plugin_controller.go

// SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Greenhouse contributors
// SPDX-License-Identifier: Apache-2.0

package plugin

import (
	"context"
	"errors"
	"fmt"
	"maps"
	"strings"

	"helm.sh/helm/v3/pkg/release"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/fields"
	"k8s.io/apimachinery/pkg/types"
	"k8s.io/cli-runtime/pkg/genericclioptions"
	ctrl "sigs.k8s.io/controller-runtime"
	"sigs.k8s.io/controller-runtime/pkg/builder"
	"sigs.k8s.io/controller-runtime/pkg/client"
	"sigs.k8s.io/controller-runtime/pkg/controller"
	"sigs.k8s.io/controller-runtime/pkg/handler"
	"sigs.k8s.io/controller-runtime/pkg/predicate"

	helmv2 "github.com/fluxcd/helm-controller/api/v2"

	greenhouseapis "github.com/cloudoperators/greenhouse/api"
	greenhousev1alpha1 "github.com/cloudoperators/greenhouse/api/v1alpha1"
	"github.com/cloudoperators/greenhouse/internal/clientutil"
	"github.com/cloudoperators/greenhouse/internal/common"
	"github.com/cloudoperators/greenhouse/internal/helm"
	"github.com/cloudoperators/greenhouse/internal/util"
	"github.com/cloudoperators/greenhouse/pkg/lifecycle"
)

// PluginReconciler reconciles a Plugin object.
type PluginReconciler struct {
	client.Client
	KubeRuntimeOpts             clientutil.RuntimeOptions
	kubeClientOpts              []clientutil.KubeClientOption
	ExpressionEvaluationEnabled bool
	IntegrationEnabled          bool
	OCIMirroringEnabled         bool
}

//+kubebuilder:rbac:groups=greenhouse.sap,resources=plugindefinitions,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups=greenhouse.sap,resources=clusterplugindefinitions,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups=greenhouse.sap,resources=plugins,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups=greenhouse.sap,resources=plugins/status;,verbs=get;update;patch
//+kubebuilder:rbac:groups=greenhouse.sap,resources=plugins/finalizers,verbs=update
//+kubebuilder:rbac:groups=greenhouse.sap,resources=clusters;teams,verbs=get;list;watch
//+kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch
//+kubebuilder:rbac:groups="events.k8s.io",resources=events,verbs=get;list;watch;create;patch;update
// +kubebuilder:rbac:groups=helm.toolkit.fluxcd.io,resources=helmreleases,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=helm.toolkit.fluxcd.io,resources=helmreleases/status,verbs=get;update;patch
// +kubebuilder:rbac:groups=helm.toolkit.fluxcd.io,resources=helmreleases/finalizers,verbs=get;create;update;patch;delete
// +kubebuilder:rbac:groups=source.toolkit.fluxcd.io,resources=helmcharts,verbs=get;list;watch
// +kubebuilder:rbac:groups=source.toolkit.fluxcd.io,resources=ocirepositories,verbs=get;list;watch
// +kubebuilder:rbac:groups="events.k8s.io",resources=events,verbs=create;patch

// These broad permissions are required as the controller manages Helm charts which contain arbitrary Kubernetes resources.
//+kubebuilder:rbac:groups=*,resources=*,verbs=*

// SetupWithManager sets up the controller with the Manager.
func (r *PluginReconciler) SetupWithManager(name string, mgr ctrl.Manager) error {
	r.Client = mgr.GetClient()
	r.kubeClientOpts = []clientutil.KubeClientOption{
		clientutil.WithRuntimeOptions(r.KubeRuntimeOpts),
		clientutil.WithPersistentConfig(),
	}

	// index Plugins by the ClusterName field for faster lookups
	if err := mgr.GetFieldIndexer().IndexField(context.Background(), &greenhousev1alpha1.Plugin{}, greenhouseapis.PluginClusterNameField, func(rawObj client.Object) []string {
		// Extract the TeamRole name from the TeamRoleBinding Spec, if one is provided
		plugin, ok := rawObj.(*greenhousev1alpha1.Plugin)
		if plugin.Spec.ClusterName == "" || !ok {
			return nil
		}
		return []string{plugin.Spec.ClusterName}
	}); err != nil {
		return err
	}

	return ctrl.NewControllerManagedBy(mgr).
		Named(name).
		WithOptions(controller.Options{
			MaxConcurrentReconciles: 10,
		}).
		For(&greenhousev1alpha1.Plugin{}).
		// Reconcile on owned flux HelmRelease changes.
		Owns(&helmv2.HelmRelease{}).
		// If a ClusterPluginDefinition was changed, reconcile relevant Plugins.
		Watches(
			&greenhousev1alpha1.ClusterPluginDefinition{},
			handler.EnqueueRequestsFromMapFunc(r.enqueueAllPluginsForClusterPluginDefinition),
		).
		// If a PluginDefinition was changed, reconcile relevant Plugins.
		Watches(
			&greenhousev1alpha1.PluginDefinition{},
			handler.EnqueueRequestsFromMapFunc(r.enqueueAllPluginsForPluginDefinition),
		).
		// Clusters and teams are passed as values to each Helm operation. Reconcile on change.
		Watches(
			&greenhousev1alpha1.Cluster{},
			handler.EnqueueRequestsFromMapFunc(r.enqueueAllPluginsForCluster),
		).
		Watches(
			&greenhousev1alpha1.Team{},
			handler.EnqueueRequestsFromMapFunc(r.enqueueAllPluginsInNamespace),
			builder.WithPredicates(predicate.GenerationChangedPredicate{}),
		).
		Complete(r)
}

func (r *PluginReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
	return lifecycle.Reconcile(ctx, r.Client, req.NamespacedName, &greenhousev1alpha1.Plugin{}, r, r.setConditions())
}

func (r *PluginReconciler) setConditions() lifecycle.Conditioner {
	return func(ctx context.Context, resource lifecycle.RuntimeObject) {
		logger := ctrl.LoggerFrom(ctx)
		plugin, ok := resource.(*greenhousev1alpha1.Plugin)
		if !ok {
			logger.Error(errors.New("resource is not a Plugin"), "status setup failed")
			return
		}

		readyCondition := r.computeReadyConditionFlux(ctx, plugin)
		UpdatePluginReadyMetric(plugin, readyCondition.Status == metav1.ConditionTrue)

		ownerLabelCondition := util.ComputeOwnerLabelCondition(ctx, r.Client, plugin)
		util.UpdateOwnedByLabelMissingMetric(plugin, ownerLabelCondition.IsFalse())

		plugin.Status.SetConditions(readyCondition, ownerLabelCondition)
	}
}

// reconcileTechnicalLabels ensures the plugin has the correct technical labels based on its status.
func (r *PluginReconciler) reconcileTechnicalLabels(ctx context.Context, plugin *greenhousev1alpha1.Plugin) error {
	_, err := clientutil.Patch(ctx, r.Client, plugin, func() error {
		labels := plugin.GetLabels()
		if labels == nil {
			labels = make(map[string]string)
		}

		if plugin.Status.UIApplication != nil {
			labels[greenhouseapis.LabelKeyUIPlugin] = "true"
		} else {
			delete(labels, greenhouseapis.LabelKeyUIPlugin)
		}

		if len(plugin.Status.ExposedServices) > 0 {
			labels[greenhouseapis.LabelKeyPluginExposedServices] = "true"
		} else {
			delete(labels, greenhouseapis.LabelKeyPluginExposedServices)
		}

		plugin.SetLabels(labels)

		return nil
	})

	return err
}

func (r *PluginReconciler) EnsureDeleted(ctx context.Context, resource lifecycle.RuntimeObject) (ctrl.Result, lifecycle.ReconcileResult, error) {
	plugin := resource.(*greenhousev1alpha1.Plugin)
	return r.EnsureFluxDeleted(ctx, plugin)
}

func (r *PluginReconciler) EnsureCreated(ctx context.Context, resource lifecycle.RuntimeObject) (ctrl.Result, lifecycle.ReconcileResult, error) {
	plugin := resource.(*greenhousev1alpha1.Plugin)
	InitPluginStatus(plugin)
	// Check if we should continue with reconciliation or requeue if cluster is scheduled for deletion
	result, err := shouldReconcileOrRequeue(ctx, r.Client, plugin)
	if err != nil {
		return ctrl.Result{}, lifecycle.Failed, err
	}
	if result != nil {
		return ctrl.Result{RequeueAfter: result.requeueAfter}, lifecycle.Pending, nil
	}
	return r.EnsureFluxCreated(ctx, plugin)
}

func (r *PluginReconciler) EnsureSuspended(ctx context.Context, resource lifecycle.RuntimeObject) (ctrl.Result, error) {
	plugin := resource.(*greenhousev1alpha1.Plugin)
	return r.EnsureFluxSuspended(ctx, plugin)
}

// enqueueAllPluginsForCluster enqueues all Plugins which have .spec.clusterName set to the name of the given Cluster.
func (r *PluginReconciler) enqueueAllPluginsForCluster(ctx context.Context, o client.Object) []