Move kea entrypoints out of Go fmt.Sprintf into an initContainer #6

2026-08-08T22:53:13+10:00

unkinben commented

2026-08-08 22:53:13 +10:00

Why

Container entrypoints were rendered as fmt.Sprintf shell strings in Go. Every entrypoint fix needed a full operator release, nothing was shellcheckable, and the escaping was a standing hazard. This is a behaviour-preserving cleanup for v0.1.4.

How

Add a kea-init initContainer that finalises the per-pod config and bounded-waits for HA peer DNS, replacing the in-entrypoint retry. It hardens the shared run dir to 0750, substitutes this-server-name from the pod ordinal (POD_NAME via the downward API), stages both configs into the shared emptyDir, and gates on kea-dhcp4 -t (60x2s) — failing loud after the cap so the kubelet restarts it instead of starting a doomed server.
Run the main kea-dhcp4 / kea-ctrl-agent containers with kea exec'd directly, dropping both wrapper shells.
Replace the two fmt.Sprintf entrypoints with a single committed internal/kea/scripts/init.sh embedded via go:embed and parameterised entirely by env vars — no Go string interpolation.
Add a shellcheck step to the pre-commit pipeline.

Test

Assert the pod shape: one kea-init initContainer, POD_NAME from the downward API, main containers exec kea directly, and the ConfigMap carries init.sh (not the old per-container entrypoints).
Assert init.sh hardens the socket dir, gates on kea-dhcp4 -t, fails loud after the cap, and is free of fmt verbs.
shellcheck the embedded script.

## Why Container entrypoints were rendered as `fmt.Sprintf` shell strings in Go. Every entrypoint fix needed a full operator release, nothing was shellcheckable, and the escaping was a standing hazard. This is a behaviour-preserving cleanup for v0.1.4. ## How - Add a `kea-init` initContainer that finalises the per-pod config and bounded-waits for HA peer DNS, replacing the in-entrypoint retry. It hardens the shared run dir to `0750`, substitutes `this-server-name` from the pod ordinal (`POD_NAME` via the downward API), stages both configs into the shared emptyDir, and gates on `kea-dhcp4 -t` (60x2s) — failing loud after the cap so the kubelet restarts it instead of starting a doomed server. - Run the main `kea-dhcp4` / `kea-ctrl-agent` containers with kea exec'd directly, dropping both wrapper shells. - Replace the two `fmt.Sprintf` entrypoints with a single committed `internal/kea/scripts/init.sh` embedded via `go:embed` and parameterised entirely by env vars — no Go string interpolation. - Add a shellcheck step to the pre-commit pipeline. ## Test - Assert the pod shape: one `kea-init` initContainer, `POD_NAME` from the downward API, main containers exec kea directly, and the ConfigMap carries `init.sh` (not the old per-container entrypoints). - Assert `init.sh` hardens the socket dir, gates on `kea-dhcp4 -t`, fails loud after the cap, and is free of fmt verbs. - shellcheck the embedded script.

unkinben added 1 commit 2026-08-08 22:53:13 +10:00

Move kea entrypoints out of Go fmt.Sprintf into an initContainer

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

9b3fa83dac

Container entrypoints were rendered as `fmt.Sprintf` shell strings in Go, so
every entrypoint fix needed a full operator release, nothing was shellcheckable,
and the escaping was a hazard.

How:
- Add a `kea-init` initContainer that finalises the per-pod config and
  bounded-waits for HA peer DNS, replacing the in-entrypoint retry. It hardens
  the shared run dir to 0750, substitutes `this-server-name` from the pod
  ordinal (`POD_NAME` via the downward API), stages both configs into the shared
  emptyDir, and gates on `kea-dhcp4 -t` (60x2s) — failing loud after the cap so
  the kubelet restarts it instead of starting a doomed server.
- Run the main kea-dhcp4 / kea-ctrl-agent containers with kea exec'd directly,
  dropping both wrapper shells.
- Replace the two `fmt.Sprintf` entrypoints with a single committed
  `internal/kea/scripts/init.sh` embedded via `go:embed` and parameterised
  entirely by env vars — no Go string interpolation.
- Add a shellcheck step to the pre-commit pipeline.

Test:
- Assert the pod shape: one kea-init initContainer, POD_NAME from the downward
  API, main containers exec kea directly, and the ConfigMap carries init.sh (not
  the old per-container entrypoints).
- Assert init.sh hardens the socket dir, gates on `kea-dhcp4 -t`, fails loud
  after the cap, and is free of fmt verbs.
- shellcheck the embedded script.

benvin merged commit 9795d13610 into main

2026-08-08 23:15:09 +10:00

benvin deleted branch benvin/entrypoint-refactor

2026-08-08 23:15:10 +10:00

unkinben referenced this pull request

2026-08-09 18:59:35 +10:00

Point HA peer URLs at per-pod ClusterIP Services #7

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/kea-operator#6