Phase 4: SSO scaffolding, RBAC enforcement, tenant-scoped dashboards, audit logging, K8s deployment
RBAC (api/internal/authz) is live on /query and /dashboards, backed by a new enterprise/ module (session issuance, audit logging, RBAC storage, OIDC/SAML protocol wiring) that core never imports -- only calls over HTTP. Found and fixed a real cross-tenant vulnerability in dashboards (no tenant_id filtering at all) while writing the threat model doc. Two things are explicitly NOT done, documented rather than hidden: tenant isolation for log data itself (/query still shares one ClickHouse connection and Tantivy index across every tenant -- RBAC controls who can query, not what a query can see), and human SSO login (protocol wiring exists, no HTTP handler calls it yet). See docs/security/threat-model.md and docs/phase-4-runbook.md. Also adds deploy/ (Go Operator + Helm chart, validated offline only -- no cluster was reachable in this environment).
This commit is contained in:
@@ -0,0 +1,78 @@
|
||||
# deploy
|
||||
|
||||
Kubernetes deployment for Sentry, added in Phase 4 (`/deploy` was
|
||||
deliberately stubbed through Phase 3 -- see `/CLAUDE.md`'s Phase 3
|
||||
non-goals). Two pieces:
|
||||
|
||||
- `operator/` -- a small Go controller-runtime Operator managing one CRD
|
||||
(`Tenant`). See `operator/README.md`.
|
||||
- `helm/sentry/` -- a Helm chart covering every `docker-compose.yml`
|
||||
service, plus the operator and `Tenant` CRs when
|
||||
`enterprise.enabled=true`. See `helm/sentry/README.md`.
|
||||
|
||||
## What "multi-tenant-aware" means here, precisely
|
||||
|
||||
Per `/docs/phase-4-isolation-design.md`, tenant isolation itself lives at
|
||||
the **application layer** inside `enterprise/` (one `api` process holds a
|
||||
map of per-tenant ClickHouse connection pools; one `search` process holds
|
||||
a map of per-tenant Tantivy indices) -- not at the Kubernetes layer. This
|
||||
directory is **not** "one Deployment per tenant" or a general
|
||||
multi-cluster system; that's an explicit Phase 4 non-goal (see
|
||||
`/CLAUDE.md`). What it *does* add, matching that same document's exit
|
||||
criteria ("real per-tenant secret management, replacing today's single
|
||||
shared `CLICKHOUSE_PASSWORD`"):
|
||||
|
||||
- A `Tenant` CRD + controller that generates and manages one dedicated
|
||||
ClickHouse credential Secret per tenant (`operator/internal/controller`).
|
||||
- A Helm chart that can install zero-or-more `Tenant` CRs
|
||||
(`values.tenants`) alongside the rest of the stack.
|
||||
|
||||
The Operator does **not** call ClickHouse (no `CREATE DATABASE`/`CREATE
|
||||
USER`/`GRANT`) and does not touch the Tantivy filesystem or
|
||||
`enterprise/internal/rbacstore` -- that's `enterprise/internal/
|
||||
tenantprovision`, still unbuilt (see the Phase 4 task 5 summary). A
|
||||
`Tenant` reaching `status.phase: Active` here means "this tenant has a
|
||||
K8s Secret," not "this tenant's ClickHouse database/grants exist" --
|
||||
those are two different systems' state machines that aren't reconciled
|
||||
together yet, named explicitly rather than implied.
|
||||
|
||||
## Verification status -- read before trusting this against a real cluster
|
||||
|
||||
**Not verified against a live Kubernetes cluster.** This environment has
|
||||
no `kubectl`/`kind`/`minikube`/`kubebuilder`/cluster reachable, so
|
||||
nothing here has been `kubectl apply`'d or `helm install`'d for real.
|
||||
Same disclosed-limitation shape as `/agent/README.md`'s "Windows-specific
|
||||
agent code remains unverified on real Windows" from Phase 1 -- a real gap
|
||||
to close before shipping, not swept under the rug.
|
||||
|
||||
What **was** actually verified, offline, in this environment (network
|
||||
access was available to fetch these tools, but no cluster):
|
||||
|
||||
- `deploy/operator`: `go build`/`go vet`/`go test ./...` all pass,
|
||||
including reconciler tests against controller-runtime's fake client
|
||||
(`internal/controller/tenant_controller_test.go`) -- real reconcile
|
||||
logic exercised, but not against a real apiserver (no `envtest`
|
||||
binaries available; see that test file's doc comment).
|
||||
- `deploy/operator/config/crd/sentry.io_tenants.yaml`: parsed with
|
||||
`sigs.k8s.io/yaml` + strict-unmarshaled into the real
|
||||
`k8s.io/apiextensions-apiserver` `CustomResourceDefinition` Go type --
|
||||
catches YAML syntax errors and structural mistakes, not a live-cluster
|
||||
admission check.
|
||||
- `deploy/helm/sentry`: `helm lint` passes; `helm template` renders
|
||||
cleanly under both default values and a `enterprise.enabled: true` +
|
||||
two-tenant override; the rendered output was checked with `kubeconform
|
||||
-strict` against the real Kubernetes 1.31 OpenAPI schema for every
|
||||
built-in resource kind (22-29 resources depending on values, 0
|
||||
invalid) -- this catches schema mistakes (wrong field names, wrong
|
||||
types) but not whether the resources actually reconcile correctly
|
||||
together on a live cluster (Job/StatefulSet startup ordering, PVC
|
||||
provisioning, actual pod scheduling).
|
||||
- Docker image builds (`operator/Dockerfile` and every other
|
||||
`Dockerfile` this chart references) were **not** verified in this
|
||||
session -- Docker's daemon wasn't reachable here either (see the
|
||||
Phase 4 task 5 conversation for why). Build and push every image this
|
||||
chart's `values.yaml` references before installing it.
|
||||
|
||||
Before relying on this in production: `kind create cluster`, `helm
|
||||
install` with `--include-crds`, and walk through
|
||||
`helm/sentry/README.md`'s two-tenant example end to end.
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: v2
|
||||
name: sentry
|
||||
description: >-
|
||||
Sentry: Kubernetes-native distributed log aggregation. Phase 4 adds
|
||||
multi-tenant-aware deployment (per-tenant ClickHouse credential Secrets
|
||||
via the tenant-operator, optional enterprise-auth) on top of the same
|
||||
single-cluster topology Phases 0-3 ran under docker-compose -- see
|
||||
deploy/README.md for what "multi-tenant-aware" does and doesn't mean
|
||||
here.
|
||||
type: application
|
||||
version: 0.4.0
|
||||
appVersion: "phase-4"
|
||||
@@ -0,0 +1,85 @@
|
||||
# deploy/helm/sentry
|
||||
|
||||
A Helm chart covering every `docker-compose.yml` service (Redpanda,
|
||||
ClickHouse, Postgres, ingest, search, api, alerting, web) plus, when
|
||||
`enterprise.enabled: true`: enterprise-auth, the `deploy/operator`
|
||||
tenant-operator, and `Tenant` CRs from `values.tenants`. See
|
||||
`/deploy/README.md` for what "multi-tenant-aware" does and doesn't mean
|
||||
at this layer, and its verification-status section before trusting this
|
||||
against a real cluster.
|
||||
|
||||
This chart never builds images -- push every image its `values.yaml`
|
||||
references to a registry the cluster can pull from first, same division
|
||||
of labor as `docker compose build` vs. `docker compose up`.
|
||||
|
||||
## Startup ordering
|
||||
|
||||
`docker-compose.yml` uses `depends_on: condition: service_healthy` /
|
||||
`service_completed_successfully` to sequence startup (e.g. `api` waits
|
||||
for `clickhouse-migrate` to actually finish, not just for `clickhouse` to
|
||||
be reachable). This chart approximates that more loosely:
|
||||
|
||||
- Migration Jobs (`clickhouse-migrate`, `metadata-migrate`,
|
||||
`redpanda-provision`) are plain `Job` resources (not Helm hooks --
|
||||
making the StatefulSets they depend on into hooks too, to get
|
||||
ordering, would break `helm upgrade`/`helm uninstall`'s normal
|
||||
ownership tracking of stateful resources, a worse tradeoff), with
|
||||
`backoffLimit: 6` so they retry a few times if their dependency isn't
|
||||
up yet.
|
||||
- App Deployments get an `initContainer` that busy-waits for their
|
||||
dependency's **TCP port**, not for a specific Job's completion (see
|
||||
`templates/_helpers.tpl`'s `sentry.waitForTCP`) -- this covers "is
|
||||
ClickHouse/Postgres/Redpanda up" but not "has the migration Job
|
||||
actually finished."
|
||||
- The gap that leaves (a pod starts before its migration has completed)
|
||||
is covered by every Go service here already calling `os.Exit(1)` on a
|
||||
failed startup DB ping (see e.g. `api/cmd/api/main.go`) --
|
||||
Kubernetes' pod restart policy retries with backoff until the schema
|
||||
is ready. This is a real, working, but *looser* guarantee than
|
||||
docker-compose's explicit ordering -- documented here rather than
|
||||
implied to be equivalent.
|
||||
|
||||
## Trying the two-tenant example
|
||||
|
||||
```sh
|
||||
# Quote each --set value -- zsh globs an unquoted tenants[0] as a
|
||||
# pattern and fails with "no matches found."
|
||||
helm install sentry . --include-crds \
|
||||
--set enterprise.enabled=true \
|
||||
--set tenantOperator.enabled=true \
|
||||
--set 'tenants[0].name=acme' --set 'tenants[0].displayName=Acme Corp' \
|
||||
--set 'tenants[1].name=globex' --set 'tenants[1].displayName=Globex Corporation'
|
||||
|
||||
kubectl get tenants
|
||||
kubectl get secret sentry-tenant-acme-clickhouse sentry-tenant-globex-clickhouse
|
||||
```
|
||||
|
||||
This proves the K8s-side half of Phase 4's "two tenants... with their
|
||||
own users, roles, dashboards" exit criteria (`/CLAUDE.md`) -- a real
|
||||
per-tenant credential Secret exists for each. It does **not** by itself
|
||||
give either tenant a working login, dashboard, or ClickHouse database:
|
||||
those need the OIDC/SAML login handlers, `internal/tenantprovision`, and
|
||||
`internal/rbacstore` wiring the Phase 4 task 5 summary names as deferred.
|
||||
|
||||
## `web`'s image needs rebuilding per environment
|
||||
|
||||
`web` is a static SvelteKit build (`adapter-static`) -- its three API
|
||||
base URLs (`VITE_API_BASE_URL`/`VITE_ALERTING_API_BASE_URL`/
|
||||
`VITE_ENTERPRISE_AUTH_BASE_URL`) are baked in at **image build time**
|
||||
(`web/Dockerfile`'s build args), not read from the container's
|
||||
environment at runtime. `values.yaml`'s `web.builtWithApiBaseURL` etc.
|
||||
document what the image you point `web.image` at needs to have been
|
||||
built with (an Ingress hostname, a LoadBalancer IP, etc.) -- this chart
|
||||
has no Ingress resources and can't itself act on those values; rebuild
|
||||
`web`'s image with the right build args for wherever this release is
|
||||
actually reachable from a browser before pointing real users at it.
|
||||
|
||||
## Validating without a cluster
|
||||
|
||||
```sh
|
||||
helm lint .
|
||||
helm template sentry . --include-crds > /tmp/rendered.yaml
|
||||
```
|
||||
|
||||
See `/deploy/README.md`'s verification section for what was actually
|
||||
checked this way (and what wasn't -- no live cluster was available).
|
||||
@@ -0,0 +1,93 @@
|
||||
# Hand-written, not `controller-gen crd` output -- see
|
||||
# api/v1alpha1/groupversion_info.go's doc comment. Kept in sync with
|
||||
# api/v1alpha1/tenant_types.go by hand; api/v1alpha1/api_test.go's
|
||||
# round-trip tests catch a Go/YAML drift in the *shape* of the types,
|
||||
# but not a drift in this file's field descriptions/validation rules --
|
||||
# review both together when either changes.
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: tenants.sentry.io
|
||||
spec:
|
||||
group: sentry.io
|
||||
names:
|
||||
kind: Tenant
|
||||
listKind: TenantList
|
||||
plural: tenants
|
||||
singular: tenant
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
additionalPrinterColumns:
|
||||
- name: Phase
|
||||
type: string
|
||||
jsonPath: .status.phase
|
||||
- name: Age
|
||||
type: date
|
||||
jsonPath: .metadata.creationTimestamp
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
type: object
|
||||
description: >-
|
||||
Tenant is the K8s-native representation of one Sentry tenant's
|
||||
deployment-topology state -- see
|
||||
deploy/operator/internal/controller/tenant_controller.go's doc
|
||||
comment for what the controller does and does not manage.
|
||||
properties:
|
||||
apiVersion:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
type: object
|
||||
required: [displayName]
|
||||
properties:
|
||||
displayName:
|
||||
type: string
|
||||
description: Human-readable only -- the object's own metadata.name is the stable identifier.
|
||||
suspended:
|
||||
type: boolean
|
||||
description: Admin-facing lever for the Suspended phase.
|
||||
default: false
|
||||
status:
|
||||
type: object
|
||||
properties:
|
||||
phase:
|
||||
type: string
|
||||
enum: [Provisioning, Active, Suspended, Deprovisioning]
|
||||
clickHouseDatabaseName:
|
||||
type: string
|
||||
clickHouseSecretRef:
|
||||
type: string
|
||||
tantivyIndexPath:
|
||||
type: string
|
||||
observedGeneration:
|
||||
type: integer
|
||||
format: int64
|
||||
conditions:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
required: [type, status]
|
||||
properties:
|
||||
type:
|
||||
type: string
|
||||
status:
|
||||
type: string
|
||||
enum: ["True", "False", "Unknown"]
|
||||
reason:
|
||||
type: string
|
||||
message:
|
||||
type: string
|
||||
observedGeneration:
|
||||
type: integer
|
||||
format: int64
|
||||
lastTransitionTime:
|
||||
type: string
|
||||
format: date-time
|
||||
@@ -0,0 +1,55 @@
|
||||
{{/*
|
||||
Standard labels applied to every resource this chart renders.
|
||||
*/}}
|
||||
{{- define "sentry.labels" -}}
|
||||
app.kubernetes.io/part-of: sentry
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Per-component selector labels -- usage:
|
||||
{{ include "sentry.selectorLabels" (list $ "api") }}
|
||||
A plain string arg (the old shape this started with) can't reach
|
||||
$.Release from inside the defined template -- `include`'s argument
|
||||
becomes the template's entire root context, so a bare "api" string
|
||||
leaves no way to get back to the chart root. A two-element list carries
|
||||
both.
|
||||
*/}}
|
||||
{{- define "sentry.selectorLabels" -}}
|
||||
{{- $root := index . 0 -}}
|
||||
{{- $name := index . 1 -}}
|
||||
app.kubernetes.io/name: sentry-{{ $name }}
|
||||
app.kubernetes.io/instance: {{ $root.Release.Name }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
An initContainer that busy-waits for a TCP host:port to accept
|
||||
connections -- usage: {{ include "sentry.waitForTCP" (list "name-suffix" "host" "port") }}
|
||||
|
||||
This approximates docker-compose.yml's `depends_on: condition:
|
||||
service_healthy` (waits for the dependency's process to be reachable),
|
||||
but NOT `condition: service_completed_successfully` (waits for a
|
||||
one-shot Job, like clickhouse-migrate, to have actually finished). That
|
||||
second guarantee doesn't have a lightweight equivalent here without
|
||||
giving every app pod's ServiceAccount RBAC to read Job status, which is
|
||||
a lot of privilege for a startup-ordering nicety -- see
|
||||
deploy/helm/sentry/README.md's "Startup ordering" section. The gap it
|
||||
leaves (a pod starts before its migration Job has finished) is covered
|
||||
by the app's own crash-and-restart-on-connect/schema failure: every Go
|
||||
service here already os.Exit(1)s on a failed Postgres/ClickHouse ping at
|
||||
startup (see e.g. api/cmd/api/main.go), so Kubernetes' restart policy
|
||||
naturally retries until the schema is ready. Documented as a real,
|
||||
accepted tradeoff, not implied to be a hard ordering guarantee.
|
||||
*/}}
|
||||
{{- define "sentry.waitForTCP" -}}
|
||||
{{- $name := index . 0 -}}
|
||||
{{- $host := index . 1 -}}
|
||||
{{- $port := index . 2 -}}
|
||||
- name: wait-for-{{ $name }}
|
||||
image: busybox:1.36
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- until nc -z -w2 {{ $host }} {{ $port }}; do echo "waiting for {{ $host }}:{{ $port }}"; sleep 2; done
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,81 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-alerting
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
{{- include "sentry.selectorLabels" (list $ "alerting") | nindent 4 }}
|
||||
spec:
|
||||
# See values.yaml's comment: replicas is not a real knob here yet.
|
||||
replicas: {{ .Values.alerting.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "sentry.selectorLabels" (list $ "alerting") | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "sentry.selectorLabels" (list $ "alerting") | nindent 8 }}
|
||||
spec:
|
||||
initContainers:
|
||||
{{- include "sentry.waitForTCP" (list "postgres" (printf "%s-postgres" .Release.Name) "5432") | nindent 8 }}
|
||||
{{- include "sentry.waitForTCP" (list "api" (printf "%s-api" .Release.Name) "8080") | nindent 8 }}
|
||||
containers:
|
||||
- name: alerting
|
||||
image: "{{ .Values.alerting.image.repository }}:{{ .Values.alerting.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
env:
|
||||
- name: POSTGRES_ADDR
|
||||
value: "{{ .Release.Name }}-postgres:5432"
|
||||
- name: POSTGRES_DATABASE
|
||||
value: sentry_metadata
|
||||
- name: POSTGRES_USERNAME
|
||||
value: sentry
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-postgres
|
||||
key: password
|
||||
- name: API_QUERY_URL
|
||||
value: "http://{{ .Release.Name }}-api:8080"
|
||||
{{- if .Values.enterprise.enabled }}
|
||||
# RoleService credential for POST /query, once api's
|
||||
# ENTERPRISE_AUTH_URL enforcement is on -- see
|
||||
# /docs/phase-4-isolation-design.md's alerting<->api gap and
|
||||
# alerting/internal/queryclient's doc comment. NOT generated
|
||||
# by this chart: mint one with
|
||||
# `enterprise-auth -mint-service-token=alerting` (see
|
||||
# enterprise/README.md) and supply it via
|
||||
# --set-string alerting.apiServiceToken=... or a values
|
||||
# override backed by a Secret you manage -- a chart
|
||||
# generating its own long-lived service credential and
|
||||
# storing it in the same release's values would defeat the
|
||||
# point of it being a distinct, revocable credential.
|
||||
{{- if .Values.alerting.apiServiceToken }}
|
||||
- name: API_SERVICE_TOKEN
|
||||
value: {{ .Values.alerting.apiServiceToken | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8081
|
||||
readinessProbe:
|
||||
exec:
|
||||
command: ["/alerting", "-healthcheck"]
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
resources:
|
||||
{{- toYaml .Values.alerting.resources | nindent 12 }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-alerting
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
{{- include "sentry.selectorLabels" (list $ "alerting") | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
{{- include "sentry.selectorLabels" (list $ "alerting") | nindent 4 }}
|
||||
ports:
|
||||
- name: http
|
||||
port: 8081
|
||||
@@ -0,0 +1,79 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-api
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
{{- include "sentry.selectorLabels" (list $ "api") | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.api.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "sentry.selectorLabels" (list $ "api") | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "sentry.selectorLabels" (list $ "api") | nindent 8 }}
|
||||
spec:
|
||||
initContainers:
|
||||
{{- include "sentry.waitForTCP" (list "clickhouse" (printf "%s-clickhouse" .Release.Name) "9000") | nindent 8 }}
|
||||
{{- include "sentry.waitForTCP" (list "postgres" (printf "%s-postgres" .Release.Name) "5432") | nindent 8 }}
|
||||
{{- include "sentry.waitForTCP" (list "search" (printf "%s-search" .Release.Name) "50052") | nindent 8 }}
|
||||
containers:
|
||||
- name: api
|
||||
image: "{{ .Values.api.image.repository }}:{{ .Values.api.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
env:
|
||||
- name: CLICKHOUSE_ADDR
|
||||
value: "{{ .Release.Name }}-clickhouse:9000"
|
||||
- name: CLICKHOUSE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-clickhouse
|
||||
key: password
|
||||
- name: SEARCH_GRPC_ADDR
|
||||
value: "{{ .Release.Name }}-search:50052"
|
||||
- name: POSTGRES_ADDR
|
||||
value: "{{ .Release.Name }}-postgres:5432"
|
||||
- name: POSTGRES_DATABASE
|
||||
value: sentry_metadata
|
||||
- name: POSTGRES_USERNAME
|
||||
value: sentry
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-postgres
|
||||
key: password
|
||||
{{- if .Values.enterprise.enabled }}
|
||||
# Turns on authz.RequireRole*/RequireRoleOrService enforcement
|
||||
# on /query and /dashboards -- see api/internal/authz and
|
||||
# /docs/phase-4-rbac-design.md. Off (unset) when
|
||||
# enterprise.enabled is false, matching every nil-authorizer
|
||||
# no-op default in this codebase.
|
||||
- name: ENTERPRISE_AUTH_URL
|
||||
value: "http://{{ .Release.Name }}-enterprise-auth:8082"
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
readinessProbe:
|
||||
exec:
|
||||
command: ["/api", "-healthcheck"]
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
resources:
|
||||
{{- toYaml .Values.api.resources | nindent 12 }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-api
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
{{- include "sentry.selectorLabels" (list $ "api") | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
{{- include "sentry.selectorLabels" (list $ "api") | nindent 4 }}
|
||||
ports:
|
||||
- name: http
|
||||
port: 8080
|
||||
@@ -0,0 +1,103 @@
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-clickhouse
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
{{- include "sentry.selectorLabels" (list $ "clickhouse") | nindent 4 }}
|
||||
spec:
|
||||
serviceName: {{ .Release.Name }}-clickhouse
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "sentry.selectorLabels" (list $ "clickhouse") | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "sentry.selectorLabels" (list $ "clickhouse") | nindent 8 }}
|
||||
spec:
|
||||
containers:
|
||||
- name: clickhouse
|
||||
image: "{{ .Values.clickhouse.image.repository }}:{{ .Values.clickhouse.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
env:
|
||||
# Required to avoid the official image's network lockdown of
|
||||
# the implicit `default` user -- see values.yaml's comment on
|
||||
# this password and docker-compose.yml's original.
|
||||
- name: CLICKHOUSE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-clickhouse
|
||||
key: password
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8123
|
||||
- name: native
|
||||
containerPort: 9000
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /var/lib/clickhouse
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
resources:
|
||||
{{- toYaml .Values.clickhouse.resources | nindent 12 }}
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: data
|
||||
spec:
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.clickhouse.persistence.size }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-clickhouse
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
{{- include "sentry.selectorLabels" (list $ "clickhouse") | nindent 4 }}
|
||||
spec:
|
||||
clusterIP: None
|
||||
selector:
|
||||
{{- include "sentry.selectorLabels" (list $ "clickhouse") | nindent 4 }}
|
||||
ports:
|
||||
- name: http
|
||||
port: 8123
|
||||
- name: native
|
||||
port: 9000
|
||||
---
|
||||
# One-shot: applies /storage/migrations/*.sql -- same image
|
||||
# storage/Dockerfile builds for docker-compose.yml's clickhouse-migrate
|
||||
# service. Plain Job, not a Helm hook -- see redpanda.yaml's comment and
|
||||
# deploy/helm/sentry/README.md's "Startup ordering" section.
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-clickhouse-migrate
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
spec:
|
||||
backoffLimit: 6
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "sentry.selectorLabels" (list $ "clickhouse-migrate") | nindent 8 }}
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
containers:
|
||||
- name: clickhouse-migrate
|
||||
image: "{{ .Values.clickhouse.migrateImage.repository }}:{{ .Values.clickhouse.migrateImage.tag }}"
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
env:
|
||||
- name: CLICKHOUSE_HTTP
|
||||
value: "http://{{ .Release.Name }}-clickhouse:8123"
|
||||
- name: CLICKHOUSE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-clickhouse
|
||||
key: password
|
||||
@@ -0,0 +1,74 @@
|
||||
{{- if .Values.enterprise.enabled }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-enterprise-auth
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
{{- include "sentry.selectorLabels" (list $ "enterprise-auth") | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.enterprise.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "sentry.selectorLabels" (list $ "enterprise-auth") | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "sentry.selectorLabels" (list $ "enterprise-auth") | nindent 8 }}
|
||||
spec:
|
||||
containers:
|
||||
- name: enterprise-auth
|
||||
image: "{{ .Values.enterprise.image.repository }}:{{ .Values.enterprise.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
env:
|
||||
- name: ENTERPRISE_SESSION_SIGNING_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-enterprise-auth
|
||||
key: sessionSigningKey
|
||||
{{- if .Values.enterprise.oidc.issuerURL }}
|
||||
- name: OIDC_ISSUER_URL
|
||||
value: {{ .Values.enterprise.oidc.issuerURL | quote }}
|
||||
- name: OIDC_CLIENT_ID
|
||||
value: {{ .Values.enterprise.oidc.clientID | quote }}
|
||||
- name: OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-enterprise-auth
|
||||
key: oidcClientSecret
|
||||
- name: OIDC_REDIRECT_URL
|
||||
value: {{ .Values.enterprise.oidc.redirectURL | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.enterprise.saml.idpMetadataURL }}
|
||||
- name: SAML_ENTITY_ID
|
||||
value: {{ .Values.enterprise.saml.entityID | quote }}
|
||||
- name: SAML_ACS_URL
|
||||
value: {{ .Values.enterprise.saml.acsURL | quote }}
|
||||
- name: SAML_IDP_METADATA_URL
|
||||
value: {{ .Values.enterprise.saml.idpMetadataURL | quote }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8082
|
||||
readinessProbe:
|
||||
exec:
|
||||
command: ["/enterprise-auth", "-healthcheck"]
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
resources:
|
||||
{{- toYaml .Values.enterprise.resources | nindent 12 }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-enterprise-auth
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
{{- include "sentry.selectorLabels" (list $ "enterprise-auth") | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
{{- include "sentry.selectorLabels" (list $ "enterprise-auth") | nindent 4 }}
|
||||
ports:
|
||||
- name: http
|
||||
port: 8082
|
||||
{{- end }}
|
||||
@@ -0,0 +1,65 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-ingest
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
{{- include "sentry.selectorLabels" (list $ "ingest") | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.ingest.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "sentry.selectorLabels" (list $ "ingest") | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "sentry.selectorLabels" (list $ "ingest") | nindent 8 }}
|
||||
spec:
|
||||
initContainers:
|
||||
{{- include "sentry.waitForTCP" (list "redpanda" (printf "%s-redpanda" .Release.Name) "9092") | nindent 8 }}
|
||||
{{- include "sentry.waitForTCP" (list "clickhouse" (printf "%s-clickhouse" .Release.Name) "9000") | nindent 8 }}
|
||||
containers:
|
||||
- name: ingest
|
||||
image: "{{ .Values.ingest.image.repository }}:{{ .Values.ingest.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
env:
|
||||
- name: REDPANDA_BROKERS
|
||||
value: "{{ .Release.Name }}-redpanda:9092"
|
||||
- name: CLICKHOUSE_ADDR
|
||||
value: "{{ .Release.Name }}-clickhouse:9000"
|
||||
- name: CLICKHOUSE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-clickhouse
|
||||
key: password
|
||||
ports:
|
||||
- name: grpc
|
||||
containerPort: 4317
|
||||
{{- if .Values.ingest.tlsSecretName }}
|
||||
volumeMounts:
|
||||
- name: tls
|
||||
mountPath: /etc/sentry-ingest
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.ingest.resources | nindent 12 }}
|
||||
{{- if .Values.ingest.tlsSecretName }}
|
||||
volumes:
|
||||
- name: tls
|
||||
secret:
|
||||
secretName: {{ .Values.ingest.tlsSecretName }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-ingest
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
{{- include "sentry.selectorLabels" (list $ "ingest") | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
{{- include "sentry.selectorLabels" (list $ "ingest") | nindent 4 }}
|
||||
ports:
|
||||
- name: grpc
|
||||
port: 4317
|
||||
@@ -0,0 +1,110 @@
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-postgres
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
{{- include "sentry.selectorLabels" (list $ "postgres") | nindent 4 }}
|
||||
spec:
|
||||
serviceName: {{ .Release.Name }}-postgres
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "sentry.selectorLabels" (list $ "postgres") | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "sentry.selectorLabels" (list $ "postgres") | nindent 8 }}
|
||||
spec:
|
||||
containers:
|
||||
- name: postgres
|
||||
image: "{{ .Values.postgres.image.repository }}:{{ .Values.postgres.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
env:
|
||||
- name: POSTGRES_DB
|
||||
value: sentry_metadata
|
||||
- name: POSTGRES_USER
|
||||
value: sentry
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-postgres
|
||||
key: password
|
||||
ports:
|
||||
- name: postgres
|
||||
containerPort: 5432
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /var/lib/postgresql/data
|
||||
readinessProbe:
|
||||
exec:
|
||||
command: ["pg_isready", "-U", "sentry", "-d", "sentry_metadata"]
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
resources:
|
||||
{{- toYaml .Values.postgres.resources | nindent 12 }}
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: data
|
||||
spec:
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.postgres.persistence.size }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-postgres
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
{{- include "sentry.selectorLabels" (list $ "postgres") | nindent 4 }}
|
||||
spec:
|
||||
clusterIP: None
|
||||
selector:
|
||||
{{- include "sentry.selectorLabels" (list $ "postgres") | nindent 4 }}
|
||||
ports:
|
||||
- name: postgres
|
||||
port: 5432
|
||||
---
|
||||
# One-shot: applies /metadata/migrations/*.sql (including Phase 4's
|
||||
# tenants/users/tenant_memberships/audit_log schema) -- same image
|
||||
# metadata/Dockerfile builds for docker-compose.yml's metadata-migrate
|
||||
# service. Plain Job, not a Helm hook -- see redpanda.yaml's comment.
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-metadata-migrate
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
spec:
|
||||
backoffLimit: 6
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "sentry.selectorLabels" (list $ "metadata-migrate") | nindent 8 }}
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
containers:
|
||||
- name: metadata-migrate
|
||||
image: "{{ .Values.postgres.migrateImage.repository }}:{{ .Values.postgres.migrateImage.tag }}"
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
env:
|
||||
- name: POSTGRES_HOST
|
||||
value: "{{ .Release.Name }}-postgres"
|
||||
- name: POSTGRES_PORT
|
||||
value: "5432"
|
||||
- name: POSTGRES_USER
|
||||
value: sentry
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-postgres
|
||||
key: password
|
||||
- name: POSTGRES_DATABASE
|
||||
value: sentry_metadata
|
||||
- name: AUDIT_WRITER_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-postgres
|
||||
key: auditWriterPassword
|
||||
@@ -0,0 +1,108 @@
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-redpanda
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
{{- include "sentry.selectorLabels" (list $ "redpanda") | nindent 4 }}
|
||||
spec:
|
||||
serviceName: {{ .Release.Name }}-redpanda
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "sentry.selectorLabels" (list $ "redpanda") | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "sentry.selectorLabels" (list $ "redpanda") | nindent 8 }}
|
||||
spec:
|
||||
containers:
|
||||
- name: redpanda
|
||||
image: "{{ .Values.redpanda.image.repository }}:{{ .Values.redpanda.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
args:
|
||||
- redpanda
|
||||
- start
|
||||
- --smp=1
|
||||
- --memory=1G
|
||||
- --reserve-memory=0M
|
||||
- --overprovisioned
|
||||
- --node-id=0
|
||||
- --check=false
|
||||
- --kafka-addr=PLAINTEXT://0.0.0.0:9092
|
||||
- --advertise-kafka-addr=PLAINTEXT://{{ .Release.Name }}-redpanda:9092
|
||||
ports:
|
||||
- name: kafka
|
||||
containerPort: 9092
|
||||
- name: admin
|
||||
containerPort: 9644
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /var/lib/redpanda/data
|
||||
readinessProbe:
|
||||
exec:
|
||||
command: ["rpk", "cluster", "health", "--exit-when-healthy"]
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
resources:
|
||||
{{- toYaml .Values.redpanda.resources | nindent 12 }}
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: data
|
||||
spec:
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.redpanda.persistence.size }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-redpanda
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
{{- include "sentry.selectorLabels" (list $ "redpanda") | nindent 4 }}
|
||||
spec:
|
||||
clusterIP: None
|
||||
selector:
|
||||
{{- include "sentry.selectorLabels" (list $ "redpanda") | nindent 4 }}
|
||||
ports:
|
||||
- name: kafka
|
||||
port: 9092
|
||||
- name: admin
|
||||
port: 9644
|
||||
---
|
||||
# One-shot: creates the sentry.logs.raw topic. Same image
|
||||
# transport/Dockerfile builds for docker-compose.yml's redpanda-provision
|
||||
# service. Deliberately a plain Job, not a Helm hook -- see
|
||||
# deploy/helm/sentry/README.md's "Startup ordering" section for why
|
||||
# (StatefulSets-as-hooks breaks helm upgrade/uninstall's ownership
|
||||
# tracking of stateful resources). backoffLimit gives it room to retry
|
||||
# until redpanda's StatefulSet is actually ready; ingest/search's own
|
||||
# crash-and-restart-on-connect-failure covers the rest of the ordering,
|
||||
# same as every dependency in this chart.
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-redpanda-provision
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
spec:
|
||||
backoffLimit: 6
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "sentry.selectorLabels" (list $ "redpanda-provision") | nindent 8 }}
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
containers:
|
||||
- name: redpanda-provision
|
||||
image: "{{ .Values.redpanda.provisionImage.repository }}:{{ .Values.redpanda.provisionImage.tag }}"
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
env:
|
||||
- name: REDPANDA_BROKERS
|
||||
value: "{{ .Release.Name }}-redpanda:9092"
|
||||
- name: REDPANDA_ADMIN_HOSTS
|
||||
value: "{{ .Release.Name }}-redpanda:9644"
|
||||
- name: REDPANDA_TOPIC_PARTITIONS
|
||||
value: "6"
|
||||
@@ -0,0 +1,71 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-search
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
{{- include "sentry.selectorLabels" (list $ "search") | nindent 4 }}
|
||||
spec:
|
||||
# See values.yaml's comment: replicas is not a real knob here yet.
|
||||
replicas: {{ .Values.search.replicas }}
|
||||
strategy:
|
||||
type: Recreate # single PVC below (ReadWriteOnce) -- avoid two pods racing to mount it during a rollout
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "sentry.selectorLabels" (list $ "search") | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "sentry.selectorLabels" (list $ "search") | nindent 8 }}
|
||||
spec:
|
||||
initContainers:
|
||||
{{- include "sentry.waitForTCP" (list "redpanda" (printf "%s-redpanda" .Release.Name) "9092") | nindent 8 }}
|
||||
containers:
|
||||
- name: search
|
||||
image: "{{ .Values.search.image.repository }}:{{ .Values.search.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
env:
|
||||
- name: REDPANDA_BROKERS
|
||||
value: "{{ .Release.Name }}-redpanda:9092"
|
||||
- name: REDPANDA_TOPIC_PARTITIONS
|
||||
value: "6"
|
||||
- name: RUST_LOG
|
||||
value: "info"
|
||||
ports:
|
||||
- name: grpc
|
||||
containerPort: 50052
|
||||
volumeMounts:
|
||||
- name: index-data
|
||||
mountPath: /var/lib/sentry-search
|
||||
resources:
|
||||
{{- toYaml .Values.search.resources | nindent 12 }}
|
||||
volumes:
|
||||
- name: index-data
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ .Release.Name }}-search-index
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-search-index
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
spec:
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.search.persistence.size }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-search
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
{{- include "sentry.selectorLabels" (list $ "search") | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
{{- include "sentry.selectorLabels" (list $ "search") | nindent 4 }}
|
||||
ports:
|
||||
- name: grpc
|
||||
port: 50052
|
||||
@@ -0,0 +1,81 @@
|
||||
{{/*
|
||||
Shared control-plane secrets -- the cluster-wide passwords
|
||||
docker-compose.yml hardcodes as "sentry-dev-only"/etc (see its
|
||||
clickhouse/metadata-postgres/metadata-migrate comments) become real
|
||||
generated-or-supplied Secrets here. Each follows the same pattern: a
|
||||
values override wins if set, otherwise a value is generated once and
|
||||
kept stable across `helm upgrade` via `lookup` (so upgrades don't
|
||||
silently rotate a live credential out from under a running Deployment --
|
||||
same "never rotate a live credential without coordinating the
|
||||
consumer-side change" reasoning as
|
||||
deploy/operator/internal/controller/tenant_controller.go's
|
||||
reconcileSecret). `lookup` returns nothing under `helm template`
|
||||
(no live cluster) -- expected; see deploy/README.md's verification
|
||||
section for what that means for this file specifically.
|
||||
*/}}
|
||||
{{- define "sentry.stableSecretValue" -}}
|
||||
{{- $ns := index . 0 -}}
|
||||
{{- $name := index . 1 -}}
|
||||
{{- $key := index . 2 -}}
|
||||
{{- $override := index . 3 -}}
|
||||
{{- $existing := lookup "v1" "Secret" $ns $name -}}
|
||||
{{- if $override -}}
|
||||
{{ $override }}
|
||||
{{- else if $existing -}}
|
||||
{{ index $existing.data $key | b64dec }}
|
||||
{{- else -}}
|
||||
{{ randAlphaNum 40 }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-clickhouse
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
stringData:
|
||||
# The official clickhouse-server image locks down *network* access
|
||||
# entirely for the implicit `default` user unless this is genuinely
|
||||
# non-empty -- see docker-compose.yml's clickhouse service comment.
|
||||
# Not a substitute for task 2's per-tenant credentials (still unbuilt
|
||||
# -- see deploy/operator's Tenant controller); this is the shared
|
||||
# admin/migration credential only.
|
||||
password: {{ include "sentry.stableSecretValue" (list .Release.Namespace (printf "%s-clickhouse" .Release.Name) "password" .Values.clickhouse.password) }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-postgres
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
stringData:
|
||||
password: {{ include "sentry.stableSecretValue" (list .Release.Namespace (printf "%s-postgres" .Release.Name) "password" .Values.postgres.password) }}
|
||||
# Restricted audit_writer Postgres role (Phase 4 task 4) -- INSERT+SELECT
|
||||
# only, via its own pool, never the shared role above. See
|
||||
# /docs/phase-4-isolation-design.md's audit-logging section and
|
||||
# metadata/README.md.
|
||||
auditWriterPassword: {{ include "sentry.stableSecretValue" (list .Release.Namespace (printf "%s-postgres" .Release.Name) "auditWriterPassword" .Values.postgres.auditWriterPassword) }}
|
||||
{{- if .Values.enterprise.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-enterprise-auth
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
stringData:
|
||||
# Must be >= 32 bytes -- see enterprise/internal/config.Load and
|
||||
# enterprise/internal/session.MinSigningKeyBytes. Rotating this
|
||||
# invalidates every outstanding session/service token -- same
|
||||
# "don't rotate a live credential silently" reasoning as above,
|
||||
# which is why it's kept stable via the lookup above rather than
|
||||
# regenerated on every `helm upgrade`.
|
||||
sessionSigningKey: {{ include "sentry.stableSecretValue" (list .Release.Namespace (printf "%s-enterprise-auth" .Release.Name) "sessionSigningKey" .Values.enterprise.sessionSigningKey) }}
|
||||
{{- if .Values.enterprise.oidc.clientSecret }}
|
||||
oidcClientSecret: {{ .Values.enterprise.oidc.clientSecret | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,92 @@
|
||||
{{- if and .Values.enterprise.enabled .Values.tenantOperator.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-tenant-operator
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
---
|
||||
# ClusterRole, not Role: Tenant is cluster-scoped-CRD-but-namespaced-object
|
||||
# (see crds/sentry.io_tenants.yaml's scope: Namespaced), and this chart
|
||||
# doesn't assume it's the only namespace the operator might one day watch
|
||||
# -- narrowed to exactly the two resource types
|
||||
# deploy/operator/internal/controller/tenant_controller.go's
|
||||
# +kubebuilder:rbac markers name (tenants, tenants/status, secrets), not
|
||||
# a wildcard grant.
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-tenant-operator
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["sentry.io"]
|
||||
resources: ["tenants"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["sentry.io"]
|
||||
resources: ["tenants/status"]
|
||||
verbs: ["get", "update", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-tenant-operator
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ .Release.Name }}-tenant-operator
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ .Release.Name }}-tenant-operator
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-tenant-operator
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
{{- include "sentry.selectorLabels" (list $ "tenant-operator") | nindent 4 }}
|
||||
spec:
|
||||
# One replica -- see deploy/operator/cmd/tenant-operator/main.go's
|
||||
# comment: no leader election yet, a second replica could
|
||||
# double-generate a Secret.
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "sentry.selectorLabels" (list $ "tenant-operator") | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "sentry.selectorLabels" (list $ "tenant-operator") | nindent 8 }}
|
||||
spec:
|
||||
serviceAccountName: {{ .Release.Name }}-tenant-operator
|
||||
containers:
|
||||
- name: tenant-operator
|
||||
image: "{{ .Values.tenantOperator.image.repository }}:{{ .Values.tenantOperator.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: 8080
|
||||
- name: probes
|
||||
containerPort: 8081
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: probes
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: probes
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
resources:
|
||||
{{- toYaml .Values.tenantOperator.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,14 @@
|
||||
{{- if .Values.enterprise.enabled }}
|
||||
{{- range .Values.tenants }}
|
||||
---
|
||||
apiVersion: sentry.io/v1alpha1
|
||||
kind: Tenant
|
||||
metadata:
|
||||
name: {{ .name }}
|
||||
labels:
|
||||
{{- include "sentry.labels" $ | nindent 4 }}
|
||||
spec:
|
||||
displayName: {{ .displayName | default .name | quote }}
|
||||
suspended: {{ .suspended | default false }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,43 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-web
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
{{- include "sentry.selectorLabels" (list $ "web") | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.web.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "sentry.selectorLabels" (list $ "web") | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "sentry.selectorLabels" (list $ "web") | nindent 8 }}
|
||||
spec:
|
||||
containers:
|
||||
- name: web
|
||||
# No env vars here -- see values.yaml's web.builtWith* comment:
|
||||
# this is a static build, its API base URLs are baked into the
|
||||
# image, not configurable at the Deployment level.
|
||||
image: "{{ .Values.web.image.repository }}:{{ .Values.web.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 3000
|
||||
resources:
|
||||
{{- toYaml .Values.web.resources | nindent 12 }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-web
|
||||
labels:
|
||||
{{- include "sentry.labels" . | nindent 4 }}
|
||||
{{- include "sentry.selectorLabels" (list $ "web") | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
{{- include "sentry.selectorLabels" (list $ "web") | nindent 4 }}
|
||||
ports:
|
||||
- name: http
|
||||
port: 3000
|
||||
@@ -0,0 +1,180 @@
|
||||
# Default values for the sentry chart. See deploy/helm/sentry/README.md
|
||||
# for the multi-tenant-specific values (enterprise.*, tenants) and what
|
||||
# "multi-tenant-aware" does and doesn't mean at this layer.
|
||||
#
|
||||
# Image repositories default to locally-built tags matching each
|
||||
# service's docker-compose.yml container_name, minus the "sentry-"
|
||||
# container_name prefix duplication -- push these to a registry this
|
||||
# cluster can actually pull from before installing; this chart never
|
||||
# builds images itself (same division of labor as docker-compose.yml:
|
||||
# `docker compose build` vs. `docker compose up`).
|
||||
|
||||
global:
|
||||
imagePullPolicy: IfNotPresent
|
||||
|
||||
redpanda:
|
||||
image:
|
||||
repository: docker.redpanda.com/redpandadata/redpanda
|
||||
tag: v24.2.7
|
||||
persistence:
|
||||
size: 10Gi
|
||||
resources: {}
|
||||
# Built from ./transport (docker-compose.yml's redpanda-provision
|
||||
# service) -- the one-shot topic-creation Job below.
|
||||
provisionImage:
|
||||
repository: sentry-redpanda-provision
|
||||
tag: latest
|
||||
|
||||
clickhouse:
|
||||
image:
|
||||
repository: clickhouse/clickhouse-server
|
||||
tag: "24.8"
|
||||
persistence:
|
||||
size: 20Gi
|
||||
resources: {}
|
||||
# Leave empty to auto-generate and persist across upgrades -- see
|
||||
# templates/secrets.yaml's stableSecretValue helper.
|
||||
password: ""
|
||||
# Built from ./storage (docker-compose.yml's clickhouse-migrate
|
||||
# service) -- the one-shot schema-migration Job.
|
||||
migrateImage:
|
||||
repository: sentry-clickhouse-migrate
|
||||
tag: latest
|
||||
|
||||
postgres:
|
||||
image:
|
||||
repository: postgres
|
||||
tag: 16-alpine
|
||||
persistence:
|
||||
size: 10Gi
|
||||
resources: {}
|
||||
password: ""
|
||||
auditWriterPassword: ""
|
||||
# Built from ./metadata (docker-compose.yml's metadata-migrate
|
||||
# service) -- the one-shot schema-migration Job.
|
||||
migrateImage:
|
||||
repository: sentry-metadata-migrate
|
||||
tag: latest
|
||||
|
||||
ingest:
|
||||
image:
|
||||
repository: sentry-ingest
|
||||
tag: latest
|
||||
replicas: 1
|
||||
resources: {}
|
||||
# mTLS server cert/key/CA -- see hack/dev-certs/generate.sh for the
|
||||
# dev equivalent of what this Secret must contain
|
||||
# (server.pem/server-key.pem/ca.pem) in a real deployment. Unlike
|
||||
# docker-compose.yml's bind-mounted ./hack/dev-certs/out, a cluster
|
||||
# deployment supplies this as a real Secret -- named here, not
|
||||
# generated by this chart (cert issuance is out of scope, same
|
||||
# "boring, well-understood" preference as everywhere else in this
|
||||
# repo -- use cert-manager or an equivalent, don't hand-roll it here).
|
||||
tlsSecretName: ""
|
||||
|
||||
search:
|
||||
image:
|
||||
repository: sentry-search
|
||||
tag: latest
|
||||
# Pinned to 1: search consumes the same Redpanda topic ingest's
|
||||
# consumer does with its own offset tracking (see search/README.md).
|
||||
# A second replica would form a second, independent consumer instance
|
||||
# against the same partitions with no coordination -- correctness,
|
||||
# not just resource waste, is the reason this isn't a `replicas` knob
|
||||
# yet. Matches CLAUDE.md's Phase 4 non-goal: "no general multi-cluster
|
||||
# orchestration."
|
||||
replicas: 1
|
||||
resources: {}
|
||||
persistence:
|
||||
size: 20Gi
|
||||
|
||||
api:
|
||||
image:
|
||||
repository: sentry-api
|
||||
tag: latest
|
||||
replicas: 2
|
||||
resources: {}
|
||||
|
||||
alerting:
|
||||
image:
|
||||
repository: sentry-alerting
|
||||
tag: latest
|
||||
# Pinned to 1 for the same reason as search: rulestore.ClaimDueRules
|
||||
# has no leader-election/partitioning story for multiple evaluator
|
||||
# replicas yet -- two would both try to claim and evaluate the same
|
||||
# due rules. Named explicitly rather than silently defaulted, since
|
||||
# it's the kind of knob someone reasonably expects to just work.
|
||||
replicas: 1
|
||||
resources: {}
|
||||
# See templates/alerting.yaml's comment -- only meaningful when
|
||||
# enterprise.enabled is true. Empty by default.
|
||||
apiServiceToken: ""
|
||||
|
||||
web:
|
||||
image:
|
||||
repository: sentry-web
|
||||
tag: latest
|
||||
replicas: 2
|
||||
resources: {}
|
||||
# NOT wired to any Deployment env var -- web is a static SvelteKit
|
||||
# build (adapter-static, see web/package.json), and VITE_API_BASE_URL/
|
||||
# VITE_ALERTING_API_BASE_URL/VITE_ENTERPRISE_AUTH_BASE_URL are baked in
|
||||
# at *image build time* (docker-compose.yml's web.build.args), not
|
||||
# read at container runtime. Deploying this chart into a real cluster
|
||||
# means rebuilding the web image with these three build args pointed
|
||||
# at wherever api/alerting/enterprise-auth are actually reachable from
|
||||
# a browser (an Ingress host, a LoadBalancer IP, etc.) -- this section
|
||||
# exists to document that requirement, not because the chart can act
|
||||
# on it.
|
||||
builtWithApiBaseURL: "http://localhost:8080"
|
||||
builtWithAlertingApiBaseURL: "http://localhost:8081"
|
||||
builtWithEnterpriseAuthBaseURL: "http://localhost:8082"
|
||||
|
||||
# enterprise-auth (commercial license) + the tenant-operator that
|
||||
# reconciles the Tenant CRD -- both off by default, matching
|
||||
# docker-compose.yml's own "included, not wired into enforcement by
|
||||
# default" stance (see its enterprise-auth service comment) and
|
||||
# enterprise/README.md's "Status" section on what's built vs. deferred.
|
||||
enterprise:
|
||||
enabled: false
|
||||
image:
|
||||
repository: sentry-enterprise-auth
|
||||
tag: latest
|
||||
replicas: 1
|
||||
resources: {}
|
||||
# Leave empty to auto-generate (>= 32 bytes) and persist across
|
||||
# upgrades -- see templates/secrets.yaml.
|
||||
sessionSigningKey: ""
|
||||
oidc:
|
||||
issuerURL: ""
|
||||
clientID: ""
|
||||
clientSecret: ""
|
||||
redirectURL: ""
|
||||
saml:
|
||||
entityID: ""
|
||||
acsURL: ""
|
||||
idpMetadataURL: ""
|
||||
|
||||
# Installs deploy/operator (the Tenant CRD controller) alongside this
|
||||
# chart. Only meaningful when enterprise.enabled is also true --
|
||||
# gated on that, not a separate flag, since a Tenant CR with no
|
||||
# enterprise-auth deployed to consume its Secret has nothing to do.
|
||||
tenantOperator:
|
||||
enabled: false
|
||||
image:
|
||||
repository: sentry-tenant-operator
|
||||
tag: latest
|
||||
resources: {}
|
||||
|
||||
# One entry per tenant to provision -- rendered as Tenant CRs
|
||||
# (templates/tenants.yaml), reconciled by the tenant-operator into a
|
||||
# per-tenant ClickHouse credential Secret. See
|
||||
# deploy/operator/internal/controller/tenant_controller.go's doc comment
|
||||
# for exactly what that does and doesn't set up. Empty by default; a
|
||||
# real two-tenant deployment (Phase 4's exit criteria) sets e.g.:
|
||||
# tenants:
|
||||
# - name: acme
|
||||
# displayName: "Acme Corp"
|
||||
# - name: globex
|
||||
# displayName: "Globex Corporation"
|
||||
tenants: []
|
||||
@@ -0,0 +1,12 @@
|
||||
# Same shape as every other Go service's Dockerfile in this repo
|
||||
# (alerting/Dockerfile, enterprise/Dockerfile) -- context is
|
||||
# deploy/operator/ itself, no /proto dependency.
|
||||
# docker build -f deploy/operator/Dockerfile -t sentry-tenant-operator deploy/operator/
|
||||
FROM golang:1.25-alpine AS builder
|
||||
WORKDIR /src
|
||||
COPY . .
|
||||
RUN CGO_ENABLED=0 GOOS=linux go build -o /out/tenant-operator ./cmd/tenant-operator
|
||||
|
||||
FROM gcr.io/distroless/static-debian12
|
||||
COPY --from=builder /out/tenant-operator /tenant-operator
|
||||
ENTRYPOINT ["/tenant-operator"]
|
||||
@@ -0,0 +1,81 @@
|
||||
# deploy/operator
|
||||
|
||||
A small `controller-runtime` Operator managing one CRD: `Tenant`
|
||||
(`sentry.io/v1alpha1`). See `internal/controller/tenant_controller.go`'s
|
||||
doc comment for exactly what it reconciles and -- just as importantly --
|
||||
what it deliberately doesn't (no ClickHouse calls, no Tantivy filesystem
|
||||
access, no `enterprise/internal/rbacstore` wiring; those are
|
||||
`enterprise/internal/tenantprovision`, still unbuilt).
|
||||
|
||||
## Not kubebuilder-scaffolded
|
||||
|
||||
No `kubebuilder`/`controller-gen` binary was available in this
|
||||
environment, so this package is hand-written rather than generated:
|
||||
|
||||
- `api/v1alpha1/zz_generated.deepcopy.go` -- normally `controller-gen
|
||||
object` output; hand-written here, covered by
|
||||
`api/v1alpha1/api_test.go`'s round-trip tests (mutate a copy, assert
|
||||
the original is untouched -- exactly the class of bug a hand-written
|
||||
`DeepCopy` is prone to).
|
||||
- `config/crd/sentry.io_tenants.yaml` -- normally `controller-gen crd`
|
||||
output from the `+kubebuilder:validation:*` markers on
|
||||
`api/v1alpha1/tenant_types.go`; hand-written here and only as strong as
|
||||
keeping the two in sync by hand. Validated by strict-unmarshaling it
|
||||
into the real `k8s.io/apiextensions-apiserver` Go type (see
|
||||
`/deploy/README.md`'s verification section) -- catches YAML/structural
|
||||
mistakes, not a drift between the CRD's field *descriptions* and the
|
||||
Go doc comments.
|
||||
- `+kubebuilder:rbac` markers on `internal/controller/tenant_controller.go`
|
||||
are present as documentation/intent (matching kubebuilder convention)
|
||||
but were never run through `controller-gen rbac` -- the actual
|
||||
ClusterRole is hand-written in
|
||||
`/deploy/helm/sentry/templates/tenant-operator.yaml`, kept in sync with
|
||||
those markers by hand, same caveat as the CRD above.
|
||||
|
||||
## Layout
|
||||
|
||||
```
|
||||
api/v1alpha1/ Tenant, TenantSpec, TenantStatus -- the CRD's Go types
|
||||
internal/controller/ TenantReconciler -- see its doc comment
|
||||
cmd/tenant-operator/ main.go -- manager setup, matches every other
|
||||
service's cmd/<name>/main.go convention in this repo
|
||||
config/crd/ hand-written CRD YAML (see above)
|
||||
```
|
||||
|
||||
## Building & testing
|
||||
|
||||
```sh
|
||||
go build ./...
|
||||
go vet ./...
|
||||
go test ./...
|
||||
```
|
||||
|
||||
Tests use `sigs.k8s.io/controller-runtime/pkg/client/fake`, not
|
||||
`envtest` -- `envtest` needs a real `kube-apiserver`/`etcd` binary pair
|
||||
(`setup-envtest`) not available in this environment. The fake client
|
||||
exercises real reconcile logic (object CRUD, owner references, status
|
||||
writes) but not anything a real apiserver does for you (admission,
|
||||
garbage collection, watch-triggered re-reconciliation) -- see
|
||||
`internal/controller/tenant_controller_test.go`'s doc comment.
|
||||
|
||||
```sh
|
||||
docker build -f Dockerfile -t sentry-tenant-operator . # context is deploy/operator/, not the repo root
|
||||
```
|
||||
|
||||
Not verified in this session -- see `/deploy/README.md`.
|
||||
|
||||
## Trying it against a real cluster
|
||||
|
||||
```sh
|
||||
kubectl apply -f config/crd/sentry.io_tenants.yaml
|
||||
kubectl apply -f - <<'EOF'
|
||||
apiVersion: sentry.io/v1alpha1
|
||||
kind: Tenant
|
||||
metadata:
|
||||
name: acme
|
||||
spec:
|
||||
displayName: "Acme Corp"
|
||||
EOF
|
||||
kubectl get tenant acme -o yaml # status.phase should reach Active
|
||||
kubectl get secret sentry-tenant-acme-clickhouse -o yaml
|
||||
```
|
||||
@@ -0,0 +1,71 @@
|
||||
// Exercises the hand-written DeepCopy methods in zz_generated.deepcopy.go
|
||||
// -- see that file's doc comment for why these aren't controller-gen
|
||||
// output here. A DeepCopy that accidentally shares a slice/map with the
|
||||
// original is a real, easy-to-introduce bug (client-go relies on
|
||||
// DeepCopyObject returning something safe to mutate independently), so
|
||||
// these tests mutate the copy and assert the original is unaffected.
|
||||
package v1alpha1
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
)
|
||||
|
||||
func TestTenantDeepCopyIsIndependent(t *testing.T) {
|
||||
orig := &Tenant{
|
||||
ObjectMeta: metav1.ObjectMeta{Name: "acme", Labels: map[string]string{"a": "1"}},
|
||||
Spec: TenantSpec{DisplayName: "Acme", Suspended: false},
|
||||
Status: TenantStatus{
|
||||
Phase: PhaseActive,
|
||||
Conditions: []metav1.Condition{
|
||||
{Type: ConditionReady, Status: metav1.ConditionTrue, Reason: "x"},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
cp := orig.DeepCopy()
|
||||
cp.Spec.DisplayName = "Changed"
|
||||
cp.Status.Conditions[0].Reason = "changed"
|
||||
cp.Labels["a"] = "changed"
|
||||
|
||||
if orig.Spec.DisplayName != "Acme" {
|
||||
t.Fatalf("mutating the copy's Spec affected the original: %q", orig.Spec.DisplayName)
|
||||
}
|
||||
if orig.Status.Conditions[0].Reason != "x" {
|
||||
t.Fatalf("mutating the copy's Conditions affected the original: %q", orig.Status.Conditions[0].Reason)
|
||||
}
|
||||
// Labels comes from metav1.ObjectMeta.DeepCopyInto, which this
|
||||
// package doesn't implement itself -- this assertion is really
|
||||
// checking that Tenant.DeepCopyInto actually calls
|
||||
// ObjectMeta.DeepCopyInto rather than doing a shallow `out.ObjectMeta
|
||||
// = in.ObjectMeta`.
|
||||
if orig.Labels["a"] != "1" {
|
||||
t.Fatalf("mutating the copy's Labels affected the original: %q", orig.Labels["a"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestTenantDeepCopyObjectPreservesData(t *testing.T) {
|
||||
orig := &Tenant{ObjectMeta: metav1.ObjectMeta{Name: "acme"}, Spec: TenantSpec{DisplayName: "Acme"}}
|
||||
obj := orig.DeepCopyObject()
|
||||
cp, ok := obj.(*Tenant)
|
||||
if !ok {
|
||||
t.Fatalf("DeepCopyObject returned %T, want *Tenant", obj)
|
||||
}
|
||||
if cp.Name != "acme" || cp.Spec.DisplayName != "Acme" {
|
||||
t.Fatalf("unexpected copy: %+v", cp)
|
||||
}
|
||||
}
|
||||
|
||||
func TestTenantListDeepCopyIsIndependent(t *testing.T) {
|
||||
orig := &TenantList{Items: []Tenant{
|
||||
{ObjectMeta: metav1.ObjectMeta{Name: "acme"}},
|
||||
{ObjectMeta: metav1.ObjectMeta{Name: "globex"}},
|
||||
}}
|
||||
cp := orig.DeepCopy()
|
||||
cp.Items[0].Name = "changed"
|
||||
|
||||
if orig.Items[0].Name != "acme" {
|
||||
t.Fatalf("mutating the copy's Items affected the original: %q", orig.Items[0].Name)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,27 @@
|
||||
// Package v1alpha1 contains the Tenant API's Go types -- kubebuilder's
|
||||
// standard api/<version>/ layout, hand-written rather than scaffolded
|
||||
// (no kubebuilder/controller-gen binary available in this environment;
|
||||
// see /home/john/Projects/sentry/deploy/README.md's verification
|
||||
// section for what that means for this package specifically: it's real,
|
||||
// compiling, unit-tested Go code, never reconciled against a live
|
||||
// cluster).
|
||||
//
|
||||
// +kubebuilder:object:generate=true
|
||||
// +groupName=sentry.io
|
||||
package v1alpha1
|
||||
|
||||
import (
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
"sigs.k8s.io/controller-runtime/pkg/scheme"
|
||||
)
|
||||
|
||||
var (
|
||||
// GroupVersion is group sentry.io, version v1alpha1.
|
||||
GroupVersion = schema.GroupVersion{Group: "sentry.io", Version: "v1alpha1"}
|
||||
|
||||
// SchemeBuilder is used to add go types to the GroupVersionKind scheme.
|
||||
SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
|
||||
|
||||
// AddToScheme adds the types in this group-version to the given scheme.
|
||||
AddToScheme = SchemeBuilder.AddToScheme
|
||||
)
|
||||
@@ -0,0 +1,117 @@
|
||||
package v1alpha1
|
||||
|
||||
import (
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
)
|
||||
|
||||
// TenantPhase mirrors the provisioning state machine from
|
||||
// /docs/phase-4-isolation-design.md: every tenant-resolution path
|
||||
// elsewhere must refuse to serve a tenant not in PhaseActive, checked
|
||||
// server-side (today, against enterprise/internal/rbacstore's tenants
|
||||
// table -- this CR is a K8s-native *view* of the same state machine at
|
||||
// the deployment-topology layer, not a second source of truth. Reconciling
|
||||
// the two together is exactly the kind of tenant-provisioning wiring
|
||||
// named as deferred in /docs/phase-4-runbook.md's task 6 section: today
|
||||
// this operator only manages the K8s-side artifact (a per-tenant
|
||||
// ClickHouse credential Secret + a ConfigMap recording the tenant's
|
||||
// database name/index path), not the actual `CREATE DATABASE`/`CREATE
|
||||
// USER`/`GRANT` calls against ClickHouse -- that's
|
||||
// enterprise/internal/tenantprovision, still unbuilt.
|
||||
type TenantPhase string
|
||||
|
||||
const (
|
||||
PhaseProvisioning TenantPhase = "Provisioning"
|
||||
PhaseActive TenantPhase = "Active"
|
||||
PhaseSuspended TenantPhase = "Suspended"
|
||||
PhaseDeprovisioning TenantPhase = "Deprovisioning"
|
||||
)
|
||||
|
||||
// TenantSpec is the desired state -- an operator/admin's intent, set via
|
||||
// `kubectl apply` or (per the Helm chart's templates/tenants.yaml) a
|
||||
// values.yaml `tenants:` entry.
|
||||
type TenantSpec struct {
|
||||
// DisplayName is human-readable only -- the Tenant object's own Name
|
||||
// (metav1.ObjectMeta) is the stable identifier, matching
|
||||
// rbacstore.Tenant.ID's "slug, not UUID" reasoning (see
|
||||
// /docs/phase-4-rbac-design.md's schema section) so this CRD's name
|
||||
// can be the same string used elsewhere (ClickHouse database name,
|
||||
// rbacstore tenant ID) without a translation layer.
|
||||
// +kubebuilder:validation:Required
|
||||
DisplayName string `json:"displayName"`
|
||||
|
||||
// Suspended is the admin-facing lever for the Suspended phase (e.g.
|
||||
// an incident-response or billing action) -- distinct from
|
||||
// Provisioning/Deprovisioning, which the controller drives from
|
||||
// object lifecycle (creation, deletion), not from this field.
|
||||
// +optional
|
||||
Suspended bool `json:"suspended,omitempty"`
|
||||
}
|
||||
|
||||
// TenantStatus is observed state -- only the controller writes this.
|
||||
type TenantStatus struct {
|
||||
// +optional
|
||||
Phase TenantPhase `json:"phase,omitempty"`
|
||||
|
||||
// ClickHouseDatabaseName is derived (today: same as the Tenant's own
|
||||
// Name) rather than settable in Spec -- see task 2's design: no
|
||||
// tenant traffic authenticates as ClickHouse's `default` user, and a
|
||||
// database name that could diverge from the tenant identifier is a
|
||||
// bookkeeping foot-gun this type avoids by construction.
|
||||
// +optional
|
||||
ClickHouseDatabaseName string `json:"clickHouseDatabaseName,omitempty"`
|
||||
|
||||
// ClickHouseSecretRef names the Secret (same namespace) holding this
|
||||
// tenant's dedicated, narrowly-granted ClickHouse credentials -- see
|
||||
// tenant_controller.go's reconcileSecret. Never the cluster-wide
|
||||
// CLICKHOUSE_PASSWORD docker-compose.yml uses today.
|
||||
// +optional
|
||||
ClickHouseSecretRef string `json:"clickHouseSecretRef,omitempty"`
|
||||
|
||||
// TantivyIndexPath is this tenant's index directory under the shared
|
||||
// search-index PVC -- see /docs/phase-4-isolation-design.md's
|
||||
// Tantivy index-per-tenant section.
|
||||
// +optional
|
||||
TantivyIndexPath string `json:"tantivyIndexPath,omitempty"`
|
||||
|
||||
// +optional
|
||||
// +patchMergeKey=type
|
||||
// +patchStrategy=merge
|
||||
Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
|
||||
|
||||
// +optional
|
||||
ObservedGeneration int64 `json:"observedGeneration,omitempty"`
|
||||
}
|
||||
|
||||
// ConditionReady is the one condition type this controller sets today --
|
||||
// more (e.g. ClickHouseProvisioned, once internal/tenantprovision
|
||||
// exists) are additive future work, not a breaking change to this type.
|
||||
const ConditionReady = "Ready"
|
||||
|
||||
// +kubebuilder:object:root=true
|
||||
// +kubebuilder:subresource:status
|
||||
// +kubebuilder:printcolumn:name="Phase",type=string,JSONPath=`.status.phase`
|
||||
// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
|
||||
|
||||
// Tenant is the K8s-native representation of one Sentry tenant's
|
||||
// deployment-topology state -- see this file's package-level doc
|
||||
// comment for what it does and does not manage today.
|
||||
type Tenant struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
metav1.ObjectMeta `json:"metadata,omitempty"`
|
||||
|
||||
Spec TenantSpec `json:"spec,omitempty"`
|
||||
Status TenantStatus `json:"status,omitempty"`
|
||||
}
|
||||
|
||||
// +kubebuilder:object:root=true
|
||||
|
||||
// TenantList is a list of Tenant.
|
||||
type TenantList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
metav1.ListMeta `json:"metadata,omitempty"`
|
||||
Items []Tenant `json:"items"`
|
||||
}
|
||||
|
||||
func init() {
|
||||
SchemeBuilder.Register(&Tenant{}, &TenantList{})
|
||||
}
|
||||
@@ -0,0 +1,92 @@
|
||||
// Hand-written, not `controller-gen object:headerFile=...` generated --
|
||||
// no controller-gen binary available in this environment (see
|
||||
// groupversion_info.go's doc comment). Kept under the conventional
|
||||
// zz_generated.deepcopy.go name so its purpose is recognizable, and
|
||||
// covered by api_test.go's round-trip tests since a hand-written
|
||||
// DeepCopy is exactly the kind of code a typo silently breaks.
|
||||
package v1alpha1
|
||||
|
||||
import (
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
)
|
||||
|
||||
func (in *TenantSpec) DeepCopy() *TenantSpec {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(TenantSpec)
|
||||
*out = *in
|
||||
return out
|
||||
}
|
||||
|
||||
func (in *TenantStatus) DeepCopyInto(out *TenantStatus) {
|
||||
*out = *in
|
||||
if in.Conditions != nil {
|
||||
out.Conditions = make([]metav1.Condition, len(in.Conditions))
|
||||
for i := range in.Conditions {
|
||||
in.Conditions[i].DeepCopyInto(&out.Conditions[i])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (in *TenantStatus) DeepCopy() *TenantStatus {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(TenantStatus)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
func (in *Tenant) DeepCopyInto(out *Tenant) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
||||
out.Spec = in.Spec
|
||||
in.Status.DeepCopyInto(&out.Status)
|
||||
}
|
||||
|
||||
func (in *Tenant) DeepCopy() *Tenant {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(Tenant)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
func (in *Tenant) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (in *TenantList) DeepCopyInto(out *TenantList) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ListMeta.DeepCopyInto(&out.ListMeta)
|
||||
if in.Items != nil {
|
||||
out.Items = make([]Tenant, len(in.Items))
|
||||
for i := range in.Items {
|
||||
in.Items[i].DeepCopyInto(&out.Items[i])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (in *TenantList) DeepCopy() *TenantList {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(TenantList)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
func (in *TenantList) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,81 @@
|
||||
// Command tenant-operator runs the Tenant CRD controller (see
|
||||
// internal/controller/tenant_controller.go's doc comment for exactly
|
||||
// what it does and doesn't manage). Same "cmd/<service>/main.go"
|
||||
// convention as every other Go service in this repo
|
||||
// (api/cmd/api, enterprise/cmd/enterprise-auth), rather than
|
||||
// kubebuilder's newer default of a bare cmd/main.go.
|
||||
package main
|
||||
|
||||
import (
|
||||
"flag"
|
||||
"os"
|
||||
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
|
||||
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
|
||||
ctrl "sigs.k8s.io/controller-runtime"
|
||||
"sigs.k8s.io/controller-runtime/pkg/healthz"
|
||||
"sigs.k8s.io/controller-runtime/pkg/log/zap"
|
||||
"sigs.k8s.io/controller-runtime/pkg/metrics/server"
|
||||
|
||||
sentryv1alpha1 "github.com/sentry/sentry/deploy/operator/api/v1alpha1"
|
||||
"github.com/sentry/sentry/deploy/operator/internal/controller"
|
||||
)
|
||||
|
||||
var scheme = runtime.NewScheme()
|
||||
|
||||
func init() {
|
||||
utilruntime.Must(clientgoscheme.AddToScheme(scheme))
|
||||
utilruntime.Must(sentryv1alpha1.AddToScheme(scheme))
|
||||
}
|
||||
|
||||
func main() {
|
||||
var metricsAddr, probeAddr string
|
||||
flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metrics endpoint binds to.")
|
||||
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the health probe endpoint binds to.")
|
||||
opts := zap.Options{Development: false}
|
||||
opts.BindFlags(flag.CommandLine)
|
||||
flag.Parse()
|
||||
|
||||
logger := zap.New(zap.UseFlagOptions(&opts))
|
||||
ctrl.SetLogger(logger)
|
||||
|
||||
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
|
||||
Scheme: scheme,
|
||||
Metrics: server.Options{BindAddress: metricsAddr},
|
||||
HealthProbeBindAddress: probeAddr,
|
||||
// A single tenant-operator replica reconciling cluster-wide state
|
||||
// is enough at this scope (see internal/controller's doc comment
|
||||
// on what it does and doesn't manage) -- leader election matters
|
||||
// once a second replica could double-generate a Secret, not
|
||||
// before.
|
||||
LeaderElection: false,
|
||||
})
|
||||
if err != nil {
|
||||
logger.Error(err, "unable to start manager")
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
if err := (&controller.TenantReconciler{
|
||||
Client: mgr.GetClient(),
|
||||
Scheme: mgr.GetScheme(),
|
||||
}).SetupWithManager(mgr); err != nil {
|
||||
logger.Error(err, "unable to create controller", "controller", "Tenant")
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
|
||||
logger.Error(err, "unable to set up health check")
|
||||
os.Exit(1)
|
||||
}
|
||||
if err := mgr.AddReadyzCheck("readyz", healthz.Ping); err != nil {
|
||||
logger.Error(err, "unable to set up ready check")
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
logger.Info("starting tenant-operator")
|
||||
if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {
|
||||
logger.Error(err, "problem running manager")
|
||||
os.Exit(1)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,93 @@
|
||||
# Hand-written, not `controller-gen crd` output -- see
|
||||
# api/v1alpha1/groupversion_info.go's doc comment. Kept in sync with
|
||||
# api/v1alpha1/tenant_types.go by hand; api/v1alpha1/api_test.go's
|
||||
# round-trip tests catch a Go/YAML drift in the *shape* of the types,
|
||||
# but not a drift in this file's field descriptions/validation rules --
|
||||
# review both together when either changes.
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: tenants.sentry.io
|
||||
spec:
|
||||
group: sentry.io
|
||||
names:
|
||||
kind: Tenant
|
||||
listKind: TenantList
|
||||
plural: tenants
|
||||
singular: tenant
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
additionalPrinterColumns:
|
||||
- name: Phase
|
||||
type: string
|
||||
jsonPath: .status.phase
|
||||
- name: Age
|
||||
type: date
|
||||
jsonPath: .metadata.creationTimestamp
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
type: object
|
||||
description: >-
|
||||
Tenant is the K8s-native representation of one Sentry tenant's
|
||||
deployment-topology state -- see
|
||||
deploy/operator/internal/controller/tenant_controller.go's doc
|
||||
comment for what the controller does and does not manage.
|
||||
properties:
|
||||
apiVersion:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
type: object
|
||||
required: [displayName]
|
||||
properties:
|
||||
displayName:
|
||||
type: string
|
||||
description: Human-readable only -- the object's own metadata.name is the stable identifier.
|
||||
suspended:
|
||||
type: boolean
|
||||
description: Admin-facing lever for the Suspended phase.
|
||||
default: false
|
||||
status:
|
||||
type: object
|
||||
properties:
|
||||
phase:
|
||||
type: string
|
||||
enum: [Provisioning, Active, Suspended, Deprovisioning]
|
||||
clickHouseDatabaseName:
|
||||
type: string
|
||||
clickHouseSecretRef:
|
||||
type: string
|
||||
tantivyIndexPath:
|
||||
type: string
|
||||
observedGeneration:
|
||||
type: integer
|
||||
format: int64
|
||||
conditions:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
required: [type, status]
|
||||
properties:
|
||||
type:
|
||||
type: string
|
||||
status:
|
||||
type: string
|
||||
enum: ["True", "False", "Unknown"]
|
||||
reason:
|
||||
type: string
|
||||
message:
|
||||
type: string
|
||||
observedGeneration:
|
||||
type: integer
|
||||
format: int64
|
||||
lastTransitionTime:
|
||||
type: string
|
||||
format: date-time
|
||||
@@ -0,0 +1,67 @@
|
||||
module github.com/sentry/sentry/deploy/operator
|
||||
|
||||
go 1.25.0
|
||||
|
||||
require (
|
||||
k8s.io/api v0.31.0
|
||||
k8s.io/apimachinery v0.31.0
|
||||
k8s.io/client-go v0.31.0
|
||||
sigs.k8s.io/controller-runtime v0.19.3
|
||||
)
|
||||
|
||||
require (
|
||||
github.com/beorn7/perks v1.0.1 // indirect
|
||||
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
||||
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
||||
github.com/emicklei/go-restful/v3 v3.11.0 // indirect
|
||||
github.com/evanphx/json-patch/v5 v5.9.0 // indirect
|
||||
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
|
||||
github.com/go-logr/logr v1.4.2 // indirect
|
||||
github.com/go-logr/zapr v1.3.0 // indirect
|
||||
github.com/go-openapi/jsonpointer v0.19.6 // indirect
|
||||
github.com/go-openapi/jsonreference v0.20.2 // indirect
|
||||
github.com/go-openapi/swag v0.22.4 // indirect
|
||||
github.com/gogo/protobuf v1.3.2 // indirect
|
||||
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
|
||||
github.com/golang/protobuf v1.5.4 // indirect
|
||||
github.com/google/gnostic-models v0.6.8 // indirect
|
||||
github.com/google/go-cmp v0.6.0 // indirect
|
||||
github.com/google/gofuzz v1.2.0 // indirect
|
||||
github.com/google/uuid v1.6.0 // indirect
|
||||
github.com/imdario/mergo v0.3.6 // indirect
|
||||
github.com/josharian/intern v1.0.0 // indirect
|
||||
github.com/json-iterator/go v1.1.12 // indirect
|
||||
github.com/mailru/easyjson v0.7.7 // indirect
|
||||
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
||||
github.com/modern-go/reflect2 v1.0.2 // indirect
|
||||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
||||
github.com/pkg/errors v0.9.1 // indirect
|
||||
github.com/prometheus/client_golang v1.19.1 // indirect
|
||||
github.com/prometheus/client_model v0.6.1 // indirect
|
||||
github.com/prometheus/common v0.55.0 // indirect
|
||||
github.com/prometheus/procfs v0.15.1 // indirect
|
||||
github.com/spf13/pflag v1.0.5 // indirect
|
||||
github.com/x448/float16 v0.8.4 // indirect
|
||||
go.uber.org/multierr v1.11.0 // indirect
|
||||
go.uber.org/zap v1.26.0 // indirect
|
||||
golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc // indirect
|
||||
golang.org/x/net v0.26.0 // indirect
|
||||
golang.org/x/oauth2 v0.21.0 // indirect
|
||||
golang.org/x/sys v0.21.0 // indirect
|
||||
golang.org/x/term v0.21.0 // indirect
|
||||
golang.org/x/text v0.16.0 // indirect
|
||||
golang.org/x/time v0.3.0 // indirect
|
||||
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
|
||||
google.golang.org/protobuf v1.34.2 // indirect
|
||||
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
|
||||
gopkg.in/inf.v0 v0.9.1 // indirect
|
||||
gopkg.in/yaml.v2 v2.4.0 // indirect
|
||||
gopkg.in/yaml.v3 v3.0.1 // indirect
|
||||
k8s.io/apiextensions-apiserver v0.31.0 // indirect
|
||||
k8s.io/klog/v2 v2.130.1 // indirect
|
||||
k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
|
||||
k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
|
||||
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
|
||||
sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
|
||||
sigs.k8s.io/yaml v1.4.0 // indirect
|
||||
)
|
||||
@@ -0,0 +1,192 @@
|
||||
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
|
||||
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
|
||||
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
|
||||
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
|
||||
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
|
||||
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
|
||||
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
|
||||
github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
|
||||
github.com/evanphx/json-patch v0.5.2 h1:xVCHIVMUu1wtM/VkR9jVZ45N3FhZfYMMYGorLCR8P3k=
|
||||
github.com/evanphx/json-patch v0.5.2/go.mod h1:ZWS5hhDbVDyob71nXKNL0+PWn6ToqBHMikGIFbs31qQ=
|
||||
github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg=
|
||||
github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
|
||||
github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
|
||||
github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
|
||||
github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
|
||||
github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
|
||||
github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
|
||||
github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
|
||||
github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
|
||||
github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
|
||||
github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
|
||||
github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
|
||||
github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
|
||||
github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
|
||||
github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
|
||||
github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
|
||||
github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
|
||||
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
|
||||
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
|
||||
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
|
||||
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
|
||||
github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
|
||||
github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
|
||||
github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
|
||||
github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
|
||||
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
|
||||
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
|
||||
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
|
||||
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
|
||||
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||
github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af h1:kmjWCqn2qkEml422C2Rrd27c3VGxi6a/6HNq8QmHRKM=
|
||||
github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
|
||||
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
|
||||
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
github.com/imdario/mergo v0.3.6 h1:xTNEAn+kxVO7dTZGu0CegyqKZmoWFI0rF8UxjlB2d28=
|
||||
github.com/imdario/mergo v0.3.6/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
|
||||
github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
|
||||
github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
|
||||
github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
|
||||
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
|
||||
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
|
||||
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
|
||||
github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
|
||||
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
|
||||
github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
|
||||
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
|
||||
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
|
||||
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
|
||||
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
|
||||
github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
|
||||
github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
|
||||
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
|
||||
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
|
||||
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
|
||||
github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
|
||||
github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
|
||||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
|
||||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
|
||||
github.com/onsi/ginkgo/v2 v2.19.0 h1:9Cnnf7UHo57Hy3k6/m5k3dRfGTMXGvxhHFvkDTCTpvA=
|
||||
github.com/onsi/ginkgo/v2 v2.19.0/go.mod h1:rlwLi9PilAFJ8jCg9UE1QP6VBpd6/xj3SRC0d6TU0To=
|
||||
github.com/onsi/gomega v1.33.1 h1:dsYjIxxSR755MDmKVsaFQTE22ChNBcuuTWgkUDSubOk=
|
||||
github.com/onsi/gomega v1.33.1/go.mod h1:U4R44UsT+9eLIaYRB2a5qajjtQYn0hauxvRm16AVYg0=
|
||||
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
|
||||
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
|
||||
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
|
||||
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
github.com/prometheus/client_golang v1.19.1 h1:wZWJDwK+NameRJuPGDhlnFgx8e8HN3XHQeLaYJFJBOE=
|
||||
github.com/prometheus/client_golang v1.19.1/go.mod h1:mP78NwGzrVks5S2H6ab8+ZZGJLZUq1hoULYBAYBw1Ho=
|
||||
github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
|
||||
github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
|
||||
github.com/prometheus/common v0.55.0 h1:KEi6DK7lXW/m7Ig5i47x0vRzuBsHuvJdi5ee6Y3G1dc=
|
||||
github.com/prometheus/common v0.55.0/go.mod h1:2SECS4xJG1kd8XF9IcM1gMX6510RAEL65zxzNImwdc8=
|
||||
github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
|
||||
github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
|
||||
github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
|
||||
github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
|
||||
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
|
||||
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
|
||||
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||
github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
|
||||
github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
|
||||
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
|
||||
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
|
||||
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
|
||||
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
|
||||
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
|
||||
github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
|
||||
github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
|
||||
github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
|
||||
github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
|
||||
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
|
||||
go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
|
||||
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
|
||||
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
|
||||
go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
|
||||
go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
|
||||
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
|
||||
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
|
||||
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||
golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc h1:mCRnTeVUjcrhlRmO0VK8a6k6Rrf6TF9htwo2pJVSjIU=
|
||||
golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc/go.mod h1:V1LtkGg67GoY2N1AnLN78QLrzxkLyJw7RJb1gzOOz9w=
|
||||
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
|
||||
golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
|
||||
golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
|
||||
golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs=
|
||||
golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
|
||||
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
|
||||
golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/term v0.21.0 h1:WVXCp+/EBEHOj53Rvu+7KiT/iElMrO8ACK16SMZ3jaA=
|
||||
golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
|
||||
golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
|
||||
golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
|
||||
golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
||||
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
|
||||
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
|
||||
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
|
||||
gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
|
||||
google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
|
||||
google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
|
||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
|
||||
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
|
||||
gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
|
||||
gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
|
||||
gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
|
||||
gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
|
||||
gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||
gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
|
||||
gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
|
||||
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
k8s.io/api v0.31.0 h1:b9LiSjR2ym/SzTOlfMHm1tr7/21aD7fSkqgD/CVJBCo=
|
||||
k8s.io/api v0.31.0/go.mod h1:0YiFF+JfFxMM6+1hQei8FY8M7s1Mth+z/q7eF1aJkTE=
|
||||
k8s.io/apiextensions-apiserver v0.31.0 h1:fZgCVhGwsclj3qCw1buVXCV6khjRzKC5eCFt24kyLSk=
|
||||
k8s.io/apiextensions-apiserver v0.31.0/go.mod h1:b9aMDEYaEe5sdK+1T0KU78ApR/5ZVp4i56VacZYEHxk=
|
||||
k8s.io/apimachinery v0.31.0 h1:m9jOiSr3FoSSL5WO9bjm1n6B9KROYYgNZOb4tyZ1lBc=
|
||||
k8s.io/apimachinery v0.31.0/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
|
||||
k8s.io/client-go v0.31.0 h1:QqEJzNjbN2Yv1H79SsS+SWnXkBgVu4Pj3CJQgbx0gI8=
|
||||
k8s.io/client-go v0.31.0/go.mod h1:Y9wvC76g4fLjmU0BA+rV+h2cncoadjvjjkkIGoTLcGU=
|
||||
k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
|
||||
k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
|
||||
k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 h1:BZqlfIlq5YbRMFko6/PM7FjZpUb45WallggurYhKGag=
|
||||
k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340/go.mod h1:yD4MZYeKMBwQKVht279WycxKyM84kkAx2DPrTXaeb98=
|
||||
k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A=
|
||||
k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
|
||||
sigs.k8s.io/controller-runtime v0.19.3 h1:XO2GvC9OPftRst6xWCpTgBZO04S2cbp0Qqkj8bX1sPw=
|
||||
sigs.k8s.io/controller-runtime v0.19.3/go.mod h1:j4j87DqtsThvwTv5/Tc5NFRyyF/RF0ip4+62tbTSIUM=
|
||||
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
|
||||
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
|
||||
sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
|
||||
sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
|
||||
sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
|
||||
sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
|
||||
@@ -0,0 +1,186 @@
|
||||
// Package controller reconciles the Tenant CRD (api/v1alpha1) into the
|
||||
// K8s-native artifacts task 2/CLAUDE.md's Phase 4 exit criteria calls
|
||||
// for: "real per-tenant secret management (replacing today's single
|
||||
// shared CLICKHOUSE_PASSWORD)" -- see docker-compose.yml's
|
||||
// CLICKHOUSE_PASSWORD comment for what that shared-secret shape looks
|
||||
// like today.
|
||||
//
|
||||
// What this reconciler does NOT do, named explicitly rather than
|
||||
// implied: it never calls ClickHouse (no CREATE DATABASE/CREATE USER/
|
||||
// GRANT), never touches the Tantivy index filesystem, and never talks to
|
||||
// enterprise/internal/rbacstore. Those are enterprise/internal/
|
||||
// tenantprovision's job -- unbuilt, per the task 5 summary. This
|
||||
// controller's job stops at "does a K8s Secret with this tenant's
|
||||
// ClickHouse credentials exist, and does the Tenant's status reflect
|
||||
// that" -- the deployment-topology half of tenant provisioning, not the
|
||||
// database-side half. A Tenant reaching PhaseActive here is NOT the same
|
||||
// claim as rbacstore's tenants.status='active' (the actual gate every
|
||||
// tenant-resolution code path checks per
|
||||
// /docs/phase-4-isolation-design.md) -- reconciling those two into one
|
||||
// state machine is exactly the kind of follow-up work
|
||||
// /docs/phase-4-runbook.md's task 6 section names as deferred.
|
||||
package controller
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"encoding/base64"
|
||||
"fmt"
|
||||
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
apierrors "k8s.io/apimachinery/pkg/api/errors"
|
||||
"k8s.io/apimachinery/pkg/api/meta"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
ctrl "sigs.k8s.io/controller-runtime"
|
||||
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
|
||||
"sigs.k8s.io/controller-runtime/pkg/log"
|
||||
|
||||
sentryv1alpha1 "github.com/sentry/sentry/deploy/operator/api/v1alpha1"
|
||||
)
|
||||
|
||||
// TenantReconciler reconciles a Tenant object.
|
||||
type TenantReconciler struct {
|
||||
client.Client
|
||||
Scheme *runtime.Scheme
|
||||
}
|
||||
|
||||
// clickHouseSecretName is deterministic from the tenant name -- never
|
||||
// randomly suffixed -- so a re-run of Reconcile (or a controller
|
||||
// restart) finds the same Secret it created before, rather than losing
|
||||
// track of it and creating a second one.
|
||||
func clickHouseSecretName(tenant *sentryv1alpha1.Tenant) string {
|
||||
return fmt.Sprintf("sentry-tenant-%s-clickhouse", tenant.Name)
|
||||
}
|
||||
|
||||
// tantivyIndexPath mirrors /docs/phase-4-isolation-design.md's Tantivy
|
||||
// section: one directory per tenant under the shared search-index
|
||||
// volume (search-index-data in docker-compose.yml; a PVC in the Helm
|
||||
// chart -- see deploy/helm/sentry/templates/search-deployment.yaml).
|
||||
func tantivyIndexPath(tenant *sentryv1alpha1.Tenant) string {
|
||||
return "/var/lib/sentry-search/tenants/" + tenant.Name
|
||||
}
|
||||
|
||||
// generatePassword returns a 32-byte random value, base64-encoded --
|
||||
// same "narrowly-granted, per-tenant, never the shared default user"
|
||||
// framing as /docs/phase-4-isolation-design.md's ClickHouse section,
|
||||
// applied to how the credential itself is generated (crypto/rand, not
|
||||
// math/rand -- this becomes a real ClickHouse user's password once
|
||||
// internal/tenantprovision consumes it).
|
||||
func generatePassword() (string, error) {
|
||||
buf := make([]byte, 32)
|
||||
if _, err := rand.Read(buf); err != nil {
|
||||
return "", fmt.Errorf("generating password: %w", err)
|
||||
}
|
||||
return base64.RawURLEncoding.EncodeToString(buf), nil
|
||||
}
|
||||
|
||||
// +kubebuilder:rbac:groups=sentry.io,resources=tenants,verbs=get;list;watch;create;update;patch;delete
|
||||
// +kubebuilder:rbac:groups=sentry.io,resources=tenants/status,verbs=get;update;patch
|
||||
// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch;delete
|
||||
|
||||
func (r *TenantReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
|
||||
logger := log.FromContext(ctx)
|
||||
|
||||
var tenant sentryv1alpha1.Tenant
|
||||
if err := r.Get(ctx, req.NamespacedName, &tenant); err != nil {
|
||||
if apierrors.IsNotFound(err) {
|
||||
// Deleted -- owned Secret is garbage-collected by K8s via
|
||||
// its OwnerReference (set in reconcileSecret below), nothing
|
||||
// else to clean up at this layer. See this file's package
|
||||
// doc comment: real deprovisioning (revoking ClickHouse
|
||||
// grants) isn't this controller's job.
|
||||
return ctrl.Result{}, nil
|
||||
}
|
||||
return ctrl.Result{}, fmt.Errorf("getting tenant: %w", err)
|
||||
}
|
||||
|
||||
secretName, err := r.reconcileSecret(ctx, &tenant)
|
||||
if err != nil {
|
||||
logger.Error(err, "reconciling clickhouse secret")
|
||||
return ctrl.Result{}, err
|
||||
}
|
||||
|
||||
desiredPhase := sentryv1alpha1.PhaseActive
|
||||
if tenant.Spec.Suspended {
|
||||
desiredPhase = sentryv1alpha1.PhaseSuspended
|
||||
}
|
||||
|
||||
tenant.Status.ClickHouseDatabaseName = tenant.Name
|
||||
tenant.Status.ClickHouseSecretRef = secretName
|
||||
tenant.Status.TantivyIndexPath = tantivyIndexPath(&tenant)
|
||||
tenant.Status.Phase = desiredPhase
|
||||
tenant.Status.ObservedGeneration = tenant.Generation
|
||||
meta.SetStatusCondition(&tenant.Status.Conditions, metav1.Condition{
|
||||
Type: sentryv1alpha1.ConditionReady,
|
||||
Status: metav1.ConditionTrue,
|
||||
Reason: "SecretReconciled",
|
||||
Message: fmt.Sprintf("ClickHouse credential secret %q is present", secretName),
|
||||
ObservedGeneration: tenant.Generation,
|
||||
})
|
||||
|
||||
if err := r.Status().Update(ctx, &tenant); err != nil {
|
||||
return ctrl.Result{}, fmt.Errorf("updating tenant status: %w", err)
|
||||
}
|
||||
|
||||
return ctrl.Result{}, nil
|
||||
}
|
||||
|
||||
// reconcileSecret creates the tenant's ClickHouse credential Secret if
|
||||
// it doesn't already exist. Deliberately never updates an existing
|
||||
// Secret's password -- rotating a live tenant's ClickHouse credential
|
||||
// out from under it (without first updating the ClickHouse-side grant,
|
||||
// which this controller doesn't do) would just break every open
|
||||
// connection for no benefit; credential rotation is real future work
|
||||
// that needs to be coordinated with internal/tenantprovision, not
|
||||
// something this reconcile loop can safely do alone.
|
||||
func (r *TenantReconciler) reconcileSecret(ctx context.Context, tenant *sentryv1alpha1.Tenant) (string, error) {
|
||||
name := clickHouseSecretName(tenant)
|
||||
|
||||
var existing corev1.Secret
|
||||
err := r.Get(ctx, types.NamespacedName{Namespace: tenant.Namespace, Name: name}, &existing)
|
||||
if err == nil {
|
||||
return name, nil
|
||||
}
|
||||
if !apierrors.IsNotFound(err) {
|
||||
return "", fmt.Errorf("getting secret: %w", err)
|
||||
}
|
||||
|
||||
password, err := generatePassword()
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
secret := &corev1.Secret{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: name,
|
||||
Namespace: tenant.Namespace,
|
||||
Labels: map[string]string{
|
||||
"app.kubernetes.io/managed-by": "sentry-tenant-operator",
|
||||
"sentry.io/tenant": tenant.Name,
|
||||
},
|
||||
},
|
||||
Type: corev1.SecretTypeOpaque,
|
||||
StringData: map[string]string{
|
||||
"username": "tenant_" + tenant.Name,
|
||||
"password": password,
|
||||
"database": tenant.Name,
|
||||
},
|
||||
}
|
||||
if err := controllerutil.SetControllerReference(tenant, secret, r.Scheme); err != nil {
|
||||
return "", fmt.Errorf("setting owner reference: %w", err)
|
||||
}
|
||||
if err := r.Create(ctx, secret); err != nil {
|
||||
return "", fmt.Errorf("creating secret: %w", err)
|
||||
}
|
||||
return name, nil
|
||||
}
|
||||
|
||||
func (r *TenantReconciler) SetupWithManager(mgr ctrl.Manager) error {
|
||||
return ctrl.NewControllerManagedBy(mgr).
|
||||
For(&sentryv1alpha1.Tenant{}).
|
||||
Owns(&corev1.Secret{}).
|
||||
Complete(r)
|
||||
}
|
||||
@@ -0,0 +1,155 @@
|
||||
// Tests use controller-runtime's fake client (sigs.k8s.io/
|
||||
// controller-runtime/pkg/client/fake), not envtest -- envtest needs a
|
||||
// real kube-apiserver/etcd binary pair (setup-envtest) that isn't
|
||||
// available in this environment (see package doc comment and
|
||||
// deploy/README.md's verification section). A fake client exercises
|
||||
// Reconcile's actual logic (object CRUD, owner references, status
|
||||
// writes) against an in-memory tracker; what it can't exercise is
|
||||
// anything a real apiserver would do for you (defaulting, admission,
|
||||
// actual garbage collection of owned objects, watch-triggered
|
||||
// re-reconciliation) -- so passing here is real signal about this
|
||||
// reconciler's logic, not proof it behaves correctly against a live
|
||||
// cluster.
|
||||
package controller
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
ctrl "sigs.k8s.io/controller-runtime"
|
||||
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||
"sigs.k8s.io/controller-runtime/pkg/client/fake"
|
||||
|
||||
sentryv1alpha1 "github.com/sentry/sentry/deploy/operator/api/v1alpha1"
|
||||
)
|
||||
|
||||
func newFakeReconciler(t *testing.T, objs ...client.Object) *TenantReconciler {
|
||||
t.Helper()
|
||||
scheme := runtime.NewScheme()
|
||||
if err := corev1.AddToScheme(scheme); err != nil {
|
||||
t.Fatalf("adding corev1 to scheme: %v", err)
|
||||
}
|
||||
if err := sentryv1alpha1.AddToScheme(scheme); err != nil {
|
||||
t.Fatalf("adding sentryv1alpha1 to scheme: %v", err)
|
||||
}
|
||||
fakeClient := fake.NewClientBuilder().
|
||||
WithScheme(scheme).
|
||||
WithObjects(objs...).
|
||||
WithStatusSubresource(&sentryv1alpha1.Tenant{}).
|
||||
Build()
|
||||
return &TenantReconciler{Client: fakeClient, Scheme: scheme}
|
||||
}
|
||||
|
||||
func testTenant(name string, suspended bool) *sentryv1alpha1.Tenant {
|
||||
return &sentryv1alpha1.Tenant{
|
||||
ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: "default"},
|
||||
Spec: sentryv1alpha1.TenantSpec{DisplayName: name, Suspended: suspended},
|
||||
}
|
||||
}
|
||||
|
||||
func TestReconcileCreatesSecretAndSetsActivePhase(t *testing.T) {
|
||||
tenant := testTenant("acme", false)
|
||||
r := newFakeReconciler(t, tenant)
|
||||
ctx := context.Background()
|
||||
|
||||
if _, err := r.Reconcile(ctx, ctrl.Request{NamespacedName: types.NamespacedName{Name: "acme", Namespace: "default"}}); err != nil {
|
||||
t.Fatalf("Reconcile: %v", err)
|
||||
}
|
||||
|
||||
var secret corev1.Secret
|
||||
if err := r.Get(ctx, types.NamespacedName{Name: "sentry-tenant-acme-clickhouse", Namespace: "default"}, &secret); err != nil {
|
||||
t.Fatalf("expected a ClickHouse secret to be created: %v", err)
|
||||
}
|
||||
if secret.StringData["username"] != "tenant_acme" || secret.StringData["database"] != "acme" {
|
||||
t.Fatalf("unexpected secret data: %+v", secret.StringData)
|
||||
}
|
||||
if secret.StringData["password"] == "" {
|
||||
t.Fatal("expected a non-empty generated password")
|
||||
}
|
||||
if len(secret.OwnerReferences) != 1 || secret.OwnerReferences[0].Name != "acme" {
|
||||
t.Fatalf("expected secret to be owned by the Tenant, got %+v", secret.OwnerReferences)
|
||||
}
|
||||
|
||||
var got sentryv1alpha1.Tenant
|
||||
if err := r.Get(ctx, types.NamespacedName{Name: "acme", Namespace: "default"}, &got); err != nil {
|
||||
t.Fatalf("getting tenant: %v", err)
|
||||
}
|
||||
if got.Status.Phase != sentryv1alpha1.PhaseActive {
|
||||
t.Fatalf("Phase = %q, want Active", got.Status.Phase)
|
||||
}
|
||||
if got.Status.ClickHouseDatabaseName != "acme" {
|
||||
t.Fatalf("ClickHouseDatabaseName = %q, want acme", got.Status.ClickHouseDatabaseName)
|
||||
}
|
||||
if got.Status.ClickHouseSecretRef != "sentry-tenant-acme-clickhouse" {
|
||||
t.Fatalf("ClickHouseSecretRef = %q", got.Status.ClickHouseSecretRef)
|
||||
}
|
||||
if got.Status.TantivyIndexPath != "/var/lib/sentry-search/tenants/acme" {
|
||||
t.Fatalf("TantivyIndexPath = %q", got.Status.TantivyIndexPath)
|
||||
}
|
||||
}
|
||||
|
||||
func TestReconcileSuspendedSetsSuspendedPhaseButKeepsSecret(t *testing.T) {
|
||||
tenant := testTenant("acme", true)
|
||||
r := newFakeReconciler(t, tenant)
|
||||
ctx := context.Background()
|
||||
|
||||
if _, err := r.Reconcile(ctx, ctrl.Request{NamespacedName: types.NamespacedName{Name: "acme", Namespace: "default"}}); err != nil {
|
||||
t.Fatalf("Reconcile: %v", err)
|
||||
}
|
||||
|
||||
var got sentryv1alpha1.Tenant
|
||||
if err := r.Get(ctx, types.NamespacedName{Name: "acme", Namespace: "default"}, &got); err != nil {
|
||||
t.Fatalf("getting tenant: %v", err)
|
||||
}
|
||||
if got.Status.Phase != sentryv1alpha1.PhaseSuspended {
|
||||
t.Fatalf("Phase = %q, want Suspended", got.Status.Phase)
|
||||
}
|
||||
|
||||
// A suspended tenant's credential Secret is NOT deleted -- suspension
|
||||
// is reversible and this controller doesn't manage ClickHouse-side
|
||||
// grants, so there's nothing at this layer to actually enforce
|
||||
// suspension; deleting the Secret would just be theater.
|
||||
var secret corev1.Secret
|
||||
if err := r.Get(ctx, types.NamespacedName{Name: "sentry-tenant-acme-clickhouse", Namespace: "default"}, &secret); err != nil {
|
||||
t.Fatalf("expected secret to still exist for a suspended tenant: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestReconcileIsIdempotentAndNeverRotatesPassword(t *testing.T) {
|
||||
tenant := testTenant("acme", false)
|
||||
r := newFakeReconciler(t, tenant)
|
||||
ctx := context.Background()
|
||||
req := ctrl.Request{NamespacedName: types.NamespacedName{Name: "acme", Namespace: "default"}}
|
||||
|
||||
if _, err := r.Reconcile(ctx, req); err != nil {
|
||||
t.Fatalf("first Reconcile: %v", err)
|
||||
}
|
||||
var first corev1.Secret
|
||||
if err := r.Get(ctx, types.NamespacedName{Name: "sentry-tenant-acme-clickhouse", Namespace: "default"}, &first); err != nil {
|
||||
t.Fatalf("getting secret after first reconcile: %v", err)
|
||||
}
|
||||
|
||||
if _, err := r.Reconcile(ctx, req); err != nil {
|
||||
t.Fatalf("second Reconcile: %v", err)
|
||||
}
|
||||
var second corev1.Secret
|
||||
if err := r.Get(ctx, types.NamespacedName{Name: "sentry-tenant-acme-clickhouse", Namespace: "default"}, &second); err != nil {
|
||||
t.Fatalf("getting secret after second reconcile: %v", err)
|
||||
}
|
||||
|
||||
if first.StringData["password"] != second.StringData["password"] {
|
||||
t.Fatal("password changed across a re-reconcile -- would break every live connection for this tenant")
|
||||
}
|
||||
}
|
||||
|
||||
func TestReconcileMissingTenantIsNoOp(t *testing.T) {
|
||||
r := newFakeReconciler(t)
|
||||
_, err := r.Reconcile(context.Background(), ctrl.Request{NamespacedName: types.NamespacedName{Name: "does-not-exist", Namespace: "default"}})
|
||||
if err != nil {
|
||||
t.Fatalf("Reconcile on a missing tenant should be a no-op, got error: %v", err)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user