kubelet: ctb: use generics to handle alpha/beta APIs for CTB projection

Author: stlaz

pkg/kubelet/clustertrustbundle/clustertrustbundle_manager.go

@@ -27,15 +27,16 @@ import (
 	"time"
 
 	"github.com/go-logr/logr"
+	certificatesv1alpha1 "k8s.io/api/certificates/v1alpha1"
 	certificatesv1beta1 "k8s.io/api/certificates/v1beta1"
 	k8serrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 	lrucache "k8s.io/apimachinery/pkg/util/cache"
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/client-go/informers"
-	certinformersv1beta1 "k8s.io/client-go/informers/certificates/v1beta1"
 	clientset "k8s.io/client-go/kubernetes"
-	certlistersv1beta1 "k8s.io/client-go/listers/certificates/v1beta1"
 	"k8s.io/client-go/tools/cache"
 	"k8s.io/klog/v2"
 )
@@ -44,6 +45,51 @@ const (
 	maxLabelSelectorLength = 100 * 1024
 )
 
+// clusterTrustBundle is a type constraint for version-independent ClusterTrustBundle API
+type clusterTrustBundle interface {
+	certificatesv1alpha1.ClusterTrustBundle | certificatesv1beta1.ClusterTrustBundle
+}
+
+// clusterTrustBundlesLister is an API-verion independent ClusterTrustBundles lister
+type clusterTrustBundlesLister[T clusterTrustBundle] interface {
+	Get(string) (*T, error)
+	List(labels.Selector) ([]*T, error)
+}
+
+type clusterTrustBundleHandlers[T clusterTrustBundle] interface {
+	GetName(*T) string
+	GetSignerName(*T) string
+	GetTrustBundle(*T) string
+}
+
+type alphaClusterTrustBundleHandlers struct{}
+
+type betaClusterTrustBundleHandlers struct{}
+
+func (b *alphaClusterTrustBundleHandlers) GetName(ctb *certificatesv1alpha1.ClusterTrustBundle) string {
+	return ctb.Name
+}
+
+func (b *alphaClusterTrustBundleHandlers) GetSignerName(ctb *certificatesv1alpha1.ClusterTrustBundle) string {
+	return ctb.Spec.SignerName
+}
+
+func (b *alphaClusterTrustBundleHandlers) GetTrustBundle(ctb *certificatesv1alpha1.ClusterTrustBundle) string {
+	return ctb.Spec.TrustBundle
+}
+
+func (b betaClusterTrustBundleHandlers) GetName(ctb *certificatesv1beta1.ClusterTrustBundle) string {
+	return ctb.Name
+}
+
+func (b *betaClusterTrustBundleHandlers) GetSignerName(ctb *certificatesv1beta1.ClusterTrustBundle) string {
+	return ctb.Spec.SignerName
+}
+
+func (b *betaClusterTrustBundleHandlers) GetTrustBundle(ctb *certificatesv1beta1.ClusterTrustBundle) string {
+	return ctb.Spec.TrustBundle
+}
+
 // Manager abstracts over the ability to get trust anchors.
 type Manager interface {
 	GetTrustAnchorsByName(name string, allowMissing bool) ([]byte, error)
@@ -52,23 +98,44 @@ type Manager interface {
 
 // InformerManager is the "real" manager.  It uses informers to track
 // ClusterTrustBundle objects.
-type InformerManager struct {
+type InformerManager[T clusterTrustBundle] struct {
 	ctbInformer cache.SharedIndexInformer
-	ctbLister   certlistersv1beta1.ClusterTrustBundleLister
+	ctbLister   clusterTrustBundlesLister[T]
+
+	ctbHandlers clusterTrustBundleHandlers[T]
 
 	normalizationCache *lrucache.LRUExpireCache
 	cacheTTL           time.Duration
 }
 
-var _ Manager = (*InformerManager)(nil)
+var _ Manager = (*InformerManager[certificatesv1beta1.ClusterTrustBundle])(nil)
+
+func NewAlphaInformerManager(
+	ctx context.Context, informerFactory informers.SharedInformerFactory, cacheSize int, cacheTTL time.Duration,
+) (Manager, error) {
+	bundlesInformer := informerFactory.Certificates().V1alpha1().ClusterTrustBundles()
+	return newInformerManager(
+		ctx, &alphaClusterTrustBundleHandlers{}, bundlesInformer.Informer(), bundlesInformer.Lister(), cacheSize, cacheTTL,
+	)
+}
+
+func NewBetaInformerManager(
+	ctx context.Context, informerFactory informers.SharedInformerFactory, cacheSize int, cacheTTL time.Duration,
+) (Manager, error) {
+	bundlesInformer := informerFactory.Certificates().V1beta1().ClusterTrustBundles()
+	return newInformerManager(
+		ctx, &betaClusterTrustBundleHandlers{}, bundlesInformer.Informer(), bundlesInformer.Lister(), cacheSize, cacheTTL,
+	)
+}
 
-// NewInformerManager returns an initialized InformerManager.
-func NewInformerManager(ctx context.Context, bundles certinformersv1beta1.ClusterTrustBundleInformer, cacheSize int, cacheTTL time.Duration) (*InformerManager, error) {
+// newInformerManager returns an initialized InformerManager.
+func newInformerManager[T clusterTrustBundle](ctx context.Context, handlers clusterTrustBundleHandlers[T], informer cache.SharedIndexInformer, lister clusterTrustBundlesLister[T], cacheSize int, cacheTTL time.Duration) (Manager, error) {
 	// We need to call Informer() before calling start on the shared informer
 	// factory, or the informer won't be registered to be started.
-	m := &InformerManager{
-		ctbInformer:        bundles.Informer(),
-		ctbLister:          bundles.Lister(),
+	m := &InformerManager[T]{
+		ctbInformer:        informer,
+		ctbLister:          lister,
+		ctbHandlers:        handlers,
 		normalizationCache: lrucache.NewLRUExpireCache(cacheSize),
 		cacheTTL:           cacheTTL,
 	}
@@ -78,34 +145,34 @@ func NewInformerManager(ctx context.Context, bundles certinformersv1beta1.Cluste
 	// apply to them.
 	_, err := m.ctbInformer.AddEventHandler(cache.ResourceEventHandlerFuncs{
 		AddFunc: func(obj any) {
-			ctb, ok := obj.(*certificatesv1beta1.ClusterTrustBundle)
+			ctb, ok := obj.(*T)
 			if !ok {
 				return
 			}
-			logger.Info("Dropping all cache entries for signer", "signerName", ctb.Spec.SignerName)
+			logger.Info("Dropping all cache entries for signer", "signerName", m.ctbHandlers.GetSignerName(ctb))
 			m.dropCacheFor(ctb)
 		},
 		UpdateFunc: func(old, new any) {
-			ctb, ok := new.(*certificatesv1beta1.ClusterTrustBundle)
+			ctb, ok := new.(*T)
 			if !ok {
 				return
 			}
-			logger.Info("Dropping cache for ClusterTrustBundle", "signerName", ctb.Spec.SignerName)
-			m.dropCacheFor(new.(*certificatesv1beta1.ClusterTrustBundle))
+			logger.Info("Dropping cache for ClusterTrustBundle", "signerName", m.ctbHandlers.GetSignerName(ctb))
+			m.dropCacheFor(new.(*T))
 		},
 		DeleteFunc: func(obj any) {
-			ctb, ok := obj.(*certificatesv1beta1.ClusterTrustBundle)
+			ctb, ok := obj.(*T)
 			if !ok {
 				tombstone, ok := obj.(cache.DeletedFinalStateUnknown)
 				if !ok {
 					return
 				}
-				ctb, ok = tombstone.Obj.(*certificatesv1beta1.ClusterTrustBundle)
+				ctb, ok = tombstone.Obj.(*T)
 				if !ok {
 					return
 				}
 			}
-			logger.Info("Dropping cache for ClusterTrustBundle", "signerName", ctb.Spec.SignerName)
+			logger.Info("Dropping cache for ClusterTrustBundle", "signerName", m.ctbHandlers.GetSignerName(ctb))
 			m.dropCacheFor(ctb)
 		},
 	})
@@ -116,21 +183,21 @@ func NewInformerManager(ctx context.Context, bundles certinformersv1beta1.Cluste
 	return m, nil
 }
 
-func (m *InformerManager) dropCacheFor(ctb *certificatesv1beta1.ClusterTrustBundle) {
-	if ctb.Spec.SignerName != "" {
+func (m *InformerManager[T]) dropCacheFor(ctb *T) {
+	if ctbSignerName := m.ctbHandlers.GetSignerName(ctb); ctbSignerName != "" {
 		m.normalizationCache.RemoveAll(func(key any) bool {
-			return key.(cacheKeyType).signerName == ctb.Spec.SignerName
+			return key.(cacheKeyType).signerName == ctbSignerName
 		})
 	} else {
 		m.normalizationCache.RemoveAll(func(key any) bool {
-			return key.(cacheKeyType).ctbName == ctb.ObjectMeta.Name
+			return key.(cacheKeyType).ctbName == m.ctbHandlers.GetName(ctb)
 		})
 	}
 }
 
 // GetTrustAnchorsByName returns normalized and deduplicated trust anchors from
 // a single named ClusterTrustBundle.
-func (m *InformerManager) GetTrustAnchorsByName(name string, allowMissing bool) ([]byte, error) {
+func (m *InformerManager[T]) GetTrustAnchorsByName(name string, allowMissing bool) ([]byte, error) {
 	if !m.ctbInformer.HasSynced() {
 		return nil, fmt.Errorf("ClusterTrustBundle informer has not yet synced")
 	}
@@ -149,7 +216,7 @@ func (m *InformerManager) GetTrustAnchorsByName(name string, allowMissing bool)
 		return nil, fmt.Errorf("while getting ClusterTrustBundle: %w", err)
 	}
 
-	pemTrustAnchors, err := m.normalizeTrustAnchors([]*certificatesv1beta1.ClusterTrustBundle{ctb})
+	pemTrustAnchors, err := m.normalizeTrustAnchors([]*T{ctb})
 	if err != nil {
 		return nil, fmt.Errorf("while normalizing trust anchors: %w", err)
 	}
@@ -161,7 +228,7 @@ func (m *InformerManager) GetTrustAnchorsByName(name string, allowMissing bool)
 
 // GetTrustAnchorsBySigner returns normalized and deduplicated trust anchors
 // from a set of selected ClusterTrustBundles.
-func (m *InformerManager) GetTrustAnchorsBySigner(signerName string, labelSelector *metav1.LabelSelector, allowMissing bool) ([]byte, error) {
+func (m *InformerManager[T]) GetTrustAnchorsBySigner(signerName string, labelSelector *metav1.LabelSelector, allowMissing bool) ([]byte, error) {
 	if !m.ctbInformer.HasSynced() {
 		return nil, fmt.Errorf("ClusterTrustBundle informer has not yet synced")
 	}
@@ -188,9 +255,9 @@ func (m *InformerManager) GetTrustAnchorsBySigner(signerName string, labelSelect
 		return nil, fmt.Errorf("while listing ClusterTrustBundles matching label selector %v: %w", labelSelector, err)
 	}
 
-	ctbList := []*certificatesv1beta1.ClusterTrustBundle{}
+	ctbList := []*T{}
 	for _, ctb := range rawCTBList {
-		if ctb.Spec.SignerName == signerName {
+		if m.ctbHandlers.GetSignerName(ctb) == signerName {
 			ctbList = append(ctbList, ctb)
 		}
 	}
@@ -212,11 +279,11 @@ func (m *InformerManager) GetTrustAnchorsBySigner(signerName string, labelSelect
 	return pemTrustAnchors, nil
 }
 
-func (m *InformerManager) normalizeTrustAnchors(ctbList []*certificatesv1beta1.ClusterTrustBundle) ([]byte, error) {
+func (m *InformerManager[T]) normalizeTrustAnchors(ctbList []*T) ([]byte, error) {
 	// Deduplicate trust anchors from all ClusterTrustBundles.
 	trustAnchorSet := sets.Set[string]{}
 	for _, ctb := range ctbList {
-		rest := []byte(ctb.Spec.TrustBundle)
+		rest := []byte(m.ctbHandlers.GetTrustBundle(ctb))
 		var b *pem.Block
 		for {
 			b, rest = pem.Decode(rest)
@@ -309,6 +376,8 @@ func (m *LazyInformerManager) isManagerSet() bool {
 	return m.manager != nil
 }
 
+type managerConstructor func(ctx context.Context, informerFactory informers.SharedInformerFactory, cacheSize int, cacheTTL time.Duration) (Manager, error)
+
 func (m *LazyInformerManager) ensureManagerSet() error {
 	if m.isManagerSet() {
 		return nil
@@ -321,24 +390,42 @@ func (m *LazyInformerManager) ensureManagerSet() error {
 		return nil
 	}
 
-	ctbAPIAvailable, err := clusterTrustBundlesAvailable(m.client)
-	if err != nil {
-		return fmt.Errorf("failed to determine which informer manager to choose: %w", err)
+	managerSchema := map[schema.GroupVersion]managerConstructor{
+		certificatesv1alpha1.SchemeGroupVersion: NewAlphaInformerManager,
+		certificatesv1beta1.SchemeGroupVersion:  NewBetaInformerManager,
 	}
 
-	if !ctbAPIAvailable {
+	kubeInformers := informers.NewSharedInformerFactoryWithOptions(m.client, 0)
+
+	var clusterTrustBundleManager Manager
+	var foundGV string
+	for _, gv := range []schema.GroupVersion{certificatesv1beta1.SchemeGroupVersion, certificatesv1alpha1.SchemeGroupVersion} {
+		ctbAPIAvailable, err := clusterTrustBundlesAvailable(m.client, gv)
+		if err != nil {
+			return fmt.Errorf("failed to determine which informer manager to choose: %w", err)
+		}
+
+		if !ctbAPIAvailable {
+			continue
+		}
+
+		clusterTrustBundleManager, err = managerSchema[gv](m.contextWithLogger, kubeInformers, m.cacheSize, 5*time.Minute)
+		if err != nil {
+			return fmt.Errorf("error starting informer-based ClusterTrustBundle manager: %w", err)
+		}
+		foundGV = gv.String()
+		break
+	}
+
+	if clusterTrustBundleManager == nil {
 		m.manager = &NoopManager{}
+		m.logger.Info("No version of the ClusterTrustBundle API was found, the ClusterTrustBundle informer won't be started")
 		return nil
 	}
 
-	kubeInformers := informers.NewSharedInformerFactoryWithOptions(m.client, 0)
-	clusterTrustBundleManager, err := NewInformerManager(m.contextWithLogger, kubeInformers.Certificates().V1beta1().ClusterTrustBundles(), m.cacheSize, 5*time.Minute)
-	if err != nil {
-		return fmt.Errorf("error starting informer-based ClusterTrustBundle manager: %w", err)
-	}
 	m.manager = clusterTrustBundleManager
 	kubeInformers.Start(m.contextWithLogger.Done())
-	m.logger.Info("Started ClusterTrustBundle informer")
+	m.logger.Info("Started ClusterTrustBundle informer", "apiGroup", foundGV)
 
 	// a cache fetch will likely follow right after, wait for the freshly started
 	// informers to sync
@@ -358,8 +445,8 @@ func (m *LazyInformerManager) ensureManagerSet() error {
 	return nil
 }
 
-func clusterTrustBundlesAvailable(client clientset.Interface) (bool, error) {
-	resList, err := client.Discovery().ServerResourcesForGroupVersion(certificatesv1beta1.SchemeGroupVersion.String())
+func clusterTrustBundlesAvailable(client clientset.Interface, gv schema.GroupVersion) (bool, error) {
+	resList, err := client.Discovery().ServerResourcesForGroupVersion(gv.String())
 	if k8serrors.IsNotFound(err) {
 		return false, nil
 	}