mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-15 17:11:30 +00:00
Josh Siviour
dd65a2dfa6
* feat(elbv2): ListenerRules CRUD with HAProxy ACL routing Implement CreateRule, ModifyRule, DeleteRule, DescribeRules, and SetRulePriorities for ALB listeners. Rules support host-header, path-pattern, http-header, http-request-method, source-ip, and query-string condition fields. Actions limited to forward (single target group); redirect and fixed-response deferred. HAProxy frontends emit per-rule ACLs with `use_backend ... if <acls>` ordered by priority. Wildcards in host/path map to HAProxy match modes (`-m beg/end/sub/str`). Condition values are validated at store-time and re-validated at render-time to prevent config injection. Target groups referenced by rule actions are protected against deletion. Deleting a listener cascades its rules. Frontend adds a Rules tab beneath each listener row showing rules with conditions and target groups, plus add/edit/delete dialogs with field-typed condition inputs. mulga-950 * test(elbv2): rule CRUD e2e + render coverage for all condition fields Adds Internal_ALB_ListenerRules subtest exercising CreateRule, ModifyRule, DeleteRule, and DescribeRules over a real ALB with HAProxy. Two TGs with disjoint backends (app#0 -> tgA, app#1 -> tgB) let the probe responder identify which TG actually served the request, so path-pattern routing can be asserted without inspecting internal state. Extends app-userdata.sh with alpha/ and beta/ sub-paths and extends client-userdata.sh trigger to accept optional http_path and host fields so probes can target specific paths and Host headers. Both changes are backward-compatible: existing callers default to / with no Host override. Adds unit-test coverage for every condition-field render path (http-header, http-request-method, query-string with and without key, source-ip) plus error-path validation tests for CreateRule, ModifyRule, DeleteRule, DescribeRules, and SetRulePriorities. Lifts diff coverage above the 60% gate. * test(elbv2): wait for tgB healthy after rule creation, not before Spinifex only health-checks a target group once it is referenced by a listener default action or a rule action. The previous ordering waited for tgB healthy before CreateRule wired it, so health checks never ran and the wait timed out. Move the WaitForTargetsHealthy(tgB) call after createPathRule. * fix(elbv2): include rule-action TGs in TargetGroupsForLB healthChecker uses Store.TargetGroupsForLB to map HAProxy server statuses back to TargetGroupRecord entries. The previous implementation walked only listener DefaultActions, so a target group referenced only by a CreateRule action was invisible to the health checker — HAProxy probed its backends but the resulting health never propagated to the store. DescribeTargetHealth reported the targets as 'initial' forever. Extend TargetGroupsForLB to walk rule actions per listener as well. Adds a unit test that wires a TG via CreateRule and asserts the resolver returns it. * test(elbv2): fix wait-for-rule logic to poll away from default backend waitForPathRouted required the caller to name the expected new host, but at the post-CreateRule wait point we only know the default host (appA); the rule target hostname (appB) is discovered by the subsequent probe. The previous code passed appA as both "new" and "old", so the wait checked "see appA" against "/alpha/" responses — which never matched because the rule had successfully routed appA out. Replace with two narrower helpers: waitForPathRoutedAway (poll until host X stops appearing) and waitForPathRoutedTo (poll until host Y appears). Update the three call sites to use the variant that matches what the caller actually knows at that point. * fix(elbv2): IAM-style error envelope + ModifyTargetGroup + listener attr stubs ELBv2 success responses use the IAM-style XML envelope (<ErrorResponse>), but error responses were emitted with the EC2 envelope (<Response>), which aws-sdk-go-v2 cannot deserialize for ELBv2 and surfaces as "UnknownError: UnknownError" — defeating provider-side InvalidAction ignores (e.g. terraform-provider-aws v5.100's DescribeCapacityReservation swallow). Route elasticloadbalancing errors through GenerateIAMErrorResponse. Add ModifyTargetGroup end-to-end (interface, impl, NATS shim, daemon handler, gateway dispatch) so terraform-provider-aws can set health-check fields after CreateTargetGroup without infinite drift. Persist HealthCheckEnabled on TargetGroupRecord and emit it in tgRecordToSDK so the provider sees the configured value across refresh cycles. Stub DescribeListenerAttributes / ModifyListenerAttributes with hand-rolled input/output structs (aws-sdk-go v1.55 lacks these types). Returns empty attribute list — sufficient for default-config workflows. * test(elbv2): cover ModifyTargetGroup + listener attribute stubs Extend handler tests with all-fields, invalid path/matcher, wrong-account ModifyTargetGroup cases plus HealthCheckEnabled assertion on CreateTargetGroup. Add gateway-layer validation tests for the new DescribeListenerAttributes, ModifyListenerAttributes, and ModifyTargetGroup dispatchers. Raises diff coverage from 58.8% to 63.7%.