Skip to content

Commit ecca9c7

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #28433 from deads2k/cert-16-push-to-simple
OCPBUGS-24583: push violation regression check into the default requirement result
2 parents 7c94b85 + b4e54c5 commit ecca9c7

File tree

5 files changed

+72
-114
lines changed

5 files changed

+72
-114
lines changed

‎pkg/cmd/update-tls-artifacts/generate-owners/tlsmetadata/autoregenerate_after_expiry/requirement.go‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ import (
44
"encoding/json"
55
"fmt"
66

7-
"github.com/openshift/origin/pkg/cmd/update-tls-artifacts/generate-owners/tlsmetadata"
87
"github.com/openshift/origin/pkg/cmd/update-tls-artifacts/generate-owners/tlsmetadatainterfaces"
98

109
"github.com/openshift/library-go/pkg/certs/cert-inspection/certgraphapi"
@@ -44,7 +43,7 @@ func (o AutoRegenerateAfterOfflineExpiryRequirement) InspectRequirement(rawData
4443
return nil, fmt.Errorf("failure marshalling %v-violations.json: %w", o.GetName(), err)
4544
}
4645

47-
return tlsmetadata.NewRequirementResult(
46+
return tlsmetadatainterfaces.NewRequirementResult(
4847
o.GetName(),
4948
ownershipJSONBytes,
5049
markdown,
@@ -56,14 +55,14 @@ func generateViolationJSON(pkiInfo *certgraphapi.PKIRegistryInfo) *certgraphapi.
5655

5756
for i := range pkiInfo.CertKeyPairs {
5857
curr := pkiInfo.CertKeyPairs[i]
59-
regenerates, _ := tlsmetadata.AnnotationValue(curr.CertKeyInfo.SelectedCertMetadataAnnotations, AutoRegenerateAfterOfflineExpiryAnnotation)
58+
regenerates, _ := tlsmetadatainterfaces.AnnotationValue(curr.CertKeyInfo.SelectedCertMetadataAnnotations, AutoRegenerateAfterOfflineExpiryAnnotation)
6059
if len(regenerates) == 0 {
6160
ret.CertKeyPairs = append(ret.CertKeyPairs, curr)
6261
}
6362
}
6463
for i := range pkiInfo.CertificateAuthorityBundles {
6564
curr := pkiInfo.CertificateAuthorityBundles[i]
66-
regenerates, _ := tlsmetadata.AnnotationValue(curr.CABundleInfo.SelectedCertMetadataAnnotations, AutoRegenerateAfterOfflineExpiryAnnotation)
65+
regenerates, _ := tlsmetadatainterfaces.AnnotationValue(curr.CABundleInfo.SelectedCertMetadataAnnotations, AutoRegenerateAfterOfflineExpiryAnnotation)
6766
if len(regenerates) == 0 {
6867
ret.CertificateAuthorityBundles = append(ret.CertificateAuthorityBundles, curr)
6968
}
@@ -81,7 +80,7 @@ func generateAutoRegenerateAfterOfflineExpiryshipMarkdown(pkiInfo *certgraphapi.
8180
for i := range pkiInfo.CertKeyPairs {
8281
curr := pkiInfo.CertKeyPairs[i]
8382
owner := curr.CertKeyInfo.OwningJiraComponent
84-
regenerates, _ := tlsmetadata.AnnotationValue(curr.CertKeyInfo.SelectedCertMetadataAnnotations, AutoRegenerateAfterOfflineExpiryAnnotation)
83+
regenerates, _ := tlsmetadatainterfaces.AnnotationValue(curr.CertKeyInfo.SelectedCertMetadataAnnotations, AutoRegenerateAfterOfflineExpiryAnnotation)
8584
if len(regenerates) == 0 {
8685
violatingCertsByOwner[owner] = append(violatingCertsByOwner[owner], curr)
8786
continue
@@ -92,7 +91,7 @@ func generateAutoRegenerateAfterOfflineExpiryshipMarkdown(pkiInfo *certgraphapi.
9291
for i := range pkiInfo.CertificateAuthorityBundles {
9392
curr := pkiInfo.CertificateAuthorityBundles[i]
9493
owner := curr.CABundleInfo.OwningJiraComponent
95-
regenerates, _ := tlsmetadata.AnnotationValue(curr.CABundleInfo.SelectedCertMetadataAnnotations, AutoRegenerateAfterOfflineExpiryAnnotation)
94+
regenerates, _ := tlsmetadatainterfaces.AnnotationValue(curr.CABundleInfo.SelectedCertMetadataAnnotations, AutoRegenerateAfterOfflineExpiryAnnotation)
9695
if len(regenerates) == 0 {
9796
violatingCABundlesByOwner[owner] = append(violatingCABundlesByOwner[owner], curr)
9897
continue

‎pkg/cmd/update-tls-artifacts/generate-owners/tlsmetadata/helpers.go‎

Lines changed: 0 additions & 100 deletions
This file was deleted.

‎pkg/cmd/update-tls-artifacts/generate-owners/tlsmetadata/ownership/requirement.go‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ import (
44
"encoding/json"
55
"fmt"
66

7-
"github.com/openshift/origin/pkg/cmd/update-tls-artifacts/generate-owners/tlsmetadata"
87
"github.com/openshift/origin/pkg/cmd/update-tls-artifacts/generate-owners/tlsmetadatainterfaces"
98

109
"github.com/openshift/library-go/pkg/certs/cert-inspection/certgraphapi"
@@ -41,7 +40,7 @@ func (o OwnerRequirement) InspectRequirement(rawData []*certgraphapi.PKIList) (t
4140
return nil, fmt.Errorf("failure marshalling %v-violations.json: %w", o.GetName(), err)
4241
}
4342

44-
return tlsmetadata.NewRequirementResult(
43+
return tlsmetadatainterfaces.NewRequirementResult(
4544
o.GetName(),
4645
ownershipJSONBytes,
4746
markdown,
@@ -54,14 +53,14 @@ func generateViolationJSON(pkiInfo *certgraphapi.PKIRegistryInfo) *certgraphapi.
5453
for i := range pkiInfo.CertKeyPairs {
5554
curr := pkiInfo.CertKeyPairs[i]
5655
owner := curr.CertKeyInfo.OwningJiraComponent
57-
if len(owner) == 0 || owner == tlsmetadata.UnknownOwner {
56+
if len(owner) == 0 || owner == tlsmetadatainterfaces.UnknownOwner {
5857
ret.CertKeyPairs = append(ret.CertKeyPairs, curr)
5958
}
6059
}
6160
for i := range pkiInfo.CertificateAuthorityBundles {
6261
curr := pkiInfo.CertificateAuthorityBundles[i]
6362
owner := curr.CABundleInfo.OwningJiraComponent
64-
if len(owner) == 0 || owner == tlsmetadata.UnknownOwner {
63+
if len(owner) == 0 || owner == tlsmetadatainterfaces.UnknownOwner {
6564
ret.CertificateAuthorityBundles = append(ret.CertificateAuthorityBundles, curr)
6665
}
6766
}
@@ -70,7 +69,6 @@ func generateViolationJSON(pkiInfo *certgraphapi.PKIRegistryInfo) *certgraphapi.
7069
}
7170

7271
func generateOwnershipMarkdown(pkiInfo *certgraphapi.PKIRegistryInfo) ([]byte, error) {
73-
const unknownOwner = "Unknown"
7472
certsByOwner := map[string][]certgraphapi.PKIRegistryInClusterCertKeyPair{}
7573
certsWithoutOwners := []certgraphapi.PKIRegistryInClusterCertKeyPair{}
7674
caBundlesByOwner := map[string][]certgraphapi.PKIRegistryInClusterCABundle{}
@@ -79,7 +77,7 @@ func generateOwnershipMarkdown(pkiInfo *certgraphapi.PKIRegistryInfo) ([]byte, e
7977
for i := range pkiInfo.CertKeyPairs {
8078
curr := pkiInfo.CertKeyPairs[i]
8179
owner := curr.CertKeyInfo.OwningJiraComponent
82-
if len(owner) == 0 || owner == tlsmetadata.UnknownOwner {
80+
if len(owner) == 0 || owner == tlsmetadatainterfaces.UnknownOwner {
8381
certsWithoutOwners = append(certsWithoutOwners, curr)
8482
continue
8583
}
@@ -88,7 +86,7 @@ func generateOwnershipMarkdown(pkiInfo *certgraphapi.PKIRegistryInfo) ([]byte, e
8886
for i := range pkiInfo.CertificateAuthorityBundles {
8987
curr := pkiInfo.CertificateAuthorityBundles[i]
9088
owner := curr.CABundleInfo.OwningJiraComponent
91-
if len(owner) == 0 || owner == tlsmetadata.UnknownOwner {
89+
if len(owner) == 0 || owner == tlsmetadatainterfaces.UnknownOwner {
9290
caBundlesWithoutOwners = append(caBundlesWithoutOwners, curr)
9391
continue
9492
}

‎pkg/cmd/update-tls-artifacts/generate-owners/tlsmetadatainterfaces/helpers.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,18 @@ import (
99
utilerrors "k8s.io/apimachinery/pkg/util/errors"
1010
)
1111

12+
const UnknownOwner = "Unknown"
13+
14+
func AnnotationValue(whitelistedAnnotations []certgraphapi.AnnotationValue, key string) (string, bool) {
15+
for _, curr := range whitelistedAnnotations {
16+
if curr.Key == key {
17+
return curr.Value, true
18+
}
19+
}
20+
21+
return "", false
22+
}
23+
1224
func ProcessByLocation(rawData []*certgraphapi.PKIList) (*certgraphapi.PKIRegistryInfo, error) {
1325
errs := []error{}
1426
certKeyPairs := certs.SecretInfoByNamespaceName{}

‎pkg/cmd/update-tls-artifacts/generate-owners/tlsmetadatainterfaces/simple_requirements_result.go‎

Lines changed: 50 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,15 @@
11
package tlsmetadatainterfaces
22

33
import (
4+
"embed"
5+
"encoding/json"
46
"fmt"
57
"os"
68
"path/filepath"
79

10+
"github.com/openshift/library-go/pkg/certs/cert-inspection/certgraphapi"
11+
"github.com/openshift/library-go/pkg/certs/cert-inspection/certgraphutils"
12+
813
"github.com/google/go-cmp/cmp"
914
)
1015

@@ -16,7 +21,7 @@ type SimpleRequirementsResult struct {
1621
violationJSON []byte
1722
}
1823

19-
func NewRequirementResult(name string, statusJSON, statusMarkdown, violationJSON []byte) (*SimpleRequirementsResult, error) {
24+
func NewRequirementResult(name string, statusJSON, statusMarkdown, violationJSON []byte) (RequirementResult, error) {
2025
if len(name) == 0 {
2126
return nil, fmt.Errorf("missing name for result")
2227
}
@@ -87,6 +92,50 @@ func (s SimpleRequirementsResult) DiffExistingContent(tlsDir string) (string, bo
8792
return "", true, nil
8893
}
8994

95+
func (s SimpleRequirementsResult) HaveViolationsRegressed(allViolationsFS embed.FS) ([]string, bool, error) {
96+
resultingViolations := &certgraphapi.PKIRegistryInfo{}
97+
if err := json.Unmarshal(s.violationJSON, resultingViolations); err != nil {
98+
return nil, false, fmt.Errorf("error decoding violation content for %v: %w", s.GetName(), err)
99+
}
100+
101+
existingViolationJSONBytes, err := allViolationsFS.ReadFile(s.violationsFilename(""))
102+
if err != nil {
103+
return nil, false, fmt.Errorf("error reading existing content for %v: %w", s.GetName(), err)
104+
}
105+
existingViolations := &certgraphapi.PKIRegistryInfo{}
106+
if err := json.Unmarshal(existingViolationJSONBytes, existingViolations); err != nil {
107+
return nil, false, fmt.Errorf("error decoding existing content for %v: %w", s.GetName(), err)
108+
}
109+
110+
regressions := []string{}
111+
for _, currCertKeyPair := range resultingViolations.CertKeyPairs {
112+
currLocation := currCertKeyPair.SecretLocation
113+
_, err := certgraphutils.LocateCertKeyPair(currLocation, existingViolations.CertKeyPairs)
114+
if err != nil {
115+
// this means it wasn't found
116+
regressions = append(regressions,
117+
fmt.Sprintf("requirment/%v: --namespace=%v secret/%v regressed and does not have an owner", s.GetName(), currLocation.Namespace, currLocation.Name),
118+
)
119+
}
120+
}
121+
122+
for _, currCABundle := range resultingViolations.CertificateAuthorityBundles {
123+
currLocation := currCABundle.ConfigMapLocation
124+
_, err := certgraphutils.LocateCertificateAuthorityBundle(currLocation, existingViolations.CertificateAuthorityBundles)
125+
if err != nil {
126+
// this means it wasn't found
127+
regressions = append(regressions,
128+
fmt.Sprintf("requirment/%v: --namespace=%v configmap/%v regressed and does not have an owner", s.GetName(), currLocation.Namespace, currLocation.Name),
129+
)
130+
}
131+
}
132+
133+
if len(regressions) > 0 {
134+
return regressions, true, nil
135+
}
136+
return nil, false, nil
137+
}
138+
90139
func (s SimpleRequirementsResult) jsonFilename(tlsDir string) string {
91140
return filepath.Join(tlsDir, s.GetName(), fmt.Sprintf("%s.json", s.GetName()))
92141
}

0 commit comments

Comments
 (0)