From 93f3c74ac17fb6eb8079cf14c5770476ff6e89d4 Mon Sep 17 00:00:00 2001 From: "mykyta.oleksiienko" Date: Mon, 21 Aug 2023 18:36:36 +0300 Subject: [PATCH] issue-522,implementation for OpenSearch Egress Rules lifecycle workflow on APIv2 --- .../v1beta1/opensearchegressrules_types.go | 54 ++++++ .../v1beta1/opensearchegressrules_webhook.go | 68 ++++++++ .../v1beta1/zz_generated.deepcopy.go | 89 ++++++++++ ...instaclustr.com_opensearchegressrules.yaml | 64 +++++++ config/webhook/manifests.yaml | 20 +++ .../opensearchegressrules_controller.go | 162 ++++++++++++++++++ pkg/instaclustr/client.go | 50 ++++++ pkg/instaclustr/config.go | 2 + pkg/instaclustr/interfaces.go | 2 + pkg/models/errors.go | 1 + 10 files changed, 512 insertions(+) create mode 100644 apis/clusterresources/v1beta1/opensearchegressrules_types.go create mode 100644 apis/clusterresources/v1beta1/opensearchegressrules_webhook.go create mode 100644 config/crd/bases/clusterresources.instaclustr.com_opensearchegressrules.yaml create mode 100644 controllers/clusterresources/opensearchegressrules_controller.go diff --git a/apis/clusterresources/v1beta1/opensearchegressrules_types.go b/apis/clusterresources/v1beta1/opensearchegressrules_types.go new file mode 100644 index 000000000..058219146 --- /dev/null +++ b/apis/clusterresources/v1beta1/opensearchegressrules_types.go @@ -0,0 +1,54 @@ +package v1beta1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "sigs.k8s.io/controller-runtime/pkg/client" + + "github.com/instaclustr/operator/pkg/models" +) + +type OpenSearchEgressRulesSpec struct { + ClusterID string `json:"clusterId"` + Name string `json:"name"` + OpenSearchBindingId string `json:"openSearchBindingId"` + Source string `json:"source"` + Type string `json:"type"` +} + +type OpenSearchEgressRulesStatus struct { + ID string `json:"id,omitempty"` + Status string `json:"status,omitempty"` +} + +//+kubebuilder:object:root=true +//+kubebuilder:subresource:status + +type OpenSearchEgressRule struct { + metav1.TypeMeta `json:",inline"` + metav1.ObjectMeta `json:"metadata,omitempty"` + + Spec OpenSearchEgressRulesSpec `json:"spec,omitempty"` + Status OpenSearchEgressRulesStatus `json:"status,omitempty"` +} + +//+kubebuilder:object:root=true + +type OpenSearchEgressRuleList struct { + metav1.TypeMeta `json:",inline"` + metav1.ListMeta `json:"metadata,omitempty"` + Items []OpenSearchEgressRule `json:"items"` +} + +func (er *OpenSearchEgressRule) GetJobID(jobName string) string { + return client.ObjectKeyFromObject(er).String() + "/" + jobName +} + +func (er *OpenSearchEgressRule) NewPatch() client.Patch { + old := er.DeepCopy() + old.Annotations[models.ResourceStateAnnotation] = "" + return client.MergeFrom(old) +} + +func init() { + SchemeBuilder.Register(&OpenSearchEgressRule{}, &OpenSearchEgressRuleList{}) +} diff --git a/apis/clusterresources/v1beta1/opensearchegressrules_webhook.go b/apis/clusterresources/v1beta1/opensearchegressrules_webhook.go new file mode 100644 index 000000000..2b08e6b28 --- /dev/null +++ b/apis/clusterresources/v1beta1/opensearchegressrules_webhook.go @@ -0,0 +1,68 @@ +package v1beta1 + +import ( + "fmt" + "regexp" + + "k8s.io/apimachinery/pkg/runtime" + ctrl "sigs.k8s.io/controller-runtime" + logf "sigs.k8s.io/controller-runtime/pkg/log" + "sigs.k8s.io/controller-runtime/pkg/webhook" + + "github.com/instaclustr/operator/pkg/models" +) + +var opensearchEgressRulesJog = logf.Log.WithName("opensearchegressrules-resource") +var openSearchBindingIDPattern, _ = regexp.Compile(`[\w-]+`) +var egressRulesIDPattern, _ = regexp.Compile(`[a-zA-Z\d-]+~\w+~[\w-]+`) + +func (r *OpenSearchEgressRule) SetupWebhookWithManager(mgr ctrl.Manager) error { + return ctrl.NewWebhookManagedBy(mgr). + For(r). + Complete() +} + +//+kubebuilder:webhook:path=/validate-clusterresources-instaclustr-com-v1beta1-opensearchuser,mutating=false,failurePolicy=fail,sideEffects=None,groups=clusterresources.instaclustr.com,resources=opensearchusers,verbs=create;update,versions=v1beta1,name=vopensearchuser.kb.io,admissionReviewVersions=v1 + +var _ webhook.Validator = &OpenSearchEgressRule{} + +// ValidateCreate implements webhook.Validator so a webhook will be registered for the type +func (r *OpenSearchEgressRule) ValidateCreate() error { + opensearchEgressRulesJog.Info("validate create", "name", r.Name) + + if r.Spec.ClusterID == "" || r.Spec.OpenSearchBindingId == "" || r.Spec.Source == "" { + return fmt.Errorf("spec.ClusterID, spec.OpenSearchBindingId, spec.Source must be filled") + } + + if !openSearchBindingIDPattern.MatchString(r.Spec.OpenSearchBindingId) { + return fmt.Errorf("mismatching openSearchBindingID to [\\w-]+ pattern") + } + + return nil +} + +// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type +func (r *OpenSearchEgressRule) ValidateUpdate(old runtime.Object) error { + opensearchEgressRulesJog.Info("validate update", "name", r.Name) + + oldRules := old.(*OpenSearchEgressRule) + + if r.Status.ID == "" { + return r.ValidateCreate() + } + + if r.Spec != oldRules.Spec { + return models.ErrImmutableSpec + } + + return nil +} + +// ValidateDelete implements webhook.Validator so a webhook will be registered for the type +func (r *OpenSearchEgressRule) ValidateDelete() error { + if !openSearchBindingIDPattern.MatchString(r.Spec.OpenSearchBindingId) { + return fmt.Errorf("mismatching openSearchBindingID to [a-zA-Z\\d-]+~\\w+~[\\w-]+ pattern") + } + + return nil +} diff --git a/apis/clusterresources/v1beta1/zz_generated.deepcopy.go b/apis/clusterresources/v1beta1/zz_generated.deepcopy.go index 17f6fb467..19ad1b33c 100644 --- a/apis/clusterresources/v1beta1/zz_generated.deepcopy.go +++ b/apis/clusterresources/v1beta1/zz_generated.deepcopy.go @@ -1105,6 +1105,95 @@ func (in *NodeReloadStatus) DeepCopy() *NodeReloadStatus { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OpenSearchEgressRule) DeepCopyInto(out *OpenSearchEgressRule) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + out.Spec = in.Spec + out.Status = in.Status +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OpenSearchEgressRule. +func (in *OpenSearchEgressRule) DeepCopy() *OpenSearchEgressRule { + if in == nil { + return nil + } + out := new(OpenSearchEgressRule) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *OpenSearchEgressRule) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OpenSearchEgressRuleList) DeepCopyInto(out *OpenSearchEgressRuleList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]OpenSearchEgressRule, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OpenSearchEgressRuleList. +func (in *OpenSearchEgressRuleList) DeepCopy() *OpenSearchEgressRuleList { + if in == nil { + return nil + } + out := new(OpenSearchEgressRuleList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *OpenSearchEgressRuleList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OpenSearchEgressRulesSpec) DeepCopyInto(out *OpenSearchEgressRulesSpec) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OpenSearchEgressRulesSpec. +func (in *OpenSearchEgressRulesSpec) DeepCopy() *OpenSearchEgressRulesSpec { + if in == nil { + return nil + } + out := new(OpenSearchEgressRulesSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *OpenSearchEgressRulesStatus) DeepCopyInto(out *OpenSearchEgressRulesStatus) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OpenSearchEgressRulesStatus. +func (in *OpenSearchEgressRulesStatus) DeepCopy() *OpenSearchEgressRulesStatus { + if in == nil { + return nil + } + out := new(OpenSearchEgressRulesStatus) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *OpenSearchUser) DeepCopyInto(out *OpenSearchUser) { *out = *in diff --git a/config/crd/bases/clusterresources.instaclustr.com_opensearchegressrules.yaml b/config/crd/bases/clusterresources.instaclustr.com_opensearchegressrules.yaml new file mode 100644 index 000000000..a650e6305 --- /dev/null +++ b/config/crd/bases/clusterresources.instaclustr.com_opensearchegressrules.yaml @@ -0,0 +1,64 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.9.2 + creationTimestamp: null + name: opensearchegressrules.clusterresources.instaclustr.com +spec: + group: clusterresources.instaclustr.com + names: + kind: OpenSearchEgressRule + listKind: OpenSearchEgressRuleList + plural: opensearchegressrules + singular: opensearchegressrule + scope: Namespaced + versions: + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + clusterId: + type: string + name: + type: string + openSearchBindingId: + type: string + source: + type: string + type: + type: string + required: + - clusterId + - name + - openSearchBindingId + - source + - type + type: object + status: + properties: + id: + type: string + status: + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/config/webhook/manifests.yaml b/config/webhook/manifests.yaml index 33fede0e2..bf9cff053 100644 --- a/config/webhook/manifests.yaml +++ b/config/webhook/manifests.yaml @@ -572,6 +572,26 @@ webhooks: resources: - opensearchusers sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: webhook-service + namespace: system + path: /validate-clusterresources-instaclustr-com-v1beta1-opensearchuser + failurePolicy: Fail + name: vopensearchuser.kb.io + rules: + - apiGroups: + - clusterresources.instaclustr.com + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - opensearchusers + sideEffects: None - admissionReviewVersions: - v1 clientConfig: diff --git a/controllers/clusterresources/opensearchegressrules_controller.go b/controllers/clusterresources/opensearchegressrules_controller.go new file mode 100644 index 000000000..362aa6724 --- /dev/null +++ b/controllers/clusterresources/opensearchegressrules_controller.go @@ -0,0 +1,162 @@ +package clusterresources + +import ( + "context" + "encoding/json" + "errors" + + "github.com/go-logr/logr" + k8serrors "k8s.io/apimachinery/pkg/api/errors" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/types" + "k8s.io/client-go/tools/record" + ctrl "sigs.k8s.io/controller-runtime" + "sigs.k8s.io/controller-runtime/pkg/client" + "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil" + "sigs.k8s.io/controller-runtime/pkg/log" + + clusterresourcesv1beta1 "github.com/instaclustr/operator/apis/clusterresources/v1beta1" + "github.com/instaclustr/operator/pkg/instaclustr" + "github.com/instaclustr/operator/pkg/models" + "github.com/instaclustr/operator/pkg/scheduler" +) + +type OpenSearchEgressRulesReconciler struct { + client.Client + Scheme *runtime.Scheme + API instaclustr.API + Scheduler scheduler.Interface + EventRecorder record.EventRecorder +} + +// Reconcile is part of the main kubernetes reconciliation loop which aims to +// move the current state of the cluster closer to the desired state. +// +// For more details, check Reconcile and its Result here: +// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.14.4/pkg/reconcile +func (r *OpenSearchEgressRulesReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) { + l := log.FromContext(ctx) + + rule := &clusterresourcesv1beta1.OpenSearchEgressRule{} + err := r.Client.Get(ctx, types.NamespacedName{ + Namespace: req.Namespace, + Name: req.Name, + }, rule) + if err != nil { + if k8serrors.IsNotFound(err) { + return models.ExitReconcile, nil + } + + l.Error(err, "Unable to fetch OpenSearch Egress Rules resource") + + return models.ReconcileRequeue, err + } + + // Handle resource deletion + if rule.DeletionTimestamp != nil { + err = r.handleDelete(ctx, l, rule) + if err != nil { + return models.ReconcileRequeue, err + } + + return models.ExitReconcile, nil + } + + // Handle resource creation + if rule.Status.ID == "" { + err = r.handleCreate(ctx, l, rule) + if err != nil { + return models.ReconcileRequeue, nil + } + + return models.ExitReconcile, nil + } + + return models.ExitReconcile, nil +} + +func (r *OpenSearchEgressRulesReconciler) handleCreate(ctx context.Context, l logr.Logger, rule *clusterresourcesv1beta1.OpenSearchEgressRule) error { + b, err := r.API.CreateOpenSearchEgressRules(rule.Spec.ClusterID, rule.Spec) + if err != nil { + l.Error(err, "failed to create OpenSearch Egress Rule resource on Instaclustr") + r.EventRecorder.Eventf(rule, models.Warning, models.CreationFailed, + "Failed to create OpenSearch Egress Rule on Instaclustr. Reason: %v", err, + ) + + return err + } + + patch := rule.NewPatch() + err = json.Unmarshal(b, &rule.Status) + if err != nil { + l.Error(err, "failed to parse OpenSearch Egress Rule resource response from Instaclustr") + r.EventRecorder.Eventf(rule, models.Warning, models.ConvertionFailed, + "Failed to parse OpenSearch Egress Rule response from Instaclustr. Reason: %v", err, + ) + + return err + } + + err = r.Status().Patch(ctx, rule, patch) + if err != nil { + l.Error(err, "failed to patch OpenSearch Egress Rule status with its id") + r.EventRecorder.Eventf(rule, models.Warning, models.PatchFailed, + "Failed to patch OpenSearch Egress Rule with its id. Reason: %v", err, + ) + + return err + } + + controllerutil.AddFinalizer(rule, models.DeletionFinalizer) + err = r.Patch(ctx, rule, patch) + if err != nil { + l.Error(err, "failed to patch OpenSearch Egress Rule with finalizer") + r.EventRecorder.Eventf(rule, models.Warning, models.PatchFailed, + "Failed to patch OpenSearch Egress Rule with finalizer. Reason: %v", err, + ) + + return err + } + + l.Info("OpenSearch Egress Rule has been created") + r.EventRecorder.Event(rule, models.Normal, models.Created, + "OpenSearch Egress Rule has been created", + ) + + return nil +} + +func (r *OpenSearchEgressRulesReconciler) handleDelete(ctx context.Context, logger logr.Logger, resource *clusterresourcesv1beta1.OpenSearchEgressRule) error { + err := r.API.DeleteOpenSearchEgressRule(resource.Status.ID) + if err != nil && !errors.Is(err, instaclustr.NotFound) { + logger.Error(err, "failed to delete OpenSearch Egress Rule on Instaclustr") + r.EventRecorder.Eventf(resource, models.Warning, models.DeletionFailed, + "Failed to delete OpenSearch Egress Rule on Instaclustr. Reason: %v", err, + ) + + return err + } + + patch := resource.NewPatch() + controllerutil.RemoveFinalizer(resource, models.DeletionFinalizer) + err = r.Patch(ctx, resource, patch) + if err != nil { + logger.Error(err, "failed to delete finalizer OpenSearch Egress Rule") + r.EventRecorder.Eventf(resource, models.Warning, models.PatchFailed, + "Failed to delete finalizer from OpenSearch Egress Rule. Reason: %v", err, + ) + + return err + } + + logger.Info("OpenSearch Egress Rule has been deleted") + + return nil +} + +// SetupWithManager sets up the controller with the Manager. +func (r *OpenSearchEgressRulesReconciler) SetupWithManager(mgr ctrl.Manager) error { + return ctrl.NewControllerManagedBy(mgr). + For(&clusterresourcesv1beta1.OpenSearchEgressRule{}). + Complete(r) +} diff --git a/pkg/instaclustr/client.go b/pkg/instaclustr/client.go index cccf45589..370765170 100644 --- a/pkg/instaclustr/client.go +++ b/pkg/instaclustr/client.go @@ -2241,3 +2241,53 @@ func (c *Client) UpdateClusterSettings(clusterID string, settings *models.Cluste return nil } + +func (c *Client) CreateOpenSearchEgressRules(clusterID string, spec any) ([]byte, error) { + url := c.serverHostname + fmt.Sprintf(OpenSearchEgressRulesEndpoint, clusterID) + + b, err := json.Marshal(spec) + if err != nil { + return nil, err + } + + resp, err := c.DoRequest(url, http.MethodPost, b) + if err != nil { + return nil, err + } + + defer resp.Body.Close() + b, err = io.ReadAll(resp.Body) + if err != nil { + return nil, err + } + + if resp.StatusCode != http.StatusAccepted { + return nil, fmt.Errorf("status code: %d, message: %s", resp.StatusCode, b) + } + + return b, nil +} + +func (c *Client) DeleteOpenSearchEgressRule(egressRuleId string) error { + url := c.serverHostname + OpenSearchEgressRuleDeleteEndpoint + egressRuleId + resp, err := c.DoRequest(url, http.MethodDelete, nil) + if err != nil { + return err + } + + defer resp.Body.Close() + b, err := io.ReadAll(resp.Body) + if err != nil { + return err + } + + if resp.StatusCode == http.StatusNotFound { + return NotFound + } + + if resp.StatusCode != http.StatusNoContent { + return fmt.Errorf("status code: %d, message: %s", resp.StatusCode, b) + } + + return nil +} diff --git a/pkg/instaclustr/config.go b/pkg/instaclustr/config.go index 28324af15..d0af13d0e 100644 --- a/pkg/instaclustr/config.go +++ b/pkg/instaclustr/config.go @@ -52,6 +52,8 @@ const ( AWSEncryptionKeyEndpoint = "/cluster-management/v2/resources/providers/aws/encryption-keys/v2/" ListAppsVersionsEndpoint = "%s/cluster-management/v2/data-sources/applications/%s/versions/v2/" ClusterSettingsEndpoint = "%s/cluster-management/v2/operations/clusters/v2/%s/change-settings/v2" + OpenSearchEgressRulesEndpoint = "/cluster-management/v2/data-sources/opensearch_cluster/%s/egress-rules/v2/" + OpenSearchEgressRuleDeleteEndpoint = "/cluster-management/v2/resources/applications/opensearch/egress-rules/v2/" ) // constants for API v1 diff --git a/pkg/instaclustr/interfaces.go b/pkg/instaclustr/interfaces.go index 3747de569..ef0af3e88 100644 --- a/pkg/instaclustr/interfaces.go +++ b/pkg/instaclustr/interfaces.go @@ -98,4 +98,6 @@ type API interface { ListAppVersions(app string) ([]*models.AppVersions, error) GetDefaultCredentialsV1(clusterID string) (string, string, error) UpdateClusterSettings(clusterID string, settings *models.ClusterSettings) error + CreateOpenSearchEgressRules(clusterID string, spec any) ([]byte, error) + DeleteOpenSearchEgressRule(egressRuleId string) error } diff --git a/pkg/models/errors.go b/pkg/models/errors.go index df31744b1..b14ef4edc 100644 --- a/pkg/models/errors.go +++ b/pkg/models/errors.go @@ -56,4 +56,5 @@ var ( ErrMissingSecretKeys = errors.New("the secret is missing the correct keys for the user") ErrUserStillExist = errors.New("the user is still attached to cluster") ErrOnlyOneEntityTwoFactorDelete = errors.New("currently only one entity of two factor delete can be filled") + ErrImmutableSpec = errors.New("spec is immutable") )