36888718399

Committed 01 Oct 2026 04:00PM UTC coverage: 78.611% (-0.02%) from 78.627%

Build # 36888718399

Build Type

push

github

Committed by

web-flow

Commit Message

chore(deps): update dependency pymdown-extensions to v12 (#826)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[pymdown-extensions](https://redirect.github.com/facelessuser/pymdown-extensions)
| `==11.0.2` → `==12.0.1` |
![age](https://developer.mend.io/api/mc/badges/age/pypi/pymdown-extensions/12.0.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pymdown-extensions/11.0.2/12.0.1?slim=true)
|

---

### Release Notes

<details>
<summary>facelessuser/pymdown-extensions (pymdown-extensions)</summary>

###
[`v12.0.1`](https://redirect.github.com/facelessuser/pymdown-extensions/releases/tag/12.0.1)

[Compare
Source](https://redirect.github.com/facelessuser/pymdown-extensions/compare/12.0...12.0.1)

#### 12.0.1

- **FIX**: BetterEm: fix a case with new logic.

###
[`v12.0`](https://redirect.github.com/facelessuser/pymdown-extensions/releases/tag/12.0)

[Compare
Source](https://redirect.github.com/facelessuser/pymdown-extensions/compare/11.0.2...12.0)

#### 12.0

- **BREAK**: BetterEm: Complete rewrite. There may be some subtle
differences between legacy behavior and new
  CommonMark behavior.

- `*` and `_` emphasis are handled at the same time to provide more
natural nesting.
  - More performant.
  - CommonMark compliant.

- **BREAK**: Tilde, Caret, Mark: Rewritten and now built upon the latest
BetterEm logic.

- When used with BetterEm, Tilde, Caret, and Mark will be added to the
same delimiter processor under the hood and
will be parsed at the same time as emphasis, allowing for better nesting
logic.
- More performant. Performance issues reported by
([@&#8203;lexdotdev](https://redirect.github.com/lexdotdev)).
- Tilde, Caret, Mark: Allow deletion, insertions, and marking mid-word
by default. Set `smart_delete`,
`smart_insert`, or `smart_mark`, respectively, to enable... (continued)

Coverage Stats

5083 of 6466 relevant lines covered (78.61%)

27.05 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

86.64

/pkg/controller/rendertask_controller.go

// Copyright BWI GmbH and Solution Arsenal contributors
// SPDX-License-Identifier: Apache-2.0

package controller

import (
        "context"
        "encoding/json"
        "fmt"
        "slices"
        "strings"
        "time"

        batchv1 "k8s.io/api/batch/v1"
        corev1 "k8s.io/api/core/v1"
        apierrors "k8s.io/apimachinery/pkg/api/errors"
        apimeta "k8s.io/apimachinery/pkg/api/meta"
        metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
        "k8s.io/apimachinery/pkg/runtime"
        "k8s.io/client-go/tools/events"
        ctrl "sigs.k8s.io/controller-runtime"
        "sigs.k8s.io/controller-runtime/pkg/client"
        "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"

        solarv1alpha1 "go.opendefense.cloud/solar/api/solar/v1alpha1"
)

const (
        annotationJobName    = "solar.opendefense.cloud/job-name"
        annotationSecretName = "solar.opendefense.cloud/secret-name"

        // Condition types
        ConditionTypeJobScheduled = "JobScheduled"
        ConditionTypeJobSucceeded = "JobSucceeded"
        ConditionTypeJobFailed    = "JobFailed"

        ConditionTypeTaskCompleted = "TaskCompleted"
        ConditionTypeTaskFailed    = "TaskFailed"
)

// RenderTaskReconciler reconciles a RenderTask object.
// Each RenderTask carries its own BaseURL and PushSecretRef for the target registry.
type RenderTaskReconciler struct {
        client.Client
        Scheme              *runtime.Scheme
        Recorder            events.EventRecorder
        RendererImage       string
        RendererCommand     string
        RendererArgs        []string
        RendererCAConfigMap string
        // RendererImagePullSecrets is the list of Secret names that kubelets in
        // each RenderTask namespace should use to pull the renderer image. Each
        // name must reference an existing Secret of type
        // kubernetes.io/dockerconfigjson in the RenderTask's namespace.
        RendererImagePullSecrets []string
        // WatchNamespace restricts reconciliation to this namespace.
        // Should be empty in production (watches all namespaces).
        // Intended for use in integration tests only.
        // See: https://book.kubebuilder.io/reference/envtest#testing-considerations
        WatchNamespace string
}

