Rewrite/resource verification

[Tanker2020]

Summary

Ports the Python oper8 resource verification layer to Go. Provides VerifyResource — the single entry point that fetches an object's current state and decides whether it is ready — along with built-in verifiers for the four standard Kubernetes workload kinds and a subsystem verifier for nested oper8-managed CRs.

Files changed:

• rewrite/verify/verify.go — VerifyFunc, VerifyOptions, VerifyResource, internal condition helpers
• rewrite/verify/builtin.go — VerifyPod, VerifyJob, VerifyDeployment, VerifyStatefulSet, VerifySubsystem
• rewrite/verify/verify_test.go — 42 table-driven tests
• .github/workflows/pr4-verify.yml — CI

Depends on: PR-2 (deploymanager/) for DeployManager.Get(), PR-3 (status/) for ConditionReady, ConditionUpdating, TimestampKey, GetVersion. This PR is stacked on the PR-3 branch but all four packages compile and test cleanly when merged in any order.

---

What was ported

Python	Go equivalent
verify_resources.py — verify_resource()	verify.VerifyResource(ctx, dm, apiVersion, kind, name, opts)
verify_resources.py — verify_pod()	verify.VerifyPod(objectState)
verify_resources.py — verify_job()	verify.VerifyJob(objectState)
verify_resources.py — verify_deployment()	verify.VerifyDeployment(objectState)
verify_resources.py — verify_statefulset()	verify.VerifyStatefulSet(objectState)
verify_resources.py — verify_subsystem()	verify.VerifySubsystem(objectState, desiredVersion)
_resource_verifiers module dict	kindVerifiers package map + Register()
_verify_condition	internal verifyCondition()
_check_condition	internal checkCondition()

---

Design decisions

session.get_object_current_state() → dm.Get(ctx, ...)

Python's verify_resource took a session object and called session.get_object_current_state(kind, name, api_version, namespace). The session abstraction doesn't exist yet in the Go port (PR-5). VerifyResource takes a DeployManager directly and calls dm.Get() — it is context-aware and testable with DryRunDeployManager in isolation.

_SESSION_NAMESPACE sentinel → explicit Namespace field

Python used a _SESSION_NAMESPACE sentinel default to distinguish "use session namespace" from "non-namespaced resource (pass None)". Go replaces this with an explicit opts.Namespace string. Callers pass the namespace they want; the zero value ("") means cluster-scoped (non-namespaced).

_resource_verifiers module dict → Register() + init()

Python populated a module-level dict at import time. Go uses an explicit Register(kind, fn) function called from builtin.go's init(). This is safe under -race (init runs once before main), makes the registry extensible by callers without package modification, and avoids hidden global state mutation.

dateutil.parser → time.Parse(time.RFC3339)

Python used dateutil.parser.parse() for timestamp sorting, which accepts many formats. Go uses time.Parse(time.RFC3339) — the only format Kubernetes actually writes. Invalid or missing timestamps fall back to time.Unix(0, 0) (epoch), matching Python's datetime.fromtimestamp(0) fallback.

Bug fix: raw bool status values

Python's _check_condition handled three cases for the condition status field:

1. String "True"/"False" (standard Kubernetes)
2. Any other string — case-insensitive compare
3. Raw bool — bool(obj_status) == expected_status

The initial Go port did condition["status"].(string) which silently returns "" for a raw bool value, causing the function to incorrectly return false. Fixed with a type switch: case bool → direct compare, case string → strings.EqualFold(v, "true") == expectedStatus.

---

Test coverage (42 tests)

Area	Tests
VerifyResource integration (via DryRunDeployManager)	not found, no verifier (present=verified), custom condition type true/false, per-call VerifyFunc, kind registry (Pod/Job/Deployment/StatefulSet), latest condition wins (timestamp sort), IsSubsystem flag
VerifyPod	Ready=True, Ready=False, no conditions
VerifyJob	Complete=True, Complete=False, no status
VerifyDeployment	Available+Progressing(correct reason), wrong reason, only Available, no conditions
VerifyStatefulSet	replicas==readyReplicas, partial ready, no replicas, nil status
VerifySubsystem	version matches, version mismatch, version not yet set, Updating=True, Ready=False, no desiredVersion
Python-parity edge cases	bool status=true, bool status=false, non-bool string ("NotABool"→false), missing status key

All tests run with -race.