unkinben
9c81320df8
The operator-generated TSIG Secret previously carried only the managed-by
label, so it could not be mirrored to another namespace by emberstack
reflector (which requires reflection-allowed annotations on the source).
Add spec.secretTemplate.{annotations,labels}, applied both when the Secret
is first generated and reconciled onto the existing Secret when the CR
changes (imported secrets are left untouched so we don't fight their
external manager). This lets the external-dns TSIG key be managed in
bind-internal and reflected into the externaldns namespace.
72 lines
2.3 KiB
Go
72 lines
2.3 KiB
Go
package controller
|
|
|
|
import (
|
|
"testing"
|
|
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
|
|
bindv1alpha1 "git.unkin.net/unkin/bind-operator/api/v1alpha1"
|
|
)
|
|
|
|
func TestApplySecretTemplate(t *testing.T) {
|
|
t.Run("nil template still stamps managed-by label", func(t *testing.T) {
|
|
var meta metav1.ObjectMeta
|
|
if !applySecretTemplate(&meta, nil) {
|
|
t.Fatal("expected change on empty meta")
|
|
}
|
|
if meta.Labels[managedByLabel] != managedByValue {
|
|
t.Errorf("managed-by label = %q, want %q", meta.Labels[managedByLabel], managedByValue)
|
|
}
|
|
if meta.Annotations != nil {
|
|
t.Errorf("annotations = %v, want nil", meta.Annotations)
|
|
}
|
|
})
|
|
|
|
t.Run("applies labels and annotations", func(t *testing.T) {
|
|
meta := metav1.ObjectMeta{Labels: map[string]string{managedByLabel: managedByValue}}
|
|
tmpl := &bindv1alpha1.SecretMetadata{
|
|
Annotations: map[string]string{"reflector.v1.k8s.emberstack.com/reflection-allowed": "true"},
|
|
Labels: map[string]string{"team": "dns"},
|
|
}
|
|
if !applySecretTemplate(&meta, tmpl) {
|
|
t.Fatal("expected change when adding template metadata")
|
|
}
|
|
if got := meta.Annotations["reflector.v1.k8s.emberstack.com/reflection-allowed"]; got != "true" {
|
|
t.Errorf("reflection annotation = %q, want true", got)
|
|
}
|
|
if meta.Labels["team"] != "dns" {
|
|
t.Errorf("team label = %q, want dns", meta.Labels["team"])
|
|
}
|
|
// managed-by must survive user-supplied labels.
|
|
if meta.Labels[managedByLabel] != managedByValue {
|
|
t.Errorf("managed-by label dropped: %v", meta.Labels)
|
|
}
|
|
})
|
|
|
|
t.Run("idempotent when already applied", func(t *testing.T) {
|
|
tmpl := &bindv1alpha1.SecretMetadata{
|
|
Annotations: map[string]string{"a": "1"},
|
|
Labels: map[string]string{"b": "2"},
|
|
}
|
|
meta := metav1.ObjectMeta{}
|
|
applySecretTemplate(&meta, tmpl)
|
|
if applySecretTemplate(&meta, tmpl) {
|
|
t.Error("expected no change on second apply")
|
|
}
|
|
})
|
|
|
|
t.Run("updates drifted annotation value", func(t *testing.T) {
|
|
meta := metav1.ObjectMeta{
|
|
Labels: map[string]string{managedByLabel: managedByValue},
|
|
Annotations: map[string]string{"a": "old"},
|
|
}
|
|
tmpl := &bindv1alpha1.SecretMetadata{Annotations: map[string]string{"a": "new"}}
|
|
if !applySecretTemplate(&meta, tmpl) {
|
|
t.Fatal("expected change when annotation value drifts")
|
|
}
|
|
if meta.Annotations["a"] != "new" {
|
|
t.Errorf("annotation a = %q, want new", meta.Annotations["a"])
|
|
}
|
|
})
|
|
}
|