Add autoupdate agent type validations

api/types/autoupdate/config.go

@@ -1,38 +1,31 @@
 /*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
+Copyright 2024 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
 
 package autoupdate
 
 import (
+	"time"
+
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	"github.com/gravitational/teleport/api/types"
 )
 
-const (
-	// ToolsUpdateModeEnabled enables client tools automatic updates.
-	ToolsUpdateModeEnabled = "enabled"
-	// ToolsUpdateModeDisabled disables client tools automatic updates.
-	ToolsUpdateModeDisabled = "disabled"
-)
-
 // NewAutoUpdateConfig creates a new auto update configuration resource.
 func NewAutoUpdateConfig(spec *autoupdate.AutoUpdateConfigSpec) (*autoupdate.AutoUpdateConfig, error) {
 	config := &autoupdate.AutoUpdateConfig{
@@ -66,10 +59,41 @@ func ValidateAutoUpdateConfig(c *autoupdate.AutoUpdateConfig) error {
 		return trace.BadParameter("Spec is nil")
 	}
 	if c.Spec.Tools != nil {
-		if c.Spec.Tools.Mode != ToolsUpdateModeDisabled && c.Spec.Tools.Mode != ToolsUpdateModeEnabled {
-			return trace.BadParameter("ToolsMode is not valid")
+		if err := checkToolsMode(c.Spec.Tools.Mode); err != nil {
+			return trace.Wrap(err, "validating spec.tools.mode")
+		}
+	}
+	if c.Spec.Agents != nil {
+		if err := checkAgentsMode(c.Spec.Agents.Mode); err != nil {
+			return trace.Wrap(err, "validating spec.agents.mode")
+		}
+		if err := checkAgentsStrategy(c.Spec.Agents.Strategy); err != nil {
+			return trace.Wrap(err, "validating spec.agents.strategy")
 		}
+
+		windowDuration := c.Spec.Agents.MaintenanceWindowDuration.AsDuration()
+		if c.Spec.Agents.Strategy == AgentsStrategyHaltOnError && windowDuration != 0 {
+			return trace.BadParameter("spec.agents.maintenance_window_duration must be zero when the strategy is %q", c.Spec.Agents.Strategy)
+		}
+		if c.Spec.Agents.Strategy == AgentsStrategyTimeBased && windowDuration < 10*time.Minute {
+			return trace.BadParameter("spec.agents.maintenance_window_duration must be greater than 10 minutes when the strategy is %q", c.Spec.Agents.Strategy)
+		}
+
+		if err := checkAgentSchedules(c.Spec.Agents.Schedules); err != nil {
+			return trace.Wrap(err, "validating spec.agents.schedules")
+		}
+
 	}
 
 	return nil
 }
+
+func checkAgentSchedules(schedules *autoupdate.AgentAutoUpdateSchedules) error {
+	// TODO: change this logic when we implement group support.
+	// Currently we reject any non-nil schedule
+	// When we'll implement schedule support, we'll treat an empty schedule as the default schedule.
+	if schedules == nil {
+		return nil
+	}
+	return trace.NotImplemented("agent schedules are not implemented yet")
+}

api/types/autoupdate/config_test.go

@@ -1,29 +1,29 @@
 /*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
+Copyright 2024 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
 
 package autoupdate
 
 import (
 	"testing"
+	"time"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/testing/protocmp"
+	"google.golang.org/protobuf/types/known/durationpb"
 
 	"github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
@@ -99,7 +99,121 @@ func TestNewAutoUpdateConfig(t *testing.T) {
 				},
 			},
 			assertErr: func(t *testing.T, err error, a ...any) {
-				require.ErrorContains(t, err, "ToolsMode is not valid")
+				require.ErrorContains(t, err, "unsupported tools mode: \"invalid-mode\"")
+			},
+		},
+		{
+			name: "invalid agents mode",
+			spec: &autoupdate.AutoUpdateConfigSpec{
+				Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+					Mode:     "invalid-mode",
+					Strategy: AgentsStrategyHaltOnError,
+				},
+			},
+			assertErr: func(t *testing.T, err error, a ...any) {
+				require.ErrorContains(t, err, "unsupported agents mode: \"invalid-mode\"")
+			},
+		},
+		{
+			name: "invalid agents strategy",
+			spec: &autoupdate.AutoUpdateConfigSpec{
+				Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+					Mode:     AgentsUpdateModeEnabled,
+					Strategy: "invalid-strategy",
+				},
+			},
+			assertErr: func(t *testing.T, err error, a ...any) {
+				require.ErrorContains(t, err, "unsupported agents strategy: \"invalid-strategy\"")
+			},
+		},
+		{
+			name: "invalid agents non-nil maintenance window with halt-on-error",
+			spec: &autoupdate.AutoUpdateConfigSpec{
+				Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+					Mode:                      AgentsUpdateModeEnabled,
+					Strategy:                  AgentsStrategyHaltOnError,
+					MaintenanceWindowDuration: durationpb.New(time.Hour),
+				},
+			},
+			assertErr: func(t *testing.T, err error, a ...any) {
+				require.ErrorContains(t, err, "maintenance_window_duration must be zero")
+			},
+		},
+		{
+			name: "invalid agents nil maintenance window with time-based strategy",
+			spec: &autoupdate.AutoUpdateConfigSpec{
+				Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+					Mode:     AgentsUpdateModeEnabled,
+					Strategy: AgentsStrategyTimeBased,
+				},
+			},
+			assertErr: func(t *testing.T, err error, a ...any) {
+				require.ErrorContains(t, err, "maintenance_window_duration must be greater than 10 minutes")
+			},
+		},
+		{
+			name: "invalid agents short maintenance window",
+			spec: &autoupdate.AutoUpdateConfigSpec{
+				Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+					Mode:                      AgentsUpdateModeEnabled,
+					Strategy:                  AgentsStrategyTimeBased,
+					MaintenanceWindowDuration: durationpb.New(time.Minute),
+				},
+			},
+			assertErr: func(t *testing.T, err error, a ...any) {
+				require.ErrorContains(t, err, "maintenance_window_duration must be greater than 10 minutes")
+			},
+		},
+		{
+			name: "success agents autoupdate halt-on-failure",
+			spec: &autoupdate.AutoUpdateConfigSpec{
+				Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+					Mode:     AgentsUpdateModeEnabled,
+					Strategy: AgentsStrategyHaltOnError,
+				},
+			},
+			assertErr: func(t *testing.T, err error, a ...any) {
+				require.NoError(t, err)
+			},
+			want: &autoupdate.AutoUpdateConfig{
+				Kind:    types.KindAutoUpdateConfig,
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: types.MetaNameAutoUpdateConfig,
+				},
+				Spec: &autoupdate.AutoUpdateConfigSpec{
+					Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+						Mode:     AgentsUpdateModeEnabled,
+						Strategy: AgentsStrategyHaltOnError,
+					},
+				},
+			},
+		},
+		{
+			name: "success agents autoupdate time-based",
+			spec: &autoupdate.AutoUpdateConfigSpec{
+				Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+					Mode:                      AgentsUpdateModeEnabled,
+					Strategy:                  AgentsStrategyTimeBased,
+					MaintenanceWindowDuration: durationpb.New(time.Hour),
+				},
+			},
+			assertErr: func(t *testing.T, err error, a ...any) {
+				require.NoError(t, err)
+			},
+			want: &autoupdate.AutoUpdateConfig{
+				Kind:    types.KindAutoUpdateConfig,
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: types.MetaNameAutoUpdateConfig,
+				},
+				Spec: &autoupdate.AutoUpdateConfigSpec{
+					Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+						Mode:                      AgentsUpdateModeEnabled,
+						Strategy:                  AgentsStrategyTimeBased,
+						MaintenanceWindowDuration: durationpb.New(time.Hour),
+					},
+				},
 			},
 		},
 	}

api/types/autoupdate/constants.go

@@ -0,0 +1,46 @@
+/*
+Copyright 2024 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package autoupdate
+
+const (
+	// ToolsUpdateModeEnabled enables client tools automatic updates.
+	ToolsUpdateModeEnabled = "enabled"
+	// ToolsUpdateModeDisabled disables client tools automatic updates.
+	ToolsUpdateModeDisabled = "disabled"
+
+	// AgentsUpdateModeEnabled enabled agent automatic updates.
+	AgentsUpdateModeEnabled = "enabled"
+	// AgentsUpdateModeDisabled disables agent automatic updates.
+	AgentsUpdateModeDisabled = "disabled"
+	// AgentsUpdateModeSuspended temporarily suspends agent automatic updates.
+	AgentsUpdateModeSuspended = "suspended"
+
+	// AgentsScheduleRegular is the regular agent update schedule.
+	AgentsScheduleRegular = "regular"
+	// AgentsScheduleImmediate is the immediate agent update schedule.
+	// Every agent must update immediately if it's not already running the target version.
+	// This can be used to recover agents in case of major incident or actively exploited vulnerability.
+	AgentsScheduleImmediate = "immediate"
+
+	// AgentsStrategyHaltOnError is the agent update strategy that updates groups sequentially
+	// according to their order in the schedule. The previous groups must succeed.
+	AgentsStrategyHaltOnError = "halt-on-error"
+	// AgentsStrategyTimeBased is the agent update strategy that updates groups solely based on their
+	// maintenance window. There is no dependency between groups. Agents won't be instructed to update
+	// if the window is over.
+	AgentsStrategyTimeBased = "time-based"
+)

api/types/autoupdate/rollout.go

@@ -0,0 +1,76 @@
+/*
+Copyright 2024 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package autoupdate
+
+import (
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	"github.com/gravitational/teleport/api/types"
+)
+
+// NewAutoUpdateAgentRollout creates a new auto update version resource.
+func NewAutoUpdateAgentRollout(spec *autoupdate.AutoUpdateAgentRolloutSpec) (*autoupdate.AutoUpdateAgentRollout, error) {
+	version := &autoupdate.AutoUpdateAgentRollout{
+		Kind:    types.KindAutoUpdateAgentRollout,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: types.MetaNameAutoUpdateAgentRollout,
+		},
+		Spec: spec,
+	}
+	if err := ValidateAutoUpdateAgentRollout(version); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return version, nil
+}
+
+// ValidateAutoUpdateAgentRollout checks that required parameters are set
+// for the specified AutoUpdateAgentRollout.
+func ValidateAutoUpdateAgentRollout(v *autoupdate.AutoUpdateAgentRollout) error {
+	if v == nil {
+		return trace.BadParameter("AutoUpdateAgentRollout is nil")
+	}
+	if v.Metadata == nil {
+		return trace.BadParameter("Metadata is nil")
+	}
+	if v.Metadata.Name != types.MetaNameAutoUpdateAgentRollout {
+		return trace.BadParameter("Name is not valid")
+	}
+	if v.Spec == nil {
+		return trace.BadParameter("Spec is nil")
+	}
+	if err := checkVersion(v.Spec.StartVersion); err != nil {
+		return trace.Wrap(err, "validating spec.start_version")
+	}
+	if err := checkVersion(v.Spec.TargetVersion); err != nil {
+		return trace.Wrap(err, "validating spec.target_version")
+	}
+	if err := checkAgentsMode(v.Spec.AutoupdateMode); err != nil {
+		return trace.Wrap(err, "validating spec.autoupdate_mode")
+	}
+	if err := checkScheduleName(v.Spec.Schedule); err != nil {
+		return trace.Wrap(err, "validating spec.schedule")
+	}
+	if err := checkAgentsStrategy(v.Spec.Strategy); err != nil {
+		return trace.Wrap(err, "validating spec.strategy")
+	}
+
+	return nil
+}