fix(tunnel): make hostname add idempotent for already-bound hosts

[bussyjd]

Problem

obol tunnel hostname add <existing-host> was not idempotent. When the hostname was already tracked on the tunnel, AddHostname returned an error (%s is already a tunnel hostname; nothing to do) and exited 1 before reaching the storefront catch-all re-render.

That short-circuit is especially harmful for the retry path used by obol tunnel hostname add <host> --offer <ns>/<name>: the CLI binds ServiceOffer.spec.hostname first so that CreateStorefront can skip offer-bound hosts from the storefront catch-all. If AddHostname is re-run for a hostname that is already bound (idempotent retry), the early error means the catch-all is never re-swept. A stale catch-all route can keep shadowing the offer's dedicated-origin route — Gateway API breaks the PathPrefix=/ tie by route age.

Fix

Treat "already present" as an idempotent success:

1. Detect the hostname is already in st.HostnameSet() (normalized match, including mixed-case input).
2. Still call CreateStorefront(cfg, existing...) over the current set so the catch-all is re-rendered and skips any hostnames that have since become offer-bound.
3. Print a no-op success message and return HostnameMutationResult{Action: "unchanged", ...} with exit 0.

No new sweep function: the duplicate path reuses the same CreateStorefront call the normal success path already uses. CreateStorefront continues to fail open (warn only) when kubectl/cluster access is unavailable.

Diagram

flowchart TD
A["tunnel hostname add host"] --> B{"already bound?"}
B -->|yes| C["CreateStorefront over current set<br/>skips offer-bound hosts"]
C --> D["idempotent success<br/>Action=unchanged, exit 0"]
B -->|no| E["normal add path"]
E --> F["route DNS / render ingress"]
F --> G["CreateStorefront over updated set"]
G --> H["persist state"]
H --> I["success<br/>Action=added"]

Loading

Validation

gofmt -l internal/tunnel/hostnames.go internal/tunnel/hostnames_test.go
go build ./...
go test ./internal/tunnel/... -count=1

Actual output:

ok github.com/ObolNetwork/obol-stack/internal/tunnel	1.306s

• gofmt -l printed nothing (both files already formatted).
• go build ./... succeeded with no output.
• go test ./internal/tunnel/... -count=1 passed.

---

https://claude.ai/code/session_01PnhCQLz7CHuDBUhWd5xF8v

[bussyjd]

Problem

obol tunnel hostname add <existing-host> was not idempotent. When the hostname was already tracked on the tunnel, AddHostname returned an error (%s is already a tunnel hostname; nothing to do) and exited 1 before reaching the storefront catch-all re-render.

That short-circuit is especially harmful for the retry path used by obol tunnel hostname add <host> --offer <ns>/<name>: the CLI binds ServiceOffer.spec.hostname first so that CreateStorefront can skip offer-bound hosts from the storefront catch-all. If AddHostname is re-run for a hostname that is already bound (idempotent retry), the early error means the catch-all is never re-swept. A stale catch-all route can keep shadowing the offer's dedicated-origin route — Gateway API breaks the PathPrefix=/ tie by route age.

Fix

Treat "already present" as an idempotent success:

1. Detect the hostname is already in st.HostnameSet() (normalized match, including mixed-case input).
2. Still call CreateStorefront(cfg, existing...) over the current set so the catch-all is re-rendered and skips any hostnames that have since become offer-bound.
3. Print a no-op success message and return HostnameMutationResult{Action: "unchanged", ...} with exit 0.

No new sweep function: the duplicate path reuses the same CreateStorefront call the normal success path already uses. CreateStorefront continues to fail open (warn only) when kubectl/cluster access is unavailable.

Diagram

flowchart TD
A["tunnel hostname add host"] --> B{"already bound?"}
B -->|yes| C["CreateStorefront over current set<br/>skips offer-bound hosts"]
C --> D["idempotent success<br/>Action=unchanged, exit 0"]
B -->|no| E["normal add path"]
E --> F["route DNS / render ingress"]
F --> G["CreateStorefront over updated set"]
G --> H["persist state"]
H --> I["success<br/>Action=added"]

Loading

Validation

gofmt -l internal/tunnel/hostnames.go internal/tunnel/hostnames_test.go
go build ./...
go test ./internal/tunnel/... -count=1

Actual output:

ok github.com/ObolNetwork/obol-stack/internal/tunnel	1.306s

• gofmt -l printed nothing (both files already formatted).
• go build ./... succeeded with no output.
• go test ./internal/tunnel/... -count=1 passed.

---

https://claude.ai/code/session_01PnhCQLz7CHuDBUhWd5xF8v

[bussyjd]

Problem

obol tunnel hostname add <existing-host> was not idempotent. When the hostname was already tracked on the tunnel, AddHostname returned an error (%s is already a tunnel hostname; nothing to do) and exited 1 before reaching the storefront catch-all re-render.

That short-circuit is especially harmful for the retry path used by obol tunnel hostname add <host> --offer <ns>/<name>: the CLI binds ServiceOffer.spec.hostname first so that CreateStorefront can skip offer-bound hosts from the storefront catch-all. If AddHostname is re-run for a hostname that is already bound (idempotent retry), the early error means the catch-all is never re-swept. A stale catch-all route can keep shadowing the offer's dedicated-origin route — Gateway API breaks the PathPrefix=/ tie by route age.

Fix

Treat "already present" as an idempotent success:

1. Detect the hostname is already in st.HostnameSet() (normalized match, including mixed-case input).
2. Still call CreateStorefront(cfg, existing...) over the current set so the catch-all is re-rendered and skips any hostnames that have since become offer-bound.
3. Print a no-op success message and return HostnameMutationResult{Action: "unchanged", ...} with exit 0.

No new sweep function: the duplicate path reuses the same CreateStorefront call the normal success path already uses. CreateStorefront continues to fail open (warn only) when kubectl/cluster access is unavailable.

Diagram

flowchart TD
A["tunnel hostname add host"] --> B{"already bound?"}
B -->|yes| C["CreateStorefront over current set<br/>skips offer-bound hosts"]
C --> D["idempotent success<br/>Action=unchanged, exit 0"]
B -->|no| E["normal add path"]
E --> F["route DNS / render ingress"]
F --> G["CreateStorefront over updated set"]
G --> H["persist state"]
H --> I["success<br/>Action=added"]

Loading

Validation

gofmt -l internal/tunnel/hostnames.go internal/tunnel/hostnames_test.go
go build ./...
go test ./internal/tunnel/... -count=1

Actual output:

ok github.com/ObolNetwork/obol-stack/internal/tunnel	1.306s

• gofmt -l printed nothing (both files already formatted).
• go build ./... succeeded with no output.
• go test ./internal/tunnel/... -count=1 passed.

---

https://claude.ai/code/session_01PnhCQLz7CHuDBUhWd5xF8v

[bussyjd]

Problem

obol tunnel hostname add <existing-host> was not idempotent. When the hostname was already tracked on the tunnel, AddHostname returned an error (%s is already a tunnel hostname; nothing to do) and exited 1 before reaching the storefront catch-all re-render.

That short-circuit is especially harmful for the retry path used by obol tunnel hostname add <host> --offer <ns>/<name>: the CLI binds ServiceOffer.spec.hostname first so that CreateStorefront can skip offer-bound hosts from the storefront catch-all. If AddHostname is re-run for a hostname that is already bound (idempotent retry), the early error means the catch-all is never re-swept. A stale catch-all route can keep shadowing the offer's dedicated-origin route — Gateway API breaks the PathPrefix=/ tie by route age.

Fix

Treat "already present" as an idempotent success:

1. Detect the hostname is already in st.HostnameSet() (normalized match, including mixed-case input).
2. Still call CreateStorefront(cfg, existing...) over the current set so the catch-all is re-rendered and skips any hostnames that have since become offer-bound.
3. Print a no-op success message and return HostnameMutationResult{Action: "unchanged", ...} with exit 0.

No new sweep function: the duplicate path reuses the same CreateStorefront call the normal success path already uses. CreateStorefront continues to fail open (warn only) when kubectl/cluster access is unavailable.

Diagram

flowchart TD
A["tunnel hostname add host"] --> B{"already bound?"}
B -->|yes| C["CreateStorefront over current set<br/>skips offer-bound hosts"]
C --> D["idempotent success<br/>Action=unchanged, exit 0"]
B -->|no| E["normal add path"]
E --> F["route DNS / render ingress"]
F --> G["CreateStorefront over updated set"]
G --> H["persist state"]
H --> I["success<br/>Action=added"]

Loading

Validation

gofmt -l internal/tunnel/hostnames.go internal/tunnel/hostnames_test.go
go build ./...
go test ./internal/tunnel/... -count=1

Actual output:

ok github.com/ObolNetwork/obol-stack/internal/tunnel	1.306s

• gofmt -l printed nothing (both files already formatted).
• go build ./... succeeded with no output.
• go test ./internal/tunnel/... -count=1 passed.

