Implement SaaS-Based Approval Workflow for ClientIntents #569

omris94 · 2025-02-26T09:14:20Z

Description

This pull request introduces a SaaS-based approval workflow for ClientIntents within the Otterize intents-operator. By default, there are no changes to the user API unless explicitly configured by the user.

Key Changes

ApprovedClientIntents CRD:
A new Custom Resource Definition (CRD) named ApprovedClientIntents has been added. This CRD represents ClientIntents resources that have been approved, facilitating a controlled and auditable access management process.
Refactoring of Intents Reconciliation:
The existing IntentsReconciler logic has been refactored into ApprovedIntentsReconciler. All operations previously triggered by the reconciliation of intents now utilize the new ApprovedClientIntents CRD, ensuring that only approved intents are enforced.
Introduction of Approval Flow Reconciler:
A new reconciler has been implemented to handle the approval flow. By default, the operator auto-approves any ClientIntents. If configured to integrate with the cloud, it reports the ClientIntents as access requests to the cloud and awaits approval status. Once a request is approved, it triggers the creation of an ApprovedClientIntents resource.

Testing

Describe how this can be tested by reviewers. Be specific about anything not tested and reasons why. If this library has unit and/or integration testing, tests should be added for new functionality and existing tests should complete without errors.

Please include any manual steps for testing end-to-end or functionality not covered by unit/integration tests.

Also include details of the environment this PR was developed in (language/platform/browser version).

This change adds test coverage for new/changed/fixed functionality

Checklist

I have added documentation for new/changed functionality in this PR and in github.com/otterize/docs

…oved intents

…nto evya/approved_intents_crd

…raphQL mutations and queries for applied intents requests

…_crd

omris94 · 2025-02-26T10:26:06Z

src/operator/controllers/approved_intents_controller.go

+}
+
+// ApprovedIntentsReconciler reconciles a Intents object
+type ApprovedIntentsReconciler struct {


This is essentially what was referred to as the Intents Reconciler

omris94 · 2025-02-26T10:27:26Z

src/operator/controllers/intents_controller.go

@@ -115,21 +86,39 @@ func NewIntentsReconciler(
 //+kubebuilder:rbac:groups="apiextensions.k8s.io",resources=customresourcedefinitions,verbs=get;list;watch;update;create;patch
 // +kubebuilder:rbac:groups=iam.cnrm.cloud.google.com,resources=iampartialpolicies,verbs=get;list;watch;create;update;patch;delete

-// Reconcile is part of the main kubernetes reconciliation loop which aims to
-// move the current state of the cluster closer to the desired state.
+// Reconcile - main reconciliation loop


Explanation about how the "clientIntents to ApprovedClientIntents" lifecycle works

…r upToDates with their corresponding ClientIntents

…lientIntents for every clientIntents while the operator will wait for the migration to end.

1. When first reconciled - add finalizer 2. When deleted - trigger approvedClientIntent deletion a. If does not exist - remove finalizer b. If exists - delete approvedClientIntent and return 3. When approvedClientIntents is deleted - remove finalizer from clientIntents before removing its own

…_crd

omris94 · 2025-03-17T17:52:46Z

src/shared/operatorconfig/config.go

@@ -66,6 +66,9 @@ const (
 	SeparateNetpolsForIngressAndEgress            = "separate-netpols-for-ingress-and-egress"
 	SeparateNetpolsForIngressAndEgressDefault     = false
 	ExternallyManagedPolicyWorkloadsKey           = "externallyManagedPolicyWorkloads"
+
+	EnableIntentsCloudApproval        = "enable-intents-cloud-approval"
+	EnableIntentsCloudApprovalDefault = true


Change before merge

…_crd

src/operator/api/v2alpha1/approved_clientintents_types.go

amitlicht · 2025-03-18T10:08:31Z

src/operator/api/v2alpha1/approved_clientintents_types.go

+//+kubebuilder:object:root=true
+//+kubebuilder:subresource:status
+
+// ApprovedClientIntents is the Schema for the intents API


Fix comment?

amitlicht · 2025-03-18T10:10:01Z

src/operator/api/v2alpha1/approved_clientintents_types.go

+	ObservedGeneration int64 `json:"observedGeneration"`
+	// ResolvedIPs stores resolved IPs for a domain name - the network mapper populates it when DNS internetTarget is used
+	// +optional
+	ResolvedIPs []ResolvedIPs `json:"resolvedIPs,omitempty" yaml:"resolvedIPs,omitempty"`


Don't forget to open a PR to update the mapper with this change + release them together

amitlicht · 2025-03-18T10:12:24Z

src/operator/api/v2alpha1/clientintents_types.go

@@ -365,14 +374,21 @@ type AzureKeyVaultPolicy struct {
 type IntentsStatus struct {
 	// upToDate field reflects whether the client intents have successfully been applied
 	// to the cluster to the state specified
+	// Deprecated: Use ApprovedClientIntents.Status.UpToDate instead


Is this comment true?

amitlicht · 2025-03-18T10:14:35Z

src/operator/api/v2alpha1/clientintents_types.go

@@ -365,14 +374,21 @@ type AzureKeyVaultPolicy struct {
 type IntentsStatus struct {


Consider renaming to ClientIntentsStatus (the name IntentsStatus is even more confusing, now that we have "ClientIntents" and "ApprovedClientIntents" and "ApprovedClientIntentsStatus"

amitlicht · 2025-03-18T10:43:01Z

src/operator/controllers/intents_controller.go

 //+kubebuilder:rbac:groups=k8s.otterize.com,resources=postgresqlserverconfigs,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=k8s.otterize.com,resources=mysqlserverconfigs,verbs=get;list;watch;create;update;patch;delete


Cleanup required RBAC permissions here

amitlicht · 2025-03-18T11:53:12Z

src/operator/controllers/intents_controller.go

-				Namespace: clientIntents.Namespace,
-			},
+func (r *IntentsReconciler) handleCloudAppliedIntentsRequests(ctx context.Context, intents otterizev2alpha1.ClientIntents) error {
+	if intents.Status.ReviewStatus == otterizev2alpha1.ReviewStatusApproved || !intents.DeletionTimestamp.IsZero() {


can we remove this "if"? The caller shouldn't call this function if this is the case (and as far as I can tell it really doesn't)

amitlicht · 2025-03-18T11:54:41Z

src/operator/controllers/intents_controller.go

+		// Will be handled elsewhere
+		return nil
+	}
+	if intents.Status.ReviewStatus == "" {


shouldn't this already be handled by the main flow? I'd expect the main flow to ensure the status is set.

amitlicht · 2025-03-18T11:58:58Z

src/operator/controllers/intents_controller.go

-			return res
-		})
-	if err != nil {
+func (r *IntentsReconciler) queryAppliedIntentsRequestsStatus(ctx context.Context) error {


queryAppliedIntentsRequestsStatus sounds like it's just querying (readonly), but really it also queries the cloud and updates the request status. The name should be more indicative.

amitlicht · 2025-03-18T12:00:48Z

src/operator/controllers/intents_controller.go

-				if address.TargetRef == nil || address.TargetRef.Kind != "Pod" {
-					continue
-				}
+func (r *IntentsReconciler) handleRequestStatusChanges(ctx context.Context, request operator_cloud_client.AppliedIntentsRequestStatus, clientIntents otterizev2alpha1.ClientIntents) error {


Maybe handleRequestStatusResponse? It didn't necessarily change

evyatarmeged and others added 30 commits January 26, 2025 11:37

Adding approved intents types

5b7b610

Adding approved client intents crd & changes to existing client intents

c42bca3

Adding approval flow for OSS (auto approve) and a reconciler for appr…

110130c

…oved intents

tweaks to main with revamped intents reconciler

5b8e437

Merge branch 'main' of https://github.com/otterize/intents-operator i…

52e917c

…nto evya/approved_intents_crd

Adding cloud approval flow and some genqlient tweaks

f59a2e2

Changing everything to approved client intents model

95cd18c

Adding periodic approval flow

c2a1ba6

Adding polling for approval updates

d8593fd

demo commit

9def051

latest fixes

02855f6

fixes

269cd19

function updates

e226fcb

Making resource UID the hash for intents approval reporting

ee676e9

Copying old status fields from client intents to approved client intents

089beb1

Added old status update to approved client intents

9be3ee7

Refactor client intents handling to use approved intents and update G…

2ce015c

…raphQL mutations and queries for applied intents requests

Move to v2beta1, write webhooks

607771d

Merge remote-tracking branch 'origin/main' into evya/approved_intents…

89267a0

…_crd

fixup

2f79886

Align with the Cloud API

5854619

Make tests work

5adf83e

uncomment

edd567b

Fix CRDs

6b1fa5b

Add delete and update logic

f40a859

Merge remote-tracking branch 'origin/main' into evya/approved_intents…

8772e86

…_crd

Do it idempotent

77d6a51

Fix updates

be9e44e

Add tests improve upToDate logic

f16a610

Remove deprecation

66e4adc

omris94 commented Feb 26, 2025

View reviewed changes

omris94 added 3 commits February 26, 2025 14:06

order

75eac3d

reorder

937bc85

remove use of upToDate; add events

aa0a712

omris94 requested a review from amitlicht February 26, 2025 15:30

omris94 changed the title ~~Support SaaS based approval flow of clientIntents~~ Support SaaS based approval flow for clientIntents Feb 26, 2025

omris94 added 12 commits March 10, 2025 19:42

Mirror events from approvedClientIntents to ClientIntents

d2e2689

Add events for status review changes

98ace92

Add upToDateReconcilers who watches ApprovedClientIntents aligns thei…

f9a94d6

…r upToDates with their corresponding ClientIntents

Approved client intents migration - The webhook will create approvedC…

fe0fe76

…lientIntents for every clientIntents while the operator will wait for the migration to end.

Add config for cloud approval

15e40eb

Use the same name for intents and approved intents

4d8c424

Align with cloud API

da7a996

Merge remote-tracking branch 'origin/main' into evya/approved_intents…

6d8ab8e

…_crd

fixup makefile

f94286c

generate

b2347fc

fixup

74a7dbd

omris94 changed the title ~~Support SaaS based approval flow for clientIntents~~ Implement SaaS-Based Approval Workflow for ClientIntents Mar 17, 2025

fixup

599debe

omris94 marked this pull request as ready for review March 17, 2025 17:51

omris94 commented Mar 17, 2025

View reviewed changes

omris94 added 4 commits March 17, 2025 20:00

lint fix

ffb98a6

Update helm

0f7ad84

Merge remote-tracking branch 'origin/main' into evya/approved_intents…

d571172

…_crd

Add resolved IPs to the migration

07f990c

amitlicht reviewed Mar 18, 2025

View reviewed changes

omris94 added 2 commits March 20, 2025 12:30

fix events strings

d7a6a32

remove not in use

21fcd63

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Implement SaaS-Based Approval Workflow for ClientIntents #569

Implement SaaS-Based Approval Workflow for ClientIntents #569

Uh oh!

omris94 commented Feb 26, 2025 •

edited

Loading

Uh oh!

omris94 Feb 26, 2025

Uh oh!

omris94 Feb 26, 2025

Uh oh!

omris94 Mar 17, 2025

Uh oh!

Uh oh!

amitlicht Mar 18, 2025

Uh oh!

amitlicht Mar 18, 2025

Uh oh!

amitlicht Mar 18, 2025

Uh oh!

amitlicht Mar 18, 2025

Uh oh!

amitlicht Mar 18, 2025

Uh oh!

amitlicht Mar 18, 2025

Uh oh!

amitlicht Mar 18, 2025

Uh oh!

amitlicht Mar 18, 2025

Uh oh!

amitlicht Mar 18, 2025

Uh oh!

Uh oh!

		@@ -365,14 +374,21 @@ type AzureKeyVaultPolicy struct {
		type IntentsStatus struct {

		//+kubebuilder:rbac:groups=k8s.otterize.com,resources=postgresqlserverconfigs,verbs=get;list;watch;create;update;patch;delete
		//+kubebuilder:rbac:groups=k8s.otterize.com,resources=mysqlserverconfigs,verbs=get;list;watch;create;update;patch;delete

Implement SaaS-Based Approval Workflow for ClientIntents #569

Are you sure you want to change the base?

Implement SaaS-Based Approval Workflow for ClientIntents #569

Uh oh!

Conversation

omris94 commented Feb 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Key Changes

Testing

Checklist

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

omris94 commented Feb 26, 2025 •

edited

Loading