Registry builder (the leader's core) #8

Merged

ginjiruu merged 3 commits from feat/registry-builder into master

2026-09-14 02:46:23 +00:00

ginjiruu commented

2026-09-14 01:37:40 +00:00

Owner

Closes #3

Implements issue #3 — the Registry builder (the leader's core).

What

internal/registry — the leader's state loader:
- Build (pure): lists all three kinds cluster-wide, structurally validates (hostnames non-overlapping; policy clientRef resolves; clientSecretRef well-formed), resolves each valid App's IdP, and produces the Registry plus the per-CRD status. A structurally-invalid App is excluded + Degraded; a missing referenced Secret keeps the App with secretReady=false (runtime degradation, never removal — ADR-0006).
- Builder (I/O, leader-gated): checks referenced Secrets, resolves the IdP per-issuer with keep-last-good (idp.Resolvent), writes the managed Registry Secret as a whole-object atomic update (idempotent — no write on unchanged state), applies Available/Degraded + observedGeneration (re-fetch before update, meta.SetStatusCondition so LastTransitionTime moves only on real transitions), and a RefreshLoop runnable for the JWKS TTL refresh.
Thin triggers: the three per-kind reconcilers now only invoke Builder.Build; one shared Builder is wired in cmd/main.go (new flags: --registry-namespace, --registry-secret-name, --registry-refresh-interval), leader-gated via mgr.Elected().
Registry schema: per-App entry = identity (namespace, clientID, hostnames) + shared (tokenEndpoint, raw JWKS, secretRef, secretReady) + OIDC section (authorizationEndpoint, callbackURLs, scopes [default openid], session/injection/logout) + Exchange section (clientRef, scopes, subject-token source). OIDC/Exchange sections present iff the App has the policy.
RBAC: the manager ClusterRole gains secrets get/list/watch/create/update/patch (generated via make manifests).

Testing (seams from spec #1)

Pure unit (schema/structural seam, internal/registry): entry shape, JSON shape, all structural exclusions, runtime degradation, resolve-failure-without-last-good, duplicate-policy, statuses/observedGeneration.
Envtest (Seam 1, stubbed httptest IdP): valid Client + policies → resolved App in the Registry + Available; hostname collision → both excluded + Degraded; malformed clientSecretRef → excluded + Degraded; dangling clientRef → policy Degraded + no entry; missing Secret → kept with secretReady=false + Degraded; idempotent rebuild (no write on unchanged state); non-leader performs no side-effects.

GOTOOLCHAIN=go1.26.0 make lint / make test: clean.

Closes #3 Implements issue #3 — the Registry builder (the leader's core). ## What - **`internal/registry`** — the leader's state loader: - `Build` (pure): lists all three kinds cluster-wide, structurally validates (hostnames non-overlapping; policy `clientRef` resolves; `clientSecretRef` well-formed), resolves each valid App's IdP, and produces the Registry plus the per-CRD status. A structurally-invalid App is excluded + Degraded; a missing referenced Secret keeps the App with `secretReady=false` (runtime degradation, never removal — ADR-0006). - `Builder` (I/O, leader-gated): checks referenced Secrets, resolves the IdP per-issuer with keep-last-good (`idp.Resolvent`), writes the managed Registry Secret as a whole-object atomic update (idempotent — no write on unchanged state), applies Available/Degraded + `observedGeneration` (re-fetch before update, `meta.SetStatusCondition` so `LastTransitionTime` moves only on real transitions), and a `RefreshLoop` runnable for the JWKS TTL refresh. - **Thin triggers**: the three per-kind reconcilers now only invoke `Builder.Build`; one shared `Builder` is wired in `cmd/main.go` (new flags: `--registry-namespace`, `--registry-secret-name`, `--registry-refresh-interval`), leader-gated via `mgr.Elected()`. - **Registry schema**: per-App entry = identity (namespace, clientID, hostnames) + shared (tokenEndpoint, raw JWKS, secretRef, secretReady) + OIDC section (authorizationEndpoint, callbackURLs, scopes [default `openid`], session/injection/logout) + Exchange section (clientRef, scopes, subject-token source). OIDC/Exchange sections present iff the App has the policy. - **RBAC**: the manager ClusterRole gains `secrets` get/list/watch/create/update/patch (generated via `make manifests`). ## Testing (seams from spec #1) - Pure unit (schema/structural seam, `internal/registry`): entry shape, JSON shape, all structural exclusions, runtime degradation, resolve-failure-without-last-good, duplicate-policy, statuses/observedGeneration. - Envtest (Seam 1, stubbed `httptest` IdP): valid Client + policies → resolved App in the Registry + Available; hostname collision → both excluded + Degraded; malformed `clientSecretRef` → excluded + Degraded; dangling `clientRef` → policy Degraded + no entry; missing Secret → kept with `secretReady=false` + Degraded; idempotent rebuild (no write on unchanged state); non-leader performs no side-effects. `GOTOOLCHAIN=go1.26.0 make lint` / `make test`: clean.

ginjiruu added 1 commit

2026-09-14 01:37:40 +00:00

add registry builder: cluster-wide build, thin triggers, registry secret, crd status

Lint / Run on Ubuntu (push) Has been cancelled

Details

Lint / Run on Ubuntu (pull_request) Has been cancelled

Details

E2E Tests / Run on Ubuntu (push) Has been cancelled

Details

E2E Tests / Run on Ubuntu (pull_request) Has been cancelled

Details

Tests / Run on Ubuntu (push) Has been cancelled