github.com/zppinho/prow@v0.0.0-20240510014325-1738badeb017/pkg/plugins/updateconfig/updateconfig.go

/*
Copyright 2017 The Kubernetes Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package updateconfig

import (
	"bytes"
	"compress/gzip"
	"context"
	"crypto/sha256"
	"fmt"
	"os"
	"path"
	"path/filepath"
	"strings"
	"unicode/utf8"

	"github.com/mattn/go-zglob"
	"github.com/prometheus/client_golang/prometheus"
	"github.com/sirupsen/logrus"
	coreapi "k8s.io/api/core/v1"
	"k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	utilerrors "k8s.io/apimachinery/pkg/util/errors"
	"k8s.io/apimachinery/pkg/util/sets"
	corev1 "k8s.io/client-go/kubernetes/typed/core/v1"

	"sigs.k8s.io/prow/pkg/config"
	"sigs.k8s.io/prow/pkg/git/v2"
	"sigs.k8s.io/prow/pkg/github"
	"sigs.k8s.io/prow/pkg/kube"
	"sigs.k8s.io/prow/pkg/pluginhelp"
	"sigs.k8s.io/prow/pkg/plugins"
)

const (
	pluginName    = "config-updater"
	bootstrapMode = false
)

func init() {
	plugins.RegisterPullRequestHandler(pluginName, handlePullRequest, helpProvider)
}

func helpProvider(config *plugins.Configuration, enabledRepos []config.OrgRepo) (*pluginhelp.PluginHelp, error) {
	var configInfo map[string]string
	if len(enabledRepos) == 1 {
		msg := ""
		for configFileName, configMapSpec := range config.ConfigUpdater.Maps {
			msg = msg + fmt.Sprintf(
				"Files matching %s/%s are used to populate the %s ConfigMap in ",
				enabledRepos[0],
				configFileName,
				configMapSpec.Name,
			)
		}
		configInfo = map[string]string{"": msg}
	}
	return &pluginhelp.PluginHelp{
			Description: "The config-updater plugin automatically redeploys configuration and plugin configuration files when they change. The plugin watches for pull request merges that modify either of the config files and updates the cluster's configmap resources in response.",
			Config:      configInfo,
		},
		nil
}

type githubClient interface {
	CreateComment(owner, repo string, number int, comment string) error
	GetPullRequestChanges(org, repo string, number int) ([]github.PullRequestChange, error)
}

func handlePullRequest(pc plugins.Agent, pre github.PullRequestEvent) error {
	return handle(pc.GitHubClient, pc.GitClient, pc.KubernetesClient.CoreV1(), pc.BuildClusterCoreV1Clients, pc.Config.ProwJobNamespace, pc.Logger, pre, pc.PluginConfig.ConfigUpdater, pc.Metrics.ConfigMapGauges)
}

// FileGetter knows how to get the contents of a file by name
type FileGetter interface {
	GetFile(filename string) ([]byte, error)
}

type OSFileGetter struct {
	Root string
}

func (g *OSFileGetter) GetFile(filename string) ([]byte, error) {
	return os.ReadFile(filepath.Join(g.Root, filename))
}

// Update updates the configmap with the data from the identified files.
// Existing configmap keys that are not included in the updates are left alone
// unless bootstrap is true in which case they are deleted.
func Update(fg FileGetter, kc corev1.ConfigMapInterface, name, namespace string, updates []ConfigMapUpdate, bootstrap bool, metrics *prometheus.GaugeVec, logger *logrus.Entry, sha string) error {
	cm, getErr := kc.Get(context.TODO(), name, metav1.GetOptions{})
	isNotFound := errors.IsNotFound(getErr)
	if getErr != nil && !isNotFound {
		return fmt.Errorf("failed to fetch current state of configmap: %w", getErr)
	}

	labels := map[string]string{
		"app.kubernetes.io/name":      "prow",
		"app.kubernetes.io/component": "updateconfig-plugin",
	}

	// For bootstrap mode, if the existing ConfigMap has any keys, make note of
	// all the keys that we won't be updating in "updates" (let's call them
	// "stale" keys), and mark them for deletion. This is because in
	// bootstrap mode, the updates that we do see are considered to be the
	// *only* keys that we want. So if there are any other keys that exist which
	// do not get updated, they shouldn't exist. So delete them.
	//
	// As an additional safety measure, only mark stale keys for deletion if
	// we had some number of updates to perform. This is to guard against cases
	// where we accidentally get 0 updates and would end up marking all existing
	// keys for deletion (bad idea). This could happen if for
	// config-bootstrapper (which uses this library) if it was executed against
	// the wrong local directory and could not find any files to generate any
	// updates for a ConfigMap.
	if bootstrap && len(updates) > 0 {
		keysToDelete := MarkStaleKeysForDeletion(cm, updates)
		for _, upd := range keysToDelete {
			logger.WithField("key", upd.Key).Info("queueing for deletion")
		}
		updates = append(updates, keysToDelete...)
	}

	if cm == nil || isNotFound {
		cm = &coreapi.ConfigMap{
			ObjectMeta: metav1.ObjectMeta{
				Name:      name,
				Namespace: namespace,
				Labels:    labels,
			},
		}
	}

	if cm.ObjectMeta.Labels == nil {
		cm.ObjectMeta.Labels = labels
	}

	if cm.Data == nil || bootstrap {
		cm.Data = map[string]string{}
	}
	if sha != "" {
		cm.Data[config.ConfigVersionFileName] = sha
	}
	if cm.BinaryData == nil || bootstrap {
		cm.BinaryData = map[string][]byte{}
	}

	for _, upd := range updates {
		if upd.Filename == "" {
			logger.WithField("key", upd.Key).Debug("Deleting key.")
			delete(cm.Data, upd.Key)
			delete(cm.BinaryData, upd.Key)
			continue
		}

		content, err := fg.GetFile(upd.Filename)
		if err != nil {
			return fmt.Errorf("get file err: %w", err)
		}
		logger.WithFields(logrus.Fields{"key": upd.Key, "filename": upd.Filename}).Debug("Populating key.")
		value := content
		if upd.GZIP {
			buff := bytes.NewBuffer([]byte{})
			// TODO: this error is wildly unlikely for anything that
			// would actually fit in a configmap, we could just as well return
			// the error instead of falling back to the raw content
			z := gzip.NewWriter(buff)
			if _, err := z.Write(content); err != nil {
				logger.WithError(err).Error("failed to gzip content, falling back to raw")
			} else {
				if err := z.Close(); err != nil {
					logger.WithError(err).Error("failed to flush gzipped content (!?), falling back to raw")
				} else {
					value = buff.Bytes()
				}
			}
		}
		if utf8.ValidString(string(value)) {
			delete(cm.BinaryData, upd.Key)
			cm.Data[upd.Key] = string(value)
		} else {
			delete(cm.Data, upd.Key)
			cm.BinaryData[upd.Key] = value
		}
	}

	var updateErr error
	var verb string
	if getErr != nil && isNotFound {
		verb = "create"
		_, updateErr = kc.Create(context.TODO(), cm, metav1.CreateOptions{})
	} else {
		verb = "update"
		_, updateErr = kc.Update(context.TODO(), cm, metav1.UpdateOptions{})
	}
	if updateErr != nil {
		return fmt.Errorf("%s config map err: %w", verb, updateErr)
	}
	if metrics != nil {
		var size float64
		for _, data := range cm.Data {
			size += float64(len(data))
		}
		for _, data := range cm.BinaryData {
			size += float64(len(data))
		}
		// in a strict sense this can race to update the value with other goroutines
		// handling other events, but as events are serialized due to the fact that
		// merges are serial in repositories, this is effectively not an issue here
		metrics.WithLabelValues(cm.Name, cm.Namespace).Set(size)
	}
	return nil
}

// MarkStaledKeysForDeletion returns a slice of ConfigMapUpdate entries for keys
// that were missing from the updates, and which should be deleted. This only
// makes sense for bootstrap mode (for the config-bootstrapper).
func MarkStaleKeysForDeletion(
	configMap *coreapi.ConfigMap,
	updates []ConfigMapUpdate,
) []ConfigMapUpdate {

	// If there are no updates, then do nothing. This is just in case we pass in
	// an empty slice for "updates" by accident (we don't want to wipe the
	// ConfigMap entirely --- that is never the intent here).
	if len(updates) == 0 {
		return nil
	}

	// Likewise if configMap itself is empty, do nothing because there's nothing
	// to delete.
	if configMap == nil {
		return nil
	}

	updatedKeys := sets.New[string]()
	for _, upd := range updates {
		updatedKeys.Insert(upd.Key)
	}

	// Add deletion entries for stale keys there were missing from the updates.
	toDelete := []ConfigMapUpdate{}
	for key := range configMap.Data {
		if updatedKeys.Has(key) {
			continue
		}
		toDelete = append(toDelete, ConfigMapUpdate{Key: key})
	}

	for key := range configMap.BinaryData {
		if updatedKeys.Has(key) {
			continue
		}
		toDelete = append(toDelete, ConfigMapUpdate{Key: key})
	}

	return toDelete
}

// ConfigMapUpdate is populated with information about a config map that should
// be updated. If the Filename is missing, then this update means that the key
// should be deleted.
type ConfigMapUpdate struct {
	Key, Filename string
	GZIP          bool
}

// FilterChanges determines which of the changes are relevant for config updating, returning mapping of
// config map to key to filename to update that key from.
func FilterChanges(cfg plugins.ConfigUpdater, changes []github.PullRequestChange, defaultNamespace string, bootstrap bool, log *logrus.Entry) map[plugins.ConfigMapID][]ConfigMapUpdate {
	toUpdate := map[plugins.ConfigMapID][]ConfigMapUpdate{}

	// Keep track of partitioned ConfigMaps that may need to be updated when bootstrapping
	requireUpdate := map[plugins.ConfigMapID]bool{}
	haveUpdate := map[plugins.ConfigMapID]bool{}
	for _, change := range changes {
		var cm plugins.ConfigMapSpec
		found := false

		for key, configMap := range cfg.Maps {
			var matchErr error
			found, matchErr = zglob.Match(key, change.Filename)
			if matchErr != nil {
				// Should not happen, log matchErr and continue
				log.WithError(matchErr).Info("key matching error")
				continue
			}

			if found {
				cm = configMap
				break
			}
		}

		if !found {
			continue // This file does not define a configmap
		}

		// Yes, update the configmap with the contents of this file
		for cluster, namespaces := range cm.Clusters {
			for _, ns := range namespaces {
				idForKey := func(_ string) plugins.ConfigMapID {
					return plugins.ConfigMapID{Name: cm.Name, Namespace: ns, Cluster: cluster}
				}
				if len(cm.PartitionedNames) > 0 {
					idForKey = func(k string) plugins.ConfigMapID {
						// Choose a name from PartitionedNames based on 'k'.
						name := cm.PartitionedNames[int(sha256.Sum256([]byte(k))[0])%len(cm.PartitionedNames)]
						for _, pn := range cm.PartitionedNames {
							requireUpdate[plugins.ConfigMapID{Name: pn, Namespace: ns, Cluster: cluster}] = true
						}
						id := plugins.ConfigMapID{Name: name, Namespace: ns, Cluster: cluster}
						haveUpdate[id] = true
						return id
					}
				}
				key := cm.Key
				if key == "" {
					if cm.UseFullPathAsKey {
						key = strings.ReplaceAll(change.Filename, "/", "-")
					} else {
						key = path.Base(change.Filename)
					}
					// if the key changed, we need to remove the old key
					if change.Status == github.PullRequestFileRenamed {
						var oldKey string
						if cm.UseFullPathAsKey {
							oldKey = strings.ReplaceAll(change.PreviousFilename, "/", "-")
						} else {
							oldKey = path.Base(change.PreviousFilename)
						}
						// not setting the filename field will cause the key to be
						// deleted
						id := idForKey(oldKey)
						toUpdate[id] = append(toUpdate[id], ConfigMapUpdate{Key: oldKey})
					}
				}
				id := idForKey(key)
				if change.Status == github.PullRequestFileRemoved {
					toUpdate[id] = append(toUpdate[id], ConfigMapUpdate{Key: key})
				} else {
					gzip := cfg.GZIP
					if cm.GZIP != nil {
						gzip = *cm.GZIP
					}
					toUpdate[id] = append(toUpdate[id], ConfigMapUpdate{Key: key, Filename: change.Filename, GZIP: gzip})
				}
			}
		}
	}
	if bootstrap {
		// If we're in bootstrap mode and a partition is completely emptied we won't have any updates for it
		// so the 'Update' function won't be able to remove the unrecognized keys (all of them) since it
		// will never consider the ConfigMap. Removing an arbitrary key ensures `Update` processes this
		// ConfigMap and gets a chance to remove all the keys.
		for id := range requireUpdate {
			if !haveUpdate[id] {
				toUpdate[id] = append(toUpdate[id], ConfigMapUpdate{Key: ""})
			}
		}
	}
	return handleDefaultNamespace(toUpdate, defaultNamespace)
}

// handleDefaultNamespace ensures plugins.ConfigMapID.Namespace is not empty string
func handleDefaultNamespace(toUpdate map[plugins.ConfigMapID][]ConfigMapUpdate, defaultNamespace string) map[plugins.ConfigMapID][]ConfigMapUpdate {
	for cm, data := range toUpdate {
		if cm.Namespace == "" {
			key := plugins.ConfigMapID{Name: cm.Name, Namespace: defaultNamespace, Cluster: cm.Cluster}
			toUpdate[key] = append(toUpdate[key], data...)
			delete(toUpdate, cm)
		}
	}
	return toUpdate
}

func handle(gc githubClient, gitClient git.ClientFactory, kc corev1.ConfigMapsGetter, buildClusterCoreV1Clients map[string]corev1.CoreV1Interface, defaultNamespace string, log *logrus.Entry, pre github.PullRequestEvent, config plugins.ConfigUpdater, metrics *prometheus.GaugeVec) error {
	// Only consider newly merged PRs
	if pre.Action != github.PullRequestActionClosed {
		return nil
	}

	if len(config.Maps) == 0 { // Nothing to update
		return nil
	}

	pr := pre.PullRequest

	if !pr.Merged || pr.MergeSHA == nil || pr.Base.Repo.DefaultBranch != pr.Base.Ref {
		return nil
	}

	org := pr.Base.Repo.Owner.Login
	repo := pr.Base.Repo.Name

	// Which files changed in this PR?
	changes, err := gc.GetPullRequestChanges(org, repo, pr.Number)
	if err != nil {
		return err
	}

	message := func(name, cluster, namespace string, updates []ConfigMapUpdate, indent string) string {
		identifier := fmt.Sprintf("`%s` configmap", name)
		if namespace != "" {
			identifier = fmt.Sprintf("%s in namespace `%s`", identifier, namespace)
		}
		if cluster != "" {
			identifier = fmt.Sprintf("%s at cluster `%s`", identifier, cluster)
		}
		msg := fmt.Sprintf("%s using the following files:", identifier)
		for _, u := range updates {
			msg = fmt.Sprintf("%s\n%s- key `%s` using file `%s`", msg, indent, u.Key, u.Filename)
		}
		return msg
	}

	// Are any of the changes files ones that define a configmap we want to update?
	toUpdate := FilterChanges(config, changes, defaultNamespace, bootstrapMode, log)
	log.WithFields(logrus.Fields{
		"configmaps_to_update": len(toUpdate),
		"changes":              len(changes),
	}).Debug("Identified configmaps to update")

	var updated []string
	indent := " " // one space
	if len(toUpdate) > 1 {
		indent = "   " // three spaces for sub bullets
	}

	gitRepo, err := gitClient.ClientFor(org, repo)
	if err != nil {
		return err
	}
	defer func() {
		if err := gitRepo.Clean(); err != nil {
			log.WithError(err).Error("Could not clean up git repo cache.")
		}
	}()
	if err := gitRepo.Checkout(*pr.MergeSHA); err != nil {
		return err
	}

	var errs []error
	for cm, data := range toUpdate {
		logger := log.WithFields(logrus.Fields{"configmap": map[string]string{"name": cm.Name, "namespace": cm.Namespace, "cluster": cm.Cluster}})
		configMapClient, err := GetConfigMapClient(kc, cm.Namespace, buildClusterCoreV1Clients, cm.Cluster)
		if err != nil {
			log.WithError(err).Errorf("Failed to find configMap client")
			errs = append(errs, err)
			continue
		}
		if err := Update(&OSFileGetter{Root: gitRepo.Directory()}, configMapClient, cm.Name, cm.Namespace, data, bootstrapMode, metrics, logger, *pr.MergeSHA); err != nil {
			errs = append(errs, err)
			continue
		}
		updated = append(updated, message(cm.Name, cm.Cluster, cm.Namespace, data, indent))
	}

	var msg string
	switch n := len(updated); n {
	case 0:
		return utilerrors.NewAggregate(errs)
	case 1:
		msg = fmt.Sprintf("Updated the %s", updated[0])
	default:
		msg = fmt.Sprintf("Updated the following %d configmaps:\n", n)
		for _, updateMsg := range updated {
			msg += fmt.Sprintf(" * %s\n", updateMsg) // one space indent
		}
	}

	if err := gc.CreateComment(org, repo, pr.Number, plugins.FormatResponseRaw(pr.Body, pr.HTMLURL, pr.User.Login, msg)); err != nil {
		errs = append(errs, fmt.Errorf("comment err: %w", err))
	}
	return utilerrors.NewAggregate(errs)
}

// GetConfigMapClient returns a configMap interface according to the given cluster and namespace
func GetConfigMapClient(kc corev1.ConfigMapsGetter, namespace string, buildClusterCoreV1Clients map[string]corev1.CoreV1Interface, cluster string) (corev1.ConfigMapInterface, error) {
	configMapClient := kc.ConfigMaps(namespace)
	if cluster != kube.DefaultClusterAlias {
		if client, ok := buildClusterCoreV1Clients[cluster]; ok {
			configMapClient = client.ConfigMaps(namespace)
		} else {
			return nil, fmt.Errorf("no k8s client is found for build cluster: '%s'", cluster)
		}
	}
	return configMapClient, nil
}