9006283803

Committed 08 May 2024 05:51PM UTC coverage: 80.605% (-0.08%) from 80.686%

Build # 9006283803

Build Type

Pull #556

github

Committed by

web-flow

Commit Message

Bump aquasecurity/trivy-action from 0.19.0 to 0.20.0

Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.19.0 to 0.20.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](https://github.com/aquasecurity/trivy-action/compare/d710430a6...b2933f565)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Pull Request Pull Request #556: Bump aquasecurity/trivy-action from 0.19.0 to 0.20.0

Run Details

2959 of 3671 relevant lines covered (80.6%)

0.94 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

83.63

/controllers/manager/staticgatewayconfiguration_controller.go

// Copyright (c) Microsoft Corporation.
// Licensed under the MIT license.

package manager

import (
        "context"
        "fmt"
        "os"
        "strings"

        "golang.zx2c4.com/wireguard/wgctrl/wgtypes"
        corev1 "k8s.io/api/core/v1"
        apierrors "k8s.io/apimachinery/pkg/api/errors"
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        "k8s.io/apimachinery/pkg/runtime/schema"
        "k8s.io/apimachinery/pkg/util/validation/field"
        "k8s.io/client-go/tools/record"
        ctrl "sigs.k8s.io/controller-runtime"
        "sigs.k8s.io/controller-runtime/pkg/builder"
        "sigs.k8s.io/controller-runtime/pkg/client"
        "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
        "sigs.k8s.io/controller-runtime/pkg/event"
        "sigs.k8s.io/controller-runtime/pkg/handler"
        "sigs.k8s.io/controller-runtime/pkg/log"
        "sigs.k8s.io/controller-runtime/pkg/predicate"
        "sigs.k8s.io/controller-runtime/pkg/reconcile"

        egressgatewayv1alpha1 "github.com/Azure/kube-egress-gateway/api/v1alpha1"
        "github.com/Azure/kube-egress-gateway/pkg/consts"
        "github.com/Azure/kube-egress-gateway/pkg/metrics"
)

var _ reconcile.Reconciler = &StaticGatewayConfigurationReconciler{}

// StaticGatewayConfigurationReconciler reconciles gateway loadBalancer according to a StaticGatewayConfiguration object
type StaticGatewayConfigurationReconciler struct {
        client.Client
        SecretNamespace string
        Recorder        record.EventRecorder
}

//+kubebuilder:rbac:groups=core,resources=events,verbs=create;patch
//+kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups=egressgateway.kubernetes.azure.com,resources=staticgatewayconfigurations,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups=egressgateway.kubernetes.azure.com,resources=staticgatewayconfigurations/status,verbs=get;update;patch
//+kubebuilder:rbac:groups=egressgateway.kubernetes.azure.com,resources=gatewaylbconfigurations,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups=egressgateway.kubernetes.azure.com,resources=gatewaylbconfigurations/status,verbs=get;update;patch

// Reconcile is part of the main kubernetes reconciliation loop which aims to
// move the current state of the cluster closer to the desired state.
func (r *StaticGatewayConfigurationReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
        log := log.FromContext(ctx)

        // Fetch the StaticGatewayConfiguration instance.
        gwConfig := &egressgatewayv1alpha1.StaticGatewayConfiguration{}
        if err := r.Get(ctx, req.NamespacedName, gwConfig); err != nil {
                if apierrors.IsNotFound(err) {
                        // Object not found, return.
                        return ctrl.Result{}, nil
                }
                log.Error(err, "unable to fetch StaticGatewayConfiguration instance")
                return ctrl.Result{}, err
        }

        if !gwConfig.ObjectMeta.DeletionTimestamp.IsZero() {
                // Clean up staticGatewayConfiguration
                return ctrl.Result{}, r.ensureDeleted(ctx, gwConfig)
        }

        return ctrl.Result{}, r.reconcile(ctx, gwConfig)
}

// SetupWithManager sets up the controller with the Manager.
func (r *StaticGatewayConfigurationReconciler) SetupWithManager(mgr ctrl.Manager) error {
        secretPredicate := predicate.Funcs{
                CreateFunc: func(e event.CreateEvent) bool {
                        // no need to trigger reconcile for secrets creation
                        return false
                },
                UpdateFunc: func(e event.UpdateEvent) bool {
                        return strings.EqualFold(e.ObjectOld.GetNamespace(), r.SecretNamespace)
                },
                DeleteFunc: func(e event.DeleteEvent) bool {
                        return strings.EqualFold(e.Object.GetNamespace(), r.SecretNamespace)
                },
                GenericFunc: func(e event.GenericEvent) bool {
                        return false
                },
        }
        return ctrl.NewControllerManagedBy(mgr).
                For(&egressgatewayv1alpha1.StaticGatewayConfiguration{}).
                Owns(&egressgatewayv1alpha1.GatewayLBConfiguration{}).
                // generated secrets created in the dedicated namespace
                Watches(&corev1.Secret{}, enqueueOwningSGCFromLabels(), builder.WithPredicates(secretPredicate)).
                Complete(r)
}

