mirror of https://github.com/tailscale/tailscale/
cmd/k8s-operator: add reconciler for Tailnet resource (#18132)
This commit adds the new reconciler for the Tailnet resource in a new location that we want to put all future reconcilers in and eventually refactor existing reconcilers into. The Tailnet resource represents OAuth credentials for a single tailnet and uses status fields to indicate the validity of the credentials. Validity is determined via expected fields existing (client_id and client_secret) and API calls for devices, keys & services being possible using them. Subsequent resources will be updated to refer to a Tailnet as the source of their oauth credentials, or fall back to the configured default. Fixes: https://github.com/tailscale/corp/issues/34767 Signed-off-by: David Bond <davidsbond93@gmail.com>pull/18174/head
David Bond
3 days ago
committed by
GitHub
parent
e988036e19
commit
d06f48f3a6
@ -0,0 +1,37 @@
|
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
// Package reconciler provides utilities for working with Kubernetes resources within controller reconciliation
|
||||||
|
// loops.
|
||||||
|
package reconciler
|
||||||
|
|
||||||
|
import (
|
||||||
|
"slices"
|
||||||
|
|
||||||
|
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
// FinalizerName is the common finalizer used across all Tailscale Kubernetes resources.
|
||||||
|
FinalizerName = "tailscale.com/finalizer"
|
||||||
|
)
|
||||||
|
|
||||||
|
// SetFinalizer adds the finalizer to the resource if not already present.
|
||||||
|
func SetFinalizer(obj client.Object) {
|
||||||
|
if idx := slices.Index(obj.GetFinalizers(), FinalizerName); idx >= 0 {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
obj.SetFinalizers(append(obj.GetFinalizers(), FinalizerName))
|
||||||
|
}
|
||||||
|
|
||||||
|
// RemoveFinalizer removes the finalizer from the resource if present.
|
||||||
|
func RemoveFinalizer(obj client.Object) {
|
||||||
|
idx := slices.Index(obj.GetFinalizers(), FinalizerName)
|
||||||
|
if idx < 0 {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
finalizers := obj.GetFinalizers()
|
||||||
|
obj.SetFinalizers(append(finalizers[:idx], finalizers[idx+1:]...))
|
||||||
|
}
|
||||||
@ -0,0 +1,40 @@
|
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
package reconciler_test
|
||||||
|
|
||||||
|
import (
|
||||||
|
"slices"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
corev1 "k8s.io/api/core/v1"
|
||||||
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||||
|
|
||||||
|
"tailscale.com/k8s-operator/reconciler"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestFinalizers(t *testing.T) {
|
||||||
|
t.Parallel()
|
||||||
|
|
||||||
|
object := &corev1.Secret{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: "test",
|
||||||
|
Namespace: "test",
|
||||||
|
},
|
||||||
|
StringData: map[string]string{
|
||||||
|
"hello": "world",
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
reconciler.SetFinalizer(object)
|
||||||
|
|
||||||
|
if !slices.Contains(object.Finalizers, reconciler.FinalizerName) {
|
||||||
|
t.Fatalf("object does not have finalizer %q: %v", reconciler.FinalizerName, object.Finalizers)
|
||||||
|
}
|
||||||
|
|
||||||
|
reconciler.RemoveFinalizer(object)
|
||||||
|
|
||||||
|
if slices.Contains(object.Finalizers, reconciler.FinalizerName) {
|
||||||
|
t.Fatalf("object still has finalizer %q: %v", reconciler.FinalizerName, object.Finalizers)
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -0,0 +1,43 @@
|
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
package tailnet_test
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"io"
|
||||||
|
|
||||||
|
"tailscale.com/internal/client/tailscale"
|
||||||
|
)
|
||||||
|
|
||||||
|
type (
|
||||||
|
MockTailnetClient struct {
|
||||||
|
ErrorOnDevices bool
|
||||||
|
ErrorOnKeys bool
|
||||||
|
ErrorOnServices bool
|
||||||
|
}
|
||||||
|
)
|
||||||
|
|
||||||
|
func (m MockTailnetClient) Devices(_ context.Context, _ *tailscale.DeviceFieldsOpts) ([]*tailscale.Device, error) {
|
||||||
|
if m.ErrorOnDevices {
|
||||||
|
return nil, io.EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m MockTailnetClient) Keys(_ context.Context) ([]string, error) {
|
||||||
|
if m.ErrorOnKeys {
|
||||||
|
return nil, io.EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m MockTailnetClient) ListVIPServices(_ context.Context) (*tailscale.VIPServiceList, error) {
|
||||||
|
if m.ErrorOnServices {
|
||||||
|
return nil, io.EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil, nil
|
||||||
|
}
|
||||||
@ -0,0 +1,302 @@
|
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
// Package tailnet provides reconciliation logic for the Tailnet custom resource definition. It is responsible for
|
||||||
|
// ensuring the referenced OAuth credentials are valid and have the required scopes to be able to generate authentication
|
||||||
|
// keys, manage devices & manage VIP services.
|
||||||
|
package tailnet
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"go.uber.org/zap"
|
||||||
|
"golang.org/x/oauth2"
|
||||||
|
"golang.org/x/oauth2/clientcredentials"
|
||||||
|
corev1 "k8s.io/api/core/v1"
|
||||||
|
apierrors "k8s.io/apimachinery/pkg/api/errors"
|
||||||
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||||
|
"k8s.io/apimachinery/pkg/types"
|
||||||
|
"sigs.k8s.io/controller-runtime/pkg/builder"
|
||||||
|
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||||
|
"sigs.k8s.io/controller-runtime/pkg/manager"
|
||||||
|
"sigs.k8s.io/controller-runtime/pkg/reconcile"
|
||||||
|
|
||||||
|
"tailscale.com/internal/client/tailscale"
|
||||||
|
"tailscale.com/ipn"
|
||||||
|
operatorutils "tailscale.com/k8s-operator"
|
||||||
|
tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
|
||||||
|
"tailscale.com/k8s-operator/reconciler"
|
||||||
|
"tailscale.com/tstime"
|
||||||
|
)
|
||||||
|
|
||||||
|
type (
|
||||||
|
// The Reconciler type is a reconcile.TypedReconciler implementation used to manage the reconciliation of
|
||||||
|
// Tailnet custom resources.
|
||||||
|
Reconciler struct {
|
||||||
|
client.Client
|
||||||
|
|
||||||
|
tailscaleNamespace string
|
||||||
|
clock tstime.Clock
|
||||||
|
logger *zap.SugaredLogger
|
||||||
|
clientFunc func(*tsapi.Tailnet, *corev1.Secret) TailscaleClient
|
||||||
|
}
|
||||||
|
|
||||||
|
// The ReconcilerOptions type contains configuration values for the Reconciler.
|
||||||
|
ReconcilerOptions struct {
|
||||||
|
// The client for interacting with the Kubernetes API.
|
||||||
|
Client client.Client
|
||||||
|
// The namespace the operator is installed in. This reconciler expects Tailnet OAuth credentials to be stored
|
||||||
|
// in Secret resources within this namespace.
|
||||||
|
TailscaleNamespace string
|
||||||
|
// Controls which clock to use for performing time-based functions. This is typically modified for use
|
||||||
|
// in tests.
|
||||||
|
Clock tstime.Clock
|
||||||
|
// The logger to use for this Reconciler.
|
||||||
|
Logger *zap.SugaredLogger
|
||||||
|
// ClientFunc is a function that takes tailscale credentials and returns an implementation for the Tailscale
|
||||||
|
// HTTP API. This should generally be nil unless needed for testing.
|
||||||
|
ClientFunc func(*tsapi.Tailnet, *corev1.Secret) TailscaleClient
|
||||||
|
}
|
||||||
|
|
||||||
|
// The TailscaleClient interface describes types that interact with the Tailscale HTTP API.
|
||||||
|
TailscaleClient interface {
|
||||||
|
Devices(context.Context, *tailscale.DeviceFieldsOpts) ([]*tailscale.Device, error)
|
||||||
|
Keys(ctx context.Context) ([]string, error)
|
||||||
|
ListVIPServices(ctx context.Context) (*tailscale.VIPServiceList, error)
|
||||||
|
}
|
||||||
|
)
|
||||||
|
|
||||||
|
const reconcilerName = "tailnet-reconciler"
|
||||||
|
|
||||||
|
// NewReconciler returns a new instance of the Reconciler type. It watches specifically for changes to Tailnet custom
|
||||||
|
// resources. The ReconcilerOptions can be used to modify the behaviour of the Reconciler.
|
||||||
|
func NewReconciler(options ReconcilerOptions) *Reconciler {
|
||||||
|
return &Reconciler{
|
||||||
|
Client: options.Client,
|
||||||
|
tailscaleNamespace: options.TailscaleNamespace,
|
||||||
|
clock: options.Clock,
|
||||||
|
logger: options.Logger.Named(reconcilerName),
|
||||||
|
clientFunc: options.ClientFunc,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Register the Reconciler onto the given manager.Manager implementation.
|
||||||
|
func (r *Reconciler) Register(mgr manager.Manager) error {
|
||||||
|
return builder.
|
||||||
|
ControllerManagedBy(mgr).
|
||||||
|
For(&tsapi.Tailnet{}).
|
||||||
|
Named(reconcilerName).
|
||||||
|
Complete(r)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Reconcile is invoked when a change occurs to Tailnet resources within the cluster. On create/update, the Tailnet
|
||||||
|
// resource is validated ensuring that the specified Secret exists and contains valid OAuth credentials that have
|
||||||
|
// required permissions to perform all necessary functions by the operator.
|
||||||
|
func (r *Reconciler) Reconcile(ctx context.Context, req reconcile.Request) (reconcile.Result, error) {
|
||||||
|
var tailnet tsapi.Tailnet
|
||||||
|
err := r.Get(ctx, req.NamespacedName, &tailnet)
|
||||||
|
switch {
|
||||||
|
case apierrors.IsNotFound(err):
|
||||||
|
return reconcile.Result{}, nil
|
||||||
|
case err != nil:
|
||||||
|
return reconcile.Result{}, fmt.Errorf("failed to get Tailnet %q: %w", req.NamespacedName, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if !tailnet.DeletionTimestamp.IsZero() {
|
||||||
|
return r.delete(ctx, &tailnet)
|
||||||
|
}
|
||||||
|
|
||||||
|
return r.createOrUpdate(ctx, &tailnet)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *Reconciler) delete(ctx context.Context, tailnet *tsapi.Tailnet) (reconcile.Result, error) {
|
||||||
|
reconciler.RemoveFinalizer(tailnet)
|
||||||
|
if err := r.Update(ctx, tailnet); err != nil {
|
||||||
|
return reconcile.Result{}, fmt.Errorf("failed to remove finalizer from Tailnet %q: %w", tailnet.Name, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return reconcile.Result{}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Constants for condition reasons.
|
||||||
|
const (
|
||||||
|
ReasonInvalidOAuth = "InvalidOAuth"
|
||||||
|
ReasonInvalidSecret = "InvalidSecret"
|
||||||
|
ReasonValid = "TailnetValid"
|
||||||
|
)
|
||||||
|
|
||||||
|
func (r *Reconciler) createOrUpdate(ctx context.Context, tailnet *tsapi.Tailnet) (reconcile.Result, error) {
|
||||||
|
name := types.NamespacedName{Name: tailnet.Spec.Credentials.SecretName, Namespace: r.tailscaleNamespace}
|
||||||
|
|
||||||
|
var secret corev1.Secret
|
||||||
|
err := r.Get(ctx, name, &secret)
|
||||||
|
|
||||||
|
// The referenced Secret does not exist within the tailscale namespace, so we'll mark the Tailnet as not ready
|
||||||
|
// for use.
|
||||||
|
if apierrors.IsNotFound(err) {
|
||||||
|
operatorutils.SetTailnetCondition(
|
||||||
|
tailnet,
|
||||||
|
tsapi.TailnetReady,
|
||||||
|
metav1.ConditionFalse,
|
||||||
|
ReasonInvalidSecret,
|
||||||
|
fmt.Sprintf("referenced secret %q does not exist in namespace %q", name.Name, r.tailscaleNamespace),
|
||||||
|
r.clock,
|
||||||
|
r.logger,
|
||||||
|
)
|
||||||
|
|
||||||
|
if err = r.Status().Update(ctx, tailnet); err != nil {
|
||||||
|
return reconcile.Result{}, fmt.Errorf("failed to update Tailnet status for %q: %w", tailnet.Name, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return reconcile.Result{}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
if err != nil {
|
||||||
|
return reconcile.Result{}, fmt.Errorf("failed to get secret %q: %w", name, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// We first ensure that the referenced secret contains the required fields. Otherwise, we set the Tailnet as
|
||||||
|
// invalid. The operator will not allow the use of this Tailnet while it is in an invalid state.
|
||||||
|
if ok := r.ensureSecret(tailnet, &secret); !ok {
|
||||||
|
if err = r.Status().Update(ctx, tailnet); err != nil {
|
||||||
|
return reconcile.Result{}, fmt.Errorf("failed to update Tailnet status for %q: %w", tailnet.Name, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return reconcile.Result{RequeueAfter: time.Minute / 2}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
tsClient := r.createClient(ctx, tailnet, &secret)
|
||||||
|
|
||||||
|
// Second, we ensure the OAuth credentials supplied in the secret are valid and have the required scopes to access
|
||||||
|
// the various API endpoints required by the operator.
|
||||||
|
if ok := r.ensurePermissions(ctx, tsClient, tailnet); !ok {
|
||||||
|
if err = r.Status().Update(ctx, tailnet); err != nil {
|
||||||
|
return reconcile.Result{}, fmt.Errorf("failed to update Tailnet status for %q: %w", tailnet.Name, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// We provide a requeue duration here as a user will likely want to go and modify their scopes and come back.
|
||||||
|
// This should save them having to delete and recreate the resource.
|
||||||
|
return reconcile.Result{RequeueAfter: time.Minute / 2}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
operatorutils.SetTailnetCondition(
|
||||||
|
tailnet,
|
||||||
|
tsapi.TailnetReady,
|
||||||
|
metav1.ConditionTrue,
|
||||||
|
ReasonValid,
|
||||||
|
ReasonValid,
|
||||||
|
r.clock,
|
||||||
|
r.logger,
|
||||||
|
)
|
||||||
|
|
||||||
|
if err = r.Status().Update(ctx, tailnet); err != nil {
|
||||||
|
return reconcile.Result{}, fmt.Errorf("failed to update Tailnet status for %q: %w", tailnet.Name, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
reconciler.SetFinalizer(tailnet)
|
||||||
|
if err = r.Update(ctx, tailnet); err != nil {
|
||||||
|
return reconcile.Result{}, fmt.Errorf("failed to add finalizer to Tailnet %q: %w", tailnet.Name, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return reconcile.Result{}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Constants for OAuth credential fields within the Secret referenced by the Tailnet.
|
||||||
|
const (
|
||||||
|
clientIDKey = "client_id"
|
||||||
|
clientSecretKey = "client_secret"
|
||||||
|
)
|
||||||
|
|
||||||
|
func (r *Reconciler) createClient(ctx context.Context, tailnet *tsapi.Tailnet, secret *corev1.Secret) TailscaleClient {
|
||||||
|
if r.clientFunc != nil {
|
||||||
|
return r.clientFunc(tailnet, secret)
|
||||||
|
}
|
||||||
|
|
||||||
|
baseURL := ipn.DefaultControlURL
|
||||||
|
if tailnet.Spec.LoginURL != "" {
|
||||||
|
baseURL = tailnet.Spec.LoginURL
|
||||||
|
}
|
||||||
|
|
||||||
|
credentials := clientcredentials.Config{
|
||||||
|
ClientID: string(secret.Data[clientIDKey]),
|
||||||
|
ClientSecret: string(secret.Data[clientSecretKey]),
|
||||||
|
TokenURL: baseURL + "/api/v2/oauth/token",
|
||||||
|
}
|
||||||
|
|
||||||
|
source := credentials.TokenSource(ctx)
|
||||||
|
httpClient := oauth2.NewClient(ctx, source)
|
||||||
|
|
||||||
|
tsClient := tailscale.NewClient("-", nil)
|
||||||
|
tsClient.UserAgent = "tailscale-k8s-operator"
|
||||||
|
tsClient.HTTPClient = httpClient
|
||||||
|
tsClient.BaseURL = baseURL
|
||||||
|
|
||||||
|
return tsClient
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *Reconciler) ensurePermissions(ctx context.Context, tsClient TailscaleClient, tailnet *tsapi.Tailnet) bool {
|
||||||
|
// Perform basic list requests here to confirm that the OAuth credentials referenced on the Tailnet resource
|
||||||
|
// can perform the basic operations required for the operator to function. This has a caveat of only performing
|
||||||
|
// read actions, as we don't want to create arbitrary keys and VIP services. However, it will catch when a user
|
||||||
|
// has completely forgotten an entire scope that's required.
|
||||||
|
var errs error
|
||||||
|
if _, err := tsClient.Devices(ctx, nil); err != nil {
|
||||||
|
errs = errors.Join(errs, fmt.Errorf("failed to list devices: %w", err))
|
||||||
|
}
|
||||||
|
|
||||||
|
if _, err := tsClient.Keys(ctx); err != nil {
|
||||||
|
errs = errors.Join(errs, fmt.Errorf("failed to list auth keys: %w", err))
|
||||||
|
}
|
||||||
|
|
||||||
|
if _, err := tsClient.ListVIPServices(ctx); err != nil {
|
||||||
|
errs = errors.Join(errs, fmt.Errorf("failed to list VIP services: %w", err))
|
||||||
|
}
|
||||||
|
|
||||||
|
if errs != nil {
|
||||||
|
operatorutils.SetTailnetCondition(
|
||||||
|
tailnet,
|
||||||
|
tsapi.TailnetReady,
|
||||||
|
metav1.ConditionFalse,
|
||||||
|
ReasonInvalidOAuth,
|
||||||
|
errs.Error(),
|
||||||
|
r.clock,
|
||||||
|
r.logger,
|
||||||
|
)
|
||||||
|
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *Reconciler) ensureSecret(tailnet *tsapi.Tailnet, secret *corev1.Secret) bool {
|
||||||
|
var message string
|
||||||
|
|
||||||
|
switch {
|
||||||
|
case len(secret.Data) == 0:
|
||||||
|
message = fmt.Sprintf("Secret %q is empty", secret.Name)
|
||||||
|
case len(secret.Data[clientIDKey]) == 0:
|
||||||
|
message = fmt.Sprintf("Secret %q is missing the client_id field", secret.Name)
|
||||||
|
case len(secret.Data[clientSecretKey]) == 0:
|
||||||
|
message = fmt.Sprintf("Secret %q is missing the client_secret field", secret.Name)
|
||||||
|
}
|
||||||
|
|
||||||
|
if message == "" {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
|
||||||
|
operatorutils.SetTailnetCondition(
|
||||||
|
tailnet,
|
||||||
|
tsapi.TailnetReady,
|
||||||
|
metav1.ConditionFalse,
|
||||||
|
ReasonInvalidSecret,
|
||||||
|
message,
|
||||||
|
r.clock,
|
||||||
|
r.logger,
|
||||||
|
)
|
||||||
|
|
||||||
|
return false
|
||||||
|
}
|
||||||
@ -0,0 +1,409 @@
|
|||||||
|
// Copyright (c) Tailscale Inc & AUTHORS
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
package tailnet_test
|
||||||
|
|
||||||
|
import (
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"go.uber.org/zap"
|
||||||
|
corev1 "k8s.io/api/core/v1"
|
||||||
|
apierrors "k8s.io/apimachinery/pkg/api/errors"
|
||||||
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||||
|
"k8s.io/apimachinery/pkg/types"
|
||||||
|
"sigs.k8s.io/controller-runtime/pkg/client/fake"
|
||||||
|
"sigs.k8s.io/controller-runtime/pkg/reconcile"
|
||||||
|
|
||||||
|
tsapi "tailscale.com/k8s-operator/apis/v1alpha1"
|
||||||
|
"tailscale.com/k8s-operator/reconciler/tailnet"
|
||||||
|
"tailscale.com/tstest"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestReconciler_Reconcile(t *testing.T) {
|
||||||
|
t.Parallel()
|
||||||
|
clock := tstest.NewClock(tstest.ClockOpts{})
|
||||||
|
logger, err := zap.NewDevelopment()
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
tt := []struct {
|
||||||
|
Name string
|
||||||
|
Request reconcile.Request
|
||||||
|
Tailnet *tsapi.Tailnet
|
||||||
|
Secret *corev1.Secret
|
||||||
|
ExpectsError bool
|
||||||
|
ExpectedConditions []metav1.Condition
|
||||||
|
ClientFunc func(*tsapi.Tailnet, *corev1.Secret) tailnet.TailscaleClient
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
Name: "ignores unknown tailnet requests",
|
||||||
|
Request: reconcile.Request{
|
||||||
|
NamespacedName: types.NamespacedName{
|
||||||
|
Name: "test",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Name: "invalid status for missing secret",
|
||||||
|
Request: reconcile.Request{
|
||||||
|
NamespacedName: types.NamespacedName{
|
||||||
|
Name: "test",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Tailnet: &tsapi.Tailnet{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: "test",
|
||||||
|
},
|
||||||
|
Spec: tsapi.TailnetSpec{
|
||||||
|
Credentials: tsapi.TailnetCredentials{
|
||||||
|
SecretName: "test",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
ExpectedConditions: []metav1.Condition{
|
||||||
|
{
|
||||||
|
Type: string(tsapi.TailnetReady),
|
||||||
|
Status: metav1.ConditionFalse,
|
||||||
|
Reason: tailnet.ReasonInvalidSecret,
|
||||||
|
Message: `referenced secret "test" does not exist in namespace "tailscale"`,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Name: "invalid status for empty secret",
|
||||||
|
Request: reconcile.Request{
|
||||||
|
NamespacedName: types.NamespacedName{
|
||||||
|
Name: "test",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Tailnet: &tsapi.Tailnet{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: "test",
|
||||||
|
},
|
||||||
|
Spec: tsapi.TailnetSpec{
|
||||||
|
Credentials: tsapi.TailnetCredentials{
|
||||||
|
SecretName: "test",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Secret: &corev1.Secret{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: "test",
|
||||||
|
Namespace: "tailscale",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
ExpectedConditions: []metav1.Condition{
|
||||||
|
{
|
||||||
|
Type: string(tsapi.TailnetReady),
|
||||||
|
Status: metav1.ConditionFalse,
|
||||||
|
Reason: tailnet.ReasonInvalidSecret,
|
||||||
|
Message: `Secret "test" is empty`,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Name: "invalid status for missing client id",
|
||||||
|
Request: reconcile.Request{
|
||||||
|
NamespacedName: types.NamespacedName{
|
||||||
|
Name: "test",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Tailnet: &tsapi.Tailnet{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: "test",
|
||||||
|
},
|
||||||
|
Spec: tsapi.TailnetSpec{
|
||||||
|
Credentials: tsapi.TailnetCredentials{
|
||||||
|
SecretName: "test",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Secret: &corev1.Secret{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: "test",
|
||||||
|
Namespace: "tailscale",
|
||||||
|
},
|
||||||
|
Data: map[string][]byte{
|
||||||
|
"client_secret": []byte("test"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
ExpectedConditions: []metav1.Condition{
|
||||||
|
{
|
||||||
|
Type: string(tsapi.TailnetReady),
|
||||||
|
Status: metav1.ConditionFalse,
|
||||||
|
Reason: tailnet.ReasonInvalidSecret,
|
||||||
|
Message: `Secret "test" is missing the client_id field`,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Name: "invalid status for missing client secret",
|
||||||
|
Request: reconcile.Request{
|
||||||
|
NamespacedName: types.NamespacedName{
|
||||||
|
Name: "test",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Tailnet: &tsapi.Tailnet{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: "test",
|
||||||
|
},
|
||||||
|
Spec: tsapi.TailnetSpec{
|
||||||
|
Credentials: tsapi.TailnetCredentials{
|
||||||
|
SecretName: "test",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Secret: &corev1.Secret{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: "test",
|
||||||
|
Namespace: "tailscale",
|
||||||
|
},
|
||||||
|
Data: map[string][]byte{
|
||||||
|
"client_id": []byte("test"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
ExpectedConditions: []metav1.Condition{
|
||||||
|
{
|
||||||
|
Type: string(tsapi.TailnetReady),
|
||||||
|
Status: metav1.ConditionFalse,
|
||||||
|
Reason: tailnet.ReasonInvalidSecret,
|
||||||
|
Message: `Secret "test" is missing the client_secret field`,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Name: "invalid status for bad devices scope",
|
||||||
|
Request: reconcile.Request{
|
||||||
|
NamespacedName: types.NamespacedName{
|
||||||
|
Name: "test",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Tailnet: &tsapi.Tailnet{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: "test",
|
||||||
|
},
|
||||||
|
Spec: tsapi.TailnetSpec{
|
||||||
|
Credentials: tsapi.TailnetCredentials{
|
||||||
|
SecretName: "test",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Secret: &corev1.Secret{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: "test",
|
||||||
|
Namespace: "tailscale",
|
||||||
|
},
|
||||||
|
Data: map[string][]byte{
|
||||||
|
"client_id": []byte("test"),
|
||||||
|
"client_secret": []byte("test"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
ClientFunc: func(_ *tsapi.Tailnet, _ *corev1.Secret) tailnet.TailscaleClient {
|
||||||
|
return &MockTailnetClient{ErrorOnDevices: true}
|
||||||
|
},
|
||||||
|
ExpectedConditions: []metav1.Condition{
|
||||||
|
{
|
||||||
|
Type: string(tsapi.TailnetReady),
|
||||||
|
Status: metav1.ConditionFalse,
|
||||||
|
Reason: tailnet.ReasonInvalidOAuth,
|
||||||
|
Message: `failed to list devices: EOF`,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Name: "invalid status for bad services scope",
|
||||||
|
Request: reconcile.Request{
|
||||||
|
NamespacedName: types.NamespacedName{
|
||||||
|
Name: "test",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Tailnet: &tsapi.Tailnet{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: "test",
|
||||||
|
},
|
||||||
|
Spec: tsapi.TailnetSpec{
|
||||||
|
Credentials: tsapi.TailnetCredentials{
|
||||||
|
SecretName: "test",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Secret: &corev1.Secret{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: "test",
|
||||||
|
Namespace: "tailscale",
|
||||||
|
},
|
||||||
|
Data: map[string][]byte{
|
||||||
|
"client_id": []byte("test"),
|
||||||
|
"client_secret": []byte("test"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
ClientFunc: func(_ *tsapi.Tailnet, _ *corev1.Secret) tailnet.TailscaleClient {
|
||||||
|
return &MockTailnetClient{ErrorOnServices: true}
|
||||||
|
},
|
||||||
|
ExpectedConditions: []metav1.Condition{
|
||||||
|
{
|
||||||
|
Type: string(tsapi.TailnetReady),
|
||||||
|
Status: metav1.ConditionFalse,
|
||||||
|
Reason: tailnet.ReasonInvalidOAuth,
|
||||||
|
Message: `failed to list VIP services: EOF`,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Name: "invalid status for bad keys scope",
|
||||||
|
Request: reconcile.Request{
|
||||||
|
NamespacedName: types.NamespacedName{
|
||||||
|
Name: "test",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Tailnet: &tsapi.Tailnet{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: "test",
|
||||||
|
},
|
||||||
|
Spec: tsapi.TailnetSpec{
|
||||||
|
Credentials: tsapi.TailnetCredentials{
|
||||||
|
SecretName: "test",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Secret: &corev1.Secret{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: "test",
|
||||||
|
Namespace: "tailscale",
|
||||||
|
},
|
||||||
|
Data: map[string][]byte{
|
||||||
|
"client_id": []byte("test"),
|
||||||
|
"client_secret": []byte("test"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
ClientFunc: func(_ *tsapi.Tailnet, _ *corev1.Secret) tailnet.TailscaleClient {
|
||||||
|
return &MockTailnetClient{ErrorOnKeys: true}
|
||||||
|
},
|
||||||
|
ExpectedConditions: []metav1.Condition{
|
||||||
|
{
|
||||||
|
Type: string(tsapi.TailnetReady),
|
||||||
|
Status: metav1.ConditionFalse,
|
||||||
|
Reason: tailnet.ReasonInvalidOAuth,
|
||||||
|
Message: `failed to list auth keys: EOF`,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Name: "ready when valid and scopes are correct",
|
||||||
|
Request: reconcile.Request{
|
||||||
|
NamespacedName: types.NamespacedName{
|
||||||
|
Name: "default",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Tailnet: &tsapi.Tailnet{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: "default",
|
||||||
|
},
|
||||||
|
Spec: tsapi.TailnetSpec{
|
||||||
|
Credentials: tsapi.TailnetCredentials{
|
||||||
|
SecretName: "test",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Secret: &corev1.Secret{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: "test",
|
||||||
|
Namespace: "tailscale",
|
||||||
|
},
|
||||||
|
Data: map[string][]byte{
|
||||||
|
"client_id": []byte("test"),
|
||||||
|
"client_secret": []byte("test"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
ClientFunc: func(_ *tsapi.Tailnet, _ *corev1.Secret) tailnet.TailscaleClient {
|
||||||
|
return &MockTailnetClient{}
|
||||||
|
},
|
||||||
|
ExpectedConditions: []metav1.Condition{
|
||||||
|
{
|
||||||
|
Type: string(tsapi.TailnetReady),
|
||||||
|
Status: metav1.ConditionTrue,
|
||||||
|
Reason: tailnet.ReasonValid,
|
||||||
|
Message: tailnet.ReasonValid,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tc := range tt {
|
||||||
|
t.Run(tc.Name, func(t *testing.T) {
|
||||||
|
builder := fake.NewClientBuilder().WithScheme(tsapi.GlobalScheme)
|
||||||
|
if tc.Tailnet != nil {
|
||||||
|
builder = builder.WithObjects(tc.Tailnet).WithStatusSubresource(tc.Tailnet)
|
||||||
|
}
|
||||||
|
if tc.Secret != nil {
|
||||||
|
builder = builder.WithObjects(tc.Secret)
|
||||||
|
}
|
||||||
|
|
||||||
|
fc := builder.Build()
|
||||||
|
opts := tailnet.ReconcilerOptions{
|
||||||
|
Client: fc,
|
||||||
|
Clock: clock,
|
||||||
|
Logger: logger.Sugar(),
|
||||||
|
ClientFunc: tc.ClientFunc,
|
||||||
|
TailscaleNamespace: "tailscale",
|
||||||
|
}
|
||||||
|
|
||||||
|
reconciler := tailnet.NewReconciler(opts)
|
||||||
|
_, err = reconciler.Reconcile(t.Context(), tc.Request)
|
||||||
|
if tc.ExpectsError && err == nil {
|
||||||
|
t.Fatalf("expected error, got none")
|
||||||
|
}
|
||||||
|
|
||||||
|
if !tc.ExpectsError && err != nil {
|
||||||
|
t.Fatalf("expected no error, got %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if len(tc.ExpectedConditions) == 0 {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
var tn tsapi.Tailnet
|
||||||
|
if err = fc.Get(t.Context(), tc.Request.NamespacedName, &tn); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if len(tn.Status.Conditions) != len(tc.ExpectedConditions) {
|
||||||
|
t.Fatalf("expected %v condition(s), got %v", len(tc.ExpectedConditions), len(tn.Status.Conditions))
|
||||||
|
}
|
||||||
|
|
||||||
|
for i, expected := range tc.ExpectedConditions {
|
||||||
|
actual := tn.Status.Conditions[i]
|
||||||
|
|
||||||
|
if actual.Type != expected.Type {
|
||||||
|
t.Errorf("expected %v, got %v", expected.Type, actual.Type)
|
||||||
|
}
|
||||||
|
|
||||||
|
if actual.Status != expected.Status {
|
||||||
|
t.Errorf("expected %v, got %v", expected.Status, actual.Status)
|
||||||
|
}
|
||||||
|
|
||||||
|
if actual.Reason != expected.Reason {
|
||||||
|
t.Errorf("expected %v, got %v", expected.Reason, actual.Reason)
|
||||||
|
}
|
||||||
|
|
||||||
|
if actual.Message != expected.Message {
|
||||||
|
t.Errorf("expected %v, got %v", expected.Message, actual.Message)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if err = fc.Delete(t.Context(), &tn); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if _, err = reconciler.Reconcile(t.Context(), tc.Request); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
err = fc.Get(t.Context(), tc.Request.NamespacedName, &tn)
|
||||||
|
if !apierrors.IsNotFound(err) {
|
||||||
|
t.Fatalf("expected not found error, got %v", err)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue