9867817318

Committed 10 Jul 2024 03:40AM UTC coverage: 80.714% (-0.08%) from 80.795%

Build # 9867817318

Build Type

push

github

Committed by

jwtty

Commit Message

Bump aquasecurity/trivy-action from 0.23.0 to 0.24.0

Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.23.0 to 0.24.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](https://github.com/aquasecurity/trivy-action/compare/7c2007bcb...6e7b7d1fd)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Run Details

3005 of 3723 relevant lines covered (80.71%)

0.94 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

83.33

/controllers/manager/staticgatewayconfiguration_controller.go

// Copyright (c) Microsoft Corporation.
// Licensed under the MIT license.

package manager

import (
        "context"
        "fmt"
        "os"
        "strings"

        "golang.zx2c4.com/wireguard/wgctrl/wgtypes"
        corev1 "k8s.io/api/core/v1"
        apierrors "k8s.io/apimachinery/pkg/api/errors"
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        "k8s.io/apimachinery/pkg/runtime/schema"
        "k8s.io/apimachinery/pkg/util/validation/field"
        "k8s.io/client-go/tools/record"
        ctrl "sigs.k8s.io/controller-runtime"
        "sigs.k8s.io/controller-runtime/pkg/builder"
        "sigs.k8s.io/controller-runtime/pkg/client"
        "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
        "sigs.k8s.io/controller-runtime/pkg/event"
        "sigs.k8s.io/controller-runtime/pkg/handler"
        "sigs.k8s.io/controller-runtime/pkg/log"
        "sigs.k8s.io/controller-runtime/pkg/predicate"
        "sigs.k8s.io/controller-runtime/pkg/reconcile"

        egressgatewayv1alpha1 "github.com/Azure/kube-egress-gateway/api/v1alpha1"
        "github.com/Azure/kube-egress-gateway/pkg/consts"
        "github.com/Azure/kube-egress-gateway/pkg/metrics"
)

var _ reconcile.Reconciler = &StaticGatewayConfigurationReconciler{}

// StaticGatewayConfigurationReconciler reconciles gateway loadBalancer according to a StaticGatewayConfiguration object
type StaticGatewayConfigurationReconciler struct {
        client.Client
        SecretNamespace string
        Recorder        record.EventRecorder
}

//+kubebuilder:rbac:groups=core,resources=events,verbs=create;patch
//+kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups=egressgateway.kubernetes.azure.com,resources=staticgatewayconfigurations,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups=egressgateway.kubernetes.azure.com,resources=staticgatewayconfigurations/status,verbs=get;update;patch
//+kubebuilder:rbac:groups=egressgateway.kubernetes.azure.com,resources=gatewaylbconfigurations,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups=egressgateway.kubernetes.azure.com,resources=gatewaylbconfigurations/status,verbs=get;update;patch

// Reconcile is part of the main kubernetes reconciliation loop which aims to
// move the current state of the cluster closer to the desired state.
func (r *StaticGatewayConfigurationReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
        log := log.FromContext(ctx)

        // Fetch the StaticGatewayConfiguration instance.
        gwConfig := &egressgatewayv1alpha1.StaticGatewayConfiguration{}
        if err := r.Get(ctx, req.NamespacedName, gwConfig); err != nil {
                if apierrors.IsNotFound(err) {
                        // Object not found, return.
                        return ctrl.Result{}, nil
                }
                log.Error(err, "unable to fetch StaticGatewayConfiguration instance")
                return ctrl.Result{}, err
        }

        if !gwConfig.ObjectMeta.DeletionTimestamp.IsZero() {
                // Clean up staticGatewayConfiguration
                return ctrl.Result{}, r.ensureDeleted(ctx, gwConfig)
        }

        return ctrl.Result{}, r.reconcile(ctx, gwConfig)
}

// SetupWithManager sets up the controller with the Manager.
func (r *StaticGatewayConfigurationReconciler) SetupWithManager(mgr ctrl.Manager) error {
        secretPredicate := predicate.Funcs{
                CreateFunc: func(e event.CreateEvent) bool {
                        // no need to trigger reconcile for secrets creation
                        return false
                },
                UpdateFunc: func(e event.UpdateEvent) bool {
                        return strings.EqualFold(e.ObjectOld.GetNamespace(), r.SecretNamespace)
                },
                DeleteFunc: func(e event.DeleteEvent) bool {
                        return strings.EqualFold(e.Object.GetNamespace(), r.SecretNamespace)
                },
                GenericFunc: func(e event.GenericEvent) bool {
                        return false
                },
        }
        return ctrl.NewControllerManagedBy(mgr).
                For(&egressgatewayv1alpha1.StaticGatewayConfiguration{}).
                Owns(&egressgatewayv1alpha1.GatewayLBConfiguration{}).
                // generated secrets created in the dedicated namespace
                Watches(&corev1.Secret{}, enqueueOwningSGCFromLabels(), builder.WithPredicates(secretPredicate)).
                Complete(r)
}

func enqueueOwningSGCFromLabels() handler.EventHandler {
        return handler.EnqueueRequestsFromMapFunc(func(_ context.Context, o client.Object) []reconcile.Request {
                labels := o.GetLabels()
                if labels == nil {
                        return nil
                }

                owningSGCNamespace, foundNamespace := labels[consts.OwningSGCNamespaceLabel]
                owningSGCName, foundName := labels[consts.OwningSGCNameLabel]

                if !foundNamespace || !foundName {
                        return nil
                }

                return []reconcile.Request{
                        {
                                NamespacedName: client.ObjectKey{
                                        Name:      owningSGCName,
                                        Namespace: owningSGCNamespace,
                                },
                        },
                }
        })
}

func (r *StaticGatewayConfigurationReconciler) reconcile(
        ctx context.Context,
        gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration,
) error {
        log := log.FromContext(ctx)
        log.Info(fmt.Sprintf("Reconciling staticGatewayConfiguration %s/%s", gwConfig.Namespace, gwConfig.Name))

        mc := metrics.NewMetricsContext(
                os.Getenv(consts.PodNamespaceEnvKey),
                "reconcile_static_gateway_configuration",
                "n/a",
                "n/a",
                strings.ToLower(fmt.Sprintf("%s/%s", gwConfig.Namespace, gwConfig.Name)),
        ) // no subscription_id/resource_group for SGC reconciler
        succeeded := false
        defer func() { mc.ObserveControllerReconcileMetrics(succeeded) }()

        if err := validate(gwConfig); err != nil {
                r.Recorder.Event(gwConfig, corev1.EventTypeWarning, "InvalidSpec", err.Error())
                return err
        }

        if !controllerutil.ContainsFinalizer(gwConfig, consts.SGCFinalizerName) {
                log.Info("Adding finalizer")
                controllerutil.AddFinalizer(gwConfig, consts.SGCFinalizerName)
                err := r.Update(ctx, gwConfig)
                if err != nil {
                        log.Error(err, "failed to add finalizer")
                        return err
                }
        }

        _, err := controllerutil.CreateOrPatch(ctx, r, gwConfig, func() error {
                // reconcile wireguard keypair
                if err := r.reconcileWireguardKey(ctx, gwConfig); err != nil {
                        log.Error(err, "failed to reconcile wireguard key")
                        r.Recorder.Event(gwConfig, corev1.EventTypeWarning, "ReconcileError", err.Error())
                        return err
                }

                // reconcile lbconfig
                if err := r.reconcileGatewayLBConfig(ctx, gwConfig); err != nil {
                        log.Error(err, "failed to reconcile gateway LB configuration")
                        r.Recorder.Event(gwConfig, corev1.EventTypeWarning, "ReconcileError", err.Error())
                        return err
                }

                return nil
        })

        prefix, reconcileStatus := "<pending>", "Reconciling"
        if gwConfig.Status.EgressIpPrefix != "" {
                prefix, reconcileStatus = gwConfig.Status.EgressIpPrefix, "Reconciled"
        }
        r.Recorder.Eventf(gwConfig, corev1.EventTypeNormal, reconcileStatus, "StaticGatewayConfiguration provisioned with egress prefix %s", prefix)
        log.Info("staticGatewayConfiguration reconciled")
        succeeded = true
        return err
}

func (r *StaticGatewayConfigurationReconciler) ensureDeleted(
        ctx context.Context,
        gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration,
) error {
        log := log.FromContext(ctx)
        log.Info(fmt.Sprintf("Reconciling staticGatewayConfiguration deletion %s/%s", gwConfig.Namespace, gwConfig.Name))

        if !controllerutil.ContainsFinalizer(gwConfig, consts.SGCFinalizerName) {
                log.Info("gwConfig does not have finalizer, no additional cleanup needed")
                return nil
        }

        mc := metrics.NewMetricsContext(
                os.Getenv(consts.PodNamespaceEnvKey),
                "delete_static_gateway_configuration",
                "n/a",
                "n/a",
                strings.ToLower(fmt.Sprintf("%s/%s", gwConfig.Namespace, gwConfig.Name)),
        ) // no subscription_id/resource_group for SGC reconciler
        succeeded := false
        defer func() { mc.ObserveControllerReconcileMetrics(succeeded) }()

        secretDeleted := false
        log.Info("Deleting wireguard key")
        secret := &corev1.Secret{
                ObjectMeta: metav1.ObjectMeta{
                        Name:      fmt.Sprintf("sgw-%s", string(gwConfig.UID)),
                        Namespace: r.SecretNamespace,
                },
        }
        if err := r.Delete(ctx, secret); err != nil {
                if !apierrors.IsNotFound(err) {
                        log.Error(err, "failed to delete existing gateway LB configuration")
                        return err
                } else {
                        secretDeleted = true
                }
        }

        lbConfigDeleted := false
        log.Info("Deleting gateway LB configuration")
        lbConfig := &egressgatewayv1alpha1.GatewayLBConfiguration{
                ObjectMeta: metav1.ObjectMeta{
                        Name:      gwConfig.Name,
                        Namespace: gwConfig.Namespace,
                },
        }
        if err := r.Delete(ctx, lbConfig); err != nil {
                if !apierrors.IsNotFound(err) {
                        log.Error(err, "failed to delete existing gateway LB configuration")
                        return err
                } else {
                        lbConfigDeleted = true
                }
        }

        if secretDeleted && lbConfigDeleted {
                log.Info("Secret and LBConfig are deleted, removing finalizer")
                controllerutil.RemoveFinalizer(gwConfig, consts.SGCFinalizerName)
                if err := r.Update(ctx, gwConfig); err != nil {
                        log.Error(err, "failed to remove finalizer")
                        return err
                }
        }

        log.Info("staticGatewayConfiguration deletion reconciled")
        succeeded = true
        return nil
}

func validate(gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration) error {
        // need to validate either GatewayNodepoolName or GatewayVmssProfile is provided, but not both
        var allErrs field.ErrorList

        if gwConfig.Spec.GatewayNodepoolName == "" && vmssProfileIsEmpty(gwConfig) {
                allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("gatewaynodepoolname"),
                        fmt.Sprintf("GatewayNodepoolName: %s, GatewayVmssProfile: %#v", gwConfig.Spec.GatewayNodepoolName, gwConfig.Spec.GatewayVmssProfile),
                        "Either GatewayNodepoolName or GatewayVmssProfile must be provided"))
        }

        if gwConfig.Spec.GatewayNodepoolName != "" && !vmssProfileIsEmpty(gwConfig) {
                allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("gatewaynodepoolname"),
                        fmt.Sprintf("GatewayNodepoolName: %s, GatewayVmssProfile: %#v", gwConfig.Spec.GatewayNodepoolName, gwConfig.Spec.GatewayVmssProfile),
                        "Only one of GatewayNodepoolName and GatewayVmssProfile should be provided"))
        }

        if !vmssProfileIsEmpty(gwConfig) {
                if gwConfig.Spec.GatewayVmssProfile.VmssResourceGroup == "" {
                        allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("gatewayvmssprofile").Child("vmssresourcegroup"),
                                gwConfig.Spec.GatewayVmssProfile.VmssResourceGroup,
                                "Gateway vmss resource group is empty"))
                }
                if gwConfig.Spec.GatewayVmssProfile.VmssName == "" {
                        allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("gatewayvmssprofile").Child("vmssname"),
                                gwConfig.Spec.GatewayVmssProfile.VmssName,
                                "Gateway vmss name is empty"))
                }
                if gwConfig.Spec.GatewayVmssProfile.PublicIpPrefixSize < 0 || gwConfig.Spec.GatewayVmssProfile.PublicIpPrefixSize > 31 {
                        allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("gatewayvmssprofile").Child("publicipprefixsize"),
                                gwConfig.Spec.GatewayVmssProfile.PublicIpPrefixSize,
                                "Gateway vmss public ip prefix size should be between 0 and 31 inclusively"))
                }
        }

        if !gwConfig.Spec.ProvisionPublicIps && gwConfig.Spec.PublicIpPrefixId != "" {
                allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("publicipprefixid"),
                        gwConfig.Spec.PublicIpPrefixId,
                        "PublicIpPrefixId should be empty when ProvisionPublicIps is false"))
        }

        if len(allErrs) == 0 {
                return nil
        }
        return apierrors.NewInvalid(
                schema.GroupKind{Group: "egressgateway.kubernetes.azure.com", Kind: "StaticGatewayConfiguration"},
                gwConfig.Name, allErrs)
}

func vmssProfileIsEmpty(gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration) bool {
        return gwConfig.Spec.GatewayVmssProfile.VmssResourceGroup == "" &&
                gwConfig.Spec.GatewayVmssProfile.VmssName == "" &&
                gwConfig.Spec.GatewayVmssProfile.PublicIpPrefixSize == 0
}

func (r *StaticGatewayConfigurationReconciler) reconcileWireguardKey(
        ctx context.Context,
        gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration,
) error {
        log := log.FromContext(ctx)

        secret := &corev1.Secret{
                ObjectMeta: metav1.ObjectMeta{
                        Name:      fmt.Sprintf("sgw-%s", string(gwConfig.UID)),
                        Namespace: r.SecretNamespace,
                },
        }
        if _, err := controllerutil.CreateOrUpdate(ctx, r, secret, func() error {
                if secret.Labels == nil {
                        secret.Labels = make(map[string]string)
                }
                if sgcNS, ok := secret.Labels[consts.OwningSGCNamespaceLabel]; !ok || sgcNS != gwConfig.Namespace {
                        secret.Labels[consts.OwningSGCNamespaceLabel] = gwConfig.Namespace
                }
                if sgcName, ok := secret.Labels[consts.OwningSGCNameLabel]; !ok || sgcName != gwConfig.Name {
                        secret.Labels[consts.OwningSGCNameLabel] = gwConfig.Name
                }

                if secret.Data == nil {
                        secret.Data = make(map[string][]byte)
                }
                if _, ok := secret.Data[consts.WireguardPrivateKeyName]; !ok {
                        // create new private key
                        wgPrivateKey, err := wgtypes.GeneratePrivateKey()
                        if err != nil {
                                log.Error(err, "failed to generate wireguard private key")
                                return err
                        }

                        secret.Data[consts.WireguardPrivateKeyName] = []byte(wgPrivateKey.String())
                        secret.Data[consts.WireguardPublicKeyName] = []byte(wgPrivateKey.PublicKey().String())
                }

                return nil
        }); err != nil {
                log.Error(err, "failed to reconcile wireguard keypair secret")
                return err
        }
        if secret.DeletionTimestamp.IsZero() {
                // Update secret reference
                gwConfig.Status.PrivateKeySecretRef = &corev1.ObjectReference{
                        APIVersion: "v1",
                        Kind:       "Secret",
                        Name:       secret.Name,
                        Namespace:  secret.Namespace,
                }

                // Update public key
                gwConfig.Status.PublicKey = string(secret.Data[consts.WireguardPublicKeyName])
        }

        return nil
}

func (r *StaticGatewayConfigurationReconciler) reconcileGatewayLBConfig(
        ctx context.Context,
        gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration,
) error {
        log := log.FromContext(ctx)

        // check existence of the gatewayLBConfig
        lbConfig := &egressgatewayv1alpha1.GatewayLBConfiguration{
                ObjectMeta: metav1.ObjectMeta{
                        Name:      gwConfig.Name,
                        Namespace: gwConfig.Namespace,
                },
        }
        if _, err := controllerutil.CreateOrPatch(ctx, r, lbConfig, func() error {
                lbConfig.Spec.GatewayNodepoolName = gwConfig.Spec.GatewayNodepoolName
                lbConfig.Spec.GatewayVmssProfile = gwConfig.Spec.GatewayVmssProfile
                lbConfig.Spec.ProvisionPublicIps = gwConfig.Spec.ProvisionPublicIps
                lbConfig.Spec.PublicIpPrefixId = gwConfig.Spec.PublicIpPrefixId
                return controllerutil.SetControllerReference(gwConfig, lbConfig, r.Client.Scheme())
        }); err != nil {
                log.Error(err, "failed to reconcile gateway lb configuration")
                return err
        }
        if lbConfig.DeletionTimestamp.IsZero() && lbConfig.Status != nil {
                gwConfig.Status.Ip = lbConfig.Status.FrontendIp
                gwConfig.Status.Port = lbConfig.Status.ServerPort
                gwConfig.Status.EgressIpPrefix = lbConfig.Status.EgressIpPrefix
        }

