github.com/verrazzano/verrazzano@v1.7.0/application-operator/mcagent/mcagent_secret.go (about)

     1  // Copyright (c) 2021, 2022, Oracle and/or its affiliates.
     2  // Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
     3  
     4  package mcagent
     5  
     6  import (
     7  	"fmt"
     8  
     9  	apierrors "k8s.io/apimachinery/pkg/api/errors"
    10  
    11  	clustersv1alpha1 "github.com/verrazzano/verrazzano/application-operator/apis/clusters/v1alpha1"
    12  	"github.com/verrazzano/verrazzano/application-operator/controllers/clusters"
    13  	"k8s.io/apimachinery/pkg/types"
    14  	"sigs.k8s.io/controller-runtime/pkg/client"
    15  	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
    16  )
    17  
    18  // Synchronize MultiClusterSecret objects to the local cluster
    19  func (s *Syncer) syncMCSecretObjects(namespace string) error {
    20  	// Get all the MultiClusterSecret objects from the admin cluster
    21  	allAdminMCSecrets := clustersv1alpha1.MultiClusterSecretList{}
    22  	listOptions := &client.ListOptions{Namespace: namespace}
    23  	err := s.AdminClient.List(s.Context, &allAdminMCSecrets, listOptions)
    24  	// When placements are changed a forbidden error can be returned.  In this case,
    25  	// we want to fall through and delete orphaned resources.
    26  	if err != nil && !apierrors.IsNotFound(err) && !apierrors.IsForbidden(err) {
    27  		return err
    28  	}
    29  
    30  	// Write each of the records that are targeted to this cluster
    31  	for _, mcSecret := range allAdminMCSecrets.Items {
    32  		if s.isThisCluster(mcSecret.Spec.Placement) {
    33  			_, err := s.createOrUpdateMCSecret(mcSecret)
    34  			if err != nil {
    35  				s.Log.Errorw(fmt.Sprintf("Failed syncing object: %v", err),
    36  					"MultiClusterSecret",
    37  					types.NamespacedName{Namespace: mcSecret.Namespace, Name: mcSecret.Name})
    38  			}
    39  		}
    40  	}
    41  
    42  	// Delete orphaned or no longer placed MultiClusterSecret resources.
    43  	// Get the list of MultiClusterSecret resources on the
    44  	// local cluster and compare to the list received from the admin cluster.
    45  	// The admin cluster is the source of truth.
    46  	allLocalMCSecrets := clustersv1alpha1.MultiClusterSecretList{}
    47  	err = s.LocalClient.List(s.Context, &allLocalMCSecrets, listOptions)
    48  	if err != nil {
    49  		s.Log.Errorf("Failed to list MultiClusterSecret on local cluster: %v", err)
    50  		return nil
    51  	}
    52  	for si, mcSecret := range allLocalMCSecrets.Items {
    53  		// Delete each MultiClusterSecret object that is not on the admin cluster or no longer placed on this cluster
    54  		if !s.secretPlacedOnCluster(&allAdminMCSecrets, mcSecret.Name, mcSecret.Namespace) {
    55  			err := s.LocalClient.Delete(s.Context, &allLocalMCSecrets.Items[si])
    56  			if err != nil {
    57  				s.Log.Errorf("Failed to delete MultiClusterSecret with name %q and namespace %q: %v", mcSecret.Name, mcSecret.Namespace, err)
    58  			}
    59  		}
    60  	}
    61  
    62  	return nil
    63  }
    64  
    65  // Create or update a MultiClusterSecret
    66  func (s *Syncer) createOrUpdateMCSecret(mcSecret clustersv1alpha1.MultiClusterSecret) (controllerutil.OperationResult, error) {
    67  	var mcSecretNew clustersv1alpha1.MultiClusterSecret
    68  	mcSecretNew.Namespace = mcSecret.Namespace
    69  	mcSecretNew.Name = mcSecret.Name
    70  
    71  	// Create or update on the local cluster
    72  	return controllerutil.CreateOrUpdate(s.Context, s.LocalClient, &mcSecretNew, func() error {
    73  		mutateMCSecret(mcSecret, &mcSecretNew)
    74  		return nil
    75  	})
    76  }
    77  
    78  func (s *Syncer) updateMultiClusterSecretStatus(name types.NamespacedName, newCond clustersv1alpha1.Condition, newClusterStatus clustersv1alpha1.ClusterLevelStatus) error {
    79  	fetched := clustersv1alpha1.MultiClusterSecret{}
    80  	err := s.AdminClient.Get(s.Context, name, &fetched)
    81  	if err != nil {
    82  		return err
    83  	}
    84  	fetched.Status.Conditions = append(fetched.Status.Conditions, newCond)
    85  	clusters.SetClusterLevelStatus(&fetched.Status, newClusterStatus)
    86  	return s.AdminClient.Status().Update(s.Context, &fetched)
    87  }
    88  
    89  // mutateMCSecret mutates the MultiClusterSecret to reflect the contents of the parent MultiClusterSecret
    90  func mutateMCSecret(mcSecret clustersv1alpha1.MultiClusterSecret, mcSecretNew *clustersv1alpha1.MultiClusterSecret) {
    91  	mcSecretNew.Spec.Placement = mcSecret.Spec.Placement
    92  	mcSecretNew.Spec.Template = mcSecret.Spec.Template
    93  	mcSecretNew.Labels = mcSecret.Labels
    94  }
    95  
    96  // secretPlacedOnCluster returns boolean indicating if the list contains the object with the specified name and namespace
    97  // and indicates the object is placed on the local cluster
    98  func (s *Syncer) secretPlacedOnCluster(mcAdminList *clustersv1alpha1.MultiClusterSecretList, name string, namespace string) bool {
    99  	for _, item := range mcAdminList.Items {
   100  		if item.Name == name && item.Namespace == namespace {
   101  			return s.isThisCluster(item.Spec.Placement)
   102  		}
   103  	}
   104  	return false
   105  }