unkinben
aab11457af
v0.2.5 (PR #14) added an options-scope allow-notify enumerating the primary pod IP on secondaries. Options-scope config feeds the config-hash annotation that rolls the StatefulSet, so any config change rolled the pods, the primary came back on a new pod IP, the operator re-rendered with the new IP, the hash changed, the pods rolled again — an infinite roll loop across every BindCluster. The prod deployment was reverted to v0.2.4. Replace the pod-IP allow-notify with TSIG-authenticated NOTIFY: - Secondaries render `allow-notify { key "<name>"; };` — a static key element with NO IPs. It depends only on the key name, so pod-IP churn can never change the render, the config-hash, or trigger a restart. - The primary signs its outgoing NOTIFYs: the zone-scope also-notify entries (already enumerating replica pod IPs, applied via rndc addzone/modzone with NO restart) now carry `key "<name>"`. - Key choice: reuse the cluster's catalog transfer TSIG key (TransferKeyRef). Secondaries already present it for AXFR and it is in keys.conf on every pod, so no new key plumbing is needed. Add a permanent regression guard for the loop class: - controller: reconcile the ConfigMap with the primary pod on two different IPs and assert the config-hash is byte-identical. - render: render restart-scoped input and assert no pod IP appears in allow-notify; RenderInput no longer has any pod-IP field. Zone-scope also-notify (rndc, no restart) legitimately still lists pod IPs; only restart-scoped config must be pod-IP-independent.
109 lines
4.1 KiB
Go
109 lines
4.1 KiB
Go
package controller
|
|
|
|
import (
|
|
"context"
|
|
"strings"
|
|
"testing"
|
|
|
|
corev1 "k8s.io/api/core/v1"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/apimachinery/pkg/runtime"
|
|
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
|
|
"sigs.k8s.io/controller-runtime/pkg/client"
|
|
"sigs.k8s.io/controller-runtime/pkg/client/fake"
|
|
|
|
bindv1alpha1 "git.unkin.net/unkin/bind-operator/api/v1alpha1"
|
|
)
|
|
|
|
// TestConfigHashIndependentOfPrimaryPodIP is the permanent regression guard for
|
|
// the v0.2.5 rolling-restart loop.
|
|
//
|
|
// v0.2.5 rendered an options-scope `allow-notify { <primaryPodIP>; ... }` into
|
|
// the (restart-scoped) named.conf. The config-hash annotation that rolls the
|
|
// StatefulSet is computed over that render (BindClusterReconciler.configHash), so
|
|
// a config change rolled the pods, the primary pod came back on a NEW IP, the
|
|
// operator re-rendered with the new IP, the hash changed, the pods rolled again,
|
|
// and so on — an infinite roll loop across every BindCluster.
|
|
//
|
|
// The fix removed all pod IPs from restart-scoped config (secondaries now admit
|
|
// intra-cluster NOTIFYs by TSIG key: `allow-notify { key "X"; }`). This test
|
|
// reconciles the ConfigMap with the primary pod on one IP, computes the hash,
|
|
// then does it again with the primary pod on a DIFFERENT IP, and asserts the
|
|
// hash is byte-identical. If any pod-IP dependency ever creeps back into
|
|
// restart-scoped config, this fails and the loop-class bug is caught.
|
|
func TestConfigHashIndependentOfPrimaryPodIP(t *testing.T) {
|
|
scheme := runtime.NewScheme()
|
|
if err := clientgoscheme.AddToScheme(scheme); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := bindv1alpha1.AddToScheme(scheme); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
const ns = "dns"
|
|
svcIP := "10.43.5.5" // stable primary Service ClusterIP (does NOT churn)
|
|
|
|
cluster := &bindv1alpha1.BindCluster{
|
|
ObjectMeta: metav1.ObjectMeta{Name: "auth", Namespace: ns},
|
|
Spec: bindv1alpha1.BindClusterSpec{
|
|
Mode: bindv1alpha1.ModeAuthoritative,
|
|
Replicas: 3,
|
|
PrimaryService: &bindv1alpha1.ClusterServiceSpec{},
|
|
},
|
|
}
|
|
primarySvc := &corev1.Service{
|
|
ObjectMeta: metav1.ObjectMeta{Name: primaryServiceName(cluster.Name), Namespace: ns},
|
|
Spec: corev1.ServiceSpec{ClusterIP: svcIP},
|
|
}
|
|
catalog := &bindv1alpha1.BindCatalogZone{
|
|
ObjectMeta: metav1.ObjectMeta{Name: "cat", Namespace: ns},
|
|
Spec: bindv1alpha1.BindCatalogZoneSpec{
|
|
ClusterRef: cluster.Name,
|
|
ZoneName: "catalog.internal",
|
|
TransferKeyRef: "externaldns-key",
|
|
},
|
|
}
|
|
tsig := &bindv1alpha1.BindTSIGKey{
|
|
ObjectMeta: metav1.ObjectMeta{Name: "externaldns-key", Namespace: ns},
|
|
Spec: bindv1alpha1.BindTSIGKeySpec{ClusterRef: cluster.Name},
|
|
}
|
|
|
|
// hashWithPrimaryIP reconciles the ConfigMap with the primary pod carrying the
|
|
// given IP, then returns the resulting config-hash.
|
|
hashWithPrimaryIP := func(ip string) string {
|
|
primaryPod := &corev1.Pod{
|
|
ObjectMeta: metav1.ObjectMeta{Name: primaryPodName(cluster.Name), Namespace: ns, Labels: commonLabels(cluster.Name)},
|
|
Status: corev1.PodStatus{PodIP: ip},
|
|
}
|
|
c := fake.NewClientBuilder().
|
|
WithScheme(scheme).
|
|
WithObjects(cluster, primarySvc, catalog, tsig, primaryPod).
|
|
Build()
|
|
r := &BindClusterReconciler{Client: c, Scheme: scheme}
|
|
ctx := context.Background()
|
|
if err := r.reconcileConfigMap(ctx, cluster); err != nil {
|
|
t.Fatalf("reconcileConfigMap: %v", err)
|
|
}
|
|
// Sanity: the pod IP must not have leaked into the rendered config.
|
|
var cm corev1.ConfigMap
|
|
if err := c.Get(ctx, client.ObjectKey{Namespace: ns, Name: configMapName(cluster.Name)}, &cm); err != nil {
|
|
t.Fatalf("get configmap: %v", err)
|
|
}
|
|
for k, v := range cm.Data {
|
|
if ip != "" && strings.Contains(v, ip) {
|
|
t.Fatalf("primary pod IP %s leaked into restart-scoped config %s:\n%s", ip, k, v)
|
|
}
|
|
}
|
|
return r.configHash(ctx, cluster)
|
|
}
|
|
|
|
h1 := hashWithPrimaryIP("10.42.3.197")
|
|
h2 := hashWithPrimaryIP("10.42.9.42") // primary pod restarted onto a new IP
|
|
if h1 == "" {
|
|
t.Fatal("config hash should not be empty")
|
|
}
|
|
if h1 != h2 {
|
|
t.Fatalf("config hash changed when only the primary pod IP changed — the v0.2.5 roll loop:\n%s\n%s", h1, h2)
|
|
}
|
|
}
|