underpost 3.2.80 → 3.2.90

package/test/instance-traffic-plan.test.js

@@ -0,0 +1,710 @@
+'use strict';
+
+import { expect } from 'chai';
+import fs from 'fs-extra';
+import {
+  curlStatusChainFactory,
+  hostRenderInstancesFactory,
+  instanceTrafficPlanFactory,
+  isTrafficServingFactory,
+  hostIngressFactsFactory,
+  nextTrafficFactory,
+  schedulableNodeFactory,
+  stopPlanFactory,
+  trafficFromRoutingInfoFactory,
+  trafficProbePathsFactory,
+  trafficTableRowsFactory,
+} from '../src/server/conf.js';
+
+// Pure resolution over the conf: the cluster lookups are injected, so every case
+// here fixes the routed colour and the endpoint readiness explicitly.
+const INSTANCES = [
+  { id: 'mmo-server', host: 'server.fixture.test', path: '/' },
+  { id: 'mmo-server-forest', host: 'server.fixture.test', path: '/FOREST' },
+];
+
+const planFactory = ({ live = {}, ready = {}, requestedTraffic = '', instances = INSTANCES } = {}) =>
+  instanceTrafficPlanFactory({
+    instances,
+    requestedTraffic,
+    liveTrafficOf: (instance) => live[instance.id],
+    servesTraffic: (instance, colour) => ready[`${instance.id}:${colour}`] === true,
+  });
+
+describe('blue/green traffic plan', () => {
+  describe('curlStatusChainFactory', () => {
+    it('extracts every followed response without duplicating -i headers', () => {
+      const raw = [
+        '< HTTP/1.1 301 Moved Permanently',
+        'HTTP/1.1 301 Moved Permanently',
+        '< HTTP/2 200',
+        'HTTP/2 200',
+        'UNDERPOST_CURL_FINAL=200',
+      ].join('\n');
+      expect(curlStatusChainFactory(raw)).to.deep.equal(['301', '200']);
+    });
+
+    it('ignores proxy CONNECT acknowledgements and reports no-response as 000', () => {
+      expect(curlStatusChainFactory('< HTTP/1.1 200 Connection established\nUNDERPOST_CURL_FINAL=000')).to.deep.equal([
+        '000',
+      ]);
+    });
+
+    it('uses curl write-out when no verbose response line was emitted', () => {
+      expect(curlStatusChainFactory('UNDERPOST_CURL_FINAL=204')).to.deep.equal(['204']);
+    });
+  });
+
+  describe('nextTrafficFactory', () => {
+    it('flips the live colour', () => {
+      expect(nextTrafficFactory('blue')).to.equal('green');
+      expect(nextTrafficFactory('green')).to.equal('blue');
+    });
+
+    it('starts on blue when no colour is live', () => {
+      for (const live of ['', undefined, null]) expect(nextTrafficFactory(live)).to.equal('blue');
+    });
+
+    it('honours an explicitly requested colour over the flip', () => {
+      expect(nextTrafficFactory('blue', 'blue')).to.equal('blue');
+      expect(nextTrafficFactory('green', 'green')).to.equal('green');
+    });
+
+    it('ignores a request that is not a colour', () => {
+      for (const requested of ['', 'red', 'BLUE', undefined])
+        expect(nextTrafficFactory('blue', requested)).to.equal('green');
+    });
+  });
+
+  // `run sync` gates its no-backend checkpoint on this directly; `run instance`
+  // reaches it through instanceTrafficPlanFactory. One definition, so neither
+  // runner can decide differently about taking a live host offline.
+  describe('isTrafficServingFactory', () => {
+    it('is serving only when the routed colour is also reachable', () => {
+      expect(isTrafficServingFactory({ liveTraffic: 'blue', hasReadyEndpoints: () => true })).to.equal(true);
+      expect(isTrafficServingFactory({ liveTraffic: 'blue', hasReadyEndpoints: () => false })).to.equal(false);
+    });
+
+    it('is not serving when no colour is routed', () => {
+      for (const liveTraffic of ['', undefined, null])
+        expect(isTrafficServingFactory({ liveTraffic, hasReadyEndpoints: () => true })).to.equal(false);
+    });
+
+    it('asks about the routed colour, and only when one is routed', () => {
+      const asked = [];
+      isTrafficServingFactory({
+        liveTraffic: 'green',
+        hasReadyEndpoints: (colour) => {
+          asked.push(colour);
+          return true;
+        },
+      });
+      isTrafficServingFactory({
+        liveTraffic: '',
+        hasReadyEndpoints: (colour) => {
+          asked.push(colour);
+          return true;
+        },
+      });
+      expect(asked).to.deep.equal(['green']);
+    });
+
+    it('defaults to not serving with nothing supplied', () => {
+      expect(isTrafficServingFactory({})).to.equal(false);
+    });
+  });
+
+  describe('instanceTrafficPlanFactory', () => {
+    it('flips every instance off the colour it serves', () => {
+      const { liveTrafficById, targetTrafficById } = planFactory({
+        live: { 'mmo-server': 'blue', 'mmo-server-forest': 'green' },
+        ready: { 'mmo-server:blue': true, 'mmo-server-forest:green': true },
+      });
+      expect(liveTrafficById).to.deep.equal({ 'mmo-server': 'blue', 'mmo-server-forest': 'green' });
+      expect(targetTrafficById).to.deep.equal({ 'mmo-server': 'green', 'mmo-server-forest': 'blue' });
+    });
+
+    // The regression this guards: a re-deploy of a healthy host must not be
+    // mistaken for a first bring-up, because the no-backend fallback checkpoint
+    // gated on `serving` routes the edge at a colour that has no Deployment.
+    it('reports a routed colour with a ready endpoint as serving', () => {
+      const { serving } = planFactory({
+        live: { 'mmo-server': 'blue', 'mmo-server-forest': 'blue' },
+        ready: { 'mmo-server:blue': true, 'mmo-server-forest:blue': true },
+      });
+      expect(serving.map((instance) => instance.id)).to.deep.equal(['mmo-server', 'mmo-server-forest']);
+    });
+
+    it('reports nothing serving on a first bring-up', () => {
+      const { serving, targetTrafficById } = planFactory({ live: {}, ready: {} });
+      expect(serving).to.deep.equal([]);
+      expect(targetTrafficById).to.deep.equal({ 'mmo-server': 'blue', 'mmo-server-forest': 'blue' });
+    });
+
+    // A route can still name a colour whose workload is long gone; that is a
+    // dead route, not traffic, so the checkpoint is free to run.
+    it('does not treat a routed colour without a ready endpoint as serving', () => {
+      const { serving, targetTrafficById } = planFactory({
+        live: { 'mmo-server': 'blue', 'mmo-server-forest': 'blue' },
+        ready: {},
+      });
+      expect(serving).to.deep.equal([]);
+      expect(targetTrafficById).to.deep.equal({ 'mmo-server': 'green', 'mmo-server-forest': 'green' });
+    });
+
+    it('counts only the instances that are actually serving', () => {
+      const { serving } = planFactory({
+        live: { 'mmo-server': 'blue', 'mmo-server-forest': 'blue' },
+        ready: { 'mmo-server:blue': true },
+      });
+      expect(serving.map((instance) => instance.id)).to.deep.equal(['mmo-server']);
+    });
+
+    // Readiness is asked about the live colour only. An idle colour left Ready by
+    // a previous cycle is not what the host is serving on.
+    it('ignores readiness of a colour that is not routed', () => {
+      const { serving } = planFactory({
+        live: { 'mmo-server': 'blue' },
+        ready: { 'mmo-server:green': true },
+        instances: [INSTANCES[0]],
+      });
+      expect(serving).to.deep.equal([]);
+    });
+
+    it('never consults readiness when no colour is routed', () => {
+      const asked = [];
+      const { serving } = instanceTrafficPlanFactory({
+        instances: INSTANCES,
+        liveTrafficOf: () => '',
+        servesTraffic: (instance, colour) => {
+          asked.push(`${instance.id}:${colour}`);
+          return true;
+        },
+      });
+      expect(asked).to.deep.equal([]);
+      expect(serving).to.deep.equal([]);
+    });
+
+    it('applies a requested colour to every instance', () => {
+      const { targetTrafficById } = planFactory({
+        live: { 'mmo-server': 'blue', 'mmo-server-forest': 'green' },
+        requestedTraffic: 'blue',
+      });
+      expect(targetTrafficById).to.deep.equal({ 'mmo-server': 'blue', 'mmo-server-forest': 'blue' });
+    });
+
+    it('is a no-op with no instances', () => {
+      expect(instanceTrafficPlanFactory({})).to.deep.equal({
+        liveTrafficById: {},
+        targetTrafficById: {},
+        serving: [],
+      });
+    });
+  });
+
+  // A host's server block and HTTPRoute are single shared objects, so what the
+  // render is built from decides which variants keep a route at all.
+  describe('hostRenderInstancesFactory', () => {
+    const MAIN = INSTANCES[0];
+    const FOREST = INSTANCES[1];
+    const TEST = { id: 'mmo-server-test', host: 'server.fixture.test', path: '/TEST' };
+
+    // The reported regression: trimming the conf to one variant must not delete
+    // the routes of the variants still deployed behind the same host.
+    it('keeps a still-deployed variant that the conf no longer declares', () => {
+      const rendered = hostRenderInstancesFactory({
+        declared: [FOREST],
+        preserved: [MAIN, FOREST, TEST],
+        isDeployed: () => true,
+      });
+      expect(rendered.map((instance) => instance.id)).to.deep.equal([
+        'mmo-server-forest',
+        'mmo-server',
+        'mmo-server-test',
+      ]);
+    });
+
+    it('drops a preserved variant once its workload is gone', () => {
+      const rendered = hostRenderInstancesFactory({
+        declared: [FOREST],
+        preserved: [MAIN, TEST],
+        isDeployed: (instance) => instance.id === 'mmo-server',
+      });
+      expect(rendered.map((instance) => instance.id)).to.deep.equal(['mmo-server-forest', 'mmo-server']);
+    });
+
+    it('never duplicates a variant that is both declared and preserved', () => {
+      const rendered = hostRenderInstancesFactory({
+        declared: [MAIN, FOREST],
+        preserved: [MAIN, FOREST],
+        isDeployed: () => true,
+      });
+      expect(rendered.map((instance) => instance.id)).to.deep.equal(['mmo-server', 'mmo-server-forest']);
+    });
+
+    // The declared entry is the current truth for that id; a stale preserved copy
+    // of the same id must not shadow it.
+    it('prefers the declared entry over a preserved one of the same id', () => {
+      const rendered = hostRenderInstancesFactory({
+        declared: [{ ...FOREST, path: '/FOREST-NEW' }],
+        preserved: [{ ...FOREST, path: '/FOREST-OLD' }],
+        isDeployed: () => true,
+      });
+      expect(rendered).to.have.lengthOf(1);
+      expect(rendered[0].path).to.equal('/FOREST-NEW');
+    });
+
+    it('ignores preserved entries with no id', () => {
+      expect(
+        hostRenderInstancesFactory({ declared: [FOREST], preserved: [{}, null], isDeployed: () => true }),
+      ).to.deep.equal([FOREST]);
+    });
+
+    it('is the declared set when nothing was preserved', () => {
+      expect(hostRenderInstancesFactory({ declared: [MAIN, FOREST] })).to.deep.equal([MAIN, FOREST]);
+      expect(hostRenderInstancesFactory({})).to.deep.equal([]);
+    });
+  });
+
+  // A nodeSelector naming a node that does not exist does not degrade — nothing
+  // schedules — so the guessed default has to be checked against the cluster.
+  describe('schedulableNodeFactory', () => {
+    const KUBEADM = [{ NAME: 'localhost.localdomain', STATUS: 'Ready', ROLES: 'control-plane' }];
+    const KIND = [
+      { NAME: 'kind-control-plane', STATUS: 'Ready', ROLES: 'control-plane' },
+      { NAME: 'kind-worker', STATUS: 'Ready', ROLES: '<none>' },
+    ];
+
+    // The reported failure: `--dev` on a kubeadm cluster guesses `kind-worker`.
+    it('substitutes a real node when the guess does not exist', () => {
+      expect(schedulableNodeFactory({ nodes: KUBEADM, node: 'kind-worker' })).to.deep.equal({
+        node: 'localhost.localdomain',
+        corrected: true,
+      });
+    });
+
+    it('keeps a node the cluster actually has', () => {
+      expect(schedulableNodeFactory({ nodes: KIND, node: 'kind-worker' })).to.deep.equal({
+        node: 'kind-worker',
+        corrected: false,
+      });
+    });
+
+    it('prefers a worker over the control plane', () => {
+      expect(schedulableNodeFactory({ nodes: KIND, node: 'nope' }).node).to.equal('kind-worker');
+    });
+
+    it('falls back to the control plane when it is the only node', () => {
+      expect(schedulableNodeFactory({ nodes: KUBEADM, node: '' }).node).to.equal('localhost.localdomain');
+    });
+
+    it('skips a NotReady node but still answers when none are Ready', () => {
+      const nodes = [
+        { NAME: 'down', STATUS: 'NotReady', ROLES: '<none>' },
+        { NAME: 'up', STATUS: 'Ready', ROLES: '<none>' },
+      ];
+      expect(schedulableNodeFactory({ nodes, node: 'nope' }).node).to.equal('up');
+      expect(schedulableNodeFactory({ nodes: [nodes[0]], node: 'nope' }).node).to.equal('down');
+    });
+
+    it('treats a cordoned node as Ready', () => {
+      const nodes = [{ NAME: 'only', STATUS: 'Ready,SchedulingDisabled', ROLES: '<none>' }];
+      expect(schedulableNodeFactory({ nodes, node: 'nope' }).node).to.equal('only');
+    });
+
+    // An unreadable cluster is not evidence the name is wrong.
+    it('leaves the choice untouched when there is no node list', () => {
+      expect(schedulableNodeFactory({ nodes: [], node: 'kind-worker' })).to.deep.equal({
+        node: 'kind-worker',
+        corrected: false,
+      });
+      expect(schedulableNodeFactory({ nodes: [{}, null], node: 'kind-worker' }).corrected).to.equal(false);
+    });
+  });
+
+  describe('stopPlanFactory', () => {
+    const FAMILY = {
+      'mmo-server': [
+        { id: 'mmo-server', host: 'server.fixture.test' },
+        { id: 'mmo-server-forest', host: 'server.fixture.test' },
+      ],
+      'mmo-client': [{ id: 'mmo-client', host: 'client.fixture.test' }],
+    };
+    const plan = (input) =>
+      stopPlanFactory({
+        env: 'development',
+        instancesFor: (instanceId) => FAMILY[instanceId] || [],
+        liveTrafficOf: () => 'blue',
+        ...input,
+      });
+    const names = (input) => plan(input).deployments.map((target) => target.deployment);
+
+    // 1 — default is the partner of whatever is serving.
+    it('stops the inactive colour of the PWA workload', () => {
+      expect(names({ deployId: 'dd-cyberia' })).to.deep.equal(['dd-cyberia-development-green']);
+    });
+
+    it('stops the colours named by --traffic, both when both are given', () => {
+      expect(names({ deployId: 'dd-cyberia', traffic: 'blue,green' })).to.deep.equal([
+        'dd-cyberia-development-blue',
+        'dd-cyberia-development-green',
+      ]);
+      expect(names({ deployId: 'dd-cyberia', traffic: 'blue' })).to.deep.equal(['dd-cyberia-development-blue']);
+    });
+
+    it('refuses a --traffic value that is not a colour', () => {
+      expect(plan({ deployId: 'dd-cyberia', traffic: 'red' }).error).to.match(/--traffic accepts blue and\/or green/);
+    });
+
+    // 2 — a literal path names the object outright and overrides every flag.
+    it('stops exactly the literal deployment, ignoring flags', () => {
+      const result = plan({
+        path: 'dd-cyberia-mmo-server-forest-development-blue',
+        deployId: 'dd-other',
+        instanceId: 'mmo-client',
+        traffic: 'blue,green',
+      });
+      expect(result.deployments.map((target) => target.deployment)).to.deep.equal([
+        'dd-cyberia-mmo-server-forest-development-blue',
+      ]);
+      expect(result.deployments[0].kind).to.equal('literal');
+    });
+
+    it('accepts several literal deployments', () => {
+      expect(names({ path: 'a-development-blue, b-development-green' })).to.deep.equal([
+        'a-development-blue',
+        'b-development-green',
+      ]);
+    });
+
+    // 3 + 4 — instance ids add their whole family alongside the PWA workload.
+    it('adds every variant of each instance family', () => {
+      expect(names({ deployId: 'dd-cyberia', instanceId: 'mmo-client,mmo-server' })).to.deep.equal([
+        'dd-cyberia-development-green',
+        'dd-cyberia-mmo-client-development-green',
+        'dd-cyberia-mmo-server-development-green',
+        'dd-cyberia-mmo-server-forest-development-green',
+      ]);
+    });
+
+    it('applies explicit colours to the PWA workload and every instance alike', () => {
+      expect(names({ deployId: 'dd-cyberia', instanceId: 'mmo-client', traffic: 'blue,green' })).to.deep.equal([
+        'dd-cyberia-development-blue',
+        'dd-cyberia-development-green',
+        'dd-cyberia-mmo-client-development-blue',
+        'dd-cyberia-mmo-client-development-green',
+      ]);
+    });
+
+    it('resolves each target its own colour', () => {
+      const deployments = plan({
+        deployId: 'dd-cyberia',
+        instanceId: 'mmo-server',
+        liveTrafficOf: (target) => (target.id === 'dd-cyberia-mmo-server' ? 'green' : 'blue'),
+      }).deployments;
+      expect(deployments.map((target) => target.deployment)).to.deep.equal([
+        'dd-cyberia-development-green',
+        'dd-cyberia-mmo-server-development-blue',
+        'dd-cyberia-mmo-server-forest-development-green',
+      ]);
+    });
+
+    it('never plans the same deployment twice', () => {
+      expect(names({ deployId: 'dd-cyberia', instanceId: 'mmo-server,mmo-server' })).to.deep.equal([
+        'dd-cyberia-development-green',
+        'dd-cyberia-mmo-server-development-green',
+        'dd-cyberia-mmo-server-forest-development-green',
+      ]);
+    });
+
+    // 5 — an instance id is only unique inside a deploy.
+    it('refuses --instance-id without --deploy-id', () => {
+      const result = plan({ instanceId: 'mmo-server' });
+      expect(result.error).to.match(/--instance-id requires --deploy-id/);
+      expect(result.deployments).to.deep.equal([]);
+    });
+
+    it('refuses a plan with nothing to act on', () => {
+      expect(plan({}).error).to.match(/nothing to stop/);
+    });
+
+    it('passes the instance host through for colour resolution', () => {
+      const asked = [];
+      plan({
+        deployId: 'dd-cyberia',
+        instanceId: 'mmo-client',
+        liveTrafficOf: (target) => {
+          asked.push([target.id, target.host, target.kind]);
+          return 'blue';
+        },
+      });
+      expect(asked).to.deep.equal([
+        ['dd-cyberia', '', 'pwa'],
+        ['dd-cyberia-mmo-client', 'client.fixture.test', 'instance'],
+      ]);
+    });
+  });
+
+  // One host's routing text is matched against several deployments and both
+  // environments, so the match has to be exact about which name it is reading.
+  describe('trafficFromRoutingInfoFactory', () => {
+    const INFO = [
+      'name: dd-cyberia-mmo-server-development-green-service',
+      'name: dd-cyberia-mmo-server-forest-development-blue-service',
+      'name: dd-cyberia-development-blue-service',
+    ].join('\n');
+
+    it('reads each deployment its own colour from a shared host', () => {
+      expect(trafficFromRoutingInfoFactory({ info: INFO, deployId: 'dd-cyberia', env: 'development' })).to.equal(
+        'blue',
+      );
+      expect(
+        trafficFromRoutingInfoFactory({ info: INFO, deployId: 'dd-cyberia-mmo-server', env: 'development' }),
+      ).to.equal('green');
+      expect(
+        trafficFromRoutingInfoFactory({ info: INFO, deployId: 'dd-cyberia-mmo-server-forest', env: 'development' }),
+      ).to.equal('blue');
+    });
+
+    it('reads the colour from the stable Service selector', () => {
+      expect(
+        trafficFromRoutingInfoFactory({
+          info: 'dd-cyberia-development-green',
+          deployId: 'dd-cyberia',
+          env: 'development',
+        }),
+      ).to.equal('green');
+    });
+
+    // The reported failure: a development cluster reported as entirely unrouted
+    // because every match was anchored on `-production-`.
+    it('finds nothing for an environment the routing does not mention', () => {
+      expect(trafficFromRoutingInfoFactory({ info: INFO, deployId: 'dd-cyberia', env: 'production' })).to.equal(null);
+    });
+
+    it('is null when there is no routing text', () => {
+      for (const info of ['', '   \n ', undefined])
+        expect(trafficFromRoutingInfoFactory({ info, deployId: 'dd-cyberia', env: 'development' })).to.equal(null);
+    });
+
+    it('does not let a regex metacharacter in the id match loosely', () => {
+      expect(
+        trafficFromRoutingInfoFactory({
+          info: 'name: dd-any-development-blue-service',
+          deployId: 'dd.any',
+          env: 'development',
+        }),
+      ).to.equal(null);
+    });
+
+    it('falls back to a whole-text match with no environment', () => {
+      expect(trafficFromRoutingInfoFactory({ info: 'routes to green here', deployId: 'dd-cyberia' })).to.equal('green');
+      expect(trafficFromRoutingInfoFactory({ info: 'nothing routed', deployId: 'dd-cyberia' })).to.equal(null);
+    });
+  });
+
+  // None of these three is readable from the route object alone, which is why
+  // the report correlates four kinds instead of reading one.
+  describe('hostIngressFactsFactory', () => {
+    const GATEWAYS = [
+      {
+        metadata: { name: 'dd-cyberia-development' },
+        spec: {
+          listeners: [
+            { name: 'http', protocol: 'HTTP' },
+            { name: 'https', protocol: 'HTTPS', tls: { certificateRefs: [{ name: 'underpost.net' }] } },
+          ],
+        },
+      },
+      { metadata: { name: 'dd-plain-development' }, spec: { listeners: [{ name: 'http', protocol: 'HTTP' }] } },
+    ];
+    const POLICIES = [
+      { spec: { targetRefs: [{ kind: 'Gateway', name: 'dd-cyberia-development', sectionName: 'https' }], http3: {} } },
+    ];
+
+    it('reads the kind, TLS and HTTP/3 for a Gateway API host', () => {
+      const facts = hostIngressFactsFactory({
+        httpRoutes: [{ spec: { hostnames: ['underpost.net'], parentRefs: [{ name: 'dd-cyberia-development' }] } }],
+        gateways: GATEWAYS,
+        clientTrafficPolicies: POLICIES,
+      });
+      expect(facts['underpost.net']).to.deep.equal({ route: 'HTTPRoute', tls: true, http3: true });
+    });
+
+    it('reads TLS from an HTTPProxy virtualhost, and never claims HTTP/3 for it', () => {
+      const facts = hostIngressFactsFactory({
+        httpProxies: [
+          { spec: { virtualhost: { fqdn: 'legacy.test', tls: { secretName: 'legacy' } } } },
+          { spec: { virtualhost: { fqdn: 'plain.test' } } },
+        ],
+      });
+      expect(facts['legacy.test']).to.deep.equal({ route: 'HTTPProxy', tls: true, http3: false });
+      expect(facts['plain.test']).to.deep.equal({ route: 'HTTPProxy', tls: false, http3: false });
+    });
+
+    it('reports no TLS for a Gateway with only a plain HTTP listener', () => {
+      const facts = hostIngressFactsFactory({
+        httpRoutes: [{ spec: { hostnames: ['plain.test'], parentRefs: [{ name: 'dd-plain-development' }] } }],
+        gateways: GATEWAYS,
+      });
+      expect(facts['plain.test']).to.deep.equal({ route: 'HTTPRoute', tls: false, http3: false });
+    });
+
+    // QUIC only exists where TLS does, so a policy on a plain listener describes
+    // nothing — the implementation rejects it too.
+    it('does not claim HTTP/3 from a policy targeting a Gateway with no TLS listener', () => {
+      const facts = hostIngressFactsFactory({
+        httpRoutes: [{ spec: { hostnames: ['plain.test'], parentRefs: [{ name: 'dd-plain-development' }] } }],
+        gateways: GATEWAYS,
+        clientTrafficPolicies: [{ spec: { targetRefs: [{ name: 'dd-plain-development' }], http3: {} } }],
+      });
+      expect(facts['plain.test'].http3).to.equal(false);
+    });
+
+    it('lets the HTTPRoute win a host described by both kinds', () => {
+      const facts = hostIngressFactsFactory({
+        httpRoutes: [{ spec: { hostnames: ['dual.test'], parentRefs: [{ name: 'dd-cyberia-development' }] } }],
+        httpProxies: [{ spec: { virtualhost: { fqdn: 'dual.test' } } }],
+        gateways: GATEWAYS,
+        clientTrafficPolicies: POLICIES,
+      });
+      expect(facts['dual.test']).to.deep.equal({ route: 'HTTPRoute', tls: true, http3: true });
+    });
+
+    it('yields nothing for missing CRDs or malformed items', () => {
+      expect(hostIngressFactsFactory()).to.deep.equal({});
+      expect(hostIngressFactsFactory({ httpProxies: [{ spec: {} }], httpRoutes: [{ spec: {} }] })).to.deep.equal({});
+    });
+  });
+
+  describe('trafficProbePathsFactory', () => {
+    it('probes only the canonical path when no replicas are declared', () => {
+      expect(trafficProbePathsFactory({}, '/wp')).to.deep.equal(['/wp']);
+      expect(trafficProbePathsFactory(undefined, '/wp')).to.deep.equal(['/wp']);
+    });
+
+    // '/' in engine-private/conf/dd-test/conf.server.json: replicas without
+    // singleReplica, so the canonical path is still actually served.
+    it('probes the canonical path plus every replica when singleReplica is not set', () => {
+      expect(trafficProbePathsFactory({ replicas: ['/r1'] }, '/')).to.deep.equal(['/', '/r1']);
+    });
+
+    // '/single-replica' in the same fixture: singleReplica means the canonical
+    // path is never itself served, only its replicas are.
+    it('probes only the replicas, dropping the canonical path, when singleReplica is set', () => {
+      expect(trafficProbePathsFactory({ replicas: ['/r2'], singleReplica: true }, '/single-replica')).to.deep.equal([
+        '/r2',
+      ]);
+    });
+
+    it('treats a non-array replicas value as no replicas', () => {
+      expect(trafficProbePathsFactory({ replicas: 'not-an-array' }, '/wp')).to.deep.equal(['/wp']);
+    });
+  });
+
+  describe('trafficTableRowsFactory', () => {
+    const ENTRIES = [
+      { kind: 'pwa', deployId: 'dd-a', id: 'dd-a', host: 'a.test', path: '/', deployment: 'dd-a-development' },
+      {
+        kind: 'instance',
+        deployId: 'dd-a',
+        id: 'dd-a-mmo-server',
+        host: 'server.test',
+        path: '/',
+        deployment: 'dd-a-mmo-server-development',
+      },
+    ];
+
+    it('reports both deployment kinds with their live colour', () => {
+      const rows = trafficTableRowsFactory({
+        entries: ENTRIES,
+        liveTrafficOf: (entry) => (entry.kind === 'pwa' ? 'blue' : 'green'),
+        servesTraffic: () => true,
+      });
+      expect(rows.map((row) => [row.kind, row.traffic, row.serving])).to.deep.equal([
+        ['pwa', 'blue', true],
+        ['instance', 'green', true],
+      ]);
+    });
+
+    it('narrows to the requested hosts', () => {
+      const rows = trafficTableRowsFactory({ entries: ENTRIES, hosts: ['server.test'], liveTrafficOf: () => 'blue' });
+      expect(rows.map((row) => row.host)).to.deep.equal(['server.test']);
+    });
+
+    it('reports every host when none are requested', () => {
+      for (const hosts of [[], ['']])
+        expect(trafficTableRowsFactory({ entries: ENTRIES, hosts, liveTrafficOf: () => 'blue' })).to.have.lengthOf(2);
+    });
+
+    // A deployment with no published route is a real state to report, not a row
+    // to hide: it is exactly what a half-finished promote looks like.
+    it('keeps an entry whose colour cannot be read', () => {
+      const rows = trafficTableRowsFactory({ entries: ENTRIES, liveTrafficOf: () => null, servesTraffic: () => true });
+      expect(rows.map((row) => [row.traffic, row.serving])).to.deep.equal([
+        ['', false],
+        ['', false],
+      ]);
+    });
+
+    it('keeps configured report rows when no Kubernetes deployments exist', () => {
+      const runSource = fs.readFileSync(new URL('../src/cli/run.js', import.meta.url), 'utf8');
+      const start = runSource.indexOf("    'get-traffic': async");
+      const end = runSource.indexOf("    'instance-promote': async", start);
+      const getTraffic = runSource.slice(start, end);
+      expect(getTraffic).to.include('.map((entry) => ({ ...entry, env }))');
+      expect(getTraffic).not.to.include('.filter((entry) => deployedNames.some');
+    });
+
+    it('reports a routed colour with no ready endpoint as not serving', () => {
+      const rows = trafficTableRowsFactory({
+        entries: [ENTRIES[0]],
+        liveTrafficOf: () => 'blue',
+        servesTraffic: () => false,
+      });
+      expect(rows[0]).to.include({ traffic: 'blue', serving: false });
+    });
+
+    it('is empty with no entries', () => {
+      expect(trafficTableRowsFactory({})).to.deep.equal([]);
+    });
+
+    it('feeds the report from stable Service selectors before legacy route text', () => {
+      const runSource = fs.readFileSync(new URL('../src/cli/run.js', import.meta.url), 'utf8');
+      const start = runSource.indexOf("    'get-traffic': async");
+      const end = runSource.indexOf("    'instance-promote': async", start);
+      const getTraffic = runSource.slice(start, end);
+      const listServices = getTraffic.indexOf("listResources('service')");
+      const stableSelector = getTraffic.indexOf('const stableTraffic = trafficFromRoutingInfoFactory');
+      const legacyRoute = getTraffic.indexOf('const legacyTraffic = trafficFromRoutingInfoFactory');
+      expect(listServices).to.be.greaterThan(-1);
+      expect(stableSelector).to.be.greaterThan(listServices);
+      expect(legacyRoute).to.be.greaterThan(stableSelector);
+    });
+
+    it('uses real followed curl probes and reports current and opposite deployment status without ENV', () => {
+      const runSource = fs.readFileSync(new URL('../src/cli/run.js', import.meta.url), 'utf8');
+      const start = runSource.indexOf("    'get-traffic': async");
+      const end = runSource.indexOf("    'instance-promote': async", start);
+      const getTraffic = runSource.slice(start, end);
+      expect(getTraffic).to.include('curl -L -v -i -s');
+      expect(getTraffic).to.include("'OPPOSITE'");
+      expect(getTraffic).not.to.include('showOpposite');
+      expect(getTraffic).to.include("'CURRENT'");
+      expect(getTraffic).not.to.include("'ENV',");
+      expect(getTraffic).to.include('opposite,');
+      expect(getTraffic).to.include("status.exists ? (status.ready ? 'ready' : 'not-ready') : 'missing'");
+      expect(getTraffic).to.include("status.serving ? 'serving' : 'not-serving'");
+      expect(getTraffic).to.include("`${probe.path} [${probe.statuses.join('→')}]`");
+    });
+
+    it('caches stable Service readiness across hosts sharing the same deployment', () => {
+      const runSource = fs.readFileSync(new URL('../src/cli/run.js', import.meta.url), 'utf8');
+      const start = runSource.indexOf("    'get-traffic': async");
+      const end = runSource.indexOf("    'instance-promote': async", start);
+      const getTraffic = runSource.slice(start, end);
+      expect(getTraffic).to.include('const servingState = {}');
+      expect(getTraffic).to.include('if (servingState[key] === undefined)');
+    });
+  });
+});