feat: reworked zone structure; added consumer-failover tokenUrl - #555
Open
ron96g wants to merge 8 commits into
Open
feat: reworked zone structure; added consumer-failover tokenUrl#555ron96g wants to merge 8 commits into
ron96g wants to merge 8 commits into
Conversation
ron96g
added
controlplane-api
ron96g
force-pushed
the
refactor/zone-presets
branch
from
August 13, 2026 11:49
914ac56 to
536f951
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the platform’s Zone model from single gateway/IDP + “links” to a multi-gateway / multi-identity-provider structure with presets, and propagates a preset-derived Token URL through applications and APIs (including consumer-failover selection). It also introduces latched Zone readiness semantics with sub-resource readiness observation and documentation updates.
Changes:
- Rework Zone consumption across components to use
ZoneSpec.{Presets,Gateways,IdentityProviders}andZoneStatus.Presets[*]instead ofStatus.Links/Status.Gateway. - Add
Application.status.tokenUrland persist/exposetoken_urlthrough projector, repositories, and GraphQL/Ent schema. - Add zone provisioning/readiness behavior (sub-resource barrier + warning events) and document the new semantics.
Reviewed changes
Copilot reviewed 108 out of 110 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| rover/internal/webhook/v1/webhook_suite_test.go | Update webhook test Zone fixture to new Gateways/Presets/IdentityProviders layout. |
| rover/internal/webhook/v1/rover_webhook.go | Switch ConsumerFailover gating to zone.Spec.FeaturesSupported. |
| rover-server/test/mocks/data/zone.json | Update rover-server mock Zone JSON to spec.presets and status.presets[*].links. |
| rover-server/internal/mapper/applicationinfo/out.go | Resolve issuers/URLs via default preset + preset status; update failover preset selection. |
| rover-server/internal/mapper/applicationinfo/out_test.go | Adjust mapper tests for preset-based Zone spec/status. |
| projector/internal/domain/zone/zone_integration_test.go | Update integration tests to preset-based Zone spec. |
| projector/internal/domain/zone/translator.go | Translate gateway/issuer from default preset and matching preset status. |
| projector/internal/domain/zone/translator_test.go | Update translator tests for preset-based Zone spec/status. |
| projector/internal/domain/application/types.go | Add TokenURL to application projection model. |
| projector/internal/domain/application/translator.go | Populate TokenURL from Application.Status.TokenUrl. |
| projector/internal/domain/application/translator_test.go | Add tests for TokenURL translation behavior. |
| projector/internal/domain/application/repository.go | Persist/clear TokenURL on upsert. |
| projector/internal/domain/application/repository_test.go | Add create/update/clear TokenURL repository tests. |
| permission/internal/controller/permissionset_controller_test.go | Update controller test Zone fixture to presets + preset status links. |
| organization/internal/webhook/v1/team_webhook_test.go | Update webhook test fixtures to new Zone spec/status structure. |
| organization/internal/webhook/v1/mutator/mutate.go | Generate team token using default preset status links (Url/TeamIssuer). |
| organization/internal/webhook/v1/mutator/mutate_test.go | Update mutator tests for preset-based Zone spec/status. |
| organization/internal/team_webhook_reconciler_test.go | Update fixtures and add retry-on-update to reduce flakiness. |
| organization/internal/handler/team/handler/gateway_consumer/gateway_consumer.go | Resolve gateway ref via default preset status. |
| organization/internal/controller/team_controller_test.go | Update controller tests for preset-based Zone spec/status. |
| organization-server/internal/graphql/generated.go | Generated GraphQL where-input additions for tokenURL predicates. |
| event/internal/handler/util/voyager_route.go | Resolve GatewayRef via default preset status helper. |
| event/internal/handler/util/sse_route.go | Resolve GatewayRef via default preset status helper. |
| event/internal/handler/util/shared_route.go | Refactor preset resolution to adminv1.Preset and add gatewayRef helper. |
| event/internal/handler/util/publish_route.go | Resolve GatewayRef via default preset status helper; update preset accessors. |
| event/internal/handler/util/publish_route_test.go | Update tests to use Spec.Presets instead of Spec.Gateway.Presets. |
| event/internal/handler/util/getters.go | Add DefaultPresetStatus(zone) helper for consistent preset status lookup. |
| event/internal/handler/util/callback_route.go | Resolve GatewayRef via default preset status helper. |
| event/internal/handler/util/callback_route_test.go | Update Zone fixtures + add nil-gatewayref case. |
| event/internal/handler/eventexposure/handler.go | Switch issuer collection to preset status; make trusted-issuer collection return errors. |
| event/internal/handler/eventexposure/handler_test.go | Update fixtures to preset status links/gateway refs. |
| event/internal/handler/eventexposure/collect_issuers_test.go | Convert to Ginkgo/Gomega; add tests for preset-status matching + missing status error. |
| event/internal/handler/eventconfig/handler.go | Switch issuer collection to preset status; propagate errors from trusted-issuer collection. |
| event/internal/handler/eventconfig/handler_test.go | Update fixtures to include preset statuses and gateways. |
| event/internal/handler/eventconfig/collect_issuers_test.go | Convert to Ginkgo/Gomega; add tests for preset-status matching + missing status error. |
| docs/docs/architecture/admin.mdx | Document latched Zone readiness + provisioning order. |
| docs/docs/admin-journey/environments-and-zones.md | Add operational guidance for readiness latch + warning events. |
| discovery-server/test/mocks/data/zone.json | Update discovery mock Zone JSON to include spec.presets. |
| discovery-server/internal/mapper/apisubscription/out.go | Build gateway base URL from presets (incl. failover preset selection). |
| discovery-server/internal/mapper/apisubscription/out_test.go | Update tests to set Spec.Presets for gateway URL mapping. |
| controlplane-api/internal/resolvers/root_.generated.go | Generated GraphQL schema additions for Application.tokenURL. |
| controlplane-api/ent/schema/application.go | Add token_url field to Application ent schema. |
| controlplane-api/ent/runtime/runtime.go | Wire TokenURL validator and shift field indices accordingly. |
| controlplane-api/ent/mutation.go | Generated mutation support for token_url. |
| controlplane-api/ent/migrate/schema.go | Add token_url column and adjust FK/index column offsets. |
| controlplane-api/ent/gql_where_input.go | Add where-input predicates for tokenURL. |
| controlplane-api/ent/gql_collection.go | Ensure tokenURL is selectable via GraphQL field collection. |
| controlplane-api/ent/application/where.go | Generated predicates for token_url. |
| controlplane-api/ent/application/application.go | Add constants/ordering/validators for token_url. |
| controlplane-api/ent/application.go | Add scanning/assignment/string formatting for token_url. |
| controlplane-api/ent/application_update.go | Generated update support for token_url. |
| controlplane-api/ent/application_create.go | Generated create/upsert support for token_url. |
| controlplane-api/ent.graphql | Add tokenURL field and where predicates to the schema. |
| common/pkg/client/client.go | Add CollectSubResources feature + helpers to list/not-ready subresources. |
| common/pkg/client/client_test.go | Add tests for sub-resource collection, reset behavior, and NotReadyObjects. |
| application/internal/handler/application/notification.go | Resolve identity provider via spec helper before reading secret-rotation config. |
| application/internal/handler/application/notification_test.go | Update notification tests for Spec.IdentityProviders. |
| application/internal/handler/application/handler.go | Publish preset-derived tokenUrl onto Application status; update gateway ref resolution. |
| application/internal/handler/application/handler_test.go | Add tests for tokenUrl publishing + blocked error cases. |
| application/config/crd/bases/application.cp.ei.telekom.de_applications.yaml | Add status.tokenUrl schema. |
| application/api/v1/application_types.go | Add TokenUrl to ApplicationStatus. |
| api/internal/handler/util/route_util.go | Resolve gateway refs and issuers via preset status; update URL accessor names. |
| api/internal/handler/util/getters.go | Update preset getters to return *adminapi.Preset; update feature checks. |
| api/internal/handler/util_proxy_route_test.go | Update test Zone fixture to new Gateways/Presets/IdentityProviders + preset status links. |
| api/internal/handler/remoteapisubscription/consumer_scenario.go | Resolve GatewayRef via preset status. |
| api/internal/handler/apisubscription/handler.go | Use preset status for issuer + use preset URL for gateway URL. |
| api/internal/handler/apiexposure/types.go | Comment formatting updates (pipeline section). |
| api/internal/handler/apiexposure/handler.go | Use preset status for LMS/IDP issuers and consumer-failover enrichment. |
| api/internal/handler/apiexposure/handler_test.go | Update Zone fixtures to preset + preset status links; update expected hostnames. |
| api/internal/controller/suite_test.go | Ensure manager goroutine closes channel and is awaited in AfterSuite. |
| api/internal/controller/remoteapisubscription_controller_test.go | Update preset URL mutation in test setup. |
| api/internal/controller/apiexposure_controller_test.go | Update controller tests for new Zone spec/status layout and hostname expectations. |
| agentic/internal/handler/util/route.go | Resolve AI gateway via preset selection + preset status gateway ref; issuer via preset status. |
| agentic/internal/handler/agenticsubscription/handler.go | Switch feature check to Spec.FeaturesSupported. |
| agentic/internal/handler/agenticsubscription/handler_test.go | Update AI-gateway zone fixtures to presets + preset status. |
| agentic/internal/handler/agenticexposure/handler.go | Switch feature checks and issuer resolution to preset status; add gocyclo nolint note. |
| agentic/internal/handler/agenticexposure/handler_test.go | Update fixtures to preset status links for issuer/LMS issuer. |
| admin/internal/handler/zone/suite_test.go | Update zone fixtures for new spec; add recorder; add helper to mark subresources ready. |
| admin/internal/handler/zone/routes.go | Use hc.DefaultPreset and gateway map; add domain label; issuer derived from IDP hostname. |
| admin/internal/handler/zone/oidc.go | Add OIDC discovery + strict token endpoint validation. |
| admin/internal/handler/zone/links.go | Replace populateLinks with per-preset status population + tokenUrl resolution/discovery. |
| admin/internal/handler/zone/identity.go | Resolve IDP via spec; add issuerHostname helper; gateway admin client creation per gateway. |
| admin/internal/handler/zone/identity_routes.go | Use preset-based gateway resolution + domain label. |
| admin/internal/handler/zone/handlingContext.go | Add HTTP client and maps; resolve default preset via Spec.GetDefaultPreset. |
| admin/internal/handler/zone/handler.go | Add readiness barrier step, subresource event reporting, and latched ready semantics. |
| admin/internal/handler/zone/gateway.go | Reconcile multiple gateways; create admin clients/consumers per gateway; add domain labels. |
| admin/internal/handler/util/naming/naming.go | Include zone+component names and normalize values for multi-gateway/IDP naming. |
| admin/internal/controller/zone_controller.go | Watch labeled sub-resources and map them back to zones; add domain predicate. |
| admin/internal/controller/suite_test.go | Add readyReconcilers to simulate identity operator readiness in envtest. |
| admin/go.mod | Add k8s.io/utils dependency. |
| admin/config/webhook/manifests.yaml | Register validating webhook for Zones. |
| admin/config/samples/admin_v1_zone.yaml | Update sample Zone YAML to new structure (features, gateways, presets, IDPs). |
| admin/cmd/main.go | Configure cache selectors to only watch admin-domain labeled sub-resources. |
| admin/api/v1/zone_types_test.go | Add tests for preset selection, feature support, and status getters. |
| admin/api/Makefile | Add module-local fmt/vet/test targets (Ginkgo). |
| admin/api/go.sum | Update sums for new test/build dependencies. |
| admin/api/go.mod | Add Ginkgo/Gomega and indirect test tool dependencies. |
Files not reviewed (1)
- admin/api/v1/zz_generated.deepcopy.go: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
178
to
+196
| // joinURL concatenates a base URL and a path, ensuring exactly one "/" between them. | ||
| // TODO: use url.JoinPath(base, path) | ||
| func joinURL(base, path string) string { | ||
| return strings.TrimRight(base, "/") + "/" + strings.TrimLeft(path, "/") | ||
| } | ||
|
|
||
| // gatewayBaseUrl returns the appropriate gateway base URL for a zone. | ||
| // When failover is enabled, it selects the ConsumerFailover preset URL; | ||
| // otherwise it falls back to the default URL from Status.Links. | ||
| func gatewayBaseUrl(zone *adminv1.Zone, failover bool) string { | ||
| var preset *adminv1.Preset | ||
| var err error | ||
| if failover { | ||
| preset, err := zone.SelectGatewayPreset(adminv1.FeatureConsumerFailover) | ||
| if err == nil { | ||
| return preset.GetDefaultUrl() | ||
| } | ||
| preset, err = zone.Spec.SelectPreset(adminv1.FeatureConsumerFailover) | ||
| } else { | ||
| preset, err = zone.Spec.GetDefaultPreset() | ||
| } | ||
| if err != nil { | ||
| return "" | ||
| } | ||
| return zone.Status.Links.Url | ||
| return preset.GetDefaultURL() |
Comment on lines
+132
to
135
| clientSecret := gatewayConfig.Admin.ClientSecret | ||
| if clientSecret == nil { | ||
| return ctrlerrors.BlockedErrorf("gateway admin client secret must be provided for zone %q", hc.Zone.Name) | ||
| return nil, ctrlerrors.BlockedErrorf("gateway %q admin client secret must be provided for zone %q", gatewayConfig.Name, hc.Zone.Name) | ||
| } |
Comment on lines
+39
to
43
| presetStatus, err := zoneObj.Status.GetPreset(preset.Name) | ||
| if err != nil || presetStatus.GatewayRef == nil { | ||
| // this should not happen if the cluster is properly configured | ||
| return ctrlerrors.BlockedErrorf("no gateway reference found in zone object") | ||
| } |
ron96g
requested review from
BjoernKarma,
iagarba,
julius-malcovsky and
stefan-ctrl
August 14, 2026 10:32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.