//+kubebuilder:rbac:groups=solar.opendefense.cloud,resources=rendertasks,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups=solar.opendefense.cloud,resources=rendertasks/status,verbs=get;update;patch
//+kubebuilder:rbac:groups=solar.opendefense.cloud,resources=rendertasks/finalizers,verbs=update
//+kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups=events.k8s.io,resources=events,verbs=create;patch

// Reconcile moves the current state of the cluster closer to the desired state
func (r *RenderTaskReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
        log := ctrl.LoggerFrom(ctx)
        ctrlResult := ctrl.Result{}

        log.V(1).Info("RenderTask is being reconciled", "req", req)

        if r.WatchNamespace != "" && req.Namespace != r.WatchNamespace {
                return ctrlResult, nil
        }

        // Fetch the RenderTask instance
        res := &solarv1alpha1.RenderTask{}
        if err := r.Get(ctx, req.NamespacedName, res); err != nil {
                if apierrors.IsNotFound(err) {
                        return ctrlResult, nil
                }

                return ctrlResult, fmt.Errorf("failed to get RenderTask: %w", err)
        }

        // RenderTask instance marked for deletion, stop reconciling
        if !res.DeletionTimestamp.IsZero() {
                log.V(1).Info("RenderTask is being deleted")
                r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "Deleting", "Delete", "RenderTask is being deleted, cleaning up secret and job")

                return ctrlResult, nil
        }

        // Check if renderjob has already completed successfully
        sc := apimeta.FindStatusCondition(res.Status.Conditions, ConditionTypeJobSucceeded)
        if sc != nil && sc.ObservedGeneration >= res.Generation && sc.Status == metav1.ConditionTrue {
                log.V(1).Info("RenderTask has already completed successfully, no further action needed")

                return ctrlResult, nil
        }

        // Determine the namespace for Jobs/Secrets — use the RenderTask's namespace
        jobNS := r.taskNamespace(res)

        // Reconcile Config Secret
        configSecret := &corev1.Secret{}
        err := r.Get(ctx, r.configSecretKey(res, jobNS), configSecret)
        if err != nil && apierrors.IsNotFound(err) {
                createdSecret, err := r.createConfigSecret(ctx, res, jobNS)
                if err != nil {
                        r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "CreateSecretFailed", "CreateConfigSecret", "Failed to create config secret: %s", err)

                        return ctrlResult, fmt.Errorf("failed to create secret: %w", err)
                }

                configSecret = createdSecret
        } else if err != nil {
                return ctrlResult, fmt.Errorf("failed to get config secret: %w", err)
        }

        // Resolve push secret from the RenderTask's PushSecretRef
        var pushSecret *corev1.Secret
        if res.Spec.PushSecretRef != nil {
                pushSecret = &corev1.Secret{}
                if err := r.Get(ctx, client.ObjectKey{Name: res.Spec.PushSecretRef.Name, Namespace: jobNS}, pushSecret); err != nil {
                        return ctrlResult, fmt.Errorf("failed to get push secret: %w", err)
                }
        }

        // Resolve source secret from the RenderTask's SourceSecretRef. It holds the
        // credentials for reading the OCM component the release is built from.
        var sourceSecret *corev1.Secret
        if res.Spec.SourceSecretRef != nil {
                sourceSecret = &corev1.Secret{}
                if err := r.Get(ctx, client.ObjectKey{Name: res.Spec.SourceSecretRef.Name, Namespace: jobNS}, sourceSecret); err != nil {
                        return ctrlResult, fmt.Errorf("failed to get source secret: %w", err)
                }
        }

