e1103f2b7d
Credentials: the TerdutServer controller generates <name>-operator-key in the server's own namespace (owned by it) and hands it to the pods as TERDUT_OPERATOR_KEY; the server creates its instance-scoped account from it at every start. A replaced Secret rolls the pods. The bootstrap handshake, the checkpoint Secret, per-team service accounts and credentials Secrets, BootstrapStateLost and credentials.deletionPolicy are gone. CRDs: TerdutServer, TerdutTeam and TerdutAlertSource. TerdutEscalationRule and TerdutDeadmanSwitch become spec.escalation and spec.deadmanSwitches[] on the team (matched by name, extras removed); team invites are removed. A team is created under the identity <namespace>/<name> (external_id), so a retry, a lost status or a deleted team heal by repeating the same call, and a display name owned by another team is TeamNameTaken instead of an adoption. The server resolves escalation usernames (UnknownUser condition). OIDC claim names and trustEmail are spec fields. Fixes: query values are URL-escaped; every delete treats 404 as success; deleting a team no longer depends on allowedTeams consent; a switch or integration deleted on the server is recreated; unnamed switches take the CR's name. Cleanup: scaffold e2e test, AGENTS.md, devcontainer, unused config/ pieces and Client.Version() removed; DESIGN.md, README, ROADMAP and the demo (run-demo.sh, manifests) rewritten for the new design. Secret RBAC stays cluster-wide, now stated in DESIGN.md section 9. Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN
132 lines
5.4 KiB
Go
132 lines
5.4 KiB
Go
package controller
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"sync/atomic"
|
|
|
|
. "github.com/onsi/ginkgo/v2"
|
|
. "github.com/onsi/gomega"
|
|
appsv1 "k8s.io/api/apps/v1"
|
|
"k8s.io/apimachinery/pkg/api/meta"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/apimachinery/pkg/types"
|
|
"sigs.k8s.io/controller-runtime/pkg/reconcile"
|
|
|
|
terdutv1alpha1 "git.ryuvia.com/niklas/terdut-operator/api/v1alpha1"
|
|
"git.ryuvia.com/niklas/terdut-operator/internal/tdclient"
|
|
)
|
|
|
|
// Shared fixture values -- a bring-your-own DSN TerdutServer spec, reused
|
|
// across terdutserver_controller_test.go, terdutteam_controller_test.go and
|
|
// this file, so there's exactly one definition to keep consistent.
|
|
const (
|
|
testImageRepo = "example.invalid/terdut-server"
|
|
testImageTag = "test"
|
|
testDSN = "postgres://terdut@test-postgres:5432/terdut?sslmode=require"
|
|
|
|
// testRefNotFoundName is a name no TerdutServer/TerdutTeam ever gets
|
|
// created with -- shared by every "...RefNotFound" test across
|
|
// terdutteam_controller_test.go, terdutescalationrule_controller_test.go,
|
|
// terdutdeadmanswitch_controller_test.go and
|
|
// terdutalertsource_controller_test.go, so goconst doesn't flag four
|
|
// independent copies of the same literal.
|
|
testRefNotFoundName = "does-not-exist"
|
|
|
|
// testUnreadyDisplayName is the TerdutTeam.spec.displayName every
|
|
// "...exists but isn't Ready yet" test across the same four files uses
|
|
// for its deliberately-never-reconciled fixture team, for the same
|
|
// goconst reason as testRefNotFoundName above.
|
|
testUnreadyDisplayName = "unready"
|
|
|
|
// testOperatorNamespace is every test file's own namespace for both
|
|
// the operator's generated/credential objects and the CRs under test
|
|
// -- always "default" in this suite, so bootstrapReadyTerdutServer
|
|
// below takes no namespace parameter of its own (golangci-lint's
|
|
// unparam flagged it once a fourth same-valued caller made that
|
|
// obvious): there's never a second value to pass.
|
|
testOperatorNamespace = "default"
|
|
)
|
|
|
|
// readyTerdutServer creates a TerdutServer with a bring-your-own DSN and drives
|
|
// it to Ready the way the happy-path test does -- shared so the tests of
|
|
// everything that references a server (TerdutTeam, TerdutAlertSource) start
|
|
// from a real, Ready one.
