21666138129

Committed 04 Feb 2026 09:33AM UTC coverage: 65.813% (-0.5%) from 66.292%

Build # 21666138129

Build Type

push

github

Committed by

trevex

Commit Message

added nlreturn, run lint --fix on make fmt

Coverage Stats

1 of 8 new or added lines in 4 files covered. (12.5%)

10 existing lines in 3 files now uncovered.

591 of 898 relevant lines covered (65.81%)

6.96 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

69.7

/pkg/controller/discovery_controller.go

// Copyright 2026 BWI GmbH and Artefact Conduit contributors
// SPDX-License-Identifier: Apache-2.0

package controller

import (
        "context"
        "fmt"
        "slices"

        corev1 "k8s.io/api/core/v1"
        apierrors "k8s.io/apimachinery/pkg/api/errors"
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        "k8s.io/apimachinery/pkg/runtime"
        "k8s.io/client-go/kubernetes"
        "k8s.io/client-go/tools/record"
        ctrl "sigs.k8s.io/controller-runtime"
        "sigs.k8s.io/controller-runtime/pkg/client"
        "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"

        solarv1alpha1 "go.opendefense.cloud/solar/api/solar/v1alpha1"
)

const (
        discoveryFinalizer = "solar.opendefense.cloud/discovery-finalizer"
)

// DiscoveryReconciler reconciles a Discovery object
type DiscoveryReconciler struct {
        client.Client
        ClientSet     kubernetes.Interface
        Scheme        *runtime.Scheme
        Recorder      record.EventRecorder
        WorkerImage   string
        WorkerCommand string
        WorkerArgs    []string
}

// nolint:lll
// +kubebuilder:rbac:groups=solar.opendefense.cloud,resources=discoveries,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=solar.opendefense.cloud,resources=discoveries/status,verbs=get;update;patch
// +kubebuilder:rbac:groups=solar.opendefense.cloud,resources=discoveries/finalizers,verbs=update
// +kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=core,resources=events,verbs=create;patch

// Reconcile moves the current state of the cluster closer to the desired state
func (r *DiscoveryReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
        log := ctrl.LoggerFrom(ctx)
        ctrlResult := ctrl.Result{}

        log.V(1).Info("Discovery is being reconciled", "req", req)

        // Fetch the Order instance
        res := &solarv1alpha1.Discovery{}
        if err := r.Get(ctx, req.NamespacedName, res); err != nil {
                if apierrors.IsNotFound(err) {
                        // Object not found, return. Created objects are automatically garbage collected.
                        return ctrlResult, nil
                }

                return ctrlResult, errLogAndWrap(log, err, "failed to get object")
        }

        // Handle deletion: cleanup artifact workflows, then remove finalizer
        if !res.DeletionTimestamp.IsZero() {
                log.V(1).Info("Discovery is being deleted")
                r.Recorder.Event(res, corev1.EventTypeWarning, "Deleting", "Discovery is being deleted, cleaning up worker")

                // Cleanup worker resources, if exists
                if err := r.deleteWorkerResources(ctx, res); err != nil {
                        return ctrlResult, errLogAndWrap(log, err, "failed to clean up worker resources")
                }

                // Remove finalizer
                if slices.Contains(res.Finalizers, discoveryFinalizer) {
                        log.V(1).Info("Removing finalizer from resource")
                        res.Finalizers = slices.DeleteFunc(res.Finalizers, func(f string) bool {
                                return f == discoveryFinalizer
                        })
                        if err := r.Update(ctx, res); err != nil {
                                return ctrlResult, errLogAndWrap(log, err, "failed to remove finalizer")
                        }
                }

                return ctrlResult, nil
        }

        // Add finalizer if not present and not deleting
        if res.DeletionTimestamp.IsZero() {
                if !slices.Contains(res.Finalizers, discoveryFinalizer) {
                        log.V(1).Info("Adding finalizer to resource")
                        res.Finalizers = append(res.Finalizers, discoveryFinalizer)
                        if err := r.Update(ctx, res); err != nil {
                                return ctrlResult, errLogAndWrap(log, err, "failed to add finalizer")
                        }
                        // Return without requeue; the Update event will trigger reconciliation again
                        return ctrlResult, nil
                }
        }

        pod, err := r.ClientSet.CoreV1().Pods(res.Namespace).Get(ctx, discoveryPrefixed(res.Name), metav1.GetOptions{})
        if err != nil && !apierrors.IsNotFound(err) {
                r.Recorder.Eventf(res, corev1.EventTypeWarning, "Reconcile", "Failed to get pod", err)
                return ctrlResult, errLogAndWrap(log, err, "failed to get pod information")
        }

        // No pod yet, create it.
        if pod == nil || pod.Name == "" {
                if err := r.createWorkerResources(ctx, res); err != nil {
                        return ctrlResult, errLogAndWrap(log, err, "failed to create pod")
                }

                return ctrlResult, nil
        }

        // Pod exists, check if it's up to date with our configuration and if it is healthy.
        if res.Status.PodGeneration != res.GetGeneration() {
                // Recreate pod, configuration mismatch
                r.Recorder.Eventf(res, corev1.EventTypeNormal, "Reconcile", "Configuration changed. Replacing pod.")
                if err := r.deleteWorkerResources(ctx, res); err != nil {
                        return ctrlResult, errLogAndWrap(log, err, "failed to clean up worker resources")
                }

                if err := r.createWorkerResources(ctx, res); err != nil {
                        return ctrlResult, errLogAndWrap(log, err, "failed to create pod")
                }

                return ctrlResult, nil
        } else {
                log.V(1).Info("Configuration hasn't changed", "podGen", res.Status.PodGeneration, "gen", res.GetGeneration())
        }

        return ctrlResult, nil
}

// deleteWorkerResources deletes the resources of the worker pod
func (r *DiscoveryReconciler) deleteWorkerResources(ctx context.Context, res *solarv1alpha1.Discovery) error {
        log := ctrl.LoggerFrom(ctx)

        if err := r.ClientSet.CoreV1().Secrets(res.Namespace).Delete(ctx, discoveryPrefixed(res.Name), metav1.DeleteOptions{}); err != nil && !apierrors.IsNotFound(err) {
                r.Recorder.Eventf(res, corev1.EventTypeWarning, "DeletionFailed", "Failed to delete secret", err)
                return errLogAndWrap(log, err, "secret deletion failed")
        }
        if err := r.ClientSet.CoreV1().Pods(res.Namespace).Delete(ctx, discoveryPrefixed(res.Name), metav1.DeleteOptions{}); err != nil && !apierrors.IsNotFound(err) {
                r.Recorder.Eventf(res, corev1.EventTypeWarning, "DeletionFailed", "Failed to delete pod", err)
                return errLogAndWrap(log, err, "pod deletion failed")
        }

        return nil
}

// createWorkerResources creates the necessary resources for the worker pod
func (r *DiscoveryReconciler) createWorkerResources(ctx context.Context, res *solarv1alpha1.Discovery) error {
        log := ctrl.LoggerFrom(ctx)

        // Create secret
        // TODO: Use the actual configuration file instead of a dummy one
        secret := &corev1.Secret{
                ObjectMeta: metav1.ObjectMeta{
                        Namespace: res.Namespace,
                        Name:      discoveryPrefixed(res.Name),
                },
                StringData: map[string]string{
                        "config.yaml": "not implemented",
                },
        }
        _, err := r.ClientSet.CoreV1().Secrets(res.Namespace).Create(ctx, secret, metav1.CreateOptions{})
        if err != nil {
                r.Recorder.Eventf(res, corev1.EventTypeWarning, "CreationFailed", "Failed to create secret", err)
                return errLogAndWrap(log, err, "failed to create secret")
        }
        r.Recorder.Eventf(res, corev1.EventTypeNormal, "PodCreate", "Secret created")

