zalando-incubator / kube-ingress-aws-controller / 37441790374

71%

master: 71%

push

github

worker: keep and refresh stacks with expired certificate TTLs while ingresses are assigned (#817)

Fixes #816

A stack whose certificate TTL tags have all expired was always handled
as `delete`, even when
ingresses were assigned to it in the current model. If the deletion
failed, the controller retried
it forever and never updated the ingresses' load balancer status. If it
succeeded, a load balancer
with live traffic was deleted.

Changes:

- `Status()` returns `delete` only when no ingress is assigned. A stack
with ingresses goes through
the normal update path, which writes a zero TTL for the certificates in
use.
- Before matching, `inUseFirst` moves the load balancers that ingresses
currently point to (their
status hostname) to the front and keeps the `sortStacks` order
otherwise. Without this, all
ingresses would be matched to the idle stack that sorts first by name,
and DNS would move to it.
Whether an ingress fits a load balancer is still decided by
`addIngress`.
- Keeping a stack that is marked for deletion is not expected, so it is
reported: the controller
logs a warning and increments
`kube_ingress_aws_controller_deletion_blocked_total`
  (alert with `increase(...[1h]) > 0`).

Behaviour change: among stacks that can take an ingress, the ones that
ingresses currently point to
are tried first. Previously the order came only from `sortStacks`
(certificate count, then name).

Tests: `TestExpiredCertTTLStacksWithIngresses` builds the model for two
shared stacks with the
same, expired certificates, one existing ingress (status points to the
stack that sorts second)
and one new ingress. It fails on `master` (both ingresses land on the
other stack) and passes with
this change. `TestInUseFirstKeepsOrderWithoutStatus` covers the
ordering. `go test ./...` passes.
Also tested on an EKS lab cluster (see comments).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01Q9yx9H3zxVNBsWGxJ4U2UW

---------

Signed-off-... (continued)

32 of 37 new or added lines in 2 files covered. (86.49%)

2728 of 3818 relevant lines covered (71.45%)

11.49 hits per line