diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json new file mode 100644 index 0000000..0e0eed2 --- /dev/null +++ b/.devcontainer/devcontainer.json @@ -0,0 +1,25 @@ +{ + "name": "Kubebuilder DevContainer", + "image": "docker.io/golang:1.23", + "features": { + "ghcr.io/devcontainers/features/docker-in-docker:2": {}, + "ghcr.io/devcontainers/features/git:1": {} + }, + + "runArgs": ["--network=host"], + + "customizations": { + "vscode": { + "settings": { + "terminal.integrated.shell.linux": "/bin/bash" + }, + "extensions": [ + "ms-kubernetes-tools.vscode-kubernetes-tools", + "ms-azuretools.vscode-docker" + ] + } + }, + + "onCreateCommand": "bash .devcontainer/post-install.sh" +} + diff --git a/.devcontainer/post-install.sh b/.devcontainer/post-install.sh new file mode 100644 index 0000000..265c43e --- /dev/null +++ b/.devcontainer/post-install.sh @@ -0,0 +1,23 @@ +#!/bin/bash +set -x + +curl -Lo ./kind https://kind.sigs.k8s.io/dl/latest/kind-linux-amd64 +chmod +x ./kind +mv ./kind /usr/local/bin/kind + +curl -L -o kubebuilder https://go.kubebuilder.io/dl/latest/linux/amd64 +chmod +x kubebuilder +mv kubebuilder /usr/local/bin/ + +KUBECTL_VERSION=$(curl -L -s https://dl.k8s.io/release/stable.txt) +curl -LO "https://dl.k8s.io/release/$KUBECTL_VERSION/bin/linux/amd64/kubectl" +chmod +x kubectl +mv kubectl /usr/local/bin/kubectl + +docker network create -d=bridge --subnet=172.19.0.0/24 kind + +kind version +kubebuilder version +docker --version +go version +kubectl version --client diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000..a3aab7a --- /dev/null +++ b/.dockerignore @@ -0,0 +1,3 @@ +# More info: https://docs.docker.com/engine/reference/builder/#dockerignore-file +# Ignore build and test binaries. +bin/ diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml new file mode 100644 index 0000000..4951e33 --- /dev/null +++ b/.github/workflows/lint.yml @@ -0,0 +1,23 @@ +name: Lint + +on: + push: + pull_request: + +jobs: + lint: + name: Run on Ubuntu + runs-on: ubuntu-latest + steps: + - name: Clone the code + uses: actions/checkout@v4 + + - name: Setup Go + uses: actions/setup-go@v5 + with: + go-version-file: go.mod + + - name: Run linter + uses: golangci/golangci-lint-action@v6 + with: + version: v1.63.4 diff --git a/.github/workflows/test-e2e.yml b/.github/workflows/test-e2e.yml new file mode 100644 index 0000000..b2eda8c --- /dev/null +++ b/.github/workflows/test-e2e.yml @@ -0,0 +1,35 @@ +name: E2E Tests + +on: + push: + pull_request: + +jobs: + test-e2e: + name: Run on Ubuntu + runs-on: ubuntu-latest + steps: + - name: Clone the code + uses: actions/checkout@v4 + + - name: Setup Go + uses: actions/setup-go@v5 + with: + go-version-file: go.mod + + - name: Install the latest version of kind + run: | + curl -Lo ./kind https://kind.sigs.k8s.io/dl/latest/kind-linux-amd64 + chmod +x ./kind + sudo mv ./kind /usr/local/bin/kind + + - name: Verify kind installation + run: kind version + + - name: Create kind cluster + run: kind create cluster + + - name: Running Test e2e + run: | + go mod tidy + make test-e2e diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml new file mode 100644 index 0000000..fc2e80d --- /dev/null +++ b/.github/workflows/test.yml @@ -0,0 +1,23 @@ +name: Tests + +on: + push: + pull_request: + +jobs: + test: + name: Run on Ubuntu + runs-on: ubuntu-latest + steps: + - name: Clone the code + uses: actions/checkout@v4 + + - name: Setup Go + uses: actions/setup-go@v5 + with: + go-version-file: go.mod + + - name: Running Tests + run: | + go mod tidy + make test diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..ada68ff --- /dev/null +++ b/.gitignore @@ -0,0 +1,27 @@ +# Binaries for programs and plugins +*.exe +*.exe~ +*.dll +*.so +*.dylib +bin/* +Dockerfile.cross + +# Test binary, built with `go test -c` +*.test + +# Output of the go coverage tool, specifically when used with LiteIDE +*.out + +# Go workspace file +go.work + +# Kubernetes Generated files - skip generated files, except for vendored files +!vendor/**/zz_generated.* + +# editor and IDE paraphernalia +.idea +.vscode +*.swp +*.swo +*~ diff --git a/.golangci.yml b/.golangci.yml new file mode 100644 index 0000000..6b29746 --- /dev/null +++ b/.golangci.yml @@ -0,0 +1,47 @@ +run: + timeout: 5m + allow-parallel-runners: true + +issues: + # don't skip warning about doc comments + # don't exclude the default set of lint + exclude-use-default: false + # restore some of the defaults + # (fill in the rest as needed) + exclude-rules: + - path: "api/*" + linters: + - lll + - path: "internal/*" + linters: + - dupl + - lll +linters: + disable-all: true + enable: + - dupl + - errcheck + - copyloopvar + - ginkgolinter + - goconst + - gocyclo + - gofmt + - goimports + - gosimple + - govet + - ineffassign + - lll + - misspell + - nakedret + - prealloc + - revive + - staticcheck + - typecheck + - unconvert + - unparam + - unused + +linters-settings: + revive: + rules: + - name: comment-spacings diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..348b837 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,33 @@ +# Build the manager binary +FROM docker.io/golang:1.23 AS builder +ARG TARGETOS +ARG TARGETARCH + +WORKDIR /workspace +# Copy the Go Modules manifests +COPY go.mod go.mod +COPY go.sum go.sum +# cache deps before building and copying source so that we don't need to re-download as much +# and so that source changes don't invalidate our downloaded layer +RUN go mod download + +# Copy the go source +COPY cmd/main.go cmd/main.go +COPY api/ api/ +COPY internal/ internal/ + +# Build +# the GOARCH has not a default value to allow the binary be built according to the host where the command +# was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO +# the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore, +# by leaving it empty we can ensure that the container and binary shipped on it will have the same platform. +RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager cmd/main.go + +# Use distroless as minimal base image to package the manager binary +# Refer to https://github.com/GoogleContainerTools/distroless for more details +FROM gcr.io/distroless/static:nonroot +WORKDIR / +COPY --from=builder /workspace/manager . +USER 65532:65532 + +ENTRYPOINT ["/manager"] diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..71e75f8 --- /dev/null +++ b/Makefile @@ -0,0 +1,225 @@ +# Image URL to use all building/pushing image targets +IMG ?= controller:latest + +# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set) +ifeq (,$(shell go env GOBIN)) +GOBIN=$(shell go env GOPATH)/bin +else +GOBIN=$(shell go env GOBIN) +endif + +# CONTAINER_TOOL defines the container tool to be used for building images. +# Be aware that the target commands are only tested with Docker which is +# scaffolded by default. However, you might want to replace it to use other +# tools. (i.e. podman) +CONTAINER_TOOL ?= docker + +# Setting SHELL to bash allows bash commands to be executed by recipes. +# Options are set to exit when a recipe line exits non-zero or a piped command fails. +SHELL = /usr/bin/env bash -o pipefail +.SHELLFLAGS = -ec + +.PHONY: all +all: build + +##@ General + +# The help target prints out all targets with their descriptions organized +# beneath their categories. The categories are represented by '##@' and the +# target descriptions by '##'. The awk command is responsible for reading the +# entire set of makefiles included in this invocation, looking for lines of the +# file as xyz: ## something, and then pretty-format the target and help. Then, +# if there's a line with ##@ something, that gets pretty-printed as a category. +# More info on the usage of ANSI control characters for terminal formatting: +# https://en.wikipedia.org/wiki/ANSI_escape_code#SGR_parameters +# More info on the awk command: +# http://linuxcommand.org/lc3_adv_awk.php + +.PHONY: help +help: ## Display this help. + @awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf " \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST) + +##@ Development + +.PHONY: manifests +manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects. + $(CONTROLLER_GEN) rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases + +.PHONY: generate +generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations. + $(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..." + +.PHONY: fmt +fmt: ## Run go fmt against code. + go fmt ./... + +.PHONY: vet +vet: ## Run go vet against code. + go vet ./... + +.PHONY: test +test: manifests generate fmt vet setup-envtest ## Run tests. + KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test $$(go list ./... | grep -v /e2e) -coverprofile cover.out + +# TODO(user): To use a different vendor for e2e tests, modify the setup under 'tests/e2e'. +# The default setup assumes Kind is pre-installed and builds/loads the Manager Docker image locally. +# Prometheus and CertManager are installed by default; skip with: +# - PROMETHEUS_INSTALL_SKIP=true +# - CERT_MANAGER_INSTALL_SKIP=true +.PHONY: test-e2e +test-e2e: manifests generate fmt vet ## Run the e2e tests. Expected an isolated environment using Kind. + @command -v kind >/dev/null 2>&1 || { \ + echo "Kind is not installed. Please install Kind manually."; \ + exit 1; \ + } + @kind get clusters | grep -q 'kind' || { \ + echo "No Kind cluster is running. Please start a Kind cluster before running the e2e tests."; \ + exit 1; \ + } + go test ./test/e2e/ -v -ginkgo.v + +.PHONY: lint +lint: golangci-lint ## Run golangci-lint linter + $(GOLANGCI_LINT) run + +.PHONY: lint-fix +lint-fix: golangci-lint ## Run golangci-lint linter and perform fixes + $(GOLANGCI_LINT) run --fix + +.PHONY: lint-config +lint-config: golangci-lint ## Verify golangci-lint linter configuration + $(GOLANGCI_LINT) config verify + +##@ Build + +.PHONY: build +build: manifests generate fmt vet ## Build manager binary. + go build -o bin/manager cmd/main.go + +.PHONY: run +run: manifests generate fmt vet ## Run a controller from your host. + go run ./cmd/main.go + +# If you wish to build the manager image targeting other platforms you can use the --platform flag. +# (i.e. docker build --platform linux/arm64). However, you must enable docker buildKit for it. +# More info: https://docs.docker.com/develop/develop-images/build_enhancements/ +.PHONY: docker-build +docker-build: ## Build docker image with the manager. + $(CONTAINER_TOOL) build -t ${IMG} . + +.PHONY: docker-push +docker-push: ## Push docker image with the manager. + $(CONTAINER_TOOL) push ${IMG} + +# PLATFORMS defines the target platforms for the manager image be built to provide support to multiple +# architectures. (i.e. make docker-buildx IMG=myregistry/mypoperator:0.0.1). To use this option you need to: +# - be able to use docker buildx. More info: https://docs.docker.com/build/buildx/ +# - have enabled BuildKit. More info: https://docs.docker.com/develop/develop-images/build_enhancements/ +# - be able to push the image to your registry (i.e. if you do not set a valid value via IMG=> then the export will fail) +# To adequately provide solutions that are compatible with multiple platforms, you should consider using this option. +PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le +.PHONY: docker-buildx +docker-buildx: ## Build and push docker image for the manager for cross-platform support + # copy existing Dockerfile and insert --platform=${BUILDPLATFORM} into Dockerfile.cross, and preserve the original Dockerfile + sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Dockerfile > Dockerfile.cross + - $(CONTAINER_TOOL) buildx create --name address-controller-builder + $(CONTAINER_TOOL) buildx use address-controller-builder + - $(CONTAINER_TOOL) buildx build --push --platform=$(PLATFORMS) --tag ${IMG} -f Dockerfile.cross . + - $(CONTAINER_TOOL) buildx rm address-controller-builder + rm Dockerfile.cross + +.PHONY: build-installer +build-installer: manifests generate kustomize ## Generate a consolidated YAML with CRDs and deployment. + mkdir -p dist + cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG} + $(KUSTOMIZE) build config/default > dist/install.yaml + +##@ Deployment + +ifndef ignore-not-found + ignore-not-found = false +endif + +.PHONY: install +install: manifests kustomize ## Install CRDs into the K8s cluster specified in ~/.kube/config. + $(KUSTOMIZE) build config/crd | $(KUBECTL) apply -f - + +.PHONY: uninstall +uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion. + $(KUSTOMIZE) build config/crd | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f - + +.PHONY: deploy +deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config. + cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG} + $(KUSTOMIZE) build config/default | $(KUBECTL) apply -f - + +.PHONY: undeploy +undeploy: kustomize ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion. + $(KUSTOMIZE) build config/default | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f - + +##@ Dependencies + +## Location to install dependencies to +LOCALBIN ?= $(shell pwd)/bin +$(LOCALBIN): + mkdir -p $(LOCALBIN) + +## Tool Binaries +KUBECTL ?= kubectl +KUSTOMIZE ?= $(LOCALBIN)/kustomize +CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen +ENVTEST ?= $(LOCALBIN)/setup-envtest +GOLANGCI_LINT = $(LOCALBIN)/golangci-lint + +## Tool Versions +KUSTOMIZE_VERSION ?= v5.5.0 +CONTROLLER_TOOLS_VERSION ?= v0.17.1 +#ENVTEST_VERSION is the version of controller-runtime release branch to fetch the envtest setup script (i.e. release-0.20) +ENVTEST_VERSION ?= $(shell go list -m -f "{{ .Version }}" sigs.k8s.io/controller-runtime | awk -F'[v.]' '{printf "release-%d.%d", $$2, $$3}') +#ENVTEST_K8S_VERSION is the version of Kubernetes to use for setting up ENVTEST binaries (i.e. 1.31) +ENVTEST_K8S_VERSION ?= $(shell go list -m -f "{{ .Version }}" k8s.io/api | awk -F'[v.]' '{printf "1.%d", $$3}') +GOLANGCI_LINT_VERSION ?= v1.63.4 + +.PHONY: kustomize +kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary. +$(KUSTOMIZE): $(LOCALBIN) + $(call go-install-tool,$(KUSTOMIZE),sigs.k8s.io/kustomize/kustomize/v5,$(KUSTOMIZE_VERSION)) + +.PHONY: controller-gen +controller-gen: $(CONTROLLER_GEN) ## Download controller-gen locally if necessary. +$(CONTROLLER_GEN): $(LOCALBIN) + $(call go-install-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen,$(CONTROLLER_TOOLS_VERSION)) + +.PHONY: setup-envtest +setup-envtest: envtest ## Download the binaries required for ENVTEST in the local bin directory. + @echo "Setting up envtest binaries for Kubernetes version $(ENVTEST_K8S_VERSION)..." + @$(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path || { \ + echo "Error: Failed to set up envtest binaries for version $(ENVTEST_K8S_VERSION)."; \ + exit 1; \ + } + +.PHONY: envtest +envtest: $(ENVTEST) ## Download setup-envtest locally if necessary. +$(ENVTEST): $(LOCALBIN) + $(call go-install-tool,$(ENVTEST),sigs.k8s.io/controller-runtime/tools/setup-envtest,$(ENVTEST_VERSION)) + +.PHONY: golangci-lint +golangci-lint: $(GOLANGCI_LINT) ## Download golangci-lint locally if necessary. +$(GOLANGCI_LINT): $(LOCALBIN) + $(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/cmd/golangci-lint,$(GOLANGCI_LINT_VERSION)) + +# go-install-tool will 'go install' any package with custom target and name of binary, if it doesn't exist +# $1 - target path with name of binary +# $2 - package url which can be installed +# $3 - specific version of package +define go-install-tool +@[ -f "$(1)-$(3)" ] || { \ +set -e; \ +package=$(2)@$(3) ;\ +echo "Downloading $${package}" ;\ +rm -f $(1) || true ;\ +GOBIN=$(LOCALBIN) go install $${package} ;\ +mv $(1) $(1)-$(3) ;\ +} ;\ +ln -sf $(1)-$(3) $(1) +endef diff --git a/PROJECT b/PROJECT new file mode 100644 index 0000000..b947642 --- /dev/null +++ b/PROJECT @@ -0,0 +1,35 @@ +# Code generated by tool. DO NOT EDIT. +# This file is used to track the info used to scaffold your project +# and allow the plugins properly work. +# More info: https://book.kubebuilder.io/reference/project-config.html +domain: sdn.cozystack.io +layout: +- go.kubebuilder.io/v4 +projectName: address-controller +repo: github.com/lllamnyp/address-controller +resources: +- api: + crdVersion: v1 + domain: sdn.cozystack.io + group: local + kind: IPAddressClass + path: github.com/lllamnyp/address-controller/api/v1alpha1 + version: v1alpha1 +- api: + crdVersion: v1 + controller: true + domain: sdn.cozystack.io + group: local + kind: IPAddress + path: github.com/lllamnyp/address-controller/api/v1alpha1 + version: v1alpha1 +- api: + crdVersion: v1 + namespaced: true + controller: true + domain: sdn.cozystack.io + group: local + kind: IPAddressClaim + path: github.com/lllamnyp/address-controller/api/v1alpha1 + version: v1alpha1 +version: "3" diff --git a/README.md b/README.md index 8bc556a..502bcff 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,91 @@ # address-controller -Core controller for the IPAddressClass feature (local.sdn.cozystack.io) — see cozystack/community#35 + +The core, class-agnostic controller for IP addresses as a first-class resource +(design: [cozystack/community#35](https://github.com/cozystack/community/pull/35)). +It is the analog of the generic PVC/PV binding controller in the storage +subsystem: it owns claim–address binding, status, and finalizer-driven +cleanup, and leaves actual address allocation to per-class drivers (the CSI +analogue), which live in separate projects. + +**The full contract — state machines, reconciliation algorithms, field +ownership, and driver obligations — is specified in +[docs/design.md](docs/design.md).** The reference driver implementing it is +[metallb-iad](https://github.com/lllamnyp/metallb-iad). + +## Resource model + +All kinds live in the `local.sdn.cozystack.io/v1alpha1` API group. + +| storage | addresses | scope | role | +|---|---|---|---| +| `StorageClass` | `IPAddressClass` | cluster | which pool, which driver (`spec.provisioner`), which reclaim policy | +| `PersistentVolume` | `IPAddress` | cluster | the address itself, with a `claimRef`, a reclaim policy, and a `fromClass`/`providerRef` source union | +| `PersistentVolumeClaim` | `IPAddressClaim` | namespaced | "give me one" — the whole tenant-facing API | + +A tenant creates an `IPAddressClaim`, reads `status.addresses[].address`, and +puts it in DNS. The claim survives the workload: deleting the Service that +used the address never releases the address, because the address's lifetime +belongs to the claim, and (under `reclaimPolicy: Retain`) even outlives the +claim as a `Released` `IPAddress`. + +### Lifecycle + +- **Claim**: `Pending` → `Bound` (all requested families bound) → `Lost` (a + bound address disappeared). A `Dual` claim binds one IPv4 and one IPv6 + `IPAddress` and reports both in `status.addresses`. +- **Address**: `Pending` → `Available` (no `claimRef`) → `Bound` → + `Released` (claim deleted under `Retain`; not reusable until an admin + clears `spec.claimRef`, at which point it is `Available` again). `Conflict` + and `Lost` are driver-owned phases; the core controller treats them as + sticky. + +## The per-class driver contract + +A driver is named by `IPAddressClass.spec.provisioner` and plugs into the +core controller as follows: + +1. **Claim pickup.** The core controller resolves a claim's class (explicit + `spec.className`, or the class annotated + `ipaddressclass.local.sdn.cozystack.io/is-default-class: "true"`) and + stamps the claim with the annotation + `local.sdn.cozystack.io/provisioner: `. The driver watches + claims carrying its name and provisions for the ones not yet `Bound`. +2. **Provisioning.** The driver allocates from the class's range + (`spec.source.fromClass: {}`) or adopts a provider-side reservation + (`spec.source.providerRef.id`), interpreting `IPAddressClass.spec.parameters` + (opaque to the core). It creates the `IPAddress` with `spec.claimRef` + pre-set to the claim's namespace/name (UID optional — the core completes + it), `spec.reclaimPolicy` copied from the class, and **its own finalizer** + for backend teardown. +3. **Binding.** The core controller completes the binding: the claim goes + `Bound` with the address in `status.addresses`, the address goes `Bound`. + Statically pre-provisioned `Available` addresses (created by an admin or a + driver ahead of demand) are matched to claims by class and family; a claim + may pin a specific one via `spec.addressName`. +4. **Reclaim.** When the claim is deleted the core controller either marks + the address `Released` (`Retain`) or deletes the `IPAddress` object + (`Delete`); in the latter case the driver's finalizer must deallocate the + backend resource before allowing the object to go away. +5. **Association.** Attaching a bound address to a workload is a separate, + reversible act and is entirely driver territory: the driver resolves the + Service annotation `local.sdn.cozystack.io/ip-address-claim` (naming a + claim in the Service's own namespace), writes the backend's pin + annotation, and maintains `IPAddress.status.associatedTo`. The driver also + reconciles live Service assignments against the ledger and sets the + `Conflict` phase when an address is held by a Service its binding does not + authorize, and `Lost` when the backing allocation disappears. + +The core controller never touches Services, never parses class parameters, +and never puts a packet on a wire. + +## Development + +Standard kubebuilder project: + +```sh +make manifests generate # regenerate CRDs and deepcopy after API changes +make build # build the manager +go test ./internal/controller/ +make install # install CRDs into the current kube-context +make run # run the controller locally +``` diff --git a/api/v1alpha1/groupversion_info.go b/api/v1alpha1/groupversion_info.go new file mode 100644 index 0000000..6330a01 --- /dev/null +++ b/api/v1alpha1/groupversion_info.go @@ -0,0 +1,36 @@ +/* +Copyright 2026. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Package v1alpha1 contains API Schema definitions for the local v1alpha1 API group. +// +kubebuilder:object:generate=true +// +groupName=local.sdn.cozystack.io +package v1alpha1 + +import ( + "k8s.io/apimachinery/pkg/runtime/schema" + "sigs.k8s.io/controller-runtime/pkg/scheme" +) + +var ( + // GroupVersion is group version used to register these objects. + GroupVersion = schema.GroupVersion{Group: "local.sdn.cozystack.io", Version: "v1alpha1"} + + // SchemeBuilder is used to add go types to the GroupVersionKind scheme. + SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion} + + // AddToScheme adds the types in this group-version to the given scheme. + AddToScheme = SchemeBuilder.AddToScheme +) diff --git a/api/v1alpha1/ipaddress_types.go b/api/v1alpha1/ipaddress_types.go new file mode 100644 index 0000000..65174bd --- /dev/null +++ b/api/v1alpha1/ipaddress_types.go @@ -0,0 +1,191 @@ +/* +Copyright 2026. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/types" +) + +// ClaimReference points an IPAddress at the IPAddressClaim it is bound to. +type ClaimReference struct { + // namespace of the claim. + // +kubebuilder:validation:MinLength=1 + Namespace string `json:"namespace"` + // name of the claim. + // +kubebuilder:validation:MinLength=1 + Name string `json:"name"` + // uid of the claim. A driver pre-binding an address may leave it empty; + // the core controller completes it when it accepts the binding. + // +optional + UID types.UID `json:"uid,omitempty"` +} + +// FromClassSource records that the address was carved from the class's own +// range by its driver — the driver is the IPAM of record. +type FromClassSource struct{} + +// ProviderReference records that the address wraps a reservation held by an +// external provider (a cloud EIP, a named static address). The driver adopted +// it rather than allocating it. +type ProviderReference struct { + // id is the provider-side stable handle of the reservation, for example + // an AWS allocation id ("eipalloc-0a1b..."). + // +kubebuilder:validation:MinLength=1 + ID string `json:"id"` +} + +// IPAddressSource is a union describing where the address came from — +// the analogue of the PersistentVolume volume-source union. Exactly one +// member must be set. +// +kubebuilder:validation:XValidation:rule="(has(self.fromClass) ? 1 : 0) + (has(self.providerRef) ? 1 : 0) == 1",message="exactly one of fromClass or providerRef must be set" +type IPAddressSource struct { + // fromClass marks the address as allocated from the class's range. + // +optional + FromClass *FromClassSource `json:"fromClass,omitempty"` + // providerRef marks the address as adopted from a provider-side + // reservation. + // +optional + ProviderRef *ProviderReference `json:"providerRef,omitempty"` +} + +// IPAddressSpec defines the desired state of IPAddress. +type IPAddressSpec struct { + // className names the IPAddressClass this address belongs to. + // +kubebuilder:validation:MinLength=1 + ClassName string `json:"className"` + + // address is the IP address itself, in canonical textual form + // (e.g. "203.0.113.7" or "2001:db8::7"). + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:XValidation:rule="self == oldSelf",message="address is immutable" + Address string `json:"address"` + + // reclaimPolicy governs what happens to this object when its claim is + // deleted; copied from the class at provisioning time. + // +optional + // +kubebuilder:default=Retain + ReclaimPolicy ReclaimPolicy `json:"reclaimPolicy,omitempty"` + + // claimRef binds this address to a claim. Set either by the driver at + // provisioning time (pre-bound) or by the core controller when it + // matches an Available address to a claim. An address with no claimRef + // is Available. After a Retain reclaim the field survives the claim + // (phase Released) until an admin clears it. + // +optional + ClaimRef *ClaimReference `json:"claimRef,omitempty"` + + // source records where the address came from. + Source IPAddressSource `json:"source"` +} + +// IPAddressPhase describes the lifecycle phase of an IPAddress. +// +kubebuilder:validation:Enum=Pending;Available;Bound;Released;Conflict;Lost +type IPAddressPhase string + +const ( + // IPAddressPending means the object has not been reconciled yet or its + // spec does not validate. + IPAddressPending IPAddressPhase = "Pending" + // IPAddressAvailable means the address is not bound to any claim and + // may be matched to one. + IPAddressAvailable IPAddressPhase = "Available" + // IPAddressBound means the address is bound to a live claim. A Bound + // address with no status.associatedTo is reserved but inert — held, + // attached to nothing. + IPAddressBound IPAddressPhase = "Bound" + // IPAddressReleased means the claim was deleted under reclaimPolicy + // Retain. The address keeps its claimRef and is not reusable until an + // admin clears it. + IPAddressReleased IPAddressPhase = "Released" + // IPAddressConflict means a live Service holds this address although + // the address's binding does not authorize it. Set by drivers; the core + // controller treats it as sticky. + IPAddressConflict IPAddressPhase = "Conflict" + // IPAddressLost means the backing allocation disappeared (for example a + // provider-side reservation was released). Set by drivers; the core + // controller treats it as sticky. + IPAddressLost IPAddressPhase = "Lost" +) + +// AssociationReference names the workload object an address is currently +// associated with (announced for). Maintained by the per-class driver. +type AssociationReference struct { + // kind of the associated object, e.g. "Service". + // +kubebuilder:validation:MinLength=1 + Kind string `json:"kind"` + // namespace of the associated object. + // +kubebuilder:validation:MinLength=1 + Namespace string `json:"namespace"` + // name of the associated object. + // +kubebuilder:validation:MinLength=1 + Name string `json:"name"` +} + +// IPAddressStatus defines the observed state of IPAddress. +type IPAddressStatus struct { + // phase is the current lifecycle phase of the address. + // +optional + Phase IPAddressPhase `json:"phase,omitempty"` + + // associatedTo names the workload the address is currently announced + // for. Nil means reserved but inert. Maintained by the per-class + // driver, never by the core controller. + // +optional + AssociatedTo *AssociationReference `json:"associatedTo,omitempty"` + + // conditions represent the latest available observations of the + // address's state. + // +optional + // +listType=map + // +listMapKey=type + Conditions []metav1.Condition `json:"conditions,omitempty"` +} + +// +kubebuilder:object:root=true +// +kubebuilder:subresource:status +// +kubebuilder:resource:scope=Cluster +// +kubebuilder:printcolumn:name="Address",type=string,JSONPath=`.spec.address` +// +kubebuilder:printcolumn:name="Class",type=string,JSONPath=`.spec.className` +// +kubebuilder:printcolumn:name="Phase",type=string,JSONPath=`.status.phase` +// +kubebuilder:printcolumn:name="ClaimNamespace",type=string,JSONPath=`.spec.claimRef.namespace` +// +kubebuilder:printcolumn:name="Claim",type=string,JSONPath=`.spec.claimRef.name` +// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` + +// IPAddress is a concrete address the cluster owns — the inventory object, +// the PersistentVolume of the address model. Created by a per-class driver +// (or an admin, for static pre-provisioning), never by tenants. +type IPAddress struct { + metav1.TypeMeta `json:",inline"` + metav1.ObjectMeta `json:"metadata,omitempty"` + + Spec IPAddressSpec `json:"spec,omitempty"` + Status IPAddressStatus `json:"status,omitempty"` +} + +// +kubebuilder:object:root=true + +// IPAddressList contains a list of IPAddress. +type IPAddressList struct { + metav1.TypeMeta `json:",inline"` + metav1.ListMeta `json:"metadata,omitempty"` + Items []IPAddress `json:"items"` +} + +func init() { + SchemeBuilder.Register(&IPAddress{}, &IPAddressList{}) +} diff --git a/api/v1alpha1/ipaddressclaim_types.go b/api/v1alpha1/ipaddressclaim_types.go new file mode 100644 index 0000000..4684e21 --- /dev/null +++ b/api/v1alpha1/ipaddressclaim_types.go @@ -0,0 +1,134 @@ +/* +Copyright 2026. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// AddressFamily selects which IP families a claim requests. +// +kubebuilder:validation:Enum=IPv4;IPv6;Dual +type AddressFamily string + +const ( + // FamilyIPv4 requests one IPv4 address. + FamilyIPv4 AddressFamily = "IPv4" + // FamilyIPv6 requests one IPv6 address. + FamilyIPv6 AddressFamily = "IPv6" + // FamilyDual requests one IPv4 and one IPv6 address. A Dual claim binds + // two IPAddress objects and reports both in status.addresses. + FamilyDual AddressFamily = "Dual" +) + +// IPAddressClaimSpec defines the desired state of IPAddressClaim. +type IPAddressClaimSpec struct { + // className names the IPAddressClass to draw from. Empty means the + // default class (the one annotated + // ipaddressclass.local.sdn.cozystack.io/is-default-class: "true"). + // +optional + ClassName string `json:"className,omitempty"` + + // family selects the IP families requested. + // +optional + // +kubebuilder:default=IPv4 + Family AddressFamily `json:"family,omitempty"` + + // addressName pins the claim to a specific Available IPAddress instead + // of letting the controller match or the driver provision one — the + // analogue of PersistentVolumeClaim.spec.volumeName. Only meaningful + // for single-family claims. + // +optional + AddressName string `json:"addressName,omitempty"` +} + +// IPAddressClaimPhase describes the lifecycle phase of a claim. +// +kubebuilder:validation:Enum=Pending;Bound;Lost +type IPAddressClaimPhase string + +const ( + // ClaimPending means the claim is not yet fully bound. + ClaimPending IPAddressClaimPhase = "Pending" + // ClaimBound means every requested family is bound to an IPAddress. + ClaimBound IPAddressClaimPhase = "Bound" + // ClaimLost means an address the claim was bound to disappeared or was + // rebound elsewhere. + ClaimLost IPAddressClaimPhase = "Lost" +) + +// BoundAddress reports one IPAddress bound to the claim. +type BoundAddress struct { + // name of the bound IPAddress object. + Name string `json:"name"` + // address is the IP itself — what the tenant reads and puts in DNS. + Address string `json:"address"` +} + +// IPAddressClaimStatus defines the observed state of IPAddressClaim. +type IPAddressClaimStatus struct { + // phase is the current lifecycle phase of the claim. + // +optional + Phase IPAddressClaimPhase `json:"phase,omitempty"` + + // className is the class the claim resolved to. For claims created + // without a className it records which default class was picked; the + // resolution is sticky. + // +optional + ClassName string `json:"className,omitempty"` + + // addresses lists the bound addresses. A list deliberately: a Dual + // claim binds a v4 and a v6 IPAddress and must report both. For a + // single-family claim the list has one entry. + // +optional + Addresses []BoundAddress `json:"addresses,omitempty"` + + // conditions represent the latest available observations of the + // claim's state. + // +optional + // +listType=map + // +listMapKey=type + Conditions []metav1.Condition `json:"conditions,omitempty"` +} + +// +kubebuilder:object:root=true +// +kubebuilder:subresource:status +// +kubebuilder:printcolumn:name="Phase",type=string,JSONPath=`.status.phase` +// +kubebuilder:printcolumn:name="Class",type=string,JSONPath=`.status.className` +// +kubebuilder:printcolumn:name="Addresses",type=string,JSONPath=`.status.addresses[*].address` +// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` + +// IPAddressClaim is a namespaced request for an address — the whole +// tenant-facing API, the PersistentVolumeClaim of the address model. +type IPAddressClaim struct { + metav1.TypeMeta `json:",inline"` + metav1.ObjectMeta `json:"metadata,omitempty"` + + Spec IPAddressClaimSpec `json:"spec,omitempty"` + Status IPAddressClaimStatus `json:"status,omitempty"` +} + +// +kubebuilder:object:root=true + +// IPAddressClaimList contains a list of IPAddressClaim. +type IPAddressClaimList struct { + metav1.TypeMeta `json:",inline"` + metav1.ListMeta `json:"metadata,omitempty"` + Items []IPAddressClaim `json:"items"` +} + +func init() { + SchemeBuilder.Register(&IPAddressClaim{}, &IPAddressClaimList{}) +} diff --git a/api/v1alpha1/ipaddressclass_types.go b/api/v1alpha1/ipaddressclass_types.go new file mode 100644 index 0000000..eb076ba --- /dev/null +++ b/api/v1alpha1/ipaddressclass_types.go @@ -0,0 +1,92 @@ +/* +Copyright 2026. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" +) + +// ReclaimPolicy describes what happens to an IPAddress when the claim +// bound to it is deleted. +// +kubebuilder:validation:Enum=Retain;Delete +type ReclaimPolicy string + +const ( + // ReclaimRetain keeps the IPAddress after its claim is deleted. The + // address moves to phase Released and is not reusable until an admin + // clears its claimRef. + ReclaimRetain ReclaimPolicy = "Retain" + // ReclaimDelete deletes the IPAddress after its claim is deleted. The + // per-class driver tears down the backend allocation via its finalizer + // before the object is removed. + ReclaimDelete ReclaimPolicy = "Delete" +) + +// IPAddressClassSpec defines the desired state of IPAddressClass. +type IPAddressClassSpec struct { + // provisioner names the per-class driver that fulfils claims of this + // class, exactly as StorageClass.provisioner names a CSI driver. The + // core controller never provisions addresses itself; it stamps this + // value onto pending claims so the named driver can pick them up. + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:XValidation:rule="self == oldSelf",message="provisioner is immutable" + Provisioner string `json:"provisioner"` + + // reclaimPolicy is copied to IPAddress objects provisioned for this + // class and governs what happens to them when their claim is deleted. + // +optional + // +kubebuilder:default=Retain + ReclaimPolicy ReclaimPolicy `json:"reclaimPolicy,omitempty"` + + // parameters is an opaque, driver-specific configuration blob (for + // example the address ranges to carve from). The core controller never + // interprets it. + // +optional + // +kubebuilder:pruning:PreserveUnknownFields + Parameters *runtime.RawExtension `json:"parameters,omitempty"` +} + +// +kubebuilder:object:root=true +// +kubebuilder:resource:scope=Cluster +// +kubebuilder:printcolumn:name="Provisioner",type=string,JSONPath=`.spec.provisioner` +// +kubebuilder:printcolumn:name="ReclaimPolicy",type=string,JSONPath=`.spec.reclaimPolicy` +// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` + +// IPAddressClass describes an address source: which pool, which driver. +// It is the StorageClass of the address model. Marking a class with the +// annotation ipaddressclass.local.sdn.cozystack.io/is-default-class: "true" +// makes it the class for claims that do not name one. +type IPAddressClass struct { + metav1.TypeMeta `json:",inline"` + metav1.ObjectMeta `json:"metadata,omitempty"` + + Spec IPAddressClassSpec `json:"spec,omitempty"` +} + +// +kubebuilder:object:root=true + +// IPAddressClassList contains a list of IPAddressClass. +type IPAddressClassList struct { + metav1.TypeMeta `json:",inline"` + metav1.ListMeta `json:"metadata,omitempty"` + Items []IPAddressClass `json:"items"` +} + +func init() { + SchemeBuilder.Register(&IPAddressClass{}, &IPAddressClassList{}) +} diff --git a/api/v1alpha1/well_known.go b/api/v1alpha1/well_known.go new file mode 100644 index 0000000..ba63fc1 --- /dev/null +++ b/api/v1alpha1/well_known.go @@ -0,0 +1,69 @@ +/* +Copyright 2026. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1alpha1 + +// Well-known annotations and finalizers of the local.sdn.cozystack.io group. +// Together with the CRD schemas these constants are the contract between the +// core controller and the per-class drivers. +const ( + // IsDefaultClassAnnotation marks an IPAddressClass as the class for + // claims that do not name one. Value must be "true". The analogue of + // storageclass.kubernetes.io/is-default-class. + IsDefaultClassAnnotation = "ipaddressclass.local.sdn.cozystack.io/is-default-class" + + // ProvisionerAnnotation is stamped onto an IPAddressClaim by the core + // controller once the claim's class is resolved. Its value is the + // class's spec.provisioner. Per-class drivers watch claims carrying + // their own name here and provision addresses for the pending ones — + // the analogue of volume.kubernetes.io/storage-provisioner. + ProvisionerAnnotation = "local.sdn.cozystack.io/provisioner" + + // ServiceClaimAnnotation, set on a Service by a tenant, names an + // IPAddressClaim in the Service's own namespace whose address should be + // pinned to the Service. Consumed by per-class drivers (which translate + // it into the backend's raw pin annotation), never by tenants writing + // backend annotations directly. + ServiceClaimAnnotation = "local.sdn.cozystack.io/ip-address-claim" + + // ClaimProtectionFinalizer is placed on every IPAddressClaim by the + // core controller so that claim deletion runs the reclaim flow for the + // bound addresses before the claim disappears. + ClaimProtectionFinalizer = "local.sdn.cozystack.io/claim-protection" + + // AddressProtectionFinalizer is placed on every IPAddress by the core + // controller. It blocks deletion of an address that is still bound to a + // live claim. Drivers add their own finalizer on addresses they + // provision to tear down the backend allocation. + AddressProtectionFinalizer = "local.sdn.cozystack.io/address-protection" +) + +// Condition types and reasons used by the core controller. +const ( + // ConditionClassResolved reports whether the claim's class reference + // resolved to an existing IPAddressClass. + ConditionClassResolved = "ClassResolved" + // ConditionBound reports whether every requested family is bound. + ConditionBound = "Bound" + + ReasonResolved = "Resolved" + ReasonClassNotFound = "ClassNotFound" + ReasonNoDefaultClass = "NoDefaultClass" + ReasonMultipleDefaultClasses = "MultipleDefaultClasses" + ReasonBound = "Bound" + ReasonWaitingForProvisioning = "WaitingForProvisioning" + ReasonAddressLost = "AddressLost" +) diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go new file mode 100644 index 0000000..ce37b8a --- /dev/null +++ b/api/v1alpha1/zz_generated.deepcopy.go @@ -0,0 +1,412 @@ +//go:build !ignore_autogenerated + +/* +Copyright 2026. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Code generated by controller-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" +) + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AssociationReference) DeepCopyInto(out *AssociationReference) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AssociationReference. +func (in *AssociationReference) DeepCopy() *AssociationReference { + if in == nil { + return nil + } + out := new(AssociationReference) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *BoundAddress) DeepCopyInto(out *BoundAddress) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BoundAddress. +func (in *BoundAddress) DeepCopy() *BoundAddress { + if in == nil { + return nil + } + out := new(BoundAddress) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ClaimReference) DeepCopyInto(out *ClaimReference) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClaimReference. +func (in *ClaimReference) DeepCopy() *ClaimReference { + if in == nil { + return nil + } + out := new(ClaimReference) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *FromClassSource) DeepCopyInto(out *FromClassSource) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FromClassSource. +func (in *FromClassSource) DeepCopy() *FromClassSource { + if in == nil { + return nil + } + out := new(FromClassSource) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IPAddress) DeepCopyInto(out *IPAddress) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + in.Spec.DeepCopyInto(&out.Spec) + in.Status.DeepCopyInto(&out.Status) +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPAddress. +func (in *IPAddress) DeepCopy() *IPAddress { + if in == nil { + return nil + } + out := new(IPAddress) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *IPAddress) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IPAddressClaim) DeepCopyInto(out *IPAddressClaim) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + out.Spec = in.Spec + in.Status.DeepCopyInto(&out.Status) +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPAddressClaim. +func (in *IPAddressClaim) DeepCopy() *IPAddressClaim { + if in == nil { + return nil + } + out := new(IPAddressClaim) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *IPAddressClaim) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IPAddressClaimList) DeepCopyInto(out *IPAddressClaimList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]IPAddressClaim, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPAddressClaimList. +func (in *IPAddressClaimList) DeepCopy() *IPAddressClaimList { + if in == nil { + return nil + } + out := new(IPAddressClaimList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *IPAddressClaimList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IPAddressClaimSpec) DeepCopyInto(out *IPAddressClaimSpec) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPAddressClaimSpec. +func (in *IPAddressClaimSpec) DeepCopy() *IPAddressClaimSpec { + if in == nil { + return nil + } + out := new(IPAddressClaimSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IPAddressClaimStatus) DeepCopyInto(out *IPAddressClaimStatus) { + *out = *in + if in.Addresses != nil { + in, out := &in.Addresses, &out.Addresses + *out = make([]BoundAddress, len(*in)) + copy(*out, *in) + } + if in.Conditions != nil { + in, out := &in.Conditions, &out.Conditions + *out = make([]v1.Condition, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPAddressClaimStatus. +func (in *IPAddressClaimStatus) DeepCopy() *IPAddressClaimStatus { + if in == nil { + return nil + } + out := new(IPAddressClaimStatus) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IPAddressClass) DeepCopyInto(out *IPAddressClass) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + in.Spec.DeepCopyInto(&out.Spec) +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPAddressClass. +func (in *IPAddressClass) DeepCopy() *IPAddressClass { + if in == nil { + return nil + } + out := new(IPAddressClass) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *IPAddressClass) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IPAddressClassList) DeepCopyInto(out *IPAddressClassList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]IPAddressClass, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPAddressClassList. +func (in *IPAddressClassList) DeepCopy() *IPAddressClassList { + if in == nil { + return nil + } + out := new(IPAddressClassList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *IPAddressClassList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IPAddressClassSpec) DeepCopyInto(out *IPAddressClassSpec) { + *out = *in + if in.Parameters != nil { + in, out := &in.Parameters, &out.Parameters + *out = new(runtime.RawExtension) + (*in).DeepCopyInto(*out) + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPAddressClassSpec. +func (in *IPAddressClassSpec) DeepCopy() *IPAddressClassSpec { + if in == nil { + return nil + } + out := new(IPAddressClassSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IPAddressList) DeepCopyInto(out *IPAddressList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]IPAddress, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPAddressList. +func (in *IPAddressList) DeepCopy() *IPAddressList { + if in == nil { + return nil + } + out := new(IPAddressList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *IPAddressList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IPAddressSource) DeepCopyInto(out *IPAddressSource) { + *out = *in + if in.FromClass != nil { + in, out := &in.FromClass, &out.FromClass + *out = new(FromClassSource) + **out = **in + } + if in.ProviderRef != nil { + in, out := &in.ProviderRef, &out.ProviderRef + *out = new(ProviderReference) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPAddressSource. +func (in *IPAddressSource) DeepCopy() *IPAddressSource { + if in == nil { + return nil + } + out := new(IPAddressSource) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IPAddressSpec) DeepCopyInto(out *IPAddressSpec) { + *out = *in + if in.ClaimRef != nil { + in, out := &in.ClaimRef, &out.ClaimRef + *out = new(ClaimReference) + **out = **in + } + in.Source.DeepCopyInto(&out.Source) +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPAddressSpec. +func (in *IPAddressSpec) DeepCopy() *IPAddressSpec { + if in == nil { + return nil + } + out := new(IPAddressSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IPAddressStatus) DeepCopyInto(out *IPAddressStatus) { + *out = *in + if in.AssociatedTo != nil { + in, out := &in.AssociatedTo, &out.AssociatedTo + *out = new(AssociationReference) + **out = **in + } + if in.Conditions != nil { + in, out := &in.Conditions, &out.Conditions + *out = make([]v1.Condition, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPAddressStatus. +func (in *IPAddressStatus) DeepCopy() *IPAddressStatus { + if in == nil { + return nil + } + out := new(IPAddressStatus) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ProviderReference) DeepCopyInto(out *ProviderReference) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProviderReference. +func (in *ProviderReference) DeepCopy() *ProviderReference { + if in == nil { + return nil + } + out := new(ProviderReference) + in.DeepCopyInto(out) + return out +} diff --git a/cmd/main.go b/cmd/main.go new file mode 100644 index 0000000..f198384 --- /dev/null +++ b/cmd/main.go @@ -0,0 +1,259 @@ +/* +Copyright 2026. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package main + +import ( + "context" + "crypto/tls" + "flag" + "os" + "path/filepath" + + // Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.) + // to ensure that exec-entrypoint and run can make use of them. + _ "k8s.io/client-go/plugin/pkg/client/auth" + + "k8s.io/apimachinery/pkg/runtime" + utilruntime "k8s.io/apimachinery/pkg/util/runtime" + clientgoscheme "k8s.io/client-go/kubernetes/scheme" + ctrl "sigs.k8s.io/controller-runtime" + "sigs.k8s.io/controller-runtime/pkg/certwatcher" + "sigs.k8s.io/controller-runtime/pkg/healthz" + "sigs.k8s.io/controller-runtime/pkg/log/zap" + "sigs.k8s.io/controller-runtime/pkg/metrics/filters" + metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server" + "sigs.k8s.io/controller-runtime/pkg/webhook" + + localv1alpha1 "github.com/lllamnyp/address-controller/api/v1alpha1" + "github.com/lllamnyp/address-controller/internal/controller" + // +kubebuilder:scaffold:imports +) + +var ( + scheme = runtime.NewScheme() + setupLog = ctrl.Log.WithName("setup") +) + +func init() { + utilruntime.Must(clientgoscheme.AddToScheme(scheme)) + + utilruntime.Must(localv1alpha1.AddToScheme(scheme)) + // +kubebuilder:scaffold:scheme +} + +// nolint:gocyclo +func main() { + var metricsAddr string + var metricsCertPath, metricsCertName, metricsCertKey string + var webhookCertPath, webhookCertName, webhookCertKey string + var enableLeaderElection bool + var probeAddr string + var secureMetrics bool + var enableHTTP2 bool + var tlsOpts []func(*tls.Config) + flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+ + "Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.") + flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.") + flag.BoolVar(&enableLeaderElection, "leader-elect", false, + "Enable leader election for controller manager. "+ + "Enabling this will ensure there is only one active controller manager.") + flag.BoolVar(&secureMetrics, "metrics-secure", true, + "If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.") + flag.StringVar(&webhookCertPath, "webhook-cert-path", "", "The directory that contains the webhook certificate.") + flag.StringVar(&webhookCertName, "webhook-cert-name", "tls.crt", "The name of the webhook certificate file.") + flag.StringVar(&webhookCertKey, "webhook-cert-key", "tls.key", "The name of the webhook key file.") + flag.StringVar(&metricsCertPath, "metrics-cert-path", "", + "The directory that contains the metrics server certificate.") + flag.StringVar(&metricsCertName, "metrics-cert-name", "tls.crt", "The name of the metrics server certificate file.") + flag.StringVar(&metricsCertKey, "metrics-cert-key", "tls.key", "The name of the metrics server key file.") + flag.BoolVar(&enableHTTP2, "enable-http2", false, + "If set, HTTP/2 will be enabled for the metrics and webhook servers") + opts := zap.Options{ + Development: true, + } + opts.BindFlags(flag.CommandLine) + flag.Parse() + + ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts))) + + // if the enable-http2 flag is false (the default), http/2 should be disabled + // due to its vulnerabilities. More specifically, disabling http/2 will + // prevent from being vulnerable to the HTTP/2 Stream Cancellation and + // Rapid Reset CVEs. For more information see: + // - https://github.com/advisories/GHSA-qppj-fm5r-hxr3 + // - https://github.com/advisories/GHSA-4374-p667-p6c8 + disableHTTP2 := func(c *tls.Config) { + setupLog.Info("disabling http/2") + c.NextProtos = []string{"http/1.1"} + } + + if !enableHTTP2 { + tlsOpts = append(tlsOpts, disableHTTP2) + } + + // Create watchers for metrics and webhooks certificates + var metricsCertWatcher, webhookCertWatcher *certwatcher.CertWatcher + + // Initial webhook TLS options + webhookTLSOpts := tlsOpts + + if len(webhookCertPath) > 0 { + setupLog.Info("Initializing webhook certificate watcher using provided certificates", + "webhook-cert-path", webhookCertPath, "webhook-cert-name", webhookCertName, "webhook-cert-key", webhookCertKey) + + var err error + webhookCertWatcher, err = certwatcher.New( + filepath.Join(webhookCertPath, webhookCertName), + filepath.Join(webhookCertPath, webhookCertKey), + ) + if err != nil { + setupLog.Error(err, "Failed to initialize webhook certificate watcher") + os.Exit(1) + } + + webhookTLSOpts = append(webhookTLSOpts, func(config *tls.Config) { + config.GetCertificate = webhookCertWatcher.GetCertificate + }) + } + + webhookServer := webhook.NewServer(webhook.Options{ + TLSOpts: webhookTLSOpts, + }) + + // Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server. + // More info: + // - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.20.0/pkg/metrics/server + // - https://book.kubebuilder.io/reference/metrics.html + metricsServerOptions := metricsserver.Options{ + BindAddress: metricsAddr, + SecureServing: secureMetrics, + TLSOpts: tlsOpts, + } + + if secureMetrics { + // FilterProvider is used to protect the metrics endpoint with authn/authz. + // These configurations ensure that only authorized users and service accounts + // can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info: + // https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.20.0/pkg/metrics/filters#WithAuthenticationAndAuthorization + metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization + } + + // If the certificate is not specified, controller-runtime will automatically + // generate self-signed certificates for the metrics server. While convenient for development and testing, + // this setup is not recommended for production. + // + // TODO(user): If you enable certManager, uncomment the following lines: + // - [METRICS-WITH-CERTS] at config/default/kustomization.yaml to generate and use certificates + // managed by cert-manager for the metrics server. + // - [PROMETHEUS-WITH-CERTS] at config/prometheus/kustomization.yaml for TLS certification. + if len(metricsCertPath) > 0 { + setupLog.Info("Initializing metrics certificate watcher using provided certificates", + "metrics-cert-path", metricsCertPath, "metrics-cert-name", metricsCertName, "metrics-cert-key", metricsCertKey) + + var err error + metricsCertWatcher, err = certwatcher.New( + filepath.Join(metricsCertPath, metricsCertName), + filepath.Join(metricsCertPath, metricsCertKey), + ) + if err != nil { + setupLog.Error(err, "to initialize metrics certificate watcher", "error", err) + os.Exit(1) + } + + metricsServerOptions.TLSOpts = append(metricsServerOptions.TLSOpts, func(config *tls.Config) { + config.GetCertificate = metricsCertWatcher.GetCertificate + }) + } + + mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{ + Scheme: scheme, + Metrics: metricsServerOptions, + WebhookServer: webhookServer, + HealthProbeBindAddress: probeAddr, + LeaderElection: enableLeaderElection, + LeaderElectionID: "a4cfeeab.sdn.cozystack.io", + // LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily + // when the Manager ends. This requires the binary to immediately end when the + // Manager is stopped, otherwise, this setting is unsafe. Setting this significantly + // speeds up voluntary leader transitions as the new leader don't have to wait + // LeaseDuration time first. + // + // In the default scaffold provided, the program ends immediately after + // the manager stops, so would be fine to enable this option. However, + // if you are doing or is intended to do any operation such as perform cleanups + // after the manager stops then its usage might be unsafe. + // LeaderElectionReleaseOnCancel: true, + }) + if err != nil { + setupLog.Error(err, "unable to start manager") + os.Exit(1) + } + + if err = controller.SetupIndexes(context.Background(), mgr); err != nil { + setupLog.Error(err, "unable to set up field indexes") + os.Exit(1) + } + + if err = (&controller.IPAddressReconciler{ + Client: mgr.GetClient(), + Scheme: mgr.GetScheme(), + Recorder: mgr.GetEventRecorderFor("ipaddress-controller"), + }).SetupWithManager(mgr); err != nil { + setupLog.Error(err, "unable to create controller", "controller", "IPAddress") + os.Exit(1) + } + if err = (&controller.IPAddressClaimReconciler{ + Client: mgr.GetClient(), + Scheme: mgr.GetScheme(), + Recorder: mgr.GetEventRecorderFor("ipaddressclaim-controller"), + }).SetupWithManager(mgr); err != nil { + setupLog.Error(err, "unable to create controller", "controller", "IPAddressClaim") + os.Exit(1) + } + // +kubebuilder:scaffold:builder + + if metricsCertWatcher != nil { + setupLog.Info("Adding metrics certificate watcher to manager") + if err := mgr.Add(metricsCertWatcher); err != nil { + setupLog.Error(err, "unable to add metrics certificate watcher to manager") + os.Exit(1) + } + } + + if webhookCertWatcher != nil { + setupLog.Info("Adding webhook certificate watcher to manager") + if err := mgr.Add(webhookCertWatcher); err != nil { + setupLog.Error(err, "unable to add webhook certificate watcher to manager") + os.Exit(1) + } + } + + if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil { + setupLog.Error(err, "unable to set up health check") + os.Exit(1) + } + if err := mgr.AddReadyzCheck("readyz", healthz.Ping); err != nil { + setupLog.Error(err, "unable to set up ready check") + os.Exit(1) + } + + setupLog.Info("starting manager") + if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil { + setupLog.Error(err, "problem running manager") + os.Exit(1) + } +} diff --git a/config/crd/bases/local.sdn.cozystack.io_ipaddressclaims.yaml b/config/crd/bases/local.sdn.cozystack.io_ipaddressclaims.yaml new file mode 100644 index 0000000..2723b8a --- /dev/null +++ b/config/crd/bases/local.sdn.cozystack.io_ipaddressclaims.yaml @@ -0,0 +1,182 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: ipaddressclaims.local.sdn.cozystack.io +spec: + group: local.sdn.cozystack.io + names: + kind: IPAddressClaim + listKind: IPAddressClaimList + plural: ipaddressclaims + singular: ipaddressclaim + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.phase + name: Phase + type: string + - jsonPath: .status.className + name: Class + type: string + - jsonPath: .status.addresses[*].address + name: Addresses + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + IPAddressClaim is a namespaced request for an address — the whole + tenant-facing API, the PersistentVolumeClaim of the address model. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: IPAddressClaimSpec defines the desired state of IPAddressClaim. + properties: + addressName: + description: |- + addressName pins the claim to a specific Available IPAddress instead + of letting the controller match or the driver provision one — the + analogue of PersistentVolumeClaim.spec.volumeName. Only meaningful + for single-family claims. + type: string + className: + description: |- + className names the IPAddressClass to draw from. Empty means the + default class (the one annotated + ipaddressclass.local.sdn.cozystack.io/is-default-class: "true"). + type: string + family: + default: IPv4 + description: family selects the IP families requested. + enum: + - IPv4 + - IPv6 + - Dual + type: string + type: object + status: + description: IPAddressClaimStatus defines the observed state of IPAddressClaim. + properties: + addresses: + description: |- + addresses lists the bound addresses. A list deliberately: a Dual + claim binds a v4 and a v6 IPAddress and must report both. For a + single-family claim the list has one entry. + items: + description: BoundAddress reports one IPAddress bound to the claim. + properties: + address: + description: address is the IP itself — what the tenant reads + and puts in DNS. + type: string + name: + description: name of the bound IPAddress object. + type: string + required: + - address + - name + type: object + type: array + className: + description: |- + className is the class the claim resolved to. For claims created + without a className it records which default class was picked; the + resolution is sticky. + type: string + conditions: + description: |- + conditions represent the latest available observations of the + claim's state. + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + phase: + description: phase is the current lifecycle phase of the claim. + enum: + - Pending + - Bound + - Lost + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/config/crd/bases/local.sdn.cozystack.io_ipaddressclasses.yaml b/config/crd/bases/local.sdn.cozystack.io_ipaddressclasses.yaml new file mode 100644 index 0000000..4974bc4 --- /dev/null +++ b/config/crd/bases/local.sdn.cozystack.io_ipaddressclasses.yaml @@ -0,0 +1,89 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: ipaddressclasses.local.sdn.cozystack.io +spec: + group: local.sdn.cozystack.io + names: + kind: IPAddressClass + listKind: IPAddressClassList + plural: ipaddressclasses + singular: ipaddressclass + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .spec.provisioner + name: Provisioner + type: string + - jsonPath: .spec.reclaimPolicy + name: ReclaimPolicy + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + IPAddressClass describes an address source: which pool, which driver. + It is the StorageClass of the address model. Marking a class with the + annotation ipaddressclass.local.sdn.cozystack.io/is-default-class: "true" + makes it the class for claims that do not name one. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: IPAddressClassSpec defines the desired state of IPAddressClass. + properties: + parameters: + description: |- + parameters is an opaque, driver-specific configuration blob (for + example the address ranges to carve from). The core controller never + interprets it. + type: object + x-kubernetes-preserve-unknown-fields: true + provisioner: + description: |- + provisioner names the per-class driver that fulfils claims of this + class, exactly as StorageClass.provisioner names a CSI driver. The + core controller never provisions addresses itself; it stamps this + value onto pending claims so the named driver can pick them up. + minLength: 1 + type: string + x-kubernetes-validations: + - message: provisioner is immutable + rule: self == oldSelf + reclaimPolicy: + default: Retain + description: |- + reclaimPolicy is copied to IPAddress objects provisioned for this + class and governs what happens to them when their claim is deleted. + enum: + - Retain + - Delete + type: string + required: + - provisioner + type: object + type: object + served: true + storage: true + subresources: {} diff --git a/config/crd/bases/local.sdn.cozystack.io_ipaddresses.yaml b/config/crd/bases/local.sdn.cozystack.io_ipaddresses.yaml new file mode 100644 index 0000000..7960e3a --- /dev/null +++ b/config/crd/bases/local.sdn.cozystack.io_ipaddresses.yaml @@ -0,0 +1,246 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: ipaddresses.local.sdn.cozystack.io +spec: + group: local.sdn.cozystack.io + names: + kind: IPAddress + listKind: IPAddressList + plural: ipaddresses + singular: ipaddress + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .spec.address + name: Address + type: string + - jsonPath: .spec.className + name: Class + type: string + - jsonPath: .status.phase + name: Phase + type: string + - jsonPath: .spec.claimRef.namespace + name: ClaimNamespace + type: string + - jsonPath: .spec.claimRef.name + name: Claim + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + IPAddress is a concrete address the cluster owns — the inventory object, + the PersistentVolume of the address model. Created by a per-class driver + (or an admin, for static pre-provisioning), never by tenants. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: IPAddressSpec defines the desired state of IPAddress. + properties: + address: + description: |- + address is the IP address itself, in canonical textual form + (e.g. "203.0.113.7" or "2001:db8::7"). + minLength: 1 + type: string + x-kubernetes-validations: + - message: address is immutable + rule: self == oldSelf + claimRef: + description: |- + claimRef binds this address to a claim. Set either by the driver at + provisioning time (pre-bound) or by the core controller when it + matches an Available address to a claim. An address with no claimRef + is Available. After a Retain reclaim the field survives the claim + (phase Released) until an admin clears it. + properties: + name: + description: name of the claim. + minLength: 1 + type: string + namespace: + description: namespace of the claim. + minLength: 1 + type: string + uid: + description: |- + uid of the claim. A driver pre-binding an address may leave it empty; + the core controller completes it when it accepts the binding. + type: string + required: + - name + - namespace + type: object + className: + description: className names the IPAddressClass this address belongs + to. + minLength: 1 + type: string + reclaimPolicy: + default: Retain + description: |- + reclaimPolicy governs what happens to this object when its claim is + deleted; copied from the class at provisioning time. + enum: + - Retain + - Delete + type: string + source: + description: source records where the address came from. + properties: + fromClass: + description: fromClass marks the address as allocated from the + class's range. + type: object + providerRef: + description: |- + providerRef marks the address as adopted from a provider-side + reservation. + properties: + id: + description: |- + id is the provider-side stable handle of the reservation, for example + an AWS allocation id ("eipalloc-0a1b..."). + minLength: 1 + type: string + required: + - id + type: object + type: object + x-kubernetes-validations: + - message: exactly one of fromClass or providerRef must be set + rule: '(has(self.fromClass) ? 1 : 0) + (has(self.providerRef) ? + 1 : 0) == 1' + required: + - address + - className + - source + type: object + status: + description: IPAddressStatus defines the observed state of IPAddress. + properties: + associatedTo: + description: |- + associatedTo names the workload the address is currently announced + for. Nil means reserved but inert. Maintained by the per-class + driver, never by the core controller. + properties: + kind: + description: kind of the associated object, e.g. "Service". + minLength: 1 + type: string + name: + description: name of the associated object. + minLength: 1 + type: string + namespace: + description: namespace of the associated object. + minLength: 1 + type: string + required: + - kind + - name + - namespace + type: object + conditions: + description: |- + conditions represent the latest available observations of the + address's state. + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + phase: + description: phase is the current lifecycle phase of the address. + enum: + - Pending + - Available + - Bound + - Released + - Conflict + - Lost + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/config/crd/kustomization.yaml b/config/crd/kustomization.yaml new file mode 100644 index 0000000..99e9d69 --- /dev/null +++ b/config/crd/kustomization.yaml @@ -0,0 +1,18 @@ +# This kustomization.yaml is not intended to be run by itself, +# since it depends on service name and namespace that are out of this kustomize package. +# It should be run by config/default +resources: +- bases/local.sdn.cozystack.io_ipaddressclasses.yaml +- bases/local.sdn.cozystack.io_ipaddresses.yaml +- bases/local.sdn.cozystack.io_ipaddressclaims.yaml +# +kubebuilder:scaffold:crdkustomizeresource + +patches: +# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix. +# patches here are for enabling the conversion webhook for each CRD +# +kubebuilder:scaffold:crdkustomizewebhookpatch + +# [WEBHOOK] To enable webhook, uncomment the following section +# the following config is for teaching kustomize how to do kustomization for CRDs. +#configurations: +#- kustomizeconfig.yaml diff --git a/config/crd/kustomizeconfig.yaml b/config/crd/kustomizeconfig.yaml new file mode 100644 index 0000000..ec5c150 --- /dev/null +++ b/config/crd/kustomizeconfig.yaml @@ -0,0 +1,19 @@ +# This file is for teaching kustomize how to substitute name and namespace reference in CRD +nameReference: +- kind: Service + version: v1 + fieldSpecs: + - kind: CustomResourceDefinition + version: v1 + group: apiextensions.k8s.io + path: spec/conversion/webhook/clientConfig/service/name + +namespace: +- kind: CustomResourceDefinition + version: v1 + group: apiextensions.k8s.io + path: spec/conversion/webhook/clientConfig/service/namespace + create: false + +varReference: +- path: metadata/annotations diff --git a/config/default/cert_metrics_manager_patch.yaml b/config/default/cert_metrics_manager_patch.yaml new file mode 100644 index 0000000..d975015 --- /dev/null +++ b/config/default/cert_metrics_manager_patch.yaml @@ -0,0 +1,30 @@ +# This patch adds the args, volumes, and ports to allow the manager to use the metrics-server certs. + +# Add the volumeMount for the metrics-server certs +- op: add + path: /spec/template/spec/containers/0/volumeMounts/- + value: + mountPath: /tmp/k8s-metrics-server/metrics-certs + name: metrics-certs + readOnly: true + +# Add the --metrics-cert-path argument for the metrics server +- op: add + path: /spec/template/spec/containers/0/args/- + value: --metrics-cert-path=/tmp/k8s-metrics-server/metrics-certs + +# Add the metrics-server certs volume configuration +- op: add + path: /spec/template/spec/volumes/- + value: + name: metrics-certs + secret: + secretName: metrics-server-cert + optional: false + items: + - key: ca.crt + path: ca.crt + - key: tls.crt + path: tls.crt + - key: tls.key + path: tls.key diff --git a/config/default/kustomization.yaml b/config/default/kustomization.yaml new file mode 100644 index 0000000..3035c26 --- /dev/null +++ b/config/default/kustomization.yaml @@ -0,0 +1,212 @@ +# Adds namespace to all resources. +namespace: address-controller-system + +# Value of this field is prepended to the +# names of all resources, e.g. a deployment named +# "wordpress" becomes "alices-wordpress". +# Note that it should also match with the prefix (text before '-') of the namespace +# field above. +namePrefix: address-controller- + +# Labels to add to all resources and selectors. +#labels: +#- includeSelectors: true +# pairs: +# someName: someValue + +resources: +- ../crd +- ../rbac +- ../manager +# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in +# crd/kustomization.yaml +#- ../webhook +# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required. +#- ../certmanager +# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'. +#- ../prometheus +# [METRICS] Expose the controller manager metrics service. +- metrics_service.yaml +# [NETWORK POLICY] Protect the /metrics endpoint and Webhook Server with NetworkPolicy. +# Only Pod(s) running a namespace labeled with 'metrics: enabled' will be able to gather the metrics. +# Only CR(s) which requires webhooks and are applied on namespaces labeled with 'webhooks: enabled' will +# be able to communicate with the Webhook Server. +#- ../network-policy + +# Uncomment the patches line if you enable Metrics +patches: +# [METRICS] The following patch will enable the metrics endpoint using HTTPS and the port :8443. +# More info: https://book.kubebuilder.io/reference/metrics +- path: manager_metrics_patch.yaml + target: + kind: Deployment + +# Uncomment the patches line if you enable Metrics and CertManager +# [METRICS-WITH-CERTS] To enable metrics protected with certManager, uncomment the following line. +# This patch will protect the metrics with certManager self-signed certs. +#- path: cert_metrics_manager_patch.yaml +# target: +# kind: Deployment + +# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in +# crd/kustomization.yaml +#- path: manager_webhook_patch.yaml +# target: +# kind: Deployment + +# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix. +# Uncomment the following replacements to add the cert-manager CA injection annotations +#replacements: +# - source: # Uncomment the following block to enable certificates for metrics +# kind: Service +# version: v1 +# name: controller-manager-metrics-service +# fieldPath: metadata.name +# targets: +# - select: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: metrics-certs +# fieldPaths: +# - spec.dnsNames.0 +# - spec.dnsNames.1 +# options: +# delimiter: '.' +# index: 0 +# create: true +# +# - source: +# kind: Service +# version: v1 +# name: controller-manager-metrics-service +# fieldPath: metadata.namespace +# targets: +# - select: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: metrics-certs +# fieldPaths: +# - spec.dnsNames.0 +# - spec.dnsNames.1 +# options: +# delimiter: '.' +# index: 1 +# create: true +# +# - source: # Uncomment the following block if you have any webhook +# kind: Service +# version: v1 +# name: webhook-service +# fieldPath: .metadata.name # Name of the service +# targets: +# - select: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPaths: +# - .spec.dnsNames.0 +# - .spec.dnsNames.1 +# options: +# delimiter: '.' +# index: 0 +# create: true +# - source: +# kind: Service +# version: v1 +# name: webhook-service +# fieldPath: .metadata.namespace # Namespace of the service +# targets: +# - select: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPaths: +# - .spec.dnsNames.0 +# - .spec.dnsNames.1 +# options: +# delimiter: '.' +# index: 1 +# create: true +# +# - source: # Uncomment the following block if you have a ValidatingWebhook (--programmatic-validation) +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert # This name should match the one in certificate.yaml +# fieldPath: .metadata.namespace # Namespace of the certificate CR +# targets: +# - select: +# kind: ValidatingWebhookConfiguration +# fieldPaths: +# - .metadata.annotations.[cert-manager.io/inject-ca-from] +# options: +# delimiter: '/' +# index: 0 +# create: true +# - source: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPath: .metadata.name +# targets: +# - select: +# kind: ValidatingWebhookConfiguration +# fieldPaths: +# - .metadata.annotations.[cert-manager.io/inject-ca-from] +# options: +# delimiter: '/' +# index: 1 +# create: true +# +# - source: # Uncomment the following block if you have a DefaultingWebhook (--defaulting ) +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPath: .metadata.namespace # Namespace of the certificate CR +# targets: +# - select: +# kind: MutatingWebhookConfiguration +# fieldPaths: +# - .metadata.annotations.[cert-manager.io/inject-ca-from] +# options: +# delimiter: '/' +# index: 0 +# create: true +# - source: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPath: .metadata.name +# targets: +# - select: +# kind: MutatingWebhookConfiguration +# fieldPaths: +# - .metadata.annotations.[cert-manager.io/inject-ca-from] +# options: +# delimiter: '/' +# index: 1 +# create: true +# +# - source: # Uncomment the following block if you have a ConversionWebhook (--conversion) +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPath: .metadata.namespace # Namespace of the certificate CR +# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD. +# +kubebuilder:scaffold:crdkustomizecainjectionns +# - source: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPath: .metadata.name +# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD. +# +kubebuilder:scaffold:crdkustomizecainjectionname diff --git a/config/default/manager_metrics_patch.yaml b/config/default/manager_metrics_patch.yaml new file mode 100644 index 0000000..2aaef65 --- /dev/null +++ b/config/default/manager_metrics_patch.yaml @@ -0,0 +1,4 @@ +# This patch adds the args to allow exposing the metrics endpoint using HTTPS +- op: add + path: /spec/template/spec/containers/0/args/0 + value: --metrics-bind-address=:8443 diff --git a/config/default/metrics_service.yaml b/config/default/metrics_service.yaml new file mode 100644 index 0000000..1d73017 --- /dev/null +++ b/config/default/metrics_service.yaml @@ -0,0 +1,18 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + control-plane: controller-manager + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize + name: controller-manager-metrics-service + namespace: system +spec: + ports: + - name: https + port: 8443 + protocol: TCP + targetPort: 8443 + selector: + control-plane: controller-manager + app.kubernetes.io/name: address-controller diff --git a/config/manager/kustomization.yaml b/config/manager/kustomization.yaml new file mode 100644 index 0000000..5c5f0b8 --- /dev/null +++ b/config/manager/kustomization.yaml @@ -0,0 +1,2 @@ +resources: +- manager.yaml diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml new file mode 100644 index 0000000..0b99264 --- /dev/null +++ b/config/manager/manager.yaml @@ -0,0 +1,98 @@ +apiVersion: v1 +kind: Namespace +metadata: + labels: + control-plane: controller-manager + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize + name: system +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: controller-manager + namespace: system + labels: + control-plane: controller-manager + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize +spec: + selector: + matchLabels: + control-plane: controller-manager + app.kubernetes.io/name: address-controller + replicas: 1 + template: + metadata: + annotations: + kubectl.kubernetes.io/default-container: manager + labels: + control-plane: controller-manager + app.kubernetes.io/name: address-controller + spec: + # TODO(user): Uncomment the following code to configure the nodeAffinity expression + # according to the platforms which are supported by your solution. + # It is considered best practice to support multiple architectures. You can + # build your manager image using the makefile target docker-buildx. + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: kubernetes.io/arch + # operator: In + # values: + # - amd64 + # - arm64 + # - ppc64le + # - s390x + # - key: kubernetes.io/os + # operator: In + # values: + # - linux + securityContext: + # Projects are configured by default to adhere to the "restricted" Pod Security Standards. + # This ensures that deployments meet the highest security requirements for Kubernetes. + # For more details, see: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + containers: + - command: + - /manager + args: + - --leader-elect + - --health-probe-bind-address=:8081 + image: controller:latest + name: manager + ports: [] + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - "ALL" + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + # TODO(user): Configure the resources accordingly based on the project requirements. + # More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 10m + memory: 64Mi + volumeMounts: [] + volumes: [] + serviceAccountName: controller-manager + terminationGracePeriodSeconds: 10 diff --git a/config/network-policy/allow-metrics-traffic.yaml b/config/network-policy/allow-metrics-traffic.yaml new file mode 100644 index 0000000..ee4f80f --- /dev/null +++ b/config/network-policy/allow-metrics-traffic.yaml @@ -0,0 +1,27 @@ +# This NetworkPolicy allows ingress traffic +# with Pods running on namespaces labeled with 'metrics: enabled'. Only Pods on those +# namespaces are able to gather data from the metrics endpoint. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize + name: allow-metrics-traffic + namespace: system +spec: + podSelector: + matchLabels: + control-plane: controller-manager + app.kubernetes.io/name: address-controller + policyTypes: + - Ingress + ingress: + # This allows ingress traffic from any namespace with the label metrics: enabled + - from: + - namespaceSelector: + matchLabels: + metrics: enabled # Only from namespaces with this label + ports: + - port: 8443 + protocol: TCP diff --git a/config/network-policy/kustomization.yaml b/config/network-policy/kustomization.yaml new file mode 100644 index 0000000..ec0fb5e --- /dev/null +++ b/config/network-policy/kustomization.yaml @@ -0,0 +1,2 @@ +resources: +- allow-metrics-traffic.yaml diff --git a/config/prometheus/kustomization.yaml b/config/prometheus/kustomization.yaml new file mode 100644 index 0000000..fdc5481 --- /dev/null +++ b/config/prometheus/kustomization.yaml @@ -0,0 +1,11 @@ +resources: +- monitor.yaml + +# [PROMETHEUS-WITH-CERTS] The following patch configures the ServiceMonitor in ../prometheus +# to securely reference certificates created and managed by cert-manager. +# Additionally, ensure that you uncomment the [METRICS WITH CERTMANAGER] patch under config/default/kustomization.yaml +# to mount the "metrics-server-cert" secret in the Manager Deployment. +#patches: +# - path: monitor_tls_patch.yaml +# target: +# kind: ServiceMonitor diff --git a/config/prometheus/monitor.yaml b/config/prometheus/monitor.yaml new file mode 100644 index 0000000..81bdff6 --- /dev/null +++ b/config/prometheus/monitor.yaml @@ -0,0 +1,27 @@ +# Prometheus Monitor Service (Metrics) +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + labels: + control-plane: controller-manager + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize + name: controller-manager-metrics-monitor + namespace: system +spec: + endpoints: + - path: /metrics + port: https # Ensure this is the name of the port that exposes HTTPS metrics + scheme: https + bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token + tlsConfig: + # TODO(user): The option insecureSkipVerify: true is not recommended for production since it disables + # certificate verification, exposing the system to potential man-in-the-middle attacks. + # For production environments, it is recommended to use cert-manager for automatic TLS certificate management. + # To apply this configuration, enable cert-manager and use the patch located at config/prometheus/servicemonitor_tls_patch.yaml, + # which securely references the certificate from the 'metrics-server-cert' secret. + insecureSkipVerify: true + selector: + matchLabels: + control-plane: controller-manager + app.kubernetes.io/name: address-controller diff --git a/config/prometheus/monitor_tls_patch.yaml b/config/prometheus/monitor_tls_patch.yaml new file mode 100644 index 0000000..e824dd0 --- /dev/null +++ b/config/prometheus/monitor_tls_patch.yaml @@ -0,0 +1,22 @@ +# Patch for Prometheus ServiceMonitor to enable secure TLS configuration +# using certificates managed by cert-manager +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: controller-manager-metrics-monitor + namespace: system +spec: + endpoints: + - tlsConfig: + insecureSkipVerify: false + ca: + secret: + name: metrics-server-cert + key: ca.crt + cert: + secret: + name: metrics-server-cert + key: tls.crt + keySecret: + name: metrics-server-cert + key: tls.key diff --git a/config/rbac/ipaddress_admin_role.yaml b/config/rbac/ipaddress_admin_role.yaml new file mode 100644 index 0000000..b67601d --- /dev/null +++ b/config/rbac/ipaddress_admin_role.yaml @@ -0,0 +1,27 @@ +# This rule is not used by the project address-controller itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants full permissions ('*') over local.sdn.cozystack.io. +# This role is intended for users authorized to modify roles and bindings within the cluster, +# enabling them to delegate specific permissions to other users or groups as needed. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize + name: ipaddress-admin-role +rules: +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddresses + verbs: + - '*' +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddresses/status + verbs: + - get diff --git a/config/rbac/ipaddress_editor_role.yaml b/config/rbac/ipaddress_editor_role.yaml new file mode 100644 index 0000000..b5941ef --- /dev/null +++ b/config/rbac/ipaddress_editor_role.yaml @@ -0,0 +1,33 @@ +# This rule is not used by the project address-controller itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants permissions to create, update, and delete resources within the local.sdn.cozystack.io. +# This role is intended for users who need to manage these resources +# but should not control RBAC or manage permissions for others. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize + name: ipaddress-editor-role +rules: +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddresses + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddresses/status + verbs: + - get diff --git a/config/rbac/ipaddress_viewer_role.yaml b/config/rbac/ipaddress_viewer_role.yaml new file mode 100644 index 0000000..bd29a46 --- /dev/null +++ b/config/rbac/ipaddress_viewer_role.yaml @@ -0,0 +1,29 @@ +# This rule is not used by the project address-controller itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants read-only access to local.sdn.cozystack.io resources. +# This role is intended for users who need visibility into these resources +# without permissions to modify them. It is ideal for monitoring purposes and limited-access viewing. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize + name: ipaddress-viewer-role +rules: +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddresses + verbs: + - get + - list + - watch +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddresses/status + verbs: + - get diff --git a/config/rbac/ipaddressclaim_admin_role.yaml b/config/rbac/ipaddressclaim_admin_role.yaml new file mode 100644 index 0000000..7a16d20 --- /dev/null +++ b/config/rbac/ipaddressclaim_admin_role.yaml @@ -0,0 +1,27 @@ +# This rule is not used by the project address-controller itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants full permissions ('*') over local.sdn.cozystack.io. +# This role is intended for users authorized to modify roles and bindings within the cluster, +# enabling them to delegate specific permissions to other users or groups as needed. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize + name: ipaddressclaim-admin-role +rules: +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddressclaims + verbs: + - '*' +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddressclaims/status + verbs: + - get diff --git a/config/rbac/ipaddressclaim_editor_role.yaml b/config/rbac/ipaddressclaim_editor_role.yaml new file mode 100644 index 0000000..70f9947 --- /dev/null +++ b/config/rbac/ipaddressclaim_editor_role.yaml @@ -0,0 +1,33 @@ +# This rule is not used by the project address-controller itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants permissions to create, update, and delete resources within the local.sdn.cozystack.io. +# This role is intended for users who need to manage these resources +# but should not control RBAC or manage permissions for others. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize + name: ipaddressclaim-editor-role +rules: +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddressclaims + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddressclaims/status + verbs: + - get diff --git a/config/rbac/ipaddressclaim_viewer_role.yaml b/config/rbac/ipaddressclaim_viewer_role.yaml new file mode 100644 index 0000000..656241f --- /dev/null +++ b/config/rbac/ipaddressclaim_viewer_role.yaml @@ -0,0 +1,29 @@ +# This rule is not used by the project address-controller itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants read-only access to local.sdn.cozystack.io resources. +# This role is intended for users who need visibility into these resources +# without permissions to modify them. It is ideal for monitoring purposes and limited-access viewing. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize + name: ipaddressclaim-viewer-role +rules: +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddressclaims + verbs: + - get + - list + - watch +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddressclaims/status + verbs: + - get diff --git a/config/rbac/ipaddressclass_admin_role.yaml b/config/rbac/ipaddressclass_admin_role.yaml new file mode 100644 index 0000000..f78253d --- /dev/null +++ b/config/rbac/ipaddressclass_admin_role.yaml @@ -0,0 +1,27 @@ +# This rule is not used by the project address-controller itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants full permissions ('*') over local.sdn.cozystack.io. +# This role is intended for users authorized to modify roles and bindings within the cluster, +# enabling them to delegate specific permissions to other users or groups as needed. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize + name: ipaddressclass-admin-role +rules: +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddressclasses + verbs: + - '*' +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddressclasses/status + verbs: + - get diff --git a/config/rbac/ipaddressclass_editor_role.yaml b/config/rbac/ipaddressclass_editor_role.yaml new file mode 100644 index 0000000..a2ebb15 --- /dev/null +++ b/config/rbac/ipaddressclass_editor_role.yaml @@ -0,0 +1,33 @@ +# This rule is not used by the project address-controller itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants permissions to create, update, and delete resources within the local.sdn.cozystack.io. +# This role is intended for users who need to manage these resources +# but should not control RBAC or manage permissions for others. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize + name: ipaddressclass-editor-role +rules: +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddressclasses + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddressclasses/status + verbs: + - get diff --git a/config/rbac/ipaddressclass_viewer_role.yaml b/config/rbac/ipaddressclass_viewer_role.yaml new file mode 100644 index 0000000..4a122ad --- /dev/null +++ b/config/rbac/ipaddressclass_viewer_role.yaml @@ -0,0 +1,29 @@ +# This rule is not used by the project address-controller itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants read-only access to local.sdn.cozystack.io resources. +# This role is intended for users who need visibility into these resources +# without permissions to modify them. It is ideal for monitoring purposes and limited-access viewing. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize + name: ipaddressclass-viewer-role +rules: +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddressclasses + verbs: + - get + - list + - watch +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddressclasses/status + verbs: + - get diff --git a/config/rbac/kustomization.yaml b/config/rbac/kustomization.yaml new file mode 100644 index 0000000..fd3d4af --- /dev/null +++ b/config/rbac/kustomization.yaml @@ -0,0 +1,34 @@ +resources: +# All RBAC will be applied under this service account in +# the deployment namespace. You may comment out this resource +# if your manager will use a service account that exists at +# runtime. Be sure to update RoleBinding and ClusterRoleBinding +# subjects if changing service account names. +- service_account.yaml +- role.yaml +- role_binding.yaml +- leader_election_role.yaml +- leader_election_role_binding.yaml +# The following RBAC configurations are used to protect +# the metrics endpoint with authn/authz. These configurations +# ensure that only authorized users and service accounts +# can access the metrics endpoint. Comment the following +# permissions if you want to disable this protection. +# More info: https://book.kubebuilder.io/reference/metrics.html +- metrics_auth_role.yaml +- metrics_auth_role_binding.yaml +- metrics_reader_role.yaml +# For each CRD, "Admin", "Editor" and "Viewer" roles are scaffolded by +# default, aiding admins in cluster management. Those roles are +# not used by the {{ .ProjectName }} itself. You can comment the following lines +# if you do not want those helpers be installed with your Project. +- ipaddressclaim_admin_role.yaml +- ipaddressclaim_editor_role.yaml +- ipaddressclaim_viewer_role.yaml +- ipaddress_admin_role.yaml +- ipaddress_editor_role.yaml +- ipaddress_viewer_role.yaml +- ipaddressclass_admin_role.yaml +- ipaddressclass_editor_role.yaml +- ipaddressclass_viewer_role.yaml + diff --git a/config/rbac/leader_election_role.yaml b/config/rbac/leader_election_role.yaml new file mode 100644 index 0000000..e6363a4 --- /dev/null +++ b/config/rbac/leader_election_role.yaml @@ -0,0 +1,40 @@ +# permissions to do leader election. +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize + name: leader-election-role +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch diff --git a/config/rbac/leader_election_role_binding.yaml b/config/rbac/leader_election_role_binding.yaml new file mode 100644 index 0000000..b172841 --- /dev/null +++ b/config/rbac/leader_election_role_binding.yaml @@ -0,0 +1,15 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize + name: leader-election-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: leader-election-role +subjects: +- kind: ServiceAccount + name: controller-manager + namespace: system diff --git a/config/rbac/metrics_auth_role.yaml b/config/rbac/metrics_auth_role.yaml new file mode 100644 index 0000000..32d2e4e --- /dev/null +++ b/config/rbac/metrics_auth_role.yaml @@ -0,0 +1,17 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: metrics-auth-role +rules: +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create diff --git a/config/rbac/metrics_auth_role_binding.yaml b/config/rbac/metrics_auth_role_binding.yaml new file mode 100644 index 0000000..e775d67 --- /dev/null +++ b/config/rbac/metrics_auth_role_binding.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: metrics-auth-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: metrics-auth-role +subjects: +- kind: ServiceAccount + name: controller-manager + namespace: system diff --git a/config/rbac/metrics_reader_role.yaml b/config/rbac/metrics_reader_role.yaml new file mode 100644 index 0000000..51a75db --- /dev/null +++ b/config/rbac/metrics_reader_role.yaml @@ -0,0 +1,9 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: metrics-reader +rules: +- nonResourceURLs: + - "/metrics" + verbs: + - get diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml new file mode 100644 index 0000000..14e13f2 --- /dev/null +++ b/config/rbac/role.yaml @@ -0,0 +1,58 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: manager-role +rules: +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddressclaims + verbs: + - get + - list + - patch + - update + - watch +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddressclaims/finalizers + - ipaddresses/finalizers + verbs: + - update +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddressclaims/status + - ipaddresses/status + verbs: + - get + - patch + - update +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddressclasses + verbs: + - get + - list + - watch +- apiGroups: + - local.sdn.cozystack.io + resources: + - ipaddresses + verbs: + - delete + - get + - list + - patch + - update + - watch diff --git a/config/rbac/role_binding.yaml b/config/rbac/role_binding.yaml new file mode 100644 index 0000000..6199107 --- /dev/null +++ b/config/rbac/role_binding.yaml @@ -0,0 +1,15 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize + name: manager-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: manager-role +subjects: +- kind: ServiceAccount + name: controller-manager + namespace: system diff --git a/config/rbac/service_account.yaml b/config/rbac/service_account.yaml new file mode 100644 index 0000000..22a04d2 --- /dev/null +++ b/config/rbac/service_account.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize + name: controller-manager + namespace: system diff --git a/config/samples/kustomization.yaml b/config/samples/kustomization.yaml new file mode 100644 index 0000000..0327ba2 --- /dev/null +++ b/config/samples/kustomization.yaml @@ -0,0 +1,6 @@ +## Append samples of your project ## +resources: +- local_v1alpha1_ipaddressclass.yaml +- local_v1alpha1_ipaddress.yaml +- local_v1alpha1_ipaddressclaim.yaml +# +kubebuilder:scaffold:manifestskustomizesamples diff --git a/config/samples/local_v1alpha1_ipaddress.yaml b/config/samples/local_v1alpha1_ipaddress.yaml new file mode 100644 index 0000000..de49d14 --- /dev/null +++ b/config/samples/local_v1alpha1_ipaddress.yaml @@ -0,0 +1,16 @@ +apiVersion: local.sdn.cozystack.io/v1alpha1 +kind: IPAddress +metadata: + labels: + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize + name: ip-203-0-113-7 +spec: + className: public + address: 203.0.113.7 + reclaimPolicy: Retain + claimRef: + namespace: default + name: web + source: + fromClass: {} diff --git a/config/samples/local_v1alpha1_ipaddressclaim.yaml b/config/samples/local_v1alpha1_ipaddressclaim.yaml new file mode 100644 index 0000000..c80e5b7 --- /dev/null +++ b/config/samples/local_v1alpha1_ipaddressclaim.yaml @@ -0,0 +1,10 @@ +apiVersion: local.sdn.cozystack.io/v1alpha1 +kind: IPAddressClaim +metadata: + labels: + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize + name: web +spec: + className: public + family: IPv4 diff --git a/config/samples/local_v1alpha1_ipaddressclass.yaml b/config/samples/local_v1alpha1_ipaddressclass.yaml new file mode 100644 index 0000000..53e4848 --- /dev/null +++ b/config/samples/local_v1alpha1_ipaddressclass.yaml @@ -0,0 +1,14 @@ +apiVersion: local.sdn.cozystack.io/v1alpha1 +kind: IPAddressClass +metadata: + labels: + app.kubernetes.io/name: address-controller + app.kubernetes.io/managed-by: kustomize + name: public + annotations: + ipaddressclass.local.sdn.cozystack.io/is-default-class: "true" +spec: + provisioner: metallb.drivers.local.sdn.cozystack.io + reclaimPolicy: Retain + parameters: + addresses: ["203.0.113.0/24"] diff --git a/docs/design.md b/docs/design.md new file mode 100644 index 0000000..839509d --- /dev/null +++ b/docs/design.md @@ -0,0 +1,430 @@ +# Design: the core address-binding controller + +- **Component:** `address-controller` — the class-agnostic core of "IP + addresses as a first-class resource" + ([cozystack/community#35](https://github.com/cozystack/community/pull/35)) +- **API group:** `local.sdn.cozystack.io/v1alpha1` +- **Status:** implemented (alpha) + +This document records the contract: the resource model, the two state +machines the core drives, the exact reconciliation algorithms, and the +obligations a per-class driver must meet. It is the reference against which +drivers (such as [metallb-iad](https://github.com/lllamnyp/metallb-iad)) +are written. + +## 1. Scope + +The core is the analog of the generic PVC/PV binding controller in the +storage subsystem. It owns: + +- resolving a claim to a class, +- accepting and completing claim–address bindings, +- matching pre-provisioned addresses to claims, +- phase and condition bookkeeping on both sides, +- finalizer-driven reclaim when a claim is deleted. + +It never allocates an address, never interprets class parameters, never +touches a Service, and never talks to a backend. Everything +backend-specific is a per-class driver's job, in a separate deployment, +discovered through the class's `spec.provisioner` — exactly as a +StorageClass names a CSI driver. + +## 2. Resource model + +| storage analog | kind | scope | one-line role | +|---|---|---|---| +| `StorageClass` | `IPAddressClass` | cluster | which pool, which driver, which reclaim policy | +| `PersistentVolume` | `IPAddress` | cluster | one concrete IP: the reservation and the inventory record | +| `PersistentVolumeClaim` | `IPAddressClaim` | namespaced | "give me one" — the whole tenant-facing API | + +### IPAddressClass + +- `spec.provisioner` (immutable) — the driver that fulfils claims of this + class. +- `spec.reclaimPolicy` — `Retain` (default) or `Delete`; copied onto each + provisioned `IPAddress`, where it takes effect. What each policy + actually reclaims — the API object, the ledger entry, backend state — + is spelled out in §6. +- `spec.parameters` — an opaque object (unknown fields preserved), never + read by the core. Shape is defined by the driver. +- The annotation `ipaddressclass.local.sdn.cozystack.io/is-default-class: + "true"` marks the class used by claims that name none. + +### IPAddress + +- `spec.address` (immutable) — the IP, one per object. The object **is** + the reservation. + + *Why spec and not status:* the split here is request vs. record, not + desired vs. observed. The **claim** is the request; an `IPAddress` is + created only after an allocation is a fact — the driver performs or + observes the backend operation first (carve from a range, allocate at + a provider, adopt an existing reservation) and then records the + result. The address is therefore always known at creation, and there + is no observe-later phase for a status field to serve: an `IPAddress` + is never a pending request for an address (that is what a `Pending` + claim is), it is the ledger entry for one that exists. + + Given that, the field must provide *identity*, and identity cannot + live in status. The object's name derives from the IP, one-object- + per-IP is enforced by create-time collision on exactly this value, and + conflict detection indexes it — all of which needs the value present + from the first moment and immutable for the object's life. Status is + the opposite by design: mutable, and legitimately absent at any moment + (wiped status must be reconstructible from the world). For the + `providerRef` arm the IP genuinely *is* re-observable — describe + `eipalloc-…` and read it back — but for the `fromClass` arm the ledger + entry is the only record in existence, and a union shares one schema: + the arm with nothing to re-observe from decides the placement. The + closest precedent is `Service.spec.clusterIP`: allocated by the + system, not the user, yet spec — because it is an allocation result + the system *commits to* and everything downstream references, not an + observation that may drift. (Cluster API's IPAM contract records the + address in spec likewise; KEP-1880 goes further and puts it in the + object name.) + + Note what this does **not** imply: a provider where the IP cannot be + *chosen* at allocation time — AWS hands you whatever `AllocateAddress` + returns — is fully supported. Choosing at allocation is not the Pin + capability; Pin is attaching a specific *already-reserved* address to + a workload at association time, which such providers do natively + (associate by the `eipalloc-…` handle). The driver allocates, observes + the handle and the IP, and records both (`spec.address`, + `spec.source.providerRef`). Only a backend with no pin mechanism at + all — nothing that says "use this reserved address" at association + time — is disqualified, because a reservation that can never be + re-attached is not a reservation. +- `spec.className` — the class it belongs to. +- `spec.claimRef` `{namespace, name, uid}` — the binding. `uid` may be + empty at creation (a driver pre-binding); the core completes it. This + field is the *single authoritative record* of a binding; everything else + (claim status, phases) is derived from it. +- `spec.reclaimPolicy` — what happens to this object when its claim goes. +- `spec.source` — a union, exactly one member set: + - `fromClass: {}` — the driver carved it from the class's range; the + driver is the IPAM of record; + - `providerRef: {id}` — a reservation held by an external provider + under the provider's own IAM, recorded here by its stable handle — + whether the driver allocated it at the provider on demand or adopted + one that already existed. +- `status.phase` — see the state machine below. +- `status.associatedTo` — the workload the address is currently announced + for. `nil` means *reserved but inert*: held, attached to nothing. + Written by drivers only. + +### IPAddressClaim + +- `spec.className` — empty means the default class. +- `spec.family` — `IPv4` | `IPv6` | `Dual`. `Dual` binds two addresses. +- `spec.addressName` — optional pre-binding to one specific `Available` + address (the `PVC.spec.volumeName` analog); meaningful for single-family + claims. +- `status.phase` — `Pending` | `Bound` | `Lost`. +- `status.className` — the sticky record of which class the claim resolved + to (see §4 step 6). +- `status.addresses` — a list of `{name, address}`, one entry per bound + `IPAddress`, so a `Dual` claim reports both families. This is what a + tenant reads and puts in DNS. + +## 3. Ownership: who writes what + +The contract is largely a discipline about who may write which field. + +| field | tenant | admin | core | driver | +|---|---|---|---|---| +| `Claim.spec` | ✍ creates/edits | | | | +| `Claim` provisioner annotation | | | ✍ stamps | reads | +| `Claim.status.*` | | | ✍ | never | +| `Claim` protection finalizer | | | ✍ | | +| `Address` object creation | | ✍ (static pre-provisioning) | never | ✍ (provisioning) | +| `Address.spec.claimRef` | | ✍ may clear on `Released` | ✍ sets on match / completes uid | ✍ pre-sets at creation only | +| `Address.status.phase`: `Available`/`Bound`/`Released` | | | ✍ | never | +| `Address.status.phase`: `Conflict`/`Lost` | | | never (sticky) | ✍ sets and clears | +| `Address.status.associatedTo` | | | never | ✍ | +| `Address` protection finalizer | | | ✍ | | +| `Address` driver finalizer(s) | | | | ✍ | +| `IPAddressClass` | | ✍ | reads | reads (incl. parameters) | + +Two invariants fall out of this table: + +1. **One binding record.** `Address.spec.claimRef` is the only place a + binding lives. `Claim.status.addresses` is a projection of it, always + recomputed, never authoritative. +2. **Phase partition.** `Available`, `Bound`, `Released` belong to the + core; `Conflict` and `Lost` belong to drivers, and the core treats them + as sticky — it neither enters nor leaves them. This is what lets a + driver flag backend-level facts (a collision, a lost provider + reservation) without racing the core's bookkeeping. + +## 4. The claim reconciliation algorithm + +State machine: + +``` + class resolved & all requested families + no address yet bound & not Lost + (new) ──────► Pending ─────────────────► Bound + ▲ │ + │ (never: Lost is │ a bound address + │ not re-entered ▼ disappears / goes Lost + │ from Pending) Lost + └────────────────────────┘ + all families satisfied again +``` + +Each reconcile pass runs the following sequence. Every step is +idempotent; the pass re-derives everything from the cluster state. + +1. **Deletion?** If the claim is being deleted, run the *reclaim flow* + (§6) and stop. +2. **Protection.** Ensure the claim carries the + `local.sdn.cozystack.io/claim-protection` finalizer, so deletion always + passes through the reclaim flow. +3. **Collect bound addresses.** All `IPAddress` objects whose `claimRef` + names this claim's namespace/name, and whose `claimRef.uid` is either + empty or equal to the claim's UID. A UID *mismatch* means the address + is bound to an earlier, deleted claim that happened to have the same + name — a stale binding. It is never adopted; the address reconciler + reclaims it (§5 step 6). +4. **Complete pre-bindings.** For collected addresses with an empty + `claimRef.uid` (a driver pre-bound them at creation), write the claim's + UID. This is the core's acceptance of the driver's provisioning. +5. **Anything missing?** Expand `spec.family` into concrete families + (`Dual` → v4 + v6); a family is satisfied if some collected address of + that family exists and is not in phase `Lost`. **If every family is + satisfied, skip straight to status (step 8) — the class is not + consulted at all.** Binding state comes strictly before class state: + a fully bound claim needs nothing from its class, so a deleted class + never disturbs existing bindings (see *Class deletion* below). +6. **Class resolution** (only reached with families missing). Resolve a + class name, trying in order: + 1. `spec.className`, if set (an explicit spec always wins); + 2. `status.className` — the sticky record of a previous resolution, so + a claim that resolved against a default class does not flap when the + default annotation moves; + 3. the *default class*: the exactly-one `IPAddressClass` annotated as + default. Zero or more than one is a terminal condition for this pass + (`NoDefaultClass` / `MultipleDefaultClasses` on the `ClassResolved` + condition); the claim is retried when any class changes. The core + deliberately refuses to guess among multiple defaults. + + The named class must exist (`ClassNotFound` condition otherwise; the + pass still falls through to step 8 so phase and addresses stay + maintained). On success the core **stamps** the claim with the + annotation `local.sdn.cozystack.io/provisioner: + `. The stamp always mirrors the resolved + class — if a claim is re-targeted at a different class before binding, + the stamp follows. This annotation is the driver's watch key; it is + how a driver knows a claim is its to serve without ever resolving + classes itself. +7. **Match, per missing family.** For each unsatisfied family: + - candidate set: if `spec.addressName` is set, only that object; + otherwise every address in phase `Available` (so: no `claimRef`, and + already accepted by the address reconciler) with the resolved class + and the wanted family; + - bind the candidate with the lexicographically smallest name by + writing `claimRef {namespace, name, uid}`. Determinism makes + concurrent controllers converge; optimistic concurrency resolves + races (the loser's write fails, it re-lists and takes the next + candidate); + - no candidate → the family stays unsatisfied and the claim waits for + its driver to provision. +8. **Status.** Recompute from scratch: + - all families satisfied → `Bound`; + - previously `Bound` (or `Lost`) and now unsatisfied → `Lost` — a + binding degraded, which is surfaced, never silently re-provisioned + around; the claim returns to `Bound` by itself if the address comes + back; + - otherwise `Pending`, with the `Bound` condition explaining what it + waits for (`WaitingForProvisioning` names the stamped provisioner). + `status.addresses` lists every collected address (name + IP), sorted + by object name. `status.className` records the resolution when one + happened this pass and is left untouched otherwise. + +**Class deletion.** The class is load-bearing only at two moments: +resolving/stamping an unbound claim, and matching or provisioning *new* +bindings. Everything downstream deliberately avoids depending on it: +satisfied claims skip class resolution entirely (step 5), reclaim reads +the `reclaimPolicy` **copied onto each address** at provisioning time +(§6), and the address reconciler never reads classes at all. So deleting +an `IPAddressClass` — or restarting the controller after its deletion — +leaves every existing binding, every reclaim, and all status upkeep +intact; the only effect is that still-unbound claims of that class stop +progressing, honestly reported as `Pending` with `ClassNotFound`. + +## 5. The address reconciliation algorithm + +State machine (core-owned transitions solid, driver-owned dashed): + +``` + (new) ──► Pending ──► Available ◄────────────────┐ + (invalid │ │ ▲ │ admin clears + address │ core matches / driver │ claimRef + stays │ pre-binds + core accepts │ + Pending) │ ▼ │ │ + │ Bound ───────────────► Released + │ ┆ claim deleted │ + │ ┆ (Retain) │ (Delete: object + │ ┆ │ is deleted instead) + │ ▼┄┄┄┄ driver-owned ┄┄┄┄┄▼ + └──────► Conflict / Lost (sticky for the core; + set and cleared by the driver only) +``` + +Each pass: + +1. **Deletion?** The protection finalizer + (`local.sdn.cozystack.io/address-protection`) is released only when no + live claim holds the address — i.e. the address is not `Bound`, or the + referenced claim is missing, being deleted, or has a different UID. + Otherwise deletion blocks and waits: a `Bound` address cannot vanish + from under a live claim. (Driver finalizers are independent of this + and are the driver's own business.) +2. **Protection.** Ensure the finalizer. +3. **Validation.** An unparsable `spec.address` pins the object at + `Pending`; nothing downstream trusts an invalid IP. +4. **Sticky phases.** `Conflict` and `Lost` short-circuit the pass — + driver territory (§3). +5. **Unbound.** No `claimRef` → `Available`. This single rule is also the + recycling path: an admin clears the `claimRef` of a `Released` address + and it becomes matchable again — the deliberate, manual step PV + semantics prescribe for `Retain`. +6. **Bound.** With a `claimRef`: + - claim exists, UID matches → `Bound`; + - claim exists, `claimRef.uid` empty → wait (the claim reconciler is + about to complete the binding); + - claim is being deleted → wait (the claim-side reclaim flow owns the + transition); + - claim gone, or UID mismatch → **safety-net reclaim**: apply this + address's own `reclaimPolicy` (`Delete` → delete self, `Retain` → + `Released`). This duplicates the claim-side flow on purpose: reclaim + must happen even if the claim vanished without its finalizer running + (e.g. the finalizer was force-removed). + +## 6. The reclaim flow (claim deletion) + +Runs behind the claim's protection finalizer, so it always runs before +the claim disappears: + +- For every address bound to the claim (same collection rule as §4 step + 3), apply **the address's** `reclaimPolicy` — copied from the class at + provisioning time, so a later class edit does not retroactively change + the fate of existing addresses: + - `Retain` → phase `Released`. The `claimRef` **survives** — the + released address is not reusable until an admin clears it (§5 step 5). + - `Delete` → delete the `IPAddress` object. The core does not tear down + any backend state; the driver's own finalizer on the address + intercepts the deletion and deallocates first (§7 obligation 4). +- Remove the finalizer; the claim goes away. + +**What each policy actually reclaims.** "The address" is up to three +things: the API object, the reservation it records, and whatever backend +state stands behind it. The policies act on them differently: + +- `Retain` acts on nothing but the phase. The object stays, so the + reservation stays: a range-carved (`fromClass`) IP remains excluded from + allocation, and a provider-held (`providerRef`) reservation remains held + at the provider — **which means it keeps incurring provider charges**. + That is deliberate, not a leak: retained means still yours, and an + idle-but-billed address is exactly what holding an elastic IP is. The + cost stops only when the reservation is actually given up, i.e. when + someone deletes the `IPAddress` object. +- `Delete` removes the object, and the driver's teardown finalizer is + where backend state is released before it goes: a `fromClass` address + returns to the free range simply by its ledger entry ceasing to exist + (for backends like MetalLB there is nothing else to do); a + provider-side reservation **the driver itself created** must be + released at the provider. For a reservation the driver merely *adopted* + (it existed before the object, e.g. an admin-imported EIP), whether + teardown releases it or leaves it in the provider's hands is the + driver's documented policy call — the safe default is to leave what + you did not create. + +So the EIP question has a precise answer: `Retain` keeps the EIP and its +bill until an admin deletes the object; `Delete` releases a +driver-allocated EIP at the provider, via the driver's finalizer. + +## 7. The driver contract + +A per-class driver (the CSI-driver analog) plugs in with no registration +step: deploying it and creating an `IPAddressClass` naming it is the whole +integration. Its obligations: + +1. **Serve stamped claims.** Watch `IPAddressClaim`s whose + `local.sdn.cozystack.io/provisioner` annotation equals the driver's + name and which are not fully bound. The driver must not resolve + classes or defaults itself — the stamp is the assignment. +2. **Provision pre-bound.** For each family the claim still misses, + create one `IPAddress`: + - `spec.claimRef` pre-set to the claim's namespace/name (UID optional — + the core completes it; setting it is allowed and slightly tighter); + - `spec.className` set, `spec.reclaimPolicy` copied from the class; + - `spec.source` reflecting reality: `fromClass` if the driver carved + the address from the class's own range, `providerRef` if a provider + holds the reservation (whether the driver allocated it there or + adopted a pre-existing one); + - the driver's **own finalizer**, if teardown has any backend work. + The driver determines the IP — by choosing it from a range, or by + recording what its backend handed out; the core decides *whether the + binding stands* (it is the binder). +3. **Never touch core-owned state** (§3): claim status, the core phases, + core finalizers, or the `claimRef` of any existing address. +4. **Tear down on deletion.** When an `IPAddress` the driver created is + deleted (reclaim `Delete`, or an admin action), the driver's finalizer + must release backend state before letting the object go. +5. **Own association** (optional but standard). Attaching a bound address + to a workload is a separate, reversible act, entirely driver-side: + resolve the Service annotation + `local.sdn.cozystack.io/ip-address-claim` (naming a claim in the + Service's *own* namespace — cross-namespace sharing is not a thing), + translate it into the backend's pin mechanism, maintain + `status.associatedTo`, and enforce that one claim serves one workload + at a time. Disassociation must leave the address `Bound` — reserved, + inert. +6. **Detect, and clear, conflicts.** If the backend hands the reserved + address to a workload the binding does not authorize, set phase + `Conflict` (and `Lost` if the backing reservation disappears). The + core will never override these; the driver clears them by setting the + phase back to a core-owned value once the condition has passed. + +Static pre-provisioning needs no driver at all: an admin may create +`Available` addresses by hand and the core matches them (§4 step 7). + +## 8. Interaction walkthrough (the happy path) + +``` +tenant core driver + │ create Claim │ │ + │────────────────────►│ finalizer, resolve class, │ + │ │ stamp provisioner ─────────►│ sees stamped, unbound claim + │ │ │ allocates, creates IPAddress + │ │◄────────────────────────────│ (claimRef pre-set, own finalizer) + │ │ completes uid, phase Bound │ + │◄────────────────────│ status.addresses = [ip] │ + │ annotate Service │ │ + │──────────────────────────────────────────────────►│ resolves claim → ip, + │ │ │ writes backend pin, + │ │ │ sets associatedTo + │ delete Service │ │ withdraws pin, clears associatedTo + │ │ (address stays Bound: reserved, inert) + │ annotate Service B │ │ same ip, pinned to B +``` + +Deleting the claim, not the Service, is what releases the address — via +§6, honoring the reclaim policy. This asymmetry is the entire point of +the model. + +## 9. Relation to the design proposal + +Where [community#35](https://github.com/cozystack/community/pull/35) is +explicit, this implementation follows it. Where it is deliberately a stub, +the choices made here are: PV-style annotation stamping instead of a +driver-registration CRD; no modeling of driver capabilities +(Allocate/Adopt/Pin) until a registration object exists to declare them +on; opaque-object class parameters rather than a string map; refusal over +newest-wins for multiple default classes; dual-stack as two `IPAddress` +objects under one claim; sticky class resolution recorded in status +(there is no admission webhook to default the spec); and association, +Service-watching, and admission policy left entirely to drivers. The API +group is `local.sdn.cozystack.io` rather than the proposal's sketched +`ipam.cozystack.io`. diff --git a/go.mod b/go.mod new file mode 100644 index 0000000..bb32064 --- /dev/null +++ b/go.mod @@ -0,0 +1,100 @@ +module github.com/lllamnyp/address-controller + +go 1.23.0 + +godebug default=go1.23 + +require ( + github.com/onsi/ginkgo/v2 v2.21.0 + github.com/onsi/gomega v1.35.1 + k8s.io/apimachinery v0.32.0 + k8s.io/client-go v0.32.0 + sigs.k8s.io/controller-runtime v0.20.0 +) + +require ( + cel.dev/expr v0.18.0 // indirect + github.com/antlr4-go/antlr/v4 v4.13.0 // indirect + github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect + github.com/beorn7/perks v1.0.1 // indirect + github.com/blang/semver/v4 v4.0.0 // indirect + github.com/cenkalti/backoff/v4 v4.3.0 // indirect + github.com/cespare/xxhash/v2 v2.3.0 // indirect + github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect + github.com/emicklei/go-restful/v3 v3.11.0 // indirect + github.com/evanphx/json-patch/v5 v5.9.0 // indirect + github.com/felixge/httpsnoop v1.0.4 // indirect + github.com/fsnotify/fsnotify v1.7.0 // indirect + github.com/fxamacker/cbor/v2 v2.7.0 // indirect + github.com/go-logr/logr v1.4.2 // indirect + github.com/go-logr/stdr v1.2.2 // indirect + github.com/go-logr/zapr v1.3.0 // indirect + github.com/go-openapi/jsonpointer v0.21.0 // indirect + github.com/go-openapi/jsonreference v0.20.2 // indirect + github.com/go-openapi/swag v0.23.0 // indirect + github.com/go-task/slim-sprig/v3 v3.0.0 // indirect + github.com/gogo/protobuf v1.3.2 // indirect + github.com/golang/protobuf v1.5.4 // indirect + github.com/google/btree v1.1.3 // indirect + github.com/google/cel-go v0.22.0 // indirect + github.com/google/gnostic-models v0.6.8 // indirect + github.com/google/go-cmp v0.6.0 // indirect + github.com/google/gofuzz v1.2.0 // indirect + github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db // indirect + github.com/google/uuid v1.6.0 // indirect + github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 // indirect + github.com/inconshreveable/mousetrap v1.1.0 // indirect + github.com/josharian/intern v1.0.0 // indirect + github.com/json-iterator/go v1.1.12 // indirect + github.com/mailru/easyjson v0.7.7 // indirect + github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect + github.com/modern-go/reflect2 v1.0.2 // indirect + github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect + github.com/pkg/errors v0.9.1 // indirect + github.com/prometheus/client_golang v1.19.1 // indirect + github.com/prometheus/client_model v0.6.1 // indirect + github.com/prometheus/common v0.55.0 // indirect + github.com/prometheus/procfs v0.15.1 // indirect + github.com/spf13/cobra v1.8.1 // indirect + github.com/spf13/pflag v1.0.5 // indirect + github.com/stoewer/go-strcase v1.3.0 // indirect + github.com/x448/float16 v0.8.4 // indirect + go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 // indirect + go.opentelemetry.io/otel v1.28.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 // indirect + go.opentelemetry.io/otel/metric v1.28.0 // indirect + go.opentelemetry.io/otel/sdk v1.28.0 // indirect + go.opentelemetry.io/otel/trace v1.28.0 // indirect + go.opentelemetry.io/proto/otlp v1.3.1 // indirect + go.uber.org/multierr v1.11.0 // indirect + go.uber.org/zap v1.27.0 // indirect + golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect + golang.org/x/net v0.30.0 // indirect + golang.org/x/oauth2 v0.23.0 // indirect + golang.org/x/sync v0.8.0 // indirect + golang.org/x/sys v0.26.0 // indirect + golang.org/x/term v0.25.0 // indirect + golang.org/x/text v0.19.0 // indirect + golang.org/x/time v0.7.0 // indirect + golang.org/x/tools v0.26.0 // indirect + gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20240826202546-f6391c0de4c7 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20240826202546-f6391c0de4c7 // indirect + google.golang.org/grpc v1.65.0 // indirect + google.golang.org/protobuf v1.35.1 // indirect + gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect + gopkg.in/inf.v0 v0.9.1 // indirect + gopkg.in/yaml.v3 v3.0.1 // indirect + k8s.io/api v0.32.0 // indirect + k8s.io/apiextensions-apiserver v0.32.0 // indirect + k8s.io/apiserver v0.32.0 // indirect + k8s.io/component-base v0.32.0 // indirect + k8s.io/klog/v2 v2.130.1 // indirect + k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f // indirect + k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect + sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.0 // indirect + sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect + sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect + sigs.k8s.io/yaml v1.4.0 // indirect +) diff --git a/go.sum b/go.sum new file mode 100644 index 0000000..7251637 --- /dev/null +++ b/go.sum @@ -0,0 +1,247 @@ +cel.dev/expr v0.18.0 h1:CJ6drgk+Hf96lkLikr4rFf19WrU0BOWEihyZnI2TAzo= +cel.dev/expr v0.18.0/go.mod h1:MrpN08Q+lEBs+bGYdLxxHkZoUSsCp0nSKTs0nTymJgw= +github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI= +github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g= +github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA= +github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY= +github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= +github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= +github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM= +github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ= +github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8= +github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE= +github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= +github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= +github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o= +github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= +github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g= +github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= +github.com/evanphx/json-patch v0.5.2 h1:xVCHIVMUu1wtM/VkR9jVZ45N3FhZfYMMYGorLCR8P3k= +github.com/evanphx/json-patch v0.5.2/go.mod h1:ZWS5hhDbVDyob71nXKNL0+PWn6ToqBHMikGIFbs31qQ= +github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg= +github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ= +github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= +github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= +github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA= +github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM= +github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E= +github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ= +github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= +github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY= +github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= +github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= +github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ= +github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg= +github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs= +github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ= +github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY= +github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE= +github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k= +github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14= +github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE= +github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ= +github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI= +github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8= +github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= +github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= +github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= +github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= +github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg= +github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4= +github.com/google/cel-go v0.22.0 h1:b3FJZxpiv1vTMo2/5RDUqAHPxkT8mmMfJIrq1llbf7g= +github.com/google/cel-go v0.22.0/go.mod h1:BuznPXXfQDpXKWQ9sPW3TzlAJN5zzFe+i9tIs0yC4s8= +github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I= +github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U= +github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= +github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI= +github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= +github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= +github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0= +github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= +github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo= +github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144= +github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= +github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 h1:bkypFPDjIYGfCYD5mRBvpqxfYX1YCS1PXdKYWi8FsN0= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0/go.mod h1:P+Lt/0by1T8bfcF3z737NnSbmxQAppXMRziHUxPOC8k= +github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= +github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= +github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY= +github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y= +github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM= +github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= +github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= +github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= +github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= +github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= +github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= +github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= +github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= +github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= +github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0= +github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc= +github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= +github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg= +github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= +github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M= +github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= +github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= +github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= +github.com/onsi/ginkgo/v2 v2.21.0 h1:7rg/4f3rB88pb5obDgNZrNHrQ4e6WpjonchcpuBRnZM= +github.com/onsi/ginkgo/v2 v2.21.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo= +github.com/onsi/gomega v1.35.1 h1:Cwbd75ZBPxFSuZ6T+rN/WCb/gOc6YgFBXLlZLhC7Ds4= +github.com/onsi/gomega v1.35.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog= +github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= +github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= +github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/prometheus/client_golang v1.19.1 h1:wZWJDwK+NameRJuPGDhlnFgx8e8HN3XHQeLaYJFJBOE= +github.com/prometheus/client_golang v1.19.1/go.mod h1:mP78NwGzrVks5S2H6ab8+ZZGJLZUq1hoULYBAYBw1Ho= +github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E= +github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY= +github.com/prometheus/common v0.55.0 h1:KEi6DK7lXW/m7Ig5i47x0vRzuBsHuvJdi5ee6Y3G1dc= +github.com/prometheus/common v0.55.0/go.mod h1:2SECS4xJG1kd8XF9IcM1gMX6510RAEL65zxzNImwdc8= +github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc= +github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk= +github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8= +github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4= +github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= +github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM= +github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y= +github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= +github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/stoewer/go-strcase v1.3.0 h1:g0eASXYtp+yvN9fK8sH94oCIk0fau9uV1/ZdJ0AVEzs= +github.com/stoewer/go-strcase v1.3.0/go.mod h1:fAH5hQ5pehh+j3nZfvwdk2RgEgQjAoM8wodgtPmh1xo= +github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= +github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= +github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= +github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= +github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg= +github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= +github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= +github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= +github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= +github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 h1:4K4tsIXefpVJtvA/8srF4V4y0akAoPHkIslgAkjixJA= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0/go.mod h1:jjdQuTGVsXV4vSs+CJ2qYDeDPf9yIJV23qlIzBm73Vg= +go.opentelemetry.io/otel v1.28.0 h1:/SqNcYk+idO0CxKEUOtKQClMK/MimZihKYMruSMViUo= +go.opentelemetry.io/otel v1.28.0/go.mod h1:q68ijF8Fc8CnMHKyzqL6akLO46ePnjkgfIMIjUIX9z4= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 h1:3Q/xZUyC1BBkualc9ROb4G8qkH90LXEIICcs5zv1OYY= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0/go.mod h1:s75jGIWA9OfCMzF0xr+ZgfrB5FEbbV7UuYo32ahUiFI= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 h1:qFffATk0X+HD+f1Z8lswGiOQYKHRlzfmdJm0wEaVrFA= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0/go.mod h1:MOiCmryaYtc+V0Ei+Tx9o5S1ZjA7kzLucuVuyzBZloQ= +go.opentelemetry.io/otel/metric v1.28.0 h1:f0HGvSl1KRAU1DLgLGFjrwVyismPlnuU6JD6bOeuA5Q= +go.opentelemetry.io/otel/metric v1.28.0/go.mod h1:Fb1eVBFZmLVTMb6PPohq3TO9IIhUisDsbJoL/+uQW4s= +go.opentelemetry.io/otel/sdk v1.28.0 h1:b9d7hIry8yZsgtbmM0DKyPWMMUMlK9NEKuIG4aBqWyE= +go.opentelemetry.io/otel/sdk v1.28.0/go.mod h1:oYj7ClPUA7Iw3m+r7GeEjz0qckQRJK2B8zjcZEfu7Pg= +go.opentelemetry.io/otel/trace v1.28.0 h1:GhQ9cUuQGmNDd5BTCP2dAvv75RdMxEfTmYejp+lkx9g= +go.opentelemetry.io/otel/trace v1.28.0/go.mod h1:jPyXzNPg6da9+38HEwElrQiHlVMTnVfM3/yv2OlIHaI= +go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0= +go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8= +go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= +go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= +go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= +go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= +go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8= +go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E= +golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= +golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= +golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= +golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8= +golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY= +golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= +golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= +golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= +golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4= +golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU= +golang.org/x/oauth2 v0.23.0 h1:PbgcYx2W7i4LvjJWEbf0ngHV6qJYr86PkAV3bXdLEbs= +golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI= +golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ= +golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= +golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo= +golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/term v0.25.0 h1:WtHI/ltw4NvSUig5KARz9h521QvRC8RmF/cuYqifU24= +golang.org/x/term v0.25.0/go.mod h1:RPyXicDX+6vLxogjjRxjgD2TKtmAO6NZBsBRfrOLu7M= +golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM= +golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY= +golang.org/x/time v0.7.0 h1:ntUhktv3OPE6TgYxXWv9vKvUSJyIFJlyohwbkEwPrKQ= +golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM= +golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= +golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= +golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= +golang.org/x/tools v0.26.0 h1:v/60pFQmzmT9ExmjDv2gGIfi3OqfKoEP6I5+umXlbnQ= +golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0= +golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw= +gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY= +google.golang.org/genproto/googleapis/api v0.0.0-20240826202546-f6391c0de4c7 h1:YcyjlL1PRr2Q17/I0dPk2JmYS5CDXfcdb2Z3YRioEbw= +google.golang.org/genproto/googleapis/api v0.0.0-20240826202546-f6391c0de4c7/go.mod h1:OCdP9MfskevB/rbYvHTsXTtKC+3bHWajPdoKgjcYkfo= +google.golang.org/genproto/googleapis/rpc v0.0.0-20240826202546-f6391c0de4c7 h1:2035KHhUv+EpyB+hWgJnaWKJOdX1E95w2S8Rr4uWKTs= +google.golang.org/genproto/googleapis/rpc v0.0.0-20240826202546-f6391c0de4c7/go.mod h1:UqMtugtsSgubUsoxbuAoiCXvqvErP7Gf0so0mK9tHxU= +google.golang.org/grpc v1.65.0 h1:bs/cUb4lp1G5iImFFd3u5ixQzweKizoZJAwBNLR42lc= +google.golang.org/grpc v1.65.0/go.mod h1:WgYC2ypjlB0EiQi6wdKixMqukr6lBc0Vo+oOgjrM5ZQ= +google.golang.org/protobuf v1.35.1 h1:m3LfL6/Ca+fqnjnlqQXNpFPABW1UD7mjh8KO2mKFytA= +google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= +gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4= +gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M= +gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc= +gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw= +gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +k8s.io/api v0.32.0 h1:OL9JpbvAU5ny9ga2fb24X8H6xQlVp+aJMFlgtQjR9CE= +k8s.io/api v0.32.0/go.mod h1:4LEwHZEf6Q/cG96F3dqR965sYOfmPM7rq81BLgsE0p0= +k8s.io/apiextensions-apiserver v0.32.0 h1:S0Xlqt51qzzqjKPxfgX1xh4HBZE+p8KKBq+k2SWNOE0= +k8s.io/apiextensions-apiserver v0.32.0/go.mod h1:86hblMvN5yxMvZrZFX2OhIHAuFIMJIZ19bTvzkP+Fmw= +k8s.io/apimachinery v0.32.0 h1:cFSE7N3rmEEtv4ei5X6DaJPHHX0C+upp+v5lVPiEwpg= +k8s.io/apimachinery v0.32.0/go.mod h1:GpHVgxoKlTxClKcteaeuF1Ul/lDVb74KpZcxcmLDElE= +k8s.io/apiserver v0.32.0 h1:VJ89ZvQZ8p1sLeiWdRJpRD6oLozNZD2+qVSLi+ft5Qs= +k8s.io/apiserver v0.32.0/go.mod h1:HFh+dM1/BE/Hm4bS4nTXHVfN6Z6tFIZPi649n83b4Ag= +k8s.io/client-go v0.32.0 h1:DimtMcnN/JIKZcrSrstiwvvZvLjG0aSxy8PxN8IChp8= +k8s.io/client-go v0.32.0/go.mod h1:boDWvdM1Drk4NJj/VddSLnx59X3OPgwrOo0vGbtq9+8= +k8s.io/component-base v0.32.0 h1:d6cWHZkCiiep41ObYQS6IcgzOUQUNpywm39KVYaUqzU= +k8s.io/component-base v0.32.0/go.mod h1:JLG2W5TUxUu5uDyKiH2R/7NnxJo1HlPoRIIbVLkK5eM= +k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk= +k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE= +k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f h1:GA7//TjRY9yWGy1poLzYYJJ4JRdzg3+O6e8I+e+8T5Y= +k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f/go.mod h1:R/HEjbvWI0qdfb8viZUeVZm0X6IZnxAydC7YU42CMw4= +k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro= +k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= +sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.0 h1:CPT0ExVicCzcpeN4baWEV2ko2Z/AsiZgEdwgcfwLgMo= +sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.0/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw= +sigs.k8s.io/controller-runtime v0.20.0 h1:jjkMo29xEXH+02Md9qaVXfEIaMESSpy3TBWPrsfQkQs= +sigs.k8s.io/controller-runtime v0.20.0/go.mod h1:BrP3w158MwvB3ZbNpaAcIKkHQ7YGpYnzpoSTZ8E14WU= +sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8= +sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo= +sigs.k8s.io/structured-merge-diff/v4 v4.4.2 h1:MdmvkGuXi/8io6ixD5wud3vOLwc1rj0aNqRlpuvjmwA= +sigs.k8s.io/structured-merge-diff/v4 v4.4.2/go.mod h1:N8f93tFZh9U6vpxwRArLiikrE5/2tiu1w1AGfACIGE4= +sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E= +sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY= diff --git a/hack/boilerplate.go.txt b/hack/boilerplate.go.txt new file mode 100644 index 0000000..9786798 --- /dev/null +++ b/hack/boilerplate.go.txt @@ -0,0 +1,15 @@ +/* +Copyright 2026. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ \ No newline at end of file diff --git a/internal/controller/indexes.go b/internal/controller/indexes.go new file mode 100644 index 0000000..dad7a0d --- /dev/null +++ b/internal/controller/indexes.go @@ -0,0 +1,62 @@ +/* +Copyright 2026. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package controller + +import ( + "context" + "net/netip" + + ctrl "sigs.k8s.io/controller-runtime" + "sigs.k8s.io/controller-runtime/pkg/client" + + localv1alpha1 "github.com/lllamnyp/address-controller/api/v1alpha1" +) + +// IPAddressClaimRefIndex indexes IPAddress objects by the +// "/" of their spec.claimRef. +const IPAddressClaimRefIndex = "spec.claimRef" + +// ClaimRefIndexKey builds the index key for a claim. +func ClaimRefIndexKey(namespace, name string) string { + return namespace + "/" + name +} + +// SetupIndexes registers the field indexes shared by the controllers. Call +// once, before setting up the controllers. +func SetupIndexes(ctx context.Context, mgr ctrl.Manager) error { + return mgr.GetFieldIndexer().IndexField(ctx, &localv1alpha1.IPAddress{}, IPAddressClaimRefIndex, + func(o client.Object) []string { + addr := o.(*localv1alpha1.IPAddress) + if addr.Spec.ClaimRef == nil { + return nil + } + return []string{ClaimRefIndexKey(addr.Spec.ClaimRef.Namespace, addr.Spec.ClaimRef.Name)} + }) +} + +// familyOf reports the address family of a textual IP, or "" if it does not +// parse. +func familyOf(address string) localv1alpha1.AddressFamily { + ip, err := netip.ParseAddr(address) + if err != nil { + return "" + } + if ip.Is4() || ip.Is4In6() { + return localv1alpha1.FamilyIPv4 + } + return localv1alpha1.FamilyIPv6 +} diff --git a/internal/controller/ipaddress_controller.go b/internal/controller/ipaddress_controller.go new file mode 100644 index 0000000..5064601 --- /dev/null +++ b/internal/controller/ipaddress_controller.go @@ -0,0 +1,203 @@ +/* +Copyright 2026. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package controller + +import ( + "context" + + apierrors "k8s.io/apimachinery/pkg/api/errors" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/types" + "k8s.io/client-go/tools/record" + ctrl "sigs.k8s.io/controller-runtime" + "sigs.k8s.io/controller-runtime/pkg/client" + "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil" + "sigs.k8s.io/controller-runtime/pkg/handler" + "sigs.k8s.io/controller-runtime/pkg/log" + "sigs.k8s.io/controller-runtime/pkg/reconcile" + + localv1alpha1 "github.com/lllamnyp/address-controller/api/v1alpha1" +) + +// IPAddressReconciler owns the class-agnostic address lifecycle: deletion +// protection while a live claim holds the address, phase bookkeeping between +// Available/Bound/Released, and the safety-net reclaim when a bound claim +// vanished without the claim-side flow running. The driver-owned phases +// Conflict and Lost are treated as sticky and never overwritten. +type IPAddressReconciler struct { + client.Client + Scheme *runtime.Scheme + Recorder record.EventRecorder +} + +// +kubebuilder:rbac:groups=local.sdn.cozystack.io,resources=ipaddresses,verbs=get;list;watch;update;patch;delete +// +kubebuilder:rbac:groups=local.sdn.cozystack.io,resources=ipaddresses/status,verbs=get;update;patch +// +kubebuilder:rbac:groups=local.sdn.cozystack.io,resources=ipaddresses/finalizers,verbs=update +// +kubebuilder:rbac:groups=local.sdn.cozystack.io,resources=ipaddressclaims,verbs=get;list;watch +// +kubebuilder:rbac:groups="",resources=events,verbs=create;patch + +// Reconcile drives an IPAddress's phase bookkeeping. +func (r *IPAddressReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) { + logger := log.FromContext(ctx) + + addr := &localv1alpha1.IPAddress{} + if err := r.Get(ctx, req.NamespacedName, addr); err != nil { + return ctrl.Result{}, client.IgnoreNotFound(err) + } + + if !addr.DeletionTimestamp.IsZero() { + return ctrl.Result{}, r.finalizeAddress(ctx, addr) + } + + if !controllerutil.ContainsFinalizer(addr, localv1alpha1.AddressProtectionFinalizer) { + controllerutil.AddFinalizer(addr, localv1alpha1.AddressProtectionFinalizer) + if err := r.Update(ctx, addr); err != nil { + return ctrl.Result{}, err + } + } + + if familyOf(addr.Spec.Address) == "" { + r.Recorder.Eventf(addr, "Warning", "InvalidAddress", + "spec.address %q does not parse as an IP address", addr.Spec.Address) + return ctrl.Result{}, r.setPhase(ctx, addr, localv1alpha1.IPAddressPending) + } + + // Conflict and Lost belong to the driver; the core controller neither + // enters nor leaves them. + if addr.Status.Phase == localv1alpha1.IPAddressConflict || addr.Status.Phase == localv1alpha1.IPAddressLost { + return ctrl.Result{}, nil + } + + if addr.Spec.ClaimRef == nil { + // Covers a fresh unbound address and a Released one whose claimRef + // an admin cleared: both become Available. + return ctrl.Result{}, r.setPhase(ctx, addr, localv1alpha1.IPAddressAvailable) + } + + claim, err := r.boundClaim(ctx, addr) + if err != nil { + return ctrl.Result{}, err + } + + switch { + case claim == nil: + // The claim is gone but the claim-side reclaim never ran (stale + // UID, or the claim disappeared without the finalizer flow). + return ctrl.Result{}, r.reclaim(ctx, addr) + case !claim.DeletionTimestamp.IsZero(): + // The claim-side flow owns the transition; nothing to do here. + return ctrl.Result{}, nil + case addr.Spec.ClaimRef.UID == "": + // Driver pre-binding awaiting completion by the claim controller. + return ctrl.Result{}, nil + default: + if err := r.setPhase(ctx, addr, localv1alpha1.IPAddressBound); err != nil { + return ctrl.Result{}, err + } + } + + logger.V(1).Info("reconciled address", "phase", addr.Status.Phase) + return ctrl.Result{}, nil +} + +// finalizeAddress blocks deletion while a live, non-deleting claim still +// holds the address; otherwise it drops the protection finalizer. +func (r *IPAddressReconciler) finalizeAddress(ctx context.Context, addr *localv1alpha1.IPAddress) error { + if !controllerutil.ContainsFinalizer(addr, localv1alpha1.AddressProtectionFinalizer) { + return nil + } + if addr.Spec.ClaimRef != nil && addr.Status.Phase == localv1alpha1.IPAddressBound { + claim, err := r.boundClaim(ctx, addr) + if err != nil { + return err + } + if claim != nil && claim.DeletionTimestamp.IsZero() { + r.Recorder.Eventf(addr, "Warning", "DeletionBlocked", + "IPAddress is bound to live claim %s/%s; deletion waits until the claim releases it", + claim.Namespace, claim.Name) + return nil + } + } + controllerutil.RemoveFinalizer(addr, localv1alpha1.AddressProtectionFinalizer) + return r.Update(ctx, addr) +} + +// boundClaim fetches the claim named by claimRef. It returns nil for a +// missing claim and for a UID mismatch — both mean the binding is stale. +func (r *IPAddressReconciler) boundClaim(ctx context.Context, addr *localv1alpha1.IPAddress) (*localv1alpha1.IPAddressClaim, error) { + ref := addr.Spec.ClaimRef + claim := &localv1alpha1.IPAddressClaim{} + err := r.Get(ctx, types.NamespacedName{Namespace: ref.Namespace, Name: ref.Name}, claim) + if apierrors.IsNotFound(err) { + return nil, nil + } + if err != nil { + return nil, err + } + if ref.UID != "" && claim.UID != ref.UID { + return nil, nil + } + return claim, nil +} + +// reclaim applies the address's reclaim policy after its claim vanished. +func (r *IPAddressReconciler) reclaim(ctx context.Context, addr *localv1alpha1.IPAddress) error { + if addr.Spec.ReclaimPolicy == localv1alpha1.ReclaimDelete { + r.Recorder.Event(addr, "Normal", "Reclaimed", "claim gone; deleting per reclaimPolicy Delete") + if err := r.Delete(ctx, addr); err != nil && !apierrors.IsNotFound(err) { + return err + } + return nil + } + if addr.Status.Phase != localv1alpha1.IPAddressReleased { + r.Recorder.Event(addr, "Normal", "Reclaimed", "claim gone; released per reclaimPolicy Retain") + } + return r.setPhase(ctx, addr, localv1alpha1.IPAddressReleased) +} + +func (r *IPAddressReconciler) setPhase(ctx context.Context, addr *localv1alpha1.IPAddress, phase localv1alpha1.IPAddressPhase) error { + if addr.Status.Phase == phase { + return nil + } + addr.Status.Phase = phase + return r.Status().Update(ctx, addr) +} + +// addressesForClaim maps a claim event to the addresses bound to it, so +// claim deletion and rebinding propagate promptly. +func (r *IPAddressReconciler) addressesForClaim(ctx context.Context, o client.Object) []reconcile.Request { + list := &localv1alpha1.IPAddressList{} + if err := r.List(ctx, list, client.MatchingFields{ + IPAddressClaimRefIndex: ClaimRefIndexKey(o.GetNamespace(), o.GetName()), + }); err != nil { + return nil + } + var reqs []reconcile.Request + for _, addr := range list.Items { + reqs = append(reqs, reconcile.Request{NamespacedName: types.NamespacedName{Name: addr.Name}}) + } + return reqs +} + +// SetupWithManager sets up the controller with the Manager. +func (r *IPAddressReconciler) SetupWithManager(mgr ctrl.Manager) error { + return ctrl.NewControllerManagedBy(mgr). + For(&localv1alpha1.IPAddress{}). + Watches(&localv1alpha1.IPAddressClaim{}, handler.EnqueueRequestsFromMapFunc(r.addressesForClaim)). + Named("ipaddress"). + Complete(r) +} diff --git a/internal/controller/ipaddress_controller_test.go b/internal/controller/ipaddress_controller_test.go new file mode 100644 index 0000000..32a5cd2 --- /dev/null +++ b/internal/controller/ipaddress_controller_test.go @@ -0,0 +1,183 @@ +/* +Copyright 2026. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package controller + +import ( + "context" + "testing" + + apierrors "k8s.io/apimachinery/pkg/api/errors" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/types" + "k8s.io/client-go/tools/record" + ctrl "sigs.k8s.io/controller-runtime" + "sigs.k8s.io/controller-runtime/pkg/client" + + localv1alpha1 "github.com/lllamnyp/address-controller/api/v1alpha1" +) + +func addressReconciler(c client.Client) *IPAddressReconciler { + return &IPAddressReconciler{ + Client: c, + Scheme: c.Scheme(), + Recorder: record.NewFakeRecorder(100), + } +} + +func reconcileAddress(t *testing.T, r *IPAddressReconciler, name string) { + t.Helper() + _, err := r.Reconcile(context.Background(), ctrl.Request{ + NamespacedName: types.NamespacedName{Name: name}, + }) + if err != nil { + t.Fatalf("reconcile: %v", err) + } +} + +func unboundAddress(name, ip string) *localv1alpha1.IPAddress { + return &localv1alpha1.IPAddress{ + ObjectMeta: metav1.ObjectMeta{Name: name}, + Spec: localv1alpha1.IPAddressSpec{ + ClassName: "public", + Address: ip, + Source: localv1alpha1.IPAddressSource{FromClass: &localv1alpha1.FromClassSource{}}, + }, + } +} + +func TestUnboundAddressBecomesAvailable(t *testing.T) { + c := testClient(t, unboundAddress("ip-1", "203.0.113.1")) + reconcileAddress(t, addressReconciler(c), "ip-1") + + got := getAddress(t, c, "ip-1") + if got.Status.Phase != localv1alpha1.IPAddressAvailable { + t.Errorf("phase = %q, want Available", got.Status.Phase) + } + if !hasFinalizer(got.Finalizers, localv1alpha1.AddressProtectionFinalizer) { + t.Error("address protection finalizer missing") + } +} + +func TestBoundAddressWithLiveClaimBecomesBound(t *testing.T) { + claim := pendingClaim("public") + addr := unboundAddress("ip-2", "203.0.113.2") + addr.Spec.ClaimRef = &localv1alpha1.ClaimReference{Namespace: "tenant-a", Name: "web", UID: "claim-uid-1"} + c := testClient(t, claim, addr) + reconcileAddress(t, addressReconciler(c), "ip-2") + + if got := getAddress(t, c, "ip-2"); got.Status.Phase != localv1alpha1.IPAddressBound { + t.Errorf("phase = %q, want Bound", got.Status.Phase) + } +} + +func TestPreBoundAddressWithoutUIDStaysUntouched(t *testing.T) { + claim := pendingClaim("public") + addr := unboundAddress("ip-3", "203.0.113.3") + addr.Spec.ClaimRef = &localv1alpha1.ClaimReference{Namespace: "tenant-a", Name: "web"} + c := testClient(t, claim, addr) + reconcileAddress(t, addressReconciler(c), "ip-3") + + if got := getAddress(t, c, "ip-3"); got.Status.Phase == localv1alpha1.IPAddressBound { + t.Error("phase Bound before the claim controller completed the binding UID") + } +} + +func TestOrphanedAddressRetainIsReleased(t *testing.T) { + addr := unboundAddress("ip-4", "203.0.113.4") + addr.Spec.ReclaimPolicy = localv1alpha1.ReclaimRetain + addr.Spec.ClaimRef = &localv1alpha1.ClaimReference{Namespace: "tenant-a", Name: "gone", UID: "old-uid"} + c := testClient(t, addr) + reconcileAddress(t, addressReconciler(c), "ip-4") + + got := getAddress(t, c, "ip-4") + if got.Status.Phase != localv1alpha1.IPAddressReleased { + t.Errorf("phase = %q, want Released", got.Status.Phase) + } + if got.Spec.ClaimRef == nil { + t.Error("claimRef cleared; it must survive a Retain reclaim") + } +} + +func TestOrphanedAddressDeletePolicyIsDeleted(t *testing.T) { + addr := unboundAddress("ip-5", "203.0.113.5") + addr.Spec.ReclaimPolicy = localv1alpha1.ReclaimDelete + addr.Spec.ClaimRef = &localv1alpha1.ClaimReference{Namespace: "tenant-a", Name: "gone", UID: "old-uid"} + c := testClient(t, addr) + r := addressReconciler(c) + reconcileAddress(t, r, "ip-5") + // The protection finalizer added in the same pass holds the object in + // deleting state; the deletion reconcile then releases it. + reconcileAddress(t, r, "ip-5") + + err := c.Get(context.Background(), types.NamespacedName{Name: "ip-5"}, &localv1alpha1.IPAddress{}) + if !apierrors.IsNotFound(err) { + t.Errorf("address still present: %v", err) + } +} + +func TestUIDMismatchTriggersReclaim(t *testing.T) { + claim := pendingClaim("public") // UID claim-uid-1 + addr := unboundAddress("ip-6", "203.0.113.6") + addr.Spec.ClaimRef = &localv1alpha1.ClaimReference{Namespace: "tenant-a", Name: "web", UID: "some-older-uid"} + c := testClient(t, claim, addr) + reconcileAddress(t, addressReconciler(c), "ip-6") + + if got := getAddress(t, c, "ip-6"); got.Status.Phase != localv1alpha1.IPAddressReleased { + t.Errorf("phase = %q, want Released (stale binding to a recreated claim)", got.Status.Phase) + } +} + +func TestStickyPhasesAreNotOverwritten(t *testing.T) { + for _, phase := range []localv1alpha1.IPAddressPhase{localv1alpha1.IPAddressConflict, localv1alpha1.IPAddressLost} { + addr := unboundAddress("ip-sticky", "203.0.113.20") + addr.Finalizers = []string{localv1alpha1.AddressProtectionFinalizer} + addr.Status.Phase = phase + c := testClient(t, addr) + reconcileAddress(t, addressReconciler(c), "ip-sticky") + + if got := getAddress(t, c, "ip-sticky"); got.Status.Phase != phase { + t.Errorf("phase = %q, want driver-owned %q untouched", got.Status.Phase, phase) + } + } +} + +func TestDeletionBlockedWhileBoundToLiveClaim(t *testing.T) { + claim := pendingClaim("public") + addr := unboundAddress("ip-7", "203.0.113.7") + addr.Finalizers = []string{localv1alpha1.AddressProtectionFinalizer} + addr.Spec.ClaimRef = &localv1alpha1.ClaimReference{Namespace: "tenant-a", Name: "web", UID: "claim-uid-1"} + addr.Status.Phase = localv1alpha1.IPAddressBound + c := testClient(t, claim, addr) + if err := c.Delete(context.Background(), addr); err != nil { + t.Fatal(err) + } + reconcileAddress(t, addressReconciler(c), "ip-7") + + got := getAddress(t, c, "ip-7") + if !hasFinalizer(got.Finalizers, localv1alpha1.AddressProtectionFinalizer) { + t.Error("finalizer removed while a live claim still holds the address") + } +} + +func TestInvalidAddressGoesPending(t *testing.T) { + c := testClient(t, unboundAddress("ip-bad", "not-an-ip")) + reconcileAddress(t, addressReconciler(c), "ip-bad") + + if got := getAddress(t, c, "ip-bad"); got.Status.Phase != localv1alpha1.IPAddressPending { + t.Errorf("phase = %q, want Pending", got.Status.Phase) + } +} diff --git a/internal/controller/ipaddressclaim_controller.go b/internal/controller/ipaddressclaim_controller.go new file mode 100644 index 0000000..1c1a170 --- /dev/null +++ b/internal/controller/ipaddressclaim_controller.go @@ -0,0 +1,474 @@ +/* +Copyright 2026. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package controller + +import ( + "context" + "fmt" + "sort" + + apierrors "k8s.io/apimachinery/pkg/api/errors" + "k8s.io/apimachinery/pkg/api/meta" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/types" + "k8s.io/client-go/tools/record" + ctrl "sigs.k8s.io/controller-runtime" + "sigs.k8s.io/controller-runtime/pkg/client" + "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil" + "sigs.k8s.io/controller-runtime/pkg/handler" + "sigs.k8s.io/controller-runtime/pkg/log" + "sigs.k8s.io/controller-runtime/pkg/reconcile" + + localv1alpha1 "github.com/lllamnyp/address-controller/api/v1alpha1" +) + +// IPAddressClaimReconciler owns the class-agnostic claim lifecycle: resolving +// the claim's class, stamping the provisioner annotation for the per-class +// driver, matching or accepting IPAddress bindings, and running the reclaim +// flow when the claim is deleted. It never allocates addresses itself. +type IPAddressClaimReconciler struct { + client.Client + Scheme *runtime.Scheme + Recorder record.EventRecorder +} + +// +kubebuilder:rbac:groups=local.sdn.cozystack.io,resources=ipaddressclaims,verbs=get;list;watch;update;patch +// +kubebuilder:rbac:groups=local.sdn.cozystack.io,resources=ipaddressclaims/status,verbs=get;update;patch +// +kubebuilder:rbac:groups=local.sdn.cozystack.io,resources=ipaddressclaims/finalizers,verbs=update +// +kubebuilder:rbac:groups=local.sdn.cozystack.io,resources=ipaddresses,verbs=get;list;watch;update;patch;delete +// +kubebuilder:rbac:groups=local.sdn.cozystack.io,resources=ipaddresses/status,verbs=get;update;patch +// +kubebuilder:rbac:groups=local.sdn.cozystack.io,resources=ipaddressclasses,verbs=get;list;watch +// +kubebuilder:rbac:groups="",resources=events,verbs=create;patch + +// Reconcile drives an IPAddressClaim towards Bound. +func (r *IPAddressClaimReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) { + logger := log.FromContext(ctx) + + claim := &localv1alpha1.IPAddressClaim{} + if err := r.Get(ctx, req.NamespacedName, claim); err != nil { + return ctrl.Result{}, client.IgnoreNotFound(err) + } + + if !claim.DeletionTimestamp.IsZero() { + return ctrl.Result{}, r.finalizeClaim(ctx, claim) + } + + if !controllerutil.ContainsFinalizer(claim, localv1alpha1.ClaimProtectionFinalizer) { + controllerutil.AddFinalizer(claim, localv1alpha1.ClaimProtectionFinalizer) + if err := r.Update(ctx, claim); err != nil { + return ctrl.Result{}, err + } + } + + // Binding state comes first, and the class is consulted only when + // something is still missing: a fully bound claim must keep working — + // and keep its status maintained — even if its class was deleted. + bound, err := r.addressesBoundTo(ctx, claim) + if err != nil { + return ctrl.Result{}, err + } + if err := r.completePreBindings(ctx, claim, bound); err != nil { + return ctrl.Result{}, err + } + + className := "" + if len(missingFamilies(claim, bound)) > 0 { + className, err = r.resolveClass(ctx, claim) + if err != nil { + return ctrl.Result{}, err + } + if className != "" { + for _, family := range missingFamilies(claim, bound) { + matched, err := r.bindAvailableAddress(ctx, claim, className, family) + if err != nil { + return ctrl.Result{}, err + } + if matched != nil { + bound = append(bound, *matched) + } + } + } + } + + if err := r.updateClaimStatus(ctx, claim, className, bound); err != nil { + return ctrl.Result{}, err + } + + logger.V(1).Info("reconciled claim", "phase", claim.Status.Phase) + return ctrl.Result{}, nil +} + +// finalizeClaim runs the reclaim flow for every address bound to a deleted +// claim, then drops the protection finalizer. +func (r *IPAddressClaimReconciler) finalizeClaim(ctx context.Context, claim *localv1alpha1.IPAddressClaim) error { + if !controllerutil.ContainsFinalizer(claim, localv1alpha1.ClaimProtectionFinalizer) { + return nil + } + addrs, err := r.addressesBoundTo(ctx, claim) + if err != nil { + return err + } + for i := range addrs { + addr := &addrs[i] + if !addr.DeletionTimestamp.IsZero() { + continue + } + switch addr.Spec.ReclaimPolicy { + case localv1alpha1.ReclaimDelete: + // The driver's own finalizer tears down the backend allocation + // before the object goes away. + if err := r.Delete(ctx, addr); err != nil && !apierrors.IsNotFound(err) { + return err + } + r.Recorder.Eventf(claim, "Normal", "AddressDeleted", + "IPAddress %s deleted per reclaimPolicy Delete", addr.Name) + default: // Retain + if addr.Status.Phase != localv1alpha1.IPAddressReleased { + addr.Status.Phase = localv1alpha1.IPAddressReleased + if err := r.Status().Update(ctx, addr); err != nil { + return err + } + } + r.Recorder.Eventf(claim, "Normal", "AddressReleased", + "IPAddress %s released per reclaimPolicy Retain", addr.Name) + } + } + controllerutil.RemoveFinalizer(claim, localv1alpha1.ClaimProtectionFinalizer) + return r.Update(ctx, claim) +} + +// resolveClass resolves the claim's class name — spec first, then the sticky +// status record, then the default class — verifies the class exists, and +// stamps the provisioner annotation. An empty return with nil error means the +// claim cannot resolve yet; the reason is already recorded on the in-memory +// conditions, persisted by the caller's status update. +func (r *IPAddressClaimReconciler) resolveClass(ctx context.Context, claim *localv1alpha1.IPAddressClaim) (string, error) { + className := claim.Spec.ClassName + if className == "" { + className = claim.Status.ClassName + } + if className == "" { + var err error + className, err = r.defaultClassName(ctx, claim) + if err != nil || className == "" { + return "", err + } + } + + class := &localv1alpha1.IPAddressClass{} + if err := r.Get(ctx, types.NamespacedName{Name: className}, class); err != nil { + if apierrors.IsNotFound(err) { + r.markUnresolved(claim, localv1alpha1.ReasonClassNotFound, + fmt.Sprintf("IPAddressClass %q not found", className)) + return "", nil + } + return "", err + } + + // The stamp always mirrors the resolved class's provisioner; if the + // claim is re-targeted at a different class before binding, drivers + // must see the new name. + if claim.Annotations[localv1alpha1.ProvisionerAnnotation] != class.Spec.Provisioner { + if claim.Annotations == nil { + claim.Annotations = map[string]string{} + } + claim.Annotations[localv1alpha1.ProvisionerAnnotation] = class.Spec.Provisioner + if err := r.Update(ctx, claim); err != nil { + return "", err + } + } + return className, nil +} + +// defaultClassName finds the single IPAddressClass annotated as default. Zero +// or more than one default is a recorded, non-retriable condition. +func (r *IPAddressClaimReconciler) defaultClassName(ctx context.Context, claim *localv1alpha1.IPAddressClaim) (string, error) { + classes := &localv1alpha1.IPAddressClassList{} + if err := r.List(ctx, classes); err != nil { + return "", err + } + var defaults []string + for _, c := range classes.Items { + if c.Annotations[localv1alpha1.IsDefaultClassAnnotation] == "true" { + defaults = append(defaults, c.Name) + } + } + switch len(defaults) { + case 1: + return defaults[0], nil + case 0: + r.markUnresolved(claim, localv1alpha1.ReasonNoDefaultClass, + "claim names no class and no IPAddressClass is annotated as default") + return "", nil + default: + sort.Strings(defaults) + r.markUnresolved(claim, localv1alpha1.ReasonMultipleDefaultClasses, + fmt.Sprintf("multiple IPAddressClasses annotated as default: %v", defaults)) + return "", nil + } +} + +// markUnresolved records a failed class resolution on the in-memory object; +// the caller's status update persists it. +func (r *IPAddressClaimReconciler) markUnresolved(claim *localv1alpha1.IPAddressClaim, reason, message string) { + r.Recorder.Event(claim, "Warning", reason, message) + meta.SetStatusCondition(&claim.Status.Conditions, metav1.Condition{ + Type: localv1alpha1.ConditionClassResolved, + Status: metav1.ConditionFalse, + Reason: reason, + Message: message, + ObservedGeneration: claim.Generation, + }) +} + +// completePreBindings accepts driver pre-bound addresses by writing the +// claim's UID into claimRefs that carry none yet. +func (r *IPAddressClaimReconciler) completePreBindings(ctx context.Context, claim *localv1alpha1.IPAddressClaim, addrs []localv1alpha1.IPAddress) error { + for i := range addrs { + addr := &addrs[i] + if addr.Spec.ClaimRef.UID == "" { + addr.Spec.ClaimRef.UID = claim.UID + if err := r.Update(ctx, addr); err != nil { + return err + } + } + } + return nil +} + +// addressesBoundTo lists live addresses whose claimRef names this claim and +// whose UID is unset or matches. A UID mismatch is a stale binding to an +// earlier claim of the same name and is not ours. +func (r *IPAddressClaimReconciler) addressesBoundTo(ctx context.Context, claim *localv1alpha1.IPAddressClaim) ([]localv1alpha1.IPAddress, error) { + list := &localv1alpha1.IPAddressList{} + if err := r.List(ctx, list, client.MatchingFields{ + IPAddressClaimRefIndex: ClaimRefIndexKey(claim.Namespace, claim.Name), + }); err != nil { + return nil, err + } + var addrs []localv1alpha1.IPAddress + for _, addr := range list.Items { + if !addr.DeletionTimestamp.IsZero() { + continue + } + if addr.Spec.ClaimRef.UID != "" && addr.Spec.ClaimRef.UID != claim.UID { + continue + } + addrs = append(addrs, addr) + } + return addrs, nil +} + +// requestedFamilies expands the claim's family into the concrete families it +// needs bound. +func requestedFamilies(claim *localv1alpha1.IPAddressClaim) []localv1alpha1.AddressFamily { + switch claim.Spec.Family { + case localv1alpha1.FamilyIPv6: + return []localv1alpha1.AddressFamily{localv1alpha1.FamilyIPv6} + case localv1alpha1.FamilyDual: + return []localv1alpha1.AddressFamily{localv1alpha1.FamilyIPv4, localv1alpha1.FamilyIPv6} + default: + return []localv1alpha1.AddressFamily{localv1alpha1.FamilyIPv4} + } +} + +// missingFamilies reports which requested families no bound address +// satisfies. An address in phase Lost does not satisfy its family. +func missingFamilies(claim *localv1alpha1.IPAddressClaim, addrs []localv1alpha1.IPAddress) []localv1alpha1.AddressFamily { + var missing []localv1alpha1.AddressFamily + for _, family := range requestedFamilies(claim) { + satisfied := false + for _, addr := range addrs { + if addr.Status.Phase != localv1alpha1.IPAddressLost && familyOf(addr.Spec.Address) == family { + satisfied = true + break + } + } + if !satisfied { + missing = append(missing, family) + } + } + return missing +} + +// bindAvailableAddress binds one Available address of the wanted class and +// family to the claim, honouring spec.addressName when set. Returning +// (nil, nil) means nothing matched and the claim keeps waiting for its +// driver to provision. +func (r *IPAddressClaimReconciler) bindAvailableAddress(ctx context.Context, claim *localv1alpha1.IPAddressClaim, className string, family localv1alpha1.AddressFamily) (*localv1alpha1.IPAddress, error) { + var candidates []localv1alpha1.IPAddress + if claim.Spec.AddressName != "" { + addr := &localv1alpha1.IPAddress{} + err := r.Get(ctx, types.NamespacedName{Name: claim.Spec.AddressName}, addr) + if apierrors.IsNotFound(err) { + return nil, nil + } + if err != nil { + return nil, err + } + candidates = []localv1alpha1.IPAddress{*addr} + } else { + list := &localv1alpha1.IPAddressList{} + if err := r.List(ctx, list); err != nil { + return nil, err + } + candidates = list.Items + } + + var match *localv1alpha1.IPAddress + for i := range candidates { + addr := &candidates[i] + if addr.Spec.ClaimRef != nil || !addr.DeletionTimestamp.IsZero() { + continue + } + if addr.Status.Phase != localv1alpha1.IPAddressAvailable { + continue + } + if addr.Spec.ClassName != className || familyOf(addr.Spec.Address) != family { + continue + } + if match == nil || addr.Name < match.Name { + match = addr + } + } + if match == nil { + return nil, nil + } + match.Spec.ClaimRef = &localv1alpha1.ClaimReference{ + Namespace: claim.Namespace, + Name: claim.Name, + UID: claim.UID, + } + // A conflict here means someone bound it first; the returned error + // requeues the claim and the next pass picks another candidate. + if err := r.Update(ctx, match); err != nil { + return nil, err + } + r.Recorder.Eventf(claim, "Normal", "Matched", "bound Available IPAddress %s", match.Name) + return match, nil +} + +// updateClaimStatus recomputes phase, bound-address list, and conditions. +// An empty className means resolution was not needed (nothing missing) or +// not possible this pass (conditions already say why); the sticky +// status.className is left untouched then. +func (r *IPAddressClaimReconciler) updateClaimStatus(ctx context.Context, claim *localv1alpha1.IPAddressClaim, className string, bound []localv1alpha1.IPAddress) error { + previous := claim.Status.Phase + + sort.Slice(bound, func(i, j int) bool { return bound[i].Name < bound[j].Name }) + var reported []localv1alpha1.BoundAddress + for _, addr := range bound { + reported = append(reported, localv1alpha1.BoundAddress{Name: addr.Name, Address: addr.Spec.Address}) + } + + claim.Status.Addresses = reported + if className != "" { + claim.Status.ClassName = className + meta.SetStatusCondition(&claim.Status.Conditions, metav1.Condition{ + Type: localv1alpha1.ConditionClassResolved, + Status: metav1.ConditionTrue, + Reason: localv1alpha1.ReasonResolved, + Message: fmt.Sprintf("resolved to IPAddressClass %q", className), + ObservedGeneration: claim.Generation, + }) + } + + missing := missingFamilies(claim, bound) + switch { + case len(missing) == 0: + claim.Status.Phase = localv1alpha1.ClaimBound + meta.SetStatusCondition(&claim.Status.Conditions, metav1.Condition{ + Type: localv1alpha1.ConditionBound, + Status: metav1.ConditionTrue, + Reason: localv1alpha1.ReasonBound, + Message: "all requested families are bound", + ObservedGeneration: claim.Generation, + }) + case previous == localv1alpha1.ClaimBound || previous == localv1alpha1.ClaimLost: + claim.Status.Phase = localv1alpha1.ClaimLost + meta.SetStatusCondition(&claim.Status.Conditions, metav1.Condition{ + Type: localv1alpha1.ConditionBound, + Status: metav1.ConditionFalse, + Reason: localv1alpha1.ReasonAddressLost, + Message: fmt.Sprintf("bound address for families %v disappeared", missing), + ObservedGeneration: claim.Generation, + }) + default: + claim.Status.Phase = localv1alpha1.ClaimPending + message := fmt.Sprintf("waiting for class resolution before families %v can be provisioned", missing) + if provisioner := claim.Annotations[localv1alpha1.ProvisionerAnnotation]; provisioner != "" { + message = fmt.Sprintf("waiting for provisioner %q to provision families %v", provisioner, missing) + } + meta.SetStatusCondition(&claim.Status.Conditions, metav1.Condition{ + Type: localv1alpha1.ConditionBound, + Status: metav1.ConditionFalse, + Reason: localv1alpha1.ReasonWaitingForProvisioning, + Message: message, + ObservedGeneration: claim.Generation, + }) + } + + if err := r.Status().Update(ctx, claim); err != nil { + return err + } + if claim.Status.Phase != previous { + r.Recorder.Eventf(claim, "Normal", string(claim.Status.Phase), + "claim is %s", claim.Status.Phase) + } + return nil +} + +// claimsForAddress maps an IPAddress event to the claim it is bound to, or — +// for unbound addresses — to every claim still awaiting binding. +func (r *IPAddressClaimReconciler) claimsForAddress(ctx context.Context, o client.Object) []reconcile.Request { + addr := o.(*localv1alpha1.IPAddress) + if ref := addr.Spec.ClaimRef; ref != nil { + return []reconcile.Request{{NamespacedName: types.NamespacedName{Namespace: ref.Namespace, Name: ref.Name}}} + } + return r.unboundClaims(ctx) +} + +// claimsForClass maps an IPAddressClass event to every claim still awaiting +// binding — a new or changed class may unblock resolution. +func (r *IPAddressClaimReconciler) claimsForClass(ctx context.Context, _ client.Object) []reconcile.Request { + return r.unboundClaims(ctx) +} + +func (r *IPAddressClaimReconciler) unboundClaims(ctx context.Context) []reconcile.Request { + claims := &localv1alpha1.IPAddressClaimList{} + if err := r.List(ctx, claims); err != nil { + return nil + } + var reqs []reconcile.Request + for _, c := range claims.Items { + if c.Status.Phase != localv1alpha1.ClaimBound { + reqs = append(reqs, reconcile.Request{NamespacedName: types.NamespacedName{Namespace: c.Namespace, Name: c.Name}}) + } + } + return reqs +} + +// SetupWithManager sets up the controller with the Manager. +func (r *IPAddressClaimReconciler) SetupWithManager(mgr ctrl.Manager) error { + return ctrl.NewControllerManagedBy(mgr). + For(&localv1alpha1.IPAddressClaim{}). + Watches(&localv1alpha1.IPAddress{}, handler.EnqueueRequestsFromMapFunc(r.claimsForAddress)). + Watches(&localv1alpha1.IPAddressClass{}, handler.EnqueueRequestsFromMapFunc(r.claimsForClass)). + Named("ipaddressclaim"). + Complete(r) +} diff --git a/internal/controller/ipaddressclaim_controller_test.go b/internal/controller/ipaddressclaim_controller_test.go new file mode 100644 index 0000000..77a8199 --- /dev/null +++ b/internal/controller/ipaddressclaim_controller_test.go @@ -0,0 +1,442 @@ +/* +Copyright 2026. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package controller + +import ( + "context" + "testing" + + apierrors "k8s.io/apimachinery/pkg/api/errors" + "k8s.io/apimachinery/pkg/api/meta" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/types" + clientgoscheme "k8s.io/client-go/kubernetes/scheme" + "k8s.io/client-go/tools/record" + ctrl "sigs.k8s.io/controller-runtime" + "sigs.k8s.io/controller-runtime/pkg/client" + "sigs.k8s.io/controller-runtime/pkg/client/fake" + + localv1alpha1 "github.com/lllamnyp/address-controller/api/v1alpha1" +) + +func testScheme(t *testing.T) *runtime.Scheme { + t.Helper() + scheme := runtime.NewScheme() + if err := clientgoscheme.AddToScheme(scheme); err != nil { + t.Fatal(err) + } + if err := localv1alpha1.AddToScheme(scheme); err != nil { + t.Fatal(err) + } + return scheme +} + +func testClient(t *testing.T, objs ...client.Object) client.Client { + t.Helper() + return fake.NewClientBuilder(). + WithScheme(testScheme(t)). + WithStatusSubresource(&localv1alpha1.IPAddress{}, &localv1alpha1.IPAddressClaim{}). + WithIndex(&localv1alpha1.IPAddress{}, IPAddressClaimRefIndex, func(o client.Object) []string { + addr := o.(*localv1alpha1.IPAddress) + if addr.Spec.ClaimRef == nil { + return nil + } + return []string{ClaimRefIndexKey(addr.Spec.ClaimRef.Namespace, addr.Spec.ClaimRef.Name)} + }). + WithObjects(objs...). + Build() +} + +func claimReconciler(c client.Client) *IPAddressClaimReconciler { + return &IPAddressClaimReconciler{ + Client: c, + Scheme: c.Scheme(), + Recorder: record.NewFakeRecorder(100), + } +} + +func reconcileClaim(t *testing.T, r *IPAddressClaimReconciler, namespace, name string) { + t.Helper() + _, err := r.Reconcile(context.Background(), ctrl.Request{ + NamespacedName: types.NamespacedName{Namespace: namespace, Name: name}, + }) + if err != nil { + t.Fatalf("reconcile: %v", err) + } +} + +func getClaim(t *testing.T, c client.Client, namespace, name string) *localv1alpha1.IPAddressClaim { + t.Helper() + claim := &localv1alpha1.IPAddressClaim{} + if err := c.Get(context.Background(), types.NamespacedName{Namespace: namespace, Name: name}, claim); err != nil { + t.Fatalf("get claim: %v", err) + } + return claim +} + +func getAddress(t *testing.T, c client.Client, name string) *localv1alpha1.IPAddress { + t.Helper() + addr := &localv1alpha1.IPAddress{} + if err := c.Get(context.Background(), types.NamespacedName{Name: name}, addr); err != nil { + t.Fatalf("get address %s: %v", name, err) + } + return addr +} + +func publicClass(annotations map[string]string) *localv1alpha1.IPAddressClass { + return &localv1alpha1.IPAddressClass{ + ObjectMeta: metav1.ObjectMeta{Name: "public", Annotations: annotations}, + Spec: localv1alpha1.IPAddressClassSpec{ + Provisioner: "metallb.drivers.local.sdn.cozystack.io", + ReclaimPolicy: localv1alpha1.ReclaimRetain, + }, + } +} + +func pendingClaim(className string) *localv1alpha1.IPAddressClaim { + return &localv1alpha1.IPAddressClaim{ + ObjectMeta: metav1.ObjectMeta{Name: "web", Namespace: "tenant-a", UID: "claim-uid-1"}, + Spec: localv1alpha1.IPAddressClaimSpec{ + ClassName: className, + Family: localv1alpha1.FamilyIPv4, + }, + } +} + +func TestClaimResolvesClassAndWaitsForProvisioner(t *testing.T) { + c := testClient(t, publicClass(nil), pendingClaim("public")) + reconcileClaim(t, claimReconciler(c), "tenant-a", "web") + + claim := getClaim(t, c, "tenant-a", "web") + if claim.Status.Phase != localv1alpha1.ClaimPending { + t.Errorf("phase = %q, want Pending", claim.Status.Phase) + } + if got := claim.Annotations[localv1alpha1.ProvisionerAnnotation]; got != "metallb.drivers.local.sdn.cozystack.io" { + t.Errorf("provisioner annotation = %q", got) + } + if claim.Status.ClassName != "public" { + t.Errorf("status.className = %q", claim.Status.ClassName) + } + if !hasFinalizer(claim.Finalizers, localv1alpha1.ClaimProtectionFinalizer) { + t.Error("claim protection finalizer missing") + } + cond := meta.FindStatusCondition(claim.Status.Conditions, localv1alpha1.ConditionBound) + if cond == nil || cond.Reason != localv1alpha1.ReasonWaitingForProvisioning { + t.Errorf("Bound condition = %+v, want reason WaitingForProvisioning", cond) + } +} + +func TestClaimUsesDefaultClass(t *testing.T) { + c := testClient(t, + publicClass(map[string]string{localv1alpha1.IsDefaultClassAnnotation: "true"}), + pendingClaim("")) + reconcileClaim(t, claimReconciler(c), "tenant-a", "web") + + claim := getClaim(t, c, "tenant-a", "web") + if claim.Status.ClassName != "public" { + t.Errorf("status.className = %q, want public (the default class)", claim.Status.ClassName) + } +} + +func TestClaimWithoutAnyDefaultClassStaysPending(t *testing.T) { + c := testClient(t, publicClass(nil), pendingClaim("")) + reconcileClaim(t, claimReconciler(c), "tenant-a", "web") + + claim := getClaim(t, c, "tenant-a", "web") + cond := meta.FindStatusCondition(claim.Status.Conditions, localv1alpha1.ConditionClassResolved) + if cond == nil || cond.Reason != localv1alpha1.ReasonNoDefaultClass { + t.Errorf("ClassResolved condition = %+v, want reason NoDefaultClass", cond) + } +} + +func TestClaimWithMultipleDefaultClassesStaysPending(t *testing.T) { + second := publicClass(map[string]string{localv1alpha1.IsDefaultClassAnnotation: "true"}) + second.Name = "public-2" + c := testClient(t, + publicClass(map[string]string{localv1alpha1.IsDefaultClassAnnotation: "true"}), + second, + pendingClaim("")) + reconcileClaim(t, claimReconciler(c), "tenant-a", "web") + + claim := getClaim(t, c, "tenant-a", "web") + cond := meta.FindStatusCondition(claim.Status.Conditions, localv1alpha1.ConditionClassResolved) + if cond == nil || cond.Reason != localv1alpha1.ReasonMultipleDefaultClasses { + t.Errorf("ClassResolved condition = %+v, want reason MultipleDefaultClasses", cond) + } +} + +func TestClaimAcceptsDriverPreBoundAddress(t *testing.T) { + addr := &localv1alpha1.IPAddress{ + ObjectMeta: metav1.ObjectMeta{Name: "ip-203-0-113-7"}, + Spec: localv1alpha1.IPAddressSpec{ + ClassName: "public", + Address: "203.0.113.7", + // Driver pre-binds without a UID; the core controller completes it. + ClaimRef: &localv1alpha1.ClaimReference{Namespace: "tenant-a", Name: "web"}, + Source: localv1alpha1.IPAddressSource{FromClass: &localv1alpha1.FromClassSource{}}, + }, + } + c := testClient(t, publicClass(nil), pendingClaim("public"), addr) + reconcileClaim(t, claimReconciler(c), "tenant-a", "web") + + claim := getClaim(t, c, "tenant-a", "web") + if claim.Status.Phase != localv1alpha1.ClaimBound { + t.Fatalf("phase = %q, want Bound", claim.Status.Phase) + } + if len(claim.Status.Addresses) != 1 || claim.Status.Addresses[0].Address != "203.0.113.7" { + t.Errorf("status.addresses = %+v", claim.Status.Addresses) + } + if got := getAddress(t, c, "ip-203-0-113-7").Spec.ClaimRef.UID; got != "claim-uid-1" { + t.Errorf("claimRef.uid = %q, want completed to claim-uid-1", got) + } +} + +func TestClaimMatchesAvailableAddress(t *testing.T) { + addr := &localv1alpha1.IPAddress{ + ObjectMeta: metav1.ObjectMeta{Name: "ip-203-0-113-8"}, + Spec: localv1alpha1.IPAddressSpec{ + ClassName: "public", + Address: "203.0.113.8", + Source: localv1alpha1.IPAddressSource{FromClass: &localv1alpha1.FromClassSource{}}, + }, + Status: localv1alpha1.IPAddressStatus{Phase: localv1alpha1.IPAddressAvailable}, + } + c := testClient(t, publicClass(nil), pendingClaim("public"), addr) + reconcileClaim(t, claimReconciler(c), "tenant-a", "web") + + claim := getClaim(t, c, "tenant-a", "web") + if claim.Status.Phase != localv1alpha1.ClaimBound { + t.Fatalf("phase = %q, want Bound", claim.Status.Phase) + } + ref := getAddress(t, c, "ip-203-0-113-8").Spec.ClaimRef + if ref == nil || ref.Namespace != "tenant-a" || ref.Name != "web" || ref.UID != "claim-uid-1" { + t.Errorf("claimRef = %+v", ref) + } +} + +func TestClaimIgnoresAvailableAddressOfWrongClassOrFamily(t *testing.T) { + wrongClass := &localv1alpha1.IPAddress{ + ObjectMeta: metav1.ObjectMeta{Name: "ip-wrong-class"}, + Spec: localv1alpha1.IPAddressSpec{ + ClassName: "other", + Address: "203.0.113.9", + Source: localv1alpha1.IPAddressSource{FromClass: &localv1alpha1.FromClassSource{}}, + }, + Status: localv1alpha1.IPAddressStatus{Phase: localv1alpha1.IPAddressAvailable}, + } + wrongFamily := &localv1alpha1.IPAddress{ + ObjectMeta: metav1.ObjectMeta{Name: "ip-wrong-family"}, + Spec: localv1alpha1.IPAddressSpec{ + ClassName: "public", + Address: "2001:db8::9", + Source: localv1alpha1.IPAddressSource{FromClass: &localv1alpha1.FromClassSource{}}, + }, + Status: localv1alpha1.IPAddressStatus{Phase: localv1alpha1.IPAddressAvailable}, + } + c := testClient(t, publicClass(nil), pendingClaim("public"), wrongClass, wrongFamily) + reconcileClaim(t, claimReconciler(c), "tenant-a", "web") + + if claim := getClaim(t, c, "tenant-a", "web"); claim.Status.Phase != localv1alpha1.ClaimPending { + t.Errorf("phase = %q, want Pending", claim.Status.Phase) + } +} + +func TestDualClaimNeedsBothFamilies(t *testing.T) { + claim := pendingClaim("public") + claim.Spec.Family = localv1alpha1.FamilyDual + v4 := &localv1alpha1.IPAddress{ + ObjectMeta: metav1.ObjectMeta{Name: "ip-v4"}, + Spec: localv1alpha1.IPAddressSpec{ + ClassName: "public", + Address: "203.0.113.10", + Source: localv1alpha1.IPAddressSource{FromClass: &localv1alpha1.FromClassSource{}}, + }, + Status: localv1alpha1.IPAddressStatus{Phase: localv1alpha1.IPAddressAvailable}, + } + c := testClient(t, publicClass(nil), claim, v4) + r := claimReconciler(c) + reconcileClaim(t, r, "tenant-a", "web") + + got := getClaim(t, c, "tenant-a", "web") + if got.Status.Phase != localv1alpha1.ClaimPending { + t.Fatalf("phase = %q, want Pending (v6 still missing)", got.Status.Phase) + } + if len(got.Status.Addresses) != 1 { + t.Fatalf("status.addresses = %+v, want the v4 half reported", got.Status.Addresses) + } + + v6 := &localv1alpha1.IPAddress{ + ObjectMeta: metav1.ObjectMeta{Name: "ip-v6"}, + Spec: localv1alpha1.IPAddressSpec{ + ClassName: "public", + Address: "2001:db8::10", + Source: localv1alpha1.IPAddressSource{FromClass: &localv1alpha1.FromClassSource{}}, + }, + Status: localv1alpha1.IPAddressStatus{Phase: localv1alpha1.IPAddressAvailable}, + } + if err := c.Create(context.Background(), v6); err != nil { + t.Fatal(err) + } + reconcileClaim(t, r, "tenant-a", "web") + + got = getClaim(t, c, "tenant-a", "web") + if got.Status.Phase != localv1alpha1.ClaimBound { + t.Fatalf("phase = %q, want Bound", got.Status.Phase) + } + if len(got.Status.Addresses) != 2 { + t.Errorf("status.addresses = %+v, want both families", got.Status.Addresses) + } +} + +func TestClaimDeletionRetainReleasesAddress(t *testing.T) { + claim := pendingClaim("public") + claim.Finalizers = []string{localv1alpha1.ClaimProtectionFinalizer} + addr := &localv1alpha1.IPAddress{ + ObjectMeta: metav1.ObjectMeta{Name: "ip-retained"}, + Spec: localv1alpha1.IPAddressSpec{ + ClassName: "public", + Address: "203.0.113.11", + ReclaimPolicy: localv1alpha1.ReclaimRetain, + ClaimRef: &localv1alpha1.ClaimReference{Namespace: "tenant-a", Name: "web", UID: "claim-uid-1"}, + Source: localv1alpha1.IPAddressSource{FromClass: &localv1alpha1.FromClassSource{}}, + }, + Status: localv1alpha1.IPAddressStatus{Phase: localv1alpha1.IPAddressBound}, + } + c := testClient(t, publicClass(nil), claim, addr) + if err := c.Delete(context.Background(), claim); err != nil { + t.Fatal(err) + } + reconcileClaim(t, claimReconciler(c), "tenant-a", "web") + + err := c.Get(context.Background(), types.NamespacedName{Namespace: "tenant-a", Name: "web"}, &localv1alpha1.IPAddressClaim{}) + if !apierrors.IsNotFound(err) { + t.Errorf("claim still present after finalization: %v", err) + } + got := getAddress(t, c, "ip-retained") + if got.Status.Phase != localv1alpha1.IPAddressReleased { + t.Errorf("address phase = %q, want Released", got.Status.Phase) + } + if got.Spec.ClaimRef == nil { + t.Error("claimRef cleared on Retain; it must survive until an admin clears it") + } +} + +func TestClaimDeletionDeletePolicyDeletesAddress(t *testing.T) { + claim := pendingClaim("public") + claim.Finalizers = []string{localv1alpha1.ClaimProtectionFinalizer} + addr := &localv1alpha1.IPAddress{ + ObjectMeta: metav1.ObjectMeta{Name: "ip-deleted"}, + Spec: localv1alpha1.IPAddressSpec{ + ClassName: "public", + Address: "203.0.113.12", + ReclaimPolicy: localv1alpha1.ReclaimDelete, + ClaimRef: &localv1alpha1.ClaimReference{Namespace: "tenant-a", Name: "web", UID: "claim-uid-1"}, + Source: localv1alpha1.IPAddressSource{FromClass: &localv1alpha1.FromClassSource{}}, + }, + Status: localv1alpha1.IPAddressStatus{Phase: localv1alpha1.IPAddressBound}, + } + c := testClient(t, publicClass(nil), claim, addr) + if err := c.Delete(context.Background(), claim); err != nil { + t.Fatal(err) + } + reconcileClaim(t, claimReconciler(c), "tenant-a", "web") + + err := c.Get(context.Background(), types.NamespacedName{Name: "ip-deleted"}, &localv1alpha1.IPAddress{}) + if !apierrors.IsNotFound(err) { + t.Errorf("address still present after Delete reclaim: %v", err) + } +} + +func TestBoundClaimSurvivesClassDeletion(t *testing.T) { + // A fully bound claim must reconcile without touching its class: + // deleting the class breaks neither the binding nor status upkeep. + claim := pendingClaim("public") + claim.Finalizers = []string{localv1alpha1.ClaimProtectionFinalizer} + claim.Annotations = map[string]string{localv1alpha1.ProvisionerAnnotation: "metallb.drivers.local.sdn.cozystack.io"} + claim.Status = localv1alpha1.IPAddressClaimStatus{ + Phase: localv1alpha1.ClaimBound, + ClassName: "public", + } + addr := &localv1alpha1.IPAddress{ + ObjectMeta: metav1.ObjectMeta{Name: "ip-203-0-113-14"}, + Spec: localv1alpha1.IPAddressSpec{ + ClassName: "public", + Address: "203.0.113.14", + ClaimRef: &localv1alpha1.ClaimReference{Namespace: "tenant-a", Name: "web", UID: "claim-uid-1"}, + Source: localv1alpha1.IPAddressSource{FromClass: &localv1alpha1.FromClassSource{}}, + }, + Status: localv1alpha1.IPAddressStatus{Phase: localv1alpha1.IPAddressBound}, + } + // Note: no IPAddressClass object at all. + c := testClient(t, claim, addr) + reconcileClaim(t, claimReconciler(c), "tenant-a", "web") + + got := getClaim(t, c, "tenant-a", "web") + if got.Status.Phase != localv1alpha1.ClaimBound { + t.Errorf("phase = %q, want Bound to survive class deletion", got.Status.Phase) + } + if got.Status.ClassName != "public" { + t.Errorf("status.className = %q, want the sticky record untouched", got.Status.ClassName) + } + if len(got.Status.Addresses) != 1 || got.Status.Addresses[0].Address != "203.0.113.14" { + t.Errorf("status.addresses = %+v, want status upkeep to continue", got.Status.Addresses) + } +} + +func TestPendingClaimWithMissingClassRecordsClassNotFound(t *testing.T) { + // An unbound claim naming a class that does not exist stays Pending + // with the reason recorded; only provisioning is blocked. + c := testClient(t, pendingClaim("nonexistent")) + reconcileClaim(t, claimReconciler(c), "tenant-a", "web") + + claim := getClaim(t, c, "tenant-a", "web") + if claim.Status.Phase != localv1alpha1.ClaimPending { + t.Errorf("phase = %q, want Pending", claim.Status.Phase) + } + cond := meta.FindStatusCondition(claim.Status.Conditions, localv1alpha1.ConditionClassResolved) + if cond == nil || cond.Reason != localv1alpha1.ReasonClassNotFound { + t.Errorf("ClassResolved condition = %+v, want reason ClassNotFound", cond) + } +} + +func TestBoundClaimGoesLostWhenAddressDisappears(t *testing.T) { + claim := pendingClaim("public") + claim.Finalizers = []string{localv1alpha1.ClaimProtectionFinalizer} + claim.Annotations = map[string]string{localv1alpha1.ProvisionerAnnotation: "metallb.drivers.local.sdn.cozystack.io"} + claim.Status = localv1alpha1.IPAddressClaimStatus{ + Phase: localv1alpha1.ClaimBound, + ClassName: "public", + Addresses: []localv1alpha1.BoundAddress{{Name: "ip-gone", Address: "203.0.113.13"}}, + } + c := testClient(t, publicClass(nil), claim) + reconcileClaim(t, claimReconciler(c), "tenant-a", "web") + + got := getClaim(t, c, "tenant-a", "web") + if got.Status.Phase != localv1alpha1.ClaimLost { + t.Errorf("phase = %q, want Lost", got.Status.Phase) + } +} + +func hasFinalizer(finalizers []string, want string) bool { + for _, f := range finalizers { + if f == want { + return true + } + } + return false +} diff --git a/test/e2e/e2e_suite_test.go b/test/e2e/e2e_suite_test.go new file mode 100644 index 0000000..7aa98df --- /dev/null +++ b/test/e2e/e2e_suite_test.go @@ -0,0 +1,110 @@ +/* +Copyright 2026. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package e2e + +import ( + "fmt" + "os" + "os/exec" + "testing" + + . "github.com/onsi/ginkgo/v2" + . "github.com/onsi/gomega" + + "github.com/lllamnyp/address-controller/test/utils" +) + +var ( + // Optional Environment Variables: + // - PROMETHEUS_INSTALL_SKIP=true: Skips Prometheus Operator installation during test setup. + // - CERT_MANAGER_INSTALL_SKIP=true: Skips CertManager installation during test setup. + // These variables are useful if Prometheus or CertManager is already installed, avoiding + // re-installation and conflicts. + skipPrometheusInstall = os.Getenv("PROMETHEUS_INSTALL_SKIP") == "true" + skipCertManagerInstall = os.Getenv("CERT_MANAGER_INSTALL_SKIP") == "true" + // isPrometheusOperatorAlreadyInstalled will be set true when prometheus CRDs be found on the cluster + isPrometheusOperatorAlreadyInstalled = false + // isCertManagerAlreadyInstalled will be set true when CertManager CRDs be found on the cluster + isCertManagerAlreadyInstalled = false + + // projectImage is the name of the image which will be build and loaded + // with the code source changes to be tested. + projectImage = "example.com/address-controller:v0.0.1" +) + +// TestE2E runs the end-to-end (e2e) test suite for the project. These tests execute in an isolated, +// temporary environment to validate project changes with the the purposed to be used in CI jobs. +// The default setup requires Kind, builds/loads the Manager Docker image locally, and installs +// CertManager and Prometheus. +func TestE2E(t *testing.T) { + RegisterFailHandler(Fail) + _, _ = fmt.Fprintf(GinkgoWriter, "Starting address-controller integration test suite\n") + RunSpecs(t, "e2e suite") +} + +var _ = BeforeSuite(func() { + By("Ensure that Prometheus is enabled") + _ = utils.UncommentCode("config/default/kustomization.yaml", "#- ../prometheus", "#") + + By("building the manager(Operator) image") + cmd := exec.Command("make", "docker-build", fmt.Sprintf("IMG=%s", projectImage)) + _, err := utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred(), "Failed to build the manager(Operator) image") + + // TODO(user): If you want to change the e2e test vendor from Kind, ensure the image is + // built and available before running the tests. Also, remove the following block. + By("loading the manager(Operator) image on Kind") + err = utils.LoadImageToKindClusterWithName(projectImage) + ExpectWithOffset(1, err).NotTo(HaveOccurred(), "Failed to load the manager(Operator) image into Kind") + + // The tests-e2e are intended to run on a temporary cluster that is created and destroyed for testing. + // To prevent errors when tests run in environments with Prometheus or CertManager already installed, + // we check for their presence before execution. + // Setup Prometheus and CertManager before the suite if not skipped and if not already installed + if !skipPrometheusInstall { + By("checking if prometheus is installed already") + isPrometheusOperatorAlreadyInstalled = utils.IsPrometheusCRDsInstalled() + if !isPrometheusOperatorAlreadyInstalled { + _, _ = fmt.Fprintf(GinkgoWriter, "Installing Prometheus Operator...\n") + Expect(utils.InstallPrometheusOperator()).To(Succeed(), "Failed to install Prometheus Operator") + } else { + _, _ = fmt.Fprintf(GinkgoWriter, "WARNING: Prometheus Operator is already installed. Skipping installation...\n") + } + } + if !skipCertManagerInstall { + By("checking if cert manager is installed already") + isCertManagerAlreadyInstalled = utils.IsCertManagerCRDsInstalled() + if !isCertManagerAlreadyInstalled { + _, _ = fmt.Fprintf(GinkgoWriter, "Installing CertManager...\n") + Expect(utils.InstallCertManager()).To(Succeed(), "Failed to install CertManager") + } else { + _, _ = fmt.Fprintf(GinkgoWriter, "WARNING: CertManager is already installed. Skipping installation...\n") + } + } +}) + +var _ = AfterSuite(func() { + // Teardown Prometheus and CertManager after the suite if not skipped and if they were not already installed + if !skipPrometheusInstall && !isPrometheusOperatorAlreadyInstalled { + _, _ = fmt.Fprintf(GinkgoWriter, "Uninstalling Prometheus Operator...\n") + utils.UninstallPrometheusOperator() + } + if !skipCertManagerInstall && !isCertManagerAlreadyInstalled { + _, _ = fmt.Fprintf(GinkgoWriter, "Uninstalling CertManager...\n") + utils.UninstallCertManager() + } +}) diff --git a/test/e2e/e2e_test.go b/test/e2e/e2e_test.go new file mode 100644 index 0000000..d57400b --- /dev/null +++ b/test/e2e/e2e_test.go @@ -0,0 +1,334 @@ +/* +Copyright 2026. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package e2e + +import ( + "encoding/json" + "fmt" + "os" + "os/exec" + "path/filepath" + "time" + + . "github.com/onsi/ginkgo/v2" + . "github.com/onsi/gomega" + + "github.com/lllamnyp/address-controller/test/utils" +) + +// namespace where the project is deployed in +const namespace = "address-controller-system" + +// serviceAccountName created for the project +const serviceAccountName = "address-controller-controller-manager" + +// metricsServiceName is the name of the metrics service of the project +const metricsServiceName = "address-controller-controller-manager-metrics-service" + +// metricsRoleBindingName is the name of the RBAC that will be created to allow get the metrics data +const metricsRoleBindingName = "address-controller-metrics-binding" + +var _ = Describe("Manager", Ordered, func() { + var controllerPodName string + + // Before running the tests, set up the environment by creating the namespace, + // enforce the restricted security policy to the namespace, installing CRDs, + // and deploying the controller. + BeforeAll(func() { + By("creating manager namespace") + cmd := exec.Command("kubectl", "create", "ns", namespace) + _, err := utils.Run(cmd) + Expect(err).NotTo(HaveOccurred(), "Failed to create namespace") + + By("labeling the namespace to enforce the restricted security policy") + cmd = exec.Command("kubectl", "label", "--overwrite", "ns", namespace, + "pod-security.kubernetes.io/enforce=restricted") + _, err = utils.Run(cmd) + Expect(err).NotTo(HaveOccurred(), "Failed to label namespace with restricted policy") + + By("installing CRDs") + cmd = exec.Command("make", "install") + _, err = utils.Run(cmd) + Expect(err).NotTo(HaveOccurred(), "Failed to install CRDs") + + By("deploying the controller-manager") + cmd = exec.Command("make", "deploy", fmt.Sprintf("IMG=%s", projectImage)) + _, err = utils.Run(cmd) + Expect(err).NotTo(HaveOccurred(), "Failed to deploy the controller-manager") + }) + + // After all tests have been executed, clean up by undeploying the controller, uninstalling CRDs, + // and deleting the namespace. + AfterAll(func() { + By("cleaning up the curl pod for metrics") + cmd := exec.Command("kubectl", "delete", "pod", "curl-metrics", "-n", namespace) + _, _ = utils.Run(cmd) + + By("undeploying the controller-manager") + cmd = exec.Command("make", "undeploy") + _, _ = utils.Run(cmd) + + By("uninstalling CRDs") + cmd = exec.Command("make", "uninstall") + _, _ = utils.Run(cmd) + + By("removing manager namespace") + cmd = exec.Command("kubectl", "delete", "ns", namespace) + _, _ = utils.Run(cmd) + }) + + // After each test, check for failures and collect logs, events, + // and pod descriptions for debugging. + AfterEach(func() { + specReport := CurrentSpecReport() + if specReport.Failed() { + By("Fetching controller manager pod logs") + cmd := exec.Command("kubectl", "logs", controllerPodName, "-n", namespace) + controllerLogs, err := utils.Run(cmd) + if err == nil { + _, _ = fmt.Fprintf(GinkgoWriter, "Controller logs:\n %s", controllerLogs) + } else { + _, _ = fmt.Fprintf(GinkgoWriter, "Failed to get Controller logs: %s", err) + } + + By("Fetching Kubernetes events") + cmd = exec.Command("kubectl", "get", "events", "-n", namespace, "--sort-by=.lastTimestamp") + eventsOutput, err := utils.Run(cmd) + if err == nil { + _, _ = fmt.Fprintf(GinkgoWriter, "Kubernetes events:\n%s", eventsOutput) + } else { + _, _ = fmt.Fprintf(GinkgoWriter, "Failed to get Kubernetes events: %s", err) + } + + By("Fetching curl-metrics logs") + cmd = exec.Command("kubectl", "logs", "curl-metrics", "-n", namespace) + metricsOutput, err := utils.Run(cmd) + if err == nil { + _, _ = fmt.Fprintf(GinkgoWriter, "Metrics logs:\n %s", metricsOutput) + } else { + _, _ = fmt.Fprintf(GinkgoWriter, "Failed to get curl-metrics logs: %s", err) + } + + By("Fetching controller manager pod description") + cmd = exec.Command("kubectl", "describe", "pod", controllerPodName, "-n", namespace) + podDescription, err := utils.Run(cmd) + if err == nil { + fmt.Println("Pod description:\n", podDescription) + } else { + fmt.Println("Failed to describe controller pod") + } + } + }) + + SetDefaultEventuallyTimeout(2 * time.Minute) + SetDefaultEventuallyPollingInterval(time.Second) + + Context("Manager", func() { + It("should run successfully", func() { + By("validating that the controller-manager pod is running as expected") + verifyControllerUp := func(g Gomega) { + // Get the name of the controller-manager pod + cmd := exec.Command("kubectl", "get", + "pods", "-l", "control-plane=controller-manager", + "-o", "go-template={{ range .items }}"+ + "{{ if not .metadata.deletionTimestamp }}"+ + "{{ .metadata.name }}"+ + "{{ \"\\n\" }}{{ end }}{{ end }}", + "-n", namespace, + ) + + podOutput, err := utils.Run(cmd) + g.Expect(err).NotTo(HaveOccurred(), "Failed to retrieve controller-manager pod information") + podNames := utils.GetNonEmptyLines(podOutput) + g.Expect(podNames).To(HaveLen(1), "expected 1 controller pod running") + controllerPodName = podNames[0] + g.Expect(controllerPodName).To(ContainSubstring("controller-manager")) + + // Validate the pod's status + cmd = exec.Command("kubectl", "get", + "pods", controllerPodName, "-o", "jsonpath={.status.phase}", + "-n", namespace, + ) + output, err := utils.Run(cmd) + g.Expect(err).NotTo(HaveOccurred()) + g.Expect(output).To(Equal("Running"), "Incorrect controller-manager pod status") + } + Eventually(verifyControllerUp).Should(Succeed()) + }) + + It("should ensure the metrics endpoint is serving metrics", func() { + By("creating a ClusterRoleBinding for the service account to allow access to metrics") + cmd := exec.Command("kubectl", "create", "clusterrolebinding", metricsRoleBindingName, + "--clusterrole=address-controller-metrics-reader", + fmt.Sprintf("--serviceaccount=%s:%s", namespace, serviceAccountName), + ) + _, err := utils.Run(cmd) + Expect(err).NotTo(HaveOccurred(), "Failed to create ClusterRoleBinding") + + By("validating that the metrics service is available") + cmd = exec.Command("kubectl", "get", "service", metricsServiceName, "-n", namespace) + _, err = utils.Run(cmd) + Expect(err).NotTo(HaveOccurred(), "Metrics service should exist") + + By("validating that the ServiceMonitor for Prometheus is applied in the namespace") + cmd = exec.Command("kubectl", "get", "ServiceMonitor", "-n", namespace) + _, err = utils.Run(cmd) + Expect(err).NotTo(HaveOccurred(), "ServiceMonitor should exist") + + By("getting the service account token") + token, err := serviceAccountToken() + Expect(err).NotTo(HaveOccurred()) + Expect(token).NotTo(BeEmpty()) + + By("waiting for the metrics endpoint to be ready") + verifyMetricsEndpointReady := func(g Gomega) { + cmd := exec.Command("kubectl", "get", "endpoints", metricsServiceName, "-n", namespace) + output, err := utils.Run(cmd) + g.Expect(err).NotTo(HaveOccurred()) + g.Expect(output).To(ContainSubstring("8443"), "Metrics endpoint is not ready") + } + Eventually(verifyMetricsEndpointReady).Should(Succeed()) + + By("verifying that the controller manager is serving the metrics server") + verifyMetricsServerStarted := func(g Gomega) { + cmd := exec.Command("kubectl", "logs", controllerPodName, "-n", namespace) + output, err := utils.Run(cmd) + g.Expect(err).NotTo(HaveOccurred()) + g.Expect(output).To(ContainSubstring("controller-runtime.metrics\tServing metrics server"), + "Metrics server not yet started") + } + Eventually(verifyMetricsServerStarted).Should(Succeed()) + + By("creating the curl-metrics pod to access the metrics endpoint") + cmd = exec.Command("kubectl", "run", "curl-metrics", "--restart=Never", + "--namespace", namespace, + "--image=curlimages/curl:latest", + "--overrides", + fmt.Sprintf(`{ + "spec": { + "containers": [{ + "name": "curl", + "image": "curlimages/curl:latest", + "command": ["/bin/sh", "-c"], + "args": ["curl -v -k -H 'Authorization: Bearer %s' https://%s.%s.svc.cluster.local:8443/metrics"], + "securityContext": { + "allowPrivilegeEscalation": false, + "capabilities": { + "drop": ["ALL"] + }, + "runAsNonRoot": true, + "runAsUser": 1000, + "seccompProfile": { + "type": "RuntimeDefault" + } + } + }], + "serviceAccount": "%s" + } + }`, token, metricsServiceName, namespace, serviceAccountName)) + _, err = utils.Run(cmd) + Expect(err).NotTo(HaveOccurred(), "Failed to create curl-metrics pod") + + By("waiting for the curl-metrics pod to complete.") + verifyCurlUp := func(g Gomega) { + cmd := exec.Command("kubectl", "get", "pods", "curl-metrics", + "-o", "jsonpath={.status.phase}", + "-n", namespace) + output, err := utils.Run(cmd) + g.Expect(err).NotTo(HaveOccurred()) + g.Expect(output).To(Equal("Succeeded"), "curl pod in wrong status") + } + Eventually(verifyCurlUp, 5*time.Minute).Should(Succeed()) + + By("getting the metrics by checking curl-metrics logs") + metricsOutput := getMetricsOutput() + Expect(metricsOutput).To(ContainSubstring( + "controller_runtime_reconcile_total", + )) + }) + + // +kubebuilder:scaffold:e2e-webhooks-checks + + // TODO: Customize the e2e test suite with scenarios specific to your project. + // Consider applying sample/CR(s) and check their status and/or verifying + // the reconciliation by using the metrics, i.e.: + // metricsOutput := getMetricsOutput() + // Expect(metricsOutput).To(ContainSubstring( + // fmt.Sprintf(`controller_runtime_reconcile_total{controller="%s",result="success"} 1`, + // strings.ToLower(), + // )) + }) +}) + +// serviceAccountToken returns a token for the specified service account in the given namespace. +// It uses the Kubernetes TokenRequest API to generate a token by directly sending a request +// and parsing the resulting token from the API response. +func serviceAccountToken() (string, error) { + const tokenRequestRawString = `{ + "apiVersion": "authentication.k8s.io/v1", + "kind": "TokenRequest" + }` + + // Temporary file to store the token request + secretName := fmt.Sprintf("%s-token-request", serviceAccountName) + tokenRequestFile := filepath.Join("/tmp", secretName) + err := os.WriteFile(tokenRequestFile, []byte(tokenRequestRawString), os.FileMode(0o644)) + if err != nil { + return "", err + } + + var out string + verifyTokenCreation := func(g Gomega) { + // Execute kubectl command to create the token + cmd := exec.Command("kubectl", "create", "--raw", fmt.Sprintf( + "/api/v1/namespaces/%s/serviceaccounts/%s/token", + namespace, + serviceAccountName, + ), "-f", tokenRequestFile) + + output, err := cmd.CombinedOutput() + g.Expect(err).NotTo(HaveOccurred()) + + // Parse the JSON output to extract the token + var token tokenRequest + err = json.Unmarshal(output, &token) + g.Expect(err).NotTo(HaveOccurred()) + + out = token.Status.Token + } + Eventually(verifyTokenCreation).Should(Succeed()) + + return out, err +} + +// getMetricsOutput retrieves and returns the logs from the curl pod used to access the metrics endpoint. +func getMetricsOutput() string { + By("getting the curl-metrics logs") + cmd := exec.Command("kubectl", "logs", "curl-metrics", "-n", namespace) + metricsOutput, err := utils.Run(cmd) + Expect(err).NotTo(HaveOccurred(), "Failed to retrieve logs from curl pod") + Expect(metricsOutput).To(ContainSubstring("< HTTP/1.1 200 OK")) + return metricsOutput +} + +// tokenRequest is a simplified representation of the Kubernetes TokenRequest API response, +// containing only the token field that we need to extract. +type tokenRequest struct { + Status struct { + Token string `json:"token"` + } `json:"status"` +} diff --git a/test/utils/utils.go b/test/utils/utils.go new file mode 100644 index 0000000..0488aa7 --- /dev/null +++ b/test/utils/utils.go @@ -0,0 +1,251 @@ +/* +Copyright 2026. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package utils + +import ( + "bufio" + "bytes" + "fmt" + "os" + "os/exec" + "strings" + + . "github.com/onsi/ginkgo/v2" //nolint:golint,revive +) + +const ( + prometheusOperatorVersion = "v0.77.1" + prometheusOperatorURL = "https://github.com/prometheus-operator/prometheus-operator/" + + "releases/download/%s/bundle.yaml" + + certmanagerVersion = "v1.16.3" + certmanagerURLTmpl = "https://github.com/cert-manager/cert-manager/releases/download/%s/cert-manager.yaml" +) + +func warnError(err error) { + _, _ = fmt.Fprintf(GinkgoWriter, "warning: %v\n", err) +} + +// Run executes the provided command within this context +func Run(cmd *exec.Cmd) (string, error) { + dir, _ := GetProjectDir() + cmd.Dir = dir + + if err := os.Chdir(cmd.Dir); err != nil { + _, _ = fmt.Fprintf(GinkgoWriter, "chdir dir: %s\n", err) + } + + cmd.Env = append(os.Environ(), "GO111MODULE=on") + command := strings.Join(cmd.Args, " ") + _, _ = fmt.Fprintf(GinkgoWriter, "running: %s\n", command) + output, err := cmd.CombinedOutput() + if err != nil { + return string(output), fmt.Errorf("%s failed with error: (%v) %s", command, err, string(output)) + } + + return string(output), nil +} + +// InstallPrometheusOperator installs the prometheus Operator to be used to export the enabled metrics. +func InstallPrometheusOperator() error { + url := fmt.Sprintf(prometheusOperatorURL, prometheusOperatorVersion) + cmd := exec.Command("kubectl", "create", "-f", url) + _, err := Run(cmd) + return err +} + +// UninstallPrometheusOperator uninstalls the prometheus +func UninstallPrometheusOperator() { + url := fmt.Sprintf(prometheusOperatorURL, prometheusOperatorVersion) + cmd := exec.Command("kubectl", "delete", "-f", url) + if _, err := Run(cmd); err != nil { + warnError(err) + } +} + +// IsPrometheusCRDsInstalled checks if any Prometheus CRDs are installed +// by verifying the existence of key CRDs related to Prometheus. +func IsPrometheusCRDsInstalled() bool { + // List of common Prometheus CRDs + prometheusCRDs := []string{ + "prometheuses.monitoring.coreos.com", + "prometheusrules.monitoring.coreos.com", + "prometheusagents.monitoring.coreos.com", + } + + cmd := exec.Command("kubectl", "get", "crds", "-o", "custom-columns=NAME:.metadata.name") + output, err := Run(cmd) + if err != nil { + return false + } + crdList := GetNonEmptyLines(output) + for _, crd := range prometheusCRDs { + for _, line := range crdList { + if strings.Contains(line, crd) { + return true + } + } + } + + return false +} + +// UninstallCertManager uninstalls the cert manager +func UninstallCertManager() { + url := fmt.Sprintf(certmanagerURLTmpl, certmanagerVersion) + cmd := exec.Command("kubectl", "delete", "-f", url) + if _, err := Run(cmd); err != nil { + warnError(err) + } +} + +// InstallCertManager installs the cert manager bundle. +func InstallCertManager() error { + url := fmt.Sprintf(certmanagerURLTmpl, certmanagerVersion) + cmd := exec.Command("kubectl", "apply", "-f", url) + if _, err := Run(cmd); err != nil { + return err + } + // Wait for cert-manager-webhook to be ready, which can take time if cert-manager + // was re-installed after uninstalling on a cluster. + cmd = exec.Command("kubectl", "wait", "deployment.apps/cert-manager-webhook", + "--for", "condition=Available", + "--namespace", "cert-manager", + "--timeout", "5m", + ) + + _, err := Run(cmd) + return err +} + +// IsCertManagerCRDsInstalled checks if any Cert Manager CRDs are installed +// by verifying the existence of key CRDs related to Cert Manager. +func IsCertManagerCRDsInstalled() bool { + // List of common Cert Manager CRDs + certManagerCRDs := []string{ + "certificates.cert-manager.io", + "issuers.cert-manager.io", + "clusterissuers.cert-manager.io", + "certificaterequests.cert-manager.io", + "orders.acme.cert-manager.io", + "challenges.acme.cert-manager.io", + } + + // Execute the kubectl command to get all CRDs + cmd := exec.Command("kubectl", "get", "crds") + output, err := Run(cmd) + if err != nil { + return false + } + + // Check if any of the Cert Manager CRDs are present + crdList := GetNonEmptyLines(output) + for _, crd := range certManagerCRDs { + for _, line := range crdList { + if strings.Contains(line, crd) { + return true + } + } + } + + return false +} + +// LoadImageToKindClusterWithName loads a local docker image to the kind cluster +func LoadImageToKindClusterWithName(name string) error { + cluster := "kind" + if v, ok := os.LookupEnv("KIND_CLUSTER"); ok { + cluster = v + } + kindOptions := []string{"load", "docker-image", name, "--name", cluster} + cmd := exec.Command("kind", kindOptions...) + _, err := Run(cmd) + return err +} + +// GetNonEmptyLines converts given command output string into individual objects +// according to line breakers, and ignores the empty elements in it. +func GetNonEmptyLines(output string) []string { + var res []string + elements := strings.Split(output, "\n") + for _, element := range elements { + if element != "" { + res = append(res, element) + } + } + + return res +} + +// GetProjectDir will return the directory where the project is +func GetProjectDir() (string, error) { + wd, err := os.Getwd() + if err != nil { + return wd, err + } + wd = strings.Replace(wd, "/test/e2e", "", -1) + return wd, nil +} + +// UncommentCode searches for target in the file and remove the comment prefix +// of the target content. The target content may span multiple lines. +func UncommentCode(filename, target, prefix string) error { + // false positive + // nolint:gosec + content, err := os.ReadFile(filename) + if err != nil { + return err + } + strContent := string(content) + + idx := strings.Index(strContent, target) + if idx < 0 { + return fmt.Errorf("unable to find the code %s to be uncomment", target) + } + + out := new(bytes.Buffer) + _, err = out.Write(content[:idx]) + if err != nil { + return err + } + + scanner := bufio.NewScanner(bytes.NewBufferString(target)) + if !scanner.Scan() { + return nil + } + for { + _, err := out.WriteString(strings.TrimPrefix(scanner.Text(), prefix)) + if err != nil { + return err + } + // Avoid writing a newline in case the previous line was the last in target. + if !scanner.Scan() { + break + } + if _, err := out.WriteString("\n"); err != nil { + return err + } + } + + _, err = out.Write(content[idx+len(target):]) + if err != nil { + return err + } + // false positive + // nolint:gosec + return os.WriteFile(filename, out.Bytes(), 0644) +}