feat: merge from source - #277
Closed
henryjarend wants to merge 24 commits into
Closed
Conversation
mise.toml pins CLI tool versions; CLAUDE.md gives Claude Code guidance for working in this repo.
Introduces a new TypesenseApiKey CRD (group ts.opentelekomcloud.com) that manages the full lifecycle of a Typesense API key against a referenced TypesenseCluster, including a cluster in a different namespace via an optional clusterRef.namespace: - create the remote key via the Typesense keys API and mirror its value into a Secret - rotate the key (delete + recreate) whenever the CR's spec changes - periodically detect and heal drift if the remote key is deleted or edited out-of-band - delete the remote key on CR deletion, guarded by a finalizer Wires TypesenseApiKeyReconciler into cmd/main.go and regenerates the CRD manifest, RBAC role, kustomization, and deepcopy code.
condition.Reason != A || condition.Reason != B is a tautology, so the guard never actually skipped SpecReplicasChanged/emergency updates while quorum was downgraded or had queued writes. Change to && to match the intended "skip only when neither reason applies" behavior. Also fills in the scaffolded TypesenseCluster controller test, which never set spec.image/spec.storage (now required) or wired a DiscoveryClient, so it failed validation/panicked before ever exercising the reconcile loop.
Covers create, spec-change rotation, drift detection (remote key deleted or edited out-of-band), and creating a key for a TypesenseCluster in a different namespace. Uses an in-memory fake of the Typesense /keys REST API plus a redirecting http.RoundTripper, since buildKeysUrl always targets a k8s in-cluster Service DNS name that doesn't resolve under envtest.
…lint Migrates the default image registry from quay.io/akyriako to ghcr.io/interworks in the Makefile, and pins golangci-lint 2.13.1 via mise, updating .golangci.yml to the v2 config schema it requires. Also fixes two Makefile e2e defaults left over from the memcached kubebuilder scaffold: KIND_CLUSTER now defaults to typesense-operator-test-e2e instead of memcached-operator-test-e2e, and bundle-build uses $(CONTAINER_TOOL) instead of a hardcoded docker. Wraps the response body Close() in doKeysRequest to satisfy errcheck under the updated lint config.
The TypesenseApiKey CRD/RBAC (feat: add TypesenseApiKey CRD and reconciler) was never propagated into the Helm chart. Re-running `make helmify` against the current kustomize output adds the typesenseapikey-crd.yaml template and the typesenseapikeys RBAC rules, and picks up the ghcr.io/interworks registry rename plus newer helmify's serviceAccountName/nodeSelector/tolerations/ topologySpreadConstraints conventions.
Typesense defaults TYPESENSE_THREAD_POOL_SIZE to NUM_CORES * 8. On dev machines/CI runners with many cores but tightly resource-limited containers (e.g. a kind node under a nested VM), this can request more threads than the container can actually create, crashing with "terminate called after throwing std::system_error: Resource temporarily unavailable" right at startup. Caps it to 32 via the existing additionalServerConfiguration ConfigMap mechanism, the same pattern already used by ts_v1alpha1_typesensecluster_kind.yaml for other env overrides.
…y lifecycle The existing e2e suite only checked that the controller-manager pod came up; it never exercised a real TypesenseCluster reaching Raft quorum or a TypesenseApiKey being reconciled against a live Typesense process. Adds a new "APIKey lifecycle" context that applies the cluster-1 and search-only-key samples, waits for both CRs' Ready condition (the cluster's Ready only flips once ReconcileQuorum reports quorum healthy), then proves the issued key actually works: a scoped search against a nonexistent collection must 404 (authenticated, not rejected), and a collection-create request with the same key must 401 (proves the documents:search-only scope is enforced by Typesense, not just recorded in status). Verification runs in throwaway curlimages/curl pods read back via `kubectl logs` after waiting for Succeeded, rather than `kubectl run --rm -i` attach output, which races short-lived commands and can silently return kubectl's own status text instead of the container's stdout. Also registers the search-only-key sample in config/samples/kustomization.yaml.
README gets a user-facing "Issuing Scoped API Keys" section (example CR, generated Secret naming, rotation/drift behavior) matching the existing TypesenseCluster examples' style. CLAUDE.md's Architecture section only described TypesenseClusterReconciler; adds a matching section for TypesenseApiKeyReconciler (create/rotate/drift-check/ delete against the Typesense /keys API) so future sessions have the same grounding for the second controller that they do for the first.
New backwards-compatible functionality (the TypesenseApiKey CRD) warrants a MINOR version bump per semver. Updates Chart.yaml (version + appVersion), Makefile's IMG_TAG, and the matching image tags in values.yaml and config/manager/kustomization.yaml so the default image reference stays consistent everywhere.
Both were workflow_dispatch-only, so nothing ran automatically against pushes or pull requests. Adds push (main) and pull_request triggers to lint.yml and test.yml, keeping workflow_dispatch for manual runs. test-e2e.yml and releases.yaml are left manual for now.
chore: Configure Renovate
Surfaced by finally running the lint workflow in CI (it was previously workflow_dispatch-only and had never actually run against this code).
feat: add TypesenseApiKey CRD for declarative Typesense API key management
Fixes all findings from issue #5 (42 originally reported, plus additional ones surfaced by the golangci-lint 2.13.1 pinned in mise.toml): gocyclo refactors of the four over-complexity reconcile functions, unused declarations, goconst duplication, staticcheck/revive/misspell/nakedret/ errcheck/unparam/prealloc/unconvert cleanups, and dot-import removal in test/utils. No behavior change; verified with make test and make test-e2e.
fix: clean up pre-existing golangci-lint findings
chore(deps): update dependency kubectl to v1.36.4
* injecting version, commit hash, build date to the binaries akyriako#215 * added ldflags in makefile and tests akyriako#215
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merges in changes from source