        return nil
}

1	// Copyright (c) Microsoft Corporation.
2	// Licensed under the MIT license.
3
4	package manager
5
6	import (
7	"context"
8	"fmt"
9	"os"
10	"strings"
11
12	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
13	corev1 "k8s.io/api/core/v1"
14	apierrors "k8s.io/apimachinery/pkg/api/errors"
15	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
16	"k8s.io/apimachinery/pkg/runtime/schema"
17	"k8s.io/apimachinery/pkg/util/validation/field"
18	"k8s.io/client-go/tools/record"
19	ctrl "sigs.k8s.io/controller-runtime"
20	"sigs.k8s.io/controller-runtime/pkg/builder"
21	"sigs.k8s.io/controller-runtime/pkg/client"
22	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
23	"sigs.k8s.io/controller-runtime/pkg/event"
24	"sigs.k8s.io/controller-runtime/pkg/handler"
25	"sigs.k8s.io/controller-runtime/pkg/log"
26	"sigs.k8s.io/controller-runtime/pkg/predicate"
27	"sigs.k8s.io/controller-runtime/pkg/reconcile"
28
29	egressgatewayv1alpha1 "github.com/Azure/kube-egress-gateway/api/v1alpha1"
30	"github.com/Azure/kube-egress-gateway/pkg/consts"
31	"github.com/Azure/kube-egress-gateway/pkg/metrics"
32	)
33
34	var _ reconcile.Reconciler = &StaticGatewayConfigurationReconciler{}
35
36	// StaticGatewayConfigurationReconciler reconciles gateway loadBalancer according to a StaticGatewayConfiguration object
37	type StaticGatewayConfigurationReconciler struct {
38	client.Client
39	SecretNamespace string
40	Recorder record.EventRecorder
41	}
42
43	//+kubebuilder:rbac:groups=core,resources=events,verbs=create;patch
44	//+kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch;delete
45	//+kubebuilder:rbac:groups=egressgateway.kubernetes.azure.com,resources=staticgatewayconfigurations,verbs=get;list;watch;create;update;patch;delete
46	//+kubebuilder:rbac:groups=egressgateway.kubernetes.azure.com,resources=staticgatewayconfigurations/status,verbs=get;update;patch
47	//+kubebuilder:rbac:groups=egressgateway.kubernetes.azure.com,resources=gatewaylbconfigurations,verbs=get;list;watch;create;update;patch;delete
48	//+kubebuilder:rbac:groups=egressgateway.kubernetes.azure.com,resources=gatewaylbconfigurations/status,verbs=get;update;patch
49
50	// Reconcile is part of the main kubernetes reconciliation loop which aims to
51	// move the current state of the cluster closer to the desired state.
52	func (r *StaticGatewayConfigurationReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {	1✔
53	log := log.FromContext(ctx)	1✔
54		1✔
55	// Fetch the StaticGatewayConfiguration instance.	1✔
56	gwConfig := &egressgatewayv1alpha1.StaticGatewayConfiguration{}	1✔
57	if err := r.Get(ctx, req.NamespacedName, gwConfig); err != nil {	1✔
58	if apierrors.IsNotFound(err) {	×
59	// Object not found, return.	×
60	return ctrl.Result{}, nil	×
61	}	×
62	log.Error(err, "unable to fetch StaticGatewayConfiguration instance")	×
63	return ctrl.Result{}, err	×
64	}
65
66	if !gwConfig.ObjectMeta.DeletionTimestamp.IsZero() {	2✔
67	// Clean up staticGatewayConfiguration	1✔
68	return ctrl.Result{}, r.ensureDeleted(ctx, gwConfig)	1✔
69	}	1✔
70
71	return ctrl.Result{}, r.reconcile(ctx, gwConfig)	1✔
72	}
73
74	// SetupWithManager sets up the controller with the Manager.
75	func (r *StaticGatewayConfigurationReconciler) SetupWithManager(mgr ctrl.Manager) error {	1✔
76	secretPredicate := predicate.Funcs{	1✔
77	CreateFunc: func(e event.CreateEvent) bool {	2✔
78	// no need to trigger reconcile for secrets creation	1✔
79	return false	1✔
80	},	1✔
81	UpdateFunc: func(e event.UpdateEvent) bool {	×
82	return strings.EqualFold(e.ObjectOld.GetNamespace(), r.SecretNamespace)	×
83	},	×
84	DeleteFunc: func(e event.DeleteEvent) bool {	1✔
85	return strings.EqualFold(e.Object.GetNamespace(), r.SecretNamespace)	1✔
86	},	1✔
87	GenericFunc: func(e event.GenericEvent) bool {	×
88	return false	×
89	},	×
90	}
91	return ctrl.NewControllerManagedBy(mgr).	1✔
92	For(&egressgatewayv1alpha1.StaticGatewayConfiguration{}).	1✔
93	Owns(&egressgatewayv1alpha1.GatewayLBConfiguration{}).	1✔
94	// generated secrets created in the dedicated namespace	1✔
95	Watches(&corev1.Secret{}, enqueueOwningSGCFromLabels(), builder.WithPredicates(secretPredicate)).	1✔
96	Complete(r)	1✔
97	}
98
99	func enqueueOwningSGCFromLabels() handler.EventHandler {	1✔
100	return handler.EnqueueRequestsFromMapFunc(func(_ context.Context, o client.Object) []reconcile.Request {	2✔
101	labels := o.GetLabels()	1✔
102	if labels == nil {	1✔
103	return nil	×
104	}	×
105
106	owningSGCNamespace, foundNamespace := labels[consts.OwningSGCNamespaceLabel]	1✔
107	owningSGCName, foundName := labels[consts.OwningSGCNameLabel]	1✔
108		1✔
109	if !foundNamespace \|\| !foundName {	1✔
110	return nil	×
111	}	×
112
113	return []reconcile.Request{	1✔
114	{	1✔
115	NamespacedName: client.ObjectKey{	1✔
116	Name: owningSGCName,	1✔
117	Namespace: owningSGCNamespace,	1✔
118	},	1✔
119	},	1✔
120	}	1✔
121	})
122	}
123
124	func (r *StaticGatewayConfigurationReconciler) reconcile(
125	ctx context.Context,
126	gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration,
127	) error {	1✔
128	log := log.FromContext(ctx)	1✔
129	log.Info(fmt.Sprintf("Reconciling staticGatewayConfiguration %s/%s", gwConfig.Namespace, gwConfig.Name))	1✔
130		1✔
131	mc := metrics.NewMetricsContext(	1✔
132	os.Getenv(consts.PodNamespaceEnvKey),	1✔
133	"reconcile_static_gateway_configuration",	1✔
134	"n/a",	1✔
135	"n/a",	1✔
136	strings.ToLower(fmt.Sprintf("%s/%s", gwConfig.Namespace, gwConfig.Name)),	1✔
137	) // no subscription_id/resource_group for SGC reconciler	1✔
138	succeeded := false	1✔
139	defer func() { mc.ObserveControllerReconcileMetrics(succeeded) }()	2✔
140
141	if err := validate(gwConfig); err != nil {	1✔
142	r.Recorder.Event(gwConfig, corev1.EventTypeWarning, "InvalidSpec", err.Error())	×
143	return err	×
144	}	×
145
146	if !controllerutil.ContainsFinalizer(gwConfig, consts.SGCFinalizerName) {	2✔
147	log.Info("Adding finalizer")	1✔
148	controllerutil.AddFinalizer(gwConfig, consts.SGCFinalizerName)	1✔
149	err := r.Update(ctx, gwConfig)	1✔
150	if err != nil {	1✔
151	log.Error(err, "failed to add finalizer")	×
152	return err	×
153	}	×
154	}
155
156	_, err := controllerutil.CreateOrPatch(ctx, r, gwConfig, func() error {	2✔
157	// reconcile wireguard keypair	1✔
158	if err := r.reconcileWireguardKey(ctx, gwConfig); err != nil {	1✔
159	log.Error(err, "failed to reconcile wireguard key")	×
160	r.Recorder.Event(gwConfig, corev1.EventTypeWarning, "ReconcileError", err.Error())	×
161	return err	×
162	}	×
163
164	// reconcile lbconfig
165	if err := r.reconcileGatewayLBConfig(ctx, gwConfig); err != nil {	1✔
166	log.Error(err, "failed to reconcile gateway LB configuration")	×
167	r.Recorder.Event(gwConfig, corev1.EventTypeWarning, "ReconcileError", err.Error())	×
168	return err	×
169	}	×
170
171	return nil	1✔
172	})
173
174	prefix, reconcileStatus := "<pending>", "Reconciling"	1✔
175	if gwConfig.Status.EgressIpPrefix != "" {	2✔
176	prefix, reconcileStatus = gwConfig.Status.EgressIpPrefix, "Reconciled"	1✔
177	}	1✔
178	r.Recorder.Eventf(gwConfig, corev1.EventTypeNormal, reconcileStatus, "StaticGatewayConfiguration provisioned with egress prefix %s", prefix)	1✔
179	log.Info("staticGatewayConfiguration reconciled")	1✔
180	succeeded = true	1✔
181	return err	1✔
182	}
183
184	func (r *StaticGatewayConfigurationReconciler) ensureDeleted(
185	ctx context.Context,
186	gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration,
187	) error {	1✔
188	log := log.FromContext(ctx)	1✔
189	log.Info(fmt.Sprintf("Reconciling staticGatewayConfiguration deletion %s/%s", gwConfig.Namespace, gwConfig.Name))	1✔
190		1✔
191	if !controllerutil.ContainsFinalizer(gwConfig, consts.SGCFinalizerName) {	2✔
192	log.Info("gwConfig does not have finalizer, no additional cleanup needed")	1✔
193	return nil	1✔
194	}	1✔
195
196	mc := metrics.NewMetricsContext(	1✔
197	os.Getenv(consts.PodNamespaceEnvKey),	1✔
198	"delete_static_gateway_configuration",	1✔
199	"n/a",	1✔
200	"n/a",	1✔
201	strings.ToLower(fmt.Sprintf("%s/%s", gwConfig.Namespace, gwConfig.Name)),	1✔
202	) // no subscription_id/resource_group for SGC reconciler	1✔
203	succeeded := false	1✔
204	defer func() { mc.ObserveControllerReconcileMetrics(succeeded) }()	2✔
205
206	secretDeleted := false	1✔
207	log.Info("Deleting wireguard key")	1✔
208	secret := &corev1.Secret{	1✔
209	ObjectMeta: metav1.ObjectMeta{	1✔
210	Name: fmt.Sprintf("sgw-%s", string(gwConfig.UID)),	1✔
211	Namespace: r.SecretNamespace,	1✔
212	},	1✔
213	}	1✔
214	if err := r.Delete(ctx, secret); err != nil {	2✔
215	if !apierrors.IsNotFound(err) {	1✔
216	log.Error(err, "failed to delete existing gateway LB configuration")	×
217	return err	×
218	} else {	1✔
219	secretDeleted = true	1✔
220	}	1✔
221	}
222
223	lbConfigDeleted := false	1✔
224	log.Info("Deleting gateway LB configuration")	1✔
225	lbConfig := &egressgatewayv1alpha1.GatewayLBConfiguration{	1✔
226	ObjectMeta: metav1.ObjectMeta{	1✔
227	Name: gwConfig.Name,	1✔
228	Namespace: gwConfig.Namespace,	1✔
229	},	1✔
230	}	1✔
231	if err := r.Delete(ctx, lbConfig); err != nil {	2✔
232	if !apierrors.IsNotFound(err) {	1✔
233	log.Error(err, "failed to delete existing gateway LB configuration")	×
234	return err	×
235	} else {	1✔
236	lbConfigDeleted = true	1✔
237	}	1✔
238	}
239
240	if secretDeleted && lbConfigDeleted {	2✔
241	log.Info("Secret and LBConfig are deleted, removing finalizer")	1✔
242	controllerutil.RemoveFinalizer(gwConfig, consts.SGCFinalizerName)	1✔
243	if err := r.Update(ctx, gwConfig); err != nil {	1✔
244	log.Error(err, "failed to remove finalizer")	×
245	return err	×
246	}	×
247	}
248
249	log.Info("staticGatewayConfiguration deletion reconciled")	1✔
250	succeeded = true	1✔
251	return nil	1✔
252	}
253
254	func validate(gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration) error {	1✔
255	// need to validate either GatewayNodepoolName or GatewayVmssProfile is provided, but not both	1✔
256	var allErrs field.ErrorList	1✔
257		1✔
258	if gwConfig.Spec.GatewayNodepoolName == "" && vmssProfileIsEmpty(gwConfig) {	2✔
259	allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("gatewaynodepoolname"),	1✔
260	fmt.Sprintf("GatewayNodepoolName: %s, GatewayVmssProfile: %#v", gwConfig.Spec.GatewayNodepoolName, gwConfig.Spec.GatewayVmssProfile),	1✔
261	"Either GatewayNodepoolName or GatewayVmssProfile must be provided"))	1✔
262	}	1✔
263
264	if gwConfig.Spec.GatewayNodepoolName != "" && !vmssProfileIsEmpty(gwConfig) {	2✔
265	allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("gatewaynodepoolname"),	1✔
266	fmt.Sprintf("GatewayNodepoolName: %s, GatewayVmssProfile: %#v", gwConfig.Spec.GatewayNodepoolName, gwConfig.Spec.GatewayVmssProfile),	1✔
267	"Only one of GatewayNodepoolName and GatewayVmssProfile should be provided"))	1✔
268	}	1✔
269
270	if !vmssProfileIsEmpty(gwConfig) {	2✔
271	if gwConfig.Spec.GatewayVmssProfile.VmssResourceGroup == "" {	2✔
272	allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("gatewayvmssprofile").Child("vmssresourcegroup"),	1✔
273	gwConfig.Spec.GatewayVmssProfile.VmssResourceGroup,	1✔
274	"Gateway vmss resource group is empty"))	1✔
275	}	1✔
276	if gwConfig.Spec.GatewayVmssProfile.VmssName == "" {	2✔
277	allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("gatewayvmssprofile").Child("vmssname"),	1✔
278	gwConfig.Spec.GatewayVmssProfile.VmssName,	1✔
279	"Gateway vmss name is empty"))	1✔
280	}	1✔
281	if gwConfig.Spec.GatewayVmssProfile.PublicIpPrefixSize < 0 \|\| gwConfig.Spec.GatewayVmssProfile.PublicIpPrefixSize > 31 {	2✔
282	allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("gatewayvmssprofile").Child("publicipprefixsize"),	1✔
283	gwConfig.Spec.GatewayVmssProfile.PublicIpPrefixSize,	1✔
284	"Gateway vmss public ip prefix size should be between 0 and 31 inclusively"))	1✔
285	}	1✔
286	}
287
288	if !gwConfig.Spec.ProvisionPublicIps && gwConfig.Spec.PublicIpPrefixId != "" {	2✔
289	allErrs = append(allErrs, field.Invalid(field.NewPath("spec").Child("publicipprefixid"),	1✔
290	gwConfig.Spec.PublicIpPrefixId,	1✔
291	"PublicIpPrefixId should be empty when ProvisionPublicIps is false"))	1✔
292	}	1✔
293
294	if len(allErrs) == 0 {	2✔
295	return nil	1✔
296	}	1✔
297	return apierrors.NewInvalid(	1✔
298	schema.GroupKind{Group: "egressgateway.kubernetes.azure.com", Kind: "StaticGatewayConfiguration"},	1✔
299	gwConfig.Name, allErrs)	1✔
300	}
301
302	func vmssProfileIsEmpty(gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration) bool {	1✔
303	return gwConfig.Spec.GatewayVmssProfile.VmssResourceGroup == "" &&	1✔
304	gwConfig.Spec.GatewayVmssProfile.VmssName == "" &&	1✔
305	gwConfig.Spec.GatewayVmssProfile.PublicIpPrefixSize == 0	1✔
306	}	1✔
307
308	func (r *StaticGatewayConfigurationReconciler) reconcileWireguardKey(
309	ctx context.Context,
310	gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration,
311	) error {	1✔
312	log := log.FromContext(ctx)	1✔
313		1✔
314	secret := &corev1.Secret{	1✔
315	ObjectMeta: metav1.ObjectMeta{	1✔
316	Name: fmt.Sprintf("sgw-%s", string(gwConfig.UID)),	1✔
317	Namespace: r.SecretNamespace,	1✔
318	},	1✔
319	}	1✔
320	if _, err := controllerutil.CreateOrUpdate(ctx, r, secret, func() error {	2✔
321	if secret.Labels == nil {	2✔
322	secret.Labels = make(map[string]string)	1✔
323	}	1✔
324	if sgcNS, ok := secret.Labels[consts.OwningSGCNamespaceLabel]; !ok \|\| sgcNS != gwConfig.Namespace {	2✔
325	secret.Labels[consts.OwningSGCNamespaceLabel] = gwConfig.Namespace	1✔
326	}	1✔
327	if sgcName, ok := secret.Labels[consts.OwningSGCNameLabel]; !ok \|\| sgcName != gwConfig.Name {	2✔
328	secret.Labels[consts.OwningSGCNameLabel] = gwConfig.Name	1✔
329	}	1✔
330
331	if secret.Data == nil {	2✔
332	secret.Data = make(map[string][]byte)	1✔
333	}	1✔
334	if _, ok := secret.Data[consts.WireguardPrivateKeyName]; !ok {	2✔
335	// create new private key	1✔
336	wgPrivateKey, err := wgtypes.GeneratePrivateKey()	1✔
337	if err != nil {	1✔
338	log.Error(err, "failed to generate wireguard private key")	×
339	return err	×
340	}	×
341
342	secret.Data[consts.WireguardPrivateKeyName] = []byte(wgPrivateKey.String())	1✔
343	secret.Data[consts.WireguardPublicKeyName] = []byte(wgPrivateKey.PublicKey().String())	1✔
344	}
345
346	return nil	1✔
347	}); err != nil {	×
348	log.Error(err, "failed to reconcile wireguard keypair secret")	×
349	return err	×
350	}	×
351	if secret.DeletionTimestamp.IsZero() {	2✔
352	// Update secret reference	1✔
353	gwConfig.Status.PrivateKeySecretRef = &corev1.ObjectReference{	1✔
354	APIVersion: "v1",	1✔
355	Kind: "Secret",	1✔
356	Name: secret.Name,	1✔
357	Namespace: secret.Namespace,	1✔
358	}	1✔
359		1✔
360	// Update public key	1✔
361	gwConfig.Status.PublicKey = string(secret.Data[consts.WireguardPublicKeyName])	1✔
362	}	1✔
363
364	return nil	1✔
365	}
366
367	func (r *StaticGatewayConfigurationReconciler) reconcileGatewayLBConfig(
368	ctx context.Context,
369	gwConfig *egressgatewayv1alpha1.StaticGatewayConfiguration,
370	) error {	1✔
371	log := log.FromContext(ctx)	1✔
372		1✔
373	// check existence of the gatewayLBConfig	1✔
374	lbConfig := &egressgatewayv1alpha1.GatewayLBConfiguration{	1✔
375	ObjectMeta: metav1.ObjectMeta{	1✔
376	Name: gwConfig.Name,	1✔
377	Namespace: gwConfig.Namespace,	1✔
378	},	1✔
379	}	1✔
380	if _, err := controllerutil.CreateOrPatch(ctx, r, lbConfig, func() error {	2✔
381	lbConfig.Spec.GatewayNodepoolName = gwConfig.Spec.GatewayNodepoolName	1✔
382	lbConfig.Spec.GatewayVmssProfile = gwConfig.Spec.GatewayVmssProfile	1✔
383	lbConfig.Spec.ProvisionPublicIps = gwConfig.Spec.ProvisionPublicIps	1✔
384	lbConfig.Spec.PublicIpPrefixId = gwConfig.Spec.PublicIpPrefixId	1✔
385	return controllerutil.SetControllerReference(gwConfig, lbConfig, r.Client.Scheme())	1✔
386	}); err != nil {	1✔
387	log.Error(err, "failed to reconcile gateway lb configuration")	×
388	return err	×
389	}	×
390	if lbConfig.DeletionTimestamp.IsZero() && lbConfig.Status != nil {	2✔
391	gwConfig.Status.Ip = lbConfig.Status.FrontendIp	1✔
392	gwConfig.Status.Port = lbConfig.Status.ServerPort	1✔
393	gwConfig.Status.EgressIpPrefix = lbConfig.Status.EgressIpPrefix	1✔
394	}	1✔
395
396	return nil	1✔
397	}

Azure / kube-egress-gateway / 9867817318

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous