Skip to content

Commit 062e83a

Browse files
JoshVanLJoshVanL
committed
Adds extra condition checks to certificaterequest_controller including
approval Signed-off-by: joshvanl <[email protected]>
1 parent 10252f0 commit 062e83a

7 files changed

+66
-16
lines changed

‎api/v1/adcsissuer_webhook.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ import (
1111
"k8s.io/apimachinery/pkg/util/validation/field"
1212

1313
ctrl "sigs.k8s.io/controller-runtime"
14-
logf "sigs.k8s.io/controller-runtime/pkg/runtime/log"
14+
logf "sigs.k8s.io/controller-runtime/pkg/log"
1515
"sigs.k8s.io/controller-runtime/pkg/webhook"
1616

1717
"github.com/jetstack/cert-manager/pkg/util/pki"

‎api/v1/clusteradcsissuer_webhook.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ import (
2626
"k8s.io/apimachinery/pkg/util/validation/field"
2727

2828
ctrl "sigs.k8s.io/controller-runtime"
29-
logf "sigs.k8s.io/controller-runtime/pkg/runtime/log"
29+
logf "sigs.k8s.io/controller-runtime/pkg/log"
3030
"sigs.k8s.io/controller-runtime/pkg/webhook"
3131

3232
"github.com/jetstack/cert-manager/pkg/util/pki"

‎controllers/adcsissuer_controller.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,7 @@ type AdcsIssuerReconciler struct {
3434
// +kubebuilder:rbac:groups=adcs.certmanager.csf.nokia.com,resources=adcsissuers,verbs=get;list;watch;create;update;patch;delete
3535
// +kubebuilder:rbac:groups=adcs.certmanager.csf.nokia.com,resources=adcsissuers/status,verbs=get;update;patch
3636

37-
func (r *AdcsIssuerReconciler) Reconcile(req ctrl.Request) (ctrl.Result, error) {
38-
ctx := context.Background()
37+
func (r *AdcsIssuerReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
3938
log := r.Log.WithValues("adcsissuer", req.NamespacedName)
4039

4140
// your logic here

‎controllers/adcsrequest_controller.go

+2-3
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ import (
2626
ctrl "sigs.k8s.io/controller-runtime"
2727
"sigs.k8s.io/controller-runtime/pkg/client"
2828

29-
cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2"
29+
cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1"
3030
cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
3131

3232
api "github.com/nokia/adcs-issuer/api/v1"
@@ -45,8 +45,7 @@ type AdcsRequestReconciler struct {
4545
// +kubebuilder:rbac:groups=adcs.certmanager.csf.nokia.com,resources=adcsrequests,verbs=get;list;watch;create;update;patch;delete
4646
// +kubebuilder:rbac:groups=adcs.certmanager.csf.nokia.com,resources=adcsrequests/status,verbs=get;update;patch
4747

48-
func (r *AdcsRequestReconciler) Reconcile(req ctrl.Request) (ctrl.Result, error) {
49-
ctx := context.Background()
48+
func (r *AdcsRequestReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
5049
log := r.Log.WithValues("adcsrequest", req.NamespacedName)
5150

5251
// your logic here

‎controllers/certificaterequest_controller.go

+57-5
Original file line numberDiff line numberDiff line change
@@ -20,11 +20,12 @@ import (
2020
"fmt"
2121

2222
"github.com/go-logr/logr"
23+
"k8s.io/utils/clock"
2324
ctrl "sigs.k8s.io/controller-runtime"
2425
"sigs.k8s.io/controller-runtime/pkg/client"
2526

2627
cmapiutil "github.com/jetstack/cert-manager/pkg/api/util"
27-
cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2"
28+
cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1"
2829
cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
2930
api "github.com/nokia/adcs-issuer/api/v1"
3031
core "k8s.io/api/core/v1"
@@ -38,6 +39,9 @@ type CertificateRequestReconciler struct {
3839
client.Client
3940
Log logr.Logger
4041
Recorder record.EventRecorder
42+
43+
Clock clock.Clock
44+
CheckApprovedCondition bool
4145
}
4246

4347
var (
@@ -48,8 +52,7 @@ var (
4852
// +kubebuilder:rbac:groups=cert-manager.io,resources=certificaterequests/status,verbs=get;update;patch
4953
// +kubebuilder:rbac:groups="",resources=events,verbs=patch
5054

51-
func (r *CertificateRequestReconciler) Reconcile(req ctrl.Request) (ctrl.Result, error) {
52-
ctx := context.Background()
55+
func (r *CertificateRequestReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
5356
log := r.Log.WithValues("certificaterequest", req.NamespacedName)
5457

5558
// your logic here
@@ -71,6 +74,55 @@ func (r *CertificateRequestReconciler) Reconcile(req ctrl.Request) (ctrl.Result,
7174
return ctrl.Result{}, nil
7275
}
7376

77+
// Ignore CertificateRequest if it is already Ready
78+
if cmapiutil.CertificateRequestHasCondition(&cr, cmapi.CertificateRequestCondition{
79+
Type: cmapi.CertificateRequestConditionReady,
80+
Status: cmmeta.ConditionTrue,
81+
}) {
82+
log.V(4).Info("CertificateRequest is Ready. Ignoring.")
83+
return ctrl.Result{}, nil
84+
}
85+
// Ignore CertificateRequest if it is already Failed
86+
if cmapiutil.CertificateRequestHasCondition(&cr, cmapi.CertificateRequestCondition{
87+
Type: cmapi.CertificateRequestConditionReady,
88+
Status: cmmeta.ConditionFalse,
89+
Reason: cmapi.CertificateRequestReasonFailed,
90+
}) {
91+
log.V(4).Info("CertificateRequest is Failed. Ignoring.")
92+
return ctrl.Result{}, nil
93+
}
94+
// Ignore CertificateRequest if it already has a Denied Ready Reason
95+
if cmapiutil.CertificateRequestHasCondition(&cr, cmapi.CertificateRequestCondition{
96+
Type: cmapi.CertificateRequestConditionReady,
97+
Status: cmmeta.ConditionFalse,
98+
Reason: cmapi.CertificateRequestReasonDenied,
99+
}) {
100+
log.V(4).Info("CertificateRequest already has a Ready condition with Denied Reason. Ignoring.")
101+
return ctrl.Result{}, nil
102+
}
103+
104+
// If CertificateRequest has been denied, mark the CertificateRequest as
105+
// Ready=Denied and set FailureTime if not already.
106+
if cmapiutil.CertificateRequestIsDenied(&cr) {
107+
log.V(4).Info("CertificateRequest has been denied. Marking as failed.")
108+
109+
if cr.Status.FailureTime == nil {
110+
nowTime := metav1.NewTime(r.Clock.Now())
111+
cr.Status.FailureTime = &nowTime
112+
}
113+
114+
message := "The CertificateRequest was denied by an approval controller"
115+
return ctrl.Result{}, r.SetStatus(ctx, &cr, cmmeta.ConditionFalse, cmapi.CertificateRequestReasonDenied, message)
116+
}
117+
118+
if r.CheckApprovedCondition {
119+
// If CertificateRequest has not been approved, exit early.
120+
if !cmapiutil.CertificateRequestIsApproved(&cr) {
121+
log.V(4).Info("certificate request has not been approved")
122+
return ctrl.Result{}, nil
123+
}
124+
}
125+
74126
// If the certificate data is already set then we skip this request as it
75127
// has already been completed in the past.
76128
if len(cr.Status.Certificate) > 0 {
@@ -116,7 +168,7 @@ func (r *CertificateRequestReconciler) Reconcile(req ctrl.Request) (ctrl.Result,
116168

117169
func (r *CertificateRequestReconciler) createAdcsRequest(ctx context.Context, cmRequest *cmapi.CertificateRequest) error {
118170
spec := api.AdcsRequestSpec{
119-
CSRPEM: cmRequest.Spec.CSRPEM,
171+
CSRPEM: cmRequest.Spec.Request,
120172
IssuerRef: cmRequest.Spec.IssuerRef,
121173
}
122174
return r.Create(ctx, &api.AdcsRequest{
@@ -137,7 +189,7 @@ func (r *CertificateRequestReconciler) SetupWithManager(mgr ctrl.Manager) error
137189

138190
func RequestDiffers(adcsReq *api.AdcsRequest, certReq *cmapi.CertificateRequest) bool {
139191
a := adcsReq.Spec.CSRPEM
140-
b := certReq.Spec.CSRPEM
192+
b := certReq.Spec.Request
141193
if len(a) != len(b) {
142194
return true
143195
}

‎controllers/clusteradcsissuer_controller.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,7 @@ type ClusterAdcsIssuerReconciler struct {
3434
// +kubebuilder:rbac:groups=adcs.certmanager.csf.nokia.com,resources=clusteradcsissuers,verbs=get;list;watch;create;update;patch;delete
3535
// +kubebuilder:rbac:groups=adcs.certmanager.csf.nokia.com,resources=clusteradcsissuers/status,verbs=get;update;patch
3636

37-
func (r *ClusterAdcsIssuerReconciler) Reconcile(req ctrl.Request) (ctrl.Result, error) {
38-
ctx := context.Background()
37+
func (r *ClusterAdcsIssuerReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
3938
log := r.Log.WithValues("clusteradcsissuer", req.NamespacedName)
4039

4140
// your logic here

‎controllers/suite_test.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ import (
2727
"k8s.io/client-go/rest"
2828
"sigs.k8s.io/controller-runtime/pkg/client"
2929
"sigs.k8s.io/controller-runtime/pkg/envtest"
30+
"sigs.k8s.io/controller-runtime/pkg/envtest/printer"
3031
logf "sigs.k8s.io/controller-runtime/pkg/log"
3132
"sigs.k8s.io/controller-runtime/pkg/log/zap"
3233
// +kubebuilder:scaffold:imports
@@ -44,11 +45,11 @@ func TestAPIs(t *testing.T) {
4445

4546
RunSpecsWithDefaultAndCustomReporters(t,
4647
"Controller Suite",
47-
[]Reporter{envtest.NewlineReporter{}})
48+
[]Reporter{printer.NewlineReporter{}})
4849
}
4950

5051
var _ = BeforeSuite(func(done Done) {
51-
logf.SetLogger(zap.LoggerTo(GinkgoWriter, true))
52+
logf.SetLogger(zap.New(zap.WriteTo(GinkgoWriter)))
5253

5354
By("bootstrapping test environment")
5455
testEnv = &envtest.Environment{

0 commit comments

Comments
 (0)