|
|
func readyTerdutServer(ctx context.Context, name string) *terdutv1alpha1.TerdutServer {
|
|
GinkgoHelper()
|
|
namespace := testOperatorNamespace
|
|
|
|
reconciler := &TerdutServerReconciler{Client: k8sClient, Scheme: k8sClient.Scheme()}
|
|
objKey := types.NamespacedName{Name: name, Namespace: namespace}
|
|
|
|
srv := &terdutv1alpha1.TerdutServer{
|
|
ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: namespace},
|
|
Spec: terdutv1alpha1.TerdutServerSpec{
|
|
Image: terdutv1alpha1.ImageSpec{Repository: testImageRepo, Tag: testImageTag},
|
|
Networking: terdutv1alpha1.NetworkingSpec{Hostname: "terdut.example.invalid", ServicePort: 8080},
|
|
Database: terdutv1alpha1.DatabaseSpec{DSN: testDSN},
|
|
},
|
|
}
|
|
Expect(k8sClient.Create(ctx, srv)).To(Succeed())
|
|
|
|
_, err := reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: objKey}) // Deployment, Service, key
|
|
Expect(err).NotTo(HaveOccurred())
|
|
|
|
var deploy appsv1.Deployment
|
|
Expect(k8sClient.Get(ctx, objKey, &deploy)).To(Succeed())
|
|
deploy.Status.ReadyReplicas = 1
|
|
deploy.Status.Replicas = 1
|
|
Expect(k8sClient.Status().Update(ctx, &deploy)).To(Succeed())
|
|
|
|
_, err = reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: objKey}) // Ready
|
|
Expect(err).NotTo(HaveOccurred())
|
|
|
|
Expect(k8sClient.Get(ctx, objKey, srv)).To(Succeed())
|
|
Expect(meta.IsStatusConditionTrue(srv.Status.Conditions, terdutv1alpha1.ConditionReady)).To(BeTrue(),
|
|
"test setup: TerdutServer %s/%s did not reach Ready", namespace, name)
|
|
return srv
|
|
}
|
|
|
|
// readyTerdutTeam creates a TerdutTeam under srv (an already-Ready
|
|
// TerdutServer, from readyTerdutServer) and drives it to Ready against the fake
|
|
// at fakeURL.
|
|
func readyTerdutTeam(ctx context.Context, namespace, name string, srv *terdutv1alpha1.TerdutServer, fakeURL string) *terdutv1alpha1.TerdutTeam {
|
|
GinkgoHelper()
|
|
|
|
reconciler := &TerdutTeamReconciler{
|
|
Client: k8sClient,
|
|
Scheme: k8sClient.Scheme(),
|
|
NewClient: func(string) *tdclient.Client { return tdclient.New(fakeURL) },
|
|
}
|
|
objKey := types.NamespacedName{Name: name, Namespace: namespace}
|
|
|
|
team := &terdutv1alpha1.TerdutTeam{
|
|
ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: namespace},
|
|
Spec: terdutv1alpha1.TerdutTeamSpec{
|
|
ServerRef: terdutv1alpha1.TerdutServerRef{Name: srv.Name},
|
|
DisplayName: name,
|
|
},
|
|
}
|
|
Expect(k8sClient.Create(ctx, team)).To(Succeed())
|
|
|
|
_, err := reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: objKey}) // finalizer
|
|
Expect(err).NotTo(HaveOccurred())
|
|
_, err = reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: objKey}) // apply
|
|
Expect(err).NotTo(HaveOccurred())
|
|
|
|
Expect(k8sClient.Get(ctx, objKey, team)).To(Succeed())
|
|
Expect(team.Status.TeamID).NotTo(BeZero(), "test setup: TerdutTeam %s/%s did not reach Ready", namespace, name)
|
|
return team
|
|
}
|
|
|
|
// uniqueNameCounter backs uniqueName. GinkgoRandomSeed()/GinkgoParallelProcess()
|
|
// are constants for the whole suite run, not per-spec -- an earlier version
|
|
// of this helper used them and collided across every spec that called it
|
|
// more than once; an atomic counter is genuinely unique per call instead.
|
|
var uniqueNameCounter atomic.Int64
|
|
|
|
// uniqueName returns a Kubernetes-object-safe name unique to this call.
|
|
func uniqueName(prefix string) string {
|
|
return fmt.Sprintf("%s-%d", prefix, uniqueNameCounter.Add(1))
|
|
}
|