Scaffold kea-operator: CRDs, controllers, config rendering, REST API, CI

Replace the ISC dhcpd PXE-boot VM with a Kea DHCP Kubernetes operator, modelled
on bind-operator. The operator renders kea-dhcp4 config from CRs and runs an HA
pair of kea-dhcp4 + kea-ctrl-agent servers behind an anycast Service.

- add KeaCluster/KeaSubnet/KeaClientClass/KeaAPI CRDs (group kea.unkin.net)
- render deterministic kea-dhcp4.conf + kea-ctrl-agent.conf into a ConfigMap and
  roll the StatefulSet via a config-hash annotation; best-effort hot-reload via
  the kea-ctrl-agent REST channel
- run HA hot-standby (memfile leases) with stable per-peer DNS identity from a
  StatefulSet; expose an anycast LoadBalancer Service for PureLB
- represent the full legacy dhcpd config: 198.18.13-17.0/24 pools, pool-less
  198.18.25.0/24, and the Legacy/UEFI-64 PXE arch classes (option 93)
- add the KeaAPI-spawned REST service: Terraform-friendly CRUD over subnet and
  client-class CRs (stable IDs, PUT upsert, 404 drift, bearer-token auth)
- add Makefile (patch/minor/major tag targets), distroless operator/api images,
  an AlmaLinux+EPEL kea workload image, and woodpecker CI with k8s resources +
  serviceAccountName on every step
- unit tests for config rendering, controller reconcile/config-hash, and the API

