Add the Proxy reconciler state machine with action-table, phase, and envtest suites

Co-Authored-By: Claude <noreply@anthropic.com>
2026-08-09 14:03:02 +02:00
parent 5c408cc284
commit 1125f74221
11 changed files with 1566 additions and 74 deletions
--- a/internal/controller/reconcile_test.go
+++ b/internal/controller/reconcile_test.go
@@ -0,0 +1,550 @@
+package controller
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	apimeta "k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	crawlv1alpha1 "gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/api/v1alpha1"
+	"gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/internal/provider"
+)
+
+// Distinct per-interval values so an asserted ctrl.Result is unambiguous
+// about which action-table row produced it.
+const (
+	tProvisioningPoll = 11 * time.Second
+	tDriftPoll        = 22 * time.Second
+	tDeletionPoll     = 33 * time.Second
+	tQuotaRetry       = 44 * time.Second
+	tRequeueNow       = 55 * time.Millisecond
+)
+
+const (
+	testProxyName = "p1"
+	testNamespace = "default"
+	testUID       = types.UID("11111111-2222-3333-4444-555555555555")
+)
+
+// stubProvider is the plan's in-test Provider stub: a handful of lines, no
+// config format, no fault-injection surface beyond settable fields.
+type stubProvider struct {
+	createID  string
+	createErr error
+	getInst   *provider.Instance
+	getErr    error
+	deleteErr error
+
+	createCalls, getCalls, deleteCalls int
+	lastCreate                         provider.CreateRequest
+}
+
+func (s *stubProvider) Create(_ context.Context, req provider.CreateRequest) (string, error) {
+	s.createCalls++
+	s.lastCreate = req
+	if s.createErr != nil {
+		return "", s.createErr
+	}
+	return s.createID, nil
+}
+
+func (s *stubProvider) Get(_ context.Context, _ string) (*provider.Instance, error) {
+	s.getCalls++
+	if s.getErr != nil {
+		return nil, s.getErr
+	}
+	return s.getInst, nil
+}
+
+func (s *stubProvider) Delete(_ context.Context, _ string) error {
+	s.deleteCalls++
+	return s.deleteErr
+}
+
+func (s *stubProvider) ListByTag(context.Context) ([]provider.Instance, error) {
+	return nil, nil
+}
+
+func notFoundErr() error {
+	return provider.Wrap(provider.ErrNotFound, "get", "stub", "some-id", nil)
+}
+
+func testScheme(t *testing.T) *runtime.Scheme {
+	t.Helper()
+	s := runtime.NewScheme()
+	if err := crawlv1alpha1.AddToScheme(s); err != nil {
+		t.Fatalf("adding crawl scheme: %v", err)
+	}
+	if err := corev1.AddToScheme(s); err != nil {
+		t.Fatalf("adding core scheme: %v", err)
+	}
+	return s
+}
+
+// managedProxy returns a Managed proxy that already carries the finalizer —
+// the state most action-table rows start from. Mutators adjust from there.
+func managedProxy(mut ...func(*crawlv1alpha1.Proxy)) *crawlv1alpha1.Proxy {
+	p := &crawlv1alpha1.Proxy{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:       testProxyName,
+			Namespace:  testNamespace,
+			UID:        testUID,
+			Generation: 1,
+			Finalizers: []string{crawlv1alpha1.FinalizerName},
+		},
+		Spec: crawlv1alpha1.ProxySpec{
+			Mode:     crawlv1alpha1.ModeManaged,
+			Provider: "stub",
+		},
+	}
+	for _, m := range mut {
+		m(p)
+	}
+	return p
+}
+
+func withProviderID(id string) func(*crawlv1alpha1.Proxy) {
+	return func(p *crawlv1alpha1.Proxy) { p.Status.ProviderID = id }
+}
+
+func withSpecHashAnnotation(hash string) func(*crawlv1alpha1.Proxy) {
+	return func(p *crawlv1alpha1.Proxy) {
+		if p.Annotations == nil {
+			p.Annotations = map[string]string{}
+		}
+		p.Annotations[crawlv1alpha1.AnnotationSpecHash] = hash
+	}
+}
+
+func deleting() func(*crawlv1alpha1.Proxy) {
+	return func(p *crawlv1alpha1.Proxy) {
+		now := metav1.Now()
+		p.DeletionTimestamp = &now
+	}
+}
+
+func newTestReconciler(t *testing.T, stub *stubProvider, objs ...client.Object) *ProxyReconciler {
+	t.Helper()
+	c := fake.NewClientBuilder().
+		WithScheme(testScheme(t)).
+		WithStatusSubresource(&crawlv1alpha1.Proxy{}).
+		WithObjects(objs...).
+		Build()
+	return &ProxyReconciler{
+		Client:           c,
+		Providers:        map[string]provider.Provider{"stub": stub},
+		ProvisioningPoll: tProvisioningPoll,
+		DriftPoll:        tDriftPoll,
+		DeletionPoll:     tDeletionPoll,
+		QuotaRetry:       tQuotaRetry,
+		RequeueNow:       tRequeueNow,
+	}
+}
+
+func doReconcile(t *testing.T, r *ProxyReconciler) (ctrl.Result, error) {
+	t.Helper()
+	return r.Reconcile(context.Background(), ctrl.Request{
+		NamespacedName: types.NamespacedName{Namespace: testNamespace, Name: testProxyName},
+	})
+}
+
+func getProxy(t *testing.T, r *ProxyReconciler) *crawlv1alpha1.Proxy {
+	t.Helper()
+	var p crawlv1alpha1.Proxy
+	if err := r.Get(context.Background(), types.NamespacedName{Namespace: testNamespace, Name: testProxyName}, &p); err != nil {
+		t.Fatalf("getting proxy: %v", err)
+	}
+	return &p
+}
+
+func assertCondition(t *testing.T, p *crawlv1alpha1.Proxy, condType string, status metav1.ConditionStatus, reason string) {
+	t.Helper()
+	cond := apimeta.FindStatusCondition(p.Status.Conditions, condType)
+	if cond == nil {
+		t.Fatalf("condition %s missing, have %+v", condType, p.Status.Conditions)
+	}
+	if cond.Status != status || cond.Reason != reason {
+		t.Errorf("condition %s = %s/%s, want %s/%s", condType, cond.Status, cond.Reason, status, reason)
+	}
+	if cond.ObservedGeneration != p.Generation {
+		t.Errorf("condition %s observedGeneration = %d, want %d", condType, cond.ObservedGeneration, p.Generation)
+	}
+}
+
+// TestReconcile_actionTable exercises every row of the plan's action table
+// by calling Reconcile directly against a fake client. Caveat (documented in
+// the plan): the fake client runs neither CEL validation nor structural
+// defaulting — the envtest suite covers those.
+func TestReconcile_actionTable(t *testing.T) {
+	t.Parallel()
+
+	// The fixture's hash: no placement, no cloud-init, defaulted port.
+	freshHash := specHash(managedProxy(), "")
+
+	tests := []struct {
+		name       string
+		proxy      *crawlv1alpha1.Proxy
+		extraObjs  []client.Object
+		stub       *stubProvider
+		wantResult ctrl.Result
+		wantErr    bool
+		verify     func(t *testing.T, r *ProxyReconciler, stub *stubProvider)
+	}{
+		{
+			name: "managed without finalizer gets one and stops",
+			proxy: managedProxy(func(p *crawlv1alpha1.Proxy) {
+				p.Finalizers = nil
+			}),
+			stub:       &stubProvider{},
+			wantResult: ctrl.Result{},
+			verify: func(t *testing.T, r *ProxyReconciler, stub *stubProvider) {
+				p := getProxy(t, r)
+				if len(p.Finalizers) != 1 || p.Finalizers[0] != crawlv1alpha1.FinalizerName {
+					t.Errorf("finalizers = %v, want [%s]", p.Finalizers, crawlv1alpha1.FinalizerName)
+				}
+				if stub.createCalls+stub.getCalls+stub.deleteCalls != 0 {
+					t.Errorf("provider was called before the finalizer was persisted")
+				}
+			},
+		},
+		{
+			name:       "empty providerID creates the instance",
+			proxy:      managedProxy(),
+			stub:       &stubProvider{createID: "stub-id-1"},
+			wantResult: ctrl.Result{RequeueAfter: tProvisioningPoll},
+			verify: func(t *testing.T, r *ProxyReconciler, stub *stubProvider) {
+				p := getProxy(t, r)
+				if p.Status.ProviderID != "stub-id-1" {
+					t.Errorf("providerID = %q, want stub-id-1", p.Status.ProviderID)
+				}
+				if got := p.Annotations[crawlv1alpha1.AnnotationSpecHash]; got != freshHash {
+					t.Errorf("spec-hash annotation = %q, want %q", got, freshHash)
+				}
+				assertCondition(t, p, crawlv1alpha1.ConditionProvisioned, metav1.ConditionFalse, ReasonProvisioning)
+				if p.Status.Phase != crawlv1alpha1.PhaseProvisioning {
+					t.Errorf("phase = %s, want Provisioning", p.Status.Phase)
+				}
+				want := provider.CreateRequest{
+					Name:      provider.NameFromUID(testUID),
+					UID:       string(testUID),
+					Namespace: testNamespace,
+					ProxyName: testProxyName,
+					Port:      crawlv1alpha1.DefaultPort,
+				}
+				if stub.lastCreate != want {
+					t.Errorf("CreateRequest = %+v, want %+v", stub.lastCreate, want)
+				}
+			},
+		},
+		{
+			name:       "provisioning instance polls again",
+			proxy:      managedProxy(withProviderID("stub-id-1"), withSpecHashAnnotation(freshHash)),
+			stub:       &stubProvider{getInst: &provider.Instance{ID: "stub-id-1", State: provider.StateProvisioning}},
+			wantResult: ctrl.Result{RequeueAfter: tProvisioningPoll},
+			verify: func(t *testing.T, r *ProxyReconciler, _ *stubProvider) {
+				p := getProxy(t, r)
+				if p.Status.IP != "" {
+					t.Errorf("ip = %q, want empty while provisioning", p.Status.IP)
+				}
+				assertCondition(t, p, crawlv1alpha1.ConditionProvisioned, metav1.ConditionFalse, ReasonProvisioning)
+			},
+		},
+		{
+			name:  "running instance publishes IP",
+			proxy: managedProxy(withProviderID("stub-id-1"), withSpecHashAnnotation(freshHash)),
+			stub: &stubProvider{
+				getInst: &provider.Instance{ID: "stub-id-1", IP: "10.1.2.3", State: provider.StateRunning},
+			},
+			wantResult: ctrl.Result{RequeueAfter: tDriftPoll},
+			verify: func(t *testing.T, r *ProxyReconciler, _ *stubProvider) {
+				p := getProxy(t, r)
+				if p.Status.IP != "10.1.2.3" {
+					t.Errorf("ip = %q, want 10.1.2.3", p.Status.IP)
+				}
+				assertCondition(t, p, crawlv1alpha1.ConditionProvisioned, metav1.ConditionTrue, ReasonCreated)
+				if p.Status.Phase != crawlv1alpha1.PhaseProvisioning {
+					t.Errorf("phase = %s, want Provisioning until a health verdict exists", p.Status.Phase)
+				}
+			},
+		},
+		{
+			name:       "stopped instance is deleted for recreation",
+			proxy:      managedProxy(withProviderID("stub-id-1"), withSpecHashAnnotation(freshHash)),
+			stub:       &stubProvider{getInst: &provider.Instance{ID: "stub-id-1", State: provider.StateStopped}},
+			wantResult: ctrl.Result{RequeueAfter: tDeletionPoll},
+			verify: func(t *testing.T, r *ProxyReconciler, stub *stubProvider) {
+				if stub.deleteCalls != 1 {
+					t.Errorf("deleteCalls = %d, want 1", stub.deleteCalls)
+				}
+				assertCondition(t, getProxy(t, r), crawlv1alpha1.ConditionProvisioned, metav1.ConditionFalse, ReasonRecreating)
+			},
+		},
+		{
+			name: "vanished instance clears ID for recreation",
+			proxy: managedProxy(withProviderID("stub-id-1"), withSpecHashAnnotation(freshHash),
+				func(p *crawlv1alpha1.Proxy) { p.Status.IP = "10.1.2.3" }),
+			stub:       &stubProvider{getErr: notFoundErr()},
+			wantResult: ctrl.Result{RequeueAfter: tRequeueNow},
+			verify: func(t *testing.T, r *ProxyReconciler, _ *stubProvider) {
+				p := getProxy(t, r)
+				if p.Status.ProviderID != "" || p.Status.IP != "" {
+					t.Errorf("providerID/ip = %q/%q, want both cleared", p.Status.ProviderID, p.Status.IP)
+				}
+			},
+		},
+		{
+			name:  "hash mismatch deletes the old instance",
+			proxy: managedProxy(withProviderID("stub-id-1"), withSpecHashAnnotation("stale-hash")),
+			stub: &stubProvider{
+				getInst: &provider.Instance{ID: "stub-id-1", IP: "10.1.2.3", State: provider.StateRunning},
+			},
+			wantResult: ctrl.Result{RequeueAfter: tDeletionPoll},
+			verify: func(t *testing.T, r *ProxyReconciler, stub *stubProvider) {
+				if stub.deleteCalls != 1 {
+					t.Errorf("deleteCalls = %d, want 1", stub.deleteCalls)
+				}
+				p := getProxy(t, r)
+				// The hash must not advance until the old instance is gone,
+				// or a crash would strand a half-replaced proxy.
+				if got := p.Annotations[crawlv1alpha1.AnnotationSpecHash]; got != "stale-hash" {
+					t.Errorf("spec-hash annotation = %q, want still stale-hash", got)
+				}
+				assertCondition(t, p, crawlv1alpha1.ConditionProvisioned, metav1.ConditionFalse, ReasonReplacing)
+			},
+		},
+		{
+			name:       "empty annotation adopts instead of replacing",
+			proxy:      managedProxy(withProviderID("stub-id-1")),
+			stub:       &stubProvider{},
+			wantResult: ctrl.Result{RequeueAfter: tRequeueNow},
+			verify: func(t *testing.T, r *ProxyReconciler, stub *stubProvider) {
+				p := getProxy(t, r)
+				if got := p.Annotations[crawlv1alpha1.AnnotationSpecHash]; got != freshHash {
+					t.Errorf("spec-hash annotation = %q, want %q", got, freshHash)
+				}
+				if p.Status.ProviderID != "stub-id-1" {
+					t.Errorf("providerID = %q, want untouched stub-id-1", p.Status.ProviderID)
+				}
+				if stub.deleteCalls != 0 {
+					t.Errorf("deleteCalls = %d, want 0 — adoption must not replace", stub.deleteCalls)
+				}
+			},
+		},
+		{
+			name:       "mismatch with instance gone advances the hash",
+			proxy:      managedProxy(withProviderID("stub-id-1"), withSpecHashAnnotation("stale-hash")),
+			stub:       &stubProvider{getErr: notFoundErr()},
+			wantResult: ctrl.Result{RequeueAfter: tRequeueNow},
+			verify: func(t *testing.T, r *ProxyReconciler, _ *stubProvider) {
+				p := getProxy(t, r)
+				if p.Status.ProviderID != "" {
+					t.Errorf("providerID = %q, want cleared", p.Status.ProviderID)
+				}
+				if got := p.Annotations[crawlv1alpha1.AnnotationSpecHash]; got != freshHash {
+					t.Errorf("spec-hash annotation = %q, want advanced to %q", got, freshHash)
+				}
+			},
+		},
+		{
+			name:       "deletion with no providerID removes the finalizer",
+			proxy:      managedProxy(deleting()),
+			stub:       &stubProvider{},
+			wantResult: ctrl.Result{},
+			verify: func(t *testing.T, r *ProxyReconciler, stub *stubProvider) {
+				assertProxyGone(t, r)
+				if stub.deleteCalls != 0 {
+					t.Errorf("deleteCalls = %d, want 0", stub.deleteCalls)
+				}
+			},
+		},
+		{
+			name:       "deletion with instance already gone removes the finalizer",
+			proxy:      managedProxy(deleting(), withProviderID("stub-id-1")),
+			stub:       &stubProvider{getErr: notFoundErr()},
+			wantResult: ctrl.Result{},
+			verify: func(t *testing.T, r *ProxyReconciler, _ *stubProvider) {
+				assertProxyGone(t, r)
+			},
+		},
+		{
+			name:  "deletion deletes the instance and polls",
+			proxy: managedProxy(deleting(), withProviderID("stub-id-1")),
+			stub: &stubProvider{
+				getInst: &provider.Instance{ID: "stub-id-1", State: provider.StateRunning},
+			},
+			wantResult: ctrl.Result{RequeueAfter: tDeletionPoll},
+			verify: func(t *testing.T, r *ProxyReconciler, stub *stubProvider) {
+				if stub.deleteCalls != 1 {
+					t.Errorf("deleteCalls = %d, want 1", stub.deleteCalls)
+				}
+				p := getProxy(t, r)
+				if p.Status.Phase != crawlv1alpha1.PhaseDeleting {
+					t.Errorf("phase = %s, want Deleting", p.Status.Phase)
+				}
+			},
+		},
+		{
+			name: "external proxy tracks its endpoint without a finalizer",
+			proxy: managedProxy(func(p *crawlv1alpha1.Proxy) {
+				p.Finalizers = nil
+				p.Spec = crawlv1alpha1.ProxySpec{
+					Mode:     crawlv1alpha1.ModeExternal,
+					Endpoint: &crawlv1alpha1.EndpointSpec{Host: "203.0.113.7", Port: 8080},
+				}
+			}),
+			stub:       &stubProvider{},
+			wantResult: ctrl.Result{},
+			verify: func(t *testing.T, r *ProxyReconciler, stub *stubProvider) {
+				p := getProxy(t, r)
+				if p.Status.IP != "203.0.113.7" {
+					t.Errorf("ip = %q, want the endpoint host", p.Status.IP)
+				}
+				if len(p.Finalizers) != 0 {
+					t.Errorf("finalizers = %v, want none on External", p.Finalizers)
+				}
+				assertCondition(t, p, crawlv1alpha1.ConditionProvisioned, metav1.ConditionTrue, ReasonExternalEndpoint)
+				if stub.createCalls+stub.getCalls+stub.deleteCalls != 0 {
+					t.Errorf("provider was called for an External proxy")
+				}
+			},
+		},
+		{
+			name:  "quota error backs off slowly without failing",
+			proxy: managedProxy(),
+			stub: &stubProvider{
+				createErr: provider.Wrap(provider.ErrQuotaExceeded, "create", "stub", "", nil),
+			},
+			wantResult: ctrl.Result{RequeueAfter: tQuotaRetry},
+			verify: func(t *testing.T, r *ProxyReconciler, _ *stubProvider) {
+				p := getProxy(t, r)
+				assertCondition(t, p, crawlv1alpha1.ConditionProvisioned, metav1.ConditionFalse, ReasonQuotaExceeded)
+				if p.Status.Phase == crawlv1alpha1.PhaseFailed {
+					t.Errorf("phase = Failed, want anything but — quota is a wait, not a failure")
+				}
+			},
+		},
+		{
+			name:  "permanent error latches Failed and stops calling the provider",
+			proxy: managedProxy(),
+			stub: &stubProvider{
+				createErr: provider.Wrap(provider.ErrPermanent, "create", "stub", "", nil),
+			},
+			wantResult: ctrl.Result{},
+			verify: func(t *testing.T, r *ProxyReconciler, stub *stubProvider) {
+				p := getProxy(t, r)
+				assertCondition(t, p, crawlv1alpha1.ConditionProvisioned, metav1.ConditionFalse, ReasonPermanentError)
+				if p.Status.Phase != crawlv1alpha1.PhaseFailed {
+					t.Errorf("phase = %s, want Failed", p.Status.Phase)
+				}
+				if res, err := doReconcile(t, r); err != nil || res != (ctrl.Result{}) {
+					t.Errorf("second reconcile = %+v, %v; want empty result, nil", res, err)
+				}
+				if stub.createCalls != 1 {
+					t.Errorf("createCalls = %d after latch, want 1", stub.createCalls)
+				}
+			},
+		},
+		{
+			name:  "transient error is returned for workqueue backoff",
+			proxy: managedProxy(),
+			stub: &stubProvider{
+				createErr: provider.Wrap(provider.ErrTransient, "create", "stub", "", nil),
+			},
+			wantResult: ctrl.Result{},
+			wantErr:    true,
+			verify: func(t *testing.T, r *ProxyReconciler, _ *stubProvider) {
+				p := getProxy(t, r)
+				if p.Status.Phase != crawlv1alpha1.PhasePending {
+					t.Errorf("phase = %s, want still Pending", p.Status.Phase)
+				}
+			},
+		},
+		{
+			name: "unconfigured provider is a permanent failure",
+			proxy: managedProxy(func(p *crawlv1alpha1.Proxy) {
+				p.Spec.Provider = "no-such-provider"
+			}),
+			stub:       &stubProvider{},
+			wantResult: ctrl.Result{},
+			verify: func(t *testing.T, r *ProxyReconciler, _ *stubProvider) {
+				p := getProxy(t, r)
+				assertCondition(t, p, crawlv1alpha1.ConditionProvisioned, metav1.ConditionFalse, ReasonPermanentError)
+				if p.Status.Phase != crawlv1alpha1.PhaseFailed {
+					t.Errorf("phase = %s, want Failed", p.Status.Phase)
+				}
+			},
+		},
+		{
+			name: "cloud-init secret is resolved into the create request",
+			proxy: managedProxy(func(p *crawlv1alpha1.Proxy) {
+				p.Spec.CloudInit = &crawlv1alpha1.CloudInitSpec{
+					SecretRef: &crawlv1alpha1.SecretKeySelector{Name: "ci-secret"},
+				}
+			}),
+			extraObjs: []client.Object{
+				&corev1.Secret{
+					ObjectMeta: metav1.ObjectMeta{Name: "ci-secret", Namespace: testNamespace},
+					Data:       map[string][]byte{"user-data": []byte("#cloud-config\npackages: [squid]")},
+				},
+			},
+			stub:       &stubProvider{createID: "stub-id-1"},
+			wantResult: ctrl.Result{RequeueAfter: tProvisioningPoll},
+			verify: func(t *testing.T, r *ProxyReconciler, stub *stubProvider) {
+				if want := "#cloud-config\npackages: [squid]"; stub.lastCreate.CloudInit != want {
+					t.Errorf("CreateRequest.CloudInit = %q, want the resolved secret content", stub.lastCreate.CloudInit)
+				}
+			},
+		},
+		{
+			name: "missing cloud-init secret errors and marks the condition",
+			proxy: managedProxy(func(p *crawlv1alpha1.Proxy) {
+				p.Spec.CloudInit = &crawlv1alpha1.CloudInitSpec{
+					SecretRef: &crawlv1alpha1.SecretKeySelector{Name: "absent"},
+				}
+			}),
+			stub:       &stubProvider{},
+			wantResult: ctrl.Result{},
+			wantErr:    true,
+			verify: func(t *testing.T, r *ProxyReconciler, stub *stubProvider) {
+				assertCondition(t, getProxy(t, r), crawlv1alpha1.ConditionProvisioned, metav1.ConditionFalse, ReasonCloudInitError)
+				if stub.createCalls != 0 {
+					t.Errorf("createCalls = %d, want 0 with unresolved cloud-init", stub.createCalls)
+				}
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			objs := append([]client.Object{tc.proxy}, tc.extraObjs...)
+			r := newTestReconciler(t, tc.stub, objs...)
+			res, err := doReconcile(t, r)
+			if (err != nil) != tc.wantErr {
+				t.Fatalf("Reconcile error = %v, wantErr %v", err, tc.wantErr)
+			}
+			if res != tc.wantResult {
+				t.Errorf("Result = %+v, want %+v", res, tc.wantResult)
+			}
+			tc.verify(t, r, tc.stub)
+		})
+	}
+}
+
+func assertProxyGone(t *testing.T, r *ProxyReconciler) {
+	t.Helper()
+	var p crawlv1alpha1.Proxy
+	err := r.Get(context.Background(), types.NamespacedName{Namespace: testNamespace, Name: testProxyName}, &p)
+	if !apierrors.IsNotFound(err) {
+		t.Errorf("proxy still exists (err=%v), want NotFound after finalizer removal", err)
+	}
+}