feat: keiailab-commons 빌더 채택 (secrethash 버그교정 + pdb/hpa/service/volume/batchjob)#381
Merged
Conversation
KeiaiLab-PHIL
changed the title
KeiaiLab-PHIL
changed the title
mongo 의 hashSecretData 가 `for k, v := range secret.Data` 로 map 을 비결정적 순회해 동일 Secret 이 reconcile 마다 다른 해시를 낼 수 있던 correctness 버그 (불필요한 password-rotation pending 신호 유발)를 keiailab-commons/pkg/secrethash.Hash (정렬 누적)로 위임해 구조적 교정. 16자 truncation 은 annotation 형식 보존. - controller/password_rotation.go: hashSecretData → commonssecrethash.Hash(...)[:16] - controller/password_rotation_hash_test.go: determinism + value-change 테스트 신설 (기존 0건 → 2건). 200회 반복 동일 해시 검증. commons 의존 v0.11.0 → v0.12.1-0.20260630004504-13e0976fc111 (keiailab-commons#86).⚠️ adopt 시 1회 해시 변화로 rotation pending 신호가 한 번 set 될 수 있음 (determinism 교정의 불가피한 1회성, 이후 안정). 검증: go build ./... → OK go vet ./internal/controller/... → clean go test -run TestHashSecretData ./internal/controller/... → ok (determinism PASS) KUBEBUILDER_ASSETS=… go test ./internal/controller/... → ok (20.1s, envtest 전체 suite) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: phil <phil@keiailab.com>
mongo 의 PDB/HPA 빌더 본문을 commons 공유 패키지로 위임 (builder.go 중복 -53 LOC). exported 시그니처 유지 → 호출부 변경 0. - BuildMongoDBPDB + pdbBaseSpec → commons pdb.Build (DefaultFloor=0). mongo 의 MinAvailable-우선 = commons 기본과 동일 → 거동 보존. - buildHPAForTarget → commons hpa.Build (MinFloor=1). buildHPAMetrics 의 cpu/memory/ 기본 케이스 → commons CPUUtilization/MemoryUtilization 헬퍼. custom Pods metric 은 mongo 도메인 잔류. 검증: go build ./... → OK go vet ./internal/resources/... → clean golangci-lint run ./internal/resources/... → 0 issues go test ./internal/resources/... → ok Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: phil <phil@keiailab.com>
- resources/builder.go BuildHeadlessService/BuildClientService → commons service.Build (Headless → ClusterIP None + PublishNotReadyAddresses). - buildTLSServerVolume/buildTLSServerMount → commons volume.TLSSecretMount (0o400 + ReadOnly cert 불변식 SSOT). commons 의존 → v0.12.1-0.20260630011743-a54c4a826028 (keiailab-commons#86 2차). 검증: go build ./... OK / go vet clean / golangci-lint 0 issues / go test resources ok. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: phil <phil@keiailab.com>
mongo 의 배치 Job 빌더 2종을 keiailab-commons/pkg/batchjob.Build 로 위임. - BuildBackupJob (mongodump 스크립트) - BuildRestoreJob (mongorestore + oplogReplay) Job/PodTemplate 엔벨로프(BackoffLimit/TTL=86400/RestartPolicyOnFailure/라벨전파)는 commons SSOT. 컨테이너(스크립트)·볼륨·SecurityContext 조립은 mongo 잔류. BuildBackupCronJob 은 CronJob(JobTemplate) 타입이라 대상 외 (유지). 검증: go build OK / vet clean / golangci-lint 신규 0 / resources test ok / KUBEBUILDER_ASSETS=… controller envtest 전체 suite ok (19.3s). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: phil <phil@keiailab.com>
commons#86 머지 + v0.13.0 릴리스 후 clean tag 로 고정. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: phil <phil@keiailab.com>
KeiaiLab-PHIL
force-pushed
the
fix/secret-hash-determinism
branch
from
473a542 to
7e2d35b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
요약 — keiailab-commons 빌더 채택 + 🐛 버그교정
mongo 가
keiailab-commons공유 빌더를 채택 (중복 제거). 순변화 -45 LOC (174+/219-). exported 시그니처 유지 → 호출부 변경 0.hashSecretDatasecrethash.Hash— map 순회 비결정성 버그 교정 + 테스트 2건 신설BuildMongoDBPDB/pdbBaseSpecpdb.Build(DefaultFloor=0)buildHPAForTarget/buildHPAMetricshpa.Build(MinFloor=1) + CPU/Mem 헬퍼 (custom 잔류)BuildHeadlessService/BuildClientServiceservice.BuildbuildTLSServerVolume/buildTLSServerMountvolume.TLSSecretMount(0o400)BuildBackupJob/BuildRestoreJobbatchjob.Build(엔벨로프)builder.go(2705 LOC 거대 파일)에서 중복 대폭 제거. (PVC 빌더는 mongo 측 dead code(lint:ignore U1000)라 추출 대상 외 — 통합/제거 결정 후속.)commons PR #86. go.mod
v0.11.0→ pseudov0.12.1-0.20260630011743-a54c4a826028. commons 릴리스 후 tag bump → draft. determinism 교정으로 adopt 시 1회 해시 변화(이후 안정).검증
🤖 Generated with Claude Code