@intentius/chant-lexicon-k8s 0.42.1 → 0.44.2

package/src/describe-resources.test.ts

@@ -105,6 +105,81 @@ describe("k8s describeResources", () => {
     expect(result.unobserved ?? {}).toEqual({});
   });
 
+  // The behold#192 shape (#1620): a Flux-deployed object declares no
+  // metadata.namespace (the controller stamps targetNamespace at apply), so the
+  // live read scopes to the client's default namespace, finds nothing, and
+  // correctly reports absence. Every layer is spec-correct and the picture
+  // still says the opposite of the truth — unless the report carries the
+  // address it actually asked, which is what `queried` is.
+  test("an absent verdict carries the resolved query address, namespace defaulted and visible (#1620)", async () => {
+    const cluster = fakeCluster({
+      // The object lives where Flux put it — not where the read will look.
+      objects: { [objectKey("apps/v1", "Deployment", "web", "flux-target")]: web },
+    });
+    const result = await describeResources(
+      {
+        environment: "prod",
+        buildOutput: "",
+        entityNames: ["web"],
+        entities: makeEntities([
+          // No metadata.namespace declared — Flux stamps it at apply time.
+          { name: "web", entityType: "K8s::Apps::Deployment", props: { metadata: { name: "web" } } },
+        ]),
+      },
+      cluster.connector,
+    );
+
+    // Still a clean absence: in neither map, the tri-state unshifted.
+    expect(result.resources).toEqual({});
+    expect(result.unobserved ?? {}).toEqual({});
+    // But the report can now explain itself: the read went to `default`.
+    expect(result.queried?.web).toBe("/apis/apps/v1/namespaces/default/deployments/web");
+  });
+
+  test("a present entity carries its query address too — the map is total over issued reads (#1620)", async () => {
+    const cluster = fakeCluster({
+      objects: { [objectKey("apps/v1", "Deployment", "web", "prod")]: web },
+    });
+    const result = await describeResources(
+      {
+        environment: "prod",
+        buildOutput: "",
+        entityNames: ["web"],
+        entities: makeEntities([
+          { name: "web", entityType: "K8s::Apps::Deployment", props: { metadata: { name: "web", namespace: "prod" } } },
+        ]),
+      },
+      cluster.connector,
+    );
+    expect(result.resources.web).toBeDefined();
+    expect(result.queried?.web).toBe("/apis/apps/v1/namespaces/prod/deployments/web");
+  });
+
+  test("a read-failed unobserved entry carries the address the failing read was issued against (#1620)", async () => {
+    const cluster = fakeCluster({
+      respond: (req) =>
+        req.path.endsWith("/deployments/web")
+          ? { status: 500, body: statusBody(500, "InternalError", "etcdserver: request timed out") }
+          : undefined,
+    });
+    const result = await describeResources(
+      {
+        environment: "prod",
+        buildOutput: "",
+        entityNames: ["web"],
+        entities: makeEntities([
+          { name: "web", entityType: "K8s::Apps::Deployment", props: { metadata: { name: "web", namespace: "prod" } } },
+        ]),
+      },
+      cluster.connector,
+    );
+    expect(result.unobserved?.web).toMatchObject({
+      reason: "read-failed",
+      queried: "/apis/apps/v1/namespaces/prod/deployments/web",
+    });
+    expect(result.queried?.web).toBe("/apis/apps/v1/namespaces/prod/deployments/web");
+  });
+
   // The headline of chant #1074: the twenty-entry map is gone, so a CRD is an
   // ordinary read rather than a permanent hole.
   test("a CRD is observed like anything else — no KUBECTL_RESOURCE entry required", async () => {
@@ -465,6 +540,44 @@ describe("k8s describeResources", () => {
       warnSpy.mockRestore();
     });
 
+    test("a failed read names the bound context it read (#1488)", async () => {
+      loadChantConfigMock.mockResolvedValue({ config: { k8s: { profiles: { prod: { context: "prod-eks" } } } } });
+      const cluster = fakeCluster({
+        kubeconfig: twoContexts,
+        respond: (req) =>
+          req.path.endsWith("/deployments/web")
+            ? { status: 500, body: statusBody(500, "InternalError", "etcdserver: leader changed") }
+            : undefined,
+      });
+
+      const result = await describeResources(
+        { environment: "prod", buildOutput: "", entityNames: ["web"], entities: entities() },
+        (o) => defaultK8sConnector({ ...o, client: { kubeconfig: twoContexts, requestLayer: cluster.layer } }),
+      );
+
+      expect(result.unobserved?.web?.reason).toBe("read-failed");
+      expect(result.unobserved?.web?.detail).toContain('context "prod-eks" (bound by k8s.profiles.prod.context)');
+    });
+
+    test("an ambient read failure names the context that was read and the missing binding (#1488)", async () => {
+      loadChantConfigMock.mockResolvedValue({ config: {} });
+      const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+      const cluster = fakeCluster({
+        kubeconfig: twoContexts,
+        respond: (req) =>
+          req.path.endsWith("/deployments/web") ? { status: 500, body: statusBody(500, "InternalError", "nope") } : undefined,
+      });
+
+      const result = await describeResources(
+        { environment: "prod", buildOutput: "", entityNames: ["web"], entities: entities() },
+        (o) => defaultK8sConnector({ ...o, client: { kubeconfig: twoContexts, requestLayer: cluster.layer } }),
+      );
+      warnSpy.mockRestore();
+
+      expect(result.unobserved?.web?.reason).toBe("read-failed");
+      expect(result.unobserved?.web?.detail).toContain('context "prod-eks" (ambient; no k8s.profiles.prod binding)');
+    });
+
     test("a bound context the kubeconfig does not have refuses with the context name", async () => {
       loadChantConfigMock.mockResolvedValue({ config: { k8s: { profiles: { prod: { context: "gone-eks" } } } } });
       const oneContext = fakeKubeconfig({ contexts: [{ name: "prod-eks" }], currentContext: "prod-eks" });
@@ -573,6 +686,161 @@ describe("k8s describeResources", () => {
       expect(result.resources["prod/hand-made"]).toBeUndefined();
     });
 
+    // The issue's own estate: a declared MicroVMReplicaSet whose operator
+    // made MicroVMs — a CRD kind no table anticipated. Discovery names it.
+    test("a controller-made child of a CRD kind surfaces as a runtime child of the declared CR", async () => {
+      const replicaSet = {
+        apiVersion: "lambda.aws.amazon.com/v1alpha1",
+        kind: "MicroVMReplicaSet",
+        metadata: { name: "kmv-dev-a-vm", namespace: "microvm-demo", uid: "mvrs-uid" },
+      };
+      const vm = {
+        apiVersion: "lambda.aws.amazon.com/v1alpha1",
+        kind: "MicroVM",
+        metadata: {
+          name: "kmv-dev-a-vm-42sgf",
+          namespace: "microvm-demo",
+          uid: "vm-uid",
+          ownerReferences: [
+            { apiVersion: "lambda.aws.amazon.com/v1alpha1", kind: "MicroVMReplicaSet", name: "kmv-dev-a-vm", uid: "mvrs-uid", controller: true },
+          ],
+        },
+        status: { phase: "Running" },
+      };
+      const cluster = fakeCluster({
+        objects: {
+          [objectKey("lambda.aws.amazon.com/v1alpha1", "MicroVMReplicaSet", "kmv-dev-a-vm", "microvm-demo")]: replicaSet,
+          [objectKey("lambda.aws.amazon.com/v1alpha1", "MicroVM", "kmv-dev-a-vm-42sgf", "microvm-demo")]: vm,
+        },
+      });
+
+      const result = await describeResources(
+        {
+          environment: "dev",
+          buildOutput: "",
+          entityNames: ["workloadReplicaSet"],
+          entities: makeEntities([
+            {
+              name: "workloadReplicaSet",
+              entityType: "K8s::KubeMicroVM::MicroVMReplicaSet",
+              props: { metadata: { name: "kmv-dev-a-vm", namespace: "microvm-demo" } },
+            },
+          ]),
+        },
+        cluster.connector,
+      );
+
+      expect(result.resources["microvm-demo/kmv-dev-a-vm-42sgf"]).toMatchObject({
+        type: "K8s::Lambda::MicroVM",
+        physicalId: "vm-uid",
+        ownerChain: { root: "declared", entity: "workloadReplicaSet" },
+      });
+    });
+
+    test("a child in a group the estate never declares surfaces too — discovery names the kinds, not the declaration", async () => {
+      // A declared CR whose operator makes ordinary Deployments: ray.io is
+      // declared, apps/v1 is not, and the estate-groups sweep never listed it.
+      const rayCluster = { apiVersion: "ray.io/v1", kind: "RayCluster", metadata: { name: "ml", namespace: "ray", uid: "ray-uid" } };
+      const head = {
+        apiVersion: "apps/v1",
+        kind: "Deployment",
+        metadata: {
+          name: "ml-head",
+          namespace: "ray",
+          uid: "head-uid",
+          ownerReferences: [{ apiVersion: "ray.io/v1", kind: "RayCluster", name: "ml", uid: "ray-uid", controller: true }],
+        },
+        status: { readyReplicas: 1, replicas: 1 },
+      };
+      const cluster = fakeCluster({
+        objects: {
+          [objectKey("ray.io/v1", "RayCluster", "ml", "ray")]: rayCluster,
+          [objectKey("apps/v1", "Deployment", "ml-head", "ray")]: head,
+        },
+      });
+
+      const result = await describeResources(
+        {
+          environment: "prod",
+          buildOutput: "",
+          entityNames: ["ml"],
+          entities: makeEntities([
+            { name: "ml", entityType: "K8s::Ray::RayCluster", props: { metadata: { name: "ml", namespace: "ray" } } },
+          ]),
+        },
+        cluster.connector,
+      );
+
+      expect(result.resources["ray/ml-head"]).toMatchObject({
+        type: "K8s::Apps::Deployment",
+        physicalId: "head-uid",
+        ownerChain: { root: "declared", entity: "ml" },
+      });
+    });
+
+    test("a discovered kind the sweep cannot list is an unobserved hole, never silently absent", async () => {
+      const cluster = fakeCluster({
+        objects: { [objectKey("batch/v1", "CronJob", "backup", "prod")]: cronJob },
+        respond: (req) =>
+          req.path === "/apis/batch/v1/namespaces/prod/jobs"
+            ? { status: 403, body: statusBody(403, "Forbidden", "jobs is forbidden") }
+            : undefined,
+      });
+
+      const result = await describeResources(
+        { environment: "prod", buildOutput: "", entityNames: ["backup"], entities: declaredCronJob() },
+        cluster.connector,
+      );
+
+      // Declared resolution is never failed by the sweep.
+      expect(result.resources.backup).toMatchObject({ type: "K8s::Batch::CronJob", physicalId: "cj-uid" });
+      // The failed list is a hole the observation admits, with the failure's
+      // own classification — a 403 is a credentials problem, and silence here
+      // would have read as "no runtime children in prod".
+      expect(result.unobserved?.["runtime-sweep:batch/v1/Job"]).toMatchObject({
+        type: "K8s::Batch::Job",
+        reason: "no-credentials",
+      });
+      expect(result.unobserved?.["runtime-sweep:batch/v1/Job"]?.detail).toContain("namespace prod");
+    });
+
+    test("a cluster-scoped child chains to a declared cluster-scoped entity — the one case cluster-scoped kinds are swept", async () => {
+      const ns = { apiVersion: "v1", kind: "Namespace", metadata: { name: "team-a", uid: "ns-uid" }, status: { phase: "Active" } };
+      const role = {
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "ClusterRole",
+        metadata: {
+          name: "team-a-admin",
+          uid: "role-uid",
+          ownerReferences: [{ apiVersion: "v1", kind: "Namespace", name: "team-a", uid: "ns-uid", controller: true }],
+        },
+      };
+      const cluster = fakeCluster({
+        objects: {
+          [objectKey("v1", "Namespace", "team-a")]: ns,
+          [objectKey("rbac.authorization.k8s.io/v1", "ClusterRole", "team-a-admin")]: role,
+        },
+      });
+
+      const result = await describeResources(
+        {
+          environment: "prod",
+          buildOutput: "",
+          entityNames: ["team"],
+          entities: makeEntities([
+            { name: "team", entityType: "K8s::Core::Namespace", props: { metadata: { name: "team-a" } } },
+          ]),
+        },
+        cluster.connector,
+      );
+
+      expect(result.resources["cluster:team-a-admin"]).toMatchObject({
+        type: "K8s::Rbac::ClusterRole",
+        physicalId: "role-uid",
+        ownerChain: { root: "declared", entity: "team" },
+      });
+    });
+
     test("a Flux-managed Deployment is attributed to its declared Kustomization by the controller's labels (#1549)", async () => {
       // Flux stamps managed objects with name+namespace labels instead of
       // ownerReferences, so the chain walk reaches nothing — the label
@@ -702,7 +970,7 @@ describe("k8s describeResources", () => {
       expect(result.resources["flux-system/cert-manager"]).toBeUndefined();
     });
 
-    test("a core-only estate sweeps no extra groups — Pods stay the core representative", async () => {
+    test("the sweep's bound is the estate's namespaces, not a kind list — and no cluster-scoped list without a cluster-scoped entity", async () => {
       const svc = { apiVersion: "v1", kind: "Service", metadata: { name: "web", namespace: "prod", uid: "svc-uid" } };
       const cluster = fakeCluster({
         objects: { [objectKey("v1", "Service", "web", "prod")]: svc },
@@ -720,10 +988,20 @@ describe("k8s describeResources", () => {
         cluster.connector,
       );
 
-      // Discovery was consulted for no non-core groupVersion: the only list
-      // sweeps are the namespace's pods.
-      const groupDiscovery = cluster.layer.paths().filter((p) => /^\/apis\/[^/]+\/[^/]+$/.test(p) && !p.includes("namespaces"));
-      expect(groupDiscovery.filter((p) => !p.startsWith("/apis/apps"))).toEqual([]);
+      const paths = cluster.layer.paths();
+      const isDiscovery = (p: string) =>
+        p === "/api" || p === "/apis" || /^\/api\/[^/]+$/.test(p) || /^\/apis\/[^/]+\/[^/]+$/.test(p);
+      const reads = paths.filter((p) => !isDiscovery(p));
+      // Discovery names the kinds; every actual read or list stays inside the
+      // one namespace the estate touches. Nothing is listed cluster-wide.
+      expect(reads.length).toBeGreaterThan(0);
+      expect(reads.every((p) => p.includes("/namespaces/prod/"))).toBe(true);
+      // Nothing declared is cluster-scoped, so no owner chain could reach a
+      // cluster-scoped object — their kinds are not listed at all.
+      expect(paths.some((p) => p.endsWith("/clusterroles"))).toBe(false);
+      // Events churn by the thousands and can never chain (`involvedObject`,
+      // not `ownerReferences`) — discovery serves them, the sweep skips them.
+      expect(paths.some((p) => p.endsWith("/events"))).toBe(false);
     });
   });
 
@@ -914,7 +1192,7 @@ describe("k8s describeResources", () => {
       expect(Object.keys(result.resources)).toHaveLength(2); // web + standalonePod, no synthetic duplicate
     });
 
-    test("a Pod-list failure for a namespace is best-effort — declared entities still resolve", async () => {
+    test("a Pod-list failure never fails declared resolution — and surfaces as an unobserved hole (#1517)", async () => {
       const cluster = fakeCluster({
         objects: { [objectKey("apps/v1", "Deployment", "web", "prod")]: web },
         respond: (req) => (req.path.endsWith("/pods") ? { status: 403, body: statusBody(403, "Forbidden", "no pods list") } : undefined),
@@ -927,6 +1205,12 @@ describe("k8s describeResources", () => {
 
       expect(result.resources.web).toMatchObject({ type: "K8s::Apps::Deployment", physicalId: "uid-1" });
       expect(Object.keys(result.resources)).toEqual(["web"]);
+      // Silence would read as "no runtime Pods in prod", which the failed
+      // list never proved — the sweep admits the hole instead.
+      expect(result.unobserved?.["runtime-sweep:v1/Pod"]).toMatchObject({
+        type: "K8s::Core::Pod",
+        reason: "no-credentials",
+      });
     });
 
     test("a lexicon-supported entity type with no namespaced entities resolved does no Pod scan at all", async () => {