func enqueueOwningSGCFromLabels() handler.EventHandler {
        return handler.EnqueueRequestsFromMapFunc(func(_ context.Context, o client.Object) []reconcile.Request {
                labels := o.GetLabels()
                if labels == nil {
                        return nil
                }

                owningSGCNamespace, foundNamespace := labels[consts.OwningSGCNamespaceLabel]
                owningSGCName, foundName := labels[consts.OwningSGCNameLabel]

                if !foundNamespace || !foundName {
                        return nil
                }

                return []reconcile.Request{
                        {
                                NamespacedName: client.ObjectKey{
                                        Name:      owningSGCName,
                                        Namespace: owningSGCNamespace,
                                },
                        },
                }
        })
}

func (r *StaticGatewayConfigurationReconciler) reconcile(
        ctx context.Context,
        gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration,
) error {
        log := log.FromContext(ctx)
        log.Info(fmt.Sprintf("Reconciling staticGatewayConfiguration %s/%s", gwConfig.Namespace, gwConfig.Name))

        mc := metrics.NewMetricsContext(
                os.Getenv(consts.PodNamespaceEnvKey),
                "reconcile_static_gateway_configuration",
                "n/a",
                "n/a",
                strings.ToLower(fmt.Sprintf("%s/%s", gwConfig.Namespace, gwConfig.Name)),
        ) // no subscription_id/resource_group for SGC reconciler
        succeeded := false
        defer func() { mc.ObserveControllerReconcileMetrics(succeeded) }()

        if err := validate(gwConfig); err != nil {
                return err
        }

        if !controllerutil.ContainsFinalizer(gwConfig, consts.SGCFinalizerName) {
                log.Info("Adding finalizer")
                controllerutil.AddFinalizer(gwConfig, consts.SGCFinalizerName)
                err := r.Update(ctx, gwConfig)
                if err != nil {
                        log.Error(err, "failed to add finalizer")
                        return err
                }
        }

        _, err := controllerutil.CreateOrPatch(ctx, r, gwConfig, func() error {
                // reconcile wireguard keypair
                if err := r.reconcileWireguardKey(ctx, gwConfig); err != nil {
                        log.Error(err, "failed to reconcile wireguard key")
                        r.Recorder.Event(gwConfig, corev1.EventTypeWarning, "ReconcileError", err.Error())
                        return err
                }

                // reconcile lbconfig
                if err := r.reconcileGatewayLBConfig(ctx, gwConfig); err != nil {
                        log.Error(err, "failed to reconcile gateway LB configuration")
                        r.Recorder.Event(gwConfig, corev1.EventTypeWarning, "ReconcileError", err.Error())
                        return err
                }

                return nil
        })

        prefix, reconcileStatus := "<pending>", "Reconciling"
        if gwConfig.Status.EgressIpPrefix != "" {
                prefix, reconcileStatus = gwConfig.Status.EgressIpPrefix, "Reconciled"
        }
        r.Recorder.Eventf(gwConfig, corev1.EventTypeNormal, reconcileStatus, "StaticGatewayConfiguration provisioned with egress prefix %s", prefix)
        log.Info("staticGatewayConfiguration reconciled")
        succeeded = true
        return err
}

func (r *StaticGatewayConfigurationReconciler) ensureDeleted(
        ctx context.Context,
        gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration,
) error {
        log := log.FromContext(ctx)
        log.Info(fmt.Sprintf("Reconciling staticGatewayConfiguration deletion %s/%s", gwConfig.Namespace, gwConfig.Name))

        if !controllerutil.ContainsFinalizer(gwConfig, consts.SGCFinalizerName) {
                log.Info("gwConfig does not have finalizer, no additional cleanup needed")
                return nil
        }

        mc := metrics.NewMetricsContext(
                os.Getenv(consts.PodNamespaceEnvKey),
                "delete_static_gateway_configuration",
                "n/a",
                "n/a",
                strings.ToLower(fmt.Sprintf("%s/%s", gwConfig.Namespace, gwConfig.Name)),
        ) // no subscription_id/resource_group for SGC reconciler
        succeeded := false
        defer func() { mc.ObserveControllerReconcileMetrics(succeeded) }()

        secretDeleted := false
        log.Info("Deleting wireguard key")
        secret := &corev1.Secret{
                ObjectMeta: metav1.ObjectMeta{
                        Name:      fmt.Sprintf("sgw-%s", string(gwConfig.UID)),
                        Namespace: r.SecretNamespace,
                },
        }
        if err := r.Delete(ctx, secret); err != nil {
                if !apierrors.IsNotFound(err) {
                        log.Error(err, "failed to delete existing gateway LB configuration")
                        return err
                } else {
                        secretDeleted = true
                }
        }

