
It("reports WebhookSecretLost and does not mint a replacement", func(ctx SpecContext) {
|
|
createSource(ctx, sameTeamRef(), "alertmanager", "prod-alertmanager")
|
|
reconcileOnce(ctx)
|
|
reconcileOnce(ctx)
|
|
Expect(readyCondition(ctx).Status).To(Equal(metav1.ConditionTrue))
|
|
|
|
as := &terdutv1alpha1.TerdutAlertSource{}
|
|
Expect(k8sClient.Get(ctx, srcKey, as)).To(Succeed())
|
|
integrationID := as.Status.IntegrationID
|
|
|
|
Expect(k8sClient.Delete(ctx, &corev1.Secret{ObjectMeta: metav1.ObjectMeta{
|
|
Name: srcName + "-terdut-webhook", Namespace: operatorNamespace,
|
|
}})).To(Succeed())
|
|
|
|
reconcileOnce(ctx)
|
|
|
|
cond := readyCondition(ctx)
|
|
Expect(cond.Status).To(Equal(metav1.ConditionFalse))
|
|
Expect(cond.Reason).To(Equal(terdutv1alpha1.ReasonWebhookSecretLost))
|
|
Expect(fake.integrationDelete[integrationID]).To(BeFalse(), "fail-closed: must not touch the still-live integration server-side either")
|
|
})
|
|
})
|
|
|
|
Describe("waiting on the referenced TerdutTeam", func() {
|
|
It("reports TeamRefNotFound when the TerdutTeam doesn't exist", func(ctx SpecContext) {
|
|
createSource(ctx, terdutv1alpha1.TerdutTeamRef{Name: testRefNotFoundName}, "alertmanager", "prod-alertmanager")
|
|
reconcileOnce(ctx) // finalizer
|
|
reconcileOnce(ctx)
|
|
|
|
Expect(readyCondition(ctx).Reason).To(Equal(terdutv1alpha1.ReasonTeamRefNotFound))
|
|
})
|
|
|
|
It("reports WaitingForTeam when the TerdutTeam exists but isn't Ready yet", func(ctx SpecContext) {
|
|
unreadyName := uniqueName("asteam-unready")
|
|
unready := &terdutv1alpha1.TerdutTeam{
|
|
ObjectMeta: metav1.ObjectMeta{Name: unreadyName, Namespace: operatorNamespace},
|
|
Spec: terdutv1alpha1.TerdutTeamSpec{
|
|
ServerRef: terdutv1alpha1.TerdutServerRef{Name: srv.Name},
|
|
DisplayName: testUnreadyDisplayName,
|
|
},
|
|
}
|
|
Expect(k8sClient.Create(ctx, unready)).To(Succeed())
|
|
DeferCleanup(func() { _ = k8sClient.Delete(ctx, unready) })
|
|
|
|
createSource(ctx, terdutv1alpha1.TerdutTeamRef{Name: unreadyName}, "alertmanager", "prod-alertmanager")
|
|
reconcileOnce(ctx) // finalizer
|
|
reconcileOnce(ctx)
|
|
|
|
Expect(readyCondition(ctx).Reason).To(Equal(terdutv1alpha1.ReasonWaitingForTeam))
|
|
})
|
|
})
|
|
|
|
Describe("deletion", func() {
|
|
It("deletes the integration server-side and removes the finalizer", func(ctx SpecContext) {
|
|
createSource(ctx, sameTeamRef(), "alertmanager", "prod-alertmanager")
|
|
reconcileOnce(ctx)
|
|
reconcileOnce(ctx)
|
|
Expect(readyCondition(ctx).Status).To(Equal(metav1.ConditionTrue))
|
|
|
|
as := &terdutv1alpha1.TerdutAlertSource{}
|
|
Expect(k8sClient.Get(ctx, srcKey, as)).To(Succeed())
|
|
integrationID := as.Status.IntegrationID
|
|
|
|
Expect(k8sClient.Delete(ctx, as)).To(Succeed())
|
|
reconcileOnce(ctx) // runs the finalizer
|
|
|
|
Expect(fake.integrationDelete[integrationID]).To(BeTrue())
|
|
err := k8sClient.Get(ctx, srcKey, as)
|
|
Expect(err).To(HaveOccurred(), "the TerdutAlertSource itself should be gone once the finalizer clears")
|
|
})
|
|
})
|
|
})
|