Merge pull request 'Wait for HA peer DNS before starting kea-dhcp4' (#5) from benvin/ha-peer-dns-wait into main

Reviewed-on: #5

internal/kea/agent.go

@@ -35,7 +35,17 @@ func EntrypointDHCP4() string {
 set -e
 ORD="${HOSTNAME##*-}"
 mkdir -p %[1]s
+chmod 0750 %[1]s
 sed "s/%[2]s/server${ORD}/g" %[3]s/kea-dhcp4.conf > %[4]s
+# The HA hook resolves peer URL hostnames once at load; on a cold container
+# start the StatefulSet peer DNS records may not resolve yet, and kea exits
+# hard instead of retrying. Wait for the config to validate before starting.
+i=0
+until %[5]s -t %[4]s >/dev/null 2>&1; do
+  i=$((i+1))
+  if [ "$i" -ge 60 ]; then break; fi
+  sleep 2
+done
 exec %[5]s -c %[4]s
 `, RunDir, ThisServerPlaceholder, ConfigDir, DHCP4ConfPath, DHCP4Bin)
 }
@@ -45,6 +55,7 @@ func EntrypointCtrlAgent() string {
 	return fmt.Sprintf(`#!/bin/sh
 set -e
 mkdir -p %[1]s
+chmod 0750 %[1]s
 cp %[2]s/kea-ctrl-agent.conf %[3]s
 exec %[4]s -c %[3]s
 `, RunDir, ConfigDir, CtrlAgentConfPath, CtrlAgentBin)

internal/kea/config_test.go

@@ -237,6 +237,29 @@ func TestRenderCtrlAgent(t *testing.T) {
 	}
 }
 
+func TestEntrypointsHardenSocketDir(t *testing.T) {
+	// Kea 2.6+ rejects a socket dir "more relaxed than 750"; the emptyDir mount
+	// defaults to 0777, so the entrypoints must chmod it before exec'ing kea.
+	want := "chmod 0750 " + RunDir
+	if ep := EntrypointDHCP4(); !strings.Contains(ep, want) {
+		t.Errorf("dhcp4 entrypoint must %q, got:\n%s", want, ep)
+	}
+	if ep := EntrypointCtrlAgent(); !strings.Contains(ep, want) {
+		t.Errorf("ctrl-agent entrypoint must %q, got:\n%s", want, ep)
+	}
+}
+
+func TestEntrypointWaitsForConfigToValidate(t *testing.T) {
+	// The dhcp4 entrypoint must gate startup on `kea-dhcp4 -t` so a cold-start
+	// HA peer DNS resolution failure retries instead of crash-looping.
+	ep := EntrypointDHCP4()
+	for _, want := range []string{"until " + DHCP4Bin + " -t " + DHCP4ConfPath, "exec " + DHCP4Bin + " -c " + DHCP4ConfPath} {
+		if !strings.Contains(ep, want) {
+			t.Errorf("dhcp4 entrypoint must contain %q, got:\n%s", want, ep)
+		}
+	}
+}
+
 func TestControlSocketPathAllowedByKea(t *testing.T) {
 	if !strings.HasPrefix(CtrlSocketPath, "/var/run/kea/") {
 		t.Errorf("CtrlSocketPath %q must live under /var/run/kea (kea 2.6+ restriction)", CtrlSocketPath)