        lbConfigDeleted := false
        log.Info("Deleting gateway LB configuration")
        lbConfig := &egressgatewayv1alpha1.GatewayLBConfiguration{
                ObjectMeta: metav1.ObjectMeta{
                        Name:      gwConfig.Name,
                        Namespace: gwConfig.Namespace,
                },
        }
        if err := r.Delete(ctx, lbConfig); err != nil {
                if !apierrors.IsNotFound(err) {
                        log.Error(err, "failed to delete existing gateway LB configuration")
                        return err
                } else {
                        lbConfigDeleted = true
                }
        }

        if secretDeleted && lbConfigDeleted {
                log.Info("Secret and LBConfig are deleted, removing finalizer")
                controllerutil.RemoveFinalizer(gwConfig, consts.SGCFinalizerName)
                if err := r.Update(ctx, gwConfig); err != nil {
                        log.Error(err, "failed to remove finalizer")
                        return err
                }
        }

        log.Info("staticGatewayConfiguration deletion reconciled")
        succeeded = true
        return nil
}

func validate(gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration) error {
        // need to validate either GatewayNodepoolName or GatewayVmssProfile is provided, but not both
        var allErrs field.ErrorList

        if gwConfig.Spec.GatewayNodepoolName == "" && vmssProfileIsEmpty(gwConfig) {
                allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("gatewaynodepoolname"),
                        fmt.Sprintf("GatewayNodepoolName: %s, GatewayVmssProfile: %#v", gwConfig.Spec.GatewayNodepoolName, gwConfig.Spec.GatewayVmssProfile),
                        "Either GatewayNodepoolName or GatewayVmssProfile must be provided"))
        }

        if gwConfig.Spec.GatewayNodepoolName != "" && !vmssProfileIsEmpty(gwConfig) {
                allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("gatewaynodepoolname"),
                        fmt.Sprintf("GatewayNodepoolName: %s, GatewayVmssProfile: %#v", gwConfig.Spec.GatewayNodepoolName, gwConfig.Spec.GatewayVmssProfile),
                        "Only one of GatewayNodepoolName and GatewayVmssProfile should be provided"))
        }

        if !vmssProfileIsEmpty(gwConfig) {
                if gwConfig.Spec.GatewayVmssProfile.VmssResourceGroup == "" {
                        allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("gatewayvmssprofile").Child("vmssresourcegroup"),
                                gwConfig.Spec.GatewayVmssProfile.VmssResourceGroup,
                                "Gateway vmss resource group is empty"))
                }
                if gwConfig.Spec.GatewayVmssProfile.VmssName == "" {
                        allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("gatewayvmssprofile").Child("vmssname"),
                                gwConfig.Spec.GatewayVmssProfile.VmssName,
                                "Gateway vmss name is empty"))
                }
                if gwConfig.Spec.GatewayVmssProfile.PublicIpPrefixSize < 0 || gwConfig.Spec.GatewayVmssProfile.PublicIpPrefixSize > 31 {
                        allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("gatewayvmssprofile").Child("publicipprefixsize"),
                                gwConfig.Spec.GatewayVmssProfile.PublicIpPrefixSize,
                                "Gateway vmss public ip prefix size should be between 0 and 31 inclusively"))
                }
        }

        if !gwConfig.Spec.ProvisionPublicIps && gwConfig.Spec.PublicIpPrefixId != "" {
                allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("publicipprefixid"),
                        gwConfig.Spec.PublicIpPrefixId,
                        "PublicIpPrefixId should be empty when ProvisionPublicIps is false"))
        }

        if len(allErrs) == 0 {
                return nil
        }
        return apierrors.NewInvalid(
                schema.GroupKind{Group: "egressgateway.kubernetes.azure.com", Kind: "StaticGatewayConfiguration"},
                gwConfig.Name, allErrs)
}

func vmssProfileIsEmpty(gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration) bool {
        return gwConfig.Spec.GatewayVmssProfile.VmssResourceGroup == "" &&
                gwConfig.Spec.GatewayVmssProfile.VmssName == "" &&
                gwConfig.Spec.GatewayVmssProfile.PublicIpPrefixSize == 0
}

func (r *StaticGatewayConfigurationReconciler) reconcileWireguardKey(
        ctx context.Context,
        gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration,
) error {
        log := log.FromContext(ctx)

