24822429227

Committed 23 Apr 2026 07:21AM UTC coverage: 72.505% (-0.5%) from 73.044%

Build # 24822429227

Build Type

Pull #436

github

Committed by

web-flow

Commit Message

Merge 4275ff704 into 7e082458b

Pull Request Pull Request #436: Registry credentials PoC

Coverage Stats

190 of 212 new or added lines in 6 files covered. (89.62%)

41 existing lines in 2 files now uncovered.

2165 of 2986 relevant lines covered (72.51%)

34.18 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

86.43

/pkg/controller/rendertask_controller.go

// Copyright 2026 BWI GmbH and Solution Arsenal contributors
// SPDX-License-Identifier: Apache-2.0

package controller

import (
        "context"
        "encoding/json"
        "fmt"
        "strings"
        "time"

        batchv1 "k8s.io/api/batch/v1"
        corev1 "k8s.io/api/core/v1"
        apierrors "k8s.io/apimachinery/pkg/api/errors"
        apimeta "k8s.io/apimachinery/pkg/api/meta"
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        "k8s.io/apimachinery/pkg/runtime"
        "k8s.io/client-go/tools/events"
        ctrl "sigs.k8s.io/controller-runtime"
        "sigs.k8s.io/controller-runtime/pkg/client"
        "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"

        solarv1alpha1 "go.opendefense.cloud/solar/api/solar/v1alpha1"
)

const (
        annotationJobName    = "solar.opendefense.cloud/job-name"
        annotationSecretName = "solar.opendefense.cloud/secret-name"

        // Condition types
        ConditionTypeJobScheduled = "JobScheduled"
        ConditionTypeJobSucceeded = "JobSucceeded"
        ConditionTypeJobFailed    = "JobFailed"

        ConditionTypeTaskCompleted = "TaskCompleted"
        ConditionTypeTaskFailed    = "TaskFailed"
)

// RenderTaskReconciler reconciles a RenderTask object.
// Each RenderTask carries its own BaseURL and SecretRef for the target registry.
type RenderTaskReconciler struct {
        client.Client
        Scheme              *runtime.Scheme
        Recorder            events.EventRecorder
        RendererImage       string
        RendererCommand     string
        RendererArgs        []string
        RendererCAConfigMap string
}

//+kubebuilder:rbac:groups=solar.opendefense.cloud,resources=rendertasks,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups=solar.opendefense.cloud,resources=rendertasks/status,verbs=get;update;patch
//+kubebuilder:rbac:groups=solar.opendefense.cloud,resources=rendertasks/finalizers,verbs=update
//+kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups=core,resources=events,verbs=create;patch
//+kubebuilder:rbac:groups=events.k8s.io,resources=events,verbs=create;patch

// Reconcile moves the current state of the cluster closer to the desired state
func (r *RenderTaskReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
        log := ctrl.LoggerFrom(ctx)
        ctrlResult := ctrl.Result{}

        log.V(1).Info("RenderTask is being reconciled", "req", req)

        // Fetch the RenderTask instance
        res := &solarv1alpha1.RenderTask{}
        if err := r.Get(ctx, req.NamespacedName, res); err != nil {
                if apierrors.IsNotFound(err) {
                        return ctrlResult, nil
                }

                return ctrlResult, errLogAndWrap(log, err, "failed to get object")
        }

        // RenderTask instance marked for deletion, stop reconciling
        if !res.DeletionTimestamp.IsZero() {
                log.V(1).Info("RenderTask is being deleted")
                r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "Deleting", "Delete", "RenderTask is being deleted, cleaning up secret and job")

                return ctrlResult, nil
        }

        // Check if renderjob has already completed successfully
        sc := apimeta.FindStatusCondition(res.Status.Conditions, ConditionTypeJobSucceeded)
        if sc != nil && sc.ObservedGeneration >= res.Generation && sc.Status == metav1.ConditionTrue {
                log.V(1).Info("RenderTask has already completed successfully, no further action needed")

                return ctrlResult, nil
        }

        // Determine the namespace for Jobs/Secrets — use the RenderTask's namespace
        jobNS := r.taskNamespace(res)

        // Reconcile Config Secret
        configSecret := &corev1.Secret{}
        err := r.Get(ctx, r.configSecretKey(res, jobNS), configSecret)
        if err != nil && apierrors.IsNotFound(err) {
                createdSecret, err := r.createConfigSecret(ctx, res, jobNS)
                if err != nil {
                        r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "CreateSecretFailed", "CreateConfigSecret", fmt.Sprintf("Failed to create config secret: %s", err))

                        return ctrlResult, errLogAndWrap(log, err, "failed to create secret")
                }

                configSecret = createdSecret
        } else if err != nil {
                return ctrlResult, errLogAndWrap(log, err, "could not get secret")
        }

        // Resolve push secret from the RenderTask's SecretRef
        var pushSecret *corev1.Secret
        if res.Spec.SecretRef != nil {
                pushSecret = &corev1.Secret{}
                if err := r.Get(ctx, client.ObjectKey{Name: res.Spec.SecretRef.Name, Namespace: jobNS}, pushSecret); err != nil {
                        return ctrlResult, errLogAndWrap(log, err, "failed to get push secret")
                }
        }

        // Reconcile Job
        job := &batchv1.Job{}
        err = r.Get(ctx, r.renderJobKey(res, jobNS), job)
        if err != nil && apierrors.IsNotFound(err) {
                err := r.createRenderJob(ctx, res, configSecret, pushSecret, jobNS)
                if err != nil {
                        r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "CreateJobFailed", "CreateJob", fmt.Sprintf("Failed to create job: %s", err))

                        return ctrlResult, errLogAndWrap(log, err, "failed to create job")
                }
        } else if err != nil {
                return ctrlResult, errLogAndWrap(log, err, "could not get job")
        }

        // Update Status
        if changed := r.updateResourceStatusFromJob(ctx, res, job); changed {
                if err := r.Status().Update(ctx, res); err != nil {
                        return ctrlResult, errLogAndWrap(log, err, "failed to update status")
                }
        }

        ttlDuration := time.Duration(ttlSeconds(res.Spec.FailedJobTTL)) * time.Second

        switch {
        case job.Status.Succeeded > 0:
                cleanupRenderResources(ctx, r, res, job, jobNS)
                log.V(1).Info("Cleaned up after successful job")

                return ctrlResult, nil

        case job.Status.Failed > 0:
                if shouldCleanupSecrets(res, ttlDuration) {
                        cleanupSecrets(ctx, r, res, jobNS)
                        log.V(1).Info("Cleaned up secrets after failed job TTL")

