@opensoha/contracts 0.1.27 → 0.1.29

package/resource/runtime/network_topology_builder_providers.go

@@ -0,0 +1,242 @@
+package runtime
+
+import (
+	"fmt"
+	cr "github.com/opensoha/soha-contracts/resource"
+	"strings"
+)
+
+func (g *topologyGraph) traefikRoute(o topologyObject) {
+	protocol := map[string]string{"IngressRoute": "HTTP", "IngressRouteTCP": "TCP", "IngressRouteUDP": "UDP"}[o.ref.Kind]
+	entry := g.objectNode(o, "entry", "traefik", protocol)
+	g.properties(entry, cr.NetworkTopologyProperty{Name: "Entry points", Value: strings.Join(texts(at(o.body, "spec", "entryPoints")), ", ")})
+	for index, raw := range items(at(o.body, "spec", "routes")) {
+		rule := g.rule(o, "traefik", protocol, index, "", nil)
+		node := g.nodes[rule]
+		if node.Rule != nil {
+			node.Rule.MatchSummary = text(raw["match"])
+			priority := integer(raw["priority"], 0)
+			node.Rule.Priority = &priority
+			node.Rule.TLSMode = ""
+			if at(o.body, "spec", "tls") != nil {
+				node.Rule.TLSMode = "terminate"
+				if at(o.body, "spec", "tls", "passthrough") == true {
+					node.Rule.TLSMode = "passthrough"
+				}
+			}
+		}
+		g.nodes[rule] = node
+		if text(raw["match"]) == "[redacted match expression]" {
+			g.state(rule, "unsupported_fragment")
+		}
+		g.link(entry, rule, "matches", protocol, "")
+		tail := rule
+		kind := "Middleware"
+		if protocol != "HTTP" {
+			kind = "MiddlewareTCP"
+		}
+		for _, middleware := range items(raw["middlewares"]) {
+			tail = g.traefikMiddleware(o, tail, middleware, kind, protocol, map[string]bool{}, 0)
+		}
+		total := int64(0)
+		for _, backend := range items(raw["services"]) {
+			total += integer(backend["weight"], 1)
+		}
+		for _, backend := range items(raw["services"]) {
+			g.traefikBackend(o, tail, backend, protocol, "weights", total, map[string]bool{}, 0)
+		}
+	}
+}
+
+func (g *topologyGraph) traefikMiddleware(o topologyObject, parent string, ref map[string]any, kind, protocol string, seen map[string]bool, depth int) string {
+	if g.budgetReached() {
+		return ""
+	}
+	namespace := firstTopology(text(ref["namespace"]), o.ref.Namespace)
+	name := text(ref["name"])
+	middleware, ok := g.objects[topologyKey(kind, namespace, name)]
+	if !ok {
+		target := g.unknown(parent, kind, namespace, name, "")
+		g.link(parent, target, "processes", protocol, "")
+		return target
+	}
+	// Each occurrence retains its position in this configured middleware chain.
+	target := g.addNode(cr.NetworkTopologyGraphNode{ID: parent + "/middleware/" + middleware.id(), Type: "processor", Label: name, Provider: "traefik", Protocol: protocol, ResolutionState: "resolved", Resource: &middleware.ref})
+	edge := g.link(parent, target, "processes", protocol, "")
+	if namespace != o.ref.Namespace {
+		edge.ResolutionState = "unknown"
+		edge.Note = "Controller allowCrossNamespace setting unverified"
+	}
+	g.properties(target, cr.NetworkTopologyProperty{Name: "Types", Value: strings.Join(texts(middleware.body["processorTypes"]), ", ")})
+	if depth >= 8 || seen[middleware.id()] {
+		g.state(target, "unsupported_fragment")
+		return target
+	}
+	next := cloneTopologySeen(seen)
+	next[middleware.id()] = true
+	for _, child := range items(at(middleware.body, "spec", "chain", "middlewares")) {
+		target = g.traefikMiddleware(middleware, target, child, kind, protocol, next, depth+1)
+	}
+	return target
+}
+
+func (g *topologyGraph) traefikBackend(o topologyObject, parent string, ref map[string]any, protocol, relation string, total int64, seen map[string]bool, depth int) {
+	if g.budgetReached() {
+		return
+	}
+
+	namespace := firstTopology(text(ref["namespace"]), o.ref.Namespace)
+	name := text(ref["name"])
+	kind := firstTopology(text(ref["kind"]), "Service")
+	port := text(ref["port"])
+	target := ""
+	switch kind {
+	case "TraefikService":
+		target = g.traefikService(o, parent, namespace, name, protocol, seen, depth)
+	case "Service":
+		target = g.backend(parent, namespace, name, port, protocol)
+	default:
+		target = g.unknown(parent, kind, namespace, name, "unsupported_fragment")
+	}
+	edge := g.link(parent, target, relation, protocol, port)
+	weight := integer(ref["weight"], 1)
+	edge.Weight = &weight
+	if relation == "weights" {
+		edge.TotalWeight = &total
+	}
+	if value, ok := ref["percent"].(float64); ok {
+		edge.MirrorPercent = &value
+	}
+	if namespace != o.ref.Namespace {
+		edge.ResolutionState = "unknown"
+		edge.Note = "Controller allowCrossNamespace setting unverified"
+	}
+}
+func (g *topologyGraph) traefikService(o topologyObject, parent, namespace, name, protocol string, seen map[string]bool, depth int) string {
+	if g.budgetReached() {
+		return ""
+	}
+
+	item, ok := g.objects[topologyKey("TraefikService", namespace, name)]
+	if !ok {
+		return g.unknown(parent, "TraefikService", namespace, name, "")
+	}
+	target := g.objectNode(item, "backend-group", "traefik", protocol)
+	if depth >= 8 || seen[item.id()] {
+		g.state(target, "unsupported_fragment")
+		return target
+	}
+	next := cloneTopologySeen(seen)
+	next[item.id()] = true
+	weighted := items(at(item.body, "spec", "weighted", "services"))
+	total := int64(0)
+	for _, backend := range weighted {
+		total += integer(backend["weight"], 1)
+	}
+	for _, backend := range weighted {
+		g.traefikBackend(item, target, backend, protocol, "weights", total, next, depth+1)
+	}
+	if mirror := object(at(item.body, "spec", "mirroring")); len(mirror) > 0 {
+		g.traefikBackend(item, target, mirror, protocol, "forwards", 0, next, depth+1)
+		for _, backend := range items(mirror["mirrors"]) {
+			g.traefikBackend(item, target, backend, protocol, "mirrors", 0, next, depth+1)
+		}
+	}
+	return target
+}
+func cloneTopologySeen(seen map[string]bool) map[string]bool {
+	next := map[string]bool{}
+	for key, value := range seen {
+		next[key] = value
+	}
+	return next
+}
+
+func (g *topologyGraph) apisixRoute(o topologyObject) {
+	entry := g.objectNode(o, "entry", "apisix", "")
+	for index, raw := range items(at(o.body, "spec", "http")) {
+		rule := g.rule(o, "apisix", "HTTP", index, text(raw["name"]), apisixMatches(object(raw["match"])))
+		node := g.nodes[rule]
+		if node.Rule != nil {
+			priority := integer(raw["priority"], 0)
+			node.Rule.Priority = &priority
+		}
+		g.nodes[rule] = node
+		g.link(entry, rule, "matches", "HTTP", "")
+		for _, plugin := range items(raw["plugins"]) {
+			g.properties(rule, cr.NetworkTopologyProperty{Name: "Configured plugin", Value: fmt.Sprintf("%s (enabled=%v; runtime priority not inferred)", text(plugin["name"]), plugin["enable"] == true)})
+		}
+		backends := items(raw["backends"])
+		if backend := object(raw["backend"]); len(backend) > 0 {
+			backends = append(backends, backend)
+		}
+		total := int64(0)
+		for _, backend := range backends {
+			total += integer(backend["weight"], 100)
+		}
+		for _, backend := range backends {
+			g.apisixBackend(o, rule, backend, "HTTP", total)
+		}
+		if len(items(at(raw, "match", "exprs"))) > 0 {
+			g.state(rule, "unsupported_fragment")
+			g.properties(rule, cr.NetworkTopologyProperty{Name: "Expressions", Value: "Configured expression values redacted; evaluation not simulated"})
+		}
+	}
+	for index, raw := range items(at(o.body, "spec", "stream")) {
+		protocol := strings.ToUpper(firstTopology(text(raw["protocol"]), "TCP"))
+		rule := g.rule(o, "apisix", protocol, index, "stream/"+firstTopology(text(raw["name"]), fmt.Sprint(index)), [][]cr.NetworkTopologyMatch{{{Type: "ingress-port", Value: text(at(raw, "match", "ingressPort"))}}})
+		g.link(entry, rule, "matches", protocol, text(at(raw, "match", "ingressPort")))
+		g.apisixBackend(o, rule, object(raw["backend"]), protocol, 100)
+	}
+}
+func apisixMatches(match map[string]any) [][]cr.NetworkTopologyMatch {
+	// APISIX arrays are OR within one dimension and AND across dimensions; do not fabricate their Cartesian product.
+	group := []cr.NetworkTopologyMatch{}
+	for _, kind := range []string{"hosts", "paths", "methods", "remoteAddrs"} {
+		values := texts(match[kind])
+		if len(values) > 0 {
+			group = append(group, cr.NetworkTopologyMatch{Type: kind, Operator: "oneOf", Value: strings.Join(values, " | ")})
+		}
+	}
+	return [][]cr.NetworkTopologyMatch{group}
+}
+func (g *topologyGraph) apisixBackend(o topologyObject, parent string, backend map[string]any, protocol string, total int64) {
+	name := text(backend["serviceName"])
+	port := text(backend["servicePort"])
+	target := ""
+	if upstream, ok := g.objects[topologyKey("ApisixUpstream", o.ref.Namespace, name)]; ok {
+		if len(items(at(upstream.body, "spec", "externalNodes"))) == 0 {
+			target = g.backend(parent, o.ref.Namespace, name, port, protocol)
+		}
+		target = g.apisixUpstream(upstream, target, protocol)
+	} else {
+		target = g.backend(parent, o.ref.Namespace, name, port, protocol)
+	}
+	edge := g.link(parent, target, "weights", protocol, port)
+	weight := integer(backend["weight"], 100)
+	edge.Weight = &weight
+	edge.TotalWeight = &total
+}
+func (g *topologyGraph) apisixUpstream(upstream topologyObject, service, protocol string) string {
+	id := g.objectNode(upstream, "backend-group", "apisix", protocol)
+	if g.expanded[id] {
+		return id
+	}
+	g.expanded[id] = true
+	g.properties(id, cr.NetworkTopologyProperty{Name: "Scheme", Value: text(at(upstream.body, "spec", "scheme"))}, cr.NetworkTopologyProperty{Name: "Load balancer", Value: text(at(upstream.body, "spec", "loadbalancer", "type"))})
+	nodes := items(at(upstream.body, "spec", "externalNodes"))
+	if len(nodes) == 0 {
+		g.link(id, service, "resolves", protocol, "")
+	}
+	for index, raw := range nodes {
+		target := g.addNode(cr.NetworkTopologyGraphNode{ID: fmt.Sprintf("%s/external/%d", id, index), Type: "external", Label: text(raw["name"]), Provider: "apisix", Protocol: protocol, ResolutionState: "external"})
+		edge := g.link(id, target, "forwards", protocol, text(raw["port"]))
+		weight := integer(raw["weight"], 1)
+		edge.Weight = &weight
+	}
+	for _, subset := range items(at(upstream.body, "spec", "subsets")) {
+		g.properties(id, cr.NetworkTopologyProperty{Name: "Configured subset", Value: text(subset["name"]) + " (endpoint subset resolution unverified)"})
+		g.state(id, "unsupported_fragment")
+	}
+	return id
+}

package/resource/runtime/network_topology_builder_test.go

@@ -0,0 +1,186 @@
+package runtime
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	cr "github.com/opensoha/soha-contracts/resource"
+)
+
+func topologyFixture(source, namespace, name, body string) cr.NetworkTopologySourceResult {
+	definition, _ := cr.LookupNetworkTopologySource(source)
+	var raw map[string]any
+	_ = json.Unmarshal([]byte(body), &raw)
+	metadata, _ := raw["metadata"].(map[string]any)
+	if metadata == nil {
+		metadata = map[string]any{}
+	}
+	metadata["name"] = name
+	metadata["namespace"] = namespace
+	metadata["uid"] = name + "-uid"
+	metadata["resourceVersion"] = "1"
+	raw["metadata"] = metadata
+	projected, err := cr.ProjectNetworkTopologyObject(source, raw)
+	if err != nil {
+		panic(err)
+	}
+	content, _ := json.Marshal(projected)
+	return cr.NetworkTopologySourceResult{Coverage: cr.NetworkTopologyCoverage{SourceID: source, Provider: definition.Provider, Namespace: namespace, State: "available"}, Objects: []cr.NetworkTopologySourceObject{{Resource: cr.ResourceRef{ClusterID: "c", APIVersion: strings.TrimPrefix(definition.Group+"/"+definition.Version, "/"), Kind: definition.Kind, Namespace: namespace, Name: name, UID: name + "-uid"}, Content: string(content)}}}
+}
+func fixtureView(sources ...cr.NetworkTopologySourceResult) cr.NetworkTopologyView {
+	return BuildNetworkTopology("c", "team", cr.NetworkTopologySnapshot{Sources: sources})
+}
+
+func TestNetworkTopologyCoverageIncludesDeniedEntriesBeyondQueryLimit(t *testing.T) {
+	sources := make([]cr.NetworkTopologySourceResult, topologyCoverageLimit+1)
+	for i := range sources {
+		sources[i].Coverage = cr.NetworkTopologyCoverage{SourceID: "kubernetes.services", State: "denied"}
+	}
+	view := fixtureView(sources[:cr.NetworkTopologyMaxQueries+2]...)
+	if view.Truncated || len(view.Coverage) != cr.NetworkTopologyMaxQueries+2 {
+		t.Fatalf("coverage was capped at the issued-query limit: %d, truncated=%v", len(view.Coverage), view.Truncated)
+	}
+	view = fixtureView(sources...)
+	if !view.Truncated || len(view.Coverage) != topologyCoverageLimit {
+		t.Fatalf("coverage exceeded the public limit: %d, truncated=%v", len(view.Coverage), view.Truncated)
+	}
+}
+func TestTopologyKeepsIngressRuleBackendPortsAndEndpointEvidence(t *testing.T) {
+	view := fixtureView(
+		topologyFixture("kubernetes.ingresses", "team", "entry", `{"spec":{"rules":[{"host":"a.test","http":{"paths":[{"path":"/a","pathType":"Prefix","backend":{"service":{"name":"web","port":{"number":80}}}}]}},{"host":"b.test","http":{"paths":[{"path":"/b","backend":{"service":{"name":"web","port":{"number":81}}}}]}}]}}`),
+		topologyFixture("kubernetes.services", "team", "web", `{"spec":{"ports":[{"name":"http","port":80,"targetPort":8080},{"name":"other","port":81,"targetPort":8081}],"selector":{"app":"web"}}}`),
+		topologyFixture("kubernetes.endpointslices", "team", "web-1", `{"ports":[{"name":"http","port":8080}],"endpoints":[{"addresses":["10.1.1.1"],"targetRef":{"kind":"Pod","name":"web-1","uid":"web-1-uid"},"conditions":{"serving":true}}]}`),
+		topologyFixture("kubernetes.pods", "team", "web-1", `{"metadata":{"labels":{"app":"web"}},"status":{"phase":"Running"}}`),
+	)
+	rules := map[string]bool{}
+	ports := map[string]bool{}
+	for _, node := range view.Nodes {
+		if node.Rule != nil {
+			group := node.Rule.MatchGroups[0]
+			rules[group[0].Value+group[1].Value] = true
+		}
+	}
+	for _, edge := range view.Edges {
+		if edge.Relation == "forwards" {
+			ports[edge.Port] = true
+		}
+	}
+	if len(rules) != 2 || !rules["a.test/a"] || !rules["b.test/b"] || !ports["80"] || !ports["81"] {
+		t.Fatalf("flattened routes: %+v %+v", rules, ports)
+	}
+	// Selector matching remains a separate declared relation, never endpoint proof.
+	for _, edge := range view.Edges {
+		if edge.Relation == "selects" && (edge.ResolutionState != "resolved" || !strings.Contains(edge.Note, "Selector match only")) {
+			t.Fatal("selector must stay separate from endpoint readiness")
+		}
+	}
+}
+func TestTopologyPreservesZeroWeightMirrorAndCycles(t *testing.T) {
+	view := fixtureView(
+		topologyFixture("traefik.ingressroutes", "team", "route", `{"spec":{"entryPoints":["web"],"routes":[{"match":"Host(\"a.test\")","services":[{"name":"weighted","kind":"TraefikService","weight":0}]}]}}`),
+		topologyFixture("traefik.traefikservices", "team", "weighted", `{"spec":{"weighted":{"services":[{"name":"web","port":80,"weight":0},{"name":"weighted","kind":"TraefikService","weight":2}]},"mirroring":{"name":"web","port":80,"mirrors":[{"name":"shadow","port":80,"percent":15}]}}}`),
+		topologyFixture("kubernetes.services", "team", "web", `{"spec":{"type":"ExternalName","externalName":"upstream.example","ports":[{"port":80}]}}`),
+	)
+	zero := false
+	mirror := false
+	cycle := false
+	for _, edge := range view.Edges {
+		zero = zero || (edge.Weight != nil && *edge.Weight == 0)
+		mirror = mirror || (edge.Relation == "mirrors" && edge.MirrorPercent != nil && *edge.MirrorPercent == 15)
+	}
+	for _, node := range view.Nodes {
+		cycle = cycle || node.ResolutionState == "unsupported_fragment"
+	}
+	if !zero || !mirror || !cycle {
+		t.Fatalf("lost semantics zero=%v mirror=%v cycle=%v", zero, mirror, cycle)
+	}
+	if len(view.Nodes) > 200 || len(view.Edges) > 400 {
+		t.Fatal("graph budget exceeded")
+	}
+}
+func TestTopologyNeverLeaksInvisibleCrossNamespaceReferences(t *testing.T) {
+	view := fixtureView(cr.NetworkTopologySourceResult{Coverage: cr.NetworkTopologyCoverage{SourceID: "gateway.referencegrants", Namespace: "private", State: "available"}}, topologyFixture("gateway.httproutes", "team", "route", `{"spec":{"parentRefs":[{"name":"hidden-gateway","namespace":"private"}],"rules":[{"backendRefs":[{"name":"hidden-service","namespace":"private","port":80}]}]}}`))
+	data, _ := json.Marshal(struct {
+		Nodes  []cr.NetworkTopologyGraphNode
+		Edges  []cr.NetworkTopologyGraphEdge
+		Traces []cr.NetworkTopologyTraceView
+	}{view.Nodes, view.Edges, view.Traces})
+	if strings.Contains(string(data), "hidden-service") || strings.Contains(string(data), "hidden-gateway") || strings.Contains(string(data), "private") {
+		t.Fatalf("hidden reference escaped: %s", data)
+	}
+}
+func TestTopologyAPISIXStreamAndExternalUpstream(t *testing.T) {
+	view := fixtureView(topologyFixture("apisix.apisixroutes", "team", "route", `{"spec":{"stream":[{"name":"dns","protocol":"UDP","match":{"ingressPort":53},"backend":{"serviceName":"dns","servicePort":53}}]}}`), topologyFixture("apisix.apisixupstreams", "team", "dns", `{"spec":{"scheme":"udp","externalNodes":[{"type":"Domain","name":"resolver.example","port":53,"weight":1}]}}`))
+	udp := false
+	external := false
+	for _, node := range view.Nodes {
+		udp = udp || node.Protocol == "UDP"
+		external = external || (node.Type == "external" && node.Label == "resolver.example")
+	}
+	if !udp || !external {
+		t.Fatalf("missing UDP/external: %+v", view)
+	}
+}
+
+func TestTopologyEndpointSliceUsesReadyPortAndPodUID(t *testing.T) {
+	service := topologyFixture("kubernetes.services", "team", "web", `{"spec":{"ports":[{"name":"http","port":80,"targetPort":8080,"protocol":"TCP"}]}}`)
+	endpoints := topologyFixture("kubernetes.endpointslices", "team", "web-endpoints", `{"metadata":{"labels":{"kubernetes.io/service-name":"web"}},"ports":[{"name":"http","port":8080,"protocol":"TCP"}],"endpoints":[{"targetRef":{"kind":"Pod","name":"web-1","uid":"web-1-uid"},"conditions":{"serving":true}}]}`)
+	pod := topologyFixture("kubernetes.pods", "team", "web-1", `{}`)
+	view := fixtureView(service, endpoints, pod)
+	resolved := false
+	for _, edge := range view.Edges {
+		if edge.Relation == "resolves" && strings.Contains(edge.Target, "web-1-uid") && edge.ResolutionState == "resolved" {
+			resolved = true
+		}
+	}
+	if !resolved {
+		t.Fatal("ready=nil EndpointSlice with matching service label, port and Pod UID did not resolve")
+	}
+	endpoints.Objects[0].Content = strings.Replace(endpoints.Objects[0].Content, `"uid":"web-1-uid"`, `"uid":"old-pod-uid"`, 1)
+	view = fixtureView(service, endpoints, pod)
+	for _, node := range view.Nodes {
+		if node.Type == "pod" {
+			t.Fatal("stale Pod UID resolved to its replacement")
+		}
+	}
+}
+func TestTopologyGatewayGrantListenerAndZeroWeight(t *testing.T) {
+	route := topologyFixture("gateway.httproutes", "team", "route", `{"spec":{"parentRefs":[{"name":"gateway","namespace":"infra","sectionName":"https"}],"rules":[{"backendRefs":[{"name":"web","namespace":"backend","port":80,"weight":0},{"name":"web","namespace":"backend","port":80,"weight":2}]}]}}`)
+	gateway := topologyFixture("gateway.gateways", "infra", "gateway", `{"spec":{"listeners":[{"name":"https","port":443,"protocol":"HTTPS","allowedRoutes":{"namespaces":{"from":"All"}}}]}}`)
+	service := topologyFixture("kubernetes.services", "backend", "web", `{"spec":{"type":"ExternalName","externalName":"upstream.example","ports":[{"port":80}]}}`)
+	grant := topologyFixture("gateway.referencegrants", "backend", "allow", `{"spec":{"from":[{"group":"gateway.networking.k8s.io","kind":"HTTPRoute","namespace":"team"}],"to":[{"group":"","kind":"Service","name":"web"}]}}`)
+	view := fixtureView(route, gateway, service, grant)
+	zero, parent := false, false
+	for _, edge := range view.Edges {
+		zero = zero || (edge.Relation == "weights" && edge.Weight != nil && *edge.Weight == 0 && edge.TotalWeight != nil && *edge.TotalWeight == 2 && edge.ResolutionState == "resolved")
+		parent = parent || (edge.Relation == "matches" && strings.Contains(edge.Source, "gateway-uid") && edge.ResolutionState == "resolved")
+	}
+	if !zero || !parent {
+		t.Fatalf("lost granted backend/listener/zero semantics: %+v", view.Edges)
+	}
+	view = fixtureView(route, gateway, service, cr.NetworkTopologySourceResult{Coverage: cr.NetworkTopologyCoverage{SourceID: "gateway.referencegrants", Namespace: "backend", State: "available"}})
+	for _, edge := range view.Edges {
+		if edge.Relation == "weights" && edge.ResolutionState == "resolved" {
+			t.Fatal("cross-namespace backend resolved without ReferenceGrant")
+		}
+	}
+}
+
+func TestTopologyRejectsRouteProtocolServicePortMismatch(t *testing.T) {
+	route := topologyFixture("kubernetes.ingresses", "team", "http", `{"spec":{"rules":[{"http":{"paths":[{"path":"/","backend":{"service":{"name":"dns","port":{"number":53}}}}]}}]}}`)
+	service := topologyFixture("kubernetes.services", "team", "dns", `{"spec":{"type":"ExternalName","externalName":"dns.example","ports":[{"port":53,"protocol":"UDP"}]}}`)
+	view := fixtureView(route, service)
+	found := false
+	for _, edge := range view.Edges {
+		if edge.Relation == "forwards" {
+			found = true
+			if edge.ResolutionState != "unresolved" {
+				t.Fatal("HTTP ingress accepted a UDP Service port")
+			}
+		}
+	}
+	if !found {
+		t.Fatal("missing configured relationship")
+	}
+}