@opensoha/contracts 0.1.27 → 0.2.0

package/resource/runtime/mutation_preconditions_test.go

@@ -0,0 +1,172 @@
+package runtime
+
+import (
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+
+	contractresource "github.com/opensoha/soha/contracts/resource"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	k8sruntime "k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	dynamicfake "k8s.io/client-go/dynamic/fake"
+	clienttesting "k8s.io/client-go/testing"
+)
+
+func TestConditionalResourceDeletePinsCallerIdentityThroughKubernetesRequest(t *testing.T) {
+	for _, scenario := range []string{"matching", "already-deleting", "replaced-uid", "changed-version", "missing-guard", "concurrent-change", "owned-pod", "external-owner"} {
+		t.Run(scenario, func(t *testing.T) {
+			current := &unstructured.Unstructured{Object: map[string]any{"apiVersion": "v1", "kind": "ConfigMap", "metadata": map[string]any{"name": "sample", "namespace": "test", "uid": "reviewed-uid", "resourceVersion": "opaque/version+1"}}}
+			expected := contractresource.ResourceMutationPreconditions{ExpectedUID: "reviewed-uid", ExpectedResourceVersion: "opaque/version+1"}
+			current.SetFinalizers([]string{"test.invalid/hold"})
+			if scenario == "already-deleting" {
+				stamp := metav1.Now()
+				current.SetDeletionTimestamp(&stamp)
+			}
+			if scenario == "replaced-uid" {
+				current.SetUID("replacement")
+			}
+			if scenario == "changed-version" {
+				current.SetResourceVersion("opaque/version+2")
+			}
+			if scenario == "missing-guard" {
+				expected.ExpectedUID = ""
+			}
+			if scenario == "owned-pod" {
+				current.SetKind("Pod")
+				owner := true
+				current.SetOwnerReferences([]metav1.OwnerReference{{APIVersion: "apps/v1", Kind: "ReplicaSet", Name: "controller", UID: "parent", Controller: &owner}})
+			}
+			if scenario == "external-owner" {
+				current.SetAnnotations(map[string]string{"meta.helm.sh/release-name": "owner", "meta.helm.sh/release-namespace": "test"})
+			}
+			resourceName := "configmaps"
+			if scenario == "owned-pod" {
+				resourceName = "pods"
+			}
+			client := dynamicfake.NewSimpleDynamicClient(k8sruntime.NewScheme(), current)
+			deletes := 0
+			client.PrependReactor("delete", resourceName, func(action clienttesting.Action) (bool, k8sruntime.Object, error) {
+				deletes++
+				deletion, ok := action.(clienttesting.DeleteAction)
+				if !ok {
+					t.Fatal("expected a Kubernetes delete action")
+				}
+				options := deletion.GetDeleteOptions()
+				if options.Preconditions == nil || options.Preconditions.UID == nil || string(*options.Preconditions.UID) != expected.ExpectedUID || options.Preconditions.ResourceVersion == nil || *options.Preconditions.ResourceVersion != expected.ExpectedResourceVersion {
+					t.Fatal("Kubernetes delete lost caller UID or resourceVersion")
+				}
+				if scenario == "concurrent-change" {
+					return true, nil, apierrors.NewConflict(schema.GroupResource{Resource: resourceName}, "sample", errors.New("concurrent update"))
+				}
+				return true, nil, nil
+			})
+			err := DeleteResourceConditional(t.Context(), client.Resource(schema.GroupVersionResource{Version: "v1", Resource: resourceName}).Namespace("test"), "sample", expected)
+			allowed := scenario == "matching" || scenario == "owned-pod" || scenario == "already-deleting"
+			if (err == nil) != allowed {
+				t.Fatalf("conditional deletion: %v", err)
+			}
+			wantDeletes := 0
+			if scenario == "matching" || scenario == "owned-pod" || scenario == "concurrent-change" {
+				wantDeletes = 1
+			}
+			if deletes != wantDeletes {
+				t.Fatalf("delete calls=%d; want %d", deletes, wantDeletes)
+			}
+			for _, action := range client.Actions() {
+				if action.GetVerb() == "patch" || action.GetVerb() == "update" {
+					t.Fatal("conditional deletion changed finalizers or resource content")
+				}
+			}
+			if (scenario == "replaced-uid" || scenario == "changed-version" || scenario == "concurrent-change") && !apierrors.IsConflict(err) {
+				t.Fatal("identity race did not return conflict", err)
+			}
+			if scenario == "external-owner" && !errors.Is(err, ErrResourceOwnership) {
+				t.Fatal("external owner protection changed", err)
+			}
+		})
+	}
+}
+
+func TestConditionalEditCannotRemoveOrOmitExistingFinalizers(t *testing.T) {
+	current := &unstructured.Unstructured{Object: map[string]any{"apiVersion": "v1", "kind": "ConfigMap", "metadata": map[string]any{"name": "sample", "namespace": "test", "uid": "uid", "resourceVersion": "rv"}}}
+	current.SetFinalizers([]string{"test.invalid/hold", "test.invalid/retain"})
+	guard := contractresource.ResourceMutationPreconditions{ExpectedUID: "uid", ExpectedResourceVersion: "rv"}
+	for _, test := range []struct {
+		name       string
+		finalizers []string
+		allowed    bool
+	}{
+		{"retained", []string{"test.invalid/retain", "test.invalid/hold"}, true},
+		{"added", []string{"test.invalid/retain", "test.invalid/hold", "test.invalid/added"}, true},
+		{"omitted", nil, false},
+		{"cleared", []string{}, false},
+		{"partly removed", []string{"test.invalid/hold"}, false},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			desired := current.DeepCopy()
+			desired.SetFinalizers(test.finalizers)
+			err := ValidateResourceEditPreconditions(current, desired, guard)
+			if (err == nil) != test.allowed {
+				t.Fatalf("finalizer guard: %v", err)
+			}
+		})
+	}
+}
+
+func TestResourceMutationPreconditionsRejectUnboundedAndAmbiguousValues(t *testing.T) {
+	for _, value := range []string{"", " ", "uid\nother", "uid\x00other", "uid\u2003other", strings.Repeat("a", 257)} {
+		guard := contractresource.ResourceMutationPreconditions{ExpectedUID: value, ExpectedResourceVersion: "opaque/non-numeric+version"}
+		if guard.Validate() == nil {
+			t.Fatal("unsafe guard value accepted")
+		}
+	}
+	if err := (contractresource.ResourceMutationPreconditions{ExpectedUID: "uid", ExpectedResourceVersion: "opaque/non-numeric+version"}).Validate(); err != nil {
+		t.Fatal("opaque version was parsed or rejected", err)
+	}
+}
+
+func TestConditionalEditCannotOverwriteStaleYAMLIdentity(t *testing.T) {
+	current := &unstructured.Unstructured{Object: map[string]any{"apiVersion": "v1", "kind": "ConfigMap", "metadata": map[string]any{"name": "sample", "namespace": "test", "uid": "reviewed", "resourceVersion": "opaque-v1"}}}
+	guard := contractresource.ResourceMutationPreconditions{ExpectedUID: "reviewed", ExpectedResourceVersion: "opaque-v1"}
+	for _, field := range []string{"uid", "version", "kind", "apiVersion", "name", "namespace"} {
+		desired := current.DeepCopy()
+		switch field {
+		case "uid":
+			desired.SetUID("stale")
+		case "version":
+			desired.SetResourceVersion("stale")
+		case "kind":
+			desired.SetKind("Secret")
+		case "apiVersion":
+			desired.SetAPIVersion("other/v1")
+		case "name":
+			desired.SetName("other")
+		case "namespace":
+			desired.SetNamespace("other")
+		}
+		if err := ValidateResourceEditPreconditions(current, desired, guard); !apierrors.IsBadRequest(err) {
+			t.Fatalf("stale %s was accepted: %v", field, err)
+		}
+	}
+	desired := current.DeepCopy()
+	desired.SetUID("")
+	desired.SetResourceVersion("")
+	if err := ValidateResourceEditPreconditions(current, desired, guard); err != nil {
+		t.Fatal("explicit body guard was not accepted", err)
+	}
+}
+
+func TestResourceIdentityProjectionDoesNotExposeSecretContent(t *testing.T) {
+	current := &unstructured.Unstructured{Object: map[string]any{"apiVersion": "v1", "kind": "Secret", "metadata": map[string]any{"name": "sample", "namespace": "test", "uid": "reviewed", "resourceVersion": "1", "annotations": map[string]any{"private": "sensitive-marker"}}, "data": map[string]any{"token": "sensitive-marker"}}}
+	value, err := json.Marshal(ResourceIdentityFrom(current))
+	if err != nil || strings.Contains(string(value), "sensitive-marker") || strings.Contains(string(value), "annotations") || strings.Contains(string(value), "data") {
+		t.Fatal("metadata identity exposed resource content", err)
+	}
+	if !strings.Contains(string(value), `"uid":"reviewed"`) {
+		t.Fatal("metadata identity lost the reviewed UID")
+	}
+}

package/resource/runtime/network_relationship_primitives.go

@@ -0,0 +1,66 @@
+package runtime
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/labels"
+)
+
+// servicePodSelector preserves Service's nonempty equality-selector semantics.
+// Malformed values invalidate the selector rather than silently broadening it.
+func servicePodSelector(selector map[string]any) labels.Selector {
+	if len(selector) == 0 {
+		return nil
+	}
+	set := labels.Set{}
+	for key, value := range selector {
+		label, ok := value.(string)
+		if !ok {
+			return nil
+		}
+		set[key] = label
+	}
+	return labels.SelectorFromSet(set)
+}
+
+type ingressBackendDeclaration struct {
+	host            string
+	path            map[string]any
+	serviceName     string
+	port            string
+	fieldPath       string
+	serviceDeclared bool
+}
+
+// forEachIngressBackendDeclaration extracts configured references once. Callers
+// retain their own graph projection, resolution, authorization and budget rules.
+func forEachIngressBackendDeclaration(body map[string]any, active func() bool, visit func(ingressBackendDeclaration)) {
+	if !active() {
+		return
+	}
+	if backend := object(at(body, "spec", "defaultBackend")); len(backend) > 0 {
+		visit(ingressBackendFact("", map[string]any{"path": "/", "pathType": "Default"}, backend, "spec.defaultBackend"))
+	}
+	rules, _ := at(body, "spec", "rules").([]any)
+	for ruleIndex, raw := range rules {
+		if !active() {
+			return
+		}
+		rule := object(raw)
+		paths, _ := at(rule, "http", "paths").([]any)
+		for pathIndex, rawPath := range paths {
+			if !active() {
+				return
+			}
+			path := object(rawPath)
+			visit(ingressBackendFact(text(rule["host"]), path, object(path["backend"]), fmt.Sprintf("spec.rules[%d].http.paths[%d].backend", ruleIndex, pathIndex)))
+		}
+	}
+}
+
+func ingressBackendFact(host string, path, backend map[string]any, fieldPath string) ingressBackendDeclaration {
+	service := object(backend["service"])
+	name, _ := service["name"].(string)
+	port := object(service["port"])
+	return ingressBackendDeclaration{host: host, path: path, serviceName: name, port: firstTopology(text(port["name"]), text(port["number"])), fieldPath: fieldPath, serviceDeclared: len(service) > 0}
+}

package/resource/runtime/network_relationship_primitives_test.go

@@ -0,0 +1,147 @@
+package runtime
+
+import (
+	"encoding/json"
+	"testing"
+
+	cr "github.com/opensoha/soha/contracts/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+)
+
+func TestNetworkRelationshipServiceSelectorParityAndMalformedValues(t *testing.T) {
+	for _, tc := range []struct {
+		name, selector string
+		match          bool
+	}{
+		{"missing", "null", false}, {"empty", "{}", false},
+		{"match", `{"app":"web"}`, true}, {"different", `{"app":"other"}`, false},
+		{"allLabelsRequired", `{"app":"web","tier":"api"}`, false},
+		{"missingEmptyLabel", `{"missing":""}`, false},
+		{"nonString", `{"app":42}`, false},
+		{"doNotDropMalformedTerm", `{"app":"web","malformed":42}`, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			pod := graphTestObject("v1", "Pod", "pod", "pod-uid")
+			pod.SetLabels(map[string]string{"app": "web"})
+			service := graphTestObject("v1", "Service", "svc", "svc-uid")
+			var selector any
+			if err := json.Unmarshal([]byte(tc.selector), &selector); err != nil {
+				t.Fatal(err)
+			}
+			service.Object["spec"] = map[string]any{"selector": selector}
+			old, err := BuildResourceGraphFromObjects(graphTestRoot("Pod", "pod"), []*unstructured.Unstructured{pod, service})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got := graphTestEdge(old, "selects", "svc", "pod"); got != tc.match {
+				t.Fatalf("Workload selector match=%v want=%v", got, tc.match)
+			}
+			networkService := topologyFixture("kubernetes.services", "ns", "svc", `{"spec":{"selector":`+tc.selector+`}}`)
+			networkPod := topologyFixture("kubernetes.pods", "ns", "pod", `{"metadata":{"labels":{"app":"web"}}}`)
+			network := networkFixtureGraph(t, networkService, networkPod)
+			if got := len(networkEdges(network, "selects")) > 0; got != tc.match {
+				t.Fatalf("Network selector match=%v want=%v", got, tc.match)
+			}
+		})
+	}
+}
+
+func TestNetworkRelationshipIngressDefaultAndPathsPreserveBothViews(t *testing.T) {
+	for _, tc := range []struct {
+		name, spec   string
+		names, paths []string
+	}{
+		{"defaultOnly", `{"defaultBackend":{"service":{"name":"default","port":{"name":"http"}}}}`, []string{"default"}, []string{"spec.defaultBackend"}},
+		{"pathsOnly", `{"rules":[{"host":"a.test","http":{"paths":[{"path":"/a","pathType":"Prefix","backend":{"service":{"name":"first","port":{"number":80}}}},{"path":"/b","backend":{"service":{"name":"second","port":{"number":80}}}}]}},{"host":"b.test","http":{"paths":[{"backend":{"service":{"name":"last","port":{"number":80}}}}]}}]}`, []string{"first", "second", "last"}, []string{"spec.rules[0].http.paths[0].backend", "spec.rules[0].http.paths[1].backend", "spec.rules[1].http.paths[0].backend"}},
+		{"defaultAndPath", `{"defaultBackend":{"service":{"name":"default","port":{"name":"http"}}},"rules":[{"host":"a.test","http":{"paths":[{"path":"/a","backend":{"service":{"name":"first","port":{"number":80}}}}]}}]}`, []string{"default", "first"}, []string{"spec.defaultBackend", "spec.rules[0].http.paths[0].backend"}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var spec map[string]any
+			if err := json.Unmarshal([]byte(tc.spec), &spec); err != nil {
+				t.Fatal(err)
+			}
+			pod := graphTestObject("v1", "Pod", "pod", "pod-uid")
+			pod.SetLabels(map[string]string{"app": "web"})
+			ingress := graphTestObject("networking.k8s.io/v1", "Ingress", "ing", "ing-uid")
+			ingress.Object["spec"] = spec
+			objects := []*unstructured.Unstructured{pod, ingress}
+			sources := []cr.NetworkTopologySourceResult{}
+			for _, name := range tc.names {
+				service := graphTestObject("v1", "Service", name, name+"-uid")
+				service.Object["spec"] = map[string]any{"selector": map[string]any{"app": "web"}}
+				objects = append(objects, service)
+				sources = append(sources, topologyFixture("kubernetes.services", "ns", name, `{"spec":{"ports":[{"name":"http","port":80}]}}`))
+			}
+			workload, err := BuildResourceGraphFromObjects(graphTestRoot("Pod", "pod"), objects)
+			if err != nil {
+				t.Fatal(err)
+			}
+			for _, name := range tc.names {
+				if !graphTestEdge(workload, "routes-to", "ing", name) {
+					t.Fatalf("Workload dropped backend %s: %+v", name, workload.Edges)
+				}
+			}
+			if edges := networkEdges(workload, "routes-to"); len(edges) != len(tc.names) {
+				t.Fatalf("Workload changed name-only edge count: %+v", edges)
+			} else {
+				for _, edge := range edges {
+					if edge.Port != "" || edge.FieldPath != "" {
+						t.Fatalf("Workload adopted network-only facts: %+v", edge)
+					}
+				}
+			}
+			networkIngress := topologyFixture("kubernetes.ingresses", "ns", "ing", `{"spec":`+tc.spec+`}`)
+			network := networkFixtureGraph(t, networkIngress, sources...)
+			actual := map[string]bool{}
+			for _, edge := range networkEdges(network, "routes-to") {
+				actual[edge.FieldPath] = true
+				if edge.Port == "" {
+					t.Fatal("Network dropped backend port")
+				}
+			}
+			if len(actual) != len(tc.paths) {
+				t.Fatalf("Network changed backend declarations: %+v", actual)
+			}
+			for _, path := range tc.paths {
+				if !actual[path] {
+					t.Fatalf("Network dropped declaration %s", path)
+				}
+			}
+			view := fixtureView(append([]cr.NetworkTopologySourceResult{networkIngress}, sources...)...)
+			if tc.name != "defaultOnly" {
+				found := false
+				for _, node := range view.Nodes {
+					if node.Rule != nil {
+						for _, group := range node.Rule.MatchGroups {
+							for _, match := range group {
+								if match.Type == "host" && match.Value == "a.test" {
+									found = true
+								}
+							}
+						}
+					}
+				}
+				if !found {
+					t.Fatal("Topology lost match context")
+				}
+			}
+		})
+	}
+}
+
+func TestNetworkRelationshipIngressIterationHonorsBudgetAndUnsupportedBackend(t *testing.T) {
+	body := map[string]any{}
+	if err := json.Unmarshal([]byte(`{"spec":{"defaultBackend":{"resource":{"apiGroup":"example.io","kind":"Bucket","name":"custom"}},"rules":[{"http":{"paths":[{"backend":{"service":{"name":"later"}}}]}}]}}`), &body); err != nil {
+		t.Fatal(err)
+	}
+	count := 0
+	forEachIngressBackendDeclaration(body, func() bool { return count == 0 }, func(ref ingressBackendDeclaration) {
+		count++
+		if ref.fieldPath != "spec.defaultBackend" || ref.serviceDeclared || ref.serviceName != "" {
+			t.Fatalf("unsupported backend fabricated a Service: %+v", ref)
+		}
+	})
+	if count != 1 {
+		t.Fatalf("iterator ignored caller budget: %d", count)
+	}
+}

package/resource/runtime/network_topology.go

@@ -10,7 +10,7 @@ import (
 	"sync"
 	"time"
 
-	resource "github.com/opensoha/soha-contracts/resource"
+	resource "github.com/opensoha/soha/contracts/resource"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -29,6 +29,12 @@ func ReadNetworkTopologySnapshot(ctx context.Context, client rest.Interface, clu
 	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
 	defer cancel()
 	output := resource.NetworkTopologySnapshot{Version: resource.NetworkTopologySnapshotFeature, Sources: make([]resource.NetworkTopologySourceResult, len(input.Queries))}
+	for _, query := range input.Queries {
+		if query.Name != "" {
+			output.Version = resource.NetworkTopologyNamedRootFeature
+			break
+		}
+	}
 	budget := &topologyReadBudget{remaining: resource.NetworkTopologyMaxTotalBytes}
 	sem := make(chan struct{}, 4)
 	var wg sync.WaitGroup
@@ -47,6 +53,9 @@ func ReadNetworkTopologySnapshot(ctx context.Context, client rest.Interface, clu
 		}(index, query)
 	}
 	wg.Wait()
+	if err := ctx.Err(); err != nil {
+		return resource.NetworkTopologySnapshot{}, err
+	}
 	total := 0
 	for i := range output.Sources {
 		source := &output.Sources[i]
@@ -69,10 +78,13 @@ func ReadNetworkTopologySnapshot(ctx context.Context, client rest.Interface, clu
 
 func topologySourceFailure(query resource.NetworkTopologySourceQuery, state, reason string) resource.NetworkTopologySourceResult {
 	definition, _ := resource.LookupNetworkTopologySource(query.SourceID)
-	return resource.NetworkTopologySourceResult{Coverage: resource.NetworkTopologyCoverage{Provider: definition.Provider, SourceID: query.SourceID, Namespace: query.Namespace, State: state, ReasonCode: reason, CheckedAt: time.Now().UTC().Format(time.RFC3339), SupportedKinds: []string{definition.Kind}}, Objects: []resource.NetworkTopologySourceObject{}}
+	return resource.NetworkTopologySourceResult{Coverage: resource.NetworkTopologyCoverage{Provider: definition.Provider, SourceID: query.SourceID, Name: query.Name, Namespace: query.Namespace, State: state, ReasonCode: reason, CheckedAt: time.Now().UTC().Format(time.RFC3339), SupportedKinds: []string{definition.Kind}}, Objects: []resource.NetworkTopologySourceObject{}}
 }
 
 func readTopologySource(ctx context.Context, client rest.Interface, clusterID string, query resource.NetworkTopologySourceQuery, budget *topologyReadBudget) resource.NetworkTopologySourceResult {
+	if query.Name != "" {
+		return readNetworkGraphNamedSource(ctx, client, clusterID, query, budget)
+	}
 	definition, _ := resource.LookupNetworkTopologySource(query.SourceID)
 	result := topologySourceFailure(query, "available", "")
 	version, err := discoverTopologySource(ctx, client, definition, budget)
@@ -142,10 +154,10 @@ func topologyAPIBase(group, version string) string {
 }
 
 func discoverTopologySource(ctx context.Context, client rest.Interface, definition resource.NetworkTopologySourceDefinition, budget *topologyReadBudget) (string, error) {
-	versions := []string{definition.Version}
-	if definition.FallbackVersion != "" {
-		versions = append(versions, definition.FallbackVersion)
-	}
+	return discoverTopologySourceVersions(ctx, client, definition, budget, resource.NetworkTopologySourceVersions(definition))
+}
+
+func discoverTopologySourceVersions(ctx context.Context, client rest.Interface, definition resource.NetworkTopologySourceDefinition, budget *topologyReadBudget, versions []string) (string, error) {
 	for _, version := range versions {
 		raw, err := boundedTopologyGET(ctx, client, topologyAPIBase(definition.Group, version), false, budget)
 		if apierrors.IsNotFound(err) {