[OOM-K8S-CERT-EXTERNAL-PROVIDER] Provide certs to CMPv2 Issuer

Format code

Issue-ID: OOM-2559
Signed-off-by: Remigiusz Janeczek <remigiusz.janeczek@nokia.com>
Change-Id: I88346b96657606b010aa8d7da0f8b86d1844f9d7

6 files changed, 82 insertions, 63 deletions

diff --git a/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller.go b/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller.go
index 38b5cdf3..54b4b103 100644
--- a/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller.go
+++ b/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller.go
@@ -28,8 +28,6 @@ package cmpv2controller
 import (
 	"context"
 	"fmt"
-	"onap.org/oom-certservice/k8s-external-provider/src/cmpv2api"
-	provisioners "onap.org/oom-certservice/k8s-external-provider/src/cmpv2provisioner"
 
 	"github.com/go-logr/logr"
 	apiutil "github.com/jetstack/cert-manager/pkg/api/util"
@@ -41,6 +39,9 @@ import (
 	"k8s.io/client-go/tools/record"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	"onap.org/oom-certservice/k8s-external-provider/src/cmpv2api"
+	provisioners "onap.org/oom-certservice/k8s-external-provider/src/cmpv2provisioner"
 )
 
 // CertificateRequestController reconciles a CMPv2Issuer object.
@@ -144,7 +145,6 @@ func (controller *CertificateRequestController) setStatus(ctx context.Context, c
 	return controller.Client.Status().Update(ctx, certificateRequest)
 }
 
-
 func isCMPv2IssuerReady(issuer cmpv2api.CMPv2Issuer) bool {
 	condition := cmpv2api.CMPv2IssuerCondition{Type: cmpv2api.ConditionReady, Status: cmpv2api.ConditionTrue}
 	return hasCondition(issuer, condition)
@@ -183,12 +183,12 @@ func (controller *CertificateRequestController) handleErrorCMPv2IssuerIsNotReady
 	return err
 }
 
-func (controller *CertificateRequestController) handleErrorGettingCMPv2Issuer(ctx context.Context, log logr.Logger, err error,  certificateRequest *cmapi.CertificateRequest, issuerNamespaceName types.NamespacedName, req ctrl.Request) {
+func (controller *CertificateRequestController) handleErrorGettingCMPv2Issuer(ctx context.Context, log logr.Logger, err error, certificateRequest *cmapi.CertificateRequest, issuerNamespaceName types.NamespacedName, req ctrl.Request) {
 	log.Error(err, "Failed to retrieve CMPv2Issuer resource", "namespace", req.Namespace, "name", certificateRequest.Spec.IssuerRef.Name)
 	_ = controller.setStatus(ctx, certificateRequest, cmmeta.ConditionFalse, cmapi.CertificateRequestReasonPending, "Failed to retrieve CMPv2Issuer resource %s: %v", issuerNamespaceName, err)
 }
 
-func (controller *CertificateRequestController) handleErrorFailedToSignCertificate(ctx context.Context, log logr.Logger, err error, certificateRequest *cmapi.CertificateRequest)  {
+func (controller *CertificateRequestController) handleErrorFailedToSignCertificate(ctx context.Context, log logr.Logger, err error, certificateRequest *cmapi.CertificateRequest) {
 	log.Error(err, "Failed to sign certificate request")
 	_ = controller.setStatus(ctx, certificateRequest, cmmeta.ConditionFalse, cmapi.CertificateRequestReasonFailed, "Failed to sign certificate request: %v", err)
 }
diff --git a/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller_test.go b/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller_test.go
index 7e55f36f..2c401cce 100644
--- a/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller_test.go
+++ b/certServiceK8sExternalProvider/src/cmpv2controller/certificate_request_controller_test.go
@@ -21,10 +21,10 @@
 package cmpv2controller
 
 import (
-	cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1"
 	"testing"
-	"github.com/stretchr/testify/assert"
 
+	cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1"
+	"github.com/stretchr/testify/assert"
 )
 
 const group = "certmanager.onap.org"
@@ -43,7 +43,6 @@ func Test_shouldBeInvalidCMPv2CertificateRequest_whenKindIsCertificateRequest(t
 	assert.False(t, isCMPv2CertificateRequest(request))
 }
 
-
 func Test_shouldBeValidCMPv2CertificateRequest_whenKindIsCMPvIssuer(t *testing.T) {
 	request := new(cmapi.CertificateRequest)
 	request.Spec.IssuerRef.Group = group
@@ -51,4 +50,3 @@ func Test_shouldBeValidCMPv2CertificateRequest_whenKindIsCMPvIssuer(t *testing.T
 
 	assert.True(t, isCMPv2CertificateRequest(request))
 }
-
diff --git a/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_controller.go b/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_controller.go
index f57f5677..1b4e5312 100644
--- a/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_controller.go
+++ b/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_controller.go
@@ -28,6 +28,7 @@ package cmpv2controller
 import (
 	"context"
 	"fmt"
+
 	"github.com/go-logr/logr"
 	core "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
@@ -35,10 +36,11 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/tools/record"
 	"k8s.io/utils/clock"
-	"onap.org/oom-certservice/k8s-external-provider/src/cmpv2api"
-	provisioners "onap.org/oom-certservice/k8s-external-provider/src/cmpv2provisioner"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	"onap.org/oom-certservice/k8s-external-provider/src/cmpv2api"
+	provisioners "onap.org/oom-certservice/k8s-external-provider/src/cmpv2provisioner"
 )
 
 // CMPv2IssuerController reconciles a CMPv2Issuer object
@@ -74,21 +76,18 @@ func (controller *CMPv2IssuerController) Reconcile(req ctrl.Request) (ctrl.Resul
 	var secret core.Secret
 	secretNamespaceName := types.NamespacedName{
 		Namespace: req.Namespace,
-		Name:      issuer.Spec.KeyRef.Name,
+		Name:      issuer.Spec.CertSecretRef.Name,
 	}
 	if err := controller.loadResource(ctx, secretNamespaceName, &secret); err != nil {
 		handleErrorInvalidSecret(ctx, log, err, statusUpdater, secretNamespaceName)
 		return ctrl.Result{}, err
 	}
-	password, ok := secret.Data[issuer.Spec.KeyRef.Key]
-	if !ok {
-		err := handleErrorSecretNotFound(ctx, log, issuer, statusUpdater, secretNamespaceName, secret)
-		return ctrl.Result{}, err
-	}
 
 	// 4. Create CMPv2 provisioner and store the instance for further use
-	provisioner, err := provisioners.New(issuer, password)
+	provisioner, err := provisioners.CreateProvisioner(issuer, secret)
 	if err != nil {
+		log.Error(err, "failed to initialize provisioner")
+		statusUpdater.UpdateNoError(ctx, cmpv2api.ConditionFalse, "Error", "Failed to initialize provisioner: %v", err)
 		handleErrorProvisionerInitialization(ctx, log, err, statusUpdater)
 		return ctrl.Result{}, err
 	}
@@ -103,7 +102,6 @@ func (controller *CMPv2IssuerController) Reconcile(req ctrl.Request) (ctrl.Resul
 	return ctrl.Result{}, nil
 }
 
-
 func (controller *CMPv2IssuerController) SetupWithManager(manager ctrl.Manager) error {
 	return ctrl.NewControllerManagedBy(manager).
 		For(&cmpv2api.CMPv2Issuer{}).
@@ -114,18 +112,22 @@ func (controller *CMPv2IssuerController) loadResource(ctx context.Context, key c
 	return controller.Client.Get(ctx, key, obj)
 }
 
-
 func validateCMPv2IssuerSpec(issuerSpec cmpv2api.CMPv2IssuerSpec, log logr.Logger) error {
 	switch {
-		case issuerSpec.URL == "":
-			return fmt.Errorf("spec.url cannot be empty")
-		case issuerSpec.KeyRef.Name == "":
-			return fmt.Errorf("spec.keyRef.name cannot be empty")
-		case issuerSpec.KeyRef.Key == "":
-			return fmt.Errorf("spec.keyRef.key cannot be empty")
-		default:
-			log.Info("CMPv2Issuer validated. ")
-			return nil
+	case issuerSpec.URL == "":
+		return fmt.Errorf("spec.url cannot be empty")
+	case issuerSpec.CaName == "":
+		return fmt.Errorf("spec.caName cannot be empty")
+	case issuerSpec.CertSecretRef.Name == "":
+		return fmt.Errorf("spec.certSecretRef.name cannot be empty")
+	case issuerSpec.CertSecretRef.KeyRef == "":
+		return fmt.Errorf("spec.certSecretRef.keyRef cannot be empty")
+	case issuerSpec.CertSecretRef.CertRef == "":
+		return fmt.Errorf("spec.certSecretRef.certRef cannot be empty")
+	case issuerSpec.CertSecretRef.CacertRef == "":
+		return fmt.Errorf("spec.certSecretRef.cacertRef cannot be empty")
+	default:
+		return nil
 	}
 }
 
@@ -134,22 +136,19 @@ func updateCMPv2IssuerStatusToVerified(statusUpdater *CMPv2IssuerStatusUpdater,
 	return statusUpdater.Update(ctx, cmpv2api.ConditionTrue, Verified, "CMPv2Issuer verified and ready to sign certificates")
 }
 
-
 // Error handling
 
 func handleErrorUpdatingCMPv2IssuerStatus(log logr.Logger, err error) {
 	log.Error(err, "Failed to update CMPv2Issuer status")
 }
 
-
 func handleErrorLoadingCMPv2Issuer(log logr.Logger, err error) {
 	log.Error(err, "Failed to retrieve CMPv2Issuer resource")
 }
 
-
 func handleErrorProvisionerInitialization(ctx context.Context, log logr.Logger, err error, statusUpdater *CMPv2IssuerStatusUpdater) {
 	log.Error(err, "Failed to initialize provisioner")
-	statusUpdater.UpdateNoError(ctx, cmpv2api.ConditionFalse, Error, "Failed initialize provisioner")
+	statusUpdater.UpdateNoError(ctx, cmpv2api.ConditionFalse, Error, "Failed to initialize provisioner: %v", err)
 }
 
 func handleErrorCMPv2IssuerValidation(ctx context.Context, log logr.Logger, err error, statusUpdater *CMPv2IssuerStatusUpdater) {
@@ -157,13 +156,6 @@ func handleErrorCMPv2IssuerValidation(ctx context.Context, log logr.Logger, err
 	statusUpdater.UpdateNoError(ctx, cmpv2api.ConditionFalse, ValidationFailed, "Failed to validate resource: %v", err)
 }
 
-func handleErrorSecretNotFound(ctx context.Context, log logr.Logger, issuer *cmpv2api.CMPv2Issuer, statusUpdater *CMPv2IssuerStatusUpdater, secretNamespaceName types.NamespacedName, secret core.Secret) error {
-	err := fmt.Errorf("secret %s does not contain key %s", secret.Name, issuer.Spec.KeyRef.Key)
-	log.Error(err, "Failed to retrieve CMPv2Issuer provisioner secret", "namespace", secretNamespaceName.Namespace, "name", secretNamespaceName.Name)
-	statusUpdater.UpdateNoError(ctx, cmpv2api.ConditionFalse, NotFound, "Failed to retrieve provisioner secret: %v", err)
-	return err
-}
-
 func handleErrorInvalidSecret(ctx context.Context, log logr.Logger, err error, statusUpdater *CMPv2IssuerStatusUpdater, secretNamespaceName types.NamespacedName) {
 	log.Error(err, "Failed to retrieve CMPv2Issuer provisioner secret", "namespace", secretNamespaceName.Namespace, "name", secretNamespaceName.Name)
 	if apierrors.IsNotFound(err) {
diff --git a/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_controller_test.go b/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_controller_test.go
index 8409ea78..79c78ed5 100644
--- a/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_controller_test.go
+++ b/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_controller_test.go
@@ -21,13 +21,22 @@
 package cmpv2controller
 
 import (
+	"testing"
+
 	"github.com/go-logr/logr"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
+
 	"onap.org/oom-certservice/k8s-external-provider/src/cmpv2api"
-	"testing"
 )
 
+func Test_shouldBeValidCMPv2IssuerSpec_whenAllFieldsAreSet(t *testing.T) {
+	spec := getValidCMPv2IssuerSpec()
+
+	err := validateCMPv2IssuerSpec(spec, &MockLogger{})
+	assert.Nil(t, err)
+}
+
 func Test_shouldBeInvalidCMPv2IssuerSpec_whenSpecIsEmpty(t *testing.T) {
 	spec := cmpv2api.CMPv2IssuerSpec{}
 	err := validateCMPv2IssuerSpec(spec, nil)
@@ -35,32 +44,50 @@ func Test_shouldBeInvalidCMPv2IssuerSpec_whenSpecIsEmpty(t *testing.T) {
 }
 
 func Test_shouldBeInvalidCMPv2IssuerSpec_whenNotAllFieldsAreSet(t *testing.T) {
-	spec := cmpv2api.CMPv2IssuerSpec{}
-	spec.URL = "https://localhost"
-	spec.KeyRef = cmpv2api.SecretKeySelector{}
-	spec.KeyRef.Name = "secret-key"
+	setEmptyFieldFunctions := map[string]func(spec *cmpv2api.CMPv2IssuerSpec){
+		"emptyUrl":            func(spec *cmpv2api.CMPv2IssuerSpec) { spec.URL = "" },
+		"empryCaName":         func(spec *cmpv2api.CMPv2IssuerSpec) { spec.CaName = "" },
+		"emptySecretName":     func(spec *cmpv2api.CMPv2IssuerSpec) { spec.CertSecretRef.Name = "" },
+		"emptySecretKeyRef":   func(spec *cmpv2api.CMPv2IssuerSpec) { spec.CertSecretRef.KeyRef = "" },
+		"emptySecretCertRef":  func(spec *cmpv2api.CMPv2IssuerSpec) { spec.CertSecretRef.CertRef = "" },
+		"emptySecretCaertRef": func(spec *cmpv2api.CMPv2IssuerSpec) { spec.CertSecretRef.CacertRef = "" },
+	}
 
-	err := validateCMPv2IssuerSpec(spec, &MockLogger{})
-	assert.NotNil(t, err)
+	for caseName, setEmptyFieldFunction := range setEmptyFieldFunctions {
+		t.Run(caseName, func(t *testing.T) {
+			test_shouldBeInvalidCMPv2IssuerSpec_whenFunctionApplied(t, setEmptyFieldFunction)
+		})
+	}
 }
 
-func Test_shouldBeValidCMPv2IssuerSpec_whenAllFieldsAreSet(t *testing.T) {
-	spec := cmpv2api.CMPv2IssuerSpec{}
-	spec.URL = "https://localhost"
-	spec.KeyRef = cmpv2api.SecretKeySelector{}
-	spec.KeyRef.Name = "secret-key"
-	spec.KeyRef.Key = "the-key"
+func test_shouldBeInvalidCMPv2IssuerSpec_whenFunctionApplied(t *testing.T, transformSpec func(spec *cmpv2api.CMPv2IssuerSpec)) {
+	spec := getValidCMPv2IssuerSpec()
+	transformSpec(&spec)
+	err := validateCMPv2IssuerSpec(spec, nil)
+	assert.NotNil(t, err)
+}
 
-	err := validateCMPv2IssuerSpec(spec, &MockLogger{})
-	assert.Nil(t, err)
+func getValidCMPv2IssuerSpec() cmpv2api.CMPv2IssuerSpec {
+	issuerSpec := cmpv2api.CMPv2IssuerSpec{
+		URL:    "https://oom-cert-service:8443/v1/certificate/",
+		CaName: "RA",
+		CertSecretRef: cmpv2api.SecretKeySelector{
+			Name:      "issuer-cert-secret",
+			KeyRef:    "cmpv2Issuer-key.pem",
+			CertRef:   "cmpv2Issuer-cert.pem",
+			CacertRef: "cacert.pem",
+		},
+	}
+	return issuerSpec
 }
 
 type MockLogger struct {
 	mock.Mock
 }
-func (m *MockLogger) Info(msg string, keysAndValues ...interface{}) {}
+
+func (m *MockLogger) Info(msg string, keysAndValues ...interface{})             {}
 func (m *MockLogger) Error(err error, msg string, keysAndValues ...interface{}) {}
-func (m *MockLogger) Enabled() bool { return false }
-func (m *MockLogger) V(level int) logr.Logger { return m }
-func (m *MockLogger) WithValues(keysAndValues ...interface{}) logr.Logger { return m }
-func (m *MockLogger) WithName(name string) logr.Logger { return m }
+func (m *MockLogger) Enabled() bool                                             { return false }
+func (m *MockLogger) V(level int) logr.Logger                                   { return m }
+func (m *MockLogger) WithValues(keysAndValues ...interface{}) logr.Logger       { return m }
+func (m *MockLogger) WithName(name string) logr.Logger                          { return m }
diff --git a/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_status_updater.go b/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_status_updater.go
index 017e36a4..f07101db 100644
--- a/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_status_updater.go
+++ b/certServiceK8sExternalProvider/src/cmpv2controller/cmpv2_issuer_status_updater.go
@@ -28,9 +28,11 @@ package cmpv2controller
 import (
 	"context"
 	"fmt"
+
 	"github.com/go-logr/logr"
 	core "k8s.io/api/core/v1"
 	meta "k8s.io/apimachinery/pkg/apis/meta/v1"
+
 	"onap.org/oom-certservice/k8s-external-provider/src/cmpv2api"
 )
 
diff --git a/certServiceK8sExternalProvider/src/cmpv2controller/status_reason.go b/certServiceK8sExternalProvider/src/cmpv2controller/status_reason.go
index d41712d3..fc1772e9 100644
--- a/certServiceK8sExternalProvider/src/cmpv2controller/status_reason.go
+++ b/certServiceK8sExternalProvider/src/cmpv2controller/status_reason.go
@@ -21,8 +21,8 @@
 package cmpv2controller
 
 const (
-	NotFound = "NotFound"
+	NotFound         = "NotFound"
 	ValidationFailed = "ValidationFailed"
-	Error = "Error"
-	Verified = "Verified"
+	Error            = "Error"
+	Verified         = "Verified"
 )