        // Reconcile Job
        job := &batchv1.Job{}
        err = r.Get(ctx, r.renderJobKey(res, jobNS), job)
        if err != nil && apierrors.IsNotFound(err) {
                err := r.createRenderJob(ctx, res, configSecret, pushSecret, sourceSecret, jobNS)
                if err != nil {
                        r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "CreateJobFailed", "CreateJob", "Failed to create job: %s", err)

                        return ctrlResult, fmt.Errorf("failed to create job: %w", err)
                }
        } else if err != nil {
                return ctrlResult, fmt.Errorf("failed to get job: %w", err)
        }

        // Update Status
        if changed := r.updateResourceStatusFromJob(ctx, res, job); changed {
                if err := r.Status().Update(ctx, res); err != nil {
                        return ctrlResult, fmt.Errorf("failed to update status: %w", err)
                }
        }

        ttlDuration := time.Duration(ttlSeconds(res.Spec.FailedJobTTL)) * time.Second

        switch {
        case job.Status.Succeeded > 0:
                cleanupRenderResources(ctx, r, res, job, jobNS)
                log.V(1).Info("Cleaned up after successful job")

                return ctrlResult, nil

        case job.Status.Failed > 0:
                if shouldCleanupSecrets(res, ttlDuration) {
                        cleanupSecrets(ctx, r, res, jobNS)
                        log.V(1).Info("Cleaned up secrets after failed job TTL")

                        return ctrlResult, nil
                }

                remaining := remainingTTL(res, ttlDuration)
                log.V(1).Info("Waiting for TTL to expire before cleaning up secrets", "remainingSeconds", remaining.Seconds())

                return ctrl.Result{RequeueAfter: remaining + time.Second}, nil
        }

        return ctrlResult, nil
}

// taskNamespace returns the namespace to use for Jobs/Secrets.
func (r *RenderTaskReconciler) taskNamespace(res *solarv1alpha1.RenderTask) string {
        return res.Namespace
}

// updateResourceStatusFromJob updates the resource status based on job status
func (r *RenderTaskReconciler) updateResourceStatusFromJob(ctx context.Context, res *solarv1alpha1.RenderTask, job *batchv1.Job) (changed bool) {
        log := ctrl.LoggerFrom(ctx)

        if job == nil {
                changed = apimeta.SetStatusCondition(&res.Status.Conditions, metav1.Condition{
                        Type:               ConditionTypeJobScheduled,
                        Status:             metav1.ConditionFalse,
                        ObservedGeneration: res.Generation,
                        Reason:             "DoesNotExist",
                        Message:            "Renderer job does not exist",
                })

                return changed
        }

        if job.Status.Succeeded > 0 {
                changed = apimeta.SetStatusCondition(&res.Status.Conditions, metav1.Condition{
                        Type:               ConditionTypeJobSucceeded,
                        Status:             metav1.ConditionTrue,
                        ObservedGeneration: res.Generation,
                        Reason:             "JobSucceeded",
                        Message:            fmt.Sprintf("Renderer job completed successfully at %v", job.Status.CompletionTime),
                })

                chartURL := r.reference(res.Spec.BaseURL, res.Spec.Repository, res.Spec.Tag)
                if res.Status.ChartURL != chartURL {
                        res.Status.ChartURL = chartURL
                        changed = true
                }

                r.Recorder.Eventf(res, job, corev1.EventTypeNormal, "JobSucceeded", "RunJob", "Renderer job completed successfully")
                log.V(1).Info("Job succeeded", "name", job.Name)

                return changed
        }

        if job.Status.Failed > 0 {
                changed = apimeta.SetStatusCondition(&res.Status.Conditions, metav1.Condition{
                        Type:               ConditionTypeJobFailed,
                        Status:             metav1.ConditionTrue,
                        ObservedGeneration: res.Generation,
                        Reason:             "JobFailed",
                        Message:            "Renderer job failed",
                })
                r.Recorder.Eventf(res, job, corev1.EventTypeWarning, "JobFailed", "RunJob", "Renderer job failed")
                log.V(1).Info("Job failed", "name", job.Name)

