knative.dev/pkg@v0.0.0-20260602142205-ac97e43f6622/client/injection/kube/reconciler/networking/v1/networkpolicy/reconciler.go

/*
Copyright 2022 The Knative Authors

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

// Code generated by injection-gen. DO NOT EDIT.

package networkpolicy

import (
	context "context"
	json "encoding/json"
	fmt "fmt"

	zap "go.uber.org/zap"
	corev1 "k8s.io/api/core/v1"
	v1 "k8s.io/api/networking/v1"
	errors "k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	labels "k8s.io/apimachinery/pkg/labels"
	types "k8s.io/apimachinery/pkg/types"
	sets "k8s.io/apimachinery/pkg/util/sets"
	kubernetes "k8s.io/client-go/kubernetes"
	scheme "k8s.io/client-go/kubernetes/scheme"
	networkingv1 "k8s.io/client-go/listers/networking/v1"
	record "k8s.io/client-go/tools/record"
	controller "knative.dev/pkg/controller"
	logging "knative.dev/pkg/logging"
	reconciler "knative.dev/pkg/reconciler"
)

// Interface defines the strongly typed interfaces to be implemented by a
// controller reconciling v1.NetworkPolicy.
type Interface interface {
	// ReconcileKind implements custom logic to reconcile v1.NetworkPolicy. Any changes
	// to the objects .Status or .Finalizers will be propagated to the stored
	// object. It is recommended that implementors do not call any update calls
	// for the Kind inside of ReconcileKind, it is the responsibility of the calling
	// controller to propagate those properties. The resource passed to ReconcileKind
	// will always have an empty deletion timestamp.
	ReconcileKind(ctx context.Context, o *v1.NetworkPolicy) reconciler.Event
}

// Finalizer defines the strongly typed interfaces to be implemented by a
// controller finalizing v1.NetworkPolicy.
type Finalizer interface {
	// FinalizeKind implements custom logic to finalize v1.NetworkPolicy. Any changes
	// to the objects .Status or .Finalizers will be ignored. Returning a nil or
	// Normal type reconciler.Event will allow the finalizer to be deleted on
	// the resource. The resource passed to FinalizeKind will always have a set
	// deletion timestamp.
	FinalizeKind(ctx context.Context, o *v1.NetworkPolicy) reconciler.Event
}

// ReadOnlyInterface defines the strongly typed interfaces to be implemented by a
// controller reconciling v1.NetworkPolicy if they want to process resources for which
// they are not the leader.
type ReadOnlyInterface interface {
	// ObserveKind implements logic to observe v1.NetworkPolicy.
	// This method should not write to the API.
	ObserveKind(ctx context.Context, o *v1.NetworkPolicy) reconciler.Event
}

type doReconcile func(ctx context.Context, o *v1.NetworkPolicy) reconciler.Event

// reconcilerImpl implements controller.Reconciler for v1.NetworkPolicy resources.
type reconcilerImpl struct {
	// LeaderAwareFuncs is inlined to help us implement reconciler.LeaderAware.
	reconciler.LeaderAwareFuncs

	// Client is used to write back status updates.
	Client kubernetes.Interface

	// Listers index properties about resources.
	Lister networkingv1.NetworkPolicyLister

	// Recorder is an event recorder for recording Event resources to the
	// Kubernetes API.
	Recorder record.EventRecorder

	// configStore allows for decorating a context with config maps.
	// +optional
	configStore reconciler.ConfigStore

	// reconciler is the implementation of the business logic of the resource.
	reconciler Interface

	// finalizerName is the name of the finalizer to reconcile.
	finalizerName string

	// useServerSideApplyForFinalizers configures whether to use server-side apply for finalizer management
	useServerSideApplyForFinalizers bool

	// finalizerFieldManager is the field manager name for server-side apply of finalizers
	finalizerFieldManager string

	// forceApplyFinalizers configures whether to force server-side apply for finalizers
	forceApplyFinalizers bool
}

// Check that our Reconciler implements controller.Reconciler.
var _ controller.Reconciler = (*reconcilerImpl)(nil)

// Check that our generated Reconciler is always LeaderAware.
var _ reconciler.LeaderAware = (*reconcilerImpl)(nil)

func NewReconciler(ctx context.Context, logger *zap.SugaredLogger, client kubernetes.Interface, lister networkingv1.NetworkPolicyLister, recorder record.EventRecorder, r Interface, options ...controller.Options) controller.Reconciler {
	// Check the options function input. It should be 0 or 1.
	if len(options) > 1 {
		logger.Fatal("Up to one options struct is supported, found: ", len(options))
	}

	// Fail fast when users inadvertently implement the other LeaderAware interface.
	// For the typed reconcilers, Promote shouldn't take any arguments.
	if _, ok := r.(reconciler.LeaderAware); ok {
		logger.Fatalf("%T implements the incorrect LeaderAware interface. Promote() should not take an argument as genreconciler handles the enqueuing automatically.", r)
	}

	rec := &reconcilerImpl{
		LeaderAwareFuncs: reconciler.LeaderAwareFuncs{
			PromoteFunc: func(bkt reconciler.Bucket, enq func(reconciler.Bucket, types.NamespacedName)) error {
				all, err := lister.List(labels.Everything())
				if err != nil {
					return err
				}
				for _, elt := range all {
					// TODO: Consider letting users specify a filter in options.
					enq(bkt, types.NamespacedName{
						Namespace: elt.GetNamespace(),
						Name:      elt.GetName(),
					})
				}
				return nil
			},
		},
		Client:        client,
		Lister:        lister,
		Recorder:      recorder,
		reconciler:    r,
		finalizerName: defaultFinalizerName,
	}

	for _, opts := range options {
		if opts.ConfigStore != nil {
			rec.configStore = opts.ConfigStore
		}
		if opts.FinalizerName != "" {
			rec.finalizerName = opts.FinalizerName
		}
		if opts.DemoteFunc != nil {
			rec.DemoteFunc = opts.DemoteFunc
		}
		if opts.UseServerSideApplyForFinalizers {
			if opts.FinalizerFieldManager == "" {
				logger.Fatal("FinalizerFieldManager must be provided when UseServerSideApplyForFinalizers is enabled")
			}
			rec.useServerSideApplyForFinalizers = true
			rec.finalizerFieldManager = opts.FinalizerFieldManager
			rec.forceApplyFinalizers = opts.ForceApplyFinalizers
		}
	}

	return rec
}

// Reconcile implements controller.Reconciler
func (r *reconcilerImpl) Reconcile(ctx context.Context, key string) error {
	logger := logging.FromContext(ctx)

	// Initialize the reconciler state. This will convert the namespace/name
	// string into a distinct namespace and name, determine if this instance of
	// the reconciler is the leader, and any additional interfaces implemented
	// by the reconciler. Returns an error is the resource key is invalid.
	s, err := newState(key, r)
	if err != nil {
		logger.Error("Invalid resource key: ", key)
		return nil
	}

	// If we are not the leader, and we don't implement either ReadOnly
	// observer interfaces, then take a fast-path out.
	if s.isNotLeaderNorObserver() {
		return controller.NewSkipKey(key)
	}

	// If configStore is set, attach the frozen configuration to the context.
	if r.configStore != nil {
		ctx = r.configStore.ToContext(ctx)
	}

	// Add the recorder to context.
	ctx = controller.WithEventRecorder(ctx, r.Recorder)

	// Get the resource with this namespace/name.

	getter := r.Lister.NetworkPolicies(s.namespace)

	original, err := getter.Get(s.name)

	if errors.IsNotFound(err) {
		// The resource may no longer exist, in which case we stop processing and call
		// the ObserveDeletion handler if appropriate.
		logger.Debugf("Resource %q no longer exists", key)
		if del, ok := r.reconciler.(reconciler.OnDeletionInterface); ok {
			return del.ObserveDeletion(ctx, types.NamespacedName{
				Namespace: s.namespace,
				Name:      s.name,
			})
		}
		return nil
	} else if err != nil {
		return err
	}

	// Don't modify the informers copy.
	resource := original.DeepCopy()

	var reconcileEvent reconciler.Event

	name, do := s.reconcileMethodFor(resource)
	// Append the target method to the logger.
	logger = logger.With(zap.String("targetMethod", name))
	switch name {
	case reconciler.DoReconcileKind:
		// Set and update the finalizer on resource if r.reconciler
		// implements Finalizer.
		if resource, err = r.setFinalizerIfFinalizer(ctx, resource); err != nil {
			return fmt.Errorf("failed to set finalizers: %w", err)
		}

		// Reconcile this copy of the resource and then write back any status
		// updates regardless of whether the reconciliation errored out.
		reconcileEvent = do(ctx, resource)

	case reconciler.DoFinalizeKind:
		// For finalizing reconcilers, if this resource being marked for deletion
		// and reconciled cleanly (nil or normal event), remove the finalizer.
		reconcileEvent = do(ctx, resource)

		if resource, err = r.clearFinalizer(ctx, resource, reconcileEvent); err != nil {
			return fmt.Errorf("failed to clear finalizers: %w", err)
		}

	case reconciler.DoObserveKind:
		// Observe any changes to this resource, since we are not the leader.
		reconcileEvent = do(ctx, resource)

	}

	// Report the reconciler event, if any.
	if reconcileEvent != nil {
		var event *reconciler.ReconcilerEvent
		if reconciler.EventAs(reconcileEvent, &event) {
			logger.Infow("Returned an event", zap.Any("event", reconcileEvent))
			r.Recorder.Event(resource, event.EventType, event.Reason, event.Error())

			// the event was wrapped inside an error, consider the reconciliation as failed
			if _, isEvent := reconcileEvent.(*reconciler.ReconcilerEvent); !isEvent {
				return reconcileEvent
			}
			return nil
		}

		if controller.IsSkipKey(reconcileEvent) {
			// This is a wrapped error, don't emit an event.
		} else if ok, _ := controller.IsRequeueKey(reconcileEvent); ok {
			// This is a wrapped error, don't emit an event.
		} else {
			logger.Errorw("Returned an error", zap.Error(reconcileEvent))
			r.Recorder.Event(resource, corev1.EventTypeWarning, "InternalError", reconcileEvent.Error())
		}
		return reconcileEvent
	}

	return nil
}

// updateFinalizersFiltered will update the Finalizers of the resource.
// TODO: this method could be generic and sync all finalizers. For now it only
// updates defaultFinalizerName or its override.
func (r *reconcilerImpl) updateFinalizersFiltered(ctx context.Context, resource *v1.NetworkPolicy, desiredFinalizers sets.Set[string]) (*v1.NetworkPolicy, error) {
	if r.useServerSideApplyForFinalizers {
		return r.updateFinalizersFilteredServerSideApply(ctx, resource, desiredFinalizers)
	}
	return r.updateFinalizersFilteredMergePatch(ctx, resource, desiredFinalizers)
}

// updateFinalizersFilteredServerSideApply uses server-side apply to manage only this controller's finalizer.
func (r *reconcilerImpl) updateFinalizersFilteredServerSideApply(ctx context.Context, resource *v1.NetworkPolicy, desiredFinalizers sets.Set[string]) (*v1.NetworkPolicy, error) {
	// Check if we need to do anything
	existingFinalizers := sets.New[string](resource.Finalizers...)

	var finalizers []string
	if desiredFinalizers.Has(r.finalizerName) {
		if existingFinalizers.Has(r.finalizerName) {
			// Nothing to do.
			return resource, nil
		}
		// Apply configuration with only our finalizer to add it.
		finalizers = []string{r.finalizerName}
	} else {
		if !existingFinalizers.Has(r.finalizerName) {
			// Nothing to do.
			return resource, nil
		}
		// For removal, we apply an empty configuration for our finalizer field manager.
		// This effectively removes our finalizer while preserving others.
		finalizers = []string{} // Empty array removes our managed finalizers
	}

	// Determine GVK
	gvks, _, err := scheme.Scheme.ObjectKinds(resource)
	if err != nil || len(gvks) == 0 {
		return resource, fmt.Errorf("failed to determine GVK for resource: %w", err)
	}
	gvk := gvks[0]

	// Create apply configuration
	applyConfig := map[string]interface{}{
		"apiVersion": gvk.GroupVersion().String(),
		"kind":       gvk.Kind,
		"metadata": map[string]interface{}{
			"name":       resource.Name,
			"uid":        resource.UID,
			"finalizers": finalizers,
		},
	}

	applyConfig["metadata"].(map[string]interface{})["namespace"] = resource.Namespace

	patch, err := json.Marshal(applyConfig)
	if err != nil {
		return resource, err
	}

	patcher := r.Client.NetworkingV1().NetworkPolicies(resource.Namespace)

	patchOpts := metav1.PatchOptions{
		FieldManager: r.finalizerFieldManager,
		Force:        &r.forceApplyFinalizers,
	}

	updated, err := patcher.Patch(ctx, resource.Name, types.ApplyPatchType, patch, patchOpts)
	if err != nil {
		r.Recorder.Eventf(resource, corev1.EventTypeWarning, "FinalizerUpdateFailed",
			"Failed to update finalizers for %q via server-side apply: %v", resource.Name, err)
	} else {
		r.Recorder.Eventf(updated, corev1.EventTypeNormal, "FinalizerUpdate",
			"Updated finalizers for %q via server-side apply", resource.GetName())
	}
	return updated, err
}

// updateFinalizersFilteredMergePatch uses merge patch to manage finalizers (legacy behavior).
func (r *reconcilerImpl) updateFinalizersFilteredMergePatch(ctx context.Context, resource *v1.NetworkPolicy, desiredFinalizers sets.Set[string]) (*v1.NetworkPolicy, error) {
	// Don't modify the informers copy.
	existing := resource.DeepCopy()

	var finalizers []string

	// If there's nothing to update, just return.
	existingFinalizers := sets.New[string](existing.Finalizers...)

	if desiredFinalizers.Has(r.finalizerName) {
		if existingFinalizers.Has(r.finalizerName) {
			// Nothing to do.
			return resource, nil
		}
		// Add the finalizer.
		finalizers = append(existing.Finalizers, r.finalizerName)
	} else {
		if !existingFinalizers.Has(r.finalizerName) {
			// Nothing to do.
			return resource, nil
		}
		// Remove the finalizer.
		existingFinalizers.Delete(r.finalizerName)
		finalizers = sets.List(existingFinalizers)
	}

	mergePatch := map[string]interface{}{
		"metadata": map[string]interface{}{
			"finalizers":      finalizers,
			"resourceVersion": existing.ResourceVersion,
		},
	}

	patch, err := json.Marshal(mergePatch)
	if err != nil {
		return resource, err
	}

	patcher := r.Client.NetworkingV1().NetworkPolicies(resource.Namespace)

	resourceName := resource.Name
	updated, err := patcher.Patch(ctx, resourceName, types.MergePatchType, patch, metav1.PatchOptions{})
	if err != nil {
		r.Recorder.Eventf(existing, corev1.EventTypeWarning, "FinalizerUpdateFailed",
			"Failed to update finalizers for %q: %v", resourceName, err)
	} else {
		r.Recorder.Eventf(updated, corev1.EventTypeNormal, "FinalizerUpdate",
			"Updated %q finalizers", resource.GetName())
	}
	return updated, err
}

func (r *reconcilerImpl) setFinalizerIfFinalizer(ctx context.Context, resource *v1.NetworkPolicy) (*v1.NetworkPolicy, error) {
	if _, ok := r.reconciler.(Finalizer); !ok {
		return resource, nil
	}

	finalizers := sets.New[string](resource.Finalizers...)

	// If this resource is not being deleted, mark the finalizer.
	if resource.GetDeletionTimestamp().IsZero() {
		finalizers.Insert(r.finalizerName)
	}

	// Synchronize the finalizers filtered by r.finalizerName.
	return r.updateFinalizersFiltered(ctx, resource, finalizers)
}

func (r *reconcilerImpl) clearFinalizer(ctx context.Context, resource *v1.NetworkPolicy, reconcileEvent reconciler.Event) (*v1.NetworkPolicy, error) {
	if _, ok := r.reconciler.(Finalizer); !ok {
		return resource, nil
	}
	if resource.GetDeletionTimestamp().IsZero() {
		return resource, nil
	}

	finalizers := sets.New[string](resource.Finalizers...)

	if reconcileEvent != nil {
		var event *reconciler.ReconcilerEvent
		if reconciler.EventAs(reconcileEvent, &event) {
			if event.EventType == corev1.EventTypeNormal {
				finalizers.Delete(r.finalizerName)
			}
		}
	} else {
		finalizers.Delete(r.finalizerName)
	}

	// Synchronize the finalizers filtered by r.finalizerName.
	updated, err := r.updateFinalizersFiltered(ctx, resource, finalizers)
	if err != nil {
		// Check if the resource still exists by querying the API server to avoid logging errors
		// when reconciling stale object from cache while the object is actually deleted.
		logger := logging.FromContext(ctx)

		getter := r.Client.NetworkingV1().NetworkPolicies(resource.Namespace)

		_, getErr := getter.Get(ctx, resource.Name, metav1.GetOptions{})
		if errors.IsNotFound(getErr) {
			// Resource no longer exists, which could happen during deletion
			logger.Debugw("Resource no longer exists while clearing finalizers",
				"resource", resource.GetName(),
				"namespace", resource.GetNamespace(),
				"originalError", err)
			// Return the original resource since the finalizer clearing is effectively complete
			return resource, nil
		}

		// For other errors, return the original error
		return updated, err
	}

	return updated, nil
}