github.com/verrazzano/verrazzano@v1.7.1/tools/oam-converter/pkg/resources/gateway/gateway.go

// Copyright (c) 2023, Oracle and/or its affiliates.
// Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.

package gateway

import (
	"fmt"
	certapiv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
	certv1 "github.com/cert-manager/cert-manager/pkg/apis/meta/v1"
	vzapi "github.com/verrazzano/verrazzano/application-operator/apis/oam/v1alpha1"
	coallateHosts "github.com/verrazzano/verrazzano/pkg/ingresstrait"
	consts "github.com/verrazzano/verrazzano/tools/oam-converter/pkg/constants"
	"github.com/verrazzano/verrazzano/tools/oam-converter/pkg/types"
	istio "istio.io/api/networking/v1beta1"
	vsapi "istio.io/client-go/pkg/apis/networking/v1beta1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

	"sigs.k8s.io/controller-runtime/pkg/client"
)

// The function createGatewayCertificate generates a certificate that the cert manager can use to generate a certificate
// that is embedded in a secret. The gateway will use the secret to offer TLS/HTTPS endpoints for installed applications.
// Each application will generate a single gateway.
func createGatewayCertificate(trait *vzapi.IngressTrait, hostsForTrait []string, appNamespace string) string {

	certName := buildCertificateName(trait, appNamespace)
	secretName := buildCertificateSecretName(trait, appNamespace)

	certificate := &certapiv1.Certificate{
		TypeMeta: metav1.TypeMeta{
			Kind:       "Certificate",
			APIVersion: consts.CertificateAPIVersion,
		},
		ObjectMeta: metav1.ObjectMeta{
			Namespace: "istio-system",
			Name:      certName,
		}}
	certificate.Spec = certapiv1.CertificateSpec{
		DNSNames:   hostsForTrait,
		SecretName: secretName,
		IssuerRef: certv1.ObjectReference{
			Name: consts.VerrazzanoClusterIssuer,
			Kind: "ClusterIssuer",
		},
	}

	return secretName
}

// buildCertificateSecretName get a cert secret name from the trait appending namespace name with trait name
func buildCertificateSecretName(trait *vzapi.IngressTrait, appNamespace string) string {
	return fmt.Sprintf("%s-%s-cert-secret", appNamespace, trait.Name)
}

// buildCertificateName get a cert name from the trait appending namespace name with trait name
func buildCertificateName(trait *vzapi.IngressTrait, appNamespace string) string {
	return fmt.Sprintf("%s-%s-cert", appNamespace, trait.Name)
}

// buildLegacyCertificateName will generate a cert name
func buildLegacyCertificateName(trait *vzapi.IngressTrait, appNamespace string, appName string) string {
	return fmt.Sprintf("%s-%s-cert", appNamespace, trait.Name)
}

// buildLegacyCertificateSecretName will generate a cert secret name
func buildLegacyCertificateSecretName(trait *vzapi.IngressTrait, appNamespace string, appName string) string {
	return fmt.Sprintf("%s-%s-cert-secret", appNamespace, trait.Name)
}

// validateConfiguredSecret ensures that a secret is specified and the trait rules specify a "hosts" setting.  The
// specification of a secret implies that a certificate was created for specific hosts that differ than the host names
// generated by the runtime (when no hosts are specified).
func validateConfiguredSecret(trait *vzapi.IngressTrait) string {
	secretName := trait.Spec.TLS.SecretName
	return secretName
}

// BuildGatewayName will generate a gateway name from the namespace and application name of the provided trait. Returns
func BuildGatewayName(appNamespace string) (string, error) {

	gwName := fmt.Sprintf("%s-%s-gw", appNamespace, appNamespace)

	return gwName, nil
}

// formatGatewayServerPortName will generate a sever port name by appending https with trait name
func formatGatewayServerPortName(traitName string) string {
	return fmt.Sprintf("https-%s", traitName)
}

// updateGatewayServersList Update/add the Server entry for the IngressTrait to the gateway servers list
// Each gateway server entry has a TLS field for the certificate.  This corresponds to the IngressTrait TLS field.
func updateGatewayServersList(servers []*istio.Server, server *istio.Server) []*istio.Server {
	if len(servers) == 0 {
		servers = append(servers, server)
		return servers
	}
	if len(servers) == 1 && len(servers[0].Name) == 0 && servers[0].Port.Name == "https" {

		// - replace the empty name server with the named one
		servers[0] = server

		return servers
	}
	for index, existingServer := range servers {
		if existingServer.Name == server.Name {

			servers[index] = server
			return servers
		}
	}
	servers = append(servers, server)
	return servers
}

func CreateGatewayResource(cli client.Client, conversionComponents []*types.ConversionComponents) (*vsapi.Gateway, []string, error) {
	gateway, allHostsForTrait, err := CreateCertificateAndSecretGateway(cli, conversionComponents)

	if err != nil {
		return nil, nil, err
	}

	return gateway, allHostsForTrait, nil

}

func CreateCertificateAndSecretGateway(cli client.Client, conversionComponents []*types.ConversionComponents) (*vsapi.Gateway, []string, error) {

	var gateway *vsapi.Gateway
	var allHostsForTrait []string
	var err error
	for _, conversionComponent := range conversionComponents {

		allHostsForTrait, err = coallateHosts.CoallateAllHostsForTrait(cli, conversionComponent.IngressTrait, conversionComponent.AppName, conversionComponent.AppNamespace)
		if err != nil {
			return nil, nil, err

		}

	}
	secretNames := CreateGatewaySecret(conversionComponents, allHostsForTrait)
	if len(secretNames) == len(conversionComponents) && secretNames != nil {
		gwName, err := BuildGatewayName(conversionComponents[0].AppNamespace)
		if err != nil {

			return nil, nil, err

		}
		gateway, err = CreateGateway(conversionComponents, allHostsForTrait, gwName, secretNames)
		if err != nil {

			return nil, nil, err

		}
	}
	return gateway, allHostsForTrait, nil
}
func CreateGatewaySecret(conversionComponents []*types.ConversionComponents, hostsForTrait []string) []string {
	var secrets []string
	for _, conversionComponent := range conversionComponents {
		var secretName string
		if conversionComponent.IngressTrait.Spec.TLS != (vzapi.IngressSecurity{}) {
			secretName = validateConfiguredSecret(conversionComponent.IngressTrait)
		} else {

			buildLegacyCertificateName(conversionComponent.IngressTrait, conversionComponent.AppNamespace, conversionComponent.AppName)
			buildLegacyCertificateSecretName(conversionComponent.IngressTrait, conversionComponent.AppNamespace, conversionComponent.AppName)
			secretName = createGatewayCertificate(conversionComponent.IngressTrait, hostsForTrait, conversionComponent.AppNamespace)

		}
		secrets = append(secrets, secretName)
	}

	return secrets
}

// CreateGateway creates the Gateway child resource of the trait.
func CreateGateway(conversionComponents []*types.ConversionComponents, hostsForTrait []string, gwName string, secretNames []string) (*vsapi.Gateway, error) {
	// Create a gateway populating only gwName metadata.
	// This is used as default if the gateway needs to be created.
	gateway := &vsapi.Gateway{
		TypeMeta: metav1.TypeMeta{
			APIVersion: consts.GatewayAPIVersion,
			Kind:       "Gateway"},
		ObjectMeta: metav1.ObjectMeta{
			Namespace: conversionComponents[0].AppNamespace,
			Name:      gwName}}

	var err error
	gateway, err = mutateGateway(conversionComponents, gateway, hostsForTrait, secretNames)
	if err != nil {
		return nil, err
	}

	return gateway, nil
}

// mutate Gateway mutates or changes gateway according to the trait configuration
func mutateGateway(conversionComponents []*types.ConversionComponents, gateway *vsapi.Gateway, hostsForTrait []string, secretNames []string) (*vsapi.Gateway, error) {
	for i := range conversionComponents {
		// perform an operation
		server := &istio.Server{
			Name:  conversionComponents[i].IngressTrait.Name,
			Hosts: hostsForTrait,
			Port: &istio.Port{
				Name:     formatGatewayServerPortName(conversionComponents[i].IngressTrait.Name),
				Number:   443,
				Protocol: consts.HTTPSProtocol,
			},
			Tls: &istio.ServerTLSSettings{
				Mode:           istio.ServerTLSSettings_SIMPLE,
				CredentialName: secretNames[i],
			},
		}
		gateway.Spec.Servers = updateGatewayServersList(gateway.Spec.Servers, server)
	}
	gateway.Spec.Selector = map[string]string{"istio": "ingressgateway"}
	return gateway, nil
}

// CreateListGateway Create a list of gateways
func CreateListGateway(gateway *vsapi.Gateway) (map[string]interface{}, error) {
	gatewayData := make(map[string]interface{})
	gatewayData["apiVersion"] = "v1"
	gatewayData["items"] = []*vsapi.Gateway{gateway}
	gatewayData["kind"] = "List"
	gatewayData["metadata"] = struct {
		ResourceVersion string `yaml:"resourceVersion"`
	}{ResourceVersion: ""}

	return gatewayData, nil
}