Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clean up Linseed elastic users for non-existent tenants #2930

Merged
merged 8 commits into from
Oct 20, 2023
Merged

Clean up Linseed elastic users for non-existent tenants #2930

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
6d8863c
-Cleanup elastic users that are no longer in use
Josh-Tigera Sep 22, 2023
58da00c
Fix linter failure
Josh-Tigera Oct 16, 2023
cdb9cf5
-Move users cleanup out into new separate "cleanup" controller
Josh-Tigera Oct 18, 2023
da1cb9c
Remove clusterID field
Josh-Tigera Oct 18, 2023
d9f24d4
Remove unused mock function
Josh-Tigera Oct 18, 2023
d176d60
Address PR comments
Josh-Tigera Oct 19, 2023
52fa46c
More PR feedback, migrate users cleanup controller into users package
Josh-Tigera Oct 20, 2023
964ed92
Add missing esClientFn specifier in controller init
Josh-Tigera Oct 20, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 14 additions & 28 deletions pkg/controller/logstorage/elastic/elastic_controller_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -198,7 +198,7 @@ var _ = Describe("LogStorage controller", func() {

Context("LogStorage is nil", func() {
// Run the reconciler, expect no error.
r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, mockESCLICreator, dns.DefaultClusterDomain, readyFlag)
r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, MockESCLICreator, dns.DefaultClusterDomain, readyFlag)
Expect(err).ShouldNot(HaveOccurred())
_, err = r.Reconcile(ctx, reconcile.Request{})
Expect(err).ShouldNot(HaveOccurred())
Expand All @@ -215,7 +215,7 @@ var _ = Describe("LogStorage controller", func() {
})

It("returns an error if the LogStorage resource exists and is not marked for deletion", func() {
r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, mockESCLICreator, dns.DefaultClusterDomain, readyFlag)
r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, MockESCLICreator, dns.DefaultClusterDomain, readyFlag)
Expect(err).ShouldNot(HaveOccurred())
mockStatus.On("SetDegraded", operatorv1.ResourceValidationError, "LogStorage validation failed - cluster type is managed but LogStorage CR still exists", mock.Anything, mock.Anything).Return()
result, err := r.Reconcile(ctx, reconcile.Request{})
Expand All @@ -232,7 +232,7 @@ var _ = Describe("LogStorage controller", func() {
mockStatus.On("ReadyToMonitor")
// mockStatus.On("SetMetaData", mock.Anything).Return()

r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, mockESCLICreator, dns.DefaultClusterDomain, readyFlag)
r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, MockESCLICreator, dns.DefaultClusterDomain, readyFlag)
Expect(err).ShouldNot(HaveOccurred())

ls := &operatorv1.LogStorage{}
Expand Down Expand Up @@ -348,7 +348,7 @@ var _ = Describe("LogStorage controller", func() {
Data: map[string]string{"eck_license_level": string(render.ElasticsearchLicenseTypeEnterprise)},
})).ShouldNot(HaveOccurred())

r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, mockESCLICreator, dns.DefaultClusterDomain, readyFlag)
r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, MockESCLICreator, dns.DefaultClusterDomain, readyFlag)
Expect(err).ShouldNot(HaveOccurred())

mockStatus.On("SetDegraded", operatorv1.ResourceNotReady, "Waiting for Elasticsearch cluster to be operational", mock.Anything, mock.Anything).Return()
Expand Down Expand Up @@ -463,7 +463,7 @@ var _ = Describe("LogStorage controller", func() {
ObjectMeta: metav1.ObjectMeta{Namespace: render.ElasticsearchNamespace, Name: render.OIDCUsersESSecretName},
})).ShouldNot(HaveOccurred())

r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, mockESCLICreator, dns.DefaultClusterDomain, readyFlag)
r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, MockESCLICreator, dns.DefaultClusterDomain, readyFlag)
Expect(err).ShouldNot(HaveOccurred())

mockStatus.On("SetDegraded", operatorv1.ResourceNotReady, "Waiting for Elasticsearch cluster to be operational", mock.Anything, mock.Anything).Return()
Expand Down Expand Up @@ -591,7 +591,7 @@ var _ = Describe("LogStorage controller", func() {
Data: map[string]string{"eck_license_level": string(render.ElasticsearchLicenseTypeEnterprise)},
})).ShouldNot(HaveOccurred())

r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, mockESCLICreator, dns.DefaultClusterDomain, readyFlag)
r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, MockESCLICreator, dns.DefaultClusterDomain, readyFlag)
Expect(err).ShouldNot(HaveOccurred())

// Elasticsearch and kibana secrets are good.
Expand Down Expand Up @@ -635,7 +635,7 @@ var _ = Describe("LogStorage controller", func() {
Expect(err).ShouldNot(HaveOccurred())
Expect(cli.Update(ctx, kbSecret)).ShouldNot(HaveOccurred())

r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, mockESCLICreator, dns.DefaultClusterDomain, readyFlag)
r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, MockESCLICreator, dns.DefaultClusterDomain, readyFlag)
Expect(err).ShouldNot(HaveOccurred())

mockStatus.On("SetDegraded", operatorv1.ResourceNotReady, "Waiting for Elasticsearch cluster to be operational", mock.Anything, mock.Anything).Return()
Expand Down Expand Up @@ -719,7 +719,7 @@ var _ = Describe("LogStorage controller", func() {
Expect(cli.Create(ctx, rec)).ShouldNot(HaveOccurred())
}

r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, mockESCLICreator, dns.DefaultClusterDomain, readyFlag)
r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, MockESCLICreator, dns.DefaultClusterDomain, readyFlag)
Expect(err).ShouldNot(HaveOccurred())

mockStatus.On("SetDegraded", operatorv1.ResourceNotReady, "Waiting for curator secrets to become available", mock.Anything, mock.Anything).Return()
Expand Down Expand Up @@ -759,7 +759,7 @@ var _ = Describe("LogStorage controller", func() {
Data: map[string]string{"eck_license_level": string(render.ElasticsearchLicenseTypeEnterprise)},
})).ShouldNot(HaveOccurred())

r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, mockESCLICreator, dns.DefaultClusterDomain, readyFlag)
r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, MockESCLICreator, dns.DefaultClusterDomain, readyFlag)
Expect(err).ShouldNot(HaveOccurred())

mockStatus.On("SetDegraded", operatorv1.ResourceNotReady, "Waiting for Elasticsearch cluster to be operational", mock.Anything, mock.Anything).Return()
Expand Down Expand Up @@ -830,7 +830,7 @@ var _ = Describe("LogStorage controller", func() {
})

It("should use default images", func() {
r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, mockESCLICreator, dns.DefaultClusterDomain, readyFlag)
r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, MockESCLICreator, dns.DefaultClusterDomain, readyFlag)
Expect(err).ShouldNot(HaveOccurred())

esAdminUserSecret := &corev1.Secret{
Expand Down Expand Up @@ -933,7 +933,7 @@ var _ = Describe("LogStorage controller", func() {
},
},
})).ToNot(HaveOccurred())
r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, mockESCLICreator, dns.DefaultClusterDomain, readyFlag)
r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, MockESCLICreator, dns.DefaultClusterDomain, readyFlag)
Expect(err).ShouldNot(HaveOccurred())

esAdminUserSecret := &corev1.Secret{
Expand Down Expand Up @@ -1056,7 +1056,7 @@ var _ = Describe("LogStorage controller", func() {
// mockStatus.On("SetMetaData", mock.Anything).Return()

var err error
r, err = NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, mockESCLICreator, dns.DefaultClusterDomain, readyFlag)
r, err = NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, MockESCLICreator, dns.DefaultClusterDomain, readyFlag)
Expect(err).ShouldNot(HaveOccurred())
})

