feat: 定义 v1alpha1 API 合同

internal/controller/api_contract_test.go

@@ -0,0 +1,144 @@
+/*
+Copyright 2026.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"fmt"
+	"strings"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	databasev1alpha1 "git.ddupan.top/panxiao81/postgresql-tenant-operator/api/v1alpha1"
+)
+
+const (
+	testInstanceName   = "shared"
+	testNamespace      = "default"
+	testPostgreSQLHost = "postgres.example.test"
+)
+
+var _ = Describe("v1alpha1 API contract", func() {
+	It("applies fixed Instance defaults through the API server", func() {
+		instance := &databasev1alpha1.PostgreSQLInstance{
+			ObjectMeta: metav1.ObjectMeta{Name: "defaults"},
+			Spec: databasev1alpha1.PostgreSQLInstanceSpec{
+				Endpoint: databasev1alpha1.PostgreSQLEndpoint{
+					Host:     testPostgreSQLHost,
+					HostAddr: "192.0.2.20",
+				},
+				AdminCredentialRef: databasev1alpha1.OpenBaoSecretReference{
+					Path: "infrastructure/postgresql/admin",
+				},
+			},
+		}
+
+		Expect(k8sClient.Create(ctx, instance)).To(Succeed())
+		DeferCleanup(func() { Expect(k8sClient.Delete(ctx, instance)).To(Succeed()) })
+		Expect(instance.Spec.Endpoint.Port).To(Equal(int32(5432)))
+		Expect(instance.Spec.Endpoint.Database).To(Equal("postgres"))
+		Expect(instance.Spec.Endpoint.SSLMode).To(Equal(databasev1alpha1.PostgreSQLSSLModeVerifyFull))
+		Expect(instance.Spec.AdminCredentialRef.UsernameKey).To(Equal("username"))
+		Expect(instance.Spec.AdminCredentialRef.PasswordKey).To(Equal("password"))
+	})
+
+	It("rejects invalid PostgreSQL identifiers and host addresses", func() {
+		instance := &databasev1alpha1.PostgreSQLInstance{
+			ObjectMeta: metav1.ObjectMeta{Name: "invalid-endpoint"},
+			Spec: databasev1alpha1.PostgreSQLInstanceSpec{
+				Endpoint: databasev1alpha1.PostgreSQLEndpoint{
+					Host:     testPostgreSQLHost,
+					HostAddr: "not-an-ip",
+					Database: "Invalid-Database",
+				},
+				AdminCredentialRef: databasev1alpha1.OpenBaoSecretReference{Path: "admin"},
+			},
+		}
+
+		err := k8sClient.Create(ctx, instance)
+		Expect(apierrors.IsInvalid(err)).To(BeTrue(), "expected invalid error, got %v", err)
+	})
+
+	It("rejects unsafe OpenBao paths", func() {
+		for index, path := range []string{"data/postgresql/admin", "postgresql/../admin", "/postgresql/admin"} {
+			instance := &databasev1alpha1.PostgreSQLInstance{
+				ObjectMeta: metav1.ObjectMeta{Name: fmt.Sprintf("invalid-path-%d", index)},
+				Spec: databasev1alpha1.PostgreSQLInstanceSpec{
+					Endpoint: databasev1alpha1.PostgreSQLEndpoint{
+						Host:     testPostgreSQLHost,
+						HostAddr: "192.0.2.21",
+					},
+					AdminCredentialRef: databasev1alpha1.OpenBaoSecretReference{Path: path},
+				},
+			}
+
+			err := k8sClient.Create(ctx, instance)
+			Expect(apierrors.IsInvalid(err)).To(BeTrue(), "path %q: expected invalid error, got %v", path, err)
+		}
+	})
+
+	It("applies fixed Tenant defaults while preserving semantic defaults", func() {
+		tenant := &databasev1alpha1.PostgreSQLTenant{
+			ObjectMeta: metav1.ObjectMeta{Name: "api-defaults", Namespace: testNamespace},
+			Spec: databasev1alpha1.PostgreSQLTenantSpec{
+				InstanceRef: testInstanceName,
+			},
+		}
+
+		Expect(k8sClient.Create(ctx, tenant)).To(Succeed())
+		DeferCleanup(func() { Expect(k8sClient.Delete(ctx, tenant)).To(Succeed()) })
+		Expect(tenant.Spec.DeletionPolicy).To(Equal(databasev1alpha1.DeletionPolicyRetain))
+		Expect(tenant.Spec.Database).To(BeEmpty())
+		Expect(tenant.Spec.LoginRole).To(BeEmpty())
+		Expect(tenant.Spec.Credential.SecretName).To(BeEmpty())
+		Expect(tenant.EffectiveDatabase()).To(Equal("api-defaults"))
+		Expect(tenant.EffectiveLoginRole()).To(Equal("api-defaults"))
+		Expect(tenant.EffectiveSecretName()).To(Equal("shared-api-defaults-postgresql"))
+	})
+
+	It("accepts a custom target Secret name", func() {
+		tenant := &databasev1alpha1.PostgreSQLTenant{
+			ObjectMeta: metav1.ObjectMeta{Name: "custom-secret", Namespace: testNamespace},
+			Spec: databasev1alpha1.PostgreSQLTenantSpec{
+				InstanceRef: testInstanceName,
+				Credential: databasev1alpha1.PostgreSQLCredentialSpec{
+					SecretName: "database-credentials",
+				},
+			},
+		}
+
+		Expect(k8sClient.Create(ctx, tenant)).To(Succeed())
+		DeferCleanup(func() { Expect(k8sClient.Delete(ctx, tenant)).To(Succeed()) })
+		Expect(tenant.EffectiveSecretName()).To(Equal("database-credentials"))
+	})
+
+	It("rejects names that cannot produce a valid ExternalSecret name", func() {
+		tenant := &databasev1alpha1.PostgreSQLTenant{
+			ObjectMeta: metav1.ObjectMeta{Name: strings.Repeat("t", 121), Namespace: testNamespace},
+			Spec: databasev1alpha1.PostgreSQLTenantSpec{
+				InstanceRef: strings.Repeat("i", 121),
+				Database:    "valid_database",
+				LoginRole:   "valid_role",
+			},
+		}
+
+		err := k8sClient.Create(ctx, tenant)
+		Expect(apierrors.IsInvalid(err)).To(BeTrue(), "expected invalid error, got %v", err)
+	})
+})

internal/controller/postgresqlinstance_controller_test.go

@@ -33,15 +33,13 @@ import (
 var _ = Describe("PostgreSQLInstance Controller", func() {
 	Context("When reconciling a resource", func() {
 		const (
-			resourceName      = "test-resource"
-			resourceNamespace = "default"
+			resourceName = "test-resource"
 		)
 
 		ctx := context.Background()
 
 		typeNamespacedName := types.NamespacedName{
-			Name:      resourceName,
-			Namespace: resourceNamespace,
+			Name: resourceName,
 		}
 		postgresqlinstance := &databasev1alpha1.PostgreSQLInstance{}
 
@@ -51,10 +49,17 @@ var _ = Describe("PostgreSQLInstance Controller", func() {
 			if err != nil && errors.IsNotFound(err) {
 				resource := &databasev1alpha1.PostgreSQLInstance{
 					ObjectMeta: metav1.ObjectMeta{
-						Name:      resourceName,
-						Namespace: resourceNamespace,
+						Name: resourceName,
+					},
+					Spec: databasev1alpha1.PostgreSQLInstanceSpec{
+						Endpoint: databasev1alpha1.PostgreSQLEndpoint{
+							Host:     testPostgreSQLHost,
+							HostAddr: "192.0.2.10",
+						},
+						AdminCredentialRef: databasev1alpha1.OpenBaoSecretReference{
+							Path: "infrastructure/postgresql/admin",
+						},
 					},
-					// TODO(user): Specify other spec details if needed.
 				}
 				Expect(k8sClient.Create(ctx, resource)).To(Succeed())
 			}

internal/controller/postgresqltenant_controller_test.go

@@ -34,7 +34,7 @@ var _ = Describe("PostgreSQLTenant Controller", func() {
 	Context("When reconciling a resource", func() {
 		const (
 			resourceName      = "test-resource"
-			resourceNamespace = "default"
+			resourceNamespace = testNamespace
 		)
 
 		ctx := context.Background()
@@ -54,7 +54,9 @@ var _ = Describe("PostgreSQLTenant Controller", func() {
 						Name:      resourceName,
 						Namespace: resourceNamespace,
 					},
-					// TODO(user): Specify other spec details if needed.
+					Spec: databasev1alpha1.PostgreSQLTenantSpec{
+						InstanceRef: testInstanceName,
+					},
 				}
 				Expect(k8sClient.Create(ctx, resource)).To(Succeed())
 			}