Files
fancy-dns/internal/kubesource/manifests_test.go
T
matsandClaude Sonnet 5.5 4d38945d94 Add a read-only Kubernetes source for zones, client groups and blocklists
The runtime can now take ClientGroup, BlockList and DNSZone objects
(fancydns.k6n.net/v1alpha1) from a cluster with -kube, from a pod's service
account or a kubeconfig alike. internal/kubesource watches them with dynamic
informers, converts and validates each object on its own, and publishes an
immutable snapshot. A bad object is skipped and keeps its last good version,
so one broken edit cannot remove a running policy; an invalid merged config is
dropped whole. The last snapshot is saved so a restart without apiserver access
still serves.

config.Store gains an overlay: Base() is what the YAML says, Get() is base plus
cluster objects. Everything that writes the config back (mutateConfig,
SetAdminAddr, the settings editor) now starts from Base(), otherwise cluster
objects would be copied into the file and shadow their own objects. YAML wins
every name collision. putACL and toggleBlocklist refuse to edit cluster-owned
objects. BlockList has no path field and refuses file:// URLs so a namespaced
object cannot pick files the runtime reads or writes. DNSZone is rendered
through the zone writer's own prove-by-reparse step, with the SOA serial taken
from metadata.generation so every replica renders identical bytes.

qlog: Flush reset the pending slice to [:0], so entries logged while it was
still storing the batch were appended over the same backing array. The race
detector found it through the new Kubernetes integration test. pending is now
set to nil, with a regression test that fails without the change.

CRD manifests, RBAC and examples are in deploy/k8s/crds; tests pin the schemas
to the Go spec structs so the two cannot drift.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-10-16 08:35:36 +02:00

118 lines
3.1 KiB
Go

package kubesource
import (
"bytes"
"io"
"os"
"reflect"
"sort"
"strings"
"testing"
"gopkg.in/yaml.v3"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
)
func yamlDocs(t *testing.T, path string) []map[string]any {
t.Helper()
b, err := os.ReadFile(path)
if err != nil {
t.Fatal(err)
}
var out []map[string]any
dec := yaml.NewDecoder(bytes.NewReader(b))
for {
var m map[string]any
if err := dec.Decode(&m); err == io.EOF {
break
} else if err != nil {
t.Fatalf("%s: %v", path, err)
}
if m != nil {
out = append(out, m)
}
}
return out
}
func jsonFields(typ reflect.Type) []string {
var out []string
for i := 0; i < typ.NumField(); i++ {
tag := strings.Split(typ.Field(i).Tag.Get("json"), ",")[0]
if tag != "" && tag != "-" {
out = append(out, tag)
}
}
sort.Strings(out)
return out
}
// TestCRDSchemasMatchTheGoSpecs keeps deploy/k8s/crds/crds.yaml and the spec
// structs from drifting: a field the schema lacks is pruned by the apiserver
// before the runtime ever sees it, and a schema field the struct lacks is
// accepted and silently ignored.
func TestCRDSchemasMatchTheGoSpecs(t *testing.T) {
want := map[string]reflect.Type{
"DNSZone": reflect.TypeOf(DNSZoneSpec{}),
"ClientGroup": reflect.TypeOf(ClientGroupSpec{}),
"BlockList": reflect.TypeOf(BlockListSpec{}),
}
seen := 0
for _, doc := range yamlDocs(t, "../../deploy/k8s/crds/crds.yaml") {
names := doc["spec"].(map[string]any)["names"].(map[string]any)
kind := names["kind"].(string)
typ, ok := want[kind]
if !ok {
t.Errorf("unexpected CRD kind %s", kind)
continue
}
seen++
versions := doc["spec"].(map[string]any)["versions"].([]any)
schema := versions[0].(map[string]any)["schema"].(map[string]any)["openAPIV3Schema"].(map[string]any)
props := schema["properties"].(map[string]any)["spec"].(map[string]any)["properties"].(map[string]any)
var got []string
for k := range props {
got = append(got, k)
}
sort.Strings(got)
if !reflect.DeepEqual(got, jsonFields(typ)) {
t.Errorf("%s: schema fields %v, Go fields %v", kind, got, jsonFields(typ))
}
if plural := names["plural"].(string); plural != map[string]string{
"DNSZone": ZoneGVR.Resource, "ClientGroup": GroupGVR.Resource, "BlockList": ListGVR.Resource,
}[kind] {
t.Errorf("%s: plural %q does not match the GVR the runtime watches", kind, plural)
}
}
if seen != len(want) {
t.Errorf("saw %d CRDs, want %d", seen, len(want))
}
}
// TestExampleObjectsConvert makes sure the shipped examples are accepted by
// the runtime, so the first thing an operator copies is not a rejection.
func TestExampleObjectsConvert(t *testing.T) {
n := 0
for _, doc := range yamlDocs(t, "../../deploy/k8s/crds/examples.yaml") {
u := &unstructured.Unstructured{Object: doc}
var err error
switch u.GetKind() {
case "DNSZone":
_, err = convertZone(u)
case "ClientGroup":
_, err = convertGroup(u)
case "BlockList":
_, err = convertList(u)
default:
t.Fatalf("unknown kind %s", u.GetKind())
}
if err != nil {
t.Errorf("%s %s: %v", u.GetKind(), u.GetName(), err)
}
n++
}
if n != 3 {
t.Fatalf("converted %d examples, want 3", n)
}
}