Fix readiness probe command argument handling

pkg/common/utils/resource/pod.go

@@ -108,48 +108,59 @@ var (
 )
 
 func buildFQDNReadinessExecProbe(enableTLS string, config map[string]interface{}, port int32, path string) *corev1.Probe {
-	host := "$(hostname -f)"
-	var curlCmd string
+	const dnsCheck = `host="$(hostname -f)"; (getent hosts "$host" >/dev/null 2>&1 || nslookup "$host" >/dev/null 2>&1) && `
+
+	var command []string
 	if enableTLS == "true" {
 		caCert := GetString(config, TLS_CA_CERTIFICATE_PATH_KEY)
 		clientCert := GetString(config, TLS_CERTIFICATE_PATH_KEY)
 		clientKey := GetString(config, TLS_PRIVATE_KEY_PATH_KEY)
-		curlCmd = fmt.Sprintf(
-			"host=%s; (getent hosts \"$host\" >/dev/null 2>&1 || nslookup \"$host\" >/dev/null 2>&1) && curl --fail --silent --output /dev/null --cacert %s --cert %s --key %s https://$host:%d%s",
-			host, caCert, clientCert, clientKey, port, path,
-		)
+		command = []string{
+			"bash", "-c",
+			dnsCheck + `curl --fail --silent --output /dev/null --cacert "$1" --cert "$2" --key "$3" "https://${host}:${4}${5}"`,
+			"doris-readiness-probe",
+			caCert,
+			clientCert,
+			clientKey,
+			strconv.Itoa(int(port)),
+			path,
+		}
 	} else {
-		curlCmd = fmt.Sprintf(
-			"host=%s; (getent hosts \"$host\" >/dev/null 2>&1 || nslookup \"$host\" >/dev/null 2>&1) && curl --fail --silent --output /dev/null http://$host:%d%s",
-			host, port, path,
-		)
+		command = []string{
+			"bash", "-c",
+			dnsCheck + `curl --fail --silent --output /dev/null "http://${host}:${1}${2}"`,
+			"doris-readiness-probe",
+			strconv.Itoa(int(port)),
+			path,
+		}
 	}
 
-	return &corev1.Probe{
-		PeriodSeconds:    5,
-		FailureThreshold: 3,
-		ProbeHandler: corev1.ProbeHandler{
-			Exec: &corev1.ExecAction{
-				Command: []string{"bash", "-c", curlCmd},
-			},
-		},
-	}
+	return newReadinessExecProbe(command)
 }
 
 func buildTLSReadinessExecProbe(config map[string]interface{}, port int32, path string) *corev1.Probe {
 	caCert := GetString(config, TLS_CA_CERTIFICATE_PATH_KEY)
 	clientCert := GetString(config, TLS_CERTIFICATE_PATH_KEY)
 	clientKey := GetString(config, TLS_PRIVATE_KEY_PATH_KEY)
-	curlCmd := fmt.Sprintf(
-		"curl --fail --silent --output /dev/null --cacert %s --cert %s --key %s https://localhost:%d%s",
-		caCert, clientCert, clientKey, port, path,
-	)
+	command := []string{
+		"curl",
+		"--fail", "--silent", "--output", "/dev/null",
+		"--cacert", caCert,
+		"--cert", clientCert,
+		"--key", clientKey,
+		fmt.Sprintf("https://localhost:%d%s", port, path),
+	}
+
+	return newReadinessExecProbe(command)
+}
+
+func newReadinessExecProbe(command []string) *corev1.Probe {
 	return &corev1.Probe{
 		PeriodSeconds:    5,
 		FailureThreshold: 3,
 		ProbeHandler: corev1.ProbeHandler{
 			Exec: &corev1.ExecAction{
-				Command: []string{"bash", "-c", curlCmd},
+				Command: command,
 			},
 		},
 	}

pkg/common/utils/resource/pod_test.go

@@ -18,12 +18,15 @@
 package resource
 
 import (
+	"reflect"
+	"strings"
+	"testing"
+
 	dv1 "github.com/apache/doris-operator/api/disaggregated/v1"
 	v1 "github.com/apache/doris-operator/api/doris/v1"
 	corev1 "k8s.io/api/core/v1"
 	kr "k8s.io/apimachinery/pkg/api/resource"
 	"k8s.io/utils/pointer"
-	"testing"
 )
 
 func Test_NewPodTemplateSpec(t *testing.T) {
@@ -151,6 +154,70 @@ func Test_NewBaseMainContainer_ImagePullPolicy(t *testing.T) {
 	}
 }
 
+func TestBuildTLSReadinessExecProbeUsesCommandArguments(t *testing.T) {
+	config := map[string]interface{}{
+		TLS_CA_CERTIFICATE_PATH_KEY: "/etc/doris/tls/ca cert.pem",
+		TLS_CERTIFICATE_PATH_KEY:    "/etc/doris/tls/client;cert.pem",
+		TLS_PRIVATE_KEY_PATH_KEY:    "/etc/doris/tls/client$key.pem",
+	}
+
+	probe := buildTLSReadinessExecProbe(config, 8030, HEALTH_API_PATH)
+	want := []string{
+		"curl",
+		"--fail", "--silent", "--output", "/dev/null",
+		"--cacert", config[TLS_CA_CERTIFICATE_PATH_KEY].(string),
+		"--cert", config[TLS_CERTIFICATE_PATH_KEY].(string),
+		"--key", config[TLS_PRIVATE_KEY_PATH_KEY].(string),
+		"https://localhost:8030/api/health",
+	}
+
+	if !reflect.DeepEqual(probe.Exec.Command, want) {
+		t.Fatalf("unexpected command: got %#v, want %#v", probe.Exec.Command, want)
+	}
+}
+
+func TestBuildFQDNReadinessExecProbePassesTLSPathsAsArguments(t *testing.T) {
+	config := map[string]interface{}{
+		TLS_CA_CERTIFICATE_PATH_KEY: "/etc/doris/tls/ca cert.pem",
+		TLS_CERTIFICATE_PATH_KEY:    "/etc/doris/tls/client;cert.pem",
+		TLS_PRIVATE_KEY_PATH_KEY:    "/etc/doris/tls/client$key.pem",
+	}
+
+	probe := buildFQDNReadinessExecProbe("true", config, 8030, HEALTH_API_PATH)
+	command := probe.Exec.Command
+	if len(command) != 9 {
+		t.Fatalf("unexpected command length: got %d, command %#v", len(command), command)
+	}
+	if command[0] != "bash" || command[1] != "-c" {
+		t.Fatalf("unexpected command prefix: %#v", command[:2])
+	}
+	for _, key := range []string{TLS_CA_CERTIFICATE_PATH_KEY, TLS_CERTIFICATE_PATH_KEY, TLS_PRIVATE_KEY_PATH_KEY} {
+		if strings.Contains(command[2], config[key].(string)) {
+			t.Fatalf("script contains the value for %s: %q", key, command[2])
+		}
+	}
+	wantArgs := []string{
+		"doris-readiness-probe",
+		config[TLS_CA_CERTIFICATE_PATH_KEY].(string),
+		config[TLS_CERTIFICATE_PATH_KEY].(string),
+		config[TLS_PRIVATE_KEY_PATH_KEY].(string),
+		"8030",
+		HEALTH_API_PATH,
+	}
+	if !reflect.DeepEqual(command[3:], wantArgs) {
+		t.Fatalf("unexpected script arguments: got %#v, want %#v", command[3:], wantArgs)
+	}
+}
+
+func TestBuildFQDNReadinessExecProbeWithoutTLSUsesArguments(t *testing.T) {
+	probe := buildFQDNReadinessExecProbe("false", nil, 8040, HEALTH_API_PATH)
+	wantArgs := []string{"doris-readiness-probe", "8040", HEALTH_API_PATH}
+
+	if !reflect.DeepEqual(probe.Exec.Command[3:], wantArgs) {
+		t.Fatalf("unexpected script arguments: got %#v, want %#v", probe.Exec.Command[3:], wantArgs)
+	}
+}
+
 func Test_LifeCycleWithPreStopScript(t *testing.T) {
 	lcs := []*corev1.Lifecycle{nil, {}}
 	for i, _ := range lcs {