Skip to content
This repository was archived by the owner on Oct 14, 2020. It is now read-only.

Commit 7157ae2

Browse files
nigthknightnigthknight
committed
Split scan_controller in utils and scan_reconciler
To make it easier to refactor the scan_controller we started by splitting it into utils and scan_reconciler.
1 parent dc5a15a commit 7157ae2

File tree

5 files changed

+148
-128
lines changed

5 files changed

+148
-128
lines changed

‎operator/controllers/execution/scan_controller.go‎ renamed to ‎operator/controllers/execution/scans/scan_controller.go‎

Lines changed: 1 addition & 127 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
1414
limitations under the License.
1515
*/
1616

17-
package controllers
17+
package scancontrollers
1818

1919
import (
2020
"context"
@@ -186,26 +186,6 @@ func (r *ScanReconciler) checkIfJobIsCompleted(scan *executionv1.Scan, labels cl
186186
return allJobsCompleted(jobs), nil
187187
}
188188

189-
// Helper functions to check and remove string from a slice of strings.
190-
func containsString(slice []string, s string) bool {
191-
for _, item := range slice {
192-
if item == s {
193-
return true
194-
}
195-
}
196-
return false
197-
}
198-
199-
func removeString(slice []string, s string) (result []string) {
200-
for _, item := range slice {
201-
if item == s {
202-
continue
203-
}
204-
result = append(result, item)
205-
}
206-
return
207-
}
208-
209189
var errNotFound = "The specified key does not exist."
210190

211191
func (r *ScanReconciler) handleFinalizer(scan *executionv1.Scan) error {
@@ -230,112 +210,6 @@ func (r *ScanReconciler) handleFinalizer(scan *executionv1.Scan) error {
230210
return nil
231211
}
232212

233-
func (r *ScanReconciler) startScan(scan *executionv1.Scan) error {
234-
ctx := context.Background()
235-
namespacedName := fmt.Sprintf("%s/%s", scan.Namespace, scan.Name)
236-
log := r.Log.WithValues("scan_init", namespacedName)
237-
238-
jobs, err := r.getJobsForScan(scan, client.MatchingLabels{"experimental.securecodebox.io/job-type": "scanner"})
239-
if err != nil {
240-
return err
241-
}
242-
if len(jobs.Items) > 0 {
243-
log.V(8).Info("Job already exists. Doesn't need to be created.")
244-
return nil
245-
}
246-
247-
// Add s3 storage finalizer to scan
248-
if !containsString(scan.ObjectMeta.Finalizers, s3StorageFinalizer) {
249-
scan.ObjectMeta.Finalizers = append(scan.ObjectMeta.Finalizers, s3StorageFinalizer)
250-
if err := r.Update(context.Background(), scan); err != nil {
251-
return err
252-
}
253-
}
254-
255-
// get the ScanType for the scan
256-
var scanType executionv1.ScanType
257-
if err := r.Get(ctx, types.NamespacedName{Name: scan.Spec.ScanType, Namespace: scan.Namespace}, &scanType); err != nil {
258-
log.V(7).Info("Unable to fetch ScanType")
259-
260-
scan.Status.State = "Errored"
261-
scan.Status.ErrorDescription = fmt.Sprintf("Configured ScanType '%s' not found in Scans Namespace. You'll likely need to deploy the ScanType.", scan.Spec.ScanType)
262-
if err := r.Status().Update(ctx, scan); err != nil {
263-
r.Log.Error(err, "unable to update Scan status")
264-
return err
265-
}
266-
267-
return fmt.Errorf("No ScanType of type '%s' found", scan.Spec.ScanType)
268-
}
269-
log.Info("Matching ScanType Found", "ScanType", scanType.Name)
270-
271-
rules := []rbacv1.PolicyRule{
272-
{
273-
APIGroups: []string{""},
274-
Resources: []string{"pods"},
275-
Verbs: []string{"get"},
276-
},
277-
}
278-
r.ensureServiceAccountExists(
279-
scan.Namespace,
280-
"lurcher",
281-
"Lurcher is used to extract results from secureCodeBox Scans. It needs rights to get and watch the status of pods to see when the scans have finished.",
282-
rules,
283-
)
284-
285-
job, err := r.constructJobForScan(scan, &scanType)
286-
if err != nil {
287-
log.Error(err, "unable to create job object ScanType")
288-
return err
289-
}
290-
291-
log.V(7).Info("Constructed Job object", "job args", strings.Join(job.Spec.Template.Spec.Containers[0].Args, ", "))
292-
293-
if err := r.Create(ctx, job); err != nil {
294-
log.Error(err, "unable to create Job for Scan", "job", job)
295-
return err
296-
}
297-
298-
scan.Status.State = "Scanning"
299-
scan.Status.RawResultType = scanType.Spec.ExtractResults.Type
300-
scan.Status.RawResultFile = filepath.Base(scanType.Spec.ExtractResults.Location)
301-
if err := r.Status().Update(ctx, scan); err != nil {
302-
log.Error(err, "unable to update Scan status")
303-
return err
304-
}
305-
306-
log.V(1).Info("created Job for Scan", "job", job)
307-
return nil
308-
}
309-
310-
// Checking if scan has completed
311-
func (r *ScanReconciler) checkIfScanIsCompleted(scan *executionv1.Scan) error {
312-
ctx := context.Background()
313-
314-
status, err := r.checkIfJobIsCompleted(scan, client.MatchingLabels{"experimental.securecodebox.io/job-type": "scanner"})
315-
if err != nil {
316-
return err
317-
}
318-
319-
switch status {
320-
case completed:
321-
r.Log.V(7).Info("Scan is completed")
322-
scan.Status.State = "ScanCompleted"
323-
if err := r.Status().Update(ctx, scan); err != nil {
324-
r.Log.Error(err, "unable to update Scan status")
325-
return err
326-
}
327-
case failed:
328-
scan.Status.State = "Errored"
329-
scan.Status.ErrorDescription = "Failed to run the Scan Container, check k8s Job and its logs for more details"
330-
if err := r.Status().Update(ctx, scan); err != nil {
331-
r.Log.Error(err, "unable to update Scan status")
332-
return err
333-
}
334-
}
335-
// Either Incomplete or Unknown, nothing we can do, other then giving it some more time...
336-
return nil
337-
}
338-
339213
func (r *ScanReconciler) startParser(scan *executionv1.Scan) error {
340214
ctx := context.Background()
341215
namespacedName := fmt.Sprintf("%s/%s", scan.Namespace, scan.Name)

‎operator/controllers/execution/scans/scan_reconciler.go‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
package scancontrollers
2+
3+
import (
4+
"context"
5+
"fmt"
6+
"path/filepath"
7+
"strings"
8+
9+
executionv1 "github.com/secureCodeBox/secureCodeBox-v2-alpha/operator/apis/execution/v1"
10+
rbacv1 "k8s.io/api/rbac/v1"
11+
"k8s.io/apimachinery/pkg/types"
12+
"sigs.k8s.io/controller-runtime/pkg/client"
13+
)
14+
15+
func (r *ScanReconciler) startScan(scan *executionv1.Scan) error {
16+
ctx := context.Background()
17+
namespacedName := fmt.Sprintf("%s/%s", scan.Namespace, scan.Name)
18+
log := r.Log.WithValues("scan_init", namespacedName)
19+
20+
jobs, err := r.getJobsForScan(scan, client.MatchingLabels{"experimental.securecodebox.io/job-type": "scanner"})
21+
if err != nil {
22+
return err
23+
}
24+
if len(jobs.Items) > 0 {
25+
log.V(8).Info("Job already exists. Doesn't need to be created.")
26+
return nil
27+
}
28+
29+
// Add s3 storage finalizer to scan
30+
if !containsString(scan.ObjectMeta.Finalizers, s3StorageFinalizer) {
31+
scan.ObjectMeta.Finalizers = append(scan.ObjectMeta.Finalizers, s3StorageFinalizer)
32+
if err := r.Update(context.Background(), scan); err != nil {
33+
return err
34+
}
35+
}
36+
37+
// get the ScanType for the scan
38+
var scanType executionv1.ScanType
39+
if err := r.Get(ctx, types.NamespacedName{Name: scan.Spec.ScanType, Namespace: scan.Namespace}, &scanType); err != nil {
40+
log.V(7).Info("Unable to fetch ScanType")
41+
42+
scan.Status.State = "Errored"
43+
scan.Status.ErrorDescription = fmt.Sprintf("Configured ScanType '%s' not found in Scans Namespace. You'll likely need to deploy the ScanType.", scan.Spec.ScanType)
44+
if err := r.Status().Update(ctx, scan); err != nil {
45+
r.Log.Error(err, "unable to update Scan status")
46+
return err
47+
}
48+
49+
return fmt.Errorf("No ScanType of type '%s' found", scan.Spec.ScanType)
50+
}
51+
log.Info("Matching ScanType Found", "ScanType", scanType.Name)
52+
53+
rules := []rbacv1.PolicyRule{
54+
{
55+
APIGroups: []string{""},
56+
Resources: []string{"pods"},
57+
Verbs: []string{"get"},
58+
},
59+
}
60+
r.ensureServiceAccountExists(
61+
scan.Namespace,
62+
"lurcher",
63+
"Lurcher is used to extract results from secureCodeBox Scans. It needs rights to get and watch the status of pods to see when the scans have finished.",
64+
rules,
65+
)
66+
67+
job, err := r.constructJobForScan(scan, &scanType)
68+
if err != nil {
69+
log.Error(err, "unable to create job object ScanType")
70+
return err
71+
}
72+
73+
log.V(7).Info("Constructed Job object", "job args", strings.Join(job.Spec.Template.Spec.Containers[0].Args, ", "))
74+
75+
if err := r.Create(ctx, job); err != nil {
76+
log.Error(err, "unable to create Job for Scan", "job", job)
77+
return err
78+
}
79+
80+
scan.Status.State = "Scanning"
81+
scan.Status.RawResultType = scanType.Spec.ExtractResults.Type
82+
scan.Status.RawResultFile = filepath.Base(scanType.Spec.ExtractResults.Location)
83+
if err := r.Status().Update(ctx, scan); err != nil {
84+
log.Error(err, "unable to update Scan status")
85+
return err
86+
}
87+
88+
log.V(1).Info("created Job for Scan", "job", job)
89+
return nil
90+
}
91+
92+
// Checking if scan has completed
93+
func (r *ScanReconciler) checkIfScanIsCompleted(scan *executionv1.Scan) error {
94+
ctx := context.Background()
95+
96+
status, err := r.checkIfJobIsCompleted(scan, client.MatchingLabels{"experimental.securecodebox.io/job-type": "scanner"})
97+
if err != nil {
98+
return err
99+
}
100+
101+
switch status {
102+
case completed:
103+
r.Log.V(7).Info("Scan is completed")
104+
scan.Status.State = "ScanCompleted"
105+
if err := r.Status().Update(ctx, scan); err != nil {
106+
r.Log.Error(err, "unable to update Scan status")
107+
return err
108+
}
109+
case failed:
110+
scan.Status.State = "Errored"
111+
scan.Status.ErrorDescription = "Failed to run the Scan Container, check k8s Job and its logs for more details"
112+
if err := r.Status().Update(ctx, scan); err != nil {
113+
r.Log.Error(err, "unable to update Scan status")
114+
return err
115+
}
116+
}
117+
// Either Incomplete or Unknown, nothing we can do, other then giving it some more time...
118+
return nil
119+
}

‎operator/controllers/execution/scans/utils.go‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
package scancontrollers
2+
3+
// Helper functions to check and remove string from a slice of strings.
4+
func containsString(slice []string, s string) bool {
5+
for _, item := range slice {
6+
if item == s {
7+
return true
8+
}
9+
}
10+
return false
11+
}
12+
13+
func removeString(slice []string, s string) (result []string) {
14+
for _, item := range slice {
15+
if item == s {
16+
continue
17+
}
18+
result = append(result, item)
19+
}
20+
return
21+
}

‎operator/controllers/execution/scheduledscan_controller.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,11 @@ import (
3232
executionv1 "github.com/secureCodeBox/secureCodeBox-v2-alpha/operator/apis/execution/v1"
3333
)
3434

35+
var (
36+
ownerKey = ".metadata.controller"
37+
apiGVStr = executionv1.GroupVersion.String()
38+
)
39+
3540
// ScheduledScanReconciler reconciles a ScheduledScan object
3641
type ScheduledScanReconciler struct {
3742
client.Client

‎operator/main.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ import (
3030
executionv1 "github.com/secureCodeBox/secureCodeBox-v2-alpha/operator/apis/execution/v1"
3131
targetsv1 "github.com/secureCodeBox/secureCodeBox-v2-alpha/operator/apis/targets/v1"
3232
executioncontroller "github.com/secureCodeBox/secureCodeBox-v2-alpha/operator/controllers/execution"
33+
scancontroller "github.com/secureCodeBox/secureCodeBox-v2-alpha/operator/controllers/execution/scans"
3334
targetscontroller "github.com/secureCodeBox/secureCodeBox-v2-alpha/operator/controllers/targets"
3435
// +kubebuilder:scaffold:imports
3536
)
@@ -71,7 +72,7 @@ func main() {
7172
os.Exit(1)
7273
}
7374

74-
if err = (&executioncontroller.ScanReconciler{
75+
if err = (&scancontroller.ScanReconciler{
7576
Client: mgr.GetClient(),
7677
Log: ctrl.Log.WithName("controllers").WithName("Scan"),
7778
Scheme: mgr.GetScheme(),

0 commit comments

Comments
 (0)