fix: reconcile sandbox preview reference grants

Author: cwilhit

Tiltfile.cluster

@@ -931,8 +931,20 @@ local_resource(
     # KRO_KUBECONFIG points at the kind cluster's host kubeconfig (where kro is).
     serve_cmd=('KRO_KUBECONFIG={kro} INFRASTRUCTURE_KUBECONFIG={kc} ' +
                'INFRASTRUCTURE_WORKSPACE_PATH=root:kedge:providers:infrastructure ' +
+               'KEDGE_SANDBOX_PREVIEW_BASE_DOMAIN={preview_domain} ' +
+               'KEDGE_SANDBOX_PREVIEW_HTTPROUTE_PARENT_GATEWAY_NAME={preview_gateway} ' +
+               'KEDGE_SANDBOX_PREVIEW_HTTPROUTE_PARENT_GATEWAY_NAMESPACE=envoy-gateway-system ' +
+               'KEDGE_SANDBOX_PREVIEW_HTTPROUTE_PARENT_GATEWAY_SECTION_NAME={preview_listener} ' +
+               'KEDGE_SANDBOX_PREVIEW_BACKEND_NAMESPACE={preview_namespace} ' +
+               'KEDGE_SANDBOX_PREVIEW_BACKEND_SERVICE_NAME={preview_backend} ' +
+               'KEDGE_SANDBOX_PREVIEW_BACKEND_SERVICE_PORT=8080 ' +
                'make run-provider-infrastructure').format(
-                   kro=KIND_HOST_KUBECONFIG, kc=KCP_ADMIN_KUBECONFIG),
+                   kro=KIND_HOST_KUBECONFIG, kc=KCP_ADMIN_KUBECONFIG,
+                   preview_domain=app_studio_preview_base_domain,
+                   preview_gateway=app_studio_preview_parent_gateway_name,
+                   preview_listener=app_studio_preview_listener,
+                   preview_namespace=app_studio_preview_namespace,
+                   preview_backend=app_studio_preview_gateway_name),
     deps=[
         'providers/infrastructure/main.go',
         'providers/infrastructure/heartbeat.go',

providers/infrastructure/dataplane/handler.go

@@ -52,15 +52,31 @@ type InstanceGetter interface {
 // target via the template contract, and reverse-proxies to the runtime cluster
 // the provider owns. Consumers therefore never hold a runtime credential.
 type Handler struct {
-	instances InstanceGetter
-	contracts ContractGetter
-	runtime   Runtime
+	instances     InstanceGetter
+	contracts     ContractGetter
+	runtime       Runtime
+	previewRoutes PreviewRouteEnsurer
+}
+
+// HandlerOption customizes the data-plane handler.
+type HandlerOption func(*Handler)
+
+// WithPreviewRouteManager installs the infrastructure-owned preview route
+// reconciler. It is only used for SandboxRunner proxy requests.
+func WithPreviewRouteManager(manager PreviewRouteEnsurer) HandlerOption {
+	return func(h *Handler) {
+		h.previewRoutes = manager
+	}
 }
 
 // NewHandler wires the handler. Any nil dependency makes the data plane report
 // 503 (the serve process runs without a runtime/kcp config in dev).
-func NewHandler(instances InstanceGetter, contracts ContractGetter, runtime Runtime) *Handler {
-	return &Handler{instances: instances, contracts: contracts, runtime: runtime}
+func NewHandler(instances InstanceGetter, contracts ContractGetter, runtime Runtime, opts ...HandlerOption) *Handler {
+	h := &Handler{instances: instances, contracts: contracts, runtime: runtime}
+	for _, opt := range opts {
+		opt(h)
+	}
+	return h
 }
 
 // request is the parsed addressing of a data-plane call.
@@ -127,6 +143,13 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if h.previewRoutes != nil && req.resource == "sandboxrunners" && req.verb == "proxy" {
+		if err := h.previewRoutes.Ensure(r.Context(), instance); err != nil {
+			http.Error(w, err.Error(), http.StatusServiceUnavailable)
+			return
+		}
+	}
+
 	// 5b. Reverse-proxy to the runtime Service the provider owns.
 	serveProxy(w, r, h.runtime, target, req.callerPath)
 }

providers/infrastructure/dataplane/handler_test.go

@@ -18,6 +18,7 @@ package dataplane
 
 import (
 	"context"
+	"errors"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -77,6 +78,19 @@ func (f *fakeRuntime) ControlToken(_ context.Context, namespace, name string) (s
 	return f.token, nil
 }
 
+type fakePreviewRouteManager struct {
+	err error
+
+	calls int
+	got   *unstructured.Unstructured
+}
+
+func (f *fakePreviewRouteManager) Ensure(_ context.Context, instance *unstructured.Unstructured) error {
+	f.calls++
+	f.got = instance
+	return f.err
+}
+
 func newTestHandler(t *testing.T, ig *fakeInstanceGetter, rt *fakeRuntime) *Handler {
 	t.Helper()
 	return NewHandler(ig, &fakeContractGetter{contract: sandboxRunnerContract()}, rt)
@@ -154,6 +168,61 @@ func TestHandlerProxyVerbAppendsCallerPath(t *testing.T) {
 	}
 }
 
+func TestHandlerEnsuresPreviewRouteBeforeProxyingSandboxPreview(t *testing.T) {
+	var gotPath string
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+	}))
+	defer upstream.Close()
+
+	manager := &fakePreviewRouteManager{}
+	h := NewHandler(
+		&fakeInstanceGetter{instance: runnerInstance(testNamespace)},
+		&fakeContractGetter{contract: sandboxRunnerContract()},
+		&fakeRuntime{host: upstream.URL},
+		WithPreviewRouteManager(manager),
+	)
+	rec := doRequest(h, http.MethodGet, dataplaneURL("proxy")+"/assets/app.js")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rec.Code)
+	}
+	if manager.calls != 1 {
+		t.Fatalf("preview route ensure calls = %d, want 1", manager.calls)
+	}
+	if manager.got == nil || manager.got.GetName() != "kedge-sandbox-a1c31ddaaaa007d4" {
+		t.Fatalf("preview route manager got instance %#v", manager.got)
+	}
+	if gotPath == "" {
+		t.Fatal("request was not proxied after preview route ensure")
+	}
+}
+
+func TestHandlerReportsPreviewRouteNotReady(t *testing.T) {
+	h := NewHandler(
+		&fakeInstanceGetter{instance: runnerInstance(testNamespace)},
+		&fakeContractGetter{contract: sandboxRunnerContract()},
+		&fakeRuntime{host: "http://unused"},
+		WithPreviewRouteManager(&fakePreviewRouteManager{err: previewRouteNotReady("waiting for ResolvedRefs")}),
+	)
+	rec := doRequest(h, http.MethodGet, dataplaneURL("proxy"))
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Fatalf("status = %d, want 503", rec.Code)
+	}
+}
+
+func TestHandlerFailsClosedWhenPreviewRouteValidationFails(t *testing.T) {
+	h := NewHandler(
+		&fakeInstanceGetter{instance: runnerInstance(testNamespace)},
+		&fakeContractGetter{contract: sandboxRunnerContract()},
+		&fakeRuntime{host: "http://unused"},
+		WithPreviewRouteManager(&fakePreviewRouteManager{err: errors.New("unexpected backend")}),
+	)
+	rec := doRequest(h, http.MethodGet, dataplaneURL("proxy"))
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Fatalf("status = %d, want 503", rec.Code)
+	}
+}
+
 func TestHandlerStatusVerbServedFromCR(t *testing.T) {
 	h := newTestHandler(t, &fakeInstanceGetter{instance: runnerInstance(testNamespace)}, &fakeRuntime{host: "http://unused"})
 	rec := doRequest(h, http.MethodGet, dataplaneURL("status"))