kacerr/gatewayapi-certificates-operator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: address review findings on the conventions branch

Browse Source 
- ci: reject a manual dispatch with tag "latest"; concurrency group per tag
- Dockerfile: declare GIT_COMMIT after the module download layer
- Makefile: docker-build targets linux/amd64 by default
- patch.go: no shared package-level pointers; main.go: no init()
- tests: assert that merge replaces managed listener content
- docs: flows.md startup section matches main.go; review saved to docs/reviews

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
kacerr
2026-10-08 20:43:02 +02:00
co-authored by Claude Opus 5.5
parent 8c074288c6
commit 60360ca5b9
10 changed files with 138 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/flows.md
+22 -14
View File
@@ -35,27 +35,35 @@ Executed once at process start (`main.go`):
```
process start
│
├─ init() [main.go:22-26]
│ ├─ clientgoscheme.AddToScheme(scheme) # core/v1: Secrets, Events, …
│ ├─ cmv1.AddToScheme(scheme) # cert-manager.io/v1 Certificate
│ └─ gwapiv1.Install(scheme) # gateway.networking.k8s.io/v1 Gateway
│
└─ main() [main.go:28]
└─ main() [main.go:24]
│
├─ flag.StringVar --metrics-bind-address default ":8080" [main.go:32]
├─ flag.StringVar --health-probe-bind-address default ":8081" [main.go:33]
├─ flag.StringVar --metrics-bind-address default ":8080" [main.go:29]
├─ flag.StringVar --health-probe-bind-address default ":8081" [main.go:30]
├─ flag.BoolVar --version [main.go:31]
├─ zap.Options{Development: true, AddCaller}.BindFlags [main.go:32-33]
│ adds --zap-devel, --zap-encoder, --zap-log-level, …
├─ flag.Parse() [main.go:34]
│
├─ ctrl.SetLogger(zap, UseDevMode=true, AddCaller) [main.go:36-41]
│ dev-mode console logger with file:line call site
├─ --version ──► print version.Resolve(), return [main.go:36-39]
│ before any logger or cluster access
│
├─ scheme := runtime.NewScheme() [main.go:41-44]
│ ├─ clientgoscheme.AddToScheme(scheme) # core/v1: Secrets, Events, …
│ ├─ cmv1.AddToScheme(scheme) # cert-manager.io/v1 Certificate
│ └─ gwapiv1.Install(scheme) # gateway.networking.k8s.io/v1 Gateway
│
├─ ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts))) [main.go:46]
│ dev-mode console logger with file:line call site unless
│ --zap-devel=false is passed
├─ log "starting gateway-cert-operator" commit=… goVersion=… [main.go:48]
│
├─ ctrl.GetConfigOrDie() # KUBECONFIG or in-cluster config
│ on err ──► os.Exit(1)
│
├─ ctrl.NewManager(cfg, Options{Scheme, Metrics, HealthProbeBindAddress})
│ on err ──► log + os.Exit(1) [main.go:44-47]
│ on err ──► log + os.Exit(1) [main.go:50-54]
│
├─ controller.SetupCertificateReconciler(mgr) [main.go:53]
├─ controller.SetupCertificateReconciler(mgr) [main.go:60]
│ registers field index + watches (see §3)
│ on err ──► log + os.Exit(1)
│
@@ -63,7 +71,7 @@ process start
├─ mgr.AddReadyzCheck("readyz", healthz.Ping) → GET /readyz:8081
│ on err ──► log + os.Exit(1)
│
└─ mgr.Start(ctrl.SetupSignalHandler()) [main.go:68]
└─ mgr.Start(ctrl.SetupSignalHandler()) [main.go:75]
SetupSignalHandler installs SIGINT / SIGTERM cancel
mgr.Start blocks; on shutdown → graceful stop
on err ──► log + os.Exit(1)
@@ -479,7 +487,7 @@ Described in §6c. Drift in `Protocol`, `AllowedRoutes`, `TLS.Options`, or any `
Branch (F) of Reconcile treats all Gateway `Get` errors the same (including `NotFound`) and returns them as re-queue-able errors. A Certificate with a typo'd `gateway-name` annotation will retry with rate-limited backoff indefinitely, generating log noise and API load. There is no terminal failure path.
**6. No leader election**
`ctrl.NewManager` at `main.go:44` does not set `LeaderElection: true`. The `deploy/deployment_gateway-cert-operator.yaml` runs `replicas: 1` which makes this safe today. Scaling to multiple replicas without enabling leader election would result in concurrent Gateway patches.
`ctrl.NewManager` at `main.go:50` does not set `LeaderElection: true`. The `deploy/deployment_gateway-cert-operator.yaml` runs `replicas: 1` which makes this safe today. Scaling to multiple replicas without enabling leader election would result in concurrent Gateway patches.
**7. `listenerNameFor` edge cases**
- **Wildcard hostnames**: `*.example.com` produces `SectionName` `auto-…-*-example-com`. The `*` character is not valid in an RFC 1123 label; the Gateway API server will reject the Patch, causing an error-retry loop.