@skyhook-io/k8s-ui 1.17.0 → 1.17.1

package/src/components/cnpg/connect.ts

@@ -0,0 +1,155 @@
+import { cnpgHASourceText, type CNPGClusterHA } from './ha'
+import { getCNPGClusterIsReplica } from '../resources/resource-utils-cnpg'
+
+/** The port CloudNativePG gives PostgreSQL and PgBouncer when a Service template sets none. */
+export const CNPG_DEFAULT_PORT = 5432
+
+export type CNPGConnectRole = 'rw' | 'ro' | 'r' | 'pooler' | 'additional'
+
+export interface CNPGConnectEndpoint {
+  role: CNPGConnectRole
+  /** The Service name. */
+  name: string
+  host: string
+  port: number
+  /** True when the port comes from a Service template rather than CloudNativePG's default. */
+  portFromTemplate: boolean
+  /** What the Service selects: the primary, standbys only, any instance, or through a Pooler. */
+  selects: string
+  /** Pooler `spec.type`, for pooler endpoints. */
+  poolerType?: string
+}
+
+export interface CNPGConnectValue {
+  value?: string
+  /** The field the value was read from, or why it is inferred. */
+  source: string
+}
+
+export interface CNPGConnectInfo {
+  endpoints: CNPGConnectEndpoint[]
+  database: CNPGConnectValue
+  owner: CNPGConnectValue
+  secret: { name: string; source: string; byConvention: boolean }
+  /** A replica cluster's services all reach instances that only replay. */
+  replicaCluster: boolean
+  /** Services named in `spec.managed.services.disabledDefaultServices`. */
+  disabled: ('ro' | 'r')[]
+}
+
+const SELECTS: Record<'rw' | 'ro' | 'r', string> = {
+  rw: 'the primary (read-write)',
+  ro: 'standbys only (read-only)',
+  // -r selects every instance Pod (cnpg.io/podRole=instance), the primary included.
+  r: 'any instance (may reach the primary; not read-only)',
+}
+
+const BOOTSTRAP_ORDER = ['recovery', 'pg_basebackup', 'initdb'] as const
+
+function templatePort(template: any): number | undefined {
+  const port = template?.spec?.ports?.[0]?.port
+  return typeof port === 'number' && port > 0 ? port : undefined
+}
+
+function endpoint(role: CNPGConnectRole, name: string, ns: string, selects: string, template?: any): CNPGConnectEndpoint {
+  const port = templatePort(template)
+  return { role, name, host: `${name}.${ns}.svc`, port: port ?? CNPG_DEFAULT_PORT, portFromTemplate: port !== undefined, selects }
+}
+
+// Mirrors CloudNativePG's GetApplicationDatabaseName / Owner / SecretName:
+// recovery, then pg_basebackup, then initdb, first non-empty wins.
+function fromBootstrap(bootstrap: any, pick: (section: any) => string | undefined, field: string): CNPGConnectValue | undefined {
+  for (const method of BOOTSTRAP_ORDER) {
+    const v = pick(bootstrap?.[method])
+    if (v) return { value: v, source: `spec.bootstrap.${method}.${field}` }
+  }
+  return undefined
+}
+
+/**
+ * How applications reach a CloudNativePG Cluster, derived from its spec and
+ * the Poolers that front it. Nothing here reads a Secret: the credentials
+ * Secret is named from the spec or CloudNativePG's `<cluster>-app` convention.
+ */
+export function cnpgConnectInfo(cluster: any, poolers: any[] = []): CNPGConnectInfo {
+  const name: string = cluster?.metadata?.name ?? ''
+  const ns: string = cluster?.metadata?.namespace ?? ''
+  const spec = cluster?.spec ?? {}
+  const bootstrap = spec.bootstrap
+
+  const disabledRaw: unknown[] = spec.managed?.services?.disabledDefaultServices ?? []
+  const disabled = (['ro', 'r'] as const).filter((t) => disabledRaw.includes(t))
+  const endpoints: CNPGConnectEndpoint[] = [endpoint('rw', `${name}-rw`, ns, SELECTS.rw)]
+  for (const t of ['ro', 'r'] as const) if (!disabled.includes(t)) endpoints.push(endpoint(t, `${name}-${t}`, ns, SELECTS[t]))
+  for (const svc of spec.managed?.services?.additional ?? []) {
+    const svcName = svc?.serviceTemplate?.metadata?.name
+    if (!svcName) continue
+    const sel = svc.selectorType as 'rw' | 'ro' | 'r'
+    endpoints.push(endpoint('additional', svcName, ns, SELECTS[sel] ?? `selector ${sel ?? 'unknown'}`, svc.serviceTemplate))
+  }
+  for (const p of poolers) {
+    if (p?.metadata?.namespace !== ns || p?.spec?.cluster?.name !== name || !p?.metadata?.name) continue
+    const type: string = p.spec?.type || 'rw'
+    endpoints.push({
+      ...endpoint('pooler', p.metadata.name, ns, `PgBouncer in front of ${type === 'rw' ? 'the primary' : type === 'ro' ? 'the standbys' : type === 'r' ? 'any instance (may reach the primary; not read-only)' : `selector ${type}`}`, p.spec?.serviceTemplate),
+      poolerType: type,
+    })
+  }
+
+  const monolith = bootstrap?.initdb?.import?.type === 'monolith'
+  const database =
+    fromBootstrap(bootstrap, (s) => s?.database, 'database') ??
+    (monolith
+      ? { source: 'not set: a monolithic import creates no application database' }
+      : { value: 'app', source: "CloudNativePG's default" })
+  const owner =
+    fromBootstrap(bootstrap, (s) => s?.owner, 'owner') ??
+    (database.value ? { value: database.value, source: "CloudNativePG's default: the database's name" } : { source: 'not set' })
+  const secretFromSpec = fromBootstrap(bootstrap, (s) => s?.secret?.name, 'secret.name')
+  const secret = secretFromSpec?.value
+    ? { name: secretFromSpec.value, source: secretFromSpec.source, byConvention: false }
+    : { name: `${name}-app`, source: 'name by convention (<cluster>-app)', byConvention: true }
+
+  return {
+    endpoints,
+    database,
+    owner,
+    secret,
+    replicaCluster: cluster ? getCNPGClusterIsReplica(cluster) : false,
+    disabled,
+  }
+}
+
+/** A connection URI with the password left as a placeholder; never a real credential. */
+export function cnpgConnectionURI(ep: CNPGConnectEndpoint, info: CNPGConnectInfo): string {
+  const user = encodeURIComponent(info.owner.value ?? '<user>')
+  const db = encodeURIComponent(info.database.value ?? '<database>')
+  return `postgresql://${user}:<password>@${ep.host}:${ep.port}/${db}`
+}
+
+function shellWord(v: string): string {
+  return /^[A-Za-z0-9_.@%+=:,/-]+$/.test(v) ? v : `'${v.replace(/'/g, `'\\''`)}'`
+}
+
+/** psql prompts for the password; nothing secret is put on the command line. */
+export function cnpgPsqlCommand(ep: CNPGConnectEndpoint, info: CNPGConnectInfo): string {
+  return `psql -h ${ep.host} -p ${ep.port} -U ${shellWord(info.owner.value ?? '<user>')} -d ${shellWord(info.database.value ?? '<database>')}`
+}
+
+export function cnpgPortForwardCommand(ep: CNPGConnectEndpoint, namespace: string, localPort = CNPG_DEFAULT_PORT, kubeconfigContext?: string): string {
+  return `kubectl${kubeconfigContext ? ` --context ${shellWord(kubeconfigContext)}` : ''} -n ${shellWord(namespace)} port-forward ${shellWord(`service/${ep.name}`)} ${localPort}:${ep.port}`
+}
+
+export function cnpgEndpointAvailability(ep: CNPGConnectEndpoint, ha?: CNPGClusterHA, unreadReason?: string): { text: string; source?: string } {
+  if (ep.role === 'rw' && ha?.rwEndpoints.state === 'ok') {
+    return { text: ha.rwEndpoints.pods.length > 0 ? 'Ready endpoints' : 'Unavailable: no ready endpoint', source: 'Service EndpointSlices' }
+  }
+  if ((ep.role === 'ro' || ep.role === 'r') && ha?.pods.state === 'ok') {
+    const candidates = ep.role === 'ro' ? ha.instances.filter((i) => i.role === 'replica') : ha.instances
+    if (ep.role === 'ro' && ha.instances.some((i) => i.ready && i.role === 'unknown') && !candidates.some((i) => i.ready)) return { text: 'Not checked', source: 'Ready instance roles were not reported' }
+    return { text: candidates.some((i) => i.ready) ? 'Ready instance observed' : ep.role === 'ro' ? 'Unavailable: no ready standby' : 'Unavailable: no ready instance', source: 'Instance Pod readiness' }
+  }
+  const source = ep.role === 'rw' ? ha?.rwEndpoints : ep.role === 'ro' || ep.role === 'r' ? ha?.pods : undefined
+  const what = ep.role === 'rw' ? 'Service EndpointSlices' : 'instance Pods'
+  return { text: 'Not checked', source: ep.role === 'pooler' || ep.role === 'additional' ? 'This Service’s availability has not been read' : source ? cnpgHASourceText(source, what) : unreadReason ?? 'HA evidence has not been read' }
+}

package/src/components/cnpg/databaseRole.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, it } from 'vitest'
+import { cnpgDatabaseRoleFacts, cnpgDatabaseRoleMeta } from './databaseRole'
+
+const role = (spec: any, status: any = {}) => ({
+  apiVersion: 'postgresql.cnpg.io/v1',
+  kind: 'DatabaseRole',
+  metadata: { name: 'app-reader', namespace: 'db' },
+  spec: { cluster: { name: 'pg' }, name: 'reader', ...spec },
+  status,
+})
+
+describe('cnpgDatabaseRoleFacts', () => {
+  it('reports the Cluster’s managed.roles precedence as three-valued', () => {
+    const cluster = { spec: { managed: { roles: [{ name: 'reader' }] } } }
+    expect(cnpgDatabaseRoleFacts(role({}), cluster).overriddenByCluster).toBe(true)
+    expect(cnpgDatabaseRoleFacts(role({}), { spec: {} }).overriddenByCluster).toBe(false)
+    expect(cnpgDatabaseRoleFacts(role({}), null).overriddenByCluster).toBeNull()
+  })
+
+  it('reads applied three ways and the operator message', () => {
+    expect(cnpgDatabaseRoleFacts(role({}), null).state).toBe('pending')
+    const failed = cnpgDatabaseRoleFacts(role({}, { applied: false, message: 'database role is already managed by the CNPG cluster' }), null)
+    expect(failed.state).toBe('failed')
+    expect(failed.message).toContain('already managed')
+  })
+
+  it('treats an omitted login as false and names the client certificate Secret', () => {
+    const f = cnpgDatabaseRoleFacts(role({ clientCertificate: {}, validUntil: '2027-01-01T00:00:00Z' }, { clientCertificate: { expiration: '2026-12-01T00:00:00Z' } }), null)
+    expect(f.login).toBe(false)
+    expect(f.clientCertificate?.secret).toBe('app-reader-client-cert')
+    expect(cnpgDatabaseRoleMeta(f)).toBe('no login · password valid until 2027-01-01T00:00:00Z · client cert until 2026-12-01T00:00:00Z')
+  })
+})
+
+it('keeps a DatabaseRole pending until its current generation is observed', () => {
+  const r = { ...role({}, { applied: true, observedGeneration: 1 }), metadata: { name: 'reader', generation: 2 } }
+  expect(cnpgDatabaseRoleFacts(r, null).state).toBe('pending')
+})

package/src/components/cnpg/databaseRole.ts

@@ -0,0 +1,80 @@
+import { appliedFact } from './relations'
+
+// CloudNativePG DatabaseRole (1.30+): one PostgreSQL role declared as its own
+// object. The same role name in the Cluster's spec.managed.roles always wins:
+// the operator does not reconcile the DatabaseRole and reports it not applied
+// ("database role is already managed by the CNPG cluster").
+
+export type CNPGRoleState = 'applied' | 'failed' | 'pending'
+
+export interface CNPGDatabaseRoleFacts {
+  pgName: string
+  cluster?: string
+  state: CNPGRoleState
+  message?: string
+  /** Absent in the spec means false: the operator's field is omitempty. */
+  login: boolean
+  superuser: boolean
+  /** spec.validUntil: when the role's password stops being accepted (PostgreSQL VALID UNTIL). */
+  passwordValidUntil?: string
+  passwordSecret?: string
+  passwordDisabled: boolean
+  clientCertificate?: { enabled: boolean; secret: string; expiration?: string; message?: string }
+  reclaimPolicy: 'delete' | 'retain'
+  /**
+   * true when the target Cluster declares the same role in spec.managed.roles,
+   * false when it does not, null when the Cluster is not visible.
+   */
+  overriddenByCluster: boolean | null
+}
+
+export function cnpgRoleState(obj: any): CNPGRoleState {
+  const fact = appliedFact(obj)
+  if (fact.tone === 'healthy') return 'applied'
+  if (fact.tone === 'unhealthy') return 'failed'
+  return 'pending'
+}
+
+export function cnpgDatabaseRoleFacts(role: any, cluster: any | null | undefined): CNPGDatabaseRoleFacts {
+  const spec = role?.spec ?? {}
+  const status = role?.status ?? {}
+  const pgName: string = spec.name ?? role?.metadata?.name ?? ''
+  let overriddenByCluster: boolean | null = null
+  if (cluster) {
+    const roles: any[] = Array.isArray(cluster?.spec?.managed?.roles) ? cluster.spec.managed.roles : []
+    overriddenByCluster = roles.some((r) => r?.name === pgName)
+  }
+  const cc = spec.clientCertificate
+  const ccEnabled = !!cc && cc.enabled !== false
+  return {
+    pgName,
+    cluster: spec.cluster?.name,
+    state: cnpgRoleState(role),
+    message: status.message || undefined,
+    login: spec.login === true,
+    superuser: spec.superuser === true,
+    passwordValidUntil: spec.validUntil || undefined,
+    passwordSecret: spec.passwordSecret?.name || undefined,
+    passwordDisabled: spec.disablePassword === true,
+    clientCertificate: ccEnabled
+      ? {
+          enabled: true,
+          secret: `${role?.metadata?.name}-client-cert`,
+          expiration: status.clientCertificate?.expiration || undefined,
+          message: status.clientCertificate?.message || undefined,
+        }
+      : undefined,
+    reclaimPolicy: spec.databaseRoleReclaimPolicy === 'delete' ? 'delete' : 'retain',
+    overriddenByCluster,
+  }
+}
+
+/** Short, factual meta line for a list row. */
+export function cnpgDatabaseRoleMeta(f: CNPGDatabaseRoleFacts): string {
+  const parts: string[] = []
+  if (f.overriddenByCluster) parts.push('overridden by spec.managed.roles')
+  parts.push(f.login ? 'login' : 'no login')
+  if (f.passwordValidUntil) parts.push(`password valid until ${f.passwordValidUntil}`)
+  if (f.clientCertificate) parts.push(f.clientCertificate.expiration ? `client cert until ${f.clientCertificate.expiration}` : 'client cert expiry not reported')
+  return parts.join(' · ')
+}