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

internal/controller/keacluster_test.go

@@ -0,0 +1,167 @@
+package controller
+
+import (
+	"context"
+	"testing"
+
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	v1alpha1 "git.unkin.net/unkin/kea-operator/api/v1alpha1"
+)
+
+func testScheme(t *testing.T) *runtime.Scheme {
+	t.Helper()
+	s := runtime.NewScheme()
+	if err := clientgoscheme.AddToScheme(s); err != nil {
+		t.Fatal(err)
+	}
+	if err := v1alpha1.AddToScheme(s); err != nil {
+		t.Fatal(err)
+	}
+	return s
+}
+
+func newClusterFixture() *v1alpha1.KeaCluster {
+	return &v1alpha1.KeaCluster{
+		ObjectMeta: metav1.ObjectMeta{Name: "pxe", Namespace: "dhcp-system"},
+		Spec: v1alpha1.KeaClusterSpec{
+			Replicas:   int32ptr(2),
+			DomainName: "main.unkin.net",
+			HA:         v1alpha1.HASpec{Mode: v1alpha1.HAHotStandby},
+		},
+	}
+}
+
+func TestKeaClusterReconcileCreatesWorkload(t *testing.T) {
+	scheme := testScheme(t)
+	cluster := newClusterFixture()
+	subnet := &v1alpha1.KeaSubnet{
+		ObjectMeta: metav1.ObjectMeta{Name: "s13", Namespace: "dhcp-system"},
+		Spec:       v1alpha1.KeaSubnetSpec{Subnet: "198.18.13.0/24", Pools: []string{"198.18.13.200 - 198.18.13.220"}},
+	}
+	cl := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithStatusSubresource(&v1alpha1.KeaCluster{}).
+		WithObjects(cluster, subnet).
+		Build()
+
+	r := &KeaClusterReconciler{Client: cl, Scheme: scheme}
+	if _, err := r.Reconcile(context.Background(), ctrl.Request{NamespacedName: types.NamespacedName{Namespace: "dhcp-system", Name: "pxe"}}); err != nil {
+		t.Fatalf("reconcile: %v", err)
+	}
+
+	// ConfigMap rendered with the subnet.
+	var cm corev1.ConfigMap
+	if err := cl.Get(context.Background(), types.NamespacedName{Namespace: "dhcp-system", Name: "pxe-config"}, &cm); err != nil {
+		t.Fatalf("configmap not created: %v", err)
+	}
+	if got := cm.Data["kea-dhcp4.conf"]; got == "" || !contains(got, "198.18.13.0/24") {
+		t.Errorf("configmap missing subnet render")
+	}
+
+	// StatefulSet with 2 containers and a config-hash annotation.
+	var sts appsv1.StatefulSet
+	if err := cl.Get(context.Background(), types.NamespacedName{Namespace: "dhcp-system", Name: "pxe"}, &sts); err != nil {
+		t.Fatalf("statefulset not created: %v", err)
+	}
+	if *sts.Spec.Replicas != 2 {
+		t.Errorf("expected 2 replicas, got %d", *sts.Spec.Replicas)
+	}
+	if len(sts.Spec.Template.Spec.Containers) != 2 {
+		t.Errorf("expected kea-dhcp4 + kea-ctrl-agent containers, got %d", len(sts.Spec.Template.Spec.Containers))
+	}
+	if sts.Spec.Template.Annotations["kea.unkin.net/config-hash"] == "" {
+		t.Errorf("missing config-hash annotation")
+	}
+
+	// Anycast + headless services.
+	for _, name := range []string{"pxe", "pxe-headless"} {
+		var svc corev1.Service
+		if err := cl.Get(context.Background(), types.NamespacedName{Namespace: "dhcp-system", Name: name}, &svc); err != nil {
+			t.Errorf("service %s not created: %v", name, err)
+		}
+	}
+}
+
+// TestConfigHashChangesWithSubnets guards the roll trigger: adding a subnet
+// must change the pod-template config hash (so the STS rolls).
+func TestConfigHashChangesWithSubnets(t *testing.T) {
+	scheme := testScheme(t)
+
+	hashFor := func(objs ...client.Object) string {
+		base := []client.Object{newClusterFixture()}
+		cl := fake.NewClientBuilder().
+			WithScheme(scheme).
+			WithStatusSubresource(&v1alpha1.KeaCluster{}).
+			WithObjects(append(base, objs...)...).
+			Build()
+		r := &KeaClusterReconciler{Client: cl, Scheme: scheme}
+		if _, err := r.Reconcile(context.Background(), ctrl.Request{NamespacedName: types.NamespacedName{Namespace: "dhcp-system", Name: "pxe"}}); err != nil {
+			t.Fatal(err)
+		}
+		var sts appsv1.StatefulSet
+		if err := cl.Get(context.Background(), types.NamespacedName{Namespace: "dhcp-system", Name: "pxe"}, &sts); err != nil {
+			t.Fatal(err)
+		}
+		return sts.Spec.Template.Annotations["kea.unkin.net/config-hash"]
+	}
+
+	empty := hashFor()
+	withSubnet := hashFor(&v1alpha1.KeaSubnet{
+		ObjectMeta: metav1.ObjectMeta{Name: "s13", Namespace: "dhcp-system"},
+		Spec:       v1alpha1.KeaSubnetSpec{Subnet: "198.18.13.0/24"},
+	})
+	if empty == withSubnet {
+		t.Errorf("config hash did not change when a subnet was added")
+	}
+}
+
+func TestClusterRefFiltersSubnets(t *testing.T) {
+	scheme := testScheme(t)
+	cluster := newClusterFixture()
+	mine := &v1alpha1.KeaSubnet{
+		ObjectMeta: metav1.ObjectMeta{Name: "mine", Namespace: "dhcp-system"},
+		Spec:       v1alpha1.KeaSubnetSpec{Subnet: "198.18.13.0/24", ClusterRef: "pxe"},
+	}
+	other := &v1alpha1.KeaSubnet{
+		ObjectMeta: metav1.ObjectMeta{Name: "other", Namespace: "dhcp-system"},
+		Spec:       v1alpha1.KeaSubnetSpec{Subnet: "10.9.9.0/24", ClusterRef: "someone-else"},
+	}
+	cl := fake.NewClientBuilder().WithScheme(scheme).
+		WithStatusSubresource(&v1alpha1.KeaCluster{}).
+		WithObjects(cluster, mine, other).Build()
+	r := &KeaClusterReconciler{Client: cl, Scheme: scheme}
+	if _, err := r.Reconcile(context.Background(), ctrl.Request{NamespacedName: types.NamespacedName{Namespace: "dhcp-system", Name: "pxe"}}); err != nil {
+		t.Fatal(err)
+	}
+	var cm corev1.ConfigMap
+	_ = cl.Get(context.Background(), types.NamespacedName{Namespace: "dhcp-system", Name: "pxe-config"}, &cm)
+	conf := cm.Data["kea-dhcp4.conf"]
+	if !contains(conf, "198.18.13.0/24") {
+		t.Errorf("cluster-matched subnet missing from config")
+	}
+	if contains(conf, "10.9.9.0/24") {
+		t.Errorf("subnet bound to another cluster leaked into config")
+	}
+}
+
+func contains(hay, needle string) bool {
+	return len(hay) >= len(needle) && (indexOf(hay, needle) >= 0)
+}
+
+func indexOf(hay, needle string) int {
+	for i := 0; i+len(needle) <= len(hay); i++ {
+		if hay[i:i+len(needle)] == needle {
+			return i
+		}
+	}
+	return -1
+}