From 91791b2a47b44606755617c7cd603393910d1245 Mon Sep 17 00:00:00 2001 From: Nikhil Bhoyar Date: Thu, 14 Nov 2024 07:58:33 +0530 Subject: [PATCH] restoring autokeyconfig alpha resource --- apis/kms/v1alpha1/autokeyconfig_reference.go | 167 +++++++++++++++ apis/kms/v1alpha1/autokeyconfig_types.go | 97 +++++++++ apis/kms/v1alpha1/keyhandle_reference.go | 8 - apis/kms/v1alpha1/types.generated.go | 27 +++ apis/kms/v1alpha1/zz_generated.deepcopy.go | 204 +++++++++++++++++++ 5 files changed, 495 insertions(+), 8 deletions(-) create mode 100644 apis/kms/v1alpha1/autokeyconfig_reference.go create mode 100644 apis/kms/v1alpha1/autokeyconfig_types.go diff --git a/apis/kms/v1alpha1/autokeyconfig_reference.go b/apis/kms/v1alpha1/autokeyconfig_reference.go new file mode 100644 index 0000000000..318653fd76 --- /dev/null +++ b/apis/kms/v1alpha1/autokeyconfig_reference.go @@ -0,0 +1,167 @@ +// Copyright 2024 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package v1alpha1 + +import ( + "context" + "fmt" + "strings" + + refsv1beta1 "github.com/GoogleCloudPlatform/k8s-config-connector/apis/refs/v1beta1" + "github.com/GoogleCloudPlatform/k8s-config-connector/pkg/k8s" + apierrors "k8s.io/apimachinery/pkg/api/errors" + "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" + "k8s.io/apimachinery/pkg/types" + "sigs.k8s.io/controller-runtime/pkg/client" +) + +var _ refsv1beta1.ExternalNormalizer = &KMSAutokeyConfigRef{} + +// KMSAutokeyConfigRef defines the resource reference to KMSAutokeyConfig, which "External" field +// holds the GCP identifier for the KRM object. +type KMSAutokeyConfigRef struct { + // A reference to an externally managed KMSAutokeyConfig resource. + // Should be in the format "folders//autokeyConfig". + External string `json:"external,omitempty"` + + // The name of a KMSAutokeyConfig resource. + Name string `json:"name,omitempty"` + + // The namespace of a KMSAutokeyConfig resource. + Namespace string `json:"namespace,omitempty"` + + parent *KMSAutokeyConfigParent +} + +// NormalizedExternal provision the "External" value for other resource that depends on KMSAutokeyConfig. +// If the "External" is given in the other resource's spec.KMSAutokeyConfigRef, the given value will be used. +// Otherwise, the "Name" and "Namespace" will be used to query the actual KMSAutokeyConfig object from the cluster. +func (r *KMSAutokeyConfigRef) NormalizedExternal(ctx context.Context, reader client.Reader, otherNamespace string) (string, error) { + if r.External != "" && r.Name != "" { + return "", fmt.Errorf("cannot specify both name and external on %s reference", KMSAutokeyConfigGVK.Kind) + } + // From given External + if r.External != "" { + if _, err := ParseKMSAutokeyConfigExternal(r.External); err != nil { + return "", err + } + return r.External, nil + } + + // From the Config Connector object + if r.Namespace == "" { + r.Namespace = otherNamespace + } + key := types.NamespacedName{Name: r.Name, Namespace: r.Namespace} + u := &unstructured.Unstructured{} + u.SetGroupVersionKind(KMSAutokeyConfigGVK) + if err := reader.Get(ctx, key, u); err != nil { + if apierrors.IsNotFound(err) { + return "", k8s.NewReferenceNotFoundError(u.GroupVersionKind(), key) + } + return "", fmt.Errorf("reading referenced %s %s: %w", KMSAutokeyConfigGVK, key, err) + } + // Get external from status.externalRef. This is the most trustworthy place. + actualExternalRef, _, err := unstructured.NestedString(u.Object, "status", "externalRef") + if err != nil { + return "", fmt.Errorf("reading status.externalRef: %w", err) + } + if actualExternalRef == "" { + return "", k8s.NewReferenceNotReadyError(u.GroupVersionKind(), key) + } + r.External = actualExternalRef + return r.External, nil +} + +// New builds a KMSAutokeyConfigRef from the Config Connector KMSAutokeyConfig object. +func NewKMSAutokeyConfigRef(ctx context.Context, reader client.Reader, obj *KMSAutokeyConfig) (*KMSAutokeyConfigRef, error) { + id := &KMSAutokeyConfigRef{} + + // Get Parent + folderRef, err := refsv1beta1.ResolveFolder(ctx, reader, obj, obj.Spec.FolderRef) + if err != nil { + return nil, err + } + folderID := folderRef.FolderID + if folderID == "" { + return nil, fmt.Errorf("cannot resolve project") + } + id.parent = &KMSAutokeyConfigParent{FolderID: folderID} + + // Use approved External + externalRef := valueOf(obj.Status.ExternalRef) + if externalRef == "" { + id.External = AsKMSAutokeyConfigExternal(id.parent) + return id, nil + } + + // Validate desired with actual + actualParent, err := ParseKMSAutokeyConfigExternal(externalRef) + if err != nil { + return nil, err + } + if actualParent.FolderID != folderID { + return nil, fmt.Errorf("spec.folderRef changed, expect %s, got %s", actualParent.FolderID, folderID) + } + id.External = externalRef + id.parent = &KMSAutokeyConfigParent{FolderID: folderID} + return id, nil +} + +func (r *KMSAutokeyConfigRef) Parent() (*KMSAutokeyConfigParent, error) { + if r.parent != nil { + return r.parent, nil + } + if r.External != "" { + parent, err := ParseKMSAutokeyConfigExternal(r.External) + if err != nil { + return nil, err + } + return parent, nil + } + return nil, fmt.Errorf("KMSAutokeyConfigRef not initialized from `NewKMSAutokeyConfigRef` or `NormalizedExternal`") +} + +type KMSAutokeyConfigParent struct { + FolderID string +} + +func (p *KMSAutokeyConfigParent) String() string { + return "folders/" + p.FolderID +} + +func AsKMSAutokeyConfigExternal(parent *KMSAutokeyConfigParent) (external string) { + return parent.String() + "/autokeyConfig" +} + +func ParseKMSAutokeyConfigExternal(external string) (parent *KMSAutokeyConfigParent, err error) { + external = strings.TrimPrefix(external, "/") + tokens := strings.Split(external, "/") + if len(tokens) != 3 || tokens[0] != "folders" || tokens[2] != "autokeyConfig" { + return nil, fmt.Errorf("format of KMSAutokeyConfig external=%q was not known (use folders//autokeyConfig)", external) + } + parent = &KMSAutokeyConfigParent{ + FolderID: tokens[1], + } + return parent, nil +} + +func valueOf[T any](t *T) T { + var zeroVal T + if t == nil { + return zeroVal + } + return *t +} diff --git a/apis/kms/v1alpha1/autokeyconfig_types.go b/apis/kms/v1alpha1/autokeyconfig_types.go new file mode 100644 index 0000000000..ce339fbe77 --- /dev/null +++ b/apis/kms/v1alpha1/autokeyconfig_types.go @@ -0,0 +1,97 @@ +// Copyright 2024 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package v1alpha1 + +import ( + "github.com/GoogleCloudPlatform/k8s-config-connector/pkg/apis/k8s/v1alpha1" + + refs "github.com/GoogleCloudPlatform/k8s-config-connector/apis/refs/v1beta1" + + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +var KMSAutokeyConfigGVK = GroupVersion.WithKind("KMSAutokeyConfig") + +// NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized. + +// KMSAutokeyConfigSpec defines the desired state of KMSAutokeyConfig +// +kcc:proto=google.cloud.kms.v1.AutokeyConfig +type KMSAutokeyConfigSpec struct { + + // NOTE: ResourceID field is not required for AutokeyConfig as its ID has the format folders//autokeyConfig i.e., it doesnt have any unique ID of its own and relies on folderID for uniqueness. + + // Immutable. The folder that this resource belongs to. + // +required + FolderRef *refs.FolderRef `json:"folderRef"` + + // +optional + KeyProjectRef *refs.ProjectRef `json:"keyProject,omitempty"` +} + +// KMSAutokeyConfigStatus defines the config connector machine state of KMSAutokeyConfig +type KMSAutokeyConfigStatus struct { + /* Conditions represent the latest available observations of the + object's current state. */ + Conditions []v1alpha1.Condition `json:"conditions,omitempty"` + + // ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource. + ObservedGeneration *int64 `json:"observedGeneration,omitempty"` + + // A unique specifier for the KMSAutokeyConfig resource in GCP. + ExternalRef *string `json:"externalRef,omitempty"` + + // ObservedState is the state of the resource as most recently observed in GCP. + ObservedState *KMSAutokeyConfigObservedState `json:"observedState,omitempty"` +} + +// KMSAutokeyConfigSpec defines the desired state of KMSAutokeyConfig +// +kcc:proto=google.cloud.kms.v1.AutokeyConfig +type KMSAutokeyConfigObservedState struct { + // Output only. Current state of this AutokeyConfig. + // +optional + State *string `json:"state,omitempty"` +} + +// +genclient +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +// +kubebuilder:resource:categories=gcp,shortName=gcpkmsautokeyconfig;gcpkmsautokeyconfigs +// +kubebuilder:subresource:status +// +kubebuilder:metadata:labels="cnrm.cloud.google.com/managed-by-kcc=true";"cnrm.cloud.google.com/system=true" +// +kubebuilder:printcolumn:name="Age",JSONPath=".metadata.creationTimestamp",type="date" +// +kubebuilder:printcolumn:name="Ready",JSONPath=".status.conditions[?(@.type=='Ready')].status",type="string",description="When 'True', the most recent reconcile of the resource succeeded" +// +kubebuilder:printcolumn:name="Status",JSONPath=".status.conditions[?(@.type=='Ready')].reason",type="string",description="The reason for the value in 'Ready'" +// +kubebuilder:printcolumn:name="Status Age",JSONPath=".status.conditions[?(@.type=='Ready')].lastTransitionTime",type="date",description="The last transition time for the value in 'Status'" + +// KMSAutokeyConfig is the Schema for the KMSAutokeyConfig API +// +k8s:openapi-gen=true +type KMSAutokeyConfig struct { + metav1.TypeMeta `json:",inline"` + metav1.ObjectMeta `json:"metadata,omitempty"` + + Spec KMSAutokeyConfigSpec `json:"spec,omitempty"` + Status KMSAutokeyConfigStatus `json:"status,omitempty"` +} + +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +// KMSAutokeyConfigList contains a list of KMSAutokeyConfig +type KMSAutokeyConfigList struct { + metav1.TypeMeta `json:",inline"` + metav1.ListMeta `json:"metadata,omitempty"` + Items []KMSAutokeyConfig `json:"items"` +} + +func init() { + SchemeBuilder.Register(&KMSAutokeyConfig{}, &KMSAutokeyConfigList{}) +} diff --git a/apis/kms/v1alpha1/keyhandle_reference.go b/apis/kms/v1alpha1/keyhandle_reference.go index 3b564876aa..1bf9799447 100644 --- a/apis/kms/v1alpha1/keyhandle_reference.go +++ b/apis/kms/v1alpha1/keyhandle_reference.go @@ -196,11 +196,3 @@ func AsKMSKeyHandleExternal_FromSpec(spec *KMSKeyHandleSpec) (parent *KMSKeyHand } return parent, valueOf(spec.ResourceID), nil } - -func valueOf[T any](t *T) T { - var zeroVal T - if t == nil { - return zeroVal - } - return *t -} diff --git a/apis/kms/v1alpha1/types.generated.go b/apis/kms/v1alpha1/types.generated.go index cf2b61df42..328ff2ff30 100644 --- a/apis/kms/v1alpha1/types.generated.go +++ b/apis/kms/v1alpha1/types.generated.go @@ -14,6 +14,33 @@ package v1alpha1 +import ( + refs "github.com/GoogleCloudPlatform/k8s-config-connector/apis/refs/v1beta1" +) + +// +kcc:proto=google.cloud.kms.v1.AutokeyConfig +type AutokeyConfig struct { + // Identifier. Name of the [AutokeyConfig][google.cloud.kms.v1.AutokeyConfig] + // resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig`. + Name *string `json:"name,omitempty"` + + // Optional. Name of the key project, e.g. `projects/{PROJECT_ID}` or + // `projects/{PROJECT_NUMBER}`, where Cloud KMS Autokey will provision a new + // [CryptoKey][google.cloud.kms.v1.CryptoKey] when a + // [KeyHandle][google.cloud.kms.v1.KeyHandle] is created. On + // [UpdateAutokeyConfig][google.cloud.kms.v1.AutokeyAdmin.UpdateAutokeyConfig], + // the caller will require `cloudkms.cryptoKeys.setIamPolicy` permission on + // this key project. Once configured, for Cloud KMS Autokey to function + // properly, this key project must have the Cloud KMS API activated and the + // Cloud KMS Service Agent for this key project must be granted the + // `cloudkms.admin` role (or pertinent permissions). A request with an empty + // key project field will clear the configuration. + KeyProject *refs.ProjectRef `json:"keyProject,omitempty"` + + // Output only. The state for the AutokeyConfig. + State *string `json:"state,omitempty"` +} + // +kcc:proto=google.cloud.kms.v1.KeyHandle type KeyHandle struct { // Identifier. Name of the [KeyHandle][google.cloud.kms.v1.KeyHandle] diff --git a/apis/kms/v1alpha1/zz_generated.deepcopy.go b/apis/kms/v1alpha1/zz_generated.deepcopy.go index 6ca84c6f39..2e3ee8a533 100644 --- a/apis/kms/v1alpha1/zz_generated.deepcopy.go +++ b/apis/kms/v1alpha1/zz_generated.deepcopy.go @@ -24,6 +24,210 @@ import ( runtime "k8s.io/apimachinery/pkg/runtime" ) +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AutokeyConfig) DeepCopyInto(out *AutokeyConfig) { + *out = *in + if in.Name != nil { + in, out := &in.Name, &out.Name + *out = new(string) + **out = **in + } + if in.KeyProject != nil { + in, out := &in.KeyProject, &out.KeyProject + *out = new(v1beta1.ProjectRef) + **out = **in + } + if in.State != nil { + in, out := &in.State, &out.State + *out = new(string) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AutokeyConfig. +func (in *AutokeyConfig) DeepCopy() *AutokeyConfig { + if in == nil { + return nil + } + out := new(AutokeyConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *KMSAutokeyConfig) DeepCopyInto(out *KMSAutokeyConfig) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + in.Spec.DeepCopyInto(&out.Spec) + in.Status.DeepCopyInto(&out.Status) +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KMSAutokeyConfig. +func (in *KMSAutokeyConfig) DeepCopy() *KMSAutokeyConfig { + if in == nil { + return nil + } + out := new(KMSAutokeyConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *KMSAutokeyConfig) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *KMSAutokeyConfigList) DeepCopyInto(out *KMSAutokeyConfigList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]KMSAutokeyConfig, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KMSAutokeyConfigList. +func (in *KMSAutokeyConfigList) DeepCopy() *KMSAutokeyConfigList { + if in == nil { + return nil + } + out := new(KMSAutokeyConfigList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *KMSAutokeyConfigList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *KMSAutokeyConfigObservedState) DeepCopyInto(out *KMSAutokeyConfigObservedState) { + *out = *in + if in.State != nil { + in, out := &in.State, &out.State + *out = new(string) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KMSAutokeyConfigObservedState. +func (in *KMSAutokeyConfigObservedState) DeepCopy() *KMSAutokeyConfigObservedState { + if in == nil { + return nil + } + out := new(KMSAutokeyConfigObservedState) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *KMSAutokeyConfigParent) DeepCopyInto(out *KMSAutokeyConfigParent) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KMSAutokeyConfigParent. +func (in *KMSAutokeyConfigParent) DeepCopy() *KMSAutokeyConfigParent { + if in == nil { + return nil + } + out := new(KMSAutokeyConfigParent) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *KMSAutokeyConfigRef) DeepCopyInto(out *KMSAutokeyConfigRef) { + *out = *in + if in.parent != nil { + in, out := &in.parent, &out.parent + *out = new(KMSAutokeyConfigParent) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KMSAutokeyConfigRef. +func (in *KMSAutokeyConfigRef) DeepCopy() *KMSAutokeyConfigRef { + if in == nil { + return nil + } + out := new(KMSAutokeyConfigRef) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *KMSAutokeyConfigSpec) DeepCopyInto(out *KMSAutokeyConfigSpec) { + *out = *in + if in.FolderRef != nil { + in, out := &in.FolderRef, &out.FolderRef + *out = new(v1beta1.FolderRef) + **out = **in + } + if in.KeyProjectRef != nil { + in, out := &in.KeyProjectRef, &out.KeyProjectRef + *out = new(v1beta1.ProjectRef) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KMSAutokeyConfigSpec. +func (in *KMSAutokeyConfigSpec) DeepCopy() *KMSAutokeyConfigSpec { + if in == nil { + return nil + } + out := new(KMSAutokeyConfigSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *KMSAutokeyConfigStatus) DeepCopyInto(out *KMSAutokeyConfigStatus) { + *out = *in + if in.Conditions != nil { + in, out := &in.Conditions, &out.Conditions + *out = make([]k8sv1alpha1.Condition, len(*in)) + copy(*out, *in) + } + if in.ObservedGeneration != nil { + in, out := &in.ObservedGeneration, &out.ObservedGeneration + *out = new(int64) + **out = **in + } + if in.ExternalRef != nil { + in, out := &in.ExternalRef, &out.ExternalRef + *out = new(string) + **out = **in + } + if in.ObservedState != nil { + in, out := &in.ObservedState, &out.ObservedState + *out = new(KMSAutokeyConfigObservedState) + (*in).DeepCopyInto(*out) + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KMSAutokeyConfigStatus. +func (in *KMSAutokeyConfigStatus) DeepCopy() *KMSAutokeyConfigStatus { + if in == nil { + return nil + } + out := new(KMSAutokeyConfigStatus) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *KMSKeyHandle) DeepCopyInto(out *KMSKeyHandle) { *out = *in