Add LifecyclePolicy field to Repository (#22)

a-hilaly · web-flow · commit cb725af8d093 · 2021-11-17T10:25:45.000-08:00
aws-controllers-k8s/community#1043 Description of changes: - Add `LifecyclePolicy` field to `Repository` resource - e2e tests for updates or creation of repositories with lifecycle policies By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
diff --git a/apis/v1alpha1/ack-generate-metadata.yaml b/apis/v1alpha1/ack-generate-metadata.yaml
@@ -1,13 +1,13 @@
 ack_generate_info:
-  build_date: "2021-10-27T21:20:07Z"
-  build_hash: d2b063806d25cfcae4f2d4eb44f8e3f713b23e8e
-  go_version: go1.15
+  build_date: "2021-11-16T14:08:50Z"
+  build_hash: ff5700c3e093082af2cbb53a461acb94ab1674d9
+  go_version: go1.16.4
   version: v0.15.2
-api_directory_checksum: 3c829828db77ef587929da78f41d52b2459fb054
+api_directory_checksum: aa86a638fe9bbdb47b2f0cad0e82abafcff8571e
 api_version: v1alpha1
 aws_sdk_go_version: v1.38.35
 generator_config_info:
-  file_checksum: b271840866f91cb16dbad00532c85716620cbbee
+  file_checksum: 746fd9f662f685e64ba766c60ac6c5bb5eea7524
   original_file_name: generator.yaml
 last_modification:
   reason: API generation
diff --git a/apis/v1alpha1/generator.yaml b/apis/v1alpha1/generator.yaml
@@ -7,6 +7,10 @@ resources:
         from:
           operation: CreateRepository
           path: RepositoryName
+      LifecyclePolicy:
+        from:
+          operation: PutLifecyclePolicy
+          path: LifecyclePolicyText
     renames:
       operations:
         CreateRepository:
@@ -25,5 +29,8 @@ resources:
     list_operation:
       match_fields:
         - Name
+    hooks:
+      sdk_read_many_post_set_output:
+        template_path: hooks/repository/sdk_read_many_post_set_output.go.tpl
     update_operation:
-      custom_method_name: customUpdateRepository
+      custom_method_name: customUpdateRepository
diff --git a/apis/v1alpha1/repository.go b/apis/v1alpha1/repository.go
diff --git a/apis/v1alpha1/zz_generated.deepcopy.go b/apis/v1alpha1/zz_generated.deepcopy.go
diff --git a/config/crd/bases/ecr.services.k8s.aws_repositories.yaml b/config/crd/bases/ecr.services.k8s.aws_repositories.yaml
@@ -62,6 +62,9 @@ spec:
                   all image tags within the repository will be immutable which will
                   prevent them from being overwritten.
                 type: string
+              lifecyclePolicy:
+                description: The JSON repository policy text to apply to the repository.
+                type: string
               name:
                 description: The name to use for the repository. The repository name
                   may be specified on its own (such as nginx-web-app) or it can be
diff --git a/generator.yaml b/generator.yaml
@@ -7,6 +7,10 @@ resources:
         from:
           operation: CreateRepository
           path: RepositoryName
+      LifecyclePolicy:
+        from:
+          operation: PutLifecyclePolicy
+          path: LifecyclePolicyText
     renames:
       operations:
         CreateRepository:
@@ -25,5 +29,8 @@ resources:
     list_operation:
       match_fields:
         - Name
+    hooks:
+      sdk_read_many_post_set_output:
+        template_path: hooks/repository/sdk_read_many_post_set_output.go.tpl
     update_operation:
-      custom_method_name: customUpdateRepository
+      custom_method_name: customUpdateRepository
diff --git a/helm/crds/ecr.services.k8s.aws_repositories.yaml b/helm/crds/ecr.services.k8s.aws_repositories.yaml
@@ -62,6 +62,9 @@ spec:
                   all image tags within the repository will be immutable which will
                   prevent them from being overwritten.
                 type: string
+              lifecyclePolicy:
+                description: The JSON repository policy text to apply to the repository.
+                type: string
               name:
                 description: The name to use for the repository. The repository name
                   may be specified on its own (such as nginx-web-app) or it can be
diff --git a/pkg/resource/repository/custom_update_api.go b/pkg/resource/repository/custom_update_api.go
@@ -66,6 +66,12 @@ func (rm *resourceManager) customUpdateRepository(
 			return nil, err
 		}
 	}
+	if delta.DifferentAt("Spec.LifecyclePolicy") {
+		updated, err = rm.updateLifecyclePolicy(ctx, updated)
+		if err != nil {
+			return nil, err
+		}
+	}
 	return updated, nil
 }
 
