Niklas Ye
c9c52af2f7
CI / test (push) Successful in 1m41s
Implements ROADMAP.md Stage 2 against terdut-server's now-real
GET /api/teams?name= (TEAM-LOOKUP.md, landed in terdut-server just
before this commit) -- without it, the adopt-on-409 pattern this
controller depends on for team creation had no server-side lookup to
call, the same gap TerdutServer's own bootstrap flow hit and fixed in
Stage 1.
- api/v1alpha1: TerdutTeamSpec per DESIGN.md §4.2 (serverRef, displayName,
oidc). status.credentialsSecretRef drops namespace for key, matching
the fix already applied to TerdutServer's.
- internal/controller:
- terdutteam_controller.go: resolves serverRef (same-namespace by
default; cross-namespace gated by the target TerdutServer's
spec.allowedTeams, DESIGN.md §4.6), waits for that TerdutServer to be
Bootstrapped (no cross-controller RPC -- reads its
status.credentialsSecretRef directly, DESIGN.md §5), creates the team
and mints its team-scoped credential using the TerdutServer's
instance-scoped one, then applies rename/oidc-groups with the
team-scoped credential every reconcile (both are idempotent PUTs of
the whole resource -- applied unconditionally rather than diffed
against a stored last-applied value, same "cheap because it's small"
reasoning §5 already gives the escalation policy's whole-policy PUT).
- terdutteam_allowedteams.go: the §4.6 consent check in isolation from
any client, unit-tested directly against hand-built inputs.
- terdutteam_bootstrap.go: create-or-adopt-on-409 for the team itself
(via TEAM-LOOKUP.md) and for its team-scoped service account (via the
same GET-by-name+mint-new-key pattern Stage 1 already uses for the
instance account).
- secrets.go: extracted TerdutServer's write/read-credential-Secret
helpers into free functions, now shared by both controllers rather
than duplicated.
- Finalizer deletes the team server-side (owner-gated, needs the
team-scoped credential -- confirmed against source that an
instance-scoped one does not satisfy requireTeamOwner, same finding
as TEAM-LOOKUP.md's) and cleans up its credentials Secret. A team
created but never fully reconciled to Ready (no team-scoped
credential ever minted) is left orphaned server-side on delete -- a
known, documented limitation (terdut-server has no delete path that
doesn't require owner-equivalent access), not a silent gap.
- internal/tdclient: Team type, CreateTeam, GetTeamByName, RenameTeam,
DeleteTeam, SetTeamOIDCGroups, CreateTeamServiceAccount -- matching
terdut-server's real handlers' shapes field-for-field, same as Stage
1's client additions.
- Tests: envtest covering the happy path, both not-ready reasons
(ServerRefNotFound, WaitingForServer), cross-namespace allow/deny
(default-closed and explicit All), both adopt-on-409 paths (team
itself, team-scoped service account), and deletion. Extended the shared
fakeTerdutServer (Stage 1) with team endpoints rather than writing a
second, separately-drifting fake. 72.8%/30.6% coverage, 0 lint issues.
Verified locally: make fmt lint test build all clean.
83 lines
3.3 KiB
Go
83 lines
3.3 KiB
Go
package controller
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"sync/atomic"
|
|
|
|
. "github.com/onsi/ginkgo/v2"
|
|
. "github.com/onsi/gomega"
|
|
appsv1 "k8s.io/api/apps/v1"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/apimachinery/pkg/types"
|
|
"sigs.k8s.io/controller-runtime/pkg/reconcile"
|
|
|
|
terdutv1alpha1 "git.ryuvia.com/niklas/terdut-operator/api/v1alpha1"
|
|
"git.ryuvia.com/niklas/terdut-operator/internal/tdclient"
|
|
)
|
|
|
|
// Shared fixture values -- a bring-your-own DSN TerdutServer spec, reused
|
|
// across terdutserver_controller_test.go, terdutteam_controller_test.go and
|
|
// this file, so there's exactly one definition to keep consistent.
|
|
const (
|
|
testImageRepo = "example.invalid/terdut-server"
|
|
testImageTag = "test"
|
|
testDSN = "postgres://terdut@test-postgres:5432/terdut?sslmode=require"
|
|
)
|
|
|
|
// bootstrapReadyTerdutServer creates a TerdutServer with a bring-your-own
|
|
// DSN and drives it to Ready against fakeURL, the same three-pass sequence
|
|
// terdutserver_controller_test.go's own happy-path test exercises directly
|
|
// -- shared here so TerdutTeam's tests (which need a real, Ready
|
|
// TerdutServer to resolve against) don't duplicate it.
|
|
func bootstrapReadyTerdutServer(ctx context.Context, namespace, name, fakeURL string) *terdutv1alpha1.TerdutServer {
|
|
GinkgoHelper()
|
|
|
|
reconciler := &TerdutServerReconciler{
|
|
Client: k8sClient,
|
|
Scheme: k8sClient.Scheme(),
|
|
OperatorNamespace: namespace,
|
|
NewClient: func(string) *tdclient.Client { return tdclient.New(fakeURL) },
|
|
}
|
|
objKey := types.NamespacedName{Name: name, Namespace: namespace}
|
|
|
|
srv := &terdutv1alpha1.TerdutServer{
|
|
ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: namespace},
|
|
Spec: terdutv1alpha1.TerdutServerSpec{
|
|
Image: terdutv1alpha1.ImageSpec{Repository: testImageRepo, Tag: testImageTag},
|
|
Networking: terdutv1alpha1.NetworkingSpec{Hostname: "terdut.example.invalid", ServicePort: 8080},
|
|
Database: terdutv1alpha1.DatabaseSpec{DSN: testDSN},
|
|
},
|
|
}
|
|
Expect(k8sClient.Create(ctx, srv)).To(Succeed())
|
|
|
|
_, err := reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: objKey}) // finalizer
|
|
Expect(err).NotTo(HaveOccurred())
|
|
_, err = reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: objKey}) // Deployment/Service
|
|
Expect(err).NotTo(HaveOccurred())
|
|
|
|
var deploy appsv1.Deployment
|
|
Expect(k8sClient.Get(ctx, objKey, &deploy)).To(Succeed())
|
|
deploy.Status.ReadyReplicas = 1
|
|
deploy.Status.Replicas = 1
|
|
Expect(k8sClient.Status().Update(ctx, &deploy)).To(Succeed())
|
|
|
|
_, err = reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: objKey}) // bootstrap
|
|
Expect(err).NotTo(HaveOccurred())
|
|
|
|
Expect(k8sClient.Get(ctx, objKey, srv)).To(Succeed())
|
|
Expect(srv.Status.CredentialsSecretRef).NotTo(BeNil(), "test setup: TerdutServer %s/%s did not reach Bootstrapped", namespace, name)
|
|
return srv
|
|
}
|
|
|
|
// uniqueNameCounter backs uniqueName. GinkgoRandomSeed()/GinkgoParallelProcess()
|
|
// are constants for the whole suite run, not per-spec -- an earlier version
|
|
// of this helper used them and collided across every spec that called it
|
|
// more than once; an atomic counter is genuinely unique per call instead.
|
|
var uniqueNameCounter atomic.Int64
|
|
|
|
// uniqueName returns a Kubernetes-object-safe name unique to this call.
|
|
func uniqueName(prefix string) string {
|
|
return fmt.Sprintf("%s-%d", prefix, uniqueNameCounter.Add(1))
|
|
}
|