authentik-kubernetes-operator/controller.go

/*
Copyright 2017 The Kubernetes Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package main

import (
	"context"
	"fmt"
	"net/http"
	"slices"
	"strconv"
	"time"

	"golang.org/x/time/rate"

	corev1 "k8s.io/api/core/v1"
	"k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
	"k8s.io/apimachinery/pkg/util/wait"
	"k8s.io/client-go/kubernetes"
	"k8s.io/client-go/kubernetes/scheme"
	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
	"k8s.io/client-go/tools/cache"
	"k8s.io/client-go/tools/record"
	"k8s.io/client-go/util/workqueue"
	"k8s.io/klog/v2"

	v1alpha1 "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/apis/proxyprovider/v1alpha1"
	clientset "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/clientset/versioned"
	operatorscheme "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/clientset/versioned/scheme"
	informers "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/informers/externalversions/proxyprovider/v1alpha1"
	listers "gitea.t000-n.de/t.behrendt/authentik-kubernetes-operator/pkg/generated/listers/proxyprovider/v1alpha1"
	authentikapi "goauthentik.io/api/v3"
)

const controllerAgentName = "proxy-provider-controller"

const (
	SuccessSynced         = "Synced"
	ErrResourceExists     = "ErrResourceExists"
	MessageResourceExists = "Resource %q already exists and is not managed by ProxyProvider"
	MessageResourceSynced = "ProxyProvider synced successfully"
	FieldManager          = controllerAgentName
)

// Finalizers
const (
	DeleteAuthentikProxyProviderFinalizer = "proxyprovider.t000-n.de/delete-authentik-proxyprovider"
)

type Controller struct {
	kubeclientset          kubernetes.Interface
	proxyProviderClientset clientset.Interface
	authentik              *authentikapi.APIClient

	proxyLister listers.ProxyProviderLister
	proxySynced cache.InformerSynced

	workqueue workqueue.TypedRateLimitingInterface[cache.ObjectName]
	recorder  record.EventRecorder
}

func NewController(
	ctx context.Context,
	kubeclientset kubernetes.Interface,
	proxyProviderClientset clientset.Interface,
	authentik *authentikapi.APIClient,
	proxyInformer informers.ProxyProviderInformer,
) *Controller {
	logger := klog.FromContext(ctx)

	utilruntime.Must(operatorscheme.AddToScheme(scheme.Scheme))
	logger.V(4).Info("Creating event broadcaster")

	eventBroadcaster := record.NewBroadcaster(record.WithContext(ctx))
	eventBroadcaster.StartStructuredLogging(0)
	eventBroadcaster.StartRecordingToSink(&typedcorev1.EventSinkImpl{Interface: kubeclientset.CoreV1().Events("")})
	recorder := eventBroadcaster.NewRecorder(scheme.Scheme, corev1.EventSource{Component: controllerAgentName})
	ratelimiter := workqueue.NewTypedMaxOfRateLimiter(
		workqueue.NewTypedItemExponentialFailureRateLimiter[cache.ObjectName](5*time.Millisecond, 1000*time.Second),
		&workqueue.TypedBucketRateLimiter[cache.ObjectName]{Limiter: rate.NewLimiter(rate.Limit(50), 300)},
	)

	c := &Controller{
		kubeclientset:          kubeclientset,
		proxyProviderClientset: proxyProviderClientset,
		authentik:              authentik,
		proxyLister:            proxyInformer.Lister(),
		proxySynced:            proxyInformer.Informer().HasSynced,
		workqueue:              workqueue.NewTypedRateLimitingQueue(ratelimiter),
		recorder:               recorder,
	}

	logger.Info("Setting up event handlers")
	proxyInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
		AddFunc: c.enqueueProxyProvider,
		UpdateFunc: func(_, newObj interface{}) {
			c.enqueueProxyProvider(newObj)
		},
	})

	return c
}

func (c *Controller) Run(ctx context.Context, workers int) error {
	defer utilruntime.HandleCrash()
	defer c.workqueue.ShutDown()
	logger := klog.FromContext(ctx)

	logger.Info("Starting ProxyProvider controller")

	logger.Info("Waiting for informer caches to sync")
	if ok := cache.WaitForCacheSync(ctx.Done(), c.proxySynced); !ok {
		return fmt.Errorf("failed to wait for caches to sync")
	}

	logger.Info("Starting workers", "count", workers)
	for i := 0; i < workers; i++ {
		go wait.UntilWithContext(ctx, c.runWorker, time.Second)
	}

	logger.Info("Started workers")
	<-ctx.Done()
	logger.Info("Shutting down workers")
	return nil
}

func (c *Controller) runWorker(ctx context.Context) {
	for c.processNextWorkItem(ctx) {
	}
}

func (c *Controller) processNextWorkItem(ctx context.Context) bool {
	objRef, shutdown := c.workqueue.Get()
	logger := klog.FromContext(ctx)
	if shutdown {
		return false
	}
	defer c.workqueue.Done(objRef)

	err := c.syncHandler(ctx, objRef)
	if err == nil {
		c.workqueue.Forget(objRef)
		logger.Info("Successfully synced", "objectName", objRef)
		return true
	}
	utilruntime.HandleErrorWithContext(ctx, err, "Error syncing; requeuing for later retry", "objectReference", objRef)
	c.workqueue.AddRateLimited(objRef)
	return true
}

func (c *Controller) syncHandler(ctx context.Context, objectRef cache.ObjectName) error {
	logger := klog.LoggerWithValues(klog.FromContext(ctx), "objectRef", objectRef)

	pp, err := c.proxyLister.ProxyProviders(objectRef.Namespace).Get(objectRef.Name)
	if err != nil {
		if errors.IsNotFound(err) {
			logger.V(4).Info("ProxyProvider no longer exists")
			return nil
		}
		return err
	}
	logger.V(4).Info("sync ProxyProvider", "name", pp.Name)

	if !pp.ObjectMeta.DeletionTimestamp.IsZero() {
		logger.Info("Reconciling deletion of ProxyProvider", "name", pp.Name)
		return c.reconcileDelete(ctx, pp)
	}

	if pp.Status.PK == "" {
		logger.Info("Reconciling creation of ProxyProvider", "name", pp.Name)
		return c.reconcileCreate(ctx, pp)
	}

	// Check if all finalizers are present. If not, we add them. Same pattern as above, just needs a helper function to check for presence of a finalizer.
	if !slices.Contains(pp.ObjectMeta.Finalizers, DeleteAuthentikProxyProviderFinalizer) {
		logger.Info("Ensuring finalizers are present", "name", pp.Name)
		return c.ensureFinalizers(ctx, pp)
	}

	logger.Info("Reconciling update of ProxyProvider", "name", pp.Name)
	return c.reconcileUpdate(ctx, pp)
}

func (c *Controller) ensureFinalizers(ctx context.Context, pp *v1alpha1.ProxyProvider) error {
	pp.ObjectMeta.Finalizers = append(pp.ObjectMeta.Finalizers, DeleteAuthentikProxyProviderFinalizer)
	return c.updateProxyProvider(ctx, pp)
}

func (c *Controller) reconcileDelete(ctx context.Context, pp *v1alpha1.ProxyProvider) error {
	pk, err := strconv.ParseInt(pp.Status.PK, 10, 32)
	if err != nil {
		return fmt.Errorf("error parsing PK: %v", err)
	}

	r, err := c.authentik.ProvidersApi.ProvidersProxyDestroy(ctx, int32(pk)).Execute()
	if err != nil {
		// This handles an edge-case, where when the ProxyProvider on Authentik has already been deleted, but the finalizer is still present. We just remove the finalizer and return.
		if r != nil && r.StatusCode != http.StatusNotFound {
			return fmt.Errorf("error when calling `ProvidersAPI.ProvidersProxyDestroy`: %w with response %v", err, r)
		}
	}

	pp.ObjectMeta.Finalizers = slices.Delete(pp.ObjectMeta.Finalizers, slices.Index(pp.ObjectMeta.Finalizers, DeleteAuthentikProxyProviderFinalizer), 1)
	return c.updateProxyProvider(ctx, pp)
}

func (c *Controller) reconcileUpdate(ctx context.Context, pp *v1alpha1.ProxyProvider) error {
	// We retrieve the existing PP from the API by slug.
	pk, err := strconv.ParseInt(pp.Status.PK, 10, 32)
	if err != nil {
		return fmt.Errorf("error parsing PK: %v", err)
	}
	_, r, err := c.authentik.ProvidersApi.ProvidersAllRetrieve(ctx, int32(pk)).Execute()
	if err != nil {
		if r != nil && r.StatusCode == http.StatusNotFound {
			// This handles an edge-case, where when the PorxyProvider on Authentik has been deleted, e.g. by mistake. We just remove the PK and return.
			// During the next reconciliation, the ProxyProvider will be re-created.
			pp.Status.PK = ""
			return c.updateProxyProviderStatus(ctx, pp)
		}
		return fmt.Errorf("error retrieving existing ProxyProvider: %v with response %v", err, r)
	}

	proxyProviderRequest := &authentikapi.PatchedProxyProviderRequest{
		Name:              &pp.Spec.Name,
		AuthorizationFlow: &pp.Spec.AuthorizationFlow,
		InvalidationFlow:  &pp.Spec.InvalidationFlow,
		ExternalHost:      &pp.Spec.ExternalHost,
		Mode:              authentikapi.PROXYMODE_FORWARD_SINGLE.Ptr(),
	}
	resp, r, err := c.authentik.ProvidersApi.ProvidersProxyPartialUpdate(ctx, int32(pk)).PatchedProxyProviderRequest(*proxyProviderRequest).Execute()
	if err != nil {
		return fmt.Errorf("error when calling `ProvidersAPI.ProvidersProxyPartialUpdate`: %w with response %v", err, r)
	}

	pp.Status.PK = strconv.Itoa(int(resp.Pk))

	return c.updateProxyProviderStatus(ctx, pp)
}

func (c *Controller) reconcileCreate(ctx context.Context, pp *v1alpha1.ProxyProvider) error {
	proxyProviderRequest := &authentikapi.ProxyProviderRequest{
		Name:              pp.Spec.Name,
		AuthorizationFlow: pp.Spec.AuthorizationFlow,
		InvalidationFlow:  pp.Spec.InvalidationFlow,
		ExternalHost:      pp.Spec.ExternalHost,
		Mode:              authentikapi.PROXYMODE_FORWARD_SINGLE.Ptr(),
	}
	resp, r, err := c.authentik.ProvidersApi.ProvidersProxyCreate(ctx).ProxyProviderRequest(*proxyProviderRequest).Execute()
	if err != nil {
		return fmt.Errorf("error when calling `ProvidersAPI.ProvidersProxyCreate`: %w with response %v", err, r)
	}

	pp.Status.PK = strconv.Itoa(int(resp.Pk))
	return c.updateProxyProviderStatus(ctx, pp)
}

func (c *Controller) enqueueProxyProvider(obj interface{}) {
	objectRef, err := cache.ObjectToName(obj)
	if err != nil {
		utilruntime.HandleError(err)
		return
	}
	c.workqueue.Add(objectRef)
}

func (c *Controller) updateProxyProviderStatus(ctx context.Context, pp *v1alpha1.ProxyProvider) error {
	ppCopy := pp.DeepCopy()
	_, err := c.proxyProviderClientset.ProxyproviderV1alpha1().ProxyProviders(ppCopy.Namespace).UpdateStatus(ctx, ppCopy, metav1.UpdateOptions{FieldManager: FieldManager})
	return err
}

// Update metadata, spec, etc. of the ProxyProvider object.
func (c *Controller) updateProxyProvider(ctx context.Context, pp *v1alpha1.ProxyProvider) error {
	ppCopy := pp.DeepCopy()
	_, err := c.proxyProviderClientset.ProxyproviderV1alpha1().ProxyProviders(ppCopy.Namespace).Update(ctx, ppCopy, metav1.UpdateOptions{FieldManager: FieldManager})
	if err != nil {
		return fmt.Errorf("error updating ProxyProvider metadata: %v", err)
	}
	return nil
}