        secret := &corev1.Secret{
                ObjectMeta: metav1.ObjectMeta{
                        Name:      fmt.Sprintf("sgw-%s", string(gwConfig.UID)),
                        Namespace: r.SecretNamespace,
                },
        }
        if _, err := controllerutil.CreateOrUpdate(ctx, r, secret, func() error {
                if secret.Labels == nil {
                        secret.Labels = make(map[string]string)
                }
                if sgcNS, ok := secret.Labels[consts.OwningSGCNamespaceLabel]; !ok || sgcNS != gwConfig.Namespace {
                        secret.Labels[consts.OwningSGCNamespaceLabel] = gwConfig.Namespace
                }
                if sgcName, ok := secret.Labels[consts.OwningSGCNameLabel]; !ok || sgcName != gwConfig.Name {
                        secret.Labels[consts.OwningSGCNameLabel] = gwConfig.Name
                }

                if secret.Data == nil {
                        secret.Data = make(map[string][]byte)
                }
                if _, ok := secret.Data[consts.WireguardPrivateKeyName]; !ok {
                        // create new private key
                        wgPrivateKey, err := wgtypes.GeneratePrivateKey()
                        if err != nil {
                                log.Error(err, "failed to generate wireguard private key")
                                return err
                        }

                        secret.Data[consts.WireguardPrivateKeyName] = []byte(wgPrivateKey.String())
                        secret.Data[consts.WireguardPublicKeyName] = []byte(wgPrivateKey.PublicKey().String())
                }

                return nil
        }); err != nil {
                log.Error(err, "failed to reconcile wireguard keypair secret")
                return err
        }
        if secret.DeletionTimestamp.IsZero() {
                // Update secret reference
                gwConfig.Status.PrivateKeySecretRef = &corev1.ObjectReference{
                        APIVersion: "v1",
                        Kind:       "Secret",
                        Name:       secret.Name,
                        Namespace:  secret.Namespace,
                }

                // Update public key
                gwConfig.Status.PublicKey = string(secret.Data[consts.WireguardPublicKeyName])
        }

        return nil
}

func (r *StaticGatewayConfigurationReconciler) reconcileGatewayLBConfig(
        ctx context.Context,
        gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration,
) error {
        log := log.FromContext(ctx)

        // check existence of the gatewayLBConfig
        lbConfig := &egressgatewayv1alpha1.GatewayLBConfiguration{
                ObjectMeta: metav1.ObjectMeta{
                        Name:      gwConfig.Name,
                        Namespace: gwConfig.Namespace,
                },
        }
        if _, err := controllerutil.CreateOrPatch(ctx, r, lbConfig, func() error {
                lbConfig.Spec.GatewayNodepoolName = gwConfig.Spec.GatewayNodepoolName
                lbConfig.Spec.GatewayVmssProfile = gwConfig.Spec.GatewayVmssProfile
                lbConfig.Spec.ProvisionPublicIps = gwConfig.Spec.ProvisionPublicIps
                lbConfig.Spec.PublicIpPrefixId = gwConfig.Spec.PublicIpPrefixId
                return controllerutil.SetControllerReference(gwConfig, lbConfig, r.Client.Scheme())
        }); err != nil {
                log.Error(err, "failed to reconcile gateway lb configuration")
                return err
        }
        if lbConfig.DeletionTimestamp.IsZero() && lbConfig.Status != nil {
                gwConfig.Status.Ip = lbConfig.Status.FrontendIp
                gwConfig.Status.Port = lbConfig.Status.ServerPort
                gwConfig.Status.EgressIpPrefix = lbConfig.Status.EgressIpPrefix
        }

        return nil
}

1	// Copyright (c) Microsoft Corporation.
2	// Licensed under the MIT license.
3
4	package manager
5
6	import (
7	"context"
8	"fmt"
9	"os"
10	"strings"
11
12	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
13	corev1 "k8s.io/api/core/v1"
14	apierrors "k8s.io/apimachinery/pkg/api/errors"
15	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
16	"k8s.io/apimachinery/pkg/runtime/schema"
17	"k8s.io/apimachinery/pkg/util/validation/field"
18	"k8s.io/client-go/tools/record"
19	ctrl "sigs.k8s.io/controller-runtime"
20	"sigs.k8s.io/controller-runtime/pkg/builder"
21	"sigs.k8s.io/controller-runtime/pkg/client"
22	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
23	"sigs.k8s.io/controller-runtime/pkg/event"
24	"sigs.k8s.io/controller-runtime/pkg/handler"
25	"sigs.k8s.io/controller-runtime/pkg/log"
26	"sigs.k8s.io/controller-runtime/pkg/predicate"
27	"sigs.k8s.io/controller-runtime/pkg/reconcile"
28
29	egressgatewayv1alpha1 "github.com/Azure/kube-egress-gateway/api/v1alpha1"
30	"github.com/Azure/kube-egress-gateway/pkg/consts"
31	"github.com/Azure/kube-egress-gateway/pkg/metrics"
32	)
33
34	var _ reconcile.Reconciler = &StaticGatewayConfigurationReconciler{}
35
36	// StaticGatewayConfigurationReconciler reconciles gateway loadBalancer according to a StaticGatewayConfiguration object
37	type StaticGatewayConfigurationReconciler struct {
38	client.Client
39	SecretNamespace string
40	Recorder record.EventRecorder
41	}
42
43	//+kubebuilder:rbac:groups=core,resources=events,verbs=create;patch
44	//+kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch;delete
45	//+kubebuilder:rbac:groups=egressgateway.kubernetes.azure.com,resources=staticgatewayconfigurations,verbs=get;list;watch;create;update;patch;delete
46	//+kubebuilder:rbac:groups=egressgateway.kubernetes.azure.com,resources=staticgatewayconfigurations/status,verbs=get;update;patch
47	//+kubebuilder:rbac:groups=egressgateway.kubernetes.azure.com,resources=gatewaylbconfigurations,verbs=get;list;watch;create;update;patch;delete
48	//+kubebuilder:rbac:groups=egressgateway.kubernetes.azure.com,resources=gatewaylbconfigurations/status,verbs=get;update;patch
49
50	// Reconcile is part of the main kubernetes reconciliation loop which aims to
51	// move the current state of the cluster closer to the desired state.
52	func (r *StaticGatewayConfigurationReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {	1✔
53	log := log.FromContext(ctx)	1✔
54		1✔
55	// Fetch the StaticGatewayConfiguration instance.	1✔
56	gwConfig := &egressgatewayv1alpha1.StaticGatewayConfiguration{}	1✔
57	if err := r.Get(ctx, req.NamespacedName, gwConfig); err != nil {	1✔
58	if apierrors.IsNotFound(err) {	×
59	// Object not found, return.	×
60	return ctrl.Result{}, nil	×
61	}	×
62	log.Error(err, "unable to fetch StaticGatewayConfiguration instance")	×
63	return ctrl.Result{}, err	×
64	}
65
66	if !gwConfig.ObjectMeta.DeletionTimestamp.IsZero() {	2✔
67	// Clean up staticGatewayConfiguration	1✔
68	return ctrl.Result{}, r.ensureDeleted(ctx, gwConfig)	1✔
69	}	1✔
70
71	return ctrl.Result{}, r.reconcile(ctx, gwConfig)	1✔
72	}
73
74	// SetupWithManager sets up the controller with the Manager.
75	func (r *StaticGatewayConfigurationReconciler) SetupWithManager(mgr ctrl.Manager) error {	1✔
76	secretPredicate := predicate.Funcs{	1✔
77	CreateFunc: func(e event.CreateEvent) bool {	2✔
78	// no need to trigger reconcile for secrets creation	1✔
79	return false	1✔
80	},	1✔
81	UpdateFunc: func(e event.UpdateEvent) bool {	×
82	return strings.EqualFold(e.ObjectOld.GetNamespace(), r.SecretNamespace)	×
83	},	×
84	DeleteFunc: func(e event.DeleteEvent) bool {	1✔
85	return strings.EqualFold(e.Object.GetNamespace(), r.SecretNamespace)	1✔
86	},	1✔
87	GenericFunc: func(e event.GenericEvent) bool {	×
88	return false	×
89	},	×
90	}
91	return ctrl.NewControllerManagedBy(mgr).	1✔
92	For(&egressgatewayv1alpha1.StaticGatewayConfiguration{}).	1✔
93	Owns(&egressgatewayv1alpha1.GatewayLBConfiguration{}).	1✔
94	// generated secrets created in the dedicated namespace	1✔
95	Watches(&corev1.Secret{}, enqueueOwningSGCFromLabels(), builder.WithPredicates(secretPredicate)).	1✔
96	Complete(r)	1✔
97	}
98
99	func enqueueOwningSGCFromLabels() handler.EventHandler {	1✔
100	return handler.EnqueueRequestsFromMapFunc(func(_ context.Context, o client.Object) []reconcile.Request {	2✔
101	labels := o.GetLabels()	1✔
102	if labels == nil {	1✔
103	return nil	×
104	}	×
105
106	owningSGCNamespace, foundNamespace := labels[consts.OwningSGCNamespaceLabel]	1✔
107	owningSGCName, foundName := labels[consts.OwningSGCNameLabel]	1✔
108		1✔
109	if !foundNamespace \|\| !foundName {	1✔
110	return nil	×
111	}	×
112
113	return []reconcile.Request{	1✔
114	{	1✔
115	NamespacedName: client.ObjectKey{	1✔
116	Name: owningSGCName,	1✔
117	Namespace: owningSGCNamespace,	1✔
118	},	1✔
119	},	1✔
120	}	1✔
121	})
122	}
123
124	func (r *StaticGatewayConfigurationReconciler) reconcile(
125	ctx context.Context,
126	gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration,
127	) error {	1✔
128	log := log.FromContext(ctx)	1✔
129	log.Info(fmt.Sprintf("Reconciling staticGatewayConfiguration %s/%s", gwConfig.Namespace, gwConfig.Name))	1✔
130		1✔
131	mc := metrics.NewMetricsContext(	1✔
132	os.Getenv(consts.PodNamespaceEnvKey),	1✔
133	"reconcile_static_gateway_configuration",	1✔
134	"n/a",	1✔
135	"n/a",	1✔
136	strings.ToLower(fmt.Sprintf("%s/%s", gwConfig.Namespace, gwConfig.Name)),	1✔
137	) // no subscription_id/resource_group for SGC reconciler	1✔
138	succeeded := false	1✔
139	defer func() { mc.ObserveControllerReconcileMetrics(succeeded) }()	2✔
140
141	if err := validate(gwConfig); err != nil {	1✔
142	return err	×
143	}	×
144
145	if !controllerutil.ContainsFinalizer(gwConfig, consts.SGCFinalizerName) {	2✔
146	log.Info("Adding finalizer")	1✔
147	controllerutil.AddFinalizer(gwConfig, consts.SGCFinalizerName)	1✔
148	err := r.Update(ctx, gwConfig)	1✔
149	if err != nil {	1✔
150	log.Error(err, "failed to add finalizer")	×
151	return err	×
152	}	×
153	}
154
155	_, err := controllerutil.CreateOrPatch(ctx, r, gwConfig, func() error {	2✔
156	// reconcile wireguard keypair	1✔
157	if err := r.reconcileWireguardKey(ctx, gwConfig); err != nil {	1✔
158	log.Error(err, "failed to reconcile wireguard key")	×
159	r.Recorder.Event(gwConfig, corev1.EventTypeWarning, "ReconcileError", err.Error())	×
160	return err	×
161	}	×
162
163	// reconcile lbconfig
164	if err := r.reconcileGatewayLBConfig(ctx, gwConfig); err != nil {	1✔
165	log.Error(err, "failed to reconcile gateway LB configuration")	×
166	r.Recorder.Event(gwConfig, corev1.EventTypeWarning, "ReconcileError", err.Error())	×
167	return err	×
168	}	×
169
170	return nil	1✔
171	})
172
173	prefix, reconcileStatus := "<pending>", "Reconciling"	1✔
174	if gwConfig.Status.EgressIpPrefix != "" {	2✔
175	prefix, reconcileStatus = gwConfig.Status.EgressIpPrefix, "Reconciled"	1✔
176	}	1✔
177	r.Recorder.Eventf(gwConfig, corev1.EventTypeNormal, reconcileStatus, "StaticGatewayConfiguration provisioned with egress prefix %s", prefix)	1✔
178	log.Info("staticGatewayConfiguration reconciled")	1✔
179	succeeded = true	1✔
180	return err	1✔
181	}
182
183	func (r *StaticGatewayConfigurationReconciler) ensureDeleted(
184	ctx context.Context,
185	gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration,
186	) error {	1✔
187	log := log.FromContext(ctx)	1✔
188	log.Info(fmt.Sprintf("Reconciling staticGatewayConfiguration deletion %s/%s", gwConfig.Namespace, gwConfig.Name))	1✔
189		1✔
190	if !controllerutil.ContainsFinalizer(gwConfig, consts.SGCFinalizerName) {	2✔
191	log.Info("gwConfig does not have finalizer, no additional cleanup needed")	1✔
192	return nil	1✔
193	}	1✔
194
195	mc := metrics.NewMetricsContext(	1✔
196	os.Getenv(consts.PodNamespaceEnvKey),	1✔
197	"delete_static_gateway_configuration",	1✔
198	"n/a",	1✔
199	"n/a",	1✔
200	strings.ToLower(fmt.Sprintf("%s/%s", gwConfig.Namespace, gwConfig.Name)),	1✔
201	) // no subscription_id/resource_group for SGC reconciler	1✔