Expand All @@ -1065,7 +1065,7 @@ var _ = Describe("LogStorage controller", func() {
})

It("should wait if tier watch is not ready", func() {
r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, mockESCLICreator, dns.DefaultClusterDomain, &utils.ReadyFlag{})
r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, MockESCLICreator, dns.DefaultClusterDomain, &utils.ReadyFlag{})
Expect(err).ShouldNot(HaveOccurred())
utils.ExpectWaitForTierWatch(ctx, r, mockStatus)
})
Expand Down Expand Up @@ -1122,7 +1122,7 @@ var _ = Describe("LogStorage controller", func() {
})

It("deletes Elasticsearch and Kibana then removes the finalizers on the LogStorage CR", func() {
r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, mockESCLICreator, dns.DefaultClusterDomain, readyFlag)
r, err := NewReconcilerWithShims(cli, scheme, mockStatus, operatorv1.ProviderNone, MockESCLICreator, dns.DefaultClusterDomain, readyFlag)
Expect(err).ShouldNot(HaveOccurred())

esAdminUserSecret := &corev1.Secret{
Expand Down Expand Up @@ -1313,17 +1313,3 @@ func CreateLogStorage(client client.Client, ls *operatorv1.LogStorage) {
// Create the LogStorage object.
ExpectWithOffset(1, client.Create(context.Background(), ls)).ShouldNot(HaveOccurred())
}

type mockESClient struct{}

func mockESCLICreator(client client.Client, ctx context.Context, elasticHTTPSEndpoint string) (utils.ElasticClient, error) {
return &mockESClient{}, nil
}

func (m *mockESClient) CreateUser(ctx context.Context, user *utils.User) error {
return fmt.Errorf("CreateUser not implemented in mock client")
}

func (*mockESClient) SetILMPolicies(ctx context.Context, ls *operatorv1.LogStorage) error {
return nil
}
74 changes: 74 additions & 0 deletions pkg/controller/logstorage/elastic/mock.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,74 @@
// Copyright (c) 2020-2023 Tigera, Inc. All rights reserved.

// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package elastic

import (
"context"
"fmt"

"github.com/stretchr/testify/mock"
operatorv1 "github.com/tigera/operator/api/v1"
"github.com/tigera/operator/pkg/controller/utils"
"sigs.k8s.io/controller-runtime/pkg/client"
)

type MockESClientKey string

type MockESClient struct {
mock.Mock
}

func MockESCLICreator(_ client.Client, ctx context.Context, _ string) (utils.ElasticClient, error) {
if esCli := ctx.Value(MockESClientKey("mockESClient")); esCli != nil {
return esCli.(*MockESClient), nil
}
return &MockESClient{}, nil
}

func (m *MockESClient) CreateUser(_ context.Context, _ *utils.User) error {
return fmt.Errorf("CreateUser not implemented in mock client")
}

func (m *MockESClient) SetILMPolicies(_ context.Context, _ *operatorv1.LogStorage) error {
return nil
}

func (m *MockESClient) DeleteRoles(ctx context.Context, roles []utils.Role) error {
var ret mock.Arguments
for _, role := range roles {
ret = m.MethodCalled("deleteRole", ctx, role)
if ret.Error(0) != nil {
return ret.Error(0)
}
}

ret = m.Called(ctx, roles)
return ret.Error(0)
}

func (m *MockESClient) DeleteUser(ctx context.Context, u *utils.User) error {
ret := m.MethodCalled("DeleteRoles", ctx, u.Roles)
if ret.Error(0) != nil {
return ret.Error(0)
}

ret = m.Called(ctx, u)
return ret.Error(0)
}

func (m *MockESClient) GetUsers(ctx context.Context) ([]utils.User, error) {
ret := m.Called(ctx)
return ret.Get(0).([]utils.User), ret.Error(1)
}
Loading