                return changed
        }

        return apimeta.SetStatusCondition(&res.Status.Conditions, metav1.Condition{
                Type:               ConditionTypeJobScheduled,
                Status:             metav1.ConditionTrue,
                ObservedGeneration: res.Generation,
                Reason:             "JobScheduled",
                Message:            fmt.Sprintf("Renderer job is running (active: %d, succeeded: %d, failed: %d)", job.Status.Active, job.Status.Succeeded, job.Status.Failed),
        })
}

func (r *RenderTaskReconciler) deleteRenderJob(ctx context.Context, res *solarv1alpha1.RenderTask, jobNS string) error {
        job := &batchv1.Job{}
        if err := r.Get(ctx, r.renderJobKey(res, jobNS), job); err != nil {
                return err
        }

        return r.Delete(ctx, job, client.PropagationPolicy(metav1.DeletePropagationBackground))
}

func (r *RenderTaskReconciler) deleteConfigSecret(ctx context.Context, res *solarv1alpha1.RenderTask, jobNS string) error {
        secret := &corev1.Secret{}
        if err := r.Get(ctx, r.configSecretKey(res, jobNS), secret); err != nil {
                return err
        }

        return r.Delete(ctx, secret, client.PropagationPolicy(metav1.DeletePropagationBackground))
}

func (r *RenderTaskReconciler) createRenderJob(ctx context.Context, res *solarv1alpha1.RenderTask, configSecret, pushSecret, sourceSecret *corev1.Secret, jobNS string) error {
        jobKey := r.renderJobKey(res, jobNS)
        jobName := jobKey.Name
        backoffLimit := int32(3)
        ttlSecondsAfterFinished := int32(3600)
        if res.Spec.FailedJobTTL != nil {
                ttlSecondsAfterFinished = *res.Spec.FailedJobTTL
        }

        volumes := []corev1.Volume{
                {
                        Name: "config",
                        Secret: &corev1.SecretVolumeSource{
                                SecretName: configSecret.Name,
                                Items: []corev1.KeyToPath{
                                        {
                                                Key:  "config.json",
                                                Path: "config.json",
                                        },
                                },
                        },
                },
        }
        volumeMounts := []corev1.VolumeMount{
                {
                        Name:      "config",
                        MountPath: "/etc/renderer/config.json",
                        SubPath:   "config.json",
                        ReadOnly:  true,
                },
        }
        envVars := []corev1.EnvVar{
                {
                        Name: "POD_NAMESPACE",
                        ValueFrom: &corev1.EnvVarSource{
                                FieldRef: &corev1.ObjectFieldSelector{
                                        FieldPath: "metadata.namespace",
                                },
                        },
                },
                {
                        Name: "POD_NAME",
                        ValueFrom: &corev1.EnvVarSource{
                                FieldRef: &corev1.ObjectFieldSelector{
                                        FieldPath: "metadata.name",
                                },
                        },
                },
        }

        if r.RendererCAConfigMap != "" {
                volumes = append(volumes, corev1.Volume{
                        Name: "ca-bundle",
                        ConfigMap: &corev1.ConfigMapVolumeSource{
                                Name: r.RendererCAConfigMap,
                                Items: []corev1.KeyToPath{
                                        {
                                                Key:  "trust-bundle.pem",
                                                Path: "ca-bundle.pem",
                                        },
                                },
                        },
                })
                volumeMounts = append(volumeMounts, corev1.VolumeMount{
                        Name:      "ca-bundle",
                        MountPath: "/etc/ssl/certs",
                        ReadOnly:  true,
                })
                envVars = append(envVars, corev1.EnvVar{
                        Name:  "SSL_CERT_FILE",
                        Value: "/etc/ssl/certs/ca-bundle.pem",
                })
        }

        pushURL := r.reference(res.Spec.BaseURL, res.Spec.Repository, res.Spec.Tag)

        args := slices.Clone(r.RendererArgs)
        args = append(args, "/etc/renderer/config.json", fmt.Sprintf("--url=%s", pushURL))
        if res.Spec.PlainHTTP {
                args = append(args, "--plain-http=true")
        }

