Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor: policy common reconciliation logic in a subreconciler #796

Merged

Conversation

fabriziosestito
Copy link
Contributor

@fabriziosestito fabriziosestito commented Jul 5, 2024

Description

This PR refactors and groups the common policy reconciliation logic in a subreconciler, removing the admission package and the Reconciler "god class" leftover.
To learn more about the subreconciler pattern, refer to this

It also removes the packages policyserver and naming and fixes some issues with the setPolicyStatus error handling:

func setPolicyStatus(ctx context.Context, deploymentsNamespace string, apiReader client.Reader, policy policiesv1.Policy) error {

Fixes #774, fixes #773

@fabriziosestito fabriziosestito force-pushed the refactor/policy-reconciler branch 2 times, most recently from b666f0d to abf3dfe Compare July 5, 2024 10:48
Copy link

codecov bot commented Jul 5, 2024

Codecov Report

Attention: Patch coverage is 80.00000% with 69 lines in your changes missing coverage. Please review.

Project coverage is 70.25%. Comparing base (a331d8d) to head (0005c69).

Files Patch % Lines
internal/controller/policy_subreconciler.go 75.87% 33 Missing and 15 partials ⚠️
...nternal/controller/policy_subreconciler_webhook.go 83.63% 14 Missing and 4 partials ⚠️
api/policies/v1/policyserver_webhook.go 83.33% 1 Missing and 1 partial ⚠️
internal/controller/admissionpolicy_controller.go 90.90% 0 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #796      +/-   ##
==========================================
+ Coverage   70.02%   70.25%   +0.22%     
==========================================
  Files          23       19       -4     
  Lines        1705     1708       +3     
==========================================
+ Hits         1194     1200       +6     
+ Misses        394      389       -5     
- Partials      117      119       +2     
Flag Coverage Δ
integration-tests 61.88% <77.10%> (+<0.01%) ⬆️
unit-tests 39.86% <83.33%> (+7.96%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@fabriziosestito fabriziosestito force-pushed the refactor/policy-reconciler branch 3 times, most recently from aa89739 to f42c548 Compare July 8, 2024 07:49
@fabriziosestito fabriziosestito marked this pull request as ready for review July 8, 2024 08:30
@fabriziosestito fabriziosestito requested a review from a team as a code owner July 8, 2024 08:30
@fabriziosestito fabriziosestito added this to the 1.15 milestone Jul 8, 2024
@fabriziosestito fabriziosestito self-assigned this Jul 8, 2024
@fabriziosestito fabriziosestito force-pushed the refactor/policy-reconciler branch from 06c62b8 to 42bdfaf Compare July 8, 2024 13:03
Copy link
Member

@jvanz jvanz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. But I have a question about one field in the reconcilers

Scheme *runtime.Scheme
Reconciler admission.Reconciler
Log logr.Logger
Scheme *runtime.Scheme
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cannot we remove the Scheme field and get it, when necessary, from the client?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This comes from the kubebuilder scaffolding. I could find the rationale here: kubernetes-sigs/kubebuilder#986

Copy link
Member

@flavio flavio left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks really good to me. I just left some minor comments

internal/controller/policy_subreconciler.go Show resolved Hide resolved
internal/controller/policy_subreconciler.go Show resolved Hide resolved
Copy link
Member

@viccuad viccuad left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I expected a different approach for the subreconciler pattern, one like the example from here:

  subreconcilersForPolicy := []subreconciler.FnWithRequest{
    r.setStatusToUnknown,
    r.addFinalizer,
    r.handleDelete,
    r.updateStatus,
  }

  // Run all subreconcilers sequentially
  for _, f := range subreconcilersForPolicy {
    if r, err := f(ctx, req); subreconciler.ShouldHaltOrRequeue(r, err) {
      return subreconciler.Evaluate(r, err)
    }
  }

I don't consider it a blocker though.

We need to also update docs/crds/Makefile for make generate to work, the resulting crd docs are part of the release artifacts.

@fabriziosestito
Copy link
Contributor Author

fabriziosestito commented Jul 9, 2024

I expected a different approach for the subreconciler pattern, one like the example from here:

  subreconcilersForPolicy := []subreconciler.FnWithRequest{
    r.setStatusToUnknown,
    r.addFinalizer,
    r.handleDelete,
    r.updateStatus,
  }

  // Run all subreconcilers sequentially
  for _, f := range subreconcilersForPolicy {
    if r, err := f(ctx, req); subreconciler.ShouldHaltOrRequeue(r, err) {
      return subreconciler.Evaluate(r, err)
    }
  }

This example is using a helper library. I linked the blog post to show the pattern of splitting and sharing reconciliation methods, if you look at the first example in the blog post a subreconciler is just a method. I personally don't want to introduce a dependency to a library, which is an opinionated take on the pattern just for this, but I am open to consider it in the future if the code becomes more complex (for instance, it could be useful when we will add the Policy Groups).

We need to also update docs/crds/Makefile for make generate to work, the resulting crd docs are part > of the release artifacts.

Done in: 5900152

…PolicySubReconciler

Signed-off-by: Fabrizio Sestito <fabrizio.sestito@suse.com>
…ciler

Signed-off-by: Fabrizio Sestito <fabrizio.sestito@suse.com>
Signed-off-by: Fabrizio Sestito <fabrizio.sestito@suse.com>
Signed-off-by: Fabrizio Sestito <fabrizio.sestito@suse.com>
Signed-off-by: Fabrizio Sestito <fabrizio.sestito@suse.com>
…ret validation in the policy server reconciler, move validation to policyserver webhook

Signed-off-by: Fabrizio Sestito <fabrizio.sestito@suse.com>
Signed-off-by: Fabrizio Sestito <fabrizio.sestito@suse.com>
Signed-off-by: Fabrizio Sestito <fabrizio.sestito@suse.com>
Signed-off-by: Fabrizio Sestito <fabrizio.sestito@suse.com>
Signed-off-by: Fabrizio Sestito <fabrizio.sestito@suse.com>
@fabriziosestito fabriziosestito force-pushed the refactor/policy-reconciler branch from 5900152 to 0005c69 Compare July 10, 2024 06:30
Copy link
Member

@viccuad viccuad left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM modulo the others.

@flavio
Copy link
Member

flavio commented Jul 10, 2024

I think we're good to go. Ship it 🚀

@fabriziosestito fabriziosestito merged commit b22a243 into kubewarden:main Jul 10, 2024
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

Remove usage of multiple clients Split the Reconciler struct
4 participants