mirror of
https://github.com/lukaszraczylo/kubemirror.git
synced 2026-07-06 19:34:41 +00:00
initial commit
This commit is contained in:
@@ -0,0 +1,144 @@
|
||||
// Package hash provides content hashing functionality for detecting resource changes.
|
||||
package hash
|
||||
|
||||
import (
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
)
|
||||
|
||||
// ComputeContentHash computes a SHA256 hash of the resource's actual content.
|
||||
// It excludes metadata fields (resourceVersion, managedFields, etc.) and status.
|
||||
// This detects actual content changes vs Kubernetes metadata changes.
|
||||
func ComputeContentHash(obj runtime.Object) (string, error) {
|
||||
content, err := extractContent(obj)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to extract content: %w", err)
|
||||
}
|
||||
|
||||
// Convert to JSON for consistent hashing
|
||||
jsonBytes, err := json.Marshal(content)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to marshal content: %w", err)
|
||||
}
|
||||
|
||||
// Compute SHA256
|
||||
hash := sha256.Sum256(jsonBytes)
|
||||
return hex.EncodeToString(hash[:]), nil
|
||||
}
|
||||
|
||||
// extractContent extracts only the content fields from a resource.
|
||||
// Excludes all metadata except name, namespace, labels, and annotations we care about.
|
||||
func extractContent(obj runtime.Object) (interface{}, error) {
|
||||
// Try typed resources first
|
||||
switch resource := obj.(type) {
|
||||
case *corev1.Secret:
|
||||
return extractSecretContent(resource), nil
|
||||
case *corev1.ConfigMap:
|
||||
return extractConfigMapContent(resource), nil
|
||||
default:
|
||||
// Fall back to unstructured for CRDs and unknown types
|
||||
return extractUnstructuredContent(obj)
|
||||
}
|
||||
}
|
||||
|
||||
// extractSecretContent extracts content from a Secret.
|
||||
func extractSecretContent(secret *corev1.Secret) map[string]interface{} {
|
||||
return map[string]interface{}{
|
||||
"type": string(secret.Type),
|
||||
"data": secret.Data,
|
||||
"stringData": secret.StringData,
|
||||
}
|
||||
}
|
||||
|
||||
// extractConfigMapContent extracts content from a ConfigMap.
|
||||
func extractConfigMapContent(cm *corev1.ConfigMap) map[string]interface{} {
|
||||
return map[string]interface{}{
|
||||
"data": cm.Data,
|
||||
"binaryData": cm.BinaryData,
|
||||
}
|
||||
}
|
||||
|
||||
// extractUnstructuredContent extracts content from an unstructured resource (CRDs, etc.).
|
||||
func extractUnstructuredContent(obj runtime.Object) (interface{}, error) {
|
||||
// Convert to unstructured
|
||||
unstructuredObj, err := runtime.DefaultUnstructuredConverter.ToUnstructured(obj)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to convert to unstructured: %w", err)
|
||||
}
|
||||
|
||||
u := &unstructured.Unstructured{Object: unstructuredObj}
|
||||
|
||||
// Make a deep copy to avoid race conditions when accessing nested fields
|
||||
// NestedMap modifies the underlying map, so we need our own copy
|
||||
uCopy := u.DeepCopy()
|
||||
|
||||
// Extract spec (most resources have spec)
|
||||
spec, found, err := unstructured.NestedMap(uCopy.Object, "spec")
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to extract spec: %w", err)
|
||||
}
|
||||
|
||||
content := make(map[string]interface{})
|
||||
if found {
|
||||
content["spec"] = spec
|
||||
}
|
||||
|
||||
// For resources without spec, include all fields except metadata and status
|
||||
if !found {
|
||||
for key, value := range uCopy.Object {
|
||||
if key != "metadata" && key != "status" && key != "apiVersion" && key != "kind" {
|
||||
content[key] = value
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return content, nil
|
||||
}
|
||||
|
||||
// NeedsSync determines if a target resource needs to be synced based on content changes.
|
||||
// It uses a multi-layer strategy:
|
||||
// 1. Check generation field (if available) - fastest
|
||||
// 2. Check content hash - universal
|
||||
func NeedsSync(source, target runtime.Object, targetAnnotations map[string]string) (bool, error) {
|
||||
// Layer 1: Generation-based check (for resources that support it)
|
||||
sourceGen := getGeneration(source)
|
||||
if sourceGen > 0 {
|
||||
targetSourceGen := targetAnnotations["source-generation"]
|
||||
if fmt.Sprintf("%d", sourceGen) != targetSourceGen {
|
||||
return true, nil // Generation changed
|
||||
}
|
||||
}
|
||||
|
||||
// Layer 2: Content hash check (works for all resources)
|
||||
sourceHash, err := ComputeContentHash(source)
|
||||
if err != nil {
|
||||
return false, fmt.Errorf("failed to compute source hash: %w", err)
|
||||
}
|
||||
|
||||
targetSourceHash := targetAnnotations["source-content-hash"]
|
||||
if sourceHash != targetSourceHash {
|
||||
return true, nil // Content changed
|
||||
}
|
||||
|
||||
// No changes detected
|
||||
return false, nil
|
||||
}
|
||||
|
||||
// getGeneration extracts the generation field from a resource if it exists.
|
||||
// Returns 0 if the resource doesn't have a generation field.
|
||||
func getGeneration(obj runtime.Object) int64 {
|
||||
// Convert to unstructured to access generation
|
||||
unstructuredObj, err := runtime.DefaultUnstructuredConverter.ToUnstructured(obj)
|
||||
if err != nil {
|
||||
return 0
|
||||
}
|
||||
|
||||
u := &unstructured.Unstructured{Object: unstructuredObj}
|
||||
return u.GetGeneration()
|
||||
}
|
||||
@@ -0,0 +1,529 @@
|
||||
package hash
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
)
|
||||
|
||||
func TestComputeContentHash_Secret(t *testing.T) {
|
||||
tests := []struct {
|
||||
secret1 *corev1.Secret
|
||||
secret2 *corev1.Secret
|
||||
name string
|
||||
wantSame bool
|
||||
wantError bool
|
||||
}{
|
||||
{
|
||||
name: "identical secrets produce same hash",
|
||||
secret1: &corev1.Secret{
|
||||
Data: map[string][]byte{
|
||||
"password": []byte("secret123"),
|
||||
},
|
||||
Type: corev1.SecretTypeOpaque,
|
||||
},
|
||||
secret2: &corev1.Secret{
|
||||
Data: map[string][]byte{
|
||||
"password": []byte("secret123"),
|
||||
},
|
||||
Type: corev1.SecretTypeOpaque,
|
||||
},
|
||||
wantSame: true,
|
||||
wantError: false,
|
||||
},
|
||||
{
|
||||
name: "different data produces different hash",
|
||||
secret1: &corev1.Secret{
|
||||
Data: map[string][]byte{
|
||||
"password": []byte("secret123"),
|
||||
},
|
||||
},
|
||||
secret2: &corev1.Secret{
|
||||
Data: map[string][]byte{
|
||||
"password": []byte("different"),
|
||||
},
|
||||
},
|
||||
wantSame: false,
|
||||
wantError: false,
|
||||
},
|
||||
{
|
||||
name: "different type produces different hash",
|
||||
secret1: &corev1.Secret{
|
||||
Data: map[string][]byte{"key": []byte("value")},
|
||||
Type: corev1.SecretTypeOpaque,
|
||||
},
|
||||
secret2: &corev1.Secret{
|
||||
Data: map[string][]byte{"key": []byte("value")},
|
||||
Type: corev1.SecretTypeTLS,
|
||||
},
|
||||
wantSame: false,
|
||||
wantError: false,
|
||||
},
|
||||
{
|
||||
name: "metadata changes don't affect hash",
|
||||
secret1: &corev1.Secret{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: "secret1",
|
||||
Namespace: "default",
|
||||
ResourceVersion: "100",
|
||||
Generation: 1,
|
||||
},
|
||||
Data: map[string][]byte{"key": []byte("value")},
|
||||
},
|
||||
secret2: &corev1.Secret{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: "secret2",
|
||||
Namespace: "different",
|
||||
ResourceVersion: "200",
|
||||
Generation: 2,
|
||||
},
|
||||
Data: map[string][]byte{"key": []byte("value")},
|
||||
},
|
||||
wantSame: true,
|
||||
wantError: false,
|
||||
},
|
||||
{
|
||||
name: "stringData included in hash",
|
||||
secret1: &corev1.Secret{
|
||||
StringData: map[string]string{"key": "value"},
|
||||
},
|
||||
secret2: &corev1.Secret{
|
||||
StringData: map[string]string{"key": "different"},
|
||||
},
|
||||
wantSame: false,
|
||||
wantError: false,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
hash1, err1 := ComputeContentHash(tt.secret1)
|
||||
hash2, err2 := ComputeContentHash(tt.secret2)
|
||||
|
||||
if tt.wantError {
|
||||
require.Error(t, err1)
|
||||
require.Error(t, err2)
|
||||
return
|
||||
}
|
||||
|
||||
require.NoError(t, err1)
|
||||
require.NoError(t, err2)
|
||||
assert.NotEmpty(t, hash1)
|
||||
assert.NotEmpty(t, hash2)
|
||||
|
||||
if tt.wantSame {
|
||||
assert.Equal(t, hash1, hash2, "hashes should be identical")
|
||||
} else {
|
||||
assert.NotEqual(t, hash1, hash2, "hashes should be different")
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestComputeContentHash_ConfigMap(t *testing.T) {
|
||||
tests := []struct {
|
||||
cm1 *corev1.ConfigMap
|
||||
cm2 *corev1.ConfigMap
|
||||
name string
|
||||
wantSame bool
|
||||
wantError bool
|
||||
}{
|
||||
{
|
||||
name: "identical configmaps produce same hash",
|
||||
cm1: &corev1.ConfigMap{
|
||||
Data: map[string]string{
|
||||
"config.yaml": "setting: value",
|
||||
},
|
||||
},
|
||||
cm2: &corev1.ConfigMap{
|
||||
Data: map[string]string{
|
||||
"config.yaml": "setting: value",
|
||||
},
|
||||
},
|
||||
wantSame: true,
|
||||
wantError: false,
|
||||
},
|
||||
{
|
||||
name: "different data produces different hash",
|
||||
cm1: &corev1.ConfigMap{
|
||||
Data: map[string]string{
|
||||
"key": "value1",
|
||||
},
|
||||
},
|
||||
cm2: &corev1.ConfigMap{
|
||||
Data: map[string]string{
|
||||
"key": "value2",
|
||||
},
|
||||
},
|
||||
wantSame: false,
|
||||
wantError: false,
|
||||
},
|
||||
{
|
||||
name: "binaryData included in hash",
|
||||
cm1: &corev1.ConfigMap{
|
||||
BinaryData: map[string][]byte{
|
||||
"file": []byte{0x00, 0x01, 0x02},
|
||||
},
|
||||
},
|
||||
cm2: &corev1.ConfigMap{
|
||||
BinaryData: map[string][]byte{
|
||||
"file": []byte{0x00, 0x01, 0xFF},
|
||||
},
|
||||
},
|
||||
wantSame: false,
|
||||
wantError: false,
|
||||
},
|
||||
{
|
||||
name: "metadata changes don't affect hash",
|
||||
cm1: &corev1.ConfigMap{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
ResourceVersion: "100",
|
||||
Generation: 1,
|
||||
},
|
||||
Data: map[string]string{"key": "value"},
|
||||
},
|
||||
cm2: &corev1.ConfigMap{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
ResourceVersion: "200",
|
||||
Generation: 5,
|
||||
},
|
||||
Data: map[string]string{"key": "value"},
|
||||
},
|
||||
wantSame: true,
|
||||
wantError: false,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
hash1, err1 := ComputeContentHash(tt.cm1)
|
||||
hash2, err2 := ComputeContentHash(tt.cm2)
|
||||
|
||||
if tt.wantError {
|
||||
require.Error(t, err1)
|
||||
require.Error(t, err2)
|
||||
return
|
||||
}
|
||||
|
||||
require.NoError(t, err1)
|
||||
require.NoError(t, err2)
|
||||
assert.NotEmpty(t, hash1)
|
||||
assert.NotEmpty(t, hash2)
|
||||
|
||||
if tt.wantSame {
|
||||
assert.Equal(t, hash1, hash2)
|
||||
} else {
|
||||
assert.NotEqual(t, hash1, hash2)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestComputeContentHash_Unstructured(t *testing.T) {
|
||||
tests := []struct {
|
||||
obj1 *unstructured.Unstructured
|
||||
obj2 *unstructured.Unstructured
|
||||
name string
|
||||
wantSame bool
|
||||
wantError bool
|
||||
}{
|
||||
{
|
||||
name: "identical specs produce same hash",
|
||||
obj1: &unstructured.Unstructured{
|
||||
Object: map[string]interface{}{
|
||||
"apiVersion": "v1",
|
||||
"kind": "Custom",
|
||||
"spec": map[string]interface{}{
|
||||
"field": "value",
|
||||
},
|
||||
},
|
||||
},
|
||||
obj2: &unstructured.Unstructured{
|
||||
Object: map[string]interface{}{
|
||||
"apiVersion": "v1",
|
||||
"kind": "Custom",
|
||||
"spec": map[string]interface{}{
|
||||
"field": "value",
|
||||
},
|
||||
},
|
||||
},
|
||||
wantSame: true,
|
||||
wantError: false,
|
||||
},
|
||||
{
|
||||
name: "different specs produce different hash",
|
||||
obj1: &unstructured.Unstructured{
|
||||
Object: map[string]interface{}{
|
||||
"spec": map[string]interface{}{
|
||||
"field": "value1",
|
||||
},
|
||||
},
|
||||
},
|
||||
obj2: &unstructured.Unstructured{
|
||||
Object: map[string]interface{}{
|
||||
"spec": map[string]interface{}{
|
||||
"field": "value2",
|
||||
},
|
||||
},
|
||||
},
|
||||
wantSame: false,
|
||||
wantError: false,
|
||||
},
|
||||
{
|
||||
name: "metadata excluded from hash",
|
||||
obj1: &unstructured.Unstructured{
|
||||
Object: map[string]interface{}{
|
||||
"metadata": map[string]interface{}{
|
||||
"resourceVersion": "100",
|
||||
},
|
||||
"spec": map[string]interface{}{
|
||||
"field": "value",
|
||||
},
|
||||
},
|
||||
},
|
||||
obj2: &unstructured.Unstructured{
|
||||
Object: map[string]interface{}{
|
||||
"metadata": map[string]interface{}{
|
||||
"resourceVersion": "200",
|
||||
},
|
||||
"spec": map[string]interface{}{
|
||||
"field": "value",
|
||||
},
|
||||
},
|
||||
},
|
||||
wantSame: true,
|
||||
wantError: false,
|
||||
},
|
||||
{
|
||||
name: "status excluded from hash",
|
||||
obj1: &unstructured.Unstructured{
|
||||
Object: map[string]interface{}{
|
||||
"spec": map[string]interface{}{
|
||||
"field": "value",
|
||||
},
|
||||
"status": map[string]interface{}{
|
||||
"condition": "Ready",
|
||||
},
|
||||
},
|
||||
},
|
||||
obj2: &unstructured.Unstructured{
|
||||
Object: map[string]interface{}{
|
||||
"spec": map[string]interface{}{
|
||||
"field": "value",
|
||||
},
|
||||
"status": map[string]interface{}{
|
||||
"condition": "NotReady",
|
||||
},
|
||||
},
|
||||
},
|
||||
wantSame: true,
|
||||
wantError: false,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
hash1, err1 := ComputeContentHash(tt.obj1)
|
||||
hash2, err2 := ComputeContentHash(tt.obj2)
|
||||
|
||||
if tt.wantError {
|
||||
require.Error(t, err1)
|
||||
require.Error(t, err2)
|
||||
return
|
||||
}
|
||||
|
||||
require.NoError(t, err1)
|
||||
require.NoError(t, err2)
|
||||
assert.NotEmpty(t, hash1)
|
||||
assert.NotEmpty(t, hash2)
|
||||
|
||||
if tt.wantSame {
|
||||
assert.Equal(t, hash1, hash2)
|
||||
} else {
|
||||
assert.NotEqual(t, hash1, hash2)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestNeedsSync(t *testing.T) {
|
||||
tests := []struct {
|
||||
source runtime.Object
|
||||
target runtime.Object
|
||||
targetAnnotations map[string]string
|
||||
name string
|
||||
want bool
|
||||
wantError bool
|
||||
}{
|
||||
{
|
||||
name: "needs sync when generation changed",
|
||||
source: &unstructured.Unstructured{
|
||||
Object: map[string]interface{}{
|
||||
"metadata": map[string]interface{}{
|
||||
"generation": int64(5),
|
||||
},
|
||||
"spec": map[string]interface{}{
|
||||
"field": "value",
|
||||
},
|
||||
},
|
||||
},
|
||||
target: &unstructured.Unstructured{},
|
||||
targetAnnotations: map[string]string{
|
||||
"source-generation": "3",
|
||||
"source-content-hash": "abc123",
|
||||
},
|
||||
want: true,
|
||||
wantError: false,
|
||||
},
|
||||
{
|
||||
name: "doesn't need sync when generation same and hash same",
|
||||
source: &corev1.Secret{
|
||||
Data: map[string][]byte{"key": []byte("value")},
|
||||
},
|
||||
target: &corev1.Secret{},
|
||||
targetAnnotations: map[string]string{
|
||||
"source-generation": "0",
|
||||
"source-content-hash": mustComputeHash(t, &corev1.Secret{Data: map[string][]byte{"key": []byte("value")}}),
|
||||
},
|
||||
want: false,
|
||||
wantError: false,
|
||||
},
|
||||
{
|
||||
name: "needs sync when content hash changed",
|
||||
source: &corev1.ConfigMap{
|
||||
Data: map[string]string{"key": "newvalue"},
|
||||
},
|
||||
target: &corev1.ConfigMap{},
|
||||
targetAnnotations: map[string]string{
|
||||
"source-content-hash": "oldhash",
|
||||
},
|
||||
want: true,
|
||||
wantError: false,
|
||||
},
|
||||
{
|
||||
name: "needs sync when no previous hash",
|
||||
source: &corev1.Secret{
|
||||
Data: map[string][]byte{"key": []byte("value")},
|
||||
},
|
||||
target: &corev1.Secret{},
|
||||
targetAnnotations: map[string]string{},
|
||||
want: true,
|
||||
wantError: false,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
got, err := NeedsSync(tt.source, tt.target, tt.targetAnnotations)
|
||||
|
||||
if tt.wantError {
|
||||
require.Error(t, err)
|
||||
return
|
||||
}
|
||||
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, tt.want, got)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestGetGeneration(t *testing.T) {
|
||||
tests := []struct {
|
||||
obj runtime.Object
|
||||
name string
|
||||
want int64
|
||||
}{
|
||||
{
|
||||
name: "returns generation for resource with generation",
|
||||
obj: &unstructured.Unstructured{
|
||||
Object: map[string]interface{}{
|
||||
"metadata": map[string]interface{}{
|
||||
"generation": int64(42),
|
||||
},
|
||||
},
|
||||
},
|
||||
want: 42,
|
||||
},
|
||||
{
|
||||
name: "returns 0 for resource without generation",
|
||||
obj: &corev1.Secret{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: "test",
|
||||
},
|
||||
},
|
||||
want: 0,
|
||||
},
|
||||
{
|
||||
name: "returns 0 for nil metadata",
|
||||
obj: &unstructured.Unstructured{
|
||||
Object: map[string]interface{}{},
|
||||
},
|
||||
want: 0,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
got := getGeneration(tt.obj)
|
||||
assert.Equal(t, tt.want, got)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// Helper function to compute hash for test setup
|
||||
func mustComputeHash(t *testing.T, obj runtime.Object) string {
|
||||
t.Helper()
|
||||
hash, err := ComputeContentHash(obj)
|
||||
require.NoError(t, err)
|
||||
return hash
|
||||
}
|
||||
|
||||
// Benchmark tests
|
||||
func BenchmarkComputeContentHash_Secret(b *testing.B) {
|
||||
secret := &corev1.Secret{
|
||||
Data: map[string][]byte{
|
||||
"password": []byte("secret123"),
|
||||
"username": []byte("admin"),
|
||||
},
|
||||
Type: corev1.SecretTypeOpaque,
|
||||
}
|
||||
|
||||
b.ResetTimer()
|
||||
for i := 0; i < b.N; i++ {
|
||||
_, _ = ComputeContentHash(secret)
|
||||
}
|
||||
}
|
||||
|
||||
func BenchmarkComputeContentHash_ConfigMap(b *testing.B) {
|
||||
cm := &corev1.ConfigMap{
|
||||
Data: map[string]string{
|
||||
"config.yaml": "setting: value\nother: data",
|
||||
},
|
||||
}
|
||||
|
||||
b.ResetTimer()
|
||||
for i := 0; i < b.N; i++ {
|
||||
_, _ = ComputeContentHash(cm)
|
||||
}
|
||||
}
|
||||
|
||||
func BenchmarkNeedsSync(b *testing.B) {
|
||||
source := &corev1.Secret{
|
||||
Data: map[string][]byte{"key": []byte("value")},
|
||||
}
|
||||
target := &corev1.Secret{}
|
||||
hash, _ := ComputeContentHash(source)
|
||||
annotations := map[string]string{
|
||||
"source-content-hash": hash,
|
||||
}
|
||||
|
||||
b.ResetTimer()
|
||||
for i := 0; i < b.N; i++ {
|
||||
_, _ = NeedsSync(source, target, annotations)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user