feat(pkg-mgr): Add a configuration parameter to allow automatic dependency version downgrades

Signed-off-by: ezgidemirel <[email protected]>

Author: ezgidemirel

.github/workflows/ci.yml

@@ -225,7 +225,7 @@ jobs:
           - base
           - ssa-claims
           - realtime-compositions
-          - package-dependency-upgrades
+          - package-dependency-updates
           - package-signature-verification
 
     steps:

cluster/charts/crossplane/README.md

@@ -90,6 +90,7 @@ and their default values.
 | `packageCache.medium` | Set to `Memory` to hold the package cache in a RAM backed file system. Useful for Crossplane development. | `""` |
 | `packageCache.pvc` | The name of a PersistentVolumeClaim to use as the package cache. Disables the default package cache `emptyDir` Volume. | `""` |
 | `packageCache.sizeLimit` | The size limit for the package cache. If medium is `Memory` the `sizeLimit` can't exceed Node memory. | `"20Mi"` |
+| `packageManager.enableAutomaticDependencyDowngrade` | Enable automatic dependency version downgrades. This configuration is only used when `--enable-dependency-version-upgrades` flag is passed. | `false` |
 | `podSecurityContextCrossplane` | Add a custom `securityContext` to the Crossplane pod. | `{}` |
 | `podSecurityContextRBACManager` | Add a custom `securityContext` to the RBAC Manager pod. | `{}` |
 | `priorityClassName` | The PriorityClass name to apply to the Crossplane and RBAC Manager pods. | `""` |

cluster/charts/crossplane/templates/deployment.yaml

@@ -197,6 +197,10 @@ spec:
           - name: {{ $key | replace "." "_" }}
             value: {{ $value | quote }}
         {{- end}}
+        {{- if .Values.packageManager.enableAutomaticDependencyDowngrade }}
+          - name: "AUTOMATIC_DEPENDENCY_DOWNGRADE_ENABLED"
+            value: "true"
+        {{- end }}
         volumeMounts:
           - mountPath: /cache
             name: package-cache

cluster/charts/crossplane/values.yaml

@@ -103,6 +103,10 @@ rbacManager:
   # -- Add `topologySpreadConstraints` to the RBAC Manager pod deployment.
   topologySpreadConstraints: []
 
+packageManager:
+  # -- Enable automatic dependency version downgrades. This configuration is only used when `--enable-dependency-version-upgrades` flag is passed.
+  enableAutomaticDependencyDowngrade: false
+
 # -- The PriorityClass name to apply to the Crossplane and RBAC Manager pods.
 priorityClassName: ""
 

cmd/crossplane/core/core.go

@@ -102,7 +102,8 @@ type startCommand struct {
 	MaxReconcileRate                 int           `default:"100" help:"The global maximum rate per second at which resources may checked for drift from the desired state."`
 	MaxConcurrentPackageEstablishers int           `default:"10"  help:"The the maximum number of goroutines to use for establishing Providers, Configurations and Functions."`
 
-	WebhookEnabled bool `default:"true" env:"WEBHOOK_ENABLED" help:"Enable webhook configuration."`
+	WebhookEnabled                      bool `default:"true"  env:"WEBHOOK_ENABLED"                        help:"Enable webhook configuration."`
+	AutomaticDependencyDowngradeEnabled bool `default:"false" env:"AUTOMATIC_DEPENDENCY_DOWNGRADE_ENABLED" help:"Enable automatic dependency version downgrades. This configuration requires the 'EnableDependencyVersionUpgrades' feature flag to be enabled."`
 
 	TLSServerSecretName string `env:"TLS_SERVER_SECRET_NAME" help:"The name of the TLS Secret that will store Crossplane's server certificate."`
 	TLSServerCertsDir   string `env:"TLS_SERVER_CERTS_DIR"   help:"The path of the folder which will store TLS server certificate of Crossplane."`
@@ -285,6 +286,10 @@ func (c *startCommand) Run(s *runtime.Scheme, log logging.Logger) error { //noli
 	if c.EnableDependencyVersionUpgrades {
 		o.Features.Enable(features.EnableAlphaDependencyVersionUpgrades)
 		log.Info("Alpha feature enabled", "flag", features.EnableAlphaDependencyVersionUpgrades)
+
+		if c.AutomaticDependencyDowngradeEnabled {
+			log.Info("Automatic dependency downgrade is enabled.")
+		}
 	}
 	if c.EnableSignatureVerification {
 		o.Features.Enable(features.EnableAlphaSignatureVerification)
@@ -392,14 +397,15 @@ func (c *startCommand) Run(s *runtime.Scheme, log logging.Logger) error { //noli
 	}
 
 	po := pkgcontroller.Options{
-		Options:                          o,
-		Cache:                            xpkg.NewFsPackageCache(c.CacheDir, afero.NewOsFs()),
-		Namespace:                        c.Namespace,
-		ServiceAccount:                   c.ServiceAccount,
-		DefaultRegistry:                  c.Registry,
-		FetcherOptions:                   []xpkg.FetcherOpt{xpkg.WithUserAgent(c.UserAgent)},
-		PackageRuntime:                   pr,
-		MaxConcurrentPackageEstablishers: c.MaxConcurrentPackageEstablishers,
+		Options:                             o,
+		Cache:                               xpkg.NewFsPackageCache(c.CacheDir, afero.NewOsFs()),
+		Namespace:                           c.Namespace,
+		ServiceAccount:                      c.ServiceAccount,
+		DefaultRegistry:                     c.Registry,
+		FetcherOptions:                      []xpkg.FetcherOpt{xpkg.WithUserAgent(c.UserAgent)},
+		PackageRuntime:                      pr,
+		MaxConcurrentPackageEstablishers:    c.MaxConcurrentPackageEstablishers,
+		AutomaticDependencyDowngradeEnabled: c.AutomaticDependencyDowngradeEnabled,
 	}
 
 	// We need to set the TUF_ROOT environment variable so that the TUF client

internal/controller/pkg/controller/options.go

@@ -49,4 +49,8 @@ type Options struct {
 	// MaxConcurrentPackageEstablishers is the maximum number of goroutines to use
 	// for establishing Providers, Configurations and Functions.
 	MaxConcurrentPackageEstablishers int
+
+	// AutomaticDependencyDowngradeEnabled is a configuration option that
+	// enables automatic downgrade of dependencies to the highest valid version.
+	AutomaticDependencyDowngradeEnabled bool
 }

internal/controller/pkg/resolver/reconciler.go

@@ -138,6 +138,13 @@ func WithFeatures(f *feature.Flags) ReconcilerOption {
 	}
 }
 
+// WithDowngradesEnabled sets whether upgrades are enabled or not.
+func WithDowngradesEnabled() ReconcilerOption {
+	return func(r *Reconciler) {
+		r.downgradesEnabled = true
+	}
+}
+
 // Reconciler reconciles packages.
 type Reconciler struct {
 	client   client.Client
@@ -148,6 +155,8 @@ type Reconciler struct {
 	config   xpkg.ConfigStore
 	registry string
 	features *feature.Flags
+
+	downgradesEnabled bool
 }
 
 // Setup adds a controller that reconciles the Lock.
@@ -172,6 +181,9 @@ func Setup(mgr ctrl.Manager, o controller.Options) error {
 
 	if o.Features.Enabled(features.EnableAlphaDependencyVersionUpgrades) {
 		opts = append(opts, WithNewDagFn(internaldag.NewUpgradingMapDag))
+		if o.AutomaticDependencyDowngradeEnabled {
+			opts = append(opts, WithDowngradesEnabled())
+		}
 	}
 
 	return ctrl.NewControllerManagedBy(mgr).
@@ -387,7 +399,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, req reconcile.Request) (reco
 		return reconcile.Result{}, errors.Errorf(errFmtMissingDependency, depID)
 	}
 
-	newVer, err := r.findDependencyVersionToUpgrade(ctx, ref, installedVersion, n, log)
+	newVer, err := r.findDependencyVersionToUpdate(ctx, ref, installedVersion, n, log)
 	if err != nil {
 		log.Debug(errFindDependencyUpgrade, "error", errors.Wrapf(err, depID, dep.Constraints))
 		lock.SetConditions(v1beta1.ResolutionFailed(errors.Wrap(err, errFindDependencyUpgrade)))
@@ -467,8 +479,8 @@ func (r *Reconciler) findDependencyVersionToInstall(ctx context.Context, dep *v1
 	return addVer, nil
 }
 
-// FindValidDependencyVersion finds a valid version with version upgrade capability considering parent constraints.
-func (r *Reconciler) findDependencyVersionToUpgrade(ctx context.Context, ref name.Reference, insVer string, dep internaldag.Node, log logging.Logger) (string, error) {
+// findDependencyVersionToUpdate finds a valid version to update the dependency considering the parent constraints.
+func (r *Reconciler) findDependencyVersionToUpdate(ctx context.Context, ref name.Reference, insVer string, dep internaldag.Node, log logging.Logger) (string, error) {
 	// If there is a digest in the parent constraints, we need to make sure that all other parent constraints are the same.
 	digest, err := findDigestToUpdate(dep)
 	if err != nil {
@@ -521,14 +533,10 @@ func (r *Reconciler) findDependencyVersionToUpgrade(ctx context.Context, ref nam
 
 	sort.Sort(semver.Collection(availableVersions))
 	currentVersion := semver.MustParse(insVer)
+	var targetVersion *semver.Version
 
 	// We aim to find the lowest version that satisfies all parent constraints and is greater than the current version.
 	for _, v := range availableVersions {
-		// Downgrades are not allowed, so we skip versions that are less than the current version.
-		if v.LessThan(currentVersion) {
-			continue
-		}
-
 		valid := true
 		for _, c := range parentConstraints {
 			if !c.Check(v) {
@@ -537,9 +545,19 @@ func (r *Reconciler) findDependencyVersionToUpgrade(ctx context.Context, ref nam
 			}
 		}
 
-		if valid {
+		// If we're upgrading, we target the first valid version that is greater than the current version.
+		if (v.GreaterThan(currentVersion) || v.Equal(currentVersion)) && valid {
 			return v.Original(), nil
 		}
+
+		// If we're downgrading, we target the largest valid version that is less than the current version.
+		if r.downgradesEnabled && valid {
+			targetVersion = v
+		}
+	}
+
+	if targetVersion != nil {
+		return targetVersion.Original(), nil
 	}
 
 	log.Debug(errFindDependencyUpgrade, "error", errors.Errorf(errFmtNoValidVersion, dep.Identifier(), dep.GetParentConstraints()))

internal/controller/pkg/resolver/reconciler_test.go

@@ -1050,7 +1050,7 @@ func TestReconcilerFindDependencyVersionToUpgrade(t *testing.T) {
 			},
 		},
 		"ErrorNoValidVersionDowngrade": {
-			reason: "We should return an error if no valid version exists for dependency and downgrade is not allowed.",
+			reason: "We should return an error if no valid version exists for dependency and downgrade is not enabled.",
 			args: args{
 				mgr:    &fake.Manager{Client: test.NewMockClient()},
 				insVer: "v1.0.0",
@@ -1074,18 +1074,70 @@ func TestReconcilerFindDependencyVersionToUpgrade(t *testing.T) {
 				err: errors.Errorf(errFmtNoValidVersion, "cool-repo/cool-image", "[<=v1.0.0 v0.0.1]"),
 			},
 		},
+		"UpgradeToSmallestValid": {
+			reason: "We should be able to find the smallest valid version to update to.",
+			args: args{
+				mgr:    &fake.Manager{Client: test.NewMockClient()},
+				insVer: "v2.0.0",
+				dep: &v1beta1.Dependency{
+					Package: "cool-repo/cool-image",
+					ParentConstraints: []string{
+						">v2.0.0",
+						"<=v3.0.0",
+					},
+				},
+				rec: []ReconcilerOption{
+					WithFetcher(&fakexpkg.MockFetcher{
+						MockTags: fakexpkg.NewMockTagsFn([]string{"v1.0.0", "v2.0.0", "v2.1.0", "v3.0.0"}, nil),
+					}),
+					WithConfigStore(&fakexpkg.MockConfigStore{
+						MockPullSecretFor: fakexpkg.NewMockConfigStorePullSecretForFn("", "", nil),
+					}),
+					WithDowngradesEnabled(),
+				},
+			},
+			want: want{
+				version: "v2.1.0",
+			},
+		},
+		"DowngradeToLargestValid": {
+			reason: "We should return an error if no valid version exists for dependency and downgrade is not allowed.",
+			args: args{
+				mgr:    &fake.Manager{Client: test.NewMockClient()},
+				insVer: "v3.0.0",
+				dep: &v1beta1.Dependency{
+					Package: "cool-repo/cool-image",
+					ParentConstraints: []string{
+						">=v0.0.1",
+						"<v3.0.0",
+					},
+				},
+				rec: []ReconcilerOption{
+					WithFetcher(&fakexpkg.MockFetcher{
+						MockTags: fakexpkg.NewMockTagsFn([]string{"v0.0.1", "v1.0.0", "v2.0.0", "v3.0.0"}, nil),
+					}),
+					WithConfigStore(&fakexpkg.MockConfigStore{
+						MockPullSecretFor: fakexpkg.NewMockConfigStorePullSecretForFn("", "", nil),
+					}),
+					WithDowngradesEnabled(),
+				},
+			},
+			want: want{
+				version: "v2.0.0",
+			},
+		},
 	}
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
 			r := NewReconciler(tc.args.mgr, append(tc.args.rec, WithLogger(testLog))...)
 			ref, _ := pkgName.ParseReference(tc.args.dep.Identifier())
-			got, err := r.findDependencyVersionToUpgrade(context.Background(), ref, tc.args.insVer, tc.args.dep, testLog)
+			got, err := r.findDependencyVersionToUpdate(context.Background(), ref, tc.args.insVer, tc.args.dep, testLog)
 
 			if diff := cmp.Diff(tc.want.err, err, test.EquateErrors()); diff != "" {
-				t.Errorf("\n%s\nr.findDependencyVersionToUpgrade(...): -want error, +got error:\n%s", tc.reason, diff)
+				t.Errorf("\n%s\nr.findDependencyVersionToUpdate(...): -want error, +got error:\n%s", tc.reason, diff)
 			}
 			if diff := cmp.Diff(tc.want.version, got, test.EquateErrors()); diff != "" {
-				t.Errorf("\n%s\nr.findDependencyVersionToUpgrade(...): -want, +got:\n%s", tc.reason, diff)
+				t.Errorf("\n%s\nr.findDependencyVersionToUpdate(...): -want, +got:\n%s", tc.reason, diff)
 			}
 		})
 	}