                        return ctrlResult, nil
                }

                remaining := remainingTTL(res, ttlDuration)
                log.V(1).Info("Waiting for TTL to expire before cleaning up secrets", "remainingSeconds", remaining.Seconds())

                return ctrl.Result{RequeueAfter: remaining + time.Second}, nil
        }

        return ctrlResult, nil
}

// taskNamespace returns the namespace to use for Jobs/Secrets.
func (r *RenderTaskReconciler) taskNamespace(res *solarv1alpha1.RenderTask) string {
        return res.Namespace
}

// updateResourceStatusFromJob updates the resource status based on job status
func (r *RenderTaskReconciler) updateResourceStatusFromJob(ctx context.Context, res *solarv1alpha1.RenderTask, job *batchv1.Job) (changed bool) {
        log := ctrl.LoggerFrom(ctx)

        if job == nil {
                changed = apimeta.SetStatusCondition(&res.Status.Conditions, metav1.Condition{
                        Type:               ConditionTypeJobScheduled,
                        Status:             metav1.ConditionFalse,
                        ObservedGeneration: res.Generation,
                        Reason:             "DoesNotExist",
                        Message:            "Renderer job does not exist",
                })

                return changed
        }

        if job.Status.Succeeded > 0 {
                changed = apimeta.SetStatusCondition(&res.Status.Conditions, metav1.Condition{
                        Type:               ConditionTypeJobSucceeded,
                        Status:             metav1.ConditionTrue,
                        ObservedGeneration: res.Generation,
                        Reason:             "JobSucceeded",
                        Message:            fmt.Sprintf("Renderer job completed successfully at %v", job.Status.CompletionTime),
                })

                chartURL := r.reference(res.Spec.BaseURL, res.Spec.Repository, res.Spec.Tag)
                if res.Status.ChartURL != chartURL {
                        res.Status.ChartURL = chartURL
                        changed = true
                }

                r.Recorder.Eventf(res, job, corev1.EventTypeNormal, "JobSucceeded", "RunJob", "Renderer job completed successfully")
                log.V(1).Info("Job succeeded", "name", job.Name)

                return changed
        }

        if job.Status.Failed > 0 {
                changed = apimeta.SetStatusCondition(&res.Status.Conditions, metav1.Condition{
                        Type:               ConditionTypeJobFailed,
                        Status:             metav1.ConditionTrue,
                        ObservedGeneration: res.Generation,
                        Reason:             "JobFailed",
                        Message:            "Renderer job failed",
                })
                r.Recorder.Eventf(res, job, corev1.EventTypeWarning, "JobFailed", "RunJob", "Renderer job failed")
                log.V(1).Info("Job failed", "name", job.Name)

                return changed
        }

        return apimeta.SetStatusCondition(&res.Status.Conditions, metav1.Condition{
                Type:               ConditionTypeJobScheduled,
                Status:             metav1.ConditionTrue,
                ObservedGeneration: res.Generation,
                Reason:             "JobScheduled",
                Message:            fmt.Sprintf("Renderer job is running (active: %d, succeeded: %d, failed: %d)", job.Status.Active, job.Status.Succeeded, job.Status.Failed),
        })
}

func (r *RenderTaskReconciler) deleteRenderJob(ctx context.Context, res *solarv1alpha1.RenderTask, jobNS string) error {
        job := &batchv1.Job{}
        if err := r.Get(ctx, r.renderJobKey(res, jobNS), job); err != nil {
                return err
        }

        return r.Delete(ctx, job, client.PropagationPolicy(metav1.DeletePropagationBackground))
}

func (r *RenderTaskReconciler) deleteConfigSecret(ctx context.Context, res *solarv1alpha1.RenderTask, jobNS string) error {
        secret := &corev1.Secret{}
        if err := r.Get(ctx, r.configSecretKey(res, jobNS), secret); err != nil {
                return err
        }

        return r.Delete(ctx, secret, client.PropagationPolicy(metav1.DeletePropagationBackground))
}

func (r *RenderTaskReconciler) createRenderJob(ctx context.Context, res *solarv1alpha1.RenderTask, configSecret, pushSecret *corev1.Secret, jobNS string) error {
        log := ctrl.LoggerFrom(ctx)

        jobKey := r.renderJobKey(res, jobNS)
        jobName := jobKey.Name
        backoffLimit := int32(3)
        ttlSecondsAfterFinished := int32(3600)
        if res.Spec.FailedJobTTL != nil {
                ttlSecondsAfterFinished = *res.Spec.FailedJobTTL
        }

        volumes := []corev1.Volume{
                {
                        Name: "config",
                        VolumeSource: corev1.VolumeSource{
                                Secret: &corev1.SecretVolumeSource{
                                        SecretName: configSecret.Name,
                                        Items: []corev1.KeyToPath{
                                                {
                                                        Key:  "config.json",
                                                        Path: "config.json",
                                                },
                                        },
                                },
                        },
                },
        }
        volumeMounts := []corev1.VolumeMount{
                {
                        Name:      "config",
                        MountPath: "/etc/renderer/config.json",
                        SubPath:   "config.json",
                        ReadOnly:  true,
                },
        }
        envVars := []corev1.EnvVar{
                {
                        Name: "POD_NAMESPACE",
                        ValueFrom: &corev1.EnvVarSource{
                                FieldRef: &corev1.ObjectFieldSelector{
                                        FieldPath: "metadata.namespace",
                                },
                        },
                },
                {
                        Name: "POD_NAME",
                        ValueFrom: &corev1.EnvVarSource{
                                FieldRef: &corev1.ObjectFieldSelector{
                                        FieldPath: "metadata.name",
                                },
                        },
                },
        }

        if r.RendererCAConfigMap != "" {
                volumes = append(volumes, corev1.Volume{
                        Name: "ca-bundle",
                        VolumeSource: corev1.VolumeSource{
                                ConfigMap: &corev1.ConfigMapVolumeSource{
                                        LocalObjectReference: corev1.LocalObjectReference{
                                                Name: r.RendererCAConfigMap,
                                        },
                                        Items: []corev1.KeyToPath{
                                                {
                                                        Key:  "trust-bundle.pem",
                                                        Path: "ca-bundle.pem",
                                                },
                                        },
                                },
                        },
                })
                volumeMounts = append(volumeMounts, corev1.VolumeMount{
                        Name:      "ca-bundle",
                        MountPath: "/etc/ssl/certs",
                        ReadOnly:  true,
                })
                envVars = append(envVars, corev1.EnvVar{
                        Name:  "SSL_CERT_FILE",
                        Value: "/etc/ssl/certs/ca-bundle.pem",
                })
        }

        pushURL := r.reference(res.Spec.BaseURL, res.Spec.Repository, res.Spec.Tag)

        rendererArgs := append([]string{}, r.RendererArgs...)
        rendererArgs = append(rendererArgs,
                "/etc/renderer/config.json",
                fmt.Sprintf("--url=%s", pushURL),
        )
        if res.Spec.Insecure {
                rendererArgs = append(rendererArgs, "--insecure")
        }

        job := &batchv1.Job{
                ObjectMeta: metav1.ObjectMeta{
                        Name:      jobName,
                        Namespace: jobKey.Namespace,
                        Annotations: map[string]string{
                                annotationJobName: jobName,
                        },
                },
                Spec: batchv1.JobSpec{
                        BackoffLimit:            &backoffLimit,
                        TTLSecondsAfterFinished: &ttlSecondsAfterFinished,
                        Template: corev1.PodTemplateSpec{
                                Spec: corev1.PodSpec{
                                        RestartPolicy: corev1.RestartPolicyNever,
                                        Containers: []corev1.Container{
                                                {
                                                        Name:         "renderer",
                                                        Image:        r.RendererImage,
                                                        Command:      []string{r.RendererCommand},
                                                        Args:         rendererArgs,
                                                        Env:          envVars,
                                                        VolumeMounts: volumeMounts,
                                                },
                                        },
                                        Volumes: volumes,
                                },
                        },
                },
        }

        if pushSecret != nil {
                switch pushSecret.Type {
                case corev1.SecretTypeBasicAuth:
                        job.Spec.Template.Spec.Containers[0].Env = append(job.Spec.Template.Spec.Containers[0].Env,
                                corev1.EnvVar{
                                        Name: "REGISTRY_USERNAME",
                                        ValueFrom: &corev1.EnvVarSource{
                                                SecretKeyRef: &corev1.SecretKeySelector{
                                                        LocalObjectReference: corev1.LocalObjectReference{
                                                                Name: pushSecret.Name,
                                                        },
                                                        Key: "username",
                                                },
                                        },
                                },
                                corev1.EnvVar{
                                        Name: "REGISTRY_PASSWORD",
                                        ValueFrom: &corev1.EnvVarSource{
                                                SecretKeyRef: &corev1.SecretKeySelector{
                                                        LocalObjectReference: corev1.LocalObjectReference{
                                                                Name: pushSecret.Name,
                                                        },
                                                        Key: "password",
                                                },
                                        },
                                },
                        )

                case corev1.SecretTypeDockerConfigJson:
                        job.Spec.Template.Spec.Volumes = append(job.Spec.Template.Spec.Volumes, corev1.Volume{
                                Name: "dockerconfig",
                                VolumeSource: corev1.VolumeSource{
                                        Secret: &corev1.SecretVolumeSource{
                                                SecretName: pushSecret.Name,
                                                Items: []corev1.KeyToPath{
                                                        {
                                                                Key:  ".dockerconfigjson",
                                                                Path: "dockerconfig.json",
                                                        },
                                                },
                                        },
                                },
                        })

                        job.Spec.Template.Spec.Containers[0].VolumeMounts = append(job.Spec.Template.Spec.Containers[0].VolumeMounts, corev1.VolumeMount{
                                Name:      "dockerconfig",
                                MountPath: "/etc/renderer/dockerconfig.json",
                                SubPath:   "dockerconfig.json",
                                ReadOnly:  true,
                        })

                        job.Spec.Template.Spec.Containers[0].Env = append(job.Spec.Template.Spec.Containers[0].Env, corev1.EnvVar{
                                Name:  "DOCKER_CONFIG",
                                Value: "/etc/renderer/dockerconfig.json",
                        })
                default:
                }
        }

        // Set owner references
        if err := controllerutil.SetControllerReference(res, job, r.Scheme); err != nil {
                return errLogAndWrap(log, err, "failed to set controller reference")
        }

        if err := r.Create(ctx, job); err != nil {
                r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "CreationFailed", "Create", "Failed to create job: %s", err)

                return errLogAndWrap(log, err, "job creation failed")
        }

        res.Status.JobRef = &corev1.ObjectReference{
                APIVersion: batchv1.SchemeGroupVersion.String(),
                Kind:       "Job",
                Namespace:  job.Namespace,
                Name:       job.Name,
        }

        if err := r.Status().Update(ctx, res); err != nil {
                return errLogAndWrap(log, err, "failed to update status")
        }

        return nil
}

func (r *RenderTaskReconciler) createConfigSecret(ctx context.Context, res *solarv1alpha1.RenderTask, jobNS string) (*corev1.Secret, error) {
        log := ctrl.LoggerFrom(ctx)

        cfgJson, err := json.Marshal(res.Spec.RendererConfig)
        if err != nil {
                return nil, err
        }

        secretKey := r.configSecretKey(res, jobNS)
        secret := &corev1.Secret{
                ObjectMeta: metav1.ObjectMeta{
                        Name:      secretKey.Name,
                        Namespace: secretKey.Namespace,
                        Annotations: map[string]string{
                                annotationSecretName: secretKey.Name,
                        },
                },
                Type: corev1.SecretTypeOpaque,
                Data: map[string][]byte{
                        "config.json": cfgJson,
                },
        }