---

https://claude.ai/code/session_01PnhCQLz7CHuDBUhWd5xF8v

[bussyjd]

Problem

obol tunnel hostname add <existing-host> was not idempotent. When the hostname was already tracked on the tunnel, AddHostname returned an error (%s is already a tunnel hostname; nothing to do) and exited 1 before reaching the storefront catch-all re-render.

That short-circuit is especially harmful for the retry path used by obol tunnel hostname add <host> --offer <ns>/<name>: the CLI binds ServiceOffer.spec.hostname first so that CreateStorefront can skip offer-bound hosts from the storefront catch-all. If AddHostname is re-run for a hostname that is already bound (idempotent retry), the early error means the catch-all is never re-swept. A stale catch-all route can keep shadowing the offer's dedicated-origin route — Gateway API breaks the PathPrefix=/ tie by route age.

Fix

Treat "already present" as an idempotent success:

1. Detect the hostname is already in st.HostnameSet() (normalized match, including mixed-case input).
2. Still call CreateStorefront(cfg, existing...) over the current set so the catch-all is re-rendered and skips any hostnames that have since become offer-bound.
3. Print a no-op success message and return HostnameMutationResult{Action: "unchanged", ...} with exit 0.

No new sweep function: the duplicate path reuses the same CreateStorefront call the normal success path already uses. CreateStorefront continues to fail open (warn only) when kubectl/cluster access is unavailable.

Diagram

flowchart TD
A["tunnel hostname add host"] --> B{"already bound?"}
B -->|yes| C["CreateStorefront over current set<br/>skips offer-bound hosts"]
C --> D["idempotent success<br/>Action=unchanged, exit 0"]
B -->|no| E["normal add path"]
E --> F["route DNS / render ingress"]
F --> G["CreateStorefront over updated set"]
G --> H["persist state"]
H --> I["success<br/>Action=added"]

Loading

Validation

gofmt -l internal/tunnel/hostnames.go internal/tunnel/hostnames_test.go
go build ./...
go test ./internal/tunnel/... -count=1

Actual output:

ok github.com/ObolNetwork/obol-stack/internal/tunnel	1.306s

• gofmt -l printed nothing (both files already formatted).
• go build ./... succeeded with no output.
• go test ./internal/tunnel/... -count=1 passed.

---

https://claude.ai/code/session_01PnhCQLz7CHuDBUhWd5xF8v

[bussyjd]

Problem

obol tunnel hostname add <existing-host> was not idempotent. When the hostname was already tracked on the tunnel, AddHostname returned an error (%s is already a tunnel hostname; nothing to do) and exited 1 before reaching the storefront catch-all re-render.

That short-circuit is especially harmful for the retry path used by obol tunnel hostname add <host> --offer <ns>/<name>: the CLI binds ServiceOffer.spec.hostname first so that CreateStorefront can skip offer-bound hosts from the storefront catch-all. If AddHostname is re-run for a hostname that is already bound (idempotent retry), the early error means the catch-all is never re-swept. A stale catch-all route can keep shadowing the offer's dedicated-origin route — Gateway API breaks the PathPrefix=/ tie by route age.

Fix

Treat "already present" as an idempotent success:

1. Detect the hostname is already in st.HostnameSet() (normalized match, including mixed-case input).
2. Still call CreateStorefront(cfg, existing...) over the current set so the catch-all is re-rendered and skips any hostnames that have since become offer-bound.
3. Print a no-op success message and return HostnameMutationResult{Action: "unchanged", ...} with exit 0.

No new sweep function: the duplicate path reuses the same CreateStorefront call the normal success path already uses. CreateStorefront continues to fail open (warn only) when kubectl/cluster access is unavailable.

Diagram

flowchart TD
A["tunnel hostname add host"] --> B{"already bound?"}
B -->|yes| C["CreateStorefront over current set<br/>skips offer-bound hosts"]
C --> D["idempotent success<br/>Action=unchanged, exit 0"]
B -->|no| E["normal add path"]
E --> F["route DNS / render ingress"]
F --> G["CreateStorefront over updated set"]
G --> H["persist state"]
H --> I["success<br/>Action=added"]

Loading

Validation

gofmt -l internal/tunnel/hostnames.go internal/tunnel/hostnames_test.go
go build ./...
go test ./internal/tunnel/... -count=1

Actual output:

ok github.com/ObolNetwork/obol-stack/internal/tunnel	1.306s

• gofmt -l printed nothing (both files already formatted).
• go build ./... succeeded with no output.
• go test ./internal/tunnel/... -count=1 passed.

---

https://claude.ai/code/session_01PnhCQLz7CHuDBUhWd5xF8v

[bussyjd]

Problem

obol tunnel hostname add <existing-host> was not idempotent. When the hostname was already tracked on the tunnel, AddHostname returned an error (%s is already a tunnel hostname; nothing to do) and exited 1 before reaching the storefront catch-all re-render.

That short-circuit is especially harmful for the retry path used by obol tunnel hostname add <host> --offer <ns>/<name>: the CLI binds ServiceOffer.spec.hostname first so that CreateStorefront can skip offer-bound hosts from the storefront catch-all. If AddHostname is re-run for a hostname that is already bound (idempotent retry), the early error means the catch-all is never re-swept. A stale catch-all route can keep shadowing the offer's dedicated-origin route — Gateway API breaks the PathPrefix=/ tie by route age.

Fix

Treat "already present" as an idempotent success:

1. Detect the hostname is already in st.HostnameSet() (normalized match, including mixed-case input).
2. Still call CreateStorefront(cfg, existing...) over the current set so the catch-all is re-rendered and skips any hostnames that have since become offer-bound.
3. Print a no-op success message and return HostnameMutationResult{Action: "unchanged", ...} with exit 0.

No new sweep function: the duplicate path reuses the same CreateStorefront call the normal success path already uses. CreateStorefront continues to fail open (warn only) when kubectl/cluster access is unavailable.

Diagram

flowchart TD
A["tunnel hostname add host"] --> B{"already bound?"}
B -->|yes| C["CreateStorefront over current set<br/>skips offer-bound hosts"]
C --> D["idempotent success<br/>Action=unchanged, exit 0"]
B -->|no| E["normal add path"]
E --> F["route DNS / render ingress"]
F --> G["CreateStorefront over updated set"]
G --> H["persist state"]
H --> I["success<br/>Action=added"]

Loading

Validation

gofmt -l internal/tunnel/hostnames.go internal/tunnel/hostnames_test.go
go build ./...
go test ./internal/tunnel/... -count=1

Actual output:

ok github.com/ObolNetwork/obol-stack/internal/tunnel	1.306s

• gofmt -l printed nothing (both files already formatted).
• go build ./... succeeded with no output.
• go test ./internal/tunnel/... -count=1 passed.

---

https://claude.ai/code/session_01PnhCQLz7CHuDBUhWd5xF8v

[bussyjd]

Problem

obol tunnel hostname add <existing-host> was not idempotent. When the hostname was already tracked on the tunnel, AddHostname returned an error (%s is already a tunnel hostname; nothing to do) and exited 1 before reaching the storefront catch-all re-render.

That short-circuit is especially harmful for the retry path used by obol tunnel hostname add <host> --offer <ns>/<name>: the CLI binds ServiceOffer.spec.hostname first so that CreateStorefront can skip offer-bound hosts from the storefront catch-all. If AddHostname is re-run for a hostname that is already bound (idempotent retry), the early error means the catch-all is never re-swept. A stale catch-all route can keep shadowing the offer's dedicated-origin route — Gateway API breaks the PathPrefix=/ tie by route age.

Fix

Treat "already present" as an idempotent success:

1. Detect the hostname is already in st.HostnameSet() (normalized match, including mixed-case input).
2. Still call CreateStorefront(cfg, existing...) over the current set so the catch-all is re-rendered and skips any hostnames that have since become offer-bound.
3. Print a no-op success message and return HostnameMutationResult{Action: "unchanged", ...} with exit 0.

No new sweep function: the duplicate path reuses the same CreateStorefront call the normal success path already uses. CreateStorefront continues to fail open (warn only) when kubectl/cluster access is unavailable.

Diagram

flowchart TD
A["tunnel hostname add host"] --> B{"already bound?"}
B -->|yes| C["CreateStorefront over current set<br/>skips offer-bound hosts"]
C --> D["idempotent success<br/>Action=unchanged, exit 0"]
B -->|no| E["normal add path"]
E --> F["route DNS / render ingress"]
F --> G["CreateStorefront over updated set"]
G --> H["persist state"]
H --> I["success<br/>Action=added"]

Loading

Validation

gofmt -l internal/tunnel/hostnames.go internal/tunnel/hostnames_test.go
go build ./...
go test ./internal/tunnel/... -count=1

Actual output:

ok github.com/ObolNetwork/obol-stack/internal/tunnel	1.306s

• gofmt -l printed nothing (both files already formatted).
• go build ./... succeeded with no output.
• go test ./internal/tunnel/... -count=1 passed.

---

https://claude.ai/code/session_01PnhCQLz7CHuDBUhWd5xF8v