[OOM-K8S-CERT-EXTERNAL-PROVIDER] Mock implementaion enhanced (part II)

Rename CertServiceIssuer -> CMPv2Issuer
Checking for Issuer.Kind (has to be CMPv2Issuer)
Introduced exit codes
Refactoring file names and packages
Moved tests to main package (according to GOlang convention)

Issue-ID: OOM-2559
Signed-off-by: Jan Malkiewicz <jan.malkiewicz@nokia.com>
Change-Id: I710d9f6c9bd22318e5152e5215b78d5a9e7b4540

4 files changed, 447 insertions, 0 deletions

diff --git a/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller.go b/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller.go
new file mode 100644
index 00000000..1669c97f
--- /dev/null
+++ b/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller.go
@@ -0,0 +1,169 @@
+/*
+ * ============LICENSE_START=======================================================
+ * oom-certservice-k8s-external-provider
+ * ================================================================================
+ * Copyright 2019 The cert-manager authors.
+ * Modifications copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * This source code was copied from the following git repository:
+ * https://github.com/smallstep/step-issuer
+ * The source code was modified for usage in the ONAP project.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package cmpv2controller
+
+import (
+	"context"
+	"fmt"
+	"onap.org/oom-certservice/k8s-external-provider/src/cmpv2api"
+	provisioners "onap.org/oom-certservice/k8s-external-provider/src/cmpv2provisioner"
+
+	"github.com/go-logr/logr"
+	apiutil "github.com/jetstack/cert-manager/pkg/api/util"
+	cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1"
+	cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
+	core "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/tools/record"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+// CertificateRequestController reconciles a CMPv2Issuer object.
+type CertificateRequestController struct {
+	client.Client
+	Log      logr.Logger
+	Recorder record.EventRecorder
+}
+
+// Reconcile will read and validate a CMPv2Issuer resource associated to the
+// CertificateRequest resource, and it will sign the CertificateRequest with the
+// provisioner in the CMPv2Issuer.
+func (controller *CertificateRequestController) Reconcile(req ctrl.Request) (ctrl.Result, error) {
+	ctx := context.Background()
+	log := controller.Log.WithValues("certificate-request-controller", req.NamespacedName)
+
+	// Fetch the CertificateRequest resource being reconciled.
+	// Just ignore the request if the certificate request has been deleted.
+	certificateRequest := new(cmapi.CertificateRequest)
+	if err := controller.Client.Get(ctx, req.NamespacedName, certificateRequest); err != nil {
+		if apierrors.IsNotFound(err) {
+			return ctrl.Result{}, nil
+		}
+
+		log.Error(err, "failed to retrieve CertificateRequest resource")
+		return ctrl.Result{}, err
+	}
+
+	if !isCMPv2CertificateRequest(certificateRequest) {
+		log.V(4).Info("certificate request is not CMPv2",
+			"group", certificateRequest.Spec.IssuerRef.Group,
+			"kind", certificateRequest.Spec.IssuerRef.Kind)
+		return ctrl.Result{}, nil
+	}
+
+	// If the certificate data is already set then we skip this request as it
+	// has already been completed in the past.
+	if len(certificateRequest.Status.Certificate) > 0 {
+		log.V(4).Info("existing certificate data found in status, skipping already completed CertificateRequest")
+		return ctrl.Result{}, nil
+	}
+
+	// Fetch the CMPv2Issuer resource
+	issuer := cmpv2api.CMPv2Issuer{}
+	issuerNamespaceName := types.NamespacedName{
+		Namespace: req.Namespace,
+		Name:      certificateRequest.Spec.IssuerRef.Name,
+	}
+	if err := controller.Client.Get(ctx, issuerNamespaceName, &issuer); err != nil {
+		log.Error(err, "failed to retrieve CMPv2Issuer resource", "namespace", req.Namespace, "name", certificateRequest.Spec.IssuerRef.Name)
+		_ = controller.setStatus(ctx, certificateRequest, cmmeta.ConditionFalse, cmapi.CertificateRequestReasonPending, "Failed to retrieve CMPv2Issuer resource %s: %v", issuerNamespaceName, err)
+		return ctrl.Result{}, err
+	}
+
+	// Check if the CMPv2Issuer resource has been marked Ready
+	if !cmpv2IssuerHasCondition(issuer, cmpv2api.CMPv2IssuerCondition{Type: cmpv2api.ConditionReady, Status: cmpv2api.ConditionTrue}) {
+		err := fmt.Errorf("resource %s is not ready", issuerNamespaceName)
+		log.Error(err, "failed to retrieve CMPv2Issuer resource", "namespace", req.Namespace, "name", certificateRequest.Spec.IssuerRef.Name)
+		_ = controller.setStatus(ctx, certificateRequest, cmmeta.ConditionFalse, cmapi.CertificateRequestReasonPending, "CMPv2Issuer resource %s is not Ready", issuerNamespaceName)
+		return ctrl.Result{}, err
+	}
+
+	// Load the provisioner that will sign the CertificateRequest
+	provisioner, ok := provisioners.Load(issuerNamespaceName)
+	if !ok {
+		err := fmt.Errorf("provisioner %s not found", issuerNamespaceName)
+		log.Error(err, "failed to provisioner for CMPv2Issuer resource")
+		_ = controller.setStatus(ctx, certificateRequest, cmmeta.ConditionFalse, cmapi.CertificateRequestReasonPending, "Failed to load provisioner for CMPv2Issuer resource %s", issuerNamespaceName)
+		return ctrl.Result{}, err
+	}
+
+	// Sign CertificateRequest
+	signedPEM, trustedCAs, err := provisioner.Sign(ctx, certificateRequest)
+	if err != nil {
+		log.Error(err, "failed to sign certificate request")
+		return ctrl.Result{}, controller.setStatus(ctx, certificateRequest, cmmeta.ConditionFalse, cmapi.CertificateRequestReasonFailed, "Failed to sign certificate request: %v", err)
+	}
+	certificateRequest.Status.Certificate = signedPEM
+	certificateRequest.Status.CA = trustedCAs
+
+	return ctrl.Result{}, controller.setStatus(ctx, certificateRequest, cmmeta.ConditionTrue, cmapi.CertificateRequestReasonIssued, "Certificate issued")
+}
+
+// SetupWithManager initializes the CertificateRequest controller into the
+// controller runtime.
+func (controller *CertificateRequestController) SetupWithManager(manager ctrl.Manager) error {
+	return ctrl.NewControllerManagedBy(manager).
+		For(&cmapi.CertificateRequest{}).
+		Complete(controller)
+}
+
+// cmpv2IssuerHasCondition will return true if the given CMPv2Issuer resource has
+// a condition matching the provided CMPv2IssuerCondition. Only the Type and
+// Status field will be used in the comparison, meaning that this function will
+// return 'true' even if the Reason, Message and LastTransitionTime fields do
+// not match.
+func cmpv2IssuerHasCondition(issuer cmpv2api.CMPv2Issuer, condition cmpv2api.CMPv2IssuerCondition) bool {
+	existingConditions := issuer.Status.Conditions
+	for _, cond := range existingConditions {
+		if condition.Type == cond.Type && condition.Status == cond.Status {
+			return true
+		}
+	}
+	return false
+}
+
+func isCMPv2CertificateRequest(certificateRequest *cmapi.CertificateRequest) bool {
+	return certificateRequest.Spec.IssuerRef.Group != "" &&
+		certificateRequest.Spec.IssuerRef.Group == cmpv2api.GroupVersion.Group &&
+	    certificateRequest.Spec.IssuerRef.Kind == cmpv2api.CMPv2IssuerKind
+
+}
+
+func (controller *CertificateRequestController) setStatus(ctx context.Context, certificateRequest *cmapi.CertificateRequest, status cmmeta.ConditionStatus, reason, message string, args ...interface{}) error {
+	completeMessage := fmt.Sprintf(message, args...)
+	apiutil.SetCertificateRequestCondition(certificateRequest, cmapi.CertificateRequestConditionReady, status, reason, completeMessage)
+
+	// Fire an Event to additionally inform users of the change
+	eventType := core.EventTypeNormal
+	if status == cmmeta.ConditionFalse {
+		eventType = core.EventTypeWarning
+	}
+	controller.Recorder.Event(certificateRequest, eventType, reason, completeMessage)
+
+	return controller.Client.Status().Update(ctx, certificateRequest)
+}
diff --git a/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller_test.go b/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller_test.go
new file mode 100644
index 00000000..36cfbc48
--- /dev/null
+++ b/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller_test.go
@@ -0,0 +1,35 @@
+package cmpv2controller
+
+import (
+	cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1"
+	"testing"
+)
+
+func TestIsCMPv2CertificateRequest_notCMPv2Request(t *testing.T) {
+	request := new(cmapi.CertificateRequest)
+	if isCMPv2CertificateRequest(request) {
+		t.Logf("CPMv2 request [NOK]")
+		t.FailNow()
+	}
+
+	request.Spec.IssuerRef.Group = "certmanager.onap.org"
+	request.Spec.IssuerRef.Kind = "CertificateRequest"
+	if isCMPv2CertificateRequest(request) {
+		t.Logf("CPMv2 request [NOK]")
+		t.FailNow()
+	}
+}
+
+func TestIsCMPv2CertificateRequest_CMPvRequest(t *testing.T) {
+	request := new(cmapi.CertificateRequest)
+	request.Spec.IssuerRef.Group = "certmanager.onap.org"
+	request.Spec.IssuerRef.Kind = "CMPv2Issuer"
+
+	if isCMPv2CertificateRequest(request) {
+		t.Logf("CPMv2 request [OK]")
+	} else {
+		t.Logf("Not a CPMv2 request [NOK]")
+		t.FailNow()
+	}
+}
+
diff --git a/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_controller.go b/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_controller.go
new file mode 100644
index 00000000..e5b1b196
--- /dev/null
+++ b/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_controller.go
@@ -0,0 +1,127 @@
+/*
+ * ============LICENSE_START=======================================================
+ * oom-certservice-k8s-external-provider
+ * ================================================================================
+ * Copyright (c) 2019 Smallstep Labs, Inc.
+ * Modifications copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * This source code was copied from the following git repository:
+ * https://github.com/smallstep/step-issuer
+ * The source code was modified for usage in the ONAP project.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package cmpv2controller
+
+import (
+	"context"
+	"fmt"
+	"github.com/go-logr/logr"
+	core "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/tools/record"
+	"k8s.io/utils/clock"
+	"onap.org/oom-certservice/k8s-external-provider/src/cmpv2api"
+	provisioners "onap.org/oom-certservice/k8s-external-provider/src/cmpv2provisioner"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+// CMPv2IssuerController reconciles a CMPv2Issuer object
+type CMPv2IssuerController struct {
+	client.Client
+	Log      logr.Logger
+	Clock    clock.Clock
+	Recorder record.EventRecorder
+}
+
+// Reconcile will read and validate the CMPv2Issuer resources, it will set the
+// status condition ready to true if everything is right.
+func (controller *CMPv2IssuerController) Reconcile(req ctrl.Request) (ctrl.Result, error) {
+	ctx := context.Background()
+	log := controller.Log.WithValues("cmpv2-issuer-controller", req.NamespacedName)
+
+	issuer := new(cmpv2api.CMPv2Issuer)
+	if err := controller.Client.Get(ctx, req.NamespacedName, issuer); err != nil {
+		log.Error(err, "failed to retrieve CMPv2Issuer resource")
+		return ctrl.Result{}, client.IgnoreNotFound(err)
+	}
+	log.Info("Issuer loaded: ", "issuer", issuer)
+
+	statusUpdater := newStatusUpdater(controller, issuer, log)
+	if err := validateCMPv2IssuerSpec(issuer.Spec); err != nil {
+		log.Error(err, "failed to validate CMPv2Issuer resource")
+		statusUpdater.UpdateNoError(ctx, cmpv2api.ConditionFalse, "Validation", "Failed to validate resource: %v", err)
+		return ctrl.Result{}, err
+	}
+	log.Info("Issuer validated. ")
+
+	// Fetch the provisioner password
+	var secret core.Secret
+	secretNamespaceName := types.NamespacedName{
+		Namespace: req.Namespace,
+		Name:      issuer.Spec.KeyRef.Name,
+	}
+	if err := controller.Client.Get(ctx, secretNamespaceName, &secret); err != nil {
+		log.Error(err, "failed to retrieve CMPv2Issuer provisioner secret", "namespace", secretNamespaceName.Namespace, "name", secretNamespaceName.Name)
+		if apierrors.IsNotFound(err) {
+			statusUpdater.UpdateNoError(ctx, cmpv2api.ConditionFalse, "NotFound", "Failed to retrieve provisioner secret: %v", err)
+		} else {
+			statusUpdater.UpdateNoError(ctx, cmpv2api.ConditionFalse, "Error", "Failed to retrieve provisioner secret: %v", err)
+		}
+		return ctrl.Result{}, err
+	}
+	password, ok := secret.Data[issuer.Spec.KeyRef.Key]
+	if !ok {
+		err := fmt.Errorf("secret %s does not contain key %s", secret.Name, issuer.Spec.KeyRef.Key)
+		log.Error(err, "failed to retrieve CMPv2Issuer provisioner secret", "namespace", secretNamespaceName.Namespace, "name", secretNamespaceName.Name)
+		statusUpdater.UpdateNoError(ctx, cmpv2api.ConditionFalse, "NotFound", "Failed to retrieve provisioner secret: %v", err)
+		return ctrl.Result{}, err
+	}
+
+	// Initialize and store the provisioner
+	provisioner, err := provisioners.New(issuer, password)
+	if err != nil {
+		log.Error(err, "failed to initialize provisioner")
+		statusUpdater.UpdateNoError(ctx, cmpv2api.ConditionFalse, "Error", "failed initialize provisioner")
+		return ctrl.Result{}, err
+	}
+	provisioners.Store(req.NamespacedName, provisioner)
+
+	log.Info( "CMPv2Issuer verified. Updating status to Verified...")
+	return ctrl.Result{}, statusUpdater.Update(ctx, cmpv2api.ConditionTrue, "Verified", "CMPv2Issuer verified and ready to sign certificates")
+}
+
+// SetupWithManager initializes the CMPv2Issuer controller into the controller
+// runtime.
+func (controller *CMPv2IssuerController) SetupWithManager(manager ctrl.Manager) error {
+	return ctrl.NewControllerManagedBy(manager).
+		For(&cmpv2api.CMPv2Issuer{}).
+		Complete(controller)
+}
+
+func validateCMPv2IssuerSpec(issuerSpec cmpv2api.CMPv2IssuerSpec) error {
+	switch {
+	case issuerSpec.URL == "":
+		return fmt.Errorf("spec.url cannot be empty")
+	case issuerSpec.KeyRef.Name == "":
+		return fmt.Errorf("spec.keyRef.name cannot be empty")
+	case issuerSpec.KeyRef.Key == "":
+		return fmt.Errorf("spec.keyRef.key cannot be empty")
+	default:
+		return nil
+	}
+}
diff --git a/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_status_updater.go b/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_status_updater.go
new file mode 100644
index 00000000..f2ec5c5a
--- /dev/null
+++ b/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_status_updater.go
@@ -0,0 +1,116 @@
+/*
+ * ============LICENSE_START=======================================================
+ * oom-certservice-k8s-external-provider
+ * ================================================================================
+ * Copyright (c) 2019 Smallstep Labs, Inc.
+ * Modifications copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * This source code was copied from the following git repository:
+ * https://github.com/smallstep/step-issuer
+ * The source code was modified for usage in the ONAP project.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package cmpv2controller
+
+import (
+	"context"
+	"fmt"
+	"github.com/go-logr/logr"
+	core "k8s.io/api/core/v1"
+	meta "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"onap.org/oom-certservice/k8s-external-provider/src/cmpv2api"
+)
+
+type CMPv2IssuerStatusUpdater struct {
+	*CMPv2IssuerController
+	issuer *cmpv2api.CMPv2Issuer
+	logger logr.Logger
+}
+
+func newStatusUpdater(controller *CMPv2IssuerController, issuer *cmpv2api.CMPv2Issuer, log logr.Logger) *CMPv2IssuerStatusUpdater {
+	return &CMPv2IssuerStatusUpdater{
+		CMPv2IssuerController: controller,
+		issuer:                issuer,
+		logger:                log,
+	}
+}
+
+func (updater *CMPv2IssuerStatusUpdater) Update(ctx context.Context, status cmpv2api.ConditionStatus, reason, message string, args ...interface{}) error {
+	completeMessage := fmt.Sprintf(message, args...)
+	updater.setCondition(status, reason, completeMessage)
+
+	// Fire an Event to additionally inform users of the change
+	eventType := core.EventTypeNormal
+	if status == cmpv2api.ConditionFalse {
+		eventType = core.EventTypeWarning
+	}
+	updater.logger.Info("Firing event: ", "issuer", updater.issuer, "eventtype", eventType, "reason", reason, "message", completeMessage)
+	updater.Recorder.Event(updater.issuer, eventType, reason, completeMessage)
+
+	updater.logger.Info("Updating issuer... ")
+	return updater.Client.Update(ctx, updater.issuer)
+}
+
+func (updater *CMPv2IssuerStatusUpdater) UpdateNoError(ctx context.Context, status cmpv2api.ConditionStatus, reason, message string, args ...interface{}) {
+	if err := updater.Update(ctx, status, reason, message, args...); err != nil {
+		updater.logger.Error(err, "failed to update", "status", status, "reason", reason)
+	}
+}
+
+// setCondition will set a 'condition' on the given cmpv2api.CMPv2Issuer resource.
+//
+// - If no condition of the same type already exists, the condition will be
+//   inserted with the LastTransitionTime set to the current time.
+// - If a condition of the same type and state already exists, the condition
+//   will be updated but the LastTransitionTime will not be modified.
+// - If a condition of the same type and different state already exists, the
+//   condition will be updated and the LastTransitionTime set to the current
+//   time.
+func (updater *CMPv2IssuerStatusUpdater) setCondition(status cmpv2api.ConditionStatus, reason, message string) {
+	now := meta.NewTime(updater.Clock.Now())
+	issuerCondition := cmpv2api.CMPv2IssuerCondition{
+		Type:               cmpv2api.ConditionReady,
+		Status:             status,
+		Reason:             reason,
+		Message:            message,
+		LastTransitionTime: &now,
+	}
+
+	// Search through existing conditions
+	for i, condition := range updater.issuer.Status.Conditions {
+		// Skip unrelated conditions
+		if condition.Type != cmpv2api.ConditionReady {
+			continue
+		}
+
+		// If this update doesn't contain a state transition, we don't update
+		// the conditions LastTransitionTime to Now()
+		if condition.Status == status {
+			issuerCondition.LastTransitionTime = condition.LastTransitionTime
+		} else {
+			updater.logger.Info("found status change for CMPv2Issuer condition; setting lastTransitionTime", "condition", condition.Type, "old_status", condition.Status, "new_status", status, "time", now.Time)
+		}
+
+		// Overwrite the existing condition
+		updater.issuer.Status.Conditions[i] = issuerCondition
+		return
+	}
+
+	// If we've not found an existing condition of this type, we simply insert
+	// the new condition into the slice.
+	updater.issuer.Status.Conditions = append(updater.issuer.Status.Conditions, issuerCondition)
+	updater.logger.Info("setting lastTransitionTime for CMPv2Issuer condition", "condition", cmpv2api.ConditionReady, "time", now.Time)
+}