@opensoha/contracts 0.1.29 → 0.2.0

package/resource/runtime/mutation_preconditions_test.go

@@ -0,0 +1,172 @@
+package runtime
+
+import (
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+
+	contractresource "github.com/opensoha/soha/contracts/resource"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	k8sruntime "k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	dynamicfake "k8s.io/client-go/dynamic/fake"
+	clienttesting "k8s.io/client-go/testing"
+)
+
+func TestConditionalResourceDeletePinsCallerIdentityThroughKubernetesRequest(t *testing.T) {
+	for _, scenario := range []string{"matching", "already-deleting", "replaced-uid", "changed-version", "missing-guard", "concurrent-change", "owned-pod", "external-owner"} {
+		t.Run(scenario, func(t *testing.T) {
+			current := &unstructured.Unstructured{Object: map[string]any{"apiVersion": "v1", "kind": "ConfigMap", "metadata": map[string]any{"name": "sample", "namespace": "test", "uid": "reviewed-uid", "resourceVersion": "opaque/version+1"}}}
+			expected := contractresource.ResourceMutationPreconditions{ExpectedUID: "reviewed-uid", ExpectedResourceVersion: "opaque/version+1"}
+			current.SetFinalizers([]string{"test.invalid/hold"})
+			if scenario == "already-deleting" {
+				stamp := metav1.Now()
+				current.SetDeletionTimestamp(&stamp)
+			}
+			if scenario == "replaced-uid" {
+				current.SetUID("replacement")
+			}
+			if scenario == "changed-version" {
+				current.SetResourceVersion("opaque/version+2")
+			}
+			if scenario == "missing-guard" {
+				expected.ExpectedUID = ""
+			}
+			if scenario == "owned-pod" {
+				current.SetKind("Pod")
+				owner := true
+				current.SetOwnerReferences([]metav1.OwnerReference{{APIVersion: "apps/v1", Kind: "ReplicaSet", Name: "controller", UID: "parent", Controller: &owner}})
+			}
+			if scenario == "external-owner" {
+				current.SetAnnotations(map[string]string{"meta.helm.sh/release-name": "owner", "meta.helm.sh/release-namespace": "test"})
+			}
+			resourceName := "configmaps"
+			if scenario == "owned-pod" {
+				resourceName = "pods"
+			}
+			client := dynamicfake.NewSimpleDynamicClient(k8sruntime.NewScheme(), current)
+			deletes := 0
+			client.PrependReactor("delete", resourceName, func(action clienttesting.Action) (bool, k8sruntime.Object, error) {
+				deletes++
+				deletion, ok := action.(clienttesting.DeleteAction)
+				if !ok {
+					t.Fatal("expected a Kubernetes delete action")
+				}
+				options := deletion.GetDeleteOptions()
+				if options.Preconditions == nil || options.Preconditions.UID == nil || string(*options.Preconditions.UID) != expected.ExpectedUID || options.Preconditions.ResourceVersion == nil || *options.Preconditions.ResourceVersion != expected.ExpectedResourceVersion {
+					t.Fatal("Kubernetes delete lost caller UID or resourceVersion")
+				}
+				if scenario == "concurrent-change" {
+					return true, nil, apierrors.NewConflict(schema.GroupResource{Resource: resourceName}, "sample", errors.New("concurrent update"))
+				}
+				return true, nil, nil
+			})
+			err := DeleteResourceConditional(t.Context(), client.Resource(schema.GroupVersionResource{Version: "v1", Resource: resourceName}).Namespace("test"), "sample", expected)
+			allowed := scenario == "matching" || scenario == "owned-pod" || scenario == "already-deleting"
+			if (err == nil) != allowed {
+				t.Fatalf("conditional deletion: %v", err)
+			}
+			wantDeletes := 0
+			if scenario == "matching" || scenario == "owned-pod" || scenario == "concurrent-change" {
+				wantDeletes = 1
+			}
+			if deletes != wantDeletes {
+				t.Fatalf("delete calls=%d; want %d", deletes, wantDeletes)
+			}
+			for _, action := range client.Actions() {
+				if action.GetVerb() == "patch" || action.GetVerb() == "update" {
+					t.Fatal("conditional deletion changed finalizers or resource content")
+				}
+			}
+			if (scenario == "replaced-uid" || scenario == "changed-version" || scenario == "concurrent-change") && !apierrors.IsConflict(err) {
+				t.Fatal("identity race did not return conflict", err)
+			}
+			if scenario == "external-owner" && !errors.Is(err, ErrResourceOwnership) {
+				t.Fatal("external owner protection changed", err)
+			}
+		})
+	}
+}
+
+func TestConditionalEditCannotRemoveOrOmitExistingFinalizers(t *testing.T) {
+	current := &unstructured.Unstructured{Object: map[string]any{"apiVersion": "v1", "kind": "ConfigMap", "metadata": map[string]any{"name": "sample", "namespace": "test", "uid": "uid", "resourceVersion": "rv"}}}
+	current.SetFinalizers([]string{"test.invalid/hold", "test.invalid/retain"})
+	guard := contractresource.ResourceMutationPreconditions{ExpectedUID: "uid", ExpectedResourceVersion: "rv"}
+	for _, test := range []struct {
+		name       string
+		finalizers []string
+		allowed    bool
+	}{
+		{"retained", []string{"test.invalid/retain", "test.invalid/hold"}, true},
+		{"added", []string{"test.invalid/retain", "test.invalid/hold", "test.invalid/added"}, true},
+		{"omitted", nil, false},
+		{"cleared", []string{}, false},
+		{"partly removed", []string{"test.invalid/hold"}, false},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			desired := current.DeepCopy()
+			desired.SetFinalizers(test.finalizers)
+			err := ValidateResourceEditPreconditions(current, desired, guard)
+			if (err == nil) != test.allowed {
+				t.Fatalf("finalizer guard: %v", err)
+			}
+		})
+	}
+}
+
+func TestResourceMutationPreconditionsRejectUnboundedAndAmbiguousValues(t *testing.T) {
+	for _, value := range []string{"", " ", "uid\nother", "uid\x00other", "uid\u2003other", strings.Repeat("a", 257)} {
+		guard := contractresource.ResourceMutationPreconditions{ExpectedUID: value, ExpectedResourceVersion: "opaque/non-numeric+version"}
+		if guard.Validate() == nil {
+			t.Fatal("unsafe guard value accepted")
+		}
+	}
+	if err := (contractresource.ResourceMutationPreconditions{ExpectedUID: "uid", ExpectedResourceVersion: "opaque/non-numeric+version"}).Validate(); err != nil {
+		t.Fatal("opaque version was parsed or rejected", err)
+	}
+}
+
+func TestConditionalEditCannotOverwriteStaleYAMLIdentity(t *testing.T) {
+	current := &unstructured.Unstructured{Object: map[string]any{"apiVersion": "v1", "kind": "ConfigMap", "metadata": map[string]any{"name": "sample", "namespace": "test", "uid": "reviewed", "resourceVersion": "opaque-v1"}}}
+	guard := contractresource.ResourceMutationPreconditions{ExpectedUID: "reviewed", ExpectedResourceVersion: "opaque-v1"}
+	for _, field := range []string{"uid", "version", "kind", "apiVersion", "name", "namespace"} {
+		desired := current.DeepCopy()
+		switch field {
+		case "uid":
+			desired.SetUID("stale")
+		case "version":
+			desired.SetResourceVersion("stale")
+		case "kind":
+			desired.SetKind("Secret")
+		case "apiVersion":
+			desired.SetAPIVersion("other/v1")
+		case "name":
+			desired.SetName("other")
+		case "namespace":
+			desired.SetNamespace("other")
+		}
+		if err := ValidateResourceEditPreconditions(current, desired, guard); !apierrors.IsBadRequest(err) {
+			t.Fatalf("stale %s was accepted: %v", field, err)
+		}
+	}
+	desired := current.DeepCopy()
+	desired.SetUID("")
+	desired.SetResourceVersion("")
+	if err := ValidateResourceEditPreconditions(current, desired, guard); err != nil {
+		t.Fatal("explicit body guard was not accepted", err)
+	}
+}
+
+func TestResourceIdentityProjectionDoesNotExposeSecretContent(t *testing.T) {
+	current := &unstructured.Unstructured{Object: map[string]any{"apiVersion": "v1", "kind": "Secret", "metadata": map[string]any{"name": "sample", "namespace": "test", "uid": "reviewed", "resourceVersion": "1", "annotations": map[string]any{"private": "sensitive-marker"}}, "data": map[string]any{"token": "sensitive-marker"}}}
+	value, err := json.Marshal(ResourceIdentityFrom(current))
+	if err != nil || strings.Contains(string(value), "sensitive-marker") || strings.Contains(string(value), "annotations") || strings.Contains(string(value), "data") {
+		t.Fatal("metadata identity exposed resource content", err)
+	}
+	if !strings.Contains(string(value), `"uid":"reviewed"`) {
+		t.Fatal("metadata identity lost the reviewed UID")
+	}
+}

package/resource/runtime/network_relationship_primitives_test.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"testing"
 
-	cr "github.com/opensoha/soha-contracts/resource"
+	cr "github.com/opensoha/soha/contracts/resource"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 )
 

package/resource/runtime/network_topology.go

@@ -10,7 +10,7 @@ import (
 	"sync"
 	"time"
 
-	resource "github.com/opensoha/soha-contracts/resource"
+	resource "github.com/opensoha/soha/contracts/resource"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"

package/resource/runtime/network_topology_builder.go

@@ -8,7 +8,7 @@ import (
 	"strings"
 	"time"
 
-	cr "github.com/opensoha/soha-contracts/resource"
+	cr "github.com/opensoha/soha/contracts/resource"
 )
 
 type topologyObject struct {

package/resource/runtime/network_topology_builder_backends.go

@@ -2,7 +2,7 @@ package runtime
 
 import (
 	"fmt"
-	cr "github.com/opensoha/soha-contracts/resource"
+	cr "github.com/opensoha/soha/contracts/resource"
 	"k8s.io/apimachinery/pkg/labels"
 	"strings"
 )

package/resource/runtime/network_topology_builder_ingress.go

@@ -2,7 +2,7 @@ package runtime
 
 import (
 	"fmt"
-	cr "github.com/opensoha/soha-contracts/resource"
+	cr "github.com/opensoha/soha/contracts/resource"
 	"strings"
 )
 

package/resource/runtime/network_topology_builder_legacy.go

@@ -1,6 +1,6 @@
 package runtime
 
-import cr "github.com/opensoha/soha-contracts/resource"
+import cr "github.com/opensoha/soha/contracts/resource"
 
 // Legacy traces are a bounded projection of the graph, never a separately inferred topology.
 func (g *topologyGraph) projectLegacy() {

package/resource/runtime/network_topology_builder_providers.go

@@ -2,7 +2,7 @@ package runtime
 
 import (
 	"fmt"
-	cr "github.com/opensoha/soha-contracts/resource"
+	cr "github.com/opensoha/soha/contracts/resource"
 	"strings"
 )
 

package/resource/runtime/network_topology_builder_test.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	cr "github.com/opensoha/soha-contracts/resource"
+	cr "github.com/opensoha/soha/contracts/resource"
 )
 
 func topologyFixture(source, namespace, name, body string) cr.NetworkTopologySourceResult {

package/resource/runtime/network_topology_declarations.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"strings"
 
-	cr "github.com/opensoha/soha-contracts/resource"
+	cr "github.com/opensoha/soha/contracts/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 )

package/resource/runtime/network_topology_test.go

@@ -9,7 +9,7 @@ import (
 	"strings"
 	"testing"
 
-	cr "github.com/opensoha/soha-contracts/resource"
+	cr "github.com/opensoha/soha/contracts/resource"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
 )

package/resource/runtime/node_drain.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 	"sync"
 
-	"github.com/opensoha/soha-contracts/resource"
+	"github.com/opensoha/soha/contracts/resource"
 	policyv1 "k8s.io/api/policy/v1"
 	policyv1beta1 "k8s.io/api/policy/v1beta1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"

package/resource/runtime/node_drain_test.go

@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/opensoha/soha-contracts/resource"
+	"github.com/opensoha/soha/contracts/resource"
 	policyv1 "k8s.io/api/policy/v1"
 	policyv1beta1 "k8s.io/api/policy/v1beta1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"

package/resource/runtime/pod_execution.go

@@ -0,0 +1,199 @@
+package runtime
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+	"unicode"
+	"unicode/utf8"
+
+	contractresource "github.com/opensoha/soha/contracts/resource"
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/validation"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/remotecommand"
+	utilexec "k8s.io/client-go/util/exec"
+)
+
+func InspectPodExecutionTarget(ctx context.Context, client kubernetes.Interface, namespace, name, expectedUID, container string) (contractresource.PodExecutionTarget, error) {
+	var empty contractresource.PodExecutionTarget
+	if client == nil || len(validation.IsDNS1123Label(namespace)) > 0 || len(validation.IsDNS1123Subdomain(name)) > 0 || expectedUID == "" || len(expectedUID) > 256 || strings.IndexFunc(expectedUID, func(r rune) bool { return unicode.IsControl(r) || unicode.IsSpace(r) }) >= 0 {
+		return empty, apierrors.NewBadRequest("valid namespace, Pod name and reviewed UID are required")
+	}
+	pod, err := client.CoreV1().Pods(namespace).Get(ctx, name, metav1.GetOptions{})
+	if err != nil {
+		return empty, err
+	}
+	if pod.Name != name || pod.Namespace != namespace || string(pod.UID) != expectedUID || pod.DeletionTimestamp != nil {
+		return empty, apierrors.NewConflict(schema.GroupResource{Resource: "pods"}, name, fmt.Errorf("pod identity changed or deletion was requested"))
+	}
+	if container == "" {
+		container = pod.Annotations["kubectl.kubernetes.io/default-container"]
+		if container == "" && len(pod.Spec.Containers) == 1 {
+			container = pod.Spec.Containers[0].Name
+		}
+	}
+	found := false
+	for _, item := range append(append([]corev1.Container(nil), pod.Spec.Containers...), pod.Spec.InitContainers...) {
+		if item.Name == container {
+			found = true
+		}
+	}
+	for _, item := range pod.Spec.EphemeralContainers {
+		if item.Name == container {
+			found = true
+		}
+	}
+	if container == "" || !found {
+		return empty, apierrors.NewBadRequest("select one existing Pod container")
+	}
+	return contractresource.PodExecutionTarget{Namespace: namespace, PodName: name, UID: expectedUID, Container: container, CheckedAt: time.Now().UTC()}, nil
+}
+
+type PodExecutorFactory func(namespace, name string, options corev1.PodExecOptions) (remotecommand.Executor, error)
+
+// ExecutePodArgv checks UID before connecting and again after execution.
+// Kubernetes exec has no atomic UID precondition; this function never claims
+// otherwise, and never retries an uncertain command.
+func ExecutePodArgv(ctx context.Context, client kubernetes.Interface, config *rest.Config, namespace, name string, input contractresource.PodArgvInput, factory PodExecutorFactory) (contractresource.PodArgvResult, error) {
+	var result contractresource.PodArgvResult
+	input, err := input.Normalized()
+	if err != nil {
+		return result, apierrors.NewBadRequest(err.Error())
+	}
+	if err := ctx.Err(); err != nil {
+		return result, err
+	}
+	runCtx, cancel := context.WithTimeout(ctx, time.Duration(input.TimeoutSeconds)*time.Second)
+	defer cancel()
+	target, err := InspectPodExecutionTarget(runCtx, client, namespace, name, input.ExpectedUID, input.Container)
+	if err != nil {
+		return result, err
+	}
+	if err := runCtx.Err(); err != nil {
+		return result, err
+	}
+	stdin, _ := base64.StdEncoding.Strict().DecodeString(input.StdinBase64)
+	options := corev1.PodExecOptions{Container: target.Container, Command: input.Argv, Stdin: len(stdin) > 0, Stdout: true, Stderr: true, TTY: false}
+	if factory == nil {
+		if config == nil || client.CoreV1().RESTClient() == nil {
+			return result, apierrors.NewBadRequest("Pod exec transport is unavailable")
+		}
+		factory = func(namespace, name string, options corev1.PodExecOptions) (remotecommand.Executor, error) {
+			request := client.CoreV1().RESTClient().Post().Resource("pods").Name(name).Namespace(namespace).SubResource("exec")
+			request.VersionedParams(&options, scheme.ParameterCodec)
+			return newPodExecutionExecutor(config, name, request.URL())
+		}
+	}
+	executor, err := factory(namespace, name, options)
+	if err != nil {
+		return result, err
+	}
+	budget := &podOutputBudget{maximum: int(input.MaxOutputBytes)}
+	stdout, stderr := &podOutputBuffer{budget: budget}, &podOutputBuffer{budget: budget}
+	streamOptions := remotecommand.StreamOptions{Stdout: stdout, Stderr: stderr}
+	if len(stdin) > 0 {
+		streamOptions.Stdin = bytes.NewReader(stdin)
+	}
+	execErr := executor.StreamWithContext(runCtx, streamOptions)
+	// An explicit API rejection of the upgrade is a denied operation, rather
+	// than a process exit or an unclassified transport failure.
+	if apierrors.IsForbidden(execErr) || apierrors.IsUnauthorized(execErr) || apierrors.IsNotFound(execErr) || apierrors.IsBadRequest(execErr) {
+		return result, execErr
+	}
+	outData, outBytes, outTruncated := stdout.snapshot()
+	errData, errBytes, errTruncated := stderr.snapshot()
+	outValue, outEncoding := encodePodExecutionStream(outData)
+	errValue, errEncoding := encodePodExecutionStream(errData)
+	output := contractresource.PodExecutionOutput{Status: "succeeded", Stdout: outValue, Stderr: errValue, StdoutEncoding: outEncoding, StderrEncoding: errEncoding, StdoutBytes: outBytes, StderrBytes: errBytes, MaxOutputBytes: input.MaxOutputBytes, StdoutTruncated: outTruncated, StderrTruncated: errTruncated, UIDVerifiedBeforeStart: true}
+	var remoteExit utilexec.ExitError
+	switch {
+	case execErr == nil:
+		code := int64(0)
+		output.ExitCode = &code
+	case errors.As(execErr, &remoteExit) && remoteExit.Exited() && remoteExit.ExitStatus() >= 0:
+		code := int64(remoteExit.ExitStatus())
+		if code > 4294967295 {
+			output.Status = "transport_lost"
+			output.ReasonCode = "invalid_exit_status"
+		} else {
+			output.ExitCode = &code
+			output.Status = "failed"
+			output.ReasonCode = "process_exited"
+		}
+	case errors.Is(runCtx.Err(), context.DeadlineExceeded):
+		output.Status = "timed_out"
+		output.ReasonCode = "deadline_exceeded"
+	case errors.Is(runCtx.Err(), context.Canceled):
+		output.Status = "canceled"
+		output.ReasonCode = "request_canceled"
+	default:
+		output.Status = "transport_lost"
+		output.ReasonCode = "transport_lost"
+	}
+	// No new provider read after cancellation/revocation. A normal completion
+	// receives a short final identity check, which can never repeat the command.
+	if runCtx.Err() == nil {
+		verifyCtx, verifyCancel := context.WithTimeout(runCtx, 3*time.Second)
+		defer verifyCancel()
+		_, verifyErr := InspectPodExecutionTarget(verifyCtx, client, namespace, name, input.ExpectedUID, target.Container)
+		if verifyErr != nil {
+			if apierrors.IsConflict(verifyErr) || apierrors.IsNotFound(verifyErr) {
+				output.TargetChanged = true
+				output.ReasonCode = "target_changed_after_execution"
+			} else {
+				output.ReasonCode = "target_verification_unavailable"
+			}
+			output.Status = "unknown"
+		}
+	}
+	result.Target, result.Output = target, output
+	return result, nil
+}
+
+func encodePodExecutionStream(data []byte) (string, string) {
+	if utf8.Valid(data) {
+		return string(data), "utf-8"
+	}
+	return base64.StdEncoding.EncodeToString(data), "base64"
+}
+
+type podOutputBudget struct {
+	mu            sync.Mutex
+	maximum, used int
+}
+type podOutputBuffer struct {
+	budget    *podOutputBudget
+	data      []byte
+	total     int64
+	truncated bool
+}
+
+func (b *podOutputBuffer) Write(data []byte) (int, error) {
+	b.budget.mu.Lock()
+	defer b.budget.mu.Unlock()
+	b.total += int64(len(data))
+	keep := min(len(data), b.budget.maximum-b.budget.used)
+	b.data = append(b.data, data[:keep]...)
+	b.budget.used += keep
+	if keep < len(data) {
+		b.truncated = true
+	}
+	return len(data), nil
+}
+
+func (b *podOutputBuffer) snapshot() ([]byte, int64, bool) {
+	b.budget.mu.Lock()
+	defer b.budget.mu.Unlock()
+	return append([]byte(nil), b.data...), b.total, b.truncated
+}