• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

opendefensecloud / solution-arsenal / 23048306639

13 Mar 2026 11:14AM UTC coverage: 71.317% (-0.7%) from 72.012%
23048306639

Pull #273

github

web-flow
Merge aa8d64ae6 into b27e7dfd8
Pull Request #273: Target e2e test

5 of 9 new or added lines in 2 files covered. (55.56%)

74 existing lines in 6 files now uncovered.

2106 of 2953 relevant lines covered (71.32%)

20.55 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

88.43
/pkg/controller/hydratedtarget_controller.go
1
// Copyright 2026 BWI GmbH and Solution Arsenal contributors
2
// SPDX-License-Identifier: Apache-2.0
3

4
package controller
5

6
import (
7
        "context"
8
        "fmt"
9
        "net/url"
10
        "slices"
11
        "strings"
12
        "time"
13

14
        ociname "github.com/google/go-containerregistry/pkg/name"
15
        corev1 "k8s.io/api/core/v1"
16
        apierrors "k8s.io/apimachinery/pkg/api/errors"
17
        apimeta "k8s.io/apimachinery/pkg/api/meta"
18
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
19
        "k8s.io/apimachinery/pkg/runtime"
20
        "k8s.io/client-go/tools/events"
21
        ctrl "sigs.k8s.io/controller-runtime"
22
        "sigs.k8s.io/controller-runtime/pkg/client"
23
        "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
24

25
        solarv1alpha1 "go.opendefense.cloud/solar/api/solar/v1alpha1"
26
)
27

28
const (
29
        hydratedTargetFinalizer = "solar.opendefense.cloud/hydrated-target-finalizer"
30
)
31

32
// HydratedTargetReconciler reconciles a HydratedTarget object
33
type HydratedTargetReconciler struct {
34
        client.Client
35
        Scheme   *runtime.Scheme
36
        Recorder events.EventRecorder
37
}
38

39
//+kubebuilder:rbac:groups=solar.opendefense.cloud,resources=hydratedtargets,verbs=get;list;watch;create;update;patch;delete
40
//+kubebuilder:rbac:groups=solar.opendefense.cloud,resources=hydratedtargets/status,verbs=get;update;patch
41
//+kubebuilder:rbac:groups=solar.opendefense.cloud,resources=hydratedtargets/finalizers,verbs=update
42
// FIXME: Switch out releases for profiles                      👇
43
//+kubebuilder:rbac:groups=solar.opendefense.cloud,resources=releases,verbs=get;list;watch
44
//+kubebuilder:rbac:groups=solar.opendefense.cloud,resources=rendertasks,verbs=get;list;watch;create;update;patch;delete
45
//+kubebuilder:rbac:groups=core,resources=events,verbs=create;patch
46
//+kubebuilder:rbac:groups=events.k8s.io,resources=events,verbs=create;patch
47

48
// Reconcile moves the current state of the cluster closer to the desired state
49
//
50
// Reconciliation Flow:
51
//
52
//        HydratedTarget created
53
//            ↓
54
//        Add finalizer
55
//            ↓
56
//        Check if already succeeded → YES → Return (no-op)
57
//            ↓ NO
58
//        Get or create RenderTask
59
//            ↓
60
//        Update status from RenderTask
61

62
func (r *HydratedTargetReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
179✔
63
        log := ctrl.LoggerFrom(ctx)
179✔
64
        ctrlResult := ctrl.Result{}
179✔
65

179✔
66
        log.V(1).Info("HydratedTarget is being reconciled", "req", req)
179✔
67

179✔
68
        // Fetch the HydratedTarget instance
179✔
69
        res := &solarv1alpha1.HydratedTarget{}
179✔
70
        if err := r.Get(ctx, req.NamespacedName, res); err != nil {
181✔
71
                if apierrors.IsNotFound(err) {
4✔
72
                        // Object not found, return. Created objects are automatically garbage collected.
2✔
73
                        return ctrlResult, nil
2✔
74
                }
2✔
75

76
                return ctrlResult, errLogAndWrap(log, err, "failed to get object")
×
77
        }
78

79
        // Handle deletion: cleanup rendertask, then remove finalizer
80
        if !res.DeletionTimestamp.IsZero() {
179✔
81
                log.V(1).Info("HydratedTarget is being deleted")
2✔
82
                r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "Deleting", "Delete", "HydratedTarget is being deleted, cleaning up resources")
2✔
83

2✔
84
                if err := r.deleteRenderTask(ctx, res); client.IgnoreNotFound(err) != nil {
2✔
85
                        return ctrlResult, errLogAndWrap(log, err, "failed to delete render task")
×
86
                }
×
87

88
                // Remove finalizer
89
                if slices.Contains(res.Finalizers, hydratedTargetFinalizer) {
4✔
90
                        log.V(1).Info("Removing finalizer from resource")
2✔
91
                        res.Finalizers = slices.DeleteFunc(res.Finalizers, func(f string) bool {
4✔
92
                                return f == hydratedTargetFinalizer
2✔
93
                        })
2✔
94
                        if err := r.Update(ctx, res); err != nil {
2✔
95
                                return ctrlResult, errLogAndWrap(log, err, "failed to remove finalizer")
×
96
                        }
×
97
                }
98

99
                return ctrlResult, nil
2✔
100
        }
101

102
        // Add finalizer if not present and not deleting
103
        if res.DeletionTimestamp.IsZero() {
350✔
104
                if !slices.Contains(res.Finalizers, hydratedTargetFinalizer) {
194✔
105
                        log.V(1).Info("Adding finalizer to resource")
19✔
106
                        res.Finalizers = append(res.Finalizers, hydratedTargetFinalizer)
19✔
107
                        if err := r.Update(ctx, res); err != nil {
19✔
108
                                return ctrlResult, errLogAndWrap(log, err, "failed to add finalizer")
×
109
                        }
×
110
                        // Return without requeue; the Update event will trigger reconciliation again
111
                        return ctrlResult, nil
19✔
112
                }
113
        }
114

115
        // Check if rendertask has already completed successfully
116
        sc := apimeta.FindStatusCondition(res.Status.Conditions, ConditionTypeTaskCompleted)
156✔
117
        if sc != nil && sc.ObservedGeneration >= res.Generation && sc.Status == metav1.ConditionTrue {
157✔
118
                log.V(1).Info("RenderTask has already completed successfully, no further action needed")
1✔
119
                return ctrlResult, nil
1✔
120
        }
1✔
121

122
        // Check if rendertask has already failed
123
        fc := apimeta.FindStatusCondition(res.Status.Conditions, ConditionTypeTaskFailed)
155✔
124
        if fc != nil && fc.ObservedGeneration >= res.Generation && fc.Status == metav1.ConditionTrue {
156✔
125
                log.V(1).Info("RenderTask has already failed, no further action needed")
1✔
126
                return ctrlResult, nil
1✔
127
        }
1✔
128

129
        // Reconcile RenderTask
130
        rt := &solarv1alpha1.RenderTask{}
154✔
131
        err := r.Get(ctx, client.ObjectKey{Name: generationName(res), Namespace: res.Namespace}, rt)
154✔
132
        if client.IgnoreNotFound(err) != nil {
154✔
NEW
133
                log.V(1).Info("Failed to get render task", "err", err)
×
134
                return ctrlResult, errLogAndWrap(log, err, "failed to get RenderTask")
×
135
        }
×
136

137
        if apierrors.IsNotFound(err) {
198✔
138
                if err := r.createRenderTask(ctx, res); err != nil {
66✔
139
                        log.V(1).Info("Failed to create RenderTask", "err", err)
22✔
140
                        r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "CreationFailed", "Create", fmt.Sprintf("failed to create RenderTask: %q", err))
22✔
141

22✔
142
                        if apierrors.IsNotFound(err) {
29✔
143
                                return ctrl.Result{RequeueAfter: 30 * time.Second}, nil
7✔
144
                        }
7✔
145

146
                        return ctrlResult, errLogAndWrap(log, err, "failed to create RenderTask")
15✔
147
                }
148
                log.V(1).Info("Created RenderTask", "res", res)
22✔
149
                r.Recorder.Eventf(res, rt, corev1.EventTypeNormal, "Created", "Create", "RenderTask was created")
22✔
150
        }
151

152
        if changed := r.updateStatusConditionsFromRenderTask(ctx, res, rt); changed {
134✔
153
                if err := r.Status().Update(ctx, res); err != nil {
2✔
154
                        return ctrlResult, errLogAndWrap(log, err, "failed to update status")
×
155
                }
×
156
        }
157

158
        // RenderTask still running, requeue
159
        return ctrl.Result{RequeueAfter: 5 * time.Second}, nil
132✔
160
}
161

162
func (r *HydratedTargetReconciler) updateStatusConditionsFromRenderTask(ctx context.Context, res *solarv1alpha1.HydratedTarget, rt *solarv1alpha1.RenderTask) (changed bool) {
132✔
163
        if rt == nil || res == nil {
132✔
164
                return false
×
165
        }
×
166

167
        log := ctrl.LoggerFrom(ctx)
132✔
168

132✔
169
        if apimeta.IsStatusConditionTrue(rt.Status.Conditions, ConditionTypeJobFailed) {
133✔
170
                changed = apimeta.SetStatusCondition(&res.Status.Conditions, metav1.Condition{
1✔
171
                        Type:               ConditionTypeTaskFailed,
1✔
172
                        Status:             metav1.ConditionTrue,
1✔
173
                        ObservedGeneration: res.Generation,
1✔
174
                        Reason:             "TaskFailed",
1✔
175
                        Message:            "RenderTask failed",
1✔
176
                })
1✔
177

1✔
178
                log.V(1).Info("RenderTask failed", "name", rt.Name)
1✔
179
                r.Recorder.Eventf(res, rt, corev1.EventTypeWarning, "TaskFailed", "RunTask", "RenderTask failed")
1✔
180

1✔
181
                return changed
1✔
182
        }
1✔
183

184
        if apimeta.IsStatusConditionTrue(rt.Status.Conditions, ConditionTypeJobSucceeded) {
132✔
185
                changed = apimeta.SetStatusCondition(&res.Status.Conditions, metav1.Condition{
1✔
186
                        Type:               ConditionTypeTaskCompleted,
1✔
187
                        Status:             metav1.ConditionTrue,
1✔
188
                        ObservedGeneration: res.Generation,
1✔
189
                        Reason:             "TaskCompleted",
1✔
190
                        Message:            "RenderTask completed",
1✔
191
                })
1✔
192

1✔
193
                log.V(1).Info("RenderTask completed", "name", rt.Name)
1✔
194
                r.Recorder.Eventf(res, rt, corev1.EventTypeWarning, "TaskCompleted", "RunTask", "RenderTask completed successfully")
1✔
195

1✔
196
                return changed
1✔
197
        }
1✔
198

199
        log.V(1).Info("RenderTask has no final condtions yet", "name", rt.Name)
130✔
200

130✔
201
        return false
130✔
202
}
203

204
func (r *HydratedTargetReconciler) createRenderTask(ctx context.Context, res *solarv1alpha1.HydratedTarget) error {
44✔
205
        log := ctrl.LoggerFrom(ctx)
44✔
206

44✔
207
        // Check if we need to cleanup an old task
44✔
208
        if res.Status.RenderTaskRef != nil && res.Status.RenderTaskRef.Name != "" {
65✔
209
                if err := r.deleteRenderTask(ctx, res); err != nil {
22✔
210
                        return errLogAndWrap(log, err, "failed to cleanup old task")
1✔
211
                }
1✔
212
        }
213

214
        spec, err := r.computeRenderTaskSpec(ctx, res)
43✔
215
        if err != nil {
49✔
216
                return err
6✔
217
        }
6✔
218
        rt := &solarv1alpha1.RenderTask{
37✔
219
                ObjectMeta: metav1.ObjectMeta{
37✔
220
                        Name:      generationName(res),
37✔
221
                        Namespace: res.Namespace,
37✔
222
                },
37✔
223
                Spec: spec,
37✔
224
        }
37✔
225

37✔
226
        if err := r.Create(ctx, rt); err != nil {
50✔
227
                r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "CreationFailed", "Create", "Failed to create RenderTask", err)
13✔
228
                return errLogAndWrap(log, err, "secret creation failed")
13✔
229
        }
13✔
230

231
        // Set owner references
232
        if err := controllerutil.SetControllerReference(res, rt, r.Scheme); err != nil {
24✔
233
                return errLogAndWrap(log, err, "failed to set controller reference")
×
234
        }
×
235

236
        // Set Reference in Status
237
        res.Status.RenderTaskRef = &corev1.ObjectReference{
24✔
238
                APIVersion: solarv1alpha1.SchemeGroupVersion.String(),
24✔
239
                Kind:       "RenderTask",
24✔
240
                Namespace:  rt.Namespace,
24✔
241
                Name:       rt.Name,
24✔
242
        }
24✔
243

24✔
244
        if err := r.Status().Update(ctx, res); err != nil {
26✔
245
                return errLogAndWrap(log, err, "failed to update status")
2✔
246
        }
2✔
247

