Local environment for testing IPAM against a real Milo control plane#49
Draft
scotwells wants to merge 1 commit into
Draft
Local environment for testing IPAM against a real Milo control plane#49scotwells wants to merge 1 commit into
scotwells wants to merge 1 commit into
Conversation
Adds a reusable local integration environment that runs the IPAM apiserver wired to a real, in-cluster Milo control plane, so the full IPAM<->Milo path can be exercised end-to-end: delegated authn/authz, quota enforcement, and the entitlement -> grant -> claim chain. This is the path the standalone e2e (--enable-quota=false, no Milo) cannot cover. Artifacts: - config/overlays/milo-integration/ — additive IPAM overlay (quota ON, all three delegation kubeconfig flags pointed at the in-cluster milo-apiserver via a Secret, NetworkPolicy egress to milo-system:6443). Dev/test-infra overlays are untouched. - config/overlays/milo-integration/quota/ — quota.miloapis.com primitives applied to Milo (ResourceRegistration + ClaimCreationPolicy + GrantCreationPolicy) that register the IPAM quotable type and auto-create the per-project grant/bucket/claim. Reproduces what the services.miloapis.com catalog API would do — this Milo build ships only the raw quota primitives. - config/overlays/milo-integration/rbac-tenant-user.yaml — Milo RBAC for the impersonated tenant user (IPAM delegates authz to Milo). - Taskfile milo-integration:up (+ deploy-milo / deploy-ipam / provision-quota). - docs/milo-integration.md — how to run it, the full-claim walkthrough, what it covers vs the standalone e2e, and known issues. Verified end-to-end: an impersonated project-scoped IPClaim binds synchronously (status.allocatedCIDR set) AND quota is enforced — a ResourceClaim is GRANTED (reason QuotaAvailable) and the project AllowanceBucket decrements (alloc 1/100). No Go changes; internal/allocation/ stays zero-dep and the forbidden-import rules are intact. No CI workflow changes (follow-up). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
scotwells
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
A reusable local environment that runs IPAM against a real, in-cluster Milo control plane, so we can exercise the full path the standalone e2e can't: delegated authn/authz, quota enforcement, and entitlement → grant → claim — on a single kind cluster.
It proves a project-scoped
IPClaimboth binds synchronously and is genuinely quota-enforced (a MiloResourceClaimis granted, and the project'sAllowanceBucketdecrements):What's here
config/overlays/milo-integration/— additive overlay that turns on quota + Milo delegation (dev/test-infra overlays untouched), plus the quota primitives applied to Milo, tenant RBAC,task milo-integration:up, anddocs/milo-integration.md(walkthrough + coverage vs the standalone e2e).Notes for reviewers
milo-controller-manager(no separate services-controller-manager in dev); this Milo build ships only rawquota.miloapis.comprimitives, so the overlay reproduces the service-catalog effect directly.requestInfo.name; an intermittent concurrent-map-write on the claim path.Scope
Env/config only — no Go changes;
internal/allocation/stays zero-dep. No CI wiring yet. Draft: review the dev-token Secret approach before reuse against a shared Milo.