202	succeeded := false	1✔
203	defer func() { mc.ObserveControllerReconcileMetrics(succeeded) }()	2✔
204
205	secretDeleted := false	1✔
206	log.Info("Deleting wireguard key")	1✔
207	secret := &corev1.Secret{	1✔
208	ObjectMeta: metav1.ObjectMeta{	1✔
209	Name: fmt.Sprintf("sgw-%s", string(gwConfig.UID)),	1✔
210	Namespace: r.SecretNamespace,	1✔
211	},	1✔
212	}	1✔
213	if err := r.Delete(ctx, secret); err != nil {	2✔
214	if !apierrors.IsNotFound(err) {	1✔
215	log.Error(err, "failed to delete existing gateway LB configuration")	×
216	return err	×
217	} else {	1✔
218	secretDeleted = true	1✔
219	}	1✔
220	}
221
222	lbConfigDeleted := false	1✔
223	log.Info("Deleting gateway LB configuration")	1✔
224	lbConfig := &egressgatewayv1alpha1.GatewayLBConfiguration{	1✔
225	ObjectMeta: metav1.ObjectMeta{	1✔
226	Name: gwConfig.Name,	1✔
227	Namespace: gwConfig.Namespace,	1✔
228	},	1✔
229	}	1✔
230	if err := r.Delete(ctx, lbConfig); err != nil {	2✔
231	if !apierrors.IsNotFound(err) {	1✔
232	log.Error(err, "failed to delete existing gateway LB configuration")	×
233	return err	×
234	} else {	1✔
235	lbConfigDeleted = true	1✔
236	}	1✔
237	}
238
239	if secretDeleted && lbConfigDeleted {	2✔
240	log.Info("Secret and LBConfig are deleted, removing finalizer")	1✔
241	controllerutil.RemoveFinalizer(gwConfig, consts.SGCFinalizerName)	1✔
242	if err := r.Update(ctx, gwConfig); err != nil {	1✔
243	log.Error(err, "failed to remove finalizer")	×
244	return err	×
245	}	×
246	}
247
248	log.Info("staticGatewayConfiguration deletion reconciled")	1✔
249	succeeded = true	1✔
250	return nil	1✔
251	}
252
253	func validate(gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration) error {	1✔
254	// need to validate either GatewayNodepoolName or GatewayVmssProfile is provided, but not both	1✔
255	var allErrs field.ErrorList	1✔
256		1✔
257	if gwConfig.Spec.GatewayNodepoolName == "" && vmssProfileIsEmpty(gwConfig) {	2✔
258	allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("gatewaynodepoolname"),	1✔
259	fmt.Sprintf("GatewayNodepoolName: %s, GatewayVmssProfile: %#v", gwConfig.Spec.GatewayNodepoolName, gwConfig.Spec.GatewayVmssProfile),	1✔
260	"Either GatewayNodepoolName or GatewayVmssProfile must be provided"))	1✔
261	}	1✔
262
263	if gwConfig.Spec.GatewayNodepoolName != "" && !vmssProfileIsEmpty(gwConfig) {	2✔
264	allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("gatewaynodepoolname"),	1✔
265	fmt.Sprintf("GatewayNodepoolName: %s, GatewayVmssProfile: %#v", gwConfig.Spec.GatewayNodepoolName, gwConfig.Spec.GatewayVmssProfile),	1✔
266	"Only one of GatewayNodepoolName and GatewayVmssProfile should be provided"))	1✔
267	}	1✔
268
269	if !vmssProfileIsEmpty(gwConfig) {	2✔
270	if gwConfig.Spec.GatewayVmssProfile.VmssResourceGroup == "" {	2✔
271	allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("gatewayvmssprofile").Child("vmssresourcegroup"),	1✔
272	gwConfig.Spec.GatewayVmssProfile.VmssResourceGroup,	1✔
273	"Gateway vmss resource group is empty"))	1✔
274	}	1✔
275	if gwConfig.Spec.GatewayVmssProfile.VmssName == "" {	2✔
276	allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("gatewayvmssprofile").Child("vmssname"),	1✔
277	gwConfig.Spec.GatewayVmssProfile.VmssName,	1✔
278	"Gateway vmss name is empty"))	1✔
279	}	1✔
280	if gwConfig.Spec.GatewayVmssProfile.PublicIpPrefixSize < 0 \|\| gwConfig.Spec.GatewayVmssProfile.PublicIpPrefixSize > 31 {	2✔
281	allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("gatewayvmssprofile").Child("publicipprefixsize"),	1✔
282	gwConfig.Spec.GatewayVmssProfile.PublicIpPrefixSize,	1✔
283	"Gateway vmss public ip prefix size should be between 0 and 31 inclusively"))	1✔
284	}	1✔
285	}
286
287	if !gwConfig.Spec.ProvisionPublicIps && gwConfig.Spec.PublicIpPrefixId != "" {	2✔
288	allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("publicipprefixid"),	1✔
289	gwConfig.Spec.PublicIpPrefixId,	1✔
290	"PublicIpPrefixId should be empty when ProvisionPublicIps is false"))	1✔
291	}	1✔
292
293	if len(allErrs) == 0 {	2✔
294	return nil	1✔
295	}	1✔
296	return apierrors.NewInvalid(	1✔
297	schema.GroupKind{Group: "egressgateway.kubernetes.azure.com", Kind: "StaticGatewayConfiguration"},	1✔
298	gwConfig.Name, allErrs)	1✔
299	}
300
301	func vmssProfileIsEmpty(gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration) bool {	1✔
302	return gwConfig.Spec.GatewayVmssProfile.VmssResourceGroup == "" &&	1✔
303	gwConfig.Spec.GatewayVmssProfile.VmssName == "" &&	1✔
304	gwConfig.Spec.GatewayVmssProfile.PublicIpPrefixSize == 0	1✔
305	}	1✔
306
307	func (r *StaticGatewayConfigurationReconciler) reconcileWireguardKey(
308	ctx context.Context,
309	gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration,
310	) error {	1✔
311	log := log.FromContext(ctx)	1✔
312		1✔
313	secret := &corev1.Secret{	1✔
314	ObjectMeta: metav1.ObjectMeta{	1✔
315	Name: fmt.Sprintf("sgw-%s", string(gwConfig.UID)),	1✔
316	Namespace: r.SecretNamespace,	1✔
317	},	1✔
318	}	1✔
319	if _, err := controllerutil.CreateOrUpdate(ctx, r, secret, func() error {	2✔
320	if secret.Labels == nil {	2✔
321	secret.Labels = make(map[string]string)	1✔
322	}	1✔
323	if sgcNS, ok := secret.Labels[consts.OwningSGCNamespaceLabel]; !ok \|\| sgcNS != gwConfig.Namespace {	2✔
324	secret.Labels[consts.OwningSGCNamespaceLabel] = gwConfig.Namespace	1✔
325	}	1✔
326	if sgcName, ok := secret.Labels[consts.OwningSGCNameLabel]; !ok \|\| sgcName != gwConfig.Name {	2✔
327	secret.Labels[consts.OwningSGCNameLabel] = gwConfig.Name	1✔
328	}	1✔
329
330	if secret.Data == nil {	2✔
331	secret.Data = make(map[string][]byte)	1✔
332	}	1✔
333	if _, ok := secret.Data[consts.WireguardPrivateKeyName]; !ok {	2✔
334	// create new private key	1✔
335	wgPrivateKey, err := wgtypes.GeneratePrivateKey()	1✔
336	if err != nil {	1✔
337	log.Error(err, "failed to generate wireguard private key")	×
338	return err	×
339	}	×
340
341	secret.Data[consts.WireguardPrivateKeyName] = []byte(wgPrivateKey.String())	1✔
342	secret.Data[consts.WireguardPublicKeyName] = []byte(wgPrivateKey.PublicKey().String())	1✔
343	}
344
345	return nil	1✔
346	}); err != nil {	×
347	log.Error(err, "failed to reconcile wireguard keypair secret")	×
348	return err	×
349	}	×
350	if secret.DeletionTimestamp.IsZero() {	2✔
351	// Update secret reference	1✔
352	gwConfig.Status.PrivateKeySecretRef = &corev1.ObjectReference{	1✔
353	APIVersion: "v1",	1✔
354	Kind: "Secret",	1✔
355	Name: secret.Name,	1✔
356	Namespace: secret.Namespace,	1✔
357	}	1✔
358		1✔
359	// Update public key	1✔
360	gwConfig.Status.PublicKey = string(secret.Data[consts.WireguardPublicKeyName])	1✔
361	}	1✔
362
363	return nil	1✔
364	}
365
366	func (r *StaticGatewayConfigurationReconciler) reconcileGatewayLBConfig(
367	ctx context.Context,
368	gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration,
369	) error {	1✔
370	log := log.FromContext(ctx)	1✔
371		1✔
372	// check existence of the gatewayLBConfig	1✔
373	lbConfig := &egressgatewayv1alpha1.GatewayLBConfiguration{	1✔
374	ObjectMeta: metav1.ObjectMeta{	1✔
375	Name: gwConfig.Name,	1✔
376	Namespace: gwConfig.Namespace,	1✔
377	},	1✔
378	}	1✔
379	if _, err := controllerutil.CreateOrPatch(ctx, r, lbConfig, func() error {	2✔
380	lbConfig.Spec.GatewayNodepoolName = gwConfig.Spec.GatewayNodepoolName	1✔
381	lbConfig.Spec.GatewayVmssProfile = gwConfig.Spec.GatewayVmssProfile	1✔
382	lbConfig.Spec.ProvisionPublicIps = gwConfig.Spec.ProvisionPublicIps	1✔
383	lbConfig.Spec.PublicIpPrefixId = gwConfig.Spec.PublicIpPrefixId	1✔
384	return controllerutil.SetControllerReference(gwConfig, lbConfig, r.Client.Scheme())	1✔
385	}); err != nil {	1✔
386	log.Error(err, "failed to reconcile gateway lb configuration")	×
387	return err	×
388	}	×
389	if lbConfig.DeletionTimestamp.IsZero() && lbConfig.Status != nil {	2✔
390	gwConfig.Status.Ip = lbConfig.Status.FrontendIp	1✔
391	gwConfig.Status.Port = lbConfig.Status.ServerPort	1✔
392	gwConfig.Status.EgressIpPrefix = lbConfig.Status.EgressIpPrefix	1✔
393	}	1✔
394
395	return nil	1✔
396	}

Azure / kube-egress-gateway / 9006283803

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous