simplify

Author: drewmalin

v1/providers/testkube/README.md

@@ -1,6 +1,6 @@
 # Test Kubernetes Provider
 
-`test-kubernetes` is a developer-only provider that backs cloud instance lifecycle calls with Kubernetes resources.
+`test-kubernetes` is a test/non-prod-only provider that backs cloud instance lifecycle calls with Kubernetes resources.
 
 ## Credentials
 
@@ -52,89 +52,4 @@ Clean up:
 
 ```bash
 minikube --profile testkube delete
-```
-
-### CI: kind
-
-kind remains the preferred CI path because it runs a disposable Kubernetes cluster on the GitHub Linux runner's Docker runtime. The CI path still uses `cloud-provider-kind` to provide `LoadBalancer` Services, but the provider itself only reads standard Kubernetes Service status.
-
-Minimal GitHub Actions sketch:
-
-```yaml
-jobs:
-  testkube-validation:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-      - name: Install cloud-provider-kind
-        run: go install sigs.k8s.io/cloud-provider-kind@latest
-      - name: Create kind cluster
-        run: |
-          kind create cluster --name testkube --wait 5m
-          kubectl label node testkube-control-plane node.kubernetes.io/exclude-from-external-load-balancers- || true
-          docker build -t ghcr.io/brevdev/cloud/testkube-ubuntu-vm:latest ./v1/providers/testkube/images/ubuntu-vm
-          kind load docker-image ghcr.io/brevdev/cloud/testkube-ubuntu-vm:latest --name testkube
-          kubectl create namespace testkube
-          echo "TESTKUBE_KUBECONFIG_BASE64=$(kind get kubeconfig --name testkube | base64 | tr -d '\n')" >> "$GITHUB_ENV"
-          echo "TESTKUBE_NAMESPACE=testkube" >> "$GITHUB_ENV"
-          echo "VALIDATION_TEST=1" >> "$GITHUB_ENV"
-      - name: Start cloud-provider-kind
-        run: |
-          sudo "$(go env GOPATH)/bin/cloud-provider-kind" > /tmp/cloud-provider-kind.log 2>&1 &
-      - name: Run provider validation
-        run: go test -v -run 'TestValidationFunctions|TestInstanceLifecycleValidation|TestFailureInstanceTypesValidation' ./v1/providers/testkube
-```
-
-These tests validate inventory, Kubernetes resource creation/listing, SSH access, stop/start/delete, and configured failure types. They do not validate dev-plane software setup.
-
-### Image-Backed SSH Validation
-
-Build the local image:
-
-```bash
-docker build -t ghcr.io/brevdev/cloud/testkube-ubuntu-vm:latest ./v1/providers/testkube/images/ubuntu-vm
-```
-
-For local minikube validation, load the image into the minikube profile:
-
-```bash
-minikube --profile testkube image load ghcr.io/brevdev/cloud/testkube-ubuntu-vm:latest
-```
-
-For CI kind validation, load the image into the kind cluster:
-
-```bash
-kind load docker-image ghcr.io/brevdev/cloud/testkube-ubuntu-vm:latest --name testkube
-```
-
-Then run the focused SSH validation:
-
-```bash
-go test -v -run TestImageBackedInstanceValidation ./v1/providers/testkube
-```
-
-`TestImageBackedInstanceValidation` creates a `test.ok.cpu` instance with the baked image tag, waits for the pod and load balancer to become ready, uses the provider-returned SSH endpoint, and verifies key-based SSH plus `sudo`, `apt-get`, and systemd basics.
-
-CI can add the same build/load step before running the image-backed test:
-
-```yaml
-      - name: Build local testkube image
-        run: docker build -t ghcr.io/brevdev/cloud/testkube-ubuntu-vm:latest ./v1/providers/testkube/images/ubuntu-vm
-      - name: Load local testkube image into kind
-        run: kind load docker-image ghcr.io/brevdev/cloud/testkube-ubuntu-vm:latest --name testkube
-      - name: Run image-backed validation
-        run: go test -v -run TestImageBackedInstanceValidation ./v1/providers/testkube
-```
-
-## Image Contract
-
-`test.ok.cpu` points at `ghcr.io/brevdev/cloud/testkube-ubuntu-vm:latest`. Before that image is published to GHCR, build the local image with that same tag. Once the image is published, local and CI validation can either pull it or keep building and loading the same tag for hermetic tests.
-
-The image at `images/ubuntu-vm` is expected to behave like a minimal Ubuntu VM for dev-plane: SSH access, `sudo`, `apt-get`, and systemd compatibility.
-
-The cloud provider does not lay down dev-plane software; dev-plane owns that. The image only needs to provide a base OS environment that dev-plane setup can use.
-
-Future exposure modes, such as fixed `NodePort` for one-off local debugging, should be separate instance type specs rather than credential fields.
+```

v1/providers/testkube/instance.go

@@ -6,6 +6,7 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
+	"regexp"
 	"slices"
 	"strings"
 	"time"
@@ -365,18 +366,22 @@ func (c *TestKubeClient) instanceFromResources(pod *corev1.Pod, service *corev1.
 }
 
 func populateNetwork(service *corev1.Service, instance *cloudv1.Instance) {
+	// Default the private IP to the cluster IP.
 	if service.Spec.ClusterIP != "" && service.Spec.ClusterIP != corev1.ClusterIPNone {
 		instance.PrivateIP = service.Spec.ClusterIP
 	}
+	// Default the SSH port to the first open port.
 	if len(service.Spec.Ports) > 0 {
 		instance.SSHPort = int(service.Spec.Ports[0].Port)
 	}
 
 	switch service.Spec.Type {
 	case corev1.ServiceTypeLoadBalancer:
+		// No ingress means no public IP.
 		if len(service.Status.LoadBalancer.Ingress) == 0 {
 			return
 		}
+		// Set the public IP to the first ingress IP.
 		ingress := service.Status.LoadBalancer.Ingress[0]
 		if ingress.IP != "" {
 			instance.PublicIP = ingress.IP
@@ -389,11 +394,14 @@ func populateNetwork(service *corev1.Service, instance *cloudv1.Instance) {
 			}
 		}
 	case corev1.ServiceTypeNodePort:
+		// No ports means no node port.
 		if len(service.Spec.Ports) == 0 {
 			return
 		}
+		// Set the SSH port to the first node port.
 		instance.SSHPort = int(service.Spec.Ports[0].NodePort)
 	case corev1.ServiceTypeClusterIP:
+		// Keep the cluster IP as the private IP.
 	}
 }
 
@@ -589,24 +597,15 @@ func tagsFromAnnotations(annotations map[string]string) cloudv1.Tags {
 	return tags
 }
 
+var invalidLabelValueCharPattern = regexp.MustCompile(`[^a-z0-9_.-]`)
+
+const maxLabelValueLength = 63
+
 func sanitizeLabelValue(value string) string {
-	value = strings.ToLower(value)
-	var builder strings.Builder
-	for _, r := range value {
-		switch {
-		case r >= 'a' && r <= 'z':
-			builder.WriteRune(r)
-		case r >= '0' && r <= '9':
-			builder.WriteRune(r)
-		case r == '-' || r == '_' || r == '.':
-			builder.WriteRune(r)
-		default:
-			builder.WriteRune('-')
-		}
-	}
-	sanitized := strings.Trim(builder.String(), "-_.")
-	if len(sanitized) > 63 {
-		sanitized = sanitized[:63]
+	sanitized := invalidLabelValueCharPattern.ReplaceAllString(strings.ToLower(value), "-")
+	sanitized = strings.Trim(sanitized, "-_.")
+	if len(sanitized) > maxLabelValueLength {
+		sanitized = sanitized[:maxLabelValueLength]
 		sanitized = strings.TrimRight(sanitized, "-_.")
 	}
 	if sanitized == "" {