test: add unit tests for daemonset and service & validation

Author: maltesander

rust/operator-binary/src/controller/build/resource/daemonset.rs

@@ -837,3 +837,175 @@ fn build_prepare_start_command(merged_config: &OpaConfig, container_name: &str)
 
     prepare_container_args
 }
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+    use stackable_operator::{
+        commons::networking::DomainName, k8s_openapi::api::core::v1::ServiceAccount,
+        k8s_openapi::apimachinery::pkg::apis::meta::v1::ObjectMeta,
+    };
+
+    use super::*;
+    use crate::{
+        controller::build::properties::test_support::validated_cluster_from_spec, crd::OpaRole,
+    };
+
+    fn cluster_info() -> KubernetesClusterInfo {
+        KubernetesClusterInfo {
+            cluster_domain: DomainName::try_from("cluster.local").unwrap(),
+        }
+    }
+
+    fn service_account() -> ServiceAccount {
+        ServiceAccount {
+            metadata: ObjectMeta {
+                name: Some("test-opa-serviceaccount".to_owned()),
+                ..Default::default()
+            },
+            ..Default::default()
+        }
+    }
+
+    fn build(cluster: &ValidatedCluster) -> DaemonSet {
+        let (role_group_name, role_group) = cluster.role_group_configs[&OpaRole::Server]
+            .iter()
+            .next()
+            .expect("the default role group should exist");
+        build_server_rolegroup_daemonset(
+            cluster,
+            role_group_name,
+            role_group,
+            "bundle-builder-image",
+            "user-info-fetcher-image",
+            &service_account(),
+            &cluster_info(),
+        )
+        .expect("the daemonset should build")
+    }
+
+    fn container_names(ds: &DaemonSet) -> Vec<String> {
+        ds.spec
+            .as_ref()
+            .unwrap()
+            .template
+            .spec
+            .as_ref()
+            .unwrap()
+            .containers
+            .iter()
+            .map(|c| c.name.clone())
+            .collect()
+    }
+
+    fn volume_names(ds: &DaemonSet) -> Vec<String> {
+        ds.spec
+            .as_ref()
+            .unwrap()
+            .template
+            .spec
+            .as_ref()
+            .unwrap()
+            .volumes
+            .as_ref()
+            .unwrap()
+            .iter()
+            .map(|v| v.name.clone())
+            .collect()
+    }
+
+    #[test]
+    fn daemonset_has_expected_name_and_rolling_update_strategy() {
+        let ds = build(&validated_cluster_from_spec(json!({
+            "image": { "productVersion": "1.2.3" },
+            "servers": { "roleGroups": { "default": {} } },
+        })));
+
+        assert_eq!(ds.metadata.name.as_deref(), Some("test-opa-server-default"));
+        let strategy = ds.spec.as_ref().unwrap().update_strategy.as_ref().unwrap();
+        assert_eq!(strategy.type_.as_deref(), Some("RollingUpdate"));
+        let rolling_update = strategy.rolling_update.as_ref().unwrap();
+        // A DaemonSet must never take an OPA pod down before the replacement is ready.
+        assert_eq!(rolling_update.max_unavailable, Some(IntOrString::Int(0)));
+    }
+
+    #[test]
+    fn daemonset_runs_opa_and_bundle_builder_with_prepare_init_container() {
+        let ds = build(&validated_cluster_from_spec(json!({
+            "image": { "productVersion": "1.2.3" },
+            "servers": { "roleGroups": { "default": {} } },
+        })));
+
+        let containers = container_names(&ds);
+        assert!(containers.contains(&"opa".to_owned()));
+        assert!(containers.contains(&"bundle-builder".to_owned()));
+        // No sidecars without the corresponding cluster config.
+        assert!(!containers.contains(&"user-info-fetcher".to_owned()));
+        assert!(!containers.contains(&"vector".to_owned()));
+
+        let pod_spec = ds.spec.as_ref().unwrap().template.spec.as_ref().unwrap();
+        let init_containers: Vec<_> = pod_spec
+            .init_containers
+            .as_ref()
+            .unwrap()
+            .iter()
+            .map(|c| c.name.clone())
+            .collect();
+        assert_eq!(init_containers, vec!["prepare".to_owned()]);
+
+        // The standard volumes are always present; the TLS volume is not (no TLS configured).
+        let volumes = volume_names(&ds);
+        for expected in ["config", "bundles", "log"] {
+            assert!(
+                volumes.contains(&expected.to_owned()),
+                "missing volume {expected}"
+            );
+        }
+        assert!(!volumes.contains(&"tls".to_owned()));
+    }
+
+    #[test]
+    fn daemonset_adds_vector_container_when_agent_enabled() {
+        let ds = build(&validated_cluster_from_spec(json!({
+            "image": { "productVersion": "1.2.3" },
+            "clusterConfig": { "vectorAggregatorConfigMapName": "vector-aggregator-discovery" },
+            "servers": {
+                "config": { "logging": { "enableVectorAgent": true } },
+                "roleGroups": { "default": {} },
+            },
+        })));
+
+        assert!(container_names(&ds).contains(&"vector".to_owned()));
+    }
+
+    #[test]
+    fn daemonset_adds_user_info_fetcher_container_when_configured() {
+        let ds = build(&validated_cluster_from_spec(json!({
+            "image": { "productVersion": "1.2.3" },
+            "clusterConfig": {
+                "userInfo": {
+                    "backend": {
+                        "experimentalXfscAas": {
+                            "hostname": "aas.default.svc.cluster.local",
+                            "port": 5000,
+                        }
+                    }
+                }
+            },
+            "servers": { "roleGroups": { "default": {} } },
+        })));
+
+        assert!(container_names(&ds).contains(&"user-info-fetcher".to_owned()));
+    }
+
+    #[test]
+    fn daemonset_adds_tls_volume_when_tls_enabled() {
+        let ds = build(&validated_cluster_from_spec(json!({
+            "image": { "productVersion": "1.2.3" },
+            "clusterConfig": { "tls": { "serverSecretClass": "tls" } },
+            "servers": { "roleGroups": { "default": {} } },
+        })));
+
+        assert!(volume_names(&ds).contains(&"tls".to_owned()));
+    }
+}

rust/operator-binary/src/controller/build/resource/service.rs

@@ -204,3 +204,112 @@ fn prometheus_annotations(tls_enabled: bool) -> Annotations {
     ])
     .expect("should be valid annotations")
 }
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::*;
+    use crate::{
+        controller::build::properties::test_support::validated_cluster_from_spec, crd::OpaRole,
+    };
+
+    const ROLE_GROUP_LABEL: &str = "app.kubernetes.io/role-group";
+
+    fn cluster(tls: bool) -> ValidatedCluster {
+        let mut spec = json!({
+            "image": { "productVersion": "1.2.3" },
+            "servers": { "roleGroups": { "default": {} } },
+        });
+        if tls {
+            spec["clusterConfig"] = json!({ "tls": { "serverSecretClass": "tls" } });
+        }
+        validated_cluster_from_spec(spec)
+    }
+
+    fn default_role_group(cluster: &ValidatedCluster) -> RoleGroupName {
+        cluster.role_group_configs[&OpaRole::Server]
+            .keys()
+            .next()
+            .expect("the default role group should exist")
+            .clone()
+    }
+
+    /// Returns the `(name, port)` of the single data port of `service`.
+    fn single_port(service: &Service) -> (String, i32) {
+        let ports = service.spec.as_ref().unwrap().ports.as_ref().unwrap();
+        assert_eq!(ports.len(), 1, "expected exactly one port");
+        (ports[0].name.clone().unwrap(), ports[0].port)
+    }
+
+    #[test]
+    fn role_service_is_cluster_internal_with_node_local_traffic() {
+        let cluster = cluster(false);
+        let service = build_server_role_service(&cluster);
+        let spec = service.spec.unwrap();
+
+        assert_eq!(service.metadata.name.as_deref(), Some("test-opa-server"));
+        // Default listener class `cluster-internal` maps to a `ClusterIP` Service.
+        assert_eq!(spec.type_.as_deref(), Some("ClusterIP"));
+        assert_eq!(spec.internal_traffic_policy.as_deref(), Some("Local"));
+        // The role-level service selects the whole role, so it must not pin a role group.
+        assert!(!spec.selector.unwrap().contains_key(ROLE_GROUP_LABEL));
+    }
+
+    #[test]
+    fn role_service_port_follows_tls() {
+        assert_eq!(
+            single_port(&build_server_role_service(&cluster(false))),
+            ("http".to_owned(), 8081)
+        );
+        assert_eq!(
+            single_port(&build_server_role_service(&cluster(true))),
+            ("https".to_owned(), 8443)
+        );
+    }
+
+    #[test]
+    fn headless_service_is_headless_and_role_group_scoped() {
+        let cluster = cluster(false);
+        let rg = default_role_group(&cluster);
+        let service = build_rolegroup_headless_service(&cluster, &rg);
+        let spec = service.spec.unwrap();
+
+        assert_eq!(
+            service.metadata.name.as_deref(),
+            Some("test-opa-server-default-headless")
+        );
+        assert_eq!(spec.cluster_ip.as_deref(), Some("None"));
+        assert_eq!(spec.publish_not_ready_addresses, Some(true));
+        assert!(spec.selector.unwrap().contains_key(ROLE_GROUP_LABEL));
+    }
+
+    #[test]
+    fn metrics_service_has_prometheus_metadata() {
+        let cluster = cluster(false);
+        let rg = default_role_group(&cluster);
+        let service = build_rolegroup_metrics_service(&cluster, &rg);
+        let spec = service.spec.as_ref().unwrap();
+
+        assert_eq!(
+            service.metadata.name.as_deref(),
+            Some("test-opa-server-default-metrics")
+        );
+        assert_eq!(spec.cluster_ip.as_deref(), Some("None"));
+        assert_eq!(single_port(&service), ("metrics".to_owned(), 8081));
+
+        let annotations = service.metadata.annotations.unwrap();
+        assert_eq!(
+            annotations.get("prometheus.io/scrape").map(String::as_str),
+            Some("true")
+        );
+        assert_eq!(
+            annotations.get("prometheus.io/scheme").map(String::as_str),
+            Some("http")
+        );
+        assert_eq!(
+            annotations.get("prometheus.io/port").map(String::as_str),
+            Some("8081")
+        );
+    }
+}

rust/operator-binary/src/controller/validate.rs

@@ -232,3 +232,57 @@ pub fn validate(
         role_group_configs,
     ))
 }
+
+#[cfg(test)]
+mod tests {
+    use stackable_operator::product_logging::spec::{
+        AutomaticContainerLogConfig, ContainerLogConfig, ContainerLogConfigChoice,
+    };
+
+    use super::*;
+
+    /// A [`Logging`] with a single (automatic) Vector container log config, as the build step
+    /// expects when the Vector agent is enabled.
+    fn logging(enable_vector_agent: bool) -> Logging<Container> {
+        Logging {
+            enable_vector_agent,
+            containers: [(
+                Container::Vector,
+                ContainerLogConfig {
+                    choice: Some(ContainerLogConfigChoice::Automatic(
+                        AutomaticContainerLogConfig::default(),
+                    )),
+                },
+            )]
+            .into(),
+        }
+    }
+
+    #[test]
+    fn validate_logging_disabled_has_no_vector_container() {
+        let validated = validate_logging(&logging(false), &None).expect("should validate");
+        assert!(!validated.enable_vector_agent);
+        assert!(validated.vector_container.is_none());
+    }
+
+    #[test]
+    fn validate_logging_enabled_requires_aggregator_config_map() {
+        assert!(matches!(
+            validate_logging(&logging(true), &None),
+            Err(Error::MissingVectorAggregatorConfigMapName)
+        ));
+    }
+
+    #[test]
+    fn validate_logging_enabled_with_aggregator_yields_vector_container() {
+        let aggregator =
+            Some(ConfigMapName::from_str("vector-aggregator-discovery").expect("valid name"));
+        let validated = validate_logging(&logging(true), &aggregator).expect("should validate");
+        assert!(validated.enable_vector_agent);
+        let vector = validated.vector_container.expect("vector container config");
+        assert_eq!(
+            vector.vector_aggregator_config_map_name.as_ref(),
+            "vector-aggregator-discovery"
+        );
+    }
+}