248
        return nil
22✔
249
}
250

251
func (r *HydratedTargetReconciler) deleteRenderTask(ctx context.Context, res *solarv1alpha1.HydratedTarget) error {
23✔
252
        if res.Status.RenderTaskRef == nil {
24✔
253
                return nil
1✔
254
        }
1✔
255

256
        rt := &solarv1alpha1.RenderTask{}
22✔
257
        if err := r.Get(ctx, client.ObjectKey{Name: res.Status.RenderTaskRef.Name, Namespace: res.Status.RenderTaskRef.Namespace}, rt); client.IgnoreNotFound(err) != nil {
22✔
258
                return err
×
259
        } else if err == nil {
31✔
260
                return r.Delete(ctx, rt, client.PropagationPolicy(metav1.DeletePropagationBackground))
9✔
261
        }
9✔
262

263
        return nil
13✔
264
}
265

266
func (r *HydratedTargetReconciler) computeRenderTaskSpec(ctx context.Context, res *solarv1alpha1.HydratedTarget) (solarv1alpha1.RenderTaskSpec, error) {
43✔
267
        spec := solarv1alpha1.RenderTaskSpec{}
43✔
268

43✔
269
        resolvedReleases := map[string]solarv1alpha1.ResourceAccess{}
43✔
270
        for k, v := range res.Spec.Releases {
58✔
271
                rel := &solarv1alpha1.Release{}
15✔
272
                if err := r.Get(ctx, client.ObjectKey{Name: v.Name, Namespace: res.Namespace}, rel); err != nil {
21✔
273
                        return spec, err
6✔
274
                }
6✔
275

276
                if rel.Status.ChartURL == "" {
9✔
NEW
277
                        return spec, fmt.Errorf("Release reference was empty, check if the release chart was rendered correctly.")
×
NEW
278
                }
×
279

280
                ref, err := ociname.ParseReference(rel.Status.ChartURL)
9✔
281
                if err != nil {
9✔
282
                        return spec, err
×
283
                }
×
284

285
                repo, err := url.JoinPath(ref.Context().RegistryStr(), ref.Context().RepositoryStr())
9✔
286
                if err != nil {
9✔
287
                        return spec, err
×
288
                }
×
289

290
                resolvedReleases[k] = solarv1alpha1.ResourceAccess{
9✔
291
                        Repository: strings.TrimPrefix(repo, "oci://"),
9✔
292
                        Tag:        ref.Identifier(),
9✔
293
                }
9✔
294
        }
295

296
        resolvedReleaseNames := []string{}
37✔
297
        for k := range resolvedReleases {
46✔
298
                resolvedReleaseNames = append(resolvedReleaseNames, k)
9✔
299
        }
9✔
300

301
        chartName := fmt.Sprintf("ht-%s", res.Name)
37✔
302
        repo, err := url.JoinPath(res.Namespace, chartName)
37✔
303
        if err != nil {
37✔
304
                return spec, err
×
305
        }
×
306

307
        tag := fmt.Sprintf("v0.0.%d", res.GetGeneration())
37✔
308

37✔
309
        spec.RendererConfig = solarv1alpha1.RendererConfig{
37✔
310
                Type: solarv1alpha1.RendererConfigTypeHydratedTarget,
37✔
311
                HydratedTargetConfig: solarv1alpha1.HydratedTargetConfig{
37✔
312
                        Chart: solarv1alpha1.ChartConfig{
37✔
313
                                Name:        chartName,
37✔
314
                                Description: fmt.Sprintf("HydratedTarget of %v", resolvedReleaseNames),
37✔
315
                                Version:     tag,
37✔
316
                                AppVersion:  tag,
37✔
317
                        },
37✔
318
                        Input: solarv1alpha1.HydratedTargetInput{
37✔
319
                                Releases: resolvedReleases,
37✔
320
                                Userdata: res.Spec.Userdata,
37✔
321
                        },
37✔
322
                },
37✔
323
        }
37✔
324
        spec.Repository = repo
37✔
325
        spec.Tag = tag
37✔
326

37✔
327
        return spec, nil
37✔
328
}
329

330
// SetupWithManager sets up the controller with the Manager.
331
func (r *HydratedTargetReconciler) SetupWithManager(mgr ctrl.Manager) error {
1✔
332
        return ctrl.NewControllerManagedBy(mgr).
1✔
333
                For(&solarv1alpha1.HydratedTarget{}).
1✔
334
                Owns(&solarv1alpha1.RenderTask{}).
1✔
335
                Complete(r)
1✔
336
}
1✔
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc