c9c52af2f7
CI / test (push) Successful in 1m41s
Implements ROADMAP.md Stage 2 against terdut-server's now-real
GET /api/teams?name= (TEAM-LOOKUP.md, landed in terdut-server just
before this commit) -- without it, the adopt-on-409 pattern this
controller depends on for team creation had no server-side lookup to
call, the same gap TerdutServer's own bootstrap flow hit and fixed in
Stage 1.
- api/v1alpha1: TerdutTeamSpec per DESIGN.md §4.2 (serverRef, displayName,
oidc). status.credentialsSecretRef drops namespace for key, matching
the fix already applied to TerdutServer's.
- internal/controller:
- terdutteam_controller.go: resolves serverRef (same-namespace by
default; cross-namespace gated by the target TerdutServer's
spec.allowedTeams, DESIGN.md §4.6), waits for that TerdutServer to be
Bootstrapped (no cross-controller RPC -- reads its
status.credentialsSecretRef directly, DESIGN.md §5), creates the team
and mints its team-scoped credential using the TerdutServer's
instance-scoped one, then applies rename/oidc-groups with the
team-scoped credential every reconcile (both are idempotent PUTs of
the whole resource -- applied unconditionally rather than diffed
against a stored last-applied value, same "cheap because it's small"
reasoning §5 already gives the escalation policy's whole-policy PUT).
- terdutteam_allowedteams.go: the §4.6 consent check in isolation from
any client, unit-tested directly against hand-built inputs.
- terdutteam_bootstrap.go: create-or-adopt-on-409 for the team itself
(via TEAM-LOOKUP.md) and for its team-scoped service account (via the
same GET-by-name+mint-new-key pattern Stage 1 already uses for the
instance account).
- secrets.go: extracted TerdutServer's write/read-credential-Secret
helpers into free functions, now shared by both controllers rather
than duplicated.
- Finalizer deletes the team server-side (owner-gated, needs the
team-scoped credential -- confirmed against source that an
instance-scoped one does not satisfy requireTeamOwner, same finding
as TEAM-LOOKUP.md's) and cleans up its credentials Secret. A team
created but never fully reconciled to Ready (no team-scoped
credential ever minted) is left orphaned server-side on delete -- a
known, documented limitation (terdut-server has no delete path that
doesn't require owner-equivalent access), not a silent gap.
- internal/tdclient: Team type, CreateTeam, GetTeamByName, RenameTeam,
DeleteTeam, SetTeamOIDCGroups, CreateTeamServiceAccount -- matching
terdut-server's real handlers' shapes field-for-field, same as Stage
1's client additions.
- Tests: envtest covering the happy path, both not-ready reasons
(ServerRefNotFound, WaitingForServer), cross-namespace allow/deny
(default-closed and explicit All), both adopt-on-409 paths (team
itself, team-scoped service account), and deletion. Extended the shared
fakeTerdutServer (Stage 1) with team endpoints rather than writing a
second, separately-drifting fake. 72.8%/30.6% coverage, 0 lint issues.
Verified locally: make fmt lint test build all clean.
449 lines
13 KiB
Go
449 lines
13 KiB
Go
//go:build !ignore_autogenerated
|
|
|
|
// Code generated by controller-gen. DO NOT EDIT.
|
|
|
|
package v1alpha1
|
|
|
|
import (
|
|
"k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/apimachinery/pkg/runtime"
|
|
)
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *AllowedTeams) DeepCopyInto(out *AllowedTeams) {
|
|
*out = *in
|
|
in.Namespaces.DeepCopyInto(&out.Namespaces)
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AllowedTeams.
|
|
func (in *AllowedTeams) DeepCopy() *AllowedTeams {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(AllowedTeams)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *AllowedTeamsNamespaces) DeepCopyInto(out *AllowedTeamsNamespaces) {
|
|
*out = *in
|
|
if in.Selector != nil {
|
|
in, out := &in.Selector, &out.Selector
|
|
*out = new(v1.LabelSelector)
|
|
(*in).DeepCopyInto(*out)
|
|
}
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AllowedTeamsNamespaces.
|
|
func (in *AllowedTeamsNamespaces) DeepCopy() *AllowedTeamsNamespaces {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(AllowedTeamsNamespaces)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *DatabaseSpec) DeepCopyInto(out *DatabaseSpec) {
|
|
*out = *in
|
|
if in.PasswordSecretRef != nil {
|
|
in, out := &in.PasswordSecretRef, &out.PasswordSecretRef
|
|
*out = new(SecretKeyRef)
|
|
**out = **in
|
|
}
|
|
if in.PostgresClusterRef != nil {
|
|
in, out := &in.PostgresClusterRef, &out.PostgresClusterRef
|
|
*out = new(PostgresClusterRef)
|
|
**out = **in
|
|
}
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DatabaseSpec.
|
|
func (in *DatabaseSpec) DeepCopy() *DatabaseSpec {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(DatabaseSpec)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *DeadmanSpec) DeepCopyInto(out *DeadmanSpec) {
|
|
*out = *in
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DeadmanSpec.
|
|
func (in *DeadmanSpec) DeepCopy() *DeadmanSpec {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(DeadmanSpec)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *ImageSpec) DeepCopyInto(out *ImageSpec) {
|
|
*out = *in
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ImageSpec.
|
|
func (in *ImageSpec) DeepCopy() *ImageSpec {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(ImageSpec)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *NetworkingSpec) DeepCopyInto(out *NetworkingSpec) {
|
|
*out = *in
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetworkingSpec.
|
|
func (in *NetworkingSpec) DeepCopy() *NetworkingSpec {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(NetworkingSpec)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *NotifySpec) DeepCopyInto(out *NotifySpec) {
|
|
*out = *in
|
|
if in.TokenSecretRef != nil {
|
|
in, out := &in.TokenSecretRef, &out.TokenSecretRef
|
|
*out = new(SecretKeyRef)
|
|
**out = **in
|
|
}
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NotifySpec.
|
|
func (in *NotifySpec) DeepCopy() *NotifySpec {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(NotifySpec)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *OIDCSpec) DeepCopyInto(out *OIDCSpec) {
|
|
*out = *in
|
|
if in.ClientSecretRef != nil {
|
|
in, out := &in.ClientSecretRef, &out.ClientSecretRef
|
|
*out = new(SecretKeyRef)
|
|
**out = **in
|
|
}
|
|
if in.AllowedGroups != nil {
|
|
in, out := &in.AllowedGroups, &out.AllowedGroups
|
|
*out = make([]string, len(*in))
|
|
copy(*out, *in)
|
|
}
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCSpec.
|
|
func (in *OIDCSpec) DeepCopy() *OIDCSpec {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(OIDCSpec)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *PostgresClusterRef) DeepCopyInto(out *PostgresClusterRef) {
|
|
*out = *in
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PostgresClusterRef.
|
|
func (in *PostgresClusterRef) DeepCopy() *PostgresClusterRef {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(PostgresClusterRef)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *SecretKeyRef) DeepCopyInto(out *SecretKeyRef) {
|
|
*out = *in
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretKeyRef.
|
|
func (in *SecretKeyRef) DeepCopy() *SecretKeyRef {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(SecretKeyRef)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *SweeperSpec) DeepCopyInto(out *SweeperSpec) {
|
|
*out = *in
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SweeperSpec.
|
|
func (in *SweeperSpec) DeepCopy() *SweeperSpec {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(SweeperSpec)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *TerdutServer) DeepCopyInto(out *TerdutServer) {
|
|
*out = *in
|
|
out.TypeMeta = in.TypeMeta
|
|
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
|
in.Spec.DeepCopyInto(&out.Spec)
|
|
in.Status.DeepCopyInto(&out.Status)
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TerdutServer.
|
|
func (in *TerdutServer) DeepCopy() *TerdutServer {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(TerdutServer)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
|
func (in *TerdutServer) DeepCopyObject() runtime.Object {
|
|
if c := in.DeepCopy(); c != nil {
|
|
return c
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *TerdutServerList) DeepCopyInto(out *TerdutServerList) {
|
|
*out = *in
|
|
out.TypeMeta = in.TypeMeta
|
|
in.ListMeta.DeepCopyInto(&out.ListMeta)
|
|
if in.Items != nil {
|
|
in, out := &in.Items, &out.Items
|
|
*out = make([]TerdutServer, len(*in))
|
|
for i := range *in {
|
|
(*in)[i].DeepCopyInto(&(*out)[i])
|
|
}
|
|
}
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TerdutServerList.
|
|
func (in *TerdutServerList) DeepCopy() *TerdutServerList {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(TerdutServerList)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
|
func (in *TerdutServerList) DeepCopyObject() runtime.Object {
|
|
if c := in.DeepCopy(); c != nil {
|
|
return c
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *TerdutServerRef) DeepCopyInto(out *TerdutServerRef) {
|
|
*out = *in
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TerdutServerRef.
|
|
func (in *TerdutServerRef) DeepCopy() *TerdutServerRef {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(TerdutServerRef)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *TerdutServerSpec) DeepCopyInto(out *TerdutServerSpec) {
|
|
*out = *in
|
|
out.Image = in.Image
|
|
out.Networking = in.Networking
|
|
in.Database.DeepCopyInto(&out.Database)
|
|
out.Sweeper = in.Sweeper
|
|
out.Deadman = in.Deadman
|
|
in.Notify.DeepCopyInto(&out.Notify)
|
|
in.OIDC.DeepCopyInto(&out.OIDC)
|
|
in.AllowedTeams.DeepCopyInto(&out.AllowedTeams)
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TerdutServerSpec.
|
|
func (in *TerdutServerSpec) DeepCopy() *TerdutServerSpec {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(TerdutServerSpec)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *TerdutServerStatus) DeepCopyInto(out *TerdutServerStatus) {
|
|
*out = *in
|
|
if in.Conditions != nil {
|
|
in, out := &in.Conditions, &out.Conditions
|
|
*out = make([]v1.Condition, len(*in))
|
|
for i := range *in {
|
|
(*in)[i].DeepCopyInto(&(*out)[i])
|
|
}
|
|
}
|
|
if in.CredentialsSecretRef != nil {
|
|
in, out := &in.CredentialsSecretRef, &out.CredentialsSecretRef
|
|
*out = new(SecretKeyRef)
|
|
**out = **in
|
|
}
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TerdutServerStatus.
|
|
func (in *TerdutServerStatus) DeepCopy() *TerdutServerStatus {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(TerdutServerStatus)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *TerdutTeam) DeepCopyInto(out *TerdutTeam) {
|
|
*out = *in
|
|
out.TypeMeta = in.TypeMeta
|
|
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
|
out.Spec = in.Spec
|
|
in.Status.DeepCopyInto(&out.Status)
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TerdutTeam.
|
|
func (in *TerdutTeam) DeepCopy() *TerdutTeam {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(TerdutTeam)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
|
func (in *TerdutTeam) DeepCopyObject() runtime.Object {
|
|
if c := in.DeepCopy(); c != nil {
|
|
return c
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *TerdutTeamList) DeepCopyInto(out *TerdutTeamList) {
|
|
*out = *in
|
|
out.TypeMeta = in.TypeMeta
|
|
in.ListMeta.DeepCopyInto(&out.ListMeta)
|
|
if in.Items != nil {
|
|
in, out := &in.Items, &out.Items
|
|
*out = make([]TerdutTeam, len(*in))
|
|
for i := range *in {
|
|
(*in)[i].DeepCopyInto(&(*out)[i])
|
|
}
|
|
}
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TerdutTeamList.
|
|
func (in *TerdutTeamList) DeepCopy() *TerdutTeamList {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(TerdutTeamList)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
|
func (in *TerdutTeamList) DeepCopyObject() runtime.Object {
|
|
if c := in.DeepCopy(); c != nil {
|
|
return c
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *TerdutTeamOIDC) DeepCopyInto(out *TerdutTeamOIDC) {
|
|
*out = *in
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TerdutTeamOIDC.
|
|
func (in *TerdutTeamOIDC) DeepCopy() *TerdutTeamOIDC {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(TerdutTeamOIDC)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *TerdutTeamSpec) DeepCopyInto(out *TerdutTeamSpec) {
|
|
*out = *in
|
|
out.ServerRef = in.ServerRef
|
|
out.OIDC = in.OIDC
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TerdutTeamSpec.
|
|
func (in *TerdutTeamSpec) DeepCopy() *TerdutTeamSpec {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(TerdutTeamSpec)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|
|
|
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
|
func (in *TerdutTeamStatus) DeepCopyInto(out *TerdutTeamStatus) {
|
|
*out = *in
|
|
if in.Conditions != nil {
|
|
in, out := &in.Conditions, &out.Conditions
|
|
*out = make([]v1.Condition, len(*in))
|
|
for i := range *in {
|
|
(*in)[i].DeepCopyInto(&(*out)[i])
|
|
}
|
|
}
|
|
if in.CredentialsSecretRef != nil {
|
|
in, out := &in.CredentialsSecretRef, &out.CredentialsSecretRef
|
|
*out = new(SecretKeyRef)
|
|
**out = **in
|
|
}
|
|
}
|
|
|
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TerdutTeamStatus.
|
|
func (in *TerdutTeamStatus) DeepCopy() *TerdutTeamStatus {
|
|
if in == nil {
|
|
return nil
|
|
}
|
|
out := new(TerdutTeamStatus)
|
|
in.DeepCopyInto(out)
|
|
return out
|
|
}
|