Skip to content

Commit d5647d5

Browse files
author
Vadim Rutkovsky
committed
update-tls-artifacts: add AnnotationRequirement
This is a wrapper around tlsmetadatainterfaces.Requirement which helps users quickly create new requirements for secret/configmap annotations
1 parent 26e252a commit d5647d5

File tree

4 files changed

+114
-125
lines changed

4 files changed

+114
-125
lines changed

‎pkg/cmd/update-tls-artifacts/generate-owners/tlsmetadata/autoregenerate_after_expiry/requirement.go‎

Lines changed: 14 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package autoregenerate_after_expiry
22

33
import (
4-
"encoding/json"
54
"fmt"
65

76
"github.com/openshift/origin/pkg/cmd/update-tls-artifacts/generate-owners/tlsmetadatainterfaces"
@@ -10,68 +9,22 @@ import (
109
"k8s.io/apimachinery/pkg/util/sets"
1110
)
1211

13-
// TODO move to openshift/api
14-
const AutoRegenerateAfterOfflineExpiryAnnotation = "certificates.openshift.io/auto-regenerate-after-offline-expiry"
12+
const annotationName string = "certificates.openshift.io/auto-regenerate-after-offline-expiry"
1513

16-
type AutoRegenerateAfterOfflineExpiryRequirement struct {
17-
name string
18-
}
14+
type AutoRegenerateAfterOfflineExpiryRequirement struct{}
1915

2016
func NewAutoRegenerateAfterOfflineExpiryRequirement() tlsmetadatainterfaces.Requirement {
21-
return AutoRegenerateAfterOfflineExpiryRequirement{
22-
name: "autoregenerate-after-expiry",
23-
}
24-
}
25-
26-
func (o AutoRegenerateAfterOfflineExpiryRequirement) InspectRequirement(rawData []*certgraphapi.PKIList) (tlsmetadatainterfaces.RequirementResult, error) {
27-
pkiInfo, err := tlsmetadatainterfaces.ProcessByLocation(rawData)
28-
if err != nil {
29-
return nil, fmt.Errorf("transforming raw data %v: %w", o.GetName(), err)
30-
}
31-
32-
ownershipJSONBytes, err := json.MarshalIndent(pkiInfo, "", " ")
33-
if err != nil {
34-
return nil, fmt.Errorf("failure marshalling %v.json: %w", o.GetName(), err)
35-
}
36-
markdown, err := generateAutoRegenerateAfterOfflineExpiryshipMarkdown(pkiInfo)
37-
if err != nil {
38-
return nil, fmt.Errorf("failure marshalling %v.md: %w", o.GetName(), err)
39-
}
40-
violations := generateViolationJSON(pkiInfo)
41-
violationJSONBytes, err := json.MarshalIndent(violations, "", " ")
42-
if err != nil {
43-
return nil, fmt.Errorf("failure marshalling %v-violations.json: %w", o.GetName(), err)
44-
}
45-
46-
return tlsmetadatainterfaces.NewRequirementResult(
47-
o.GetName(),
48-
ownershipJSONBytes,
49-
markdown,
50-
violationJSONBytes)
51-
}
52-
53-
func generateViolationJSON(pkiInfo *certgraphapi.PKIRegistryInfo) *certgraphapi.PKIRegistryInfo {
54-
ret := &certgraphapi.PKIRegistryInfo{}
55-
56-
for i := range pkiInfo.CertKeyPairs {
57-
curr := pkiInfo.CertKeyPairs[i]
58-
regenerates, _ := tlsmetadatainterfaces.AnnotationValue(curr.CertKeyInfo.SelectedCertMetadataAnnotations, AutoRegenerateAfterOfflineExpiryAnnotation)
59-
if len(regenerates) == 0 {
60-
ret.CertKeyPairs = append(ret.CertKeyPairs, curr)
61-
}
62-
}
63-
for i := range pkiInfo.CertificateAuthorityBundles {
64-
curr := pkiInfo.CertificateAuthorityBundles[i]
65-
regenerates, _ := tlsmetadatainterfaces.AnnotationValue(curr.CABundleInfo.SelectedCertMetadataAnnotations, AutoRegenerateAfterOfflineExpiryAnnotation)
66-
if len(regenerates) == 0 {
67-
ret.CertificateAuthorityBundles = append(ret.CertificateAuthorityBundles, curr)
68-
}
69-
}
70-
71-
return ret
17+
return tlsmetadatainterfaces.NewAnnotationRequirement(
18+
// requirement name
19+
"autoregenerate-after-expiry",
20+
// cert or configmap annotation
21+
annotationName,
22+
// function which generates markdown report
23+
generateAutoRegenerateAfterOfflineExpiryMarkdownFn,
24+
)
7225
}
7326

74-
func generateAutoRegenerateAfterOfflineExpiryshipMarkdown(pkiInfo *certgraphapi.PKIRegistryInfo) ([]byte, error) {
27+
func generateAutoRegenerateAfterOfflineExpiryMarkdownFn(pkiInfo *certgraphapi.PKIRegistryInfo) ([]byte, error) {
7528
compliantCertsByOwner := map[string][]certgraphapi.PKIRegistryInClusterCertKeyPair{}
7629
violatingCertsByOwner := map[string][]certgraphapi.PKIRegistryInClusterCertKeyPair{}
7730
compliantCABundlesByOwner := map[string][]certgraphapi.PKIRegistryInClusterCABundle{}
@@ -80,7 +33,7 @@ func generateAutoRegenerateAfterOfflineExpiryshipMarkdown(pkiInfo *certgraphapi.
8033
for i := range pkiInfo.CertKeyPairs {
8134
curr := pkiInfo.CertKeyPairs[i]
8235
owner := curr.CertKeyInfo.OwningJiraComponent
83-
regenerates, _ := tlsmetadatainterfaces.AnnotationValue(curr.CertKeyInfo.SelectedCertMetadataAnnotations, AutoRegenerateAfterOfflineExpiryAnnotation)
36+
regenerates, _ := tlsmetadatainterfaces.AnnotationValue(curr.CertKeyInfo.SelectedCertMetadataAnnotations, annotationName)
8437
if len(regenerates) == 0 {
8538
violatingCertsByOwner[owner] = append(violatingCertsByOwner[owner], curr)
8639
continue
@@ -91,7 +44,7 @@ func generateAutoRegenerateAfterOfflineExpiryshipMarkdown(pkiInfo *certgraphapi.
9144
for i := range pkiInfo.CertificateAuthorityBundles {
9245
curr := pkiInfo.CertificateAuthorityBundles[i]
9346
owner := curr.CABundleInfo.OwningJiraComponent
94-
regenerates, _ := tlsmetadatainterfaces.AnnotationValue(curr.CABundleInfo.SelectedCertMetadataAnnotations, AutoRegenerateAfterOfflineExpiryAnnotation)
47+
regenerates, _ := tlsmetadatainterfaces.AnnotationValue(curr.CABundleInfo.SelectedCertMetadataAnnotations, annotationName)
9548
if len(regenerates) == 0 {
9649
violatingCABundlesByOwner[owner] = append(violatingCABundlesByOwner[owner], curr)
9750
continue
@@ -105,7 +58,7 @@ func generateAutoRegenerateAfterOfflineExpiryshipMarkdown(pkiInfo *certgraphapi.
10558
md.Text("the cluster will automatically create new cert/key pairs or update CA bundles as required without human")
10659
md.Text("intervention.")
10760
md.Textf("To assert that a particular cert/key pair or CA bundle can do this, add the %q annotation to the secret or configmap and ",
108-
AutoRegenerateAfterOfflineExpiryAnnotation)
61+
annotationName)
10962
md.Text("setting the value of the annotation a github link to the PR adding the annotation.")
11063
md.Text("This assertion also means that you have")
11164
md.OrderedListStart()
@@ -203,7 +156,3 @@ func generateAutoRegenerateAfterOfflineExpiryshipMarkdown(pkiInfo *certgraphapi.
203156

204157
return md.Bytes(), nil
205158
}
206-
207-
func (o AutoRegenerateAfterOfflineExpiryRequirement) GetName() string {
208-
return o.name
209-
}

‎pkg/cmd/update-tls-artifacts/generate-owners/tlsmetadata/ownership/requirement.go‎

Lines changed: 10 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -1,74 +1,28 @@
11
package ownership
22

33
import (
4-
"encoding/json"
54
"fmt"
65

6+
"github.com/openshift/api/annotations"
77
"github.com/openshift/origin/pkg/cmd/update-tls-artifacts/generate-owners/tlsmetadatainterfaces"
88

99
"github.com/openshift/library-go/pkg/certs/cert-inspection/certgraphapi"
1010
"k8s.io/apimachinery/pkg/util/sets"
1111
)
1212

13-
type OwnerRequirement struct {
14-
name string
15-
}
16-
17-
func NewOwnerRequirement() tlsmetadatainterfaces.Requirement {
18-
return OwnerRequirement{
19-
name: "ownership",
20-
}
21-
}
13+
const annotationName string = annotations.OpenShiftComponent
2214

23-
func (o OwnerRequirement) InspectRequirement(rawData []*certgraphapi.PKIList) (tlsmetadatainterfaces.RequirementResult, error) {
24-
pkiInfo, err := tlsmetadatainterfaces.ProcessByLocation(rawData)
25-
if err != nil {
26-
return nil, fmt.Errorf("transforming raw data %v: %w", o.GetName(), err)
27-
}
28-
29-
ownershipJSONBytes, err := json.MarshalIndent(pkiInfo, "", " ")
30-
if err != nil {
31-
return nil, fmt.Errorf("failure marshalling %v.json: %w", o.GetName(), err)
32-
}
33-
markdown, err := generateOwnershipMarkdown(pkiInfo)
34-
if err != nil {
35-
return nil, fmt.Errorf("failure marshalling %v.md: %w", o.GetName(), err)
36-
}
37-
violations := generateViolationJSON(pkiInfo)
38-
violationJSONBytes, err := json.MarshalIndent(violations, "", " ")
39-
if err != nil {
40-
return nil, fmt.Errorf("failure marshalling %v-violations.json: %w", o.GetName(), err)
41-
}
15+
type OwnerRequirement struct{}
4216

43-
return tlsmetadatainterfaces.NewRequirementResult(
44-
o.GetName(),
45-
ownershipJSONBytes,
46-
markdown,
47-
violationJSONBytes)
17+
func NewOwnerRequirement() tlsmetadatainterfaces.AnnotationRequirement {
18+
return tlsmetadatainterfaces.NewAnnotationRequirement(
19+
"ownership",
20+
annotationName,
21+
generateOwnerMarkdownFn,
22+
)
4823
}
4924

50-
func generateViolationJSON(pkiInfo *certgraphapi.PKIRegistryInfo) *certgraphapi.PKIRegistryInfo {
51-
ret := &certgraphapi.PKIRegistryInfo{}
52-
53-
for i := range pkiInfo.CertKeyPairs {
54-
curr := pkiInfo.CertKeyPairs[i]
55-
owner := curr.CertKeyInfo.OwningJiraComponent
56-
if len(owner) == 0 || owner == tlsmetadatainterfaces.UnknownOwner {
57-
ret.CertKeyPairs = append(ret.CertKeyPairs, curr)
58-
}
59-
}
60-
for i := range pkiInfo.CertificateAuthorityBundles {
61-
curr := pkiInfo.CertificateAuthorityBundles[i]
62-
owner := curr.CABundleInfo.OwningJiraComponent
63-
if len(owner) == 0 || owner == tlsmetadatainterfaces.UnknownOwner {
64-
ret.CertificateAuthorityBundles = append(ret.CertificateAuthorityBundles, curr)
65-
}
66-
}
67-
68-
return ret
69-
}
70-
71-
func generateOwnershipMarkdown(pkiInfo *certgraphapi.PKIRegistryInfo) ([]byte, error) {
25+
func generateOwnerMarkdownFn(pkiInfo *certgraphapi.PKIRegistryInfo) ([]byte, error) {
7226
certsByOwner := map[string][]certgraphapi.PKIRegistryInClusterCertKeyPair{}
7327
certsWithoutOwners := []certgraphapi.PKIRegistryInClusterCertKeyPair{}
7428
caBundlesByOwner := map[string][]certgraphapi.PKIRegistryInClusterCABundle{}
@@ -158,7 +112,3 @@ func generateOwnershipMarkdown(pkiInfo *certgraphapi.PKIRegistryInfo) ([]byte, e
158112

159113
return md.Bytes(), nil
160114
}
161-
162-
func (o OwnerRequirement) GetName() string {
163-
return o.name
164-
}

‎pkg/cmd/update-tls-artifacts/generate-owners/tlsmetadatainterfaces/annotation_requirement.go‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
package tlsmetadatainterfaces
2+
3+
import (
4+
"encoding/json"
5+
"fmt"
6+
7+
"github.com/openshift/library-go/pkg/certs/cert-inspection/certgraphapi"
8+
)
9+
10+
type generateMarkdownFn func(pkiInfo *certgraphapi.PKIRegistryInfo) ([]byte, error)
11+
12+
type annotationRequirement struct {
13+
// requirementName is a unique name for metadata requirement
14+
requirementName string
15+
// annotationName is the annotation looked up in cert metadata
16+
annotationName string
17+
// markdownFn is a function which build markdown report from pkiInfo
18+
markdownFn generateMarkdownFn
19+
}
20+
21+
func NewAnnotationRequirement(requirementName, annotationName string, generateMarkdownFn generateMarkdownFn) AnnotationRequirement {
22+
return annotationRequirement{
23+
requirementName: requirementName,
24+
annotationName: annotationName,
25+
markdownFn: generateMarkdownFn,
26+
}
27+
}
28+
29+
func (o annotationRequirement) GetName() string {
30+
return o.requirementName
31+
}
32+
33+
func (o annotationRequirement) GetAnnotationName() string {
34+
return o.annotationName
35+
}
36+
37+
func (o annotationRequirement) InspectRequirement(rawData []*certgraphapi.PKIList) (RequirementResult, error) {
38+
pkiInfo, err := ProcessByLocation(rawData)
39+
if err != nil {
40+
return nil, fmt.Errorf("transforming raw data %v: %w", o.GetName(), err)
41+
}
42+
43+
ownershipJSONBytes, err := json.MarshalIndent(pkiInfo, "", " ")
44+
if err != nil {
45+
return nil, fmt.Errorf("failure marshalling %v.json: %w", o.GetName(), err)
46+
}
47+
markdown, err := o.markdownFn(pkiInfo)
48+
if err != nil {
49+
return nil, fmt.Errorf("failure marshalling %v.md: %w", o.GetName(), err)
50+
}
51+
violations := generateViolationJSONForAnnotationRequirement(o.GetAnnotationName(), pkiInfo)
52+
violationJSONBytes, err := json.MarshalIndent(violations, "", " ")
53+
if err != nil {
54+
return nil, fmt.Errorf("failure marshalling %v-violations.json: %w", o.GetName(), err)
55+
}
56+
57+
return NewRequirementResult(
58+
o.GetName(),
59+
ownershipJSONBytes,
60+
markdown,
61+
violationJSONBytes)
62+
}
63+
64+
func generateViolationJSONForAnnotationRequirement(annotationName string, pkiInfo *certgraphapi.PKIRegistryInfo) *certgraphapi.PKIRegistryInfo {
65+
ret := &certgraphapi.PKIRegistryInfo{}
66+
67+
for i := range pkiInfo.CertKeyPairs {
68+
curr := pkiInfo.CertKeyPairs[i]
69+
regenerates, _ := AnnotationValue(curr.CertKeyInfo.SelectedCertMetadataAnnotations, annotationName)
70+
if len(regenerates) == 0 {
71+
ret.CertKeyPairs = append(ret.CertKeyPairs, curr)
72+
}
73+
}
74+
for i := range pkiInfo.CertificateAuthorityBundles {
75+
curr := pkiInfo.CertificateAuthorityBundles[i]
76+
regenerates, _ := AnnotationValue(curr.CABundleInfo.SelectedCertMetadataAnnotations, annotationName)
77+
if len(regenerates) == 0 {
78+
ret.CertificateAuthorityBundles = append(ret.CertificateAuthorityBundles, curr)
79+
}
80+
}
81+
82+
return ret
83+
}

‎pkg/cmd/update-tls-artifacts/generate-owners/tlsmetadatainterfaces/types.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,13 @@ type Requirement interface {
1313
InspectRequirement(rawData []*certgraphapi.PKIList) (RequirementResult, error)
1414
}
1515

16+
type AnnotationRequirement interface {
17+
Requirement
18+
19+
// GetAnnotationName returns annotation name to use
20+
GetAnnotationName() string
21+
}
22+
1623
type RequirementResult interface {
1724
GetName() string
1825

0 commit comments

Comments
 (0)