        // Set owner references
        if err := controllerutil.SetControllerReference(res, secret, r.Scheme); err != nil {
                return nil, errLogAndWrap(log, err, "failed to set controller reference")
        }

        if err := r.Create(ctx, secret); err != nil {
                r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "CreationFailed", "Create", "Failed to create secret: %s", err)

                return nil, errLogAndWrap(log, err, "secret creation failed")
        }

        res.Status.ConfigSecretRef = &corev1.ObjectReference{
                APIVersion: corev1.SchemeGroupVersion.String(),
                Kind:       "Secret",
                Namespace:  secret.Namespace,
                Name:       secret.Name,
        }

        if err := r.Status().Update(ctx, res); err != nil {
                return nil, errLogAndWrap(log, err, "failed to update status")
        }

        return secret, nil
}

func (r *RenderTaskReconciler) configSecretKey(res *solarv1alpha1.RenderTask, jobNS string) client.ObjectKey {
        return client.ObjectKey{
                Name:      truncateName(fmt.Sprintf("render-%s", res.Name), maxK8sLabelValueLen),
                Namespace: jobNS,
        }
}

func (r *RenderTaskReconciler) renderJobKey(res *solarv1alpha1.RenderTask, jobNS string) client.ObjectKey {
        return client.ObjectKey{
                Name:      truncateName(fmt.Sprintf("render-%s", res.Name), maxK8sLabelValueLen),
                Namespace: jobNS,
        }
}

func (r *RenderTaskReconciler) reference(baseURL, repo, tag string) string {
        base := baseURL
        if !strings.HasPrefix(base, "oci://") {
                base = fmt.Sprintf("oci://%s", base)
        }

        base = strings.TrimSuffix(base, "/")

        return fmt.Sprintf("%s/%s:%s", base, repo, tag)
}

func ttlSeconds(ttl *int32) int32 {
        if ttl != nil {
                return *ttl
        }

        return 3600
}

func shouldCleanupSecrets(res *solarv1alpha1.RenderTask, ttl time.Duration) bool {
        cond := apimeta.FindStatusCondition(res.Status.Conditions, ConditionTypeJobFailed)

        return cond != nil && time.Since(cond.LastTransitionTime.Time) >= ttl
}

func remainingTTL(res *solarv1alpha1.RenderTask, ttl time.Duration) time.Duration {
        cond := apimeta.FindStatusCondition(res.Status.Conditions, ConditionTypeJobFailed)
        if cond == nil {
                return ttl
        }

        remaining := ttl - time.Since(cond.LastTransitionTime.Time)
        if remaining < 0 {
                return 0
        }

        return remaining
}

func cleanupSecrets(ctx context.Context, r *RenderTaskReconciler, res *solarv1alpha1.RenderTask, jobNS string) {
        if err := r.deleteConfigSecret(ctx, res, jobNS); err != nil && !apierrors.IsNotFound(err) {
                r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "DeletionFailed", "Delete", "Failed to delete config secret", err)
        }
}

func cleanupRenderResources(ctx context.Context, r *RenderTaskReconciler, res *solarv1alpha1.RenderTask, job *batchv1.Job, jobNS string) {
        cleanupSecrets(ctx, r, res, jobNS)
        if err := r.deleteRenderJob(ctx, res, jobNS); err != nil && !apierrors.IsNotFound(err) {
                r.Recorder.Eventf(res, job, corev1.EventTypeWarning, "DeletionFailed", "Delete", "Failed to delete job", err)
        }
}

// SetupWithManager sets up the controller with the Manager.
func (r *RenderTaskReconciler) SetupWithManager(mgr ctrl.Manager) error {
        return ctrl.NewControllerManagedBy(mgr).
                For(&solarv1alpha1.RenderTask{}).
                Owns(&batchv1.Job{}).
                Owns(&corev1.Secret{}).
                Complete(r)
}

1	// Copyright 2026 BWI GmbH and Solution Arsenal contributors
2	// SPDX-License-Identifier: Apache-2.0
3
4	package controller
5
6	import (
7	"context"
8	"encoding/json"
9	"fmt"
10	"strings"
11	"time"
12
13	batchv1 "k8s.io/api/batch/v1"
14	corev1 "k8s.io/api/core/v1"
15	apierrors "k8s.io/apimachinery/pkg/api/errors"
16	apimeta "k8s.io/apimachinery/pkg/api/meta"
17	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
18	"k8s.io/apimachinery/pkg/runtime"
19	"k8s.io/client-go/tools/events"
20	ctrl "sigs.k8s.io/controller-runtime"
21	"sigs.k8s.io/controller-runtime/pkg/client"
22	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
23
24	solarv1alpha1 "go.opendefense.cloud/solar/api/solar/v1alpha1"
25	)
26
27	const (
28	annotationJobName = "solar.opendefense.cloud/job-name"
29	annotationSecretName = "solar.opendefense.cloud/secret-name"
30
31	// Condition types
32	ConditionTypeJobScheduled = "JobScheduled"
33	ConditionTypeJobSucceeded = "JobSucceeded"
34	ConditionTypeJobFailed = "JobFailed"
35
36	ConditionTypeTaskCompleted = "TaskCompleted"
37	ConditionTypeTaskFailed = "TaskFailed"
38	)
39
40	// RenderTaskReconciler reconciles a RenderTask object.
41	// Each RenderTask carries its own BaseURL and SecretRef for the target registry.
42	type RenderTaskReconciler struct {
43	client.Client
44	Scheme *runtime.Scheme
45	Recorder events.EventRecorder
46	RendererImage string
47	RendererCommand string
48	RendererArgs []string
49	RendererCAConfigMap string
50	}
51
52	//+kubebuilder:rbac:groups=solar.opendefense.cloud,resources=rendertasks,verbs=get;list;watch;create;update;patch;delete
53	//+kubebuilder:rbac:groups=solar.opendefense.cloud,resources=rendertasks/status,verbs=get;update;patch
54	//+kubebuilder:rbac:groups=solar.opendefense.cloud,resources=rendertasks/finalizers,verbs=update
55	//+kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;watch;create;update;patch;delete
56	//+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch;delete
57	//+kubebuilder:rbac:groups=core,resources=events,verbs=create;patch
58	//+kubebuilder:rbac:groups=events.k8s.io,resources=events,verbs=create;patch
59
60	// Reconcile moves the current state of the cluster closer to the desired state
61	func (r *RenderTaskReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {	520✔
62	log := ctrl.LoggerFrom(ctx)	520✔
63	ctrlResult := ctrl.Result{}	520✔
64		520✔
65	log.V(1).Info("RenderTask is being reconciled", "req", req)	520✔
66		520✔
67	// Fetch the RenderTask instance	520✔
68	res := &solarv1alpha1.RenderTask{}	520✔
69	if err := r.Get(ctx, req.NamespacedName, res); err != nil {	542✔
70	if apierrors.IsNotFound(err) {	44✔
71	return ctrlResult, nil	22✔
72	}	22✔
73
74	return ctrlResult, errLogAndWrap(log, err, "failed to get object")	×
75	}
76
77	// RenderTask instance marked for deletion, stop reconciling
78	if !res.DeletionTimestamp.IsZero() {	498✔
79	log.V(1).Info("RenderTask is being deleted")	×
80	r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "Deleting", "Delete", "RenderTask is being deleted, cleaning up secret and job")	×
81		×
82	return ctrlResult, nil	×
83	}	×
84
85	// Check if renderjob has already completed successfully
86	sc := apimeta.FindStatusCondition(res.Status.Conditions, ConditionTypeJobSucceeded)	498✔
87	if sc != nil && sc.ObservedGeneration >= res.Generation && sc.Status == metav1.ConditionTrue {	503✔
88	log.V(1).Info("RenderTask has already completed successfully, no further action needed")	5✔
89		5✔
90	return ctrlResult, nil	5✔
91	}	5✔
92
93	// Determine the namespace for Jobs/Secrets — use the RenderTask's namespace
94	jobNS := r.taskNamespace(res)	493✔
95		493✔
96	// Reconcile Config Secret	493✔
97	configSecret := &corev1.Secret{}	493✔
98	err := r.Get(ctx, r.configSecretKey(res, jobNS), configSecret)	493✔
99	if err != nil && apierrors.IsNotFound(err) {	900✔
100	createdSecret, err := r.createConfigSecret(ctx, res, jobNS)	407✔
101	if err != nil {	407✔
UNCOV 102	r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "CreateSecretFailed", "CreateConfigSecret", fmt.Sprintf("Failed to create config secret: %s", err))	×
UNCOV 103		×
UNCOV 104	return ctrlResult, errLogAndWrap(log, err, "failed to create secret")	×
UNCOV 105	}	×
106
107	configSecret = createdSecret	407✔
108	} else if err != nil {	86✔
109	return ctrlResult, errLogAndWrap(log, err, "could not get secret")	×
110	}	×
111
112	// Resolve push secret from the RenderTask's SecretRef
113	var pushSecret *corev1.Secret	493✔
114	if res.Spec.SecretRef != nil {	986✔
115	pushSecret = &corev1.Secret{}	493✔
116	if err := r.Get(ctx, client.ObjectKey{Name: res.Spec.SecretRef.Name, Namespace: jobNS}, pushSecret); err != nil {	536✔
117	return ctrlResult, errLogAndWrap(log, err, "failed to get push secret")	43✔
118	}	43✔
119	}
120
121	// Reconcile Job
122	job := &batchv1.Job{}	450✔
123	err = r.Get(ctx, r.renderJobKey(res, jobNS), job)	450✔
124	if err != nil && apierrors.IsNotFound(err) {	466✔
125	err := r.createRenderJob(ctx, res, configSecret, pushSecret, jobNS)	16✔
126	if err != nil {	16✔
UNCOV 127	r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "CreateJobFailed", "CreateJob", fmt.Sprintf("Failed to create job: %s", err))	×
UNCOV 128		×
UNCOV 129	return ctrlResult, errLogAndWrap(log, err, "failed to create job")	×
UNCOV 130	}	×
131	} else if err != nil {	434✔
132	return ctrlResult, errLogAndWrap(log, err, "could not get job")	×
133	}	×
134
135	// Update Status
136	if changed := r.updateResourceStatusFromJob(ctx, res, job); changed {	476✔
137	if err := r.Status().Update(ctx, res); err != nil {	31✔
138	return ctrlResult, errLogAndWrap(log, err, "failed to update status")	5✔
139	}	5✔
140	}
141
142	ttlDuration := time.Duration(ttlSeconds(res.Spec.FailedJobTTL)) * time.Second	445✔
143		445✔
144	switch {	445✔
145	case job.Status.Succeeded > 0:	3✔
146	cleanupRenderResources(ctx, r, res, job, jobNS)	3✔
147	log.V(1).Info("Cleaned up after successful job")	3✔
148		3✔
149	return ctrlResult, nil	3✔
150
151	case job.Status.Failed > 0:	406✔
152	if shouldCleanupSecrets(res, ttlDuration) {	808✔
153	cleanupSecrets(ctx, r, res, jobNS)	402✔
154	log.V(1).Info("Cleaned up secrets after failed job TTL")	402✔
155		402✔
156	return ctrlResult, nil	402✔
157	}	402✔
158
159	remaining := remainingTTL(res, ttlDuration)	4✔
160	log.V(1).Info("Waiting for TTL to expire before cleaning up secrets", "remainingSeconds", remaining.Seconds())	4✔
161		4✔
162	return ctrl.Result{RequeueAfter: remaining + time.Second}, nil	4✔
163	}
164
165	return ctrlResult, nil	36✔
166	}
167
168	// taskNamespace returns the namespace to use for Jobs/Secrets.
169	func (r RenderTaskReconciler) taskNamespace(res solarv1alpha1.RenderTask) string {	493✔
170	return res.Namespace	493✔
171	}	493✔
172
173	// updateResourceStatusFromJob updates the resource status based on job status
174	func (r RenderTaskReconciler) updateResourceStatusFromJob(ctx context.Context, res solarv1alpha1.RenderTask, job *batchv1.Job) (changed bool) {	450✔
175	log := ctrl.LoggerFrom(ctx)	450✔
176		450✔
177	if job == nil {	450✔
178	changed = apimeta.SetStatusCondition(&res.Status.Conditions, metav1.Condition{	×
179	Type: ConditionTypeJobScheduled,	×
180	Status: metav1.ConditionFalse,	×
181	ObservedGeneration: res.Generation,	×
182	Reason: "DoesNotExist",	×
183	Message: "Renderer job does not exist",	×
184	})	×
185		×
186	return changed	×
187	}	×
188
189	if job.Status.Succeeded > 0 {	453✔
190	changed = apimeta.SetStatusCondition(&res.Status.Conditions, metav1.Condition{	3✔
191	Type: ConditionTypeJobSucceeded,	3✔
192	Status: metav1.ConditionTrue,	3✔
193	ObservedGeneration: res.Generation,	3✔
194	Reason: "JobSucceeded",	3✔
195	Message: fmt.Sprintf("Renderer job completed successfully at %v", job.Status.CompletionTime),	3✔
196	})	3✔
197		3✔
198	chartURL := r.reference(res.Spec.BaseURL, res.Spec.Repository, res.Spec.Tag)	3✔
199	if res.Status.ChartURL != chartURL {	6✔
200	res.Status.ChartURL = chartURL	3✔
201	changed = true	3✔
202	}	3✔
203
204	r.Recorder.Eventf(res, job, corev1.EventTypeNormal, "JobSucceeded", "RunJob", "Renderer job completed successfully")	3✔
205	log.V(1).Info("Job succeeded", "name", job.Name)	3✔
206		3✔
207	return changed	3✔
208	}
209
210	if job.Status.Failed > 0 {	853✔
211	changed = apimeta.SetStatusCondition(&res.Status.Conditions, metav1.Condition{	406✔
212	Type: ConditionTypeJobFailed,	406✔
213	Status: metav1.ConditionTrue,	406✔
214	ObservedGeneration: res.Generation,	406✔
215	Reason: "JobFailed",	406✔
216	Message: "Renderer job failed",	406✔
217	})	406✔
218	r.Recorder.Eventf(res, job, corev1.EventTypeWarning, "JobFailed", "RunJob", "Renderer job failed")	406✔
219	log.V(1).Info("Job failed", "name", job.Name)	406✔
220		406✔
221	return changed	406✔
222	}	406✔
223
224	return apimeta.SetStatusCondition(&res.Status.Conditions, metav1.Condition{	41✔
225	Type: ConditionTypeJobScheduled,	41✔
226	Status: metav1.ConditionTrue,	41✔
227	ObservedGeneration: res.Generation,	41✔
228	Reason: "JobScheduled",	41✔
229	Message: fmt.Sprintf("Renderer job is running (active: %d, succeeded: %d, failed: %d)", job.Status.Active, job.Status.Succeeded, job.Status.Failed),	41✔
230	})	41✔
231	}
232
233	func (r RenderTaskReconciler) deleteRenderJob(ctx context.Context, res solarv1alpha1.RenderTask, jobNS string) error {	3✔
234	job := &batchv1.Job{}	3✔
235	if err := r.Get(ctx, r.renderJobKey(res, jobNS), job); err != nil {	3✔
236	return err	×
237	}	×
238
239	return r.Delete(ctx, job, client.PropagationPolicy(metav1.DeletePropagationBackground))	3✔
240	}
241
242	func (r RenderTaskReconciler) deleteConfigSecret(ctx context.Context, res solarv1alpha1.RenderTask, jobNS string) error {	405✔
243	secret := &corev1.Secret{}	405✔
244	if err := r.Get(ctx, r.configSecretKey(res, jobNS), secret); err != nil {	405✔
UNCOV 245	return err	×
UNCOV 246	}	×
247
248	return r.Delete(ctx, secret, client.PropagationPolicy(metav1.DeletePropagationBackground))	405✔
249	}
250
251	func (r RenderTaskReconciler) createRenderJob(ctx context.Context, res solarv1alpha1.RenderTask, configSecret, pushSecret *corev1.Secret, jobNS string) error {	16✔
252	log := ctrl.LoggerFrom(ctx)	16✔
253		16✔
254	jobKey := r.renderJobKey(res, jobNS)	16✔
255	jobName := jobKey.Name	16✔
256	backoffLimit := int32(3)	16✔
257	ttlSecondsAfterFinished := int32(3600)	16✔
258	if res.Spec.FailedJobTTL != nil {	18✔
259	ttlSecondsAfterFinished = *res.Spec.FailedJobTTL	2✔
260	}	2✔
261
262	volumes := []corev1.Volume{	16✔
263	{	16✔
264	Name: "config",	16✔
265	VolumeSource: corev1.VolumeSource{	16✔
266	Secret: &corev1.SecretVolumeSource{	16✔
267	SecretName: configSecret.Name,	16✔
268	Items: []corev1.KeyToPath{	16✔
269	{	16✔
270	Key: "config.json",	16✔
271	Path: "config.json",	16✔
272	},	16✔
273	},	16✔
274	},	16✔
275	},	16✔
276	},	16✔
277	}	16✔
278	volumeMounts := []corev1.VolumeMount{	16✔
279	{	16✔
280	Name: "config",	16✔
281	MountPath: "/etc/renderer/config.json",	16✔
282	SubPath: "config.json",	16✔
283	ReadOnly: true,	16✔
284	},	16✔
285	}	16✔
286	envVars := []corev1.EnvVar{	16✔
287	{	16✔
288	Name: "POD_NAMESPACE",	16✔
289	ValueFrom: &corev1.EnvVarSource{	16✔
290	FieldRef: &corev1.ObjectFieldSelector{	16✔
291	FieldPath: "metadata.namespace",	16✔
292	},	16✔
293	},	16✔
294	},	16✔
295	{	16✔
296	Name: "POD_NAME",	16✔
297	ValueFrom: &corev1.EnvVarSource{	16✔
298	FieldRef: &corev1.ObjectFieldSelector{	16✔
299	FieldPath: "metadata.name",	16✔
300	},	16✔
301	},	16✔
302	},	16✔
303	}	16✔
304		16✔
305	if r.RendererCAConfigMap != "" {	32✔
306	volumes = append(volumes, corev1.Volume{	16✔
307	Name: "ca-bundle",	16✔
308	VolumeSource: corev1.VolumeSource{	16✔
309	ConfigMap: &corev1.ConfigMapVolumeSource{	16✔
310	LocalObjectReference: corev1.LocalObjectReference{	16✔
311	Name: r.RendererCAConfigMap,	16✔
312	},	16✔
313	Items: []corev1.KeyToPath{	16✔
314	{	16✔
315	Key: "trust-bundle.pem",	16✔
316	Path: "ca-bundle.pem",	16✔
317	},	16✔
318	},	16✔
319	},	16✔
320	},	16✔
321	})	16✔
322	volumeMounts = append(volumeMounts, corev1.VolumeMount{	16✔
323	Name: "ca-bundle",	16✔
324	MountPath: "/etc/ssl/certs",	16✔
325	ReadOnly: true,	16✔
326	})	16✔
327	envVars = append(envVars, corev1.EnvVar{	16✔
328	Name: "SSL_CERT_FILE",	16✔
329	Value: "/etc/ssl/certs/ca-bundle.pem",	16✔
330	})	16✔
331	}	16✔
332
333	pushURL := r.reference(res.Spec.BaseURL, res.Spec.Repository, res.Spec.Tag)	16✔
334		16✔
335	rendererArgs := append([]string{}, r.RendererArgs...)	16✔
336	rendererArgs = append(rendererArgs,	16✔
337	"/etc/renderer/config.json",	16✔
338	fmt.Sprintf("--url=%s", pushURL),	16✔
339	)	16✔
340	if res.Spec.Insecure {	16✔
NEW 341	rendererArgs = append(rendererArgs, "--insecure")	×
NEW 342	}	×
343
344	job := &batchv1.Job{	16✔
345	ObjectMeta: metav1.ObjectMeta{	16✔
346	Name: jobName,	16✔
347	Namespace: jobKey.Namespace,	16✔
348	Annotations: map[string]string{	16✔
349	annotationJobName: jobName,	16✔
350	},	16✔
351	},	16✔
352	Spec: batchv1.JobSpec{	16✔
353	BackoffLimit: &backoffLimit,	16✔
354	TTLSecondsAfterFinished: &ttlSecondsAfterFinished,	16✔
355	Template: corev1.PodTemplateSpec{	16✔
356	Spec: corev1.PodSpec{	16✔
357	RestartPolicy: corev1.RestartPolicyNever,	16✔
358	Containers: []corev1.Container{	16✔
359	{	16✔
360	Name: "renderer",	16✔
361	Image: r.RendererImage,	16✔
362	Command: []string{r.RendererCommand},	16✔
363	Args: rendererArgs,	16✔
364	Env: envVars,	16✔
365	VolumeMounts: volumeMounts,	16✔
366	},	16✔
367	},	16✔
368	Volumes: volumes,	16✔
369	},	16✔
370	},	16✔
371	},	16✔
372	}	16✔
373		16✔
374	if pushSecret != nil {	32✔
375	switch pushSecret.Type {	16✔
376	case corev1.SecretTypeBasicAuth:	1✔
377	job.Spec.Template.Spec.Containers[0].Env = append(job.Spec.Template.Spec.Containers[0].Env,	1✔
378	corev1.EnvVar{	1✔
379	Name: "REGISTRY_USERNAME",	1✔
380	ValueFrom: &corev1.EnvVarSource{	1✔
381	SecretKeyRef: &corev1.SecretKeySelector{	1✔
382	LocalObjectReference: corev1.LocalObjectReference{	1✔
383	Name: pushSecret.Name,	1✔
384	},	1✔
385	Key: "username",	1✔
386	},	1✔
387	},	1✔
388	},	1✔
389	corev1.EnvVar{	1✔
390	Name: "REGISTRY_PASSWORD",	1✔
391	ValueFrom: &corev1.EnvVarSource{	1✔
392	SecretKeyRef: &corev1.SecretKeySelector{	1✔
393	LocalObjectReference: corev1.LocalObjectReference{	1✔
394	Name: pushSecret.Name,	1✔
395	},	1✔
396	Key: "password",	1✔
397	},	1✔
398	},	1✔
399	},	1✔
400	)	1✔
401
402	case corev1.SecretTypeDockerConfigJson:	1✔
403	job.Spec.Template.Spec.Volumes = append(job.Spec.Template.Spec.Volumes, corev1.Volume{	1✔
404	Name: "dockerconfig",	1✔
405	VolumeSource: corev1.VolumeSource{	1✔
406	Secret: &corev1.SecretVolumeSource{	1✔
407	SecretName: pushSecret.Name,	1✔
408	Items: []corev1.KeyToPath{	1✔
409	{	1✔
410	Key: ".dockerconfigjson",	1✔
411	Path: "dockerconfig.json",	1✔
412	},	1✔
413	},	1✔
414	},	1✔
415	},	1✔
416	})	1✔
417		1✔
418	job.Spec.Template.Spec.Containers[0].VolumeMounts = append(job.Spec.Template.Spec.Containers[0].VolumeMounts, corev1.VolumeMount{	1✔
419	Name: "dockerconfig",	1✔
420	MountPath: "/etc/renderer/dockerconfig.json",	1✔
421	SubPath: "dockerconfig.json",	1✔
422	ReadOnly: true,	1✔
423	})	1✔
424		1✔
425	job.Spec.Template.Spec.Containers[0].Env = append(job.Spec.Template.Spec.Containers[0].Env, corev1.EnvVar{	1✔
426	Name: "DOCKER_CONFIG",	1✔
427	Value: "/etc/renderer/dockerconfig.json",	1✔
428	})	1✔
429	default:	14✔
430	}
431	}
432
433	// Set owner references
434	if err := controllerutil.SetControllerReference(res, job, r.Scheme); err != nil {	16✔
435	return errLogAndWrap(log, err, "failed to set controller reference")	×
436	}	×
437
438	if err := r.Create(ctx, job); err != nil {	16✔
439	r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "CreationFailed", "Create", "Failed to create job: %s", err)	×
440		×
441	return errLogAndWrap(log, err, "job creation failed")	×
442	}	×
443
444	res.Status.JobRef = &corev1.ObjectReference{	16✔
445	APIVersion: batchv1.SchemeGroupVersion.String(),	16✔
446	Kind: "Job",	16✔
447	Namespace: job.Namespace,	16✔
448	Name: job.Name,	16✔
449	}	16✔
450		16✔
451	if err := r.Status().Update(ctx, res); err != nil {	16✔
UNCOV 452	return errLogAndWrap(log, err, "failed to update status")	×
UNCOV 453	}	×
454
455	return nil	16✔
456	}
457
458	func (r RenderTaskReconciler) createConfigSecret(ctx context.Context, res solarv1alpha1.RenderTask, jobNS string) (*corev1.Secret, error) {	407✔
459	log := ctrl.LoggerFrom(ctx)	407✔
460		407✔
461	cfgJson, err := json.Marshal(res.Spec.RendererConfig)	407✔
462	if err != nil {	407✔
463	return nil, err	×
464	}	×
465
466	secretKey := r.configSecretKey(res, jobNS)	407✔
467	secret := &corev1.Secret{	407✔
468	ObjectMeta: metav1.ObjectMeta{	407✔
469	Name: secretKey.Name,	407✔
470	Namespace: secretKey.Namespace,	407✔
471	Annotations: map[string]string{	407✔
472	annotationSecretName: secretKey.Name,	407✔
473	},	407✔
474	},	407✔
475	Type: corev1.SecretTypeOpaque,	407✔
476	Data: map[string][]byte{	407✔
477	"config.json": cfgJson,	407✔
478	},	407✔
479	}	407✔
480		407✔
481	// Set owner references	407✔
482	if err := controllerutil.SetControllerReference(res, secret, r.Scheme); err != nil {	407✔
483	return nil, errLogAndWrap(log, err, "failed to set controller reference")	×
484	}	×
485
486	if err := r.Create(ctx, secret); err != nil {	407✔
487	r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "CreationFailed", "Create", "Failed to create secret: %s", err)	×
488		×
489	return nil, errLogAndWrap(log, err, "secret creation failed")	×
490	}	×
491
492	res.Status.ConfigSecretRef = &corev1.ObjectReference{	407✔
493	APIVersion: corev1.SchemeGroupVersion.String(),	407✔
494	Kind: "Secret",	407✔
495	Namespace: secret.Namespace,	407✔
496	Name: secret.Name,	407✔
497	}	407✔
498		407✔
499	if err := r.Status().Update(ctx, res); err != nil {	407✔
UNCOV 500	return nil, errLogAndWrap(log, err, "failed to update status")	×
UNCOV 501	}	×
502
503	return secret, nil	407✔
504	}
505
506	func (r RenderTaskReconciler) configSecretKey(res solarv1alpha1.RenderTask, jobNS string) client.ObjectKey {	1,305✔
507	return client.ObjectKey{	1,305✔
508	Name: truncateName(fmt.Sprintf("render-%s", res.Name), maxK8sLabelValueLen),	1,305✔
509	Namespace: jobNS,	1,305✔
510	}	1,305✔
511	}	1,305✔
512
513	func (r RenderTaskReconciler) renderJobKey(res solarv1alpha1.RenderTask, jobNS string) client.ObjectKey {	469✔
514	return client.ObjectKey{	469✔
515	Name: truncateName(fmt.Sprintf("render-%s", res.Name), maxK8sLabelValueLen),	469✔
516	Namespace: jobNS,	469✔
517	}	469✔
518	}	469✔
519
520	func (r *RenderTaskReconciler) reference(baseURL, repo, tag string) string {	19✔
521	base := baseURL	19✔
522	if !strings.HasPrefix(base, "oci://") {	38✔
523	base = fmt.Sprintf("oci://%s", base)	19✔
524	}	19✔
525
526	base = strings.TrimSuffix(base, "/")	19✔
527		19✔
528	return fmt.Sprintf("%s/%s:%s", base, repo, tag)	19✔
529	}
530
531	func ttlSeconds(ttl *int32) int32 {	445✔
532	if ttl != nil {	855✔
533	return *ttl	410✔
534	}	410✔
535
536	return 3600	35✔
537	}
538
539	func shouldCleanupSecrets(res *solarv1alpha1.RenderTask, ttl time.Duration) bool {	406✔
540	cond := apimeta.FindStatusCondition(res.Status.Conditions, ConditionTypeJobFailed)	406✔
541		406✔
542	return cond != nil && time.Since(cond.LastTransitionTime.Time) >= ttl	406✔
543	}	406✔
544
545	func remainingTTL(res *solarv1alpha1.RenderTask, ttl time.Duration) time.Duration {	4✔
546	cond := apimeta.FindStatusCondition(res.Status.Conditions, ConditionTypeJobFailed)	4✔
547	if cond == nil {	4✔
548	return ttl	×
549	}	×
550
551	remaining := ttl - time.Since(cond.LastTransitionTime.Time)	4✔
552	if remaining < 0 {	4✔
553	return 0	×
554	}	×
555
556	return remaining	4✔
557	}
558
559	func cleanupSecrets(ctx context.Context, r RenderTaskReconciler, res solarv1alpha1.RenderTask, jobNS string) {	405✔
560	if err := r.deleteConfigSecret(ctx, res, jobNS); err != nil && !apierrors.IsNotFound(err) {	405✔
561	r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "DeletionFailed", "Delete", "Failed to delete config secret", err)	×
562	}	×
563	}
564
565	func cleanupRenderResources(ctx context.Context, r RenderTaskReconciler, res solarv1alpha1.RenderTask, job *batchv1.Job, jobNS string) {	3✔
566	cleanupSecrets(ctx, r, res, jobNS)	3✔
567	if err := r.deleteRenderJob(ctx, res, jobNS); err != nil && !apierrors.IsNotFound(err) {	3✔
568	r.Recorder.Eventf(res, job, corev1.EventTypeWarning, "DeletionFailed", "Delete", "Failed to delete job", err)	×
569	}	×
570	}
571
572	// SetupWithManager sets up the controller with the Manager.
573	func (r *RenderTaskReconciler) SetupWithManager(mgr ctrl.Manager) error {	1✔
574	return ctrl.NewControllerManagedBy(mgr).	1✔
575	For(&solarv1alpha1.RenderTask{}).	1✔
576	Owns(&batchv1.Job{}).	1✔
577	Owns(&corev1.Secret{}).	1✔
578	Complete(r)	1✔
579	}	1✔

opendefensecloud / solution-arsenal / 24822429227

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous