Repository navigation
🤖 feat: add the dormant CoderTemplateTest reconciler skeleton - #197
Conversation
Add CoderTemplateTestReconciler without registering it: assertions, cleanup finalizer before any Coder call, status initialization, the deadline while Pending, control-plane and operator-token access, and the owner setting with an existence check. Finished tests and deleted tests that never created a workspace release the finalizer at once. Refs #152 Signed-off-by: Thomas Kosiewski <tk@coder.com> --- _Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_ Change-Id: I92e96b44f6940e8031f1c3bf1aa59f9205c180aa
|
@codex security review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 93e81bf644
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Address the #197 review: with TLS, call Coder through the internal HTTP URL like the control-plane controller, and fail a test whose deadline passed while its Coder lookups ran. Refs #152 Signed-off-by: Thomas Kosiewski <tk@coder.com> --- _Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_ Change-Id: I6405b4c0ba48b42032689b9532dc6a63e3e3b636
|
@codex review |
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Summary
Fourth layer of the
CoderTemplateTeststack (Refs #152), the first half of the plan's PR 3. It addsCoderTemplateTestReconcilerwithout registering it, so the kind stays dormant and nothing changes for users. The reconciler never creates a workspace.I split the plan's PR 3 in two because the full version came to about 790 hand-written lines. This PR is the skeleton and control-plane access. The next layer adds owner eligibility, the organization, template, and version lookups, version pinning, and the workspace name check.
What
internal/controller/codertemplatetest_controller.goruns the first step that applies, then returns:assertion failed: ...): client, scheme, and clock are set. The fetched object matches the request. The UID gives aktt-name of 28 hex characters, and a recordedstatus.workspaceNamematches it. A create marker or workspace ID fails fast, because this controller never creates workspaces.coder.com/template-test-cleanup(new constant inapi/v1alpha1), stored withUpdatebefore any Coder call. A finished test whose workspace is gone is not given the finalizer again.phase=Pending,startTime,observedGeneration,Reconciling=True,Ready=False,Stalled=False.WorkspaceDeleted=True(NotCreated) if needed, then releases the finalizer. It is never evaluated again.startTime + timeoutSecondspassed givesFailedDeadlineExceeded, with the last wait reason inmessage.CoderControlPlane(missing, being deleted, or withoutstatus.url:ControlPlaneNotReady), operator access and the token Secret (OperatorAccessNotReady),spec.templateTests.ownerUserID(OwnerNotConfigured), and the owner's existence in Coder (OwnerNotEligible). Other Coder failures wait withCoderUnavailableand only the status code and Coder's short message.ReadyToCreate. The plan's PR 4 replaces this with the create step.Every status write uses
Status().Updatewith the readresourceVersionand is skipped when nothing changed. Waits requeue after 15 s, never past the deadline. The reconciler reads the clock again after its Coder lookups, so a deadline that passes during a slow lookup still fails the test. Coder calls use a 30 s client timeout. Messages are capped at 256 bytes.Coder URL: an HTTP
status.urlis used as is. With TLS,status.urlis HTTPS on the service name, which certificates rarely cover, so the controller usescontrolPlaneSDKURL(internal HTTP) like the control-plane controller. #198 tracks the same change for the provisioner and the aggregated API server.k8s.io/utils/clock/testingis now vendored (from the module already ingo.mod) for the fake clock.Follow-ups from the #196 assessment
codersdk.NameValidcomparesstr == "new" || str == "create", andhttpapicalls it on the raw value). The CEL rule already matches, so it stays case-sensitive. A new API test row pins thatNew.CREATEis accepted.orgByIdent: this layer looks up no organization, so it does not depend on it. The next layer, which adds the lookups, makes it case-insensitive like v2.37.2GetOrganizationByName(LOWER(name)) and tests a mixed-case template reference.Not in this layer, by plan: the control-plane-gone release (amendment A1) and
deletion-policy: retain(A2) come with cleanup in PR 5. The 429 backoff comes with the create path in PR 4.Tests
internal/controller/codertemplatetest_controller_test.go(envtest with the fake Coder, a new reconciler per call to model restarts, and a fake clock):status.url, control plane deleted, no owner configured, unknown owner, a Coder 503 (CoderUnavailable), and finallyReadyToCreate. The first reconcile only adds the finalizer and makes no Coder call. No create request is sent. Deleting the waiting test releases it at once.Pending: at 899 s the requeue is 1 s, at 900 s the test isFailedDeadlineExceededwithStalled=True,Ready=False,WorkspaceDeleted=True(NotCreated), and no finalizer. Later reconciles do not change it.DeadlineExceededand the last waitReadyToCreate.codertemplatetest_internal_test.go: an HTTPstatus.urlstays unchanged, and an HTTPS one with TLS becomeshttp://coder.ns.svc.cluster.local:80.codertemplatetest_api_test.go:New.CREATEis accepted.The fake's token now equals the token that
createTestControlPlanestores, so tests reuse that helper.Mutation check (scratch worktree, each mutation fails at least one test): no finalizer before Coder calls, no deadline, no deadline recheck after lookups,
status.urlfor HTTPS, and no finalizer release for a finished test.Validation
All on the pushed tree, with exit 0 each:
make verify-vendor,make test,make test-integration,make build,make lintmake codegen,make manifests,make docs-reference(no diff afterwards)go test -race ./internal/controller/...Line count
586 hand-written added lines and 3 removed. Vendored
k8s.io/utils/clock/testingadds 419 lines.Generated with
xum• Model:anthropic:claude-opus-5-5• Thinking:high