        // Set owner references
        if err := controllerutil.SetControllerReference(res, secret, r.Scheme); err != nil {
                return errLogAndWrap(log, err, "failed to set controller reference")
        }

        // Create pod
        var args = r.WorkerArgs
        args = append(args, "--config", "/etc/worker/config.yaml")
        pod := &corev1.Pod{
                ObjectMeta: metav1.ObjectMeta{
                        Name:        discoveryPrefixed(res.Name),
                        Namespace:   res.Namespace,
                        Labels:      res.Labels,
                        Annotations: res.Annotations,
                },
                Spec: corev1.PodSpec{
                        Containers: []corev1.Container{
                                {
                                        Name:    "worker",
                                        Image:   r.WorkerImage,
                                        Command: []string{r.WorkerCommand},
                                        Args:    args,
                                        VolumeMounts: []corev1.VolumeMount{
                                                {
                                                        Name:      "config",
                                                        ReadOnly:  true,
                                                        MountPath: "/etc/worker"},
                                        },
                                },
                        },
                        Volumes: []corev1.Volume{
                                {
                                        Name: "config",
                                        VolumeSource: corev1.VolumeSource{
                                                Secret: &corev1.SecretVolumeSource{
                                                        SecretName: res.Name,
                                                },
                                        },
                                },
                        },
                },
        }

        // Set owner references
        if err := controllerutil.SetControllerReference(res, pod, r.Scheme); err != nil {
                return errLogAndWrap(log, err, "failed to set controller reference")
        }

        _, err = r.ClientSet.CoreV1().Pods(res.Namespace).Create(ctx, pod, metav1.CreateOptions{})
        if err != nil {
                r.Recorder.Eventf(res, corev1.EventTypeWarning, "PodCreate", "Failed to create pod", err)
                return errLogAndWrap(log, err, "failed to create pod")
        }
        r.Recorder.Eventf(res, corev1.EventTypeNormal, "PodCreate", "Worker pod created")
        log.V(1).Info("Pod created", "podGen", res.GetGeneration())

        // Update discovery version in status
        res.Status.PodGeneration = res.GetGeneration()
        if err := r.Status().Update(ctx, res); err != nil {
                return errLogAndWrap(log, err, "failed to update status")
        }

        return nil
}

// discoveryPrefixed returns the name of the discovery prefixed resource
func discoveryPrefixed(discoveryName string) string {
        return fmt.Sprintf("discovery-%s", discoveryName)
}

// SetupWithManager sets up the controller with the Manager.
func (r *DiscoveryReconciler) SetupWithManager(mgr ctrl.Manager) error {
        return ctrl.NewControllerManagedBy(mgr).
                For(&solarv1alpha1.Discovery{}).
                Owns(&corev1.Pod{}).
                Owns(&corev1.Secret{}).
                Complete(r)
}

1	// Copyright 2026 BWI GmbH and Artefact Conduit contributors
2	// SPDX-License-Identifier: Apache-2.0
3
4	package controller
5
6	import (
7	"context"
8	"fmt"
9	"slices"
10
11	corev1 "k8s.io/api/core/v1"
12	apierrors "k8s.io/apimachinery/pkg/api/errors"
13	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
14	"k8s.io/apimachinery/pkg/runtime"
15	"k8s.io/client-go/kubernetes"
16	"k8s.io/client-go/tools/record"
17	ctrl "sigs.k8s.io/controller-runtime"
18	"sigs.k8s.io/controller-runtime/pkg/client"
19	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
20
21	solarv1alpha1 "go.opendefense.cloud/solar/api/solar/v1alpha1"
22	)
23
24	const (
25	discoveryFinalizer = "solar.opendefense.cloud/discovery-finalizer"
26	)
27
28	// DiscoveryReconciler reconciles a Discovery object
29	type DiscoveryReconciler struct {
30	client.Client
31	ClientSet kubernetes.Interface
32	Scheme *runtime.Scheme
33	Recorder record.EventRecorder
34	WorkerImage string
35	WorkerCommand string
36	WorkerArgs []string
37	}
38
39	// nolint:lll
40	// +kubebuilder:rbac:groups=solar.opendefense.cloud,resources=discoveries,verbs=get;list;watch;create;update;patch;delete
41	// +kubebuilder:rbac:groups=solar.opendefense.cloud,resources=discoveries/status,verbs=get;update;patch
42	// +kubebuilder:rbac:groups=solar.opendefense.cloud,resources=discoveries/finalizers,verbs=update
43	// +kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch;create;update;patch;delete
44	// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch;delete
45	// +kubebuilder:rbac:groups=core,resources=events,verbs=create;patch
46
47	// Reconcile moves the current state of the cluster closer to the desired state
48	func (r *DiscoveryReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {	5✔
49	log := ctrl.LoggerFrom(ctx)	5✔
50	ctrlResult := ctrl.Result{}	5✔
51		5✔
52	log.V(1).Info("Discovery is being reconciled", "req", req)	5✔
53		5✔
54	// Fetch the Order instance	5✔
55	res := &solarv1alpha1.Discovery{}	5✔
56	if err := r.Get(ctx, req.NamespacedName, res); err != nil {	5✔
57	if apierrors.IsNotFound(err) {	×
58	// Object not found, return. Created objects are automatically garbage collected.	×
59	return ctrlResult, nil	×
60	}	×
61
UNCOV 62	return ctrlResult, errLogAndWrap(log, err, "failed to get object")	×
63	}
64
65	// Handle deletion: cleanup artifact workflows, then remove finalizer
66	if !res.DeletionTimestamp.IsZero() {	5✔
67	log.V(1).Info("Discovery is being deleted")	×
68	r.Recorder.Event(res, corev1.EventTypeWarning, "Deleting", "Discovery is being deleted, cleaning up worker")	×
69		×
70	// Cleanup worker resources, if exists	×
71	if err := r.deleteWorkerResources(ctx, res); err != nil {	×
72	return ctrlResult, errLogAndWrap(log, err, "failed to clean up worker resources")	×
73	}	×
74
75	// Remove finalizer
76	if slices.Contains(res.Finalizers, discoveryFinalizer) {	×
77	log.V(1).Info("Removing finalizer from resource")	×
78	res.Finalizers = slices.DeleteFunc(res.Finalizers, func(f string) bool {	×
79	return f == discoveryFinalizer	×
80	})	×
81	if err := r.Update(ctx, res); err != nil {	×
82	return ctrlResult, errLogAndWrap(log, err, "failed to remove finalizer")	×
83	}	×
84	}
85
UNCOV 86	return ctrlResult, nil	×
87	}
88
89	// Add finalizer if not present and not deleting
