unkin-agent
70e5b0ed55
- symlink named.conf to the projected file so kubelet updates reach named - drop the config hash from the pod template; hash only the entrypoint - reconfig each pod once its mounted config matches, tracked in status - surface reconfig failures with checkconf detail on ConfigApplied
96 lines
3.2 KiB
Go
96 lines
3.2 KiB
Go
package controller
|
|
|
|
import (
|
|
"context"
|
|
"strings"
|
|
"testing"
|
|
|
|
corev1 "k8s.io/api/core/v1"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/apimachinery/pkg/runtime"
|
|
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
|
|
"sigs.k8s.io/controller-runtime/pkg/client"
|
|
"sigs.k8s.io/controller-runtime/pkg/client/fake"
|
|
|
|
bindv1alpha1 "git.unkin.net/unkin/bind-operator/api/v1alpha1"
|
|
)
|
|
|
|
// TestRenderedConfigIndependentOfPrimaryPodIP guards the v0.2.5 loop: if a pod
|
|
// IP leaks into named.conf, every pod churn re-renders config and reconfigs every
|
|
// pod. Render with the primary pod on two different IPs and require identical
|
|
// output.
|
|
func TestRenderedConfigIndependentOfPrimaryPodIP(t *testing.T) {
|
|
scheme := runtime.NewScheme()
|
|
if err := clientgoscheme.AddToScheme(scheme); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := bindv1alpha1.AddToScheme(scheme); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
const ns = "dns"
|
|
svcIP := "10.43.5.5" // stable primary Service ClusterIP (does NOT churn)
|
|
|
|
cluster := &bindv1alpha1.BindCluster{
|
|
ObjectMeta: metav1.ObjectMeta{Name: "auth", Namespace: ns},
|
|
Spec: bindv1alpha1.BindClusterSpec{
|
|
Mode: bindv1alpha1.ModeAuthoritative,
|
|
Replicas: 3,
|
|
PrimaryService: &bindv1alpha1.ClusterServiceSpec{},
|
|
},
|
|
}
|
|
primarySvc := &corev1.Service{
|
|
ObjectMeta: metav1.ObjectMeta{Name: primaryServiceName(cluster.Name), Namespace: ns},
|
|
Spec: corev1.ServiceSpec{ClusterIP: svcIP},
|
|
}
|
|
catalog := &bindv1alpha1.BindCatalogZone{
|
|
ObjectMeta: metav1.ObjectMeta{Name: "cat", Namespace: ns},
|
|
Spec: bindv1alpha1.BindCatalogZoneSpec{
|
|
ClusterRef: cluster.Name,
|
|
ZoneName: "catalog.internal",
|
|
TransferKeyRef: "externaldns-key",
|
|
},
|
|
}
|
|
tsig := &bindv1alpha1.BindTSIGKey{
|
|
ObjectMeta: metav1.ObjectMeta{Name: "externaldns-key", Namespace: ns},
|
|
Spec: bindv1alpha1.BindTSIGKeySpec{ClusterRef: cluster.Name},
|
|
}
|
|
|
|
renderWithPrimaryIP := func(ip string) string {
|
|
primaryPod := &corev1.Pod{
|
|
ObjectMeta: metav1.ObjectMeta{Name: primaryPodName(cluster.Name), Namespace: ns, Labels: commonLabels(cluster.Name)},
|
|
Status: corev1.PodStatus{PodIP: ip},
|
|
}
|
|
c := fake.NewClientBuilder().
|
|
WithScheme(scheme).
|
|
WithObjects(cluster, primarySvc, catalog, tsig, primaryPod).
|
|
Build()
|
|
r := &BindClusterReconciler{Client: c, Scheme: scheme}
|
|
ctx := context.Background()
|
|
primaryConf, secondaryConf, err := r.reconcileConfigMap(ctx, cluster)
|
|
if err != nil {
|
|
t.Fatalf("reconcileConfigMap: %v", err)
|
|
}
|
|
// Sanity: the pod IP must not have leaked into the rendered config.
|
|
var cm corev1.ConfigMap
|
|
if err := c.Get(ctx, client.ObjectKey{Namespace: ns, Name: configMapName(cluster.Name)}, &cm); err != nil {
|
|
t.Fatalf("get configmap: %v", err)
|
|
}
|
|
for k, v := range cm.Data {
|
|
if ip != "" && strings.Contains(v, ip) {
|
|
t.Fatalf("primary pod IP %s leaked into rendered config %s:\n%s", ip, k, v)
|
|
}
|
|
}
|
|
return primaryConf + secondaryConf
|
|
}
|
|
|
|
h1 := renderWithPrimaryIP("10.42.3.197")
|
|
h2 := renderWithPrimaryIP("10.42.9.42") // primary pod restarted onto a new IP
|
|
if h1 == "" {
|
|
t.Fatal("rendered config should not be empty")
|
|
}
|
|
if h1 != h2 {
|
|
t.Fatalf("rendered config changed when only the primary pod IP changed — the v0.2.5 loop:\n%s\n%s", h1, h2)
|
|
}
|
|
}
|