@@ -131,3 +137,61 @@ func (rm *resourceManager) updateImageTagMutability(
 	}
 	return desired, nil
 }
+
+// updateLifecyclePolicy calls the PutLifecyclePolicy ECR API call for a
+// specific repository
+func (rm *resourceManager) updateLifecyclePolicy(
+	ctx context.Context,
+	desired *resource,
+) (*resource, error) {
+	var err error
+	rlog := ackrtlog.FromContext(ctx)
+	exit := rlog.Trace("rm.updateRepositoryLifecyclePolicy")
+	defer exit(err)
+
+	dspec := desired.ko.Spec
+	dstatus := desired.ko.Status
+
+	if dspec.LifecyclePolicy == nil || *dspec.LifecyclePolicy == "" {
+		return rm.deleteLifecyclePolicy(ctx, desired)
+	}
+
+	input := &svcsdk.PutLifecyclePolicyInput{
+		RepositoryName:      aws.String(*dspec.Name),
+		RegistryId:          aws.String(*dstatus.RegistryID),
+		LifecyclePolicyText: aws.String(*dspec.LifecyclePolicy),
+	}
+
+	_, err = rm.sdkapi.PutLifecyclePolicyWithContext(ctx, input)
+	rm.metrics.RecordAPICall("UPDATE", "PutLifecyclePolicy", err)
+	if err != nil {
+		return nil, err
+	}
+	return desired, nil
+}
+
+// deleteLifecyclePolicy calls the DeleteLifecyclePolicy ECR API call for a
+// specific repository
+func (rm *resourceManager) deleteLifecyclePolicy(
+	ctx context.Context,
+	desired *resource,
+) (*resource, error) {
+	var err error
+	rlog := ackrtlog.FromContext(ctx)
+	exit := rlog.Trace("rm.deleteLifecyclePolicy")
+	defer exit(err)
+
+	dspec := desired.ko.Spec
+	dstatus := desired.ko.Status
+	input := &svcsdk.DeleteLifecyclePolicyInput{
+		RepositoryName: aws.String(*dspec.Name),
+		RegistryId:     aws.String(*dstatus.RegistryID),
+	}
+
+	_, err = rm.sdkapi.DeleteLifecyclePolicyWithContext(ctx, input)
+	rm.metrics.RecordAPICall("DELETE", "DeleteLifecyclePolicy", err)
+	if err != nil {
+		return nil, err
+	}
+	return desired, nil
+}
diff --git a/pkg/resource/repository/delta.go b/pkg/resource/repository/delta.go
diff --git a/pkg/resource/repository/hook.go b/pkg/resource/repository/hook.go
@@ -0,0 +1,32 @@
+package repository
+
+import (
+	"context"
+
+	svcapitypes "github.com/aws-controllers-k8s/ecr-controller/apis/v1alpha1"
+	ackrtlog "github.com/aws-controllers-k8s/runtime/pkg/runtime/log"
+	svcsdk "github.com/aws/aws-sdk-go/service/ecr"
+)
+
+// setResourceAdditionalFields will describe the fields that are not return by
+// DescribeRepository calls
+func (rm *resourceManager) setResourceAdditionalFields(
+	ctx context.Context,
+	r *resource,
+	ko *svcapitypes.Repository,
+) (err error) {
+	rlog := ackrtlog.FromContext(ctx)
+	exit := rlog.Trace("rm.setResourceAdditionalFields")
+	defer exit(err)
+
+	getLifecyclePolicyResponse, err := rm.sdkapi.GetLifecyclePolicyWithContext(
+		ctx,
+		&svcsdk.GetLifecyclePolicyInput{
+			RepositoryName: r.ko.Spec.Name,
+			RegistryId:     r.ko.Status.RegistryID,
+		},
+	)
+	rm.metrics.RecordAPICall("GET", "GetLifecyclePolicy", err)
+	ko.Spec.LifecyclePolicy = getLifecyclePolicyResponse.LifecyclePolicyText
+	return nil
+}
diff --git a/pkg/resource/repository/sdk.go b/pkg/resource/repository/sdk.go
diff --git a/templates/hooks/repository/sdk_read_many_post_set_output.go.tpl b/templates/hooks/repository/sdk_read_many_post_set_output.go.tpl
@@ -0,0 +1,3 @@
+	if err := rm.setResourceAdditionalFields(ctx, r, ko); err != nil {
+		return nil, err
+	}
diff --git a/test/e2e/resources/repository_lifecycle_policy.yaml b/test/e2e/resources/repository_lifecycle_policy.yaml
@@ -0,0 +1,10 @@
+apiVersion: ecr.services.k8s.aws/v1alpha1
+kind: Repository
+metadata:
+  name: $REPOSITORY_NAME
+spec:
+  name: $REPOSITORY_NAME
+  imageScanningConfiguration:
+    scanOnPush: false
+  imageTagMutability: MUTABLE
+  lifecyclePolicy: '{"rules":[{"rulePriority":1,"description":"Expire images older than 14 days","selection":{"tagStatus":"untagged","countType":"sinceImagePushed","countUnit":"days","countNumber":14},"action":{"type":"expire"}}]}'
diff --git a/test/e2e/tests/test_repository.py b/test/e2e/tests/test_repository.py
@@ -32,6 +32,9 @@
 UPDATE_WAIT_AFTER_SECONDS = 10
 DELETE_WAIT_AFTER_SECONDS = 10
 
+LIFECYCLE_POLICY_FILTERING_ON_IMAGE_AGE = '{"rules":[{"rulePriority":1,"description":"Expire images older than 14 days","selection":'\
+    '{"tagStatus":"untagged","countType":"sinceImagePushed","countUnit":"days","countNumber":14},"action":{"type":"expire"}}]}'
+
 @pytest.fixture(scope="module")
 def ecr_client():
     return boto3.client("ecr")
@@ -40,10 +43,10 @@ def ecr_client():
 @pytest.mark.canary
 class TestRepository:
 
-    def get_repository(self, ecr_client, repositoryName: str) -> dict:
+    def get_repository(self, ecr_client, repository_name: str) -> dict:
         try:
             resp = ecr_client.describe_repositories(
-                repositoryNames=[repositoryName]
+                repositoryNames=[repository_name]
             )
         except Exception as e:
             logging.debug(e)
@@ -52,15 +55,29 @@ def get_repository(self, ecr_client, repositoryName: str) -> dict:
         
         repositories = resp["repositories"]
         for repository in repositories:
-            if repository["repositoryName"] == repositoryName:
+            if repository["repositoryName"] == repository_name:
                 return repository
 
         return None
 
-    def repository_exists(self, ecr_client, repositoryName: str) -> bool:
-        return self.get_repository(ecr_client, repositoryName) is not None
+    def get_lifecycle_policy(self, ecr_client, repository_name: str, registry_id: str) -> str:
+        try:
+            resp = ecr_client.get_lifecycle_policy(
+                repositoryName=repository_name,
+                registryId=registry_id,
+            )
+            return resp['lifecyclePolicyText']
+        except Exception as e:
+            logging.debug(e)
+            return ""
+
+    def repository_exists(self, ecr_client, repository_name: str) -> bool:
+        return self.get_repository(ecr_client, repository_name) is not None
 
     def test_smoke(self, ecr_client):
+        self.test_basic_repository(ecr_client=ecr_client)
+
+    def test_basic_repository(self, ecr_client):
         resource_name = random_suffix_name("ecr-repository", 24)
 
         replacements = REPLACEMENT_VALUES.copy()
@@ -111,3 +128,55 @@ def test_smoke(self, ecr_client):
         exists = self.repository_exists(ecr_client, resource_name)
         assert not exists
 
+    def test_repository_lifecycle_policy(self, ecr_client):
+        resource_name = random_suffix_name("ecr-repository", 24)
+
+        replacements = REPLACEMENT_VALUES.copy()
+        replacements["REPOSITORY_NAME"] = resource_name
+        # Load ECR CR
+        resource_data = load_ecr_resource(
+            "repository_lifecycle_policy",
+            additional_replacements=replacements,
+        )
+        logging.debug(resource_data)
+
+        # Create k8s resource
+        ref = k8s.CustomResourceReference(
+            CRD_GROUP, CRD_VERSION, RESOURCE_PLURAL,
+            resource_name, namespace="default",
+        )
+        k8s.create_custom_resource(ref, resource_data)
+        cr = k8s.wait_resource_consumed_by_controller(ref)
+
+        assert cr is not None
+        assert k8s.get_resource_exists(ref)
+
+        time.sleep(CREATE_WAIT_AFTER_SECONDS)
+
+        # Check ECR repository exists
+        repo = self.repository_exists(ecr_client, resource_name)
+        assert repo is not None
+
+        # Check ECR repository lifecycle policy exists
+        lifecycle_policy = self.get_lifecycle_policy(ecr_client, resource_name, cr["status"]["registryID"])
+        assert lifecycle_policy == LIFECYCLE_POLICY_FILTERING_ON_IMAGE_AGE
+
+        # Remove lifecycle policy
+        cr["spec"]["lifecyclePolicy"] = ""
+
+        # Patch k8s resource
+        k8s.patch_custom_resource(ref, cr)
+        time.sleep(UPDATE_WAIT_AFTER_SECONDS)
+
+        lifecycle_policy = self.get_lifecycle_policy(ecr_client, resource_name, cr["status"]["registryID"])
+        assert lifecycle_policy == ""
+
+        # Delete k8s resource
+        _, deleted = k8s.delete_custom_resource(ref)
+        assert deleted is True
+
+        time.sleep(DELETE_WAIT_AFTER_SECONDS)
+
+        # Check ECR repository doesn't exists
+        exists = self.repository_exists(ecr_client, resource_name)
+        assert not exists
