PoC rework ensure

internal/controller/common/action/base_action.go

@@ -10,9 +10,12 @@ import (
 	"strings"
 	"time"
 
+	"github.com/securesign/operator/internal/apis"
 	"github.com/securesign/operator/internal/controller/annotations"
+	"github.com/securesign/operator/internal/controller/constants"
 	"k8s.io/apimachinery/pkg/api/equality"
 	apiErrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/util/retry"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
@@ -62,6 +65,7 @@ func (action *BaseAction) StatusUpdate(ctx context.Context, obj client2.Object)
 	return &Result{Result: reconcile.Result{Requeue: false}}
 }
 
+// Deprecated: Use Error function
 func (action *BaseAction) Failed(err error) *Result {
 	action.Logger.Error(err, "error during action execution")
 	return &Result{
@@ -70,6 +74,25 @@ func (action *BaseAction) Failed(err error) *Result {
 	}
 }
 
+func (action *BaseAction) Error(ctx context.Context, err error, instance apis.ConditionsAwareObject) *Result {
+	if errors.Is(err, reconcile.TerminalError(err)) {
+		instance.SetCondition(metav1.Condition{
+			Type:    constants.Ready,
+			Status:  metav1.ConditionFalse,
+			Reason:  constants.Failure,
+			Message: err.Error(),
+		})
+		if updateErr := action.Client.Status().Update(ctx, instance); updateErr != nil {
+			err = errors.Join(err, updateErr)
+		}
+	}
+	action.Logger.Error(err, "error during action execution")
+	return &Result{
+		Err: err,
+	}
+}
+
+// Deprecated: Use Error function with TerminalError passed as an argument
 func (action *BaseAction) FailedWithStatusUpdate(ctx context.Context, err error, instance client2.Object) *Result {
 	if e := action.Client.Status().Update(ctx, instance); e != nil {
 		if strings.Contains(err.Error(), OptimisticLockErrorMsg) {
@@ -96,6 +119,7 @@ func (action *BaseAction) Requeue() *Result {
 	}
 }
 
+// Deprecated: Use kubernetes.CreateOrUpdate function
 func (action *BaseAction) Ensure(ctx context.Context, obj client2.Object, opts ...EnsureOption) (bool, error) {
 	var (
 		expected client2.Object

internal/controller/common/utils/ensure.go

@@ -0,0 +1,24 @@
+package utils
+
+import (
+	"golang.org/x/exp/maps"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+func EnsureLabels(obj client.Object, labels map[string]string) {
+	if obj.GetLabels() == nil {
+		obj.SetLabels(labels)
+		return
+	}
+
+	maps.Copy(obj.GetLabels(), labels)
+}
+
+func EnsureAnnotations(obj client.Object, annotations map[string]string) {
+	if obj.GetAnnotations() == nil {
+		obj.GetAnnotations()
+		return
+	}
+
+	maps.Copy(obj.GetAnnotations(), annotations)
+}

internal/controller/common/utils/kubernetes/common.go

@@ -9,7 +9,11 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/securesign/operator/internal/controller/annotations"
+	apiErrors "k8s.io/apimachinery/pkg/api/errors"
 	k8sLabels "k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/util/retry"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
 	v13 "github.com/openshift/api/operator/v1"
 	"github.com/securesign/operator/internal/controller/common/utils"
@@ -133,3 +137,23 @@ func FindByLabelSelector(ctx context.Context, c client.Client, list client.Objec
 
 	return c.List(ctx, list, client.InNamespace(namespace), listOptions)
 }
+
+func CreateOrUpdate[T client.Object](ctx context.Context, cli client.Client, obj T, fn func(object T) error) (result controllerutil.OperationResult, err error) {
+	err = retry.OnError(retry.DefaultRetry, func(err error) bool {
+		return apiErrors.IsConflict(err) || apiErrors.IsAlreadyExists(err)
+	}, func() error {
+		var createUpdateError error
+		result, createUpdateError = controllerutil.CreateOrUpdate(ctx, cli, obj, func() error {
+			annoStr, find := obj.GetAnnotations()[annotations.PausedReconciliation]
+			if find {
+				annoBool, _ := strconv.ParseBool(annoStr)
+				if annoBool {
+					return nil
+				}
+			}
+			return fn(obj)
+		})
+		return createUpdateError
+	})
+	return
+}

internal/controller/tuf/actions/deployment.go

@@ -6,11 +6,15 @@ import (
 
 	rhtasv1alpha1 "github.com/securesign/operator/api/v1alpha1"
 	"github.com/securesign/operator/internal/controller/common/action"
+	"github.com/securesign/operator/internal/controller/common/utils"
+	"github.com/securesign/operator/internal/controller/common/utils/kubernetes"
 	"github.com/securesign/operator/internal/controller/constants"
 	"github.com/securesign/operator/internal/controller/labels"
-	tufutils "github.com/securesign/operator/internal/controller/tuf/utils"
+	v1 "k8s.io/api/apps/v1"
+	core "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 )
 
@@ -32,34 +36,105 @@ func (i deployAction) CanHandle(_ context.Context, tuf *rhtasv1alpha1.Tuf) bool
 }
 
 func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.Tuf) *action.Result {
-	var (
-		updated bool
-		err     error
-	)
-
 	labels := labels.For(ComponentName, DeploymentName, instance.Name)
 
-	dp := tufutils.CreateTufDeployment(instance, DeploymentName, RBACName, labels)
-
-	if err = controllerutil.SetControllerReference(instance, dp, i.Client.Scheme()); err != nil {
-		return i.Failed(fmt.Errorf("could not set controller reference for Deployment: %w", err))
-	}
-
-	if updated, err = i.Ensure(ctx, dp); err != nil {
-		meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
-			Type:    constants.Ready,
-			Status:  metav1.ConditionFalse,
-			Reason:  constants.Failure,
-			Message: err.Error(),
-		})
-		return i.FailedWithStatusUpdate(ctx, fmt.Errorf("could not create TUF: %w", err), instance)
+	var (
+		result controllerutil.OperationResult
+		err    error
+	)
+	if result, err = kubernetes.CreateOrUpdate(ctx, i.Client,
+		&v1.Deployment{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      DeploymentName,
+				Namespace: instance.Namespace,
+			},
+		}, i.createTufDeployment(instance, RBACName, labels)); err != nil {
+		return i.Error(ctx, fmt.Errorf("could not create TUF: %w", err), instance)
 	}
 
-	if updated {
+	if result != controllerutil.OperationResultNone {
 		meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{Type: constants.Ready,
 			Status: metav1.ConditionFalse, Reason: constants.Creating, Message: "Deployment created"})
 		return i.StatusUpdate(ctx, instance)
 	} else {
 		return i.Continue()
 	}
 }
+
+func (i deployAction) createTufDeployment(instance *rhtasv1alpha1.Tuf, sa string, labels map[string]string) func(*v1.Deployment) error {
+	return func(dp *v1.Deployment) error {
+		if err := controllerutil.SetControllerReference(instance, dp, i.Client.Scheme()); err != nil {
+			return fmt.Errorf("could not set controller reference for Deployment: %w", err)
+		}
+		utils.EnsureLabels(dp, labels)
+
+		spec := &dp.Spec
+		spec.Replicas = utils.Pointer[int32](1)
+		spec.Selector = &metav1.LabelSelector{
+			MatchLabels: labels,
+		}
+		spec.Strategy = v1.DeploymentStrategy{
+			Type: "Recreate",
+		}
+
+		template := &spec.Template
+		template.Labels = labels
+		template.Spec.ServiceAccountName = sa
+
+		if template.Spec.Volumes == nil {
+			template.Spec.Volumes = make([]core.Volume, 1)
+		}
+		volume := &template.Spec.Volumes[0]
+		volume.Name = "repository"
+		volume.VolumeSource = core.VolumeSource{
+			PersistentVolumeClaim: &core.PersistentVolumeClaimVolumeSource{
+				ClaimName: instance.Status.PvcName,
+			},
+		}
+
+		if template.Spec.Containers == nil {
+			template.Spec.Containers = make([]core.Container, 1)
+		}
+		container := &template.Spec.Containers[0]
+		container.Name = "tuf-server"
+		container.Image = constants.HttpServerImage
+		container.Ports = []core.ContainerPort{
+			{
+				Protocol:      core.ProtocolTCP,
+				ContainerPort: 8080,
+			},
+		}
+
+		container.VolumeMounts = []core.VolumeMount{
+			{
+				Name:      "repository",
+				MountPath: "/var/www/html",
+				// let user upload manual update using `oc rsync` command
+				ReadOnly: false,
+			}}
+
+		if container.LivenessProbe == nil {
+			container.LivenessProbe = &core.Probe{}
+		}
+		// server is running returning any status code (including 403 - noindex.html)
+		container.LivenessProbe.Exec = &core.ExecAction{Command: []string{"curl", "localhost:8080"}}
+		container.LivenessProbe.InitialDelaySeconds = 30
+		container.LivenessProbe.PeriodSeconds = 10
+
+		if container.ReadinessProbe == nil {
+			container.ReadinessProbe = &core.Probe{}
+		}
+		container.ReadinessProbe.HTTPGet = &core.HTTPGetAction{
+			Path:   "/root.json",
+			Port:   intstr.FromInt32(8080),
+			Scheme: "HTTP",
+		}
+		container.ReadinessProbe.InitialDelaySeconds = 10
+		container.ReadinessProbe.PeriodSeconds = 10
+		container.ReadinessProbe.FailureThreshold = 10
+
+		utils.SetProxyEnvs(dp)
+
+		return nil
+	}
+}