90	if res.DeletionTimestamp.IsZero() {	10✔
91	if !slices.Contains(res.Finalizers, discoveryFinalizer) {	6✔
92	log.V(1).Info("Adding finalizer to resource")	1✔
93	res.Finalizers = append(res.Finalizers, discoveryFinalizer)	1✔
94	if err := r.Update(ctx, res); err != nil {	1✔
95	return ctrlResult, errLogAndWrap(log, err, "failed to add finalizer")	×
96	}	×
97	// Return without requeue; the Update event will trigger reconciliation again
98	return ctrlResult, nil	1✔
99	}
100	}
101
102	pod, err := r.ClientSet.CoreV1().Pods(res.Namespace).Get(ctx, discoveryPrefixed(res.Name), metav1.GetOptions{})	4✔
103	if err != nil && !apierrors.IsNotFound(err) {	4✔
104	r.Recorder.Eventf(res, corev1.EventTypeWarning, "Reconcile", "Failed to get pod", err)	×
105	return ctrlResult, errLogAndWrap(log, err, "failed to get pod information")	×
106	}	×
107
108	// No pod yet, create it.
109	if pod == nil \|\| pod.Name == "" {	5✔
110	if err := r.createWorkerResources(ctx, res); err != nil {	1✔
111	return ctrlResult, errLogAndWrap(log, err, "failed to create pod")	×
112	}	×
113
114	return ctrlResult, nil	1✔
115	}
116
117	// Pod exists, check if it's up to date with our configuration and if it is healthy.
118	if res.Status.PodGeneration != res.GetGeneration() {	4✔
119	// Recreate pod, configuration mismatch	1✔
120	r.Recorder.Eventf(res, corev1.EventTypeNormal, "Reconcile", "Configuration changed. Replacing pod.")	1✔
121	if err := r.deleteWorkerResources(ctx, res); err != nil {	1✔
122	return ctrlResult, errLogAndWrap(log, err, "failed to clean up worker resources")	×
123	}	×
124
125	if err := r.createWorkerResources(ctx, res); err != nil {	1✔
126	return ctrlResult, errLogAndWrap(log, err, "failed to create pod")	×
127	}	×
128
129	return ctrlResult, nil	1✔
130	} else {	2✔
131	log.V(1).Info("Configuration hasn't changed", "podGen", res.Status.PodGeneration, "gen", res.GetGeneration())	2✔
132	}	2✔
133
134	return ctrlResult, nil	2✔
135	}
136
137	// deleteWorkerResources deletes the resources of the worker pod
138	func (r DiscoveryReconciler) deleteWorkerResources(ctx context.Context, res solarv1alpha1.Discovery) error {	1✔
139	log := ctrl.LoggerFrom(ctx)	1✔
140		1✔
141	if err := r.ClientSet.CoreV1().Secrets(res.Namespace).Delete(ctx, discoveryPrefixed(res.Name), metav1.DeleteOptions{}); err != nil && !apierrors.IsNotFound(err) {	1✔
142	r.Recorder.Eventf(res, corev1.EventTypeWarning, "DeletionFailed", "Failed to delete secret", err)	×
143	return errLogAndWrap(log, err, "secret deletion failed")	×
144	}	×
145	if err := r.ClientSet.CoreV1().Pods(res.Namespace).Delete(ctx, discoveryPrefixed(res.Name), metav1.DeleteOptions{}); err != nil && !apierrors.IsNotFound(err) {	1✔
146	r.Recorder.Eventf(res, corev1.EventTypeWarning, "DeletionFailed", "Failed to delete pod", err)	×
147	return errLogAndWrap(log, err, "pod deletion failed")	×
148	}	×
149
150	return nil	1✔
151	}
152
153	// createWorkerResources creates the necessary resources for the worker pod
154	func (r DiscoveryReconciler) createWorkerResources(ctx context.Context, res solarv1alpha1.Discovery) error {	2✔
155	log := ctrl.LoggerFrom(ctx)	2✔
156		2✔
157	// Create secret	2✔
158	// TODO: Use the actual configuration file instead of a dummy one	2✔
159	secret := &corev1.Secret{	2✔
160	ObjectMeta: metav1.ObjectMeta{	2✔
161	Namespace: res.Namespace,	2✔
162	Name: discoveryPrefixed(res.Name),	2✔
163	},	2✔
164	StringData: map[string]string{	2✔
165	"config.yaml": "not implemented",	2✔
166	},	2✔
167	}	2✔
168	_, err := r.ClientSet.CoreV1().Secrets(res.Namespace).Create(ctx, secret, metav1.CreateOptions{})	2✔
169	if err != nil {	2✔
170	r.Recorder.Eventf(res, corev1.EventTypeWarning, "CreationFailed", "Failed to create secret", err)	×
171	return errLogAndWrap(log, err, "failed to create secret")	×
172	}	×
173	r.Recorder.Eventf(res, corev1.EventTypeNormal, "PodCreate", "Secret created")	2✔
174		2✔
175	// Set owner references	2✔
176	if err := controllerutil.SetControllerReference(res, secret, r.Scheme); err != nil {	2✔
177	return errLogAndWrap(log, err, "failed to set controller reference")	×
178	}	×
179
180	// Create pod
181	var args = r.WorkerArgs	2✔
182	args = append(args, "--config", "/etc/worker/config.yaml")	2✔
183	pod := &corev1.Pod{	2✔
184	ObjectMeta: metav1.ObjectMeta{	2✔
185	Name: discoveryPrefixed(res.Name),	2✔
186	Namespace: res.Namespace,	2✔
187	Labels: res.Labels,	2✔
188	Annotations: res.Annotations,	2✔
189	},	2✔
190	Spec: corev1.PodSpec{	2✔
191	Containers: []corev1.Container{	2✔
192	{	2✔
193	Name: "worker",	2✔
194	Image: r.WorkerImage,	2✔
195	Command: []string{r.WorkerCommand},	2✔
196	Args: args,	2✔
197	VolumeMounts: []corev1.VolumeMount{	2✔
198	{	2✔
199	Name: "config",	2✔
200	ReadOnly: true,	2✔
201	MountPath: "/etc/worker"},	2✔
202	},	2✔
203	},	2✔
204	},	2✔
205	Volumes: []corev1.Volume{	2✔
206	{	2✔
207	Name: "config",	2✔
208	VolumeSource: corev1.VolumeSource{	2✔
209	Secret: &corev1.SecretVolumeSource{	2✔
210	SecretName: res.Name,	2✔
211	},	2✔
212	},	2✔
213	},	2✔
214	},	2✔
215	},	2✔
216	}	2✔
217		2✔
218	// Set owner references	2✔
219	if err := controllerutil.SetControllerReference(res, pod, r.Scheme); err != nil {	2✔
220	return errLogAndWrap(log, err, "failed to set controller reference")	×
221	}	×
222
223	_, err = r.ClientSet.CoreV1().Pods(res.Namespace).Create(ctx, pod, metav1.CreateOptions{})	2✔
224	if err != nil {	2✔
225	r.Recorder.Eventf(res, corev1.EventTypeWarning, "PodCreate", "Failed to create pod", err)	×
226	return errLogAndWrap(log, err, "failed to create pod")	×
227	}	×
228	r.Recorder.Eventf(res, corev1.EventTypeNormal, "PodCreate", "Worker pod created")	2✔
229	log.V(1).Info("Pod created", "podGen", res.GetGeneration())	2✔
230		2✔
231	// Update discovery version in status	2✔
232	res.Status.PodGeneration = res.GetGeneration()	2✔
233	if err := r.Status().Update(ctx, res); err != nil {	2✔
234	return errLogAndWrap(log, err, "failed to update status")	×
235	}	×
236
237	return nil	2✔
238	}
239
240	// discoveryPrefixed returns the name of the discovery prefixed resource
241	func discoveryPrefixed(discoveryName string) string {	12✔
242	return fmt.Sprintf("discovery-%s", discoveryName)	12✔
243	}	12✔
244
245	// SetupWithManager sets up the controller with the Manager.
246	func (r *DiscoveryReconciler) SetupWithManager(mgr ctrl.Manager) error {	1✔
247	return ctrl.NewControllerManagedBy(mgr).	1✔
248	For(&solarv1alpha1.Discovery{}).	1✔
249	Owns(&corev1.Pod{}).	1✔
250	Owns(&corev1.Secret{}).	1✔
251	Complete(r)	1✔
252	}	1✔

opendefensecloud / solution-arsenal / 21666138129

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous