feat: 接入 Database 三资源 API 与分层绑定协调
确定单库单账号、集群级 Database、资源侧先写绑定和凭据定位合同。领域层承载纯规则，service 协調流程，Kubernetes adapter 负责资源呈现与版本保护。 验证：全量 make test、三轮 race、真实 API server 并发与重启补写、最小 RBAC/watch、lint 和文档检查通过。供应、凭据交付及删除清理尚未实现，保留 DeletionPending/finalizer 边界。
This commit is contained in:
@@ -0,0 +1,136 @@
|
||||
// Package binding 定义资源与申请的纯绑定规则，不访问 Kubernetes 或数据库。
|
||||
package binding
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"regexp"
|
||||
)
|
||||
|
||||
const (
|
||||
Binding = "Binding"
|
||||
Bound = "Bound"
|
||||
Deleting = "Deleting"
|
||||
Conflict = "Conflict"
|
||||
DependencyUnavailable = "DependencyUnavailable"
|
||||
)
|
||||
|
||||
type Identity struct {
|
||||
Name string
|
||||
UID string
|
||||
}
|
||||
|
||||
type TenantIdentity struct {
|
||||
Namespace string
|
||||
Name string
|
||||
UID string
|
||||
}
|
||||
|
||||
// Request 保留用户输入；Resolve 产生默认值已确定的目标，不修改原请求。
|
||||
type Request struct {
|
||||
Provision *ProvisionRequest
|
||||
ExistingDatabase string
|
||||
}
|
||||
|
||||
type ProvisionRequest struct {
|
||||
Instance string
|
||||
Database string
|
||||
LoginRole string
|
||||
}
|
||||
|
||||
type Target struct {
|
||||
Name string
|
||||
Provision *ProvisionRequest
|
||||
}
|
||||
|
||||
var identifier = regexp.MustCompile(`^[a-z][a-z0-9_]{0,62}$`)
|
||||
|
||||
func (r Request) Resolve(tenant TenantIdentity) (Target, error) {
|
||||
if (r.Provision == nil) == (r.ExistingDatabase == "") {
|
||||
return Target{}, fmt.Errorf("必须且只能选择动态申请或已有 Database")
|
||||
}
|
||||
if r.Provision == nil {
|
||||
return Target{Name: r.ExistingDatabase}, nil
|
||||
}
|
||||
provision := *r.Provision
|
||||
if provision.Database == "" {
|
||||
provision.Database = tenant.Name
|
||||
}
|
||||
if provision.LoginRole == "" {
|
||||
provision.LoginRole = tenant.Name
|
||||
}
|
||||
if !identifier.MatchString(provision.Database) || !identifier.MatchString(provision.LoginRole) {
|
||||
return Target{}, fmt.Errorf("动态 database/loginRole 必须符合 PostgreSQL identifier 规则；省略时使用 Tenant 名称")
|
||||
}
|
||||
return Target{Name: DynamicDatabaseName(tenant.UID), Provision: &provision}, nil
|
||||
}
|
||||
|
||||
func DynamicDatabaseName(tenantUID string) string { return "tenant-" + tenantUID }
|
||||
|
||||
type Tenant struct {
|
||||
Identity TenantIdentity
|
||||
Request Request
|
||||
Phase string
|
||||
Deleting bool
|
||||
Database *Identity
|
||||
}
|
||||
|
||||
// Database 是绑定所需的资源事实，不包含存储版本、Conditions 或客户端对象。
|
||||
type Database struct {
|
||||
Identity Identity
|
||||
Instance string
|
||||
InstanceUID string
|
||||
Name string
|
||||
LoginRole string
|
||||
Source string
|
||||
Tenant *TenantIdentity
|
||||
Phase string
|
||||
Deleting bool
|
||||
Ready bool
|
||||
}
|
||||
|
||||
type Instance struct {
|
||||
Identity Identity
|
||||
Deleting bool
|
||||
Ready bool
|
||||
}
|
||||
|
||||
type Issue struct {
|
||||
Reason string
|
||||
Message string
|
||||
}
|
||||
|
||||
func (d Database) MatchesProvision(target Target, tenant TenantIdentity) bool {
|
||||
return target.Provision != nil && d.Source == "Provision" && d.Instance == target.Provision.Instance &&
|
||||
d.Name == target.Provision.Database && d.LoginRole == target.Provision.LoginRole &&
|
||||
d.Tenant != nil && *d.Tenant == tenant
|
||||
}
|
||||
|
||||
func (i Instance) Check(database *Database) *Issue {
|
||||
if i.Deleting || !i.Ready {
|
||||
return &Issue{DependencyUnavailable, "Instance 正在删除或尚无当前版本的 Ready 观察"}
|
||||
}
|
||||
if database != nil && database.InstanceUID != "" && database.InstanceUID != i.Identity.UID {
|
||||
return &Issue{Conflict, "Instance UID 已变化；请核实实例身份，未迁移或接管资源"}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (d Database) CanBind(tenant Tenant) *Issue {
|
||||
if tenant.Database != nil && tenant.Database.UID != d.Identity.UID {
|
||||
return &Issue{Conflict, fmt.Sprintf("Database %s 的 UID 与已记录绑定不同；请核实同名重建，未接管新对象", d.Identity.Name)}
|
||||
}
|
||||
if d.Deleting || d.Phase == "Released" || d.Phase == Deleting {
|
||||
return &Issue{Conflict, "Database 正在删除或处于 Released；请由管理员核实并处理，未重新分配"}
|
||||
}
|
||||
if d.Tenant != nil {
|
||||
if *d.Tenant != tenant.Identity {
|
||||
return &Issue{Conflict, fmt.Sprintf("Database %s 已绑定 Tenant %s/%s（UID %s）；未抢占",
|
||||
d.Identity.Name, d.Tenant.Namespace, d.Tenant.Name, d.Tenant.UID)}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
if d.Phase != "Available" || !d.Ready {
|
||||
return &Issue{DependencyUnavailable, "Database 尚未完成验证并进入 Available，等待资源观察"}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,134 @@
|
||||
package binding
|
||||
|
||||
import "testing"
|
||||
|
||||
const (
|
||||
testNamespace = "apps"
|
||||
testApp = "app"
|
||||
testInstance = "shared"
|
||||
testOwner = "owner"
|
||||
testExisting = "existing"
|
||||
testOther = "other"
|
||||
)
|
||||
|
||||
func TestRequestResolve(t *testing.T) {
|
||||
tenant := TenantIdentity{Namespace: testNamespace, Name: testApp, UID: "tenant-uid"}
|
||||
tests := []struct {
|
||||
name string
|
||||
request Request
|
||||
valid bool
|
||||
}{
|
||||
{"动态默认值", Request{Provision: &ProvisionRequest{Instance: testInstance}}, true},
|
||||
{"显式名称", Request{Provision: &ProvisionRequest{Instance: testInstance, Database: "custom", LoginRole: testOwner}}, true},
|
||||
{"已有资源", Request{ExistingDatabase: testExisting}, true},
|
||||
{"没有入口", Request{}, false},
|
||||
{"同时指定入口", Request{Provision: &ProvisionRequest{}, ExistingDatabase: testExisting}, false},
|
||||
{"非法库名", Request{Provision: &ProvisionRequest{Database: "bad-name"}}, false},
|
||||
{"非法角色名", Request{Provision: &ProvisionRequest{LoginRole: "bad-name"}}, false},
|
||||
}
|
||||
for _, tc := range tests {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
target, err := tc.request.Resolve(tenant)
|
||||
if (err == nil) != tc.valid {
|
||||
t.Fatalf("Resolve() = %v, valid = %v", err, tc.valid)
|
||||
}
|
||||
if !tc.valid {
|
||||
return
|
||||
}
|
||||
if tc.request.Provision == nil {
|
||||
if target.Name != testExisting || target.Provision != nil {
|
||||
t.Fatal("已有资源不应推导 Instance 或供应请求")
|
||||
}
|
||||
return
|
||||
}
|
||||
if target.Name != "tenant-tenant-uid" || target.Provision == tc.request.Provision {
|
||||
t.Fatal("目标名称不稳定，或 Resolve 未复制输入")
|
||||
}
|
||||
if tc.request.Provision.Database == "" && target.Provision.Database != tenant.Name {
|
||||
t.Fatal("数据库默认名称不符")
|
||||
}
|
||||
if tc.request.Provision.LoginRole == "" && target.Provision.LoginRole != tenant.Name {
|
||||
t.Fatal("角色默认名称不符")
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestDatabaseCanBind(t *testing.T) {
|
||||
tenant := Tenant{Identity: TenantIdentity{Namespace: testNamespace, Name: testApp, UID: "current"}}
|
||||
tests := []struct {
|
||||
name string
|
||||
change func(*Database, *Tenant)
|
||||
reason string
|
||||
}{
|
||||
{"空闲且就绪", func(*Database, *Tenant) {}, ""},
|
||||
{"同一绑定重试", func(d *Database, t *Tenant) { d.Tenant = &t.Identity; d.Ready = false }, ""},
|
||||
{"尚未观察", func(d *Database, _ *Tenant) { d.Ready = false }, DependencyUnavailable},
|
||||
{"尚未Available", func(d *Database, _ *Tenant) { d.Phase = "Pending" }, DependencyUnavailable},
|
||||
{"Released", func(d *Database, _ *Tenant) { d.Phase = "Released" }, Conflict},
|
||||
{"删除标记", func(d *Database, _ *Tenant) { d.Deleting = true }, Conflict},
|
||||
{"删除阶段", func(d *Database, _ *Tenant) { d.Phase = Deleting }, Conflict},
|
||||
{"已被占用", func(d *Database, _ *Tenant) { d.Tenant = &TenantIdentity{UID: testOther} }, Conflict},
|
||||
{"同名新申请", func(d *Database, t *Tenant) { old := t.Identity; old.UID = "old"; d.Tenant = &old }, Conflict},
|
||||
{"同名新资源", func(_ *Database, t *Tenant) { t.Database = &Identity{Name: "resource", UID: "old"} }, Conflict},
|
||||
}
|
||||
for _, tc := range tests {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
database := Database{Identity: Identity{Name: "resource", UID: "database-uid"}, Phase: "Available", Ready: true}
|
||||
currentTenant := tenant
|
||||
tc.change(&database, ¤tTenant)
|
||||
checkIssue(t, database.CanBind(currentTenant), tc.reason)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestInstanceCheck(t *testing.T) {
|
||||
instance := Instance{Identity: Identity{UID: "instance"}, Ready: true}
|
||||
checkIssue(t, instance.Check(nil), "")
|
||||
checkIssue(t, instance.Check(&Database{InstanceUID: "instance"}), "")
|
||||
checkIssue(t, instance.Check(&Database{InstanceUID: "replaced"}), Conflict)
|
||||
instance.Ready = false
|
||||
checkIssue(t, instance.Check(nil), DependencyUnavailable)
|
||||
instance.Ready, instance.Deleting = true, true
|
||||
checkIssue(t, instance.Check(nil), DependencyUnavailable)
|
||||
}
|
||||
|
||||
func TestMatchesProvision(t *testing.T) {
|
||||
tenant := TenantIdentity{Namespace: testNamespace, Name: testApp, UID: "tenant"}
|
||||
target := Target{Provision: &ProvisionRequest{Instance: testInstance, Database: testApp, LoginRole: testOwner}}
|
||||
database := Database{Source: "Provision", Instance: testInstance, Name: testApp, LoginRole: testOwner, Tenant: &tenant}
|
||||
if !database.MatchesProvision(target, tenant) {
|
||||
t.Fatal("相同目标与身份应允许重试")
|
||||
}
|
||||
mutations := []func(*Database){
|
||||
func(d *Database) { d.Source = "Import" },
|
||||
func(d *Database) { d.Instance = testOther },
|
||||
func(d *Database) { d.Name = testOther },
|
||||
func(d *Database) { d.LoginRole = testOther },
|
||||
func(d *Database) { d.Tenant = nil },
|
||||
func(d *Database) { d.Tenant = &TenantIdentity{UID: testOther} },
|
||||
}
|
||||
for _, mutate := range mutations {
|
||||
changed := database
|
||||
mutate(&changed)
|
||||
if changed.MatchesProvision(target, tenant) {
|
||||
t.Fatal("不匹配的记录不能仅靠名称被认领")
|
||||
}
|
||||
}
|
||||
if database.MatchesProvision(Target{}, tenant) {
|
||||
t.Fatal("已有资源申请不是动态供应重试")
|
||||
}
|
||||
}
|
||||
|
||||
func checkIssue(t *testing.T, issue *Issue, reason string) {
|
||||
t.Helper()
|
||||
if reason == "" {
|
||||
if issue != nil {
|
||||
t.Fatalf("不应拒绝: %+v", issue)
|
||||
}
|
||||
return
|
||||
}
|
||||
if issue == nil || issue.Reason != reason || issue.Message == "" {
|
||||
t.Fatalf("issue = %+v, want %s 与可读诊断", issue, reason)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user