        job := &batchv1.Job{
                Name:      jobName,
                Namespace: jobKey.Namespace,
                Annotations: map[string]string{
                        annotationJobName: jobName,
                },
                Spec: batchv1.JobSpec{
                        BackoffLimit:            &backoffLimit,
                        TTLSecondsAfterFinished: &ttlSecondsAfterFinished,
                        Template: corev1.PodTemplateSpec{
                                Spec: corev1.PodSpec{
                                        RestartPolicy: corev1.RestartPolicyNever,
                                        Containers: []corev1.Container{
                                                {
                                                        Name:         "renderer",
                                                        Image:        r.RendererImage,
                                                        Command:      []string{r.RendererCommand},
                                                        Args:         args,
                                                        Env:          envVars,
                                                        VolumeMounts: volumeMounts,
                                                },
                                        },
                                        Volumes: volumes,
                                },
                        },
                },
        }

        if pushSecret != nil {
                switch pushSecret.Type {
                case corev1.SecretTypeBasicAuth:
                        job.Spec.Template.Spec.Containers[0].Env = append(job.Spec.Template.Spec.Containers[0].Env,
                                corev1.EnvVar{
                                        Name: "REGISTRY_USERNAME",
                                        ValueFrom: &corev1.EnvVarSource{
                                                SecretKeyRef: &corev1.SecretKeySelector{
                                                        Name: pushSecret.Name,
                                                        Key:  "username",
                                                },
                                        },
                                },
                                corev1.EnvVar{
                                        Name: "REGISTRY_PASSWORD",
                                        ValueFrom: &corev1.EnvVarSource{
                                                SecretKeyRef: &corev1.SecretKeySelector{
                                                        Name: pushSecret.Name,
                                                        Key:  "password",
                                                },
                                        },
                                },
                        )

                case corev1.SecretTypeDockerConfigJson:
                        job.Spec.Template.Spec.Volumes = append(job.Spec.Template.Spec.Volumes, corev1.Volume{
                                Name: "dockerconfig",
                                Secret: &corev1.SecretVolumeSource{
                                        SecretName: pushSecret.Name,
                                        Items: []corev1.KeyToPath{
                                                {
                                                        Key:  ".dockerconfigjson",
                                                        Path: "dockerconfig.json",
                                                },
                                        },
                                },
                        })

                        job.Spec.Template.Spec.Containers[0].VolumeMounts = append(job.Spec.Template.Spec.Containers[0].VolumeMounts, corev1.VolumeMount{
                                Name:      "dockerconfig",
                                MountPath: "/etc/renderer/dockerconfig.json",
                                SubPath:   "dockerconfig.json",
                                ReadOnly:  true,
                        })

                        job.Spec.Template.Spec.Containers[0].Env = append(job.Spec.Template.Spec.Containers[0].Env, corev1.EnvVar{
                                Name:  "DOCKER_CONFIG",
                                Value: "/etc/renderer/dockerconfig.json",
                        })
                default:
                }
        }

        // Credentials for reading the OCM component. Kept separate from the push
        // credentials because the source registry is frequently a different one.
        switch {
        case hasBasicAuthKeys(sourceSecret):
                job.Spec.Template.Spec.Containers[0].Env = append(job.Spec.Template.Spec.Containers[0].Env,
                        corev1.EnvVar{
                                Name: "SOURCE_REGISTRY_USERNAME",
                                ValueFrom: &corev1.EnvVarSource{
                                        SecretKeyRef: &corev1.SecretKeySelector{
                                                Name: sourceSecret.Name,
                                                Key:  secretKeyUsername,
                                        },
                                },
                        },
                        corev1.EnvVar{
                                Name: "SOURCE_REGISTRY_PASSWORD",
                                ValueFrom: &corev1.EnvVarSource{
                                        SecretKeyRef: &corev1.SecretKeySelector{
                                                Name: sourceSecret.Name,
                                                Key:  secretKeyPassword,
                                        },
                                },
                        },
                )

        case hasDockerConfigJSON(sourceSecret):
                // Mounted at its own path so it cannot collide with the push secret's
                // docker config
                job.Spec.Template.Spec.Volumes = append(job.Spec.Template.Spec.Volumes, corev1.Volume{
                        Name: "source-dockerconfig",
                        Secret: &corev1.SecretVolumeSource{
                                SecretName: sourceSecret.Name,
                                Items: []corev1.KeyToPath{
                                        {
                                                Key:  corev1.DockerConfigJsonKey,
                                                Path: "config.json",
                                        },
                                },
                        },
                })

                job.Spec.Template.Spec.Containers[0].VolumeMounts = append(
                        job.Spec.Template.Spec.Containers[0].VolumeMounts, corev1.VolumeMount{
                                Name:      "source-dockerconfig",
                                MountPath: sourceDockerConfigPath,
                                SubPath:   "config.json",
                                ReadOnly:  true,
                        })

                job.Spec.Template.Spec.Containers[0].Env = append(job.Spec.Template.Spec.Containers[0].Env,
                        corev1.EnvVar{
                                Name:  "SOURCE_DOCKER_CONFIG",
                                Value: sourceDockerConfigPath,
                        })
        }

        if len(r.RendererImagePullSecrets) > 0 {
                refs := make([]corev1.LocalObjectReference, len(r.RendererImagePullSecrets))
                for i, n := range r.RendererImagePullSecrets {
                        refs[i] = corev1.LocalObjectReference{Name: n}
                }
                job.Spec.Template.Spec.ImagePullSecrets = refs
        }

        // Set owner references
        if err := controllerutil.SetControllerReference(res, job, r.Scheme); err != nil {
                return fmt.Errorf("failed to set controller reference on Job: %w", err)
        }

        if err := r.Create(ctx, job); err != nil {
                r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "CreationFailed", "Create", "Failed to create job: %s", err)

                return err
        }

        res.Status.JobRef = &corev1.ObjectReference{
                APIVersion: batchv1.SchemeGroupVersion.String(),
                Kind:       "Job",
                Namespace:  job.Namespace,
                Name:       job.Name,
        }

        if err := r.Status().Update(ctx, res); err != nil {
                return fmt.Errorf("failed to update status: %w", err)
        }

        return nil
}

// secretKeyUsername and secretKeyPassword are the keys SolAr reads from a
// Registry's solarSecretRef, mirroring pkg/discovery/registry_provider.go.
const (
        secretKeyUsername = "username"
        secretKeyPassword = "password"

        // sourceDockerConfigPath is where a dockerconfigjson source secret is
        // mounted in the render Pod, kept distinct from the push secret's mount.
        sourceDockerConfigPath = "/etc/renderer/source-dockerconfig.json"
)

// hasBasicAuthKeys reports whether secret carries both credential keys with
// non-empty values, regardless of its declared Secret type. Empty values are
// rejected
func hasBasicAuthKeys(secret *corev1.Secret) bool {
        if secret == nil {
                return false
        }

        username, hasUser := secret.Data[secretKeyUsername]
        password, hasPass := secret.Data[secretKeyPassword]

        return hasUser && hasPass && len(username) > 0 && len(password) > 0
}

// hasDockerConfigJSON reports whether secret carries a non-empty docker config,
// the other shape a Registry's solarSecretRef can take.
func hasDockerConfigJSON(secret *corev1.Secret) bool {
        if secret == nil {
                return false
        }

        config, ok := secret.Data[corev1.DockerConfigJsonKey]

        return ok && len(config) > 0
}

func (r *RenderTaskReconciler) createConfigSecret(ctx context.Context, res *solarv1alpha1.RenderTask, jobNS string) (*corev1.Secret, error) {
        cfgJson, err := json.Marshal(res.Spec.RendererConfig)
        if err != nil {
                return nil, err
        }

        secretKey := r.configSecretKey(res, jobNS)
        secret := &corev1.Secret{
                Name:      secretKey.Name,
                Namespace: secretKey.Namespace,
                Annotations: map[string]string{
                        annotationSecretName: secretKey.Name,
                },
                Type: corev1.SecretTypeOpaque,
                Data: map[string][]byte{
                        "config.json": cfgJson,
                },
        }

        // Set owner references
        if err := controllerutil.SetControllerReference(res, secret, r.Scheme); err != nil {
                return nil, fmt.Errorf("failed to set controller reference on Secret: %w", err)
        }

        if err := r.Create(ctx, secret); err != nil {
                r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "CreationFailed", "Create", "Failed to create secret: %s", err)

                return nil, err
        }

        res.Status.ConfigSecretRef = &corev1.ObjectReference{
                APIVersion: corev1.SchemeGroupVersion.String(),
                Kind:       "Secret",
                Namespace:  secret.Namespace,
                Name:       secret.Name,
        }

        if err := r.Status().Update(ctx, res); err != nil {
                return nil, fmt.Errorf("failed to update status: %w", err)
        }

        return secret, nil
}

func (r *RenderTaskReconciler) configSecretKey(res *solarv1alpha1.RenderTask, jobNS string) client.ObjectKey {
        return client.ObjectKey{
                Name:      truncateName(fmt.Sprintf("render-%s", res.Name), maxK8sLabelValueLen),
                Namespace: jobNS,
        }
}

func (r *RenderTaskReconciler) renderJobKey(res *solarv1alpha1.RenderTask, jobNS string) client.ObjectKey {
        return client.ObjectKey{
                Name:      truncateName(fmt.Sprintf("render-%s", res.Name), maxK8sLabelValueLen),
                Namespace: jobNS,
        }
}

func (r *RenderTaskReconciler) reference(baseURL, repo, tag string) string {
        base := baseURL
        if !strings.HasPrefix(base, "oci://") {
                base = fmt.Sprintf("oci://%s", base)
        }

        base = strings.TrimSuffix(base, "/")

        return fmt.Sprintf("%s/%s:%s", base, repo, tag)
}

func ttlSeconds(ttl *int32) int32 {
        if ttl != nil {
                return *ttl
        }

        return 3600
}

func shouldCleanupSecrets(res *solarv1alpha1.RenderTask, ttl time.Duration) bool {
        cond := apimeta.FindStatusCondition(res.Status.Conditions, ConditionTypeJobFailed)

        return cond != nil && time.Since(cond.LastTransitionTime.Time) >= ttl
}

func remainingTTL(res *solarv1alpha1.RenderTask, ttl time.Duration) time.Duration {
        cond := apimeta.FindStatusCondition(res.Status.Conditions, ConditionTypeJobFailed)
        if cond == nil {
                return ttl
        }

        remaining := ttl - time.Since(cond.LastTransitionTime.Time)
        if remaining < 0 {
                return 0
        }

        return remaining
}

func cleanupSecrets(ctx context.Context, r *RenderTaskReconciler, res *solarv1alpha1.RenderTask, jobNS string) {
        if err := r.deleteConfigSecret(ctx, res, jobNS); err != nil && !apierrors.IsNotFound(err) {
                r.Recorder.Eventf(res, nil, corev1.EventTypeWarning, "DeletionFailed", "Delete", "Failed to delete config secret: %s", err)
        }
}

func cleanupRenderResources(ctx context.Context, r *RenderTaskReconciler, res *solarv1alpha1.RenderTask, job *batchv1.Job, jobNS string) {
        cleanupSecrets(ctx, r, res, jobNS)
        if err := r.deleteRenderJob(ctx, res, jobNS); err != nil && !apierrors.IsNotFound(err) {
                r.Recorder.Eventf(res, job, corev1.EventTypeWarning, "DeletionFailed", "Delete", "Failed to delete job: %s", err)
        }
}

// SetupWithManager sets up the controller with the Manager.
func (r *RenderTaskReconciler) SetupWithManager(mgr ctrl.Manager) error {
        return ctrl.NewControllerManagedBy(mgr).
                For(&solarv1alpha1.RenderTask{}).
                Owns(&batchv1.Job{}).
                Owns(&corev1.Secret{}).
                Complete(r)
}

opendefensecloud / solution-arsenal / 36888718399

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous