@@ -28,155 +28,5 @@ KUBEBUILDER_ASSETS="$(go run sigs.k8s.io/controller-runtime/tools/setup-envtest@
2828- ** Related resources** (Secrets/ConfigMaps): direction is per-rule —
2929 ` FromProvider ` (provider→consumer) or ` FromConsumer ` (consumer→provider).
3030
31- ---
32-
33- ## E2E scenarios (` test/e2e/ ` )
34-
35- ### ` TestSlimCoreHappyCase ` — [ sync_test.go] ( e2e/sync_test.go )
36- The full one-apply flow (Secret + Connection + ClusterBinding), stepped in order:
37-
38- | # | Scenario | Asserts |
39- | ---| ---| ---|
40- | 1 | Connection becomes Ready and discovers the exported API | discovery → ` status.exportedAPIs ` , Ready |
41- | 2 | provider heartbeat Lease is maintained and renewed | ` coordination.k8s.io/Lease ` on provider, renewed |
42- | 3 | ClusterBinding Ready and the CRD is pulled onto the consumer | ` schema.source: CRD ` pull, ` boundAPIs ` , managed marker |
43- | 4 | instance spec syncs consumer → provider | SSA + ownership markers + syncer finalizer |
44- | 5 | status syncs provider → consumer | status subresource flows down |
45- | 6 | spec update syncs consumer → provider | update propagation |
46- | 7 | conflict: foreign provider object not overwritten | ` conflictPolicy: Fail ` , ` conflictCount ` + ` Conflicts ` condition |
47- | 8 | consumer delete removes the provider copy + releases finalizer | delete propagation |
48- | 9 | deleting a conflicting consumer object leaves the foreign provider object intact | conflict-safe delete |
49- | 10 | a CRD exported after connect is picked up | periodic re-discovery |
50- | 11 | ` conflictPolicy: Adopt ` takes over an un-owned provider object | adopt (never steals an owned object) |
51- | 12 | Connection created before its Secret resolves when the Secret arrives | order-independence (Secret watch) |
52- | 13 | Secret survives deletion while its Connection exists, released on Connection delete | Secret finalizer |
53- | 14 | a Secret shared by multiple Connections released only when the last is deleted | shared-Secret refcount |
54- | 15 | deleting the ClusterBinding unbinds and cleans up | full unbind |
55-
56- ### ` TestSlimCorePolicies ` — [ policies_test.go] ( e2e/policies_test.go )
57- | Scenario | Asserts |
58- | ---| ---|
59- | ` deletion-policy: Orphan ` keeps the provider copy | orphan on delete/unbind |
60- | ` updatePolicy: Always ` follows provider CRD changes | schema tracking |
61- | ` autoBind ` maintains a managed ClusterBinding | auto-bind mirrors exported APIs |
62- | ` pullPolicy: All ` installs CRDs without a binding | pull-all |
63- | ` PermissionDenied ` surfaces on a restricted Connection | provider RBAC denial → condition/Event |
64-
65- ### ` TestSlimCoreRelatedResources ` — [ related_resources_test.go] ( e2e/related_resources_test.go )
66- | Scenario | Asserts |
67- | ---| ---|
68- | a label-selected provider ** Secret** syncs to the consumer | ` FromProvider ` + labelSelector |
69- | the synced copy is GC'd when it stops matching | GC on stop-matching |
70-
71- ### ` TestSlimCoreRelatedConfigMaps ` — [ related_resources_more_test.go] ( e2e/related_resources_more_test.go )
72- | Scenario | Asserts |
73- | ---| ---|
74- | a label-selected provider ** ConfigMap** syncs to the consumer | ` FromProvider ` ConfigMap |
75- | the synced ConfigMap is GC'd when it stops matching | GC |
76- | a foreign ConfigMap of the same name is not overwritten | foreign-object guard |
77-
78- ### ` TestSlimCoreRelatedReverseDirection ` — [ related_resources_more_test.go] ( e2e/related_resources_more_test.go )
79- | Scenario | Asserts |
80- | ---| ---|
81- | a label-selected consumer ** Secret** syncs ** up** to the provider | ` FromConsumer ` (reverse) |
82- | the provider copy is GC'd when the consumer Secret stops matching | reverse GC |
83-
84- ### ` TestSlimCoreRelatedNamedSelector ` — [ related_resources_more_test.go] ( e2e/related_resources_more_test.go )
85- | Scenario | Asserts |
86- | ---| ---|
87- | only the named ConfigMap syncs; a non-named one does not | ` selector.names ` |
88-
89- ### ` TestSlimCoreRelatedCleanupOnUnbind ` — [ related_resources_more_test.go] ( e2e/related_resources_more_test.go )
90- | Scenario | Asserts |
91- | ---| ---|
92- | deleting the binding removes the related copies | ` cleanupRelated ` on unbind |
93-
94- ### ` TestSlimCoreOpenAPISource ` — [ schema_source_test.go] ( e2e/schema_source_test.go )
95- | Scenario | Asserts |
96- | ---| ---|
97- | Connection synthesizes and installs the CRD via OpenAPI | ` schema.source: OpenAPI ` (CRD-less provider) |
98- | a binding syncs an instance over the synthesized CRD | sync works on a synthesized CRD |
99-
100- ### ` TestSlimCoreKCPLikeProvider ` — [ schema_source_test.go] ( e2e/schema_source_test.go )
101- | Scenario | Asserts |
102- | ---| ---|
103- | identity is pinned from the LogicalCluster | kcp identity (LogicalCluster UID over kube-system) |
104- | instances sync against the kcp-like provider | end-to-end on a kcp-shaped provider |
105-
106- ### ` TestSlimCoreStopOnDisengage ` — [ disengage_test.go] ( e2e/disengage_test.go )
107- | Scenario | Asserts |
108- | ---| ---|
109- | a Connection that loses readiness disengages | syncers torn down, not left against a dead cluster |
110- | re-engage rebuilds the syncer and sync resumes | fresh cluster on re-engage |
111-
112- ### ` TestSlimCoreNamespacedBinding ` — [ namespaced_binding_test.go] ( e2e/namespaced_binding_test.go )
113- | Scenario | Asserts |
114- | ---| ---|
115- | the namespaced Binding becomes Ready and pulls the CRD | namespaced ` Binding ` kind reconciles |
116- | an instance in the bound namespace syncs to the provider | namespace-scoped sync |
117- | an instance in another namespace is not synced | scope enforcement (ClusterBinding would cover all; a Binding only its namespace) |
118-
119- ---
120-
121- ## Unit tests (` engine/*/ ` )
122-
123- ### ` engine/crdpull ` — [ crdpull_test.go] ( ../engine/crdpull/crdpull_test.go )
124- | Test | Covers |
125- | ---| ---|
126- | ` TestPull_BoundCreatesCRD ` | default pull creates the CRD |
127- | ` TestPull_UpdatePolicyOnce_DoesNotUpdate ` | ** ` updatePolicy: Once ` ** pins the schema |
128- | ` TestPull_UpdatePolicyAlways_FollowsProviderChanges ` | ` updatePolicy: Always ` |
129- | ` TestPull_NoneAbsent_NotInstalled ` | ** ` pullPolicy: None ` ** does not install |
130- | ` TestPull_NonePresent_StampsMarkers ` | ` pullPolicy: None ` still stamps markers on an existing CRD |
131-
132- ### ` engine/remote ` — [ remote_test.go] ( ../engine/remote/remote_test.go )
133- | Test | Covers |
134- | ---| ---|
135- | ` TestClusterUID_KubeSystem ` | identity from kube-system on plain k8s |
136- | ` TestClusterUID_KCPLogicalClusterFallback ` | identity from LogicalCluster |
137- | ` TestClusterUID_LogicalClusterWinsWhenBothPresent ` | LogicalCluster preferred |
138- | ` TestClusterUID_NoSource ` | error when neither is present |
139-
140- ### ` engine/mapper ` — [ mapper_test.go] ( ../engine/mapper/mapper_test.go )
141- | Test | Covers |
142- | ---| ---|
143- | ` TestIdentity_RoundTrips ` | ` Identity ` mapper key round-trip |
144- | ` TestMapper_NonIdentityRoundTrips ` | a ** custom (non-identity) Mapper** round-trip contract |
145-
146- ---
147-
148- ## Coverage matrix (by feature)
149-
150- | Feature | e2e | unit |
151- | ---| ---| ---|
152- | Connection: secret resolve, identity pin, discovery | ✅ | — |
153- | Heartbeat Lease | ✅ | — |
154- | Schema delivery: CRD pull | ✅ | ✅ |
155- | Schema delivery: OpenAPI synthesis / Auto | ✅ | — |
156- | ` pullPolicy ` : Bound (default), All | ✅ | — |
157- | ` pullPolicy ` : None | — | ✅ |
158- | ` updatePolicy ` : Always | ✅ | ✅ |
159- | ` updatePolicy ` : Once | — | ✅ |
160- | Instance sync: spec up / status down / update | ✅ | — |
161- | Conflicts: ` Fail ` (no overwrite), ` Adopt ` | ✅ | — |
162- | ` deletion-policy: Orphan ` | ✅ | — |
163- | ` autoBind ` | ✅ | — |
164- | Order-independent apply + Secret lifecycle | ✅ | — |
165- | Unbind / cleanup (instances, CRD, related) | ✅ | — |
166- | Related: ` FromProvider ` Secret + ConfigMap, GC, foreign guard | ✅ | — |
167- | Related: ` FromConsumer ` (reverse) Secret, GC | ✅ | — |
168- | Related: ` names ` selector | ✅ | — |
169- | Stop-on-disengage + re-engage | ✅ | — |
170- | kcp ` LogicalCluster ` identity | ✅ | ✅ |
171- | ` PermissionDenied ` / provider RBAC | ✅ | — |
172- | Mapper extension point | Identity only (implicit) | ✅ (contract) |
173-
174- ## Not covered yet
175-
176- - ** Custom ` Mapper ` end-to-end** — the contract is unit-tested; no e2e wires a
177- non-identity mapper through the running syncer.
178- - ** ` pullPolicy: None ` / ` updatePolicy: Once ` in e2e** — unit-tested in ` crdpull ` .
179- - ** ` FromConsumer ` ConfigMap** — only the ` FromConsumer ` Secret path is e2e'd
180- (direction is resource-kind-agnostic in the code, so this is cosmetic).
181- - ** Conversion-webhook CRDs** — not refused yet; not tested (known gap).
182- - ** Multi-version CRDs** — accepted limitation; not tested.
31+ ` disengage_test.go ` , ` namespaced_binding_test.go ` .
32+ - ** unit** — ` engine/crdpull ` , ` engine/remote ` , ` engine/mapper ` (` *_test.go ` next to the code).
0 commit comments