xianyun_deploy/

mirrord.rs

//! Generates mirrord configuration files from a reloader config.
//!
//! Ported from `internal/mirrord/config.go`.

use std::io::Write;
use std::os::unix::fs::OpenOptionsExt;

use serde::{Deserialize, Serialize};
use thiserror::Error;

use xianyun_core::config::latest::ReloaderConfig;

/// Errors from generating a mirrord configuration.
#[derive(Debug, Error)]
pub enum MirrordError {
    /// The reloader type is not `"mirror"`.
    #[error("reloader type is not 'mirror'")]
    NotMirrorReloader,
    /// The mirror configuration is missing.
    #[error("mirror configuration is missing")]
    MissingMirrorConfig,
    /// The target configuration is missing.
    #[error("target configuration is missing")]
    MissingTargetConfig,
    /// Failed opening the mirrord config file.
    #[error("opening mirrord config file {0}: {1}")]
    OpenFile(String, std::io::Error),
    /// Failed marshalling the mirrord config to JSON.
    #[error("marshaling mirrord config: {0}")]
    Marshal(#[from] serde_json::Error),
    /// Failed writing the mirrord config file.
    #[error("writing mirrord config file {0}: {1}")]
    WriteFile(String, std::io::Error),
}

/// The complete mirrord configuration structure.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Config {
    pub target: TargetConfig,
    pub feature: FeatureConfig,
    pub agent: AgentConfig,
}

/// The target Kubernetes resource for mirrord.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct TargetConfig {
    pub path: String,
    pub namespace: String,
}

/// The features to enable in mirrord.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct FeatureConfig {
    pub network: NetworkConfig,
    pub fs: FsConfig,
    pub env: EnvConfig,
}

/// Outgoing network interception configuration.
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
pub struct OutgoingConfig {
    #[serde(skip_serializing_if = "std::ops::Not::not", default)]
    pub ignore_localhost: bool,
}

/// How mirrord intercepts incoming traffic.
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
pub struct IncomingConfig {
    #[serde(skip_serializing_if = "String::is_empty", default)]
    pub mode: String,
}

/// Network interception configuration.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct NetworkConfig {
    pub incoming: IncomingConfig,
    pub outgoing: OutgoingConfig,
}

/// Filesystem mount configuration.
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
pub struct FsConfig {
    pub mode: String,
    #[serde(skip_serializing_if = "Vec::is_empty", default)]
    pub read_write: Vec<String>,
    #[serde(skip_serializing_if = "Vec::is_empty", default)]
    pub read_only: Vec<String>,
    #[serde(skip_serializing_if = "Option::is_none", default)]
    pub mapping: Option<std::collections::HashMap<String, String>>,
}

/// Excludes environment variables from being inherited from the remote
/// pod. See <https://metalbear.com/mirrord/docs/config/options#feature-env-exclude>.
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
pub struct EnvConfig {
    #[serde(skip_serializing_if = "Vec::is_empty", default)]
    pub exclude: Vec<String>,
}

/// The mirrord agent configuration.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AgentConfig {
    pub namespace: String,
}

/// Creates a mirrord configuration from a reloader config and writes it
/// to the specified file. The caller is responsible for cleaning up the
/// generated file.
pub fn generate_config(
    reloader_config: &ReloaderConfig,
    filename: &str,
) -> Result<(), MirrordError> {
    if reloader_config.reloader_type != "mirror" {
        return Err(MirrordError::NotMirrorReloader);
    }

    let mirror = reloader_config
        .mirror
        .as_ref()
        .ok_or(MirrordError::MissingMirrorConfig)?;

    let target = mirror
        .target
        .as_ref()
        .ok_or(MirrordError::MissingTargetConfig)?;

    // Build target path: {type}/{name} or {type}/{name}/container/{container}
    let mut target_path = format!("{}/{}", target.kubernetes_type, target.name);
    if !target.container.is_empty() {
        target_path = format!("{target_path}/container/{}", target.container);
    }

    // Build outgoing network configuration.
    let mut outgoing = OutgoingConfig::default();
    let mut incoming_mode = "steal".to_string();

    if let Some(network) = &mirror.network {
        if let Some(out) = &network.outgoing {
            outgoing.ignore_localhost = out.ignore_localhost;
        }

        if let Some(inc) = &network.incoming
            && !inc.mode.is_empty()
        {
            incoming_mode = inc.mode.clone();
        }
    }

    // Build filesystem configuration.
    let mut fs_mode = "write".to_string();
    if let Some(filesystem) = &mirror.filesystem
        && !filesystem.mode.is_empty()
    {
        fs_mode = filesystem.mode.clone();
    }

    let mut cfg = Config {
        target: TargetConfig {
            path: target_path,
            namespace: target.namespace.clone(),
        },
        feature: FeatureConfig {
            network: NetworkConfig {
                incoming: IncomingConfig {
                    mode: incoming_mode,
                },
                outgoing,
            },
            fs: FsConfig {
                mode: fs_mode,
                ..Default::default()
            },
            env: EnvConfig {
                // GODEBUG is not guaranteed to be back- or
                // forwards-compatible.
                exclude: vec!["GODEBUG".to_string()],
            },
        },
        agent: AgentConfig {
            namespace: target.namespace.clone(),
        },
    };

    if let Some(filesystem) = &mirror.filesystem {
        cfg.feature.fs.read_write = filesystem.read_write.clone();
        cfg.feature.fs.read_only = filesystem.read_only.clone();
        cfg.feature.fs.mapping = filesystem
            .mapping
            .as_ref()
            .map(|m| m.iter().map(|(k, v)| (k.clone(), v.clone())).collect());
    }

    write_json_config(&cfg, filename)
}

/// Writes `cfg` to `filename` as indented JSON. Unlike Go's
/// `encoding/json`, `serde_json` never HTML-escapes `<`, `>`, or `&`, so
/// regex special characters in mapping patterns are always written
/// literally without any extra configuration.
fn write_json_config(cfg: &Config, filename: &str) -> Result<(), MirrordError> {
    let mut file = std::fs::OpenOptions::new()
        .write(true)
        .create(true)
        .truncate(true)
        .mode(0o600)
        .open(filename)
        .map_err(|e| MirrordError::OpenFile(filename.to_string(), e))?;

    let body = serde_json::to_vec_pretty(cfg)?;

    file.write_all(&body)
        .and_then(|()| file.write_all(b"\n"))
        .map_err(|e| MirrordError::WriteFile(filename.to_string(), e))
}

#[cfg(test)]
mod tests {
    use super::*;
    use xianyun_core::config::latest::{
        FilesystemConfig, MirrorConfig, MirrorIncomingConfig, MirrorNetworkConfig,
        MirrorOutgoingConfig, MirrorTargetConfig,
    };
    use xianyun_core::orderedmap::OrderedMap;

    fn read_config(path: &std::path::Path) -> serde_json::Value {
        let data = std::fs::read_to_string(path).unwrap();
        serde_json::from_str(&data).unwrap()
    }

    // Ported from internal/mirrord/config_test.go:16 (TestGenerateConfig_Success)
    #[test]
    fn test_generate_config_success() {
        let tmp_dir = tempfile::tempdir().unwrap();
        let config_file = tmp_dir.path().join("mirrord-config.json");

        let reloader_config = ReloaderConfig {
            reloader_type: "mirror".to_string(),
            mirror: Some(MirrorConfig {
                target: Some(MirrorTargetConfig {
                    namespace: "gitlab".to_string(),
                    kubernetes_type: "pod".to_string(),
                    name: "gitlab-gitaly-0".to_string(),
                    ..Default::default()
                }),
                filesystem: Some(FilesystemConfig {
                    read_write: vec!["^/home/git/repositories".to_string()],
                    read_only: vec![
                        "^/etc/gitaly".to_string(),
                        "^/srv/gitlab-shell".to_string(),
                        "^/etc/gitlab-secrets".to_string(),
                    ],
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        generate_config(&reloader_config, config_file.to_str().unwrap()).unwrap();
        assert!(config_file.exists());

        let cfg = read_config(&config_file);
        assert_eq!(cfg["target"]["path"], "pod/gitlab-gitaly-0");
        assert_eq!(cfg["target"]["namespace"], "gitlab");
        assert_eq!(cfg["feature"]["network"]["incoming"]["mode"], "steal");
        assert_eq!(
            cfg["feature"]["network"]["outgoing"]["ignore_localhost"],
            serde_json::Value::Null
        );
        assert_eq!(cfg["feature"]["fs"]["mode"], "write");
        assert_eq!(
            cfg["feature"]["fs"]["read_write"],
            serde_json::json!(["^/home/git/repositories"])
        );
        assert_eq!(
            cfg["feature"]["fs"]["read_only"],
            serde_json::json!(["^/etc/gitaly", "^/srv/gitlab-shell", "^/etc/gitlab-secrets"])
        );
        assert_eq!(cfg["agent"]["namespace"], "gitlab");
    }

    // Ported from internal/mirrord/config_test.go:75 (TestGenerateConfig_WithoutFilesystem)
    #[test]
    fn test_generate_config_without_filesystem() {
        let tmp_dir = tempfile::tempdir().unwrap();
        let config_file = tmp_dir.path().join("mirrord-config.json");

        let reloader_config = ReloaderConfig {
            reloader_type: "mirror".to_string(),
            mirror: Some(MirrorConfig {
                target: Some(MirrorTargetConfig {
                    namespace: "gitlab".to_string(),
                    kubernetes_type: "deployment".to_string(),
                    name: "gitlab-webservice-default-0".to_string(),
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        generate_config(&reloader_config, config_file.to_str().unwrap()).unwrap();

        let cfg = read_config(&config_file);
        assert_eq!(
            cfg["target"]["path"],
            "deployment/gitlab-webservice-default-0"
        );
        assert_eq!(cfg["target"]["namespace"], "gitlab");
        assert_eq!(cfg["feature"]["fs"]["mode"], "write");
        assert!(cfg["feature"]["fs"].get("read_write").is_none());
        assert!(cfg["feature"]["fs"].get("read_only").is_none());
    }

    // Ported from internal/mirrord/config_test.go:114 (TestGenerateConfig_DifferentResourceTypes)
    #[test]
    fn test_generate_config_different_resource_types() {
        let cases = [
            ("pod", "gitlab-gitaly-0", "pod/gitlab-gitaly-0"),
            (
                "deployment",
                "gitlab-webservice",
                "deployment/gitlab-webservice",
            ),
            ("statefulset", "gitlab-gitaly", "statefulset/gitlab-gitaly"),
            ("daemonset", "gitlab-runner", "daemonset/gitlab-runner"),
        ];

        for (kubernetes_type, resource_name, expected_path) in cases {
            let tmp_dir = tempfile::tempdir().unwrap();
            let config_file = tmp_dir.path().join("mirrord-config.json");

            let reloader_config = ReloaderConfig {
                reloader_type: "mirror".to_string(),
                mirror: Some(MirrorConfig {
                    target: Some(MirrorTargetConfig {
                        namespace: "gitlab".to_string(),
                        kubernetes_type: kubernetes_type.to_string(),
                        name: resource_name.to_string(),
                        ..Default::default()
                    }),
                    ..Default::default()
                }),
                ..Default::default()
            };

            generate_config(&reloader_config, config_file.to_str().unwrap()).unwrap();

            let cfg = read_config(&config_file);
            assert_eq!(
                cfg["target"]["path"], expected_path,
                "type={kubernetes_type}"
            );
        }
    }

    // Ported from internal/mirrord/config_test.go:163 (TestGenerateConfig_TargetContainer)
    #[test]
    fn test_generate_config_target_container() {
        let cases = [
            (
                "webservice",
                "deployment/gitlab-webservice/container/webservice",
            ),
            ("", "deployment/gitlab-webservice"),
        ];

        for (container, expected_path) in cases {
            let tmp_dir = tempfile::tempdir().unwrap();
            let config_file = tmp_dir.path().join("mirrord-config.json");

            let reloader_config = ReloaderConfig {
                reloader_type: "mirror".to_string(),
                mirror: Some(MirrorConfig {
                    target: Some(MirrorTargetConfig {
                        namespace: "gitlab".to_string(),
                        kubernetes_type: "deployment".to_string(),
                        name: "gitlab-webservice".to_string(),
                        container: container.to_string(),
                    }),
                    ..Default::default()
                }),
                ..Default::default()
            };

            generate_config(&reloader_config, config_file.to_str().unwrap()).unwrap();

            let cfg = read_config(&config_file);
            assert_eq!(
                cfg["target"]["path"], expected_path,
                "container={container}"
            );
        }
    }

    // Ported from internal/mirrord/config_test.go:210 (TestGenerateConfig_IncomingMode)
    #[test]
    fn test_generate_config_incoming_mode() {
        let cases = [
            (None, "steal"),
            (Some("steal"), "steal"),
            (Some("mirror"), "mirror"),
            (Some("off"), "off"),
        ];

        for (incoming, expected_mode) in cases {
            let tmp_dir = tempfile::tempdir().unwrap();
            let config_file = tmp_dir.path().join("mirrord-config.json");

            let reloader_config = ReloaderConfig {
                reloader_type: "mirror".to_string(),
                mirror: Some(MirrorConfig {
                    target: Some(MirrorTargetConfig {
                        namespace: "default".to_string(),
                        kubernetes_type: "deployment".to_string(),
                        name: "my-app".to_string(),
                        ..Default::default()
                    }),
                    network: Some(MirrorNetworkConfig {
                        incoming: incoming.map(|mode| MirrorIncomingConfig {
                            mode: mode.to_string(),
                        }),
                        ..Default::default()
                    }),
                    ..Default::default()
                }),
                ..Default::default()
            };

            generate_config(&reloader_config, config_file.to_str().unwrap()).unwrap();

            let cfg = read_config(&config_file);
            assert_eq!(cfg["feature"]["network"]["incoming"]["mode"], expected_mode);
        }
    }

    // Ported from internal/mirrord/config_test.go:264 (TestGenerateConfig_OmitsKubeconfig)
    #[test]
    fn test_generate_config_omits_kubeconfig() {
        let tmp_dir = tempfile::tempdir().unwrap();
        let config_file = tmp_dir.path().join("mirrord-config.json");

        let reloader_config = ReloaderConfig {
            reloader_type: "mirror".to_string(),
            mirror: Some(MirrorConfig {
                target: Some(MirrorTargetConfig {
                    namespace: "gitlab".to_string(),
                    kubernetes_type: "pod".to_string(),
                    name: "gitlab-gitaly-0".to_string(),
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        generate_config(&reloader_config, config_file.to_str().unwrap()).unwrap();

        let data = std::fs::read_to_string(&config_file).unwrap();
        assert!(!data.contains("kubeconfig"));
    }

    // Ported from internal/mirrord/config_test.go:294 (TestGenerateConfig_NotMirrorRepository)
    #[test]
    fn test_generate_config_not_mirror_repository() {
        let tmp_dir = tempfile::tempdir().unwrap();
        let config_file = tmp_dir.path().join("mirrord-config.json");

        let reloader_config = ReloaderConfig {
            reloader_type: "helm".to_string(),
            ..Default::default()
        };

        let err = generate_config(&reloader_config, config_file.to_str().unwrap()).unwrap_err();
        assert!(matches!(err, MirrordError::NotMirrorReloader));
        assert!(!config_file.exists());
    }

    // Ported from internal/mirrord/config_test.go:310 (TestGenerateConfig_MissingMirrorConfig)
    #[test]
    fn test_generate_config_missing_mirror_config() {
        let tmp_dir = tempfile::tempdir().unwrap();
        let config_file = tmp_dir.path().join("mirrord-config.json");

        let reloader_config = ReloaderConfig {
            reloader_type: "mirror".to_string(),
            mirror: None,
            ..Default::default()
        };

        let err = generate_config(&reloader_config, config_file.to_str().unwrap()).unwrap_err();
        assert!(matches!(err, MirrordError::MissingMirrorConfig));
        assert!(!config_file.exists());
    }

    // Ported from internal/mirrord/config_test.go:327 (TestGenerateConfig_MissingTargetConfig)
    #[test]
    fn test_generate_config_missing_target_config() {
        let tmp_dir = tempfile::tempdir().unwrap();
        let config_file = tmp_dir.path().join("mirrord-config.json");

        let reloader_config = ReloaderConfig {
            reloader_type: "mirror".to_string(),
            mirror: Some(MirrorConfig {
                target: None,
                ..Default::default()
            }),
            ..Default::default()
        };

        let err = generate_config(&reloader_config, config_file.to_str().unwrap()).unwrap_err();
        assert!(matches!(err, MirrordError::MissingTargetConfig));
        assert!(!config_file.exists());
    }

    // Ported from internal/mirrord/config_test.go:344 (TestGenerateConfig_InvalidPath)
    #[test]
    fn test_generate_config_invalid_path() {
        let config_file = "/nonexistent/directory/mirrord-config.json";

        let reloader_config = ReloaderConfig {
            reloader_type: "mirror".to_string(),
            mirror: Some(MirrorConfig {
                target: Some(MirrorTargetConfig {
                    namespace: "gitlab".to_string(),
                    kubernetes_type: "pod".to_string(),
                    name: "gitlab-gitaly-0".to_string(),
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        let err = generate_config(&reloader_config, config_file).unwrap_err();
        assert!(err.to_string().contains("opening mirrord config file"));
    }

    // Ported from internal/mirrord/config_test.go:369 (TestGenerateConfig_JSONFormat)
    #[test]
    fn test_generate_config_json_format() {
        let tmp_dir = tempfile::tempdir().unwrap();
        let config_file = tmp_dir.path().join("mirrord-config.json");

        let reloader_config = ReloaderConfig {
            reloader_type: "mirror".to_string(),
            mirror: Some(MirrorConfig {
                target: Some(MirrorTargetConfig {
                    namespace: "gitlab".to_string(),
                    kubernetes_type: "pod".to_string(),
                    name: "gitlab-gitaly-0".to_string(),
                    ..Default::default()
                }),
                filesystem: Some(FilesystemConfig {
                    read_write: vec!["^/home/git/repositories".to_string()],
                    read_only: vec!["^/etc/gitaly".to_string()],
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        generate_config(&reloader_config, config_file.to_str().unwrap()).unwrap();

        let data = std::fs::read_to_string(&config_file).unwrap();
        let _: serde_json::Value = serde_json::from_str(&data).unwrap();

        assert!(data.contains('\n'));
        assert!(data.contains("  "));
    }

    // Ported from internal/mirrord/config_test.go:403 (TestGenerateConfig_FilesystemMode)
    #[test]
    fn test_generate_config_filesystem_mode() {
        let cases = [
            (None, "write"),
            (Some("write"), "write"),
            (Some("local"), "local"),
            (Some("localwithoverrides"), "localwithoverrides"),
            (Some("read"), "read"),
        ];

        for (mode, expected_mode) in cases {
            let tmp_dir = tempfile::tempdir().unwrap();
            let config_file = tmp_dir.path().join("mirrord-config.json");

            let filesystem = mode.map(|m| FilesystemConfig {
                mode: m.to_string(),
                ..Default::default()
            });

            let reloader_config = ReloaderConfig {
                reloader_type: "mirror".to_string(),
                mirror: Some(MirrorConfig {
                    target: Some(MirrorTargetConfig {
                        namespace: "gitlab".to_string(),
                        kubernetes_type: "pod".to_string(),
                        name: "gitlab-webservice-0".to_string(),
                        ..Default::default()
                    }),
                    filesystem,
                    ..Default::default()
                }),
                ..Default::default()
            };

            generate_config(&reloader_config, config_file.to_str().unwrap()).unwrap();

            let cfg = read_config(&config_file);
            assert_eq!(cfg["feature"]["fs"]["mode"], expected_mode);
        }
    }

    // Ported from internal/mirrord/config_test.go:450 (TestGenerateConfig_IgnoreLocalhostOutgoing)
    #[test]
    fn test_generate_config_ignore_localhost_outgoing() {
        let tmp_dir = tempfile::tempdir().unwrap();
        let config_file = tmp_dir.path().join("mirrord-config.json");

        let reloader_config = ReloaderConfig {
            reloader_type: "mirror".to_string(),
            mirror: Some(MirrorConfig {
                target: Some(MirrorTargetConfig {
                    namespace: "gitlab".to_string(),
                    kubernetes_type: "pod".to_string(),
                    name: "gitlab-webservice-0".to_string(),
                    ..Default::default()
                }),
                network: Some(MirrorNetworkConfig {
                    outgoing: Some(MirrorOutgoingConfig {
                        ignore_localhost: true,
                    }),
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        generate_config(&reloader_config, config_file.to_str().unwrap()).unwrap();

        let cfg = read_config(&config_file);
        assert_eq!(
            cfg["feature"]["network"]["outgoing"]["ignore_localhost"],
            true
        );
    }

    // Ported from internal/mirrord/config_test.go:476 (TestGenerateConfig_WithoutNetwork)
    #[test]
    fn test_generate_config_without_network() {
        let tmp_dir = tempfile::tempdir().unwrap();
        let config_file = tmp_dir.path().join("mirrord-config.json");

        let reloader_config = ReloaderConfig {
            reloader_type: "mirror".to_string(),
            mirror: Some(MirrorConfig {
                target: Some(MirrorTargetConfig {
                    namespace: "gitlab".to_string(),
                    kubernetes_type: "pod".to_string(),
                    name: "gitlab-webservice-0".to_string(),
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        generate_config(&reloader_config, config_file.to_str().unwrap()).unwrap();

        let cfg = read_config(&config_file);
        assert_eq!(
            cfg["feature"]["network"]["outgoing"]["ignore_localhost"],
            serde_json::Value::Null
        );

        let data = std::fs::read_to_string(&config_file).unwrap();
        assert!(!data.contains("ignore_localhost"));
    }

    // Ported from internal/mirrord/config_test.go:503 (TestGenerateConfig_WithFSMapping)
    #[test]
    fn test_generate_config_with_fs_mapping() {
        let tmp_dir = tempfile::tempdir().unwrap();
        let config_file = tmp_dir.path().join("mirrord-config.json");

        let mut mapping: OrderedMap<String, String> = OrderedMap::new();
        mapping.set(
            r"^/home/(?<user>\S+)/dev/tomcat".to_string(),
            "/etc/tomcat".to_string(),
        );
        mapping.set(
            r"^/home/(?<user>\S+)/dev/config".to_string(),
            "/mnt/configs".to_string(),
        );

        let reloader_config = ReloaderConfig {
            reloader_type: "mirror".to_string(),
            mirror: Some(MirrorConfig {
                target: Some(MirrorTargetConfig {
                    namespace: "gitlab".to_string(),
                    kubernetes_type: "pod".to_string(),
                    name: "gitlab-gitaly-0".to_string(),
                    ..Default::default()
                }),
                filesystem: Some(FilesystemConfig {
                    mapping: Some(mapping),
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        generate_config(&reloader_config, config_file.to_str().unwrap()).unwrap();

        let data = std::fs::read_to_string(&config_file).unwrap();
        // Named capture groups use < and > which must not be HTML-escaped.
        assert!(!data.contains(r"\u003c"));
        assert!(!data.contains(r"\u003e"));
        assert!(data.contains("(?<user>"));

        let cfg = read_config(&config_file);
        let got_mapping = &cfg["feature"]["fs"]["mapping"];
        assert_eq!(got_mapping.as_object().unwrap().len(), 2);
        assert_eq!(
            got_mapping[r"^/home/(?<user>\S+)/dev/tomcat"],
            "/etc/tomcat"
        );
        assert_eq!(
            got_mapping[r"^/home/(?<user>\S+)/dev/config"],
            "/mnt/configs"
        );
    }

    // Ported from internal/mirrord/config_test.go:539 (TestGenerateConfig_WithoutFSMapping)
    #[test]
    fn test_generate_config_without_fs_mapping() {
        let tmp_dir = tempfile::tempdir().unwrap();
        let config_file = tmp_dir.path().join("mirrord-config.json");

        let reloader_config = ReloaderConfig {
            reloader_type: "mirror".to_string(),
            mirror: Some(MirrorConfig {
                target: Some(MirrorTargetConfig {
                    namespace: "gitlab".to_string(),
                    kubernetes_type: "pod".to_string(),
                    name: "gitlab-gitaly-0".to_string(),
                    ..Default::default()
                }),
                filesystem: Some(FilesystemConfig {
                    read_write: vec!["^/home/git/repositories".to_string()],
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        generate_config(&reloader_config, config_file.to_str().unwrap()).unwrap();

        let data = std::fs::read_to_string(&config_file).unwrap();
        assert!(!data.contains("\"mapping\""));
    }

    // Ported from internal/mirrord/config_test.go:564 (TestGenerateConfig_FilePermissions)
    #[test]
    fn test_generate_config_file_permissions() {
        use std::os::unix::fs::PermissionsExt;

        let tmp_dir = tempfile::tempdir().unwrap();
        let config_file = tmp_dir.path().join("mirrord-config.json");

        let reloader_config = ReloaderConfig {
            reloader_type: "mirror".to_string(),
            mirror: Some(MirrorConfig {
                target: Some(MirrorTargetConfig {
                    namespace: "gitlab".to_string(),
                    kubernetes_type: "pod".to_string(),
                    name: "gitlab-gitaly-0".to_string(),
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        generate_config(&reloader_config, config_file.to_str().unwrap()).unwrap();

        let meta = std::fs::metadata(&config_file).unwrap();
        assert_eq!(meta.permissions().mode() & 0o777, 0o600);
    }

    // Ported from internal/mirrord/example_test.go:12 (ExampleGenerateConfig)
    #[test]
    fn example_generate_config() {
        let tmp_dir = tempfile::tempdir().unwrap();
        let config_file = tmp_dir.path().join("example-mirrord-config.json");

        let reloader_config = ReloaderConfig {
            reloader_type: "mirror".to_string(),
            mirror: Some(MirrorConfig {
                target: Some(MirrorTargetConfig {
                    namespace: "gitlab".to_string(),
                    kubernetes_type: "pod".to_string(),
                    name: "gitlab-gitaly-0".to_string(),
                    ..Default::default()
                }),
                filesystem: Some(FilesystemConfig {
                    read_write: vec!["^/home/git/repositories".to_string()],
                    read_only: vec![
                        "^/etc/gitaly".to_string(),
                        "^/srv/gitlab-shell".to_string(),
                        "^/etc/gitlab-secrets".to_string(),
                    ],
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };

        generate_config(&reloader_config, config_file.to_str().unwrap()).unwrap();

        let data = std::fs::read_to_string(&config_file).unwrap();

        let expected = r#"{
  "target": {
    "path": "pod/gitlab-gitaly-0",
    "namespace": "gitlab"
  },
  "feature": {
    "network": {
      "incoming": {
        "mode": "steal"
      },
      "outgoing": {}
    },
    "fs": {
      "mode": "write",
      "read_write": [
        "^/home/git/repositories"
      ],
      "read_only": [
        "^/etc/gitaly",
        "^/srv/gitlab-shell",
        "^/etc/gitlab-secrets"
      ]
    },
    "env": {
      "exclude": [
        "GODEBUG"
      ]
    }
  },
  "agent": {
    "namespace": "gitlab"
  }
}
"#;

        assert_eq!(data, expected);
    }
}