xianyun_infra/

dev_ca.rs

//! Embeds the dev-CA kustomization used to deploy caproni's development
//! certificate authority and its supporting cert-manager resources (CA
//! Secret, ClusterIssuer, trust Bundle, and a wildcard Certificate for the
//! cluster hostname).
//!
//! Ported from `internal/infra/assets/dev-ca/assets.go` and
//! `devca_overlay_test.go`. The Go original uses `//go:embed *.yaml`
//! against `embed.FS`; this port has no directly equivalent virtual
//! filesystem type, so [`FILES`] is a `const` slice of `(name, content)`
//! pairs built from `include_str!`, materialized into a
//! `xianyun_backends::kustomize::FileSystem` by [`write_files`] the same
//! way the Go test's `assetstest.WriteFS` walks an `embed.FS`. See
//! `PORT_NOTES.md`.
//!
//! The Traefik TLSStore that makes that wildcard certificate Traefik's
//! default is a separate module, [`crate::traefik_tlsstore`]: it needs the
//! Traefik CRDs, which the resources here do not.

use xianyun_backends::kustomize::FileSystem;

/// Ported from the `//go:embed *.yaml` directive on `devca.FS`.
pub const FILES: &[(&str, &str)] = &[
    ("bundle.yaml", include_str!("dev_ca_assets/bundle.yaml")),
    (
        "certificate.yaml",
        include_str!("dev_ca_assets/certificate.yaml"),
    ),
    (
        "clusterissuer.yaml",
        include_str!("dev_ca_assets/clusterissuer.yaml"),
    ),
    (
        "kustomization.yaml",
        include_str!("dev_ca_assets/kustomization.yaml"),
    ),
    (
        "namespace.yaml",
        include_str!("dev_ca_assets/namespace.yaml"),
    ),
];

/// Ported from `assetstest.WriteFS`, specialized to [`FILES`] rather than
/// a generic `io/fs.FS`, since this port embeds files as a `const` slice
/// rather than a virtual filesystem type.
pub fn write_files(fsys: &dyn FileSystem, dir: &str) -> std::io::Result<()> {
    for (name, content) in FILES {
        fsys.write_file(&format!("{dir}/{name}"), content.as_bytes())?;
    }

    Ok(())
}

#[cfg(test)]
mod tests {
    use std::collections::HashMap;
    use std::sync::Mutex;

    use xianyun_backends::kustomize::{Backend, Client, FileSystem};
    use xianyun_executor::exec::Client as ExecClient;

    use super::*;

    /// A minimal in-memory [`FileSystem`], standing in for
    /// `filesys.MakeFsInMemory()`.
    #[derive(Default)]
    struct InMemoryFs {
        files: Mutex<HashMap<String, Vec<u8>>>,
    }

    impl FileSystem for InMemoryFs {
        fn write_file(&self, path: &str, content: &[u8]) -> std::io::Result<()> {
            self.files
                .lock()
                .unwrap()
                .insert(path.to_string(), content.to_vec());
            Ok(())
        }

        fn read_file(&self, path: &str) -> std::io::Result<Vec<u8>> {
            self.files
                .lock()
                .unwrap()
                .get(path)
                .cloned()
                .ok_or_else(|| std::io::Error::new(std::io::ErrorKind::NotFound, path.to_string()))
        }

        fn walk(&self, dir: &str) -> std::io::Result<Vec<String>> {
            let prefix = if dir.ends_with('/') {
                dir.to_string()
            } else {
                format!("{dir}/")
            };
            Ok(self
                .files
                .lock()
                .unwrap()
                .keys()
                .filter(|path| path.starts_with(&prefix) || *path == dir)
                .cloned()
                .collect())
        }
    }

    /// A decoded Kubernetes resource, keyed by GVK + namespace + name, so
    /// two renderings compare independent of document order. Ported from
    /// `resourceKey`/`decodeResources`.
    #[derive(Debug, Clone, PartialEq, Eq, Hash)]
    struct ResourceKey {
        api_version: String,
        kind: String,
        namespace: String,
        name: String,
    }

    /// Ported from `decodeResources`. Parses a multi-document YAML stream
    /// into a map keyed by [`ResourceKey`]. Each value is the object's
    /// normalized content, so key ordering and base64 line wrapping do not
    /// affect equality.
    ///
    /// `serde_yaml` 0.9's [`serde_yaml::Deserializer`] implements
    /// `Iterator`, yielding one deserializer per `---`-separated document
    /// in the stream -- the direct equivalent of Go's
    /// `yaml.NewDecoder(...).Decode` loop until `io.EOF` that the original
    /// test uses.
    fn decode_resources(data: &[u8]) -> std::collections::HashMap<ResourceKey, serde_yaml::Value> {
        use serde::de::Deserialize;

        let mut out = std::collections::HashMap::new();

        for document in serde_yaml::Deserializer::from_slice(data) {
            let mut doc =
                serde_yaml::Value::deserialize(document).expect("unexpected YAML decode error");

            // Skip empty documents (e.g. a stray leading/trailing `---`),
            // matching Go's `if len(doc) == 0 { continue }`.
            let is_empty = match &doc {
                serde_yaml::Value::Null => true,
                serde_yaml::Value::Mapping(m) => m.is_empty(),
                _ => false,
            };
            if is_empty {
                continue;
            }

            let api_version = as_string_opt(doc.get("apiVersion"));
            let kind = as_string_opt(doc.get("kind"));
            let metadata = doc.get("metadata");
            let namespace = as_string_opt(metadata.and_then(|m| m.get("namespace")));
            let name = as_string_opt(metadata.and_then(|m| m.get("name")));

            normalize_secret_data(&mut doc);

            out.insert(
                ResourceKey {
                    api_version,
                    kind,
                    namespace,
                    name,
                },
                doc,
            );
        }

        assert!(!out.is_empty(), "no resources decoded");

        out
    }

    /// Ported from `asString`.
    fn as_string_opt(v: Option<&serde_yaml::Value>) -> String {
        v.and_then(serde_yaml::Value::as_str)
            .unwrap_or_default()
            .to_string()
    }

    /// Ported from `normalizeSecretData`. Drops the Secret's `data` block:
    /// the CA cert/key are runtime material, not part of the overlay
    /// structure the golden guards, and committing them (even as
    /// placeholders) trips secret scanning.
    fn normalize_secret_data(doc: &mut serde_yaml::Value) {
        if doc.get("kind").and_then(|k| k.as_str()) != Some("Secret") {
            return;
        }

        if let serde_yaml::Value::Mapping(map) = doc {
            map.remove("data");
        }
    }

    /// Ported from `materializeOverlay`. Copies the embedded flat dev-CA
    /// kustomization into `fsys` under `dir`, and drops the fixture CA
    /// cert/key alongside it so the secretGenerator can build.
    fn materialize_overlay(fsys: &dyn FileSystem, dir: &str) {
        write_files(fsys, dir).unwrap();

        // Placeholder cert/key content. The golden guards the overlay's
        // structure, not the CA key bytes (those are runtime material
        // delivered at deploy time), so fixed non-secret placeholders keep
        // real private keys out of the repository -- matching the project
        // convention of never committing key material.
        let crt = b"test-placeholder-cert\n";
        let key = b"test-placeholder-key\n";

        fsys.write_file(&format!("{dir}/tls.crt"), crt).unwrap();
        fsys.write_file(&format!("{dir}/tls.key"), key).unwrap();
    }

    /// Ported from `TestDevCAOverlay_MatchesGolden`. Renders the embedded
    /// dev-CA kustomization with the real kustomize backend and asserts
    /// the resource set matches the committed golden snapshot, compared at
    /// the parsed-resource level (document order, key order, and base64
    /// line wrapping are normalized away). The golden freezes the
    /// known-good render -- proven equivalent to the legacy
    /// caproni-ca.yaml.tmpl before that template was removed -- so
    /// accidental overlay changes are caught. The build runs in process
    /// from an in-memory filesystem, so it never touches disk or a CLI.
    // `Client::build` is implemented now, and the overlay's
    // `namespace.yaml`/`clusterissuer.yaml`/`bundle.yaml` resources and
    // `certificate.yaml` (when its placeholder dnsNames are left alone)
    // build and compare correctly. What still fails is the overlay's
    // `secretGenerator` (for `xianyun-ca`) and `configMapGenerator` +
    // `replacements` pair (substituting the hostname literals into the
    // wildcard Certificate's `spec.dnsNames`): neither is implemented by
    // `xianyun_backends::kustomize::Client::build`'s hand-rolled,
    // in-memory builder (`kustomize/mod.rs` only parses `namePrefix` and a
    // flat `resources:` list), so the rendered output is missing the
    // generated Secret and still carries the unsubstituted `placeholder-*`
    // dnsNames the golden does not. Confirmed by running this test with
    // `--ignored`: the diff is exactly those two gaps. This is unstarted
    // Phase 4 feature work in a sibling crate, not a tooling-availability
    // gap -- a real `kustomize` binary is available in this environment.
    #[test]
    fn dev_ca_overlay_matches_golden() {
        let fsys = InMemoryFs::default();
        materialize_overlay(&fsys, "/overlay");

        let backend = Client::with_fs(std::sync::Arc::new(fsys), std::sync::Arc::new(ExecClient));

        let rendered = backend.build("/overlay").unwrap();

        let golden = include_str!("../testdata/devca/golden.golden");

        let want = decode_resources(golden.as_bytes());
        let got = decode_resources(&rendered);

        assert_eq!(want, got);
    }
}