ops_kongsni.go

package ops

import (
	"context"
	"errors"
	"fmt"
	"net/http"

	sdkkonnectgo "github.com/Kong/sdk-konnect-go"
	sdkkonnectcomp "github.com/Kong/sdk-konnect-go/models/components"
	sdkkonnectops "github.com/Kong/sdk-konnect-go/models/operations"
	sdkkonnecterrs "github.com/Kong/sdk-konnect-go/models/sdkerrors"
	"sigs.k8s.io/controller-runtime/pkg/client"
	ctrllog "sigs.k8s.io/controller-runtime/pkg/log"

	commonv1alpha1 "github.com/kong/kong-operator/v2/api/common/v1alpha1"
	configurationv1alpha1 "github.com/kong/kong-operator/v2/api/configuration/v1alpha1"
)

func createSNI(
	ctx context.Context,
	sdk sdkkonnectgo.SNIsSDK,
	sni *configurationv1alpha1.KongSNI,
) error {
	cpID := sni.GetControlPlaneID()
	if cpID == "" {
		return CantPerformOperationWithoutControlPlaneIDError{Entity: sni, Op: CreateOp}
	}
	if sni.Status.Konnect == nil || sni.Status.Konnect.CertificateID == "" {
		return fmt.Errorf("can't create %T %s without a Konnect Certificate ID", sni, client.ObjectKeyFromObject(sni))
	}

	resp, err := sdk.CreateSniWithCertificate(ctx, sdkkonnectops.CreateSniWithCertificateRequest{
		ControlPlaneID:    cpID,
		CertificateID:     sni.Status.Konnect.CertificateID,
		SNIWithoutParents: kongSNIToSNIWithoutParents(sni),
	})
	if errWrapped := wrapErrIfKonnectOpFailed(err, CreateOp, sni); errWrapped != nil {
		return errWrapped
	}

	if resp == nil || resp.Sni == nil || resp.Sni.ID == nil || *resp.Sni.ID == "" {
		return fmt.Errorf("failed creating %s: %w", sni.GetTypeName(), ErrNilResponse)
	}

	// At this point, the SNI has been created successfully.
	sni.Status.Konnect.SetKonnectID(*resp.Sni.ID)

	return nil
}

func updateSNI(
	ctx context.Context,
	sdk sdkkonnectgo.SNIsSDK,
	sni *configurationv1alpha1.KongSNI,
) error {
	cpID := sni.GetControlPlaneID()
	if cpID == "" {
		return CantPerformOperationWithoutControlPlaneIDError{Entity: sni, Op: UpdateOp}
	}
	if sni.Status.Konnect == nil || sni.Status.Konnect.CertificateID == "" {
		return fmt.Errorf("can't update %T %s without a Konnect Certificate ID", sni, client.ObjectKeyFromObject(sni))
	}
	id := sni.GetKonnectID()

	_, err := sdk.UpsertSniWithCertificate(ctx, sdkkonnectops.UpsertSniWithCertificateRequest{
		ControlPlaneID:    cpID,
		CertificateID:     sni.Status.Konnect.CertificateID,
		SNIID:             id,
		SNIWithoutParents: kongSNIToSNIWithoutParents(sni),
	})

	// TODO: handle already exists
	// Can't adopt it as it will cause conflicts between the controller
	// that created that entity and already manages it, hm
	if errWrap := wrapErrIfKonnectOpFailed(err, UpdateOp, sni); errWrap != nil {
		return errWrap
	}

	return nil
}

func deleteSNI(
	ctx context.Context,
	sdk sdkkonnectgo.SNIsSDK,
	sni *configurationv1alpha1.KongSNI,
) error {
	cpID := sni.GetControlPlaneID()
	if cpID == "" {
		return fmt.Errorf("can't delete %T %s without a Konnect ControlPlane ID", sni, client.ObjectKeyFromObject(sni))
	}
	if sni.Status.Konnect == nil || sni.Status.Konnect.CertificateID == "" {
		return fmt.Errorf("can't delete %T %s without a Konnect Certificate ID", sni, client.ObjectKeyFromObject(sni))
	}
	id := sni.GetKonnectID()

	_, err := sdk.DeleteSniWithCertificate(ctx, sdkkonnectops.DeleteSniWithCertificateRequest{
		ControlPlaneID: cpID,
		CertificateID:  sni.Status.Konnect.CertificateID,
		SNIID:          id,
	})

	if errWrapped := wrapErrIfKonnectOpFailed(err, DeleteOp, sni); errWrapped != nil {
		// Service delete operation returns an SDKError instead of a NotFoundError.
		if sdkError, ok := errors.AsType[*sdkkonnecterrs.SDKError](errWrapped); ok {
			if sdkError.StatusCode == http.StatusNotFound {
				ctrllog.FromContext(ctx).
					Info("entity not found in Konnect, skipping delete",
						"op", DeleteOp, "type", sni.GetTypeName(), "id", id,
					)
				return nil
			}
			return FailedKonnectOpError[configurationv1alpha1.KongSNI]{
				Op:  DeleteOp,
				Err: sdkError,
			}
		}
		return FailedKonnectOpError[configurationv1alpha1.KongSNI]{
			Op:  DeleteOp,
			Err: errWrapped,
		}
	}

	return nil
}

func adoptSNI(
	ctx context.Context,
	sdk sdkkonnectgo.SNIsSDK,
	sni *configurationv1alpha1.KongSNI,
) error {
	cpID := sni.GetControlPlaneID()
	if cpID == "" {
		return KonnectEntityAdoptionMissingControlPlaneIDError{}
	}
	if sni.Status.Konnect == nil || sni.Status.Konnect.CertificateID == "" {
		return fmt.Errorf("can't adopt %T %s without a Konnect Certificate ID", sni, client.ObjectKeyFromObject(sni))
	}

	adoptOptions := sni.Spec.Adopt
	konnectID := adoptOptions.Konnect.ID

	resp, err := sdk.GetSniWithCertificate(ctx, sdkkonnectops.GetSniWithCertificateRequest{
		ControlPlaneID: cpID,
		CertificateID:  sni.Status.Konnect.CertificateID,
		SNIID:          konnectID,
	})
	if err != nil {
		return KonnectEntityAdoptionFetchError{
			KonnectID: konnectID,
			Err:       err,
		}
	}
	if resp == nil || resp.Sni == nil {
		return fmt.Errorf("failed to adopt %s: %w", sni.GetTypeName(), ErrNilResponse)
	}

	uidTag, hasUIDTag := findUIDTag(resp.Sni.Tags)
	if hasUIDTag && extractUIDFromTag(uidTag) != string(sni.UID) {
		return KonnectEntityAdoptionUIDTagConflictError{
			KonnectID:    konnectID,
			ActualUIDTag: extractUIDFromTag(uidTag),
		}
	}

	adoptMode := adoptOptions.Mode
	if adoptMode == "" {
		adoptMode = commonv1alpha1.AdoptModeOverride
	}

	switch adoptMode {
	case commonv1alpha1.AdoptModeOverride:
		sniCopy := sni.DeepCopy()
		sniCopy.SetKonnectID(konnectID)
		if err = updateSNI(ctx, sdk, sniCopy); err != nil {
			return err
		}
	case commonv1alpha1.AdoptModeMatch:
		if !sniMatch(resp.Sni, sni) {
			return KonnectEntityAdoptionNotMatchError{
				KonnectID: konnectID,
			}
		}
	default:
		return fmt.Errorf("failed to adopt: adopt mode %q not supported", adoptMode)
	}

	sni.SetKonnectID(konnectID)
	return nil
}

func kongSNIToSNIWithoutParents(sni *configurationv1alpha1.KongSNI) sdkkonnectcomp.SNIWithoutParents {
	return sdkkonnectcomp.SNIWithoutParents{
		Name: sni.Spec.Name,
		Tags: GenerateTagsForObject(sni, sni.Spec.Tags...),
	}
}

// getKongSNIForUID returns the Konnect ID of the Konnect SNI that matches the UID of the provided SNI.
func getKongSNIForUID(ctx context.Context, sdk sdkkonnectgo.SNIsSDK, sni *configurationv1alpha1.KongSNI) (string, error) {
	resp, err := sdk.ListSni(ctx, sdkkonnectops.ListSniRequest{
		ControlPlaneID: sni.GetControlPlaneID(),
		Tags:           new(UIDLabelForObject(sni)),
	})
	if err != nil {
		return "", fmt.Errorf("failed listing %s: %w", sni.GetTypeName(), err)
	}
	if resp == nil || resp.Object == nil {
		return "", fmt.Errorf("failed listing %s: %w", sni.GetTypeName(), ErrNilResponse)
	}

	_, id, err := getMatchingEntryFromListResponseData(sliceToEntityWithIDPtrSlice(resp.Object.Data), sni)
	return id, err
}

func sniMatch(konnectSNI *sdkkonnectcomp.Sni, sni *configurationv1alpha1.KongSNI) bool {
	if konnectSNI == nil {
		return false
	}
	if konnectSNI.Certificate.ID == nil || *konnectSNI.Certificate.ID == "" {
		return false
	}
	return konnectSNI.Name == sni.Spec.Name &&
		*konnectSNI.Certificate.ID == sni.Status.Konnect.CertificateID
}