Fix license expiration check

tamalsaha · tamalsaha · commit 1bfeb81f765c · 2025-03-22T22:28:27.000-07:00
Signed-off-by: Tamal Saha &lt;tamal@appscode.com&gt;
diff --git a/pkg/apiserver/apiserver.go b/pkg/apiserver/apiserver.go
@@ -197,7 +197,7 @@ func (c completedConfig) New(ctx context.Context) (*LicenseProxyServer, error) {
 	}
 
 	rb := storage.NewRecordBook()
-	reg := storage.NewLicenseRegistry(c.ExtraConfig.CacheDir, rb)
+	reg := storage.NewLicenseRegistry(c.ExtraConfig.CacheDir, storage.MinRemainingLife, rb)
 	if c.ExtraConfig.LicenseDir != "" {
 		err = storage.LoadDir(cid, c.ExtraConfig.LicenseDir, reg)
 		if err != nil {
diff --git a/pkg/controllers/secret/license_syncer.go b/pkg/controllers/secret/license_syncer.go
@@ -20,13 +20,15 @@ import (
 	"context"
 	"crypto/x509"
 	"fmt"
+	"time"
 
 	"go.bytebuilders.dev/license-proxyserver/pkg/common"
 	"go.bytebuilders.dev/license-proxyserver/pkg/storage"
 	verifier "go.bytebuilders.dev/license-verifier"
 
 	core "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/klog/v2"
 	kutil "kmodules.xyz/client-go"
 	cu "kmodules.xyz/client-go/client"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -100,6 +102,15 @@ func (r *LicenseSyncer) addLicense(data []byte) error {
 	if err != nil {
 		return err
 	}
-	r.R.Add(&license, nil)
+
+	if time.Until(license.NotAfter.Time) >= storage.MinRemainingLife {
+		klog.InfoS("adding license",
+			"id", license.ID,
+			"product", license.ProductLine,
+			"plan", license.PlanName,
+			"expiry", license.NotAfter.UTC().Format(time.RFC822),
+		)
+		r.R.Add(&license, nil)
+	}
 	return nil
 }
diff --git a/pkg/manager/license_acquirer.go b/pkg/manager/license_acquirer.go
@@ -25,6 +25,7 @@ import (
 	"path/filepath"
 	"strings"
 	"sync"
+	"time"
 
 	"go.bytebuilders.dev/license-proxyserver/pkg/common"
 	"go.bytebuilders.dev/license-proxyserver/pkg/storage"
@@ -46,6 +47,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 )
 
+const ttl = storage.LicenseAcquisitionBuffer + storage.MinRemainingLife
+
 type LicenseAcquirer struct {
 	client.Client
 	BaseURL               string
@@ -88,10 +91,7 @@ func (r *LicenseAcquirer) Reconcile(ctx context.Context, request reconcile.Reque
 		}
 	}
 	if cid != "" && len(features) > 0 {
-		err = r.reconcile(ctx, managedCluster.Name, cid, features)
-		if err != nil {
-			return reconcile.Result{}, err
-		}
+		return r.reconcile(managedCluster.Name, cid, features)
 	}
 
 	return reconcile.Result{}, nil
@@ -111,12 +111,12 @@ func (r *LicenseAcquirer) getLicenseRegistry(cid string) (*storage.LicenseRegist
 	if err != nil {
 		return nil, err
 	}
-	reg = storage.NewLicenseRegistry(dir, nil)
+	reg = storage.NewLicenseRegistry(dir, ttl, nil)
 	r.LicenseCache[cid] = reg
 	return reg, nil
 }
 
-func (r *LicenseAcquirer) reconcile(ctx context.Context, clusterName, cid string, features []string) error {
+func (r *LicenseAcquirer) reconcile(clusterName, cid string, features []string) (reconcile.Result, error) {
 	sec := core.Secret{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      common.LicenseSecret,
@@ -130,20 +130,21 @@ func (r *LicenseAcquirer) reconcile(ctx context.Context, clusterName, cid string
 	} else if apierrors.IsNotFound(err) {
 		sec.Data = map[string][]byte{}
 	} else {
-		return err
+		return reconcile.Result{}, err
 	}
 
 	var errList []error
+	var earliestExpired time.Time
 
 	reg, err := r.getLicenseRegistry(cid)
 	if err != nil {
-		return err
+		return reconcile.Result{}, err
 	}
 	for _, feature := range features {
 		l, found := reg.LicenseForFeature(feature)
 		if !found {
 			var c *v1alpha1.Contract
-			l, c, err = r.getNewLicense(ctx, cid, []string{feature})
+			l, c, err = r.getNewLicense(cid, []string{feature})
 			if err == nil {
 				reg.Add(l, c)
 			} else {
@@ -156,6 +157,9 @@ func (r *LicenseAcquirer) reconcile(ctx context.Context, clusterName, cid string
 		}
 		if l != nil && l.Status == v1alpha1.LicenseActive {
 			sec.Data[l.PlanName] = l.Data
+			if earliestExpired.IsZero() || earliestExpired.After(l.NotAfter.Time) {
+				earliestExpired = l.NotAfter.Time
+			}
 		}
 	}
 
@@ -165,12 +169,15 @@ func (r *LicenseAcquirer) reconcile(ctx context.Context, clusterName, cid string
 		errList = append(errList, r.Create(context.TODO(), &sec))
 	}
 
-	return utilerrors.NewAggregate(errList)
+	if !earliestExpired.IsZero() {
+		return reconcile.Result{
+			RequeueAfter: time.Until(earliestExpired.Add(-ttl)),
+		}, utilerrors.NewAggregate(errList)
+	}
+	return reconcile.Result{}, utilerrors.NewAggregate(errList)
 }
 
-func (r *LicenseAcquirer) getNewLicense(ctx context.Context, cid string, features []string) (*v1alpha1.License, *v1alpha1.Contract, error) {
-	logger := log.FromContext(ctx)
-
+func (r *LicenseAcquirer) getNewLicense(cid string, features []string) (*v1alpha1.License, *v1alpha1.Contract, error) {
 	lc, err := pc.NewClient(r.BaseURL, r.Token, cid, r.CaCert, r.InsecureSkipTLSVerify, fmt.Sprintf("license-proxyserver-manager/%s", v.Version.Version))
 	if err != nil {
 		return nil, nil, err
@@ -180,7 +187,6 @@ func (r *LicenseAcquirer) getNewLicense(ctx context.Context, cid string, feature
 	if err != nil {
 		return nil, nil, err
 	}
-	logger.Info("acquired new license", "cid", cid, "features", strings.Join(features, ","))
 
 	caData, err := info.LoadLicenseCA()
 	if err != nil {
@@ -200,5 +206,12 @@ func (r *LicenseAcquirer) getNewLicense(ctx context.Context, cid string, feature
 		return nil, nil, err
 	}
 
+	klog.InfoS("acquired new license",
+		"cluster", cid,
+		"id", l.ID,
+		"product", l.ProductLine,
+		"plan", l.PlanName,
+		"expiry", l.NotAfter.UTC().Format(time.RFC822),
+	)
 	return &l, con, nil
 }
diff --git a/pkg/registry/proxyserver/licenserequest/storage.go b/pkg/registry/proxyserver/licenserequest/storage.go
@@ -21,6 +21,7 @@ import (
 	"crypto/x509"
 	"sort"
 	"strings"
+	"time"
 
 	proxyv1alpha1 "go.bytebuilders.dev/license-proxyserver/apis/proxyserver/v1alpha1"
 	"go.bytebuilders.dev/license-proxyserver/pkg/common"
@@ -36,6 +37,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/apiserver/pkg/endpoints/request"
 	"k8s.io/apiserver/pkg/registry/rest"
+	"k8s.io/klog/v2"
 	clustermeta "kmodules.xyz/client-go/cluster"
 	clusterv1alpha1 "open-cluster-management.io/api/cluster/v1alpha1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -143,6 +145,7 @@ func (r *Storage) Create(ctx context.Context, obj runtime.Object, _ rest.Validat
 		}
 	} else {
 		// return blank response instead of error
+		// typically license mounted via secret has expired
 		in.Response = &proxyv1alpha1.LicenseRequestResponse{}
 	}
 
@@ -172,6 +175,13 @@ func (r *Storage) getLicense(features []string) (*v1alpha1.License, error) {
 	if err != nil {
 		return nil, err
 	}
+
+	klog.InfoS("adding license",
+		"id", l.ID,
+		"product", l.ProductLine,
+		"plan", l.PlanName,
+		"expiry", l.NotAfter.UTC().Format(time.RFC822),
+	)
 	r.reg.Add(&l, c)
 	return &l, nil
 }
diff --git a/pkg/storage/loader.go b/pkg/storage/loader.go
@@ -19,6 +19,7 @@ package storage
 import (
 	"os"
 	"path/filepath"
+	"time"
 
 	verifier "go.bytebuilders.dev/license-verifier"
 	"go.bytebuilders.dev/license-verifier/info"
@@ -68,7 +69,14 @@ func LoadDir(cid, dir string, reg *LicenseRegistry) error {
 		if err != nil {
 			klog.ErrorS(err, "Skipping", "file", filename)
 			continue
-		} else {
+		} else if time.Until(license.NotAfter.Time) >= MinRemainingLife {
+			klog.InfoS("adding license",
+				"dir", dir,
+				"id", license.ID,
+				"product", license.ProductLine,
+				"plan", license.PlanName,
+				"expiry", license.NotAfter.UTC().Format(time.RFC822),
+			)
 			reg.Add(&license, nil)
 		}
 	}
diff --git a/pkg/storage/store.go b/pkg/storage/store.go
@@ -25,9 +25,14 @@ import (
 	"time"
 
 	"go.bytebuilders.dev/license-verifier/apis/licenses/v1alpha1"
+
+	"k8s.io/klog/v2"
 )
 
-const minRemainingLife = 10 * time.Minute
+const (
+	LicenseAcquisitionBuffer = 5 * time.Second
+	MinRemainingLife         = 5 * time.Minute
+)
 
 // A LicenseQueue implements heap.Interface and holds Items.
 type LicenseQueue []*v1alpha1.License
@@ -67,11 +72,13 @@ type LicenseRegistry struct {
 	store    map[string]*Record      // serial # -> Record
 	rb       *RecordBook
 	cacheDir string
+	ttl      time.Duration
 }
 
-func NewLicenseRegistry(cacheDir string, rb *RecordBook) *LicenseRegistry {
+func NewLicenseRegistry(cacheDir string, ttl time.Duration, rb *RecordBook) *LicenseRegistry {
 	return &LicenseRegistry{
 		cacheDir: cacheDir,
+		ttl:      ttl,
 		reg:      make(map[string]LicenseQueue),
 		store:    make(map[string]*Record),
 		rb:       rb,
@@ -109,13 +116,19 @@ func (r *LicenseRegistry) LicenseForFeature(feature string) (*v1alpha1.License,
 	if !ok {
 		return nil, false
 	}
-	now := time.Now().Add(minRemainingLife)
 	for q.Len() > 0 {
 		// ref: https://stackoverflow.com/a/63328950
 		item := q[0]
-		if now.After(item.NotAfter.Time) {
+		if time.Until(item.NotAfter.Time) < r.ttl {
 			heap.Pop(&q)
 			r.reg[feature] = q
+
+			klog.InfoS("removing license",
+				"id", item.ID,
+				"product", item.ProductLine,
+				"plan", item.PlanName,
+				"expiry", item.NotAfter.UTC().Format(time.RFC822),
+			)
 			r.removeFromStore(item)
 		} else {
 			return item, true
@@ -153,7 +166,7 @@ func (r *LicenseRegistry) List() []*Record {
 	r.m.Lock()
 	defer r.m.Unlock()
 
-	now := time.Now().Add(minRemainingLife)
+	now := time.Now().Add(r.ttl)
 	out := make([]*Record, 0, len(r.store))
 	for _, rec := range r.store {
 		if rec.License.NotAfter.After(now) {

Original file line number	Diff line number	Diff line change
`@@ -197,7 +197,7 @@ func (c completedConfig) New(ctx context.Context) (*LicenseProxyServer, error) {`
`197`	`197`	`}`
`198`	`198`
`199`	`199`	`rb := storage.NewRecordBook()`
`200`		`- reg := storage.NewLicenseRegistry(c.ExtraConfig.CacheDir, rb)`
	`200`	`+ reg := storage.NewLicenseRegistry(c.ExtraConfig.CacheDir, storage.MinRemainingLife, rb)`
`201`	`201`	`if c.ExtraConfig.LicenseDir != "" {`
`202`	`202`	`err = storage.LoadDir(cid, c.ExtraConfig.LicenseDir, reg)`
`203`	`203`	`if err != nil {`