kacerr/egress-proxies-operator
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Add the Kubernetes pod provider (replaces the removed mock)

Browse Source 
Create/Get/Delete/ListByTag against real corev1.Pod objects in the same
cluster the operator runs in, running an ubuntu/squid container -- picked
by actually checking Docker Hub metadata (Canonical-published, rebuilt
the same day this was decided, 50M+ pulls) rather than guessing an image
reference. It's a public image, so kind nodes pull it directly with no
build/load step.

providerID is "<namespace>/<podName>", parsed via
cache.SplitMetaNamespaceKey -- the same self-contained-providerID
reasoning the plan already calls for on the GCP provider's zone-qualified
IDs. Pod state maps to InstanceState with Succeeded/Failed/Unknown all
collapsing to Terminated, since the reconciler already treats Stopped and
Terminated identically; Running-without-PodIP maps to Provisioning so an
empty IP is never published.

The client is built internally via ctrl.GetConfig() (in-cluster or local
kubeconfig, whichever applies), not threaded through the registry
Constructor signature -- this is what lets `make run` against a local
kind cluster and running in-cluster share the exact same code path with
no provider-specific wiring in cmd/main.go. New() is deliberately
untested (0% coverage): it's the one function that must never run under
`go test`, since it would happily connect to whatever cluster the
developer's kubeconfig points at. Tests construct Provider via an
unexported newWithClient(client, cfg) instead.

ListByTag lists Pods across every namespace (orphan GC needs to find
every tagged Pod regardless of where it landed), which means this
provider's RBAC has to be a ClusterRole rather than namespace-scoped --
flagged now, wired in Step 10.

provider.Config gains KubernetesConfig (replacing MockConfig) and drops
the FailWith*/fault-injection surface entirely, since that need is now
served by a small in-test stub Provider for reconciler tests (Step 4),
not a config-driven mechanism on a real provider package.

Tests use sigs.k8s.io/controller-runtime/pkg/client/fake -- real Pod
objects, the real client.Client interface -- at 77.6% coverage.
make test green across the whole repo.

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Jan Novak
2026-08-08 00:17:50 +02:00
parent 4529594fb7
commit ff859ebd84
9 changed files with 753 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
internal/provider/config.go
View File

@@ -7,23 +7,6 @@ import (
"sigs.k8s.io/yaml"
)
// Fail-with classes accepted by MockConfig.FailWith, shared with the mock
// provider's fault injection so the two sides never drift on the string
// values.
const (
FailWithNotFound = "notfound"
FailWithQuota = "quota"
FailWithTransient = "transient"
FailWithPermanent = "permanent"
)
var validFailClasses = map[string]bool{
FailWithNotFound: true,
FailWithQuota: true,
FailWithTransient: true,
FailWithPermanent: true,
}
// Config is the top-level shape of the --providers-config file.
type Config struct {
Providers []ProviderConfig `json:"providers"`
@@ -34,27 +17,17 @@ type Config struct {
// blocks. Exactly one of the type-specific blocks below should be set,
// matching Type.
type ProviderConfig struct {
Name string `json:"name"`
Type string `json:"type"`
Mock *MockConfig `json:"mock,omitempty"`
GCP *GCPConfig `json:"gcp,omitempty"`
Name string `json:"name"`
Type string `json:"type"`
Kubernetes *KubernetesConfig `json:"kubernetes,omitempty"`
GCP *GCPConfig `json:"gcp,omitempty"`
}
// MockConfig configures the in-memory mock provider.
type MockConfig struct {
// ProvisionDelaySeconds is how long a created instance reports
// Provisioning before Running. Default 5.
ProvisionDelaySeconds int32 `json:"provisionDelaySeconds,omitempty"`
// DeleteDelaySeconds is how long a deleted instance reports Terminated
// before Get starts returning ErrNotFound. Default 1.
DeleteDelaySeconds int32 `json:"deleteDelaySeconds,omitempty"`
// FailNextCreates makes the next N Create calls fail with FailWith,
// for exercising the reconciler's error handling in demos.
FailNextCreates int `json:"failNextCreates,omitempty"`
// FailWith selects the error class injected failures return: one of
// FailWithNotFound/FailWithQuota/FailWithTransient/FailWithPermanent.
// Default FailWithTransient.
FailWith string `json:"failWith,omitempty"`
// KubernetesConfig configures the kubernetes-pod provider, which creates
// proxy Pods in the same cluster the operator itself runs in.
type KubernetesConfig struct {
// Image is the proxy container image. Default "ubuntu/squid:6.6-24.04_edge".
Image string `json:"image,omitempty"`
}
// GCPConfig configures a named GCP provider instance.
@@ -109,16 +82,13 @@ func (c *Config) validate() error {
seen[p.Name] = true
switch p.Type {
case "mock":
case "kubernetes":
if p.GCP != nil {
return fmt.Errorf("providers[%d] %q: type is mock but a gcp block is set", i, p.Name)
}
if p.Mock != nil && p.Mock.FailWith != "" && !validFailClasses[p.Mock.FailWith] {
return fmt.Errorf("providers[%d] %q: unknown mock.failWith %q", i, p.Name, p.Mock.FailWith)
return fmt.Errorf("providers[%d] %q: type is kubernetes but a gcp block is set", i, p.Name)
}
case "gcp":
if p.Mock != nil {
return fmt.Errorf("providers[%d] %q: type is gcp but a mock block is set", i, p.Name)
if p.Kubernetes != nil {
return fmt.Errorf("providers[%d] %q: type is gcp but a kubernetes block is set", i, p.Name)
}
if p.GCP == nil || p.GCP.Project == "" {
return fmt.Errorf("providers[%d] %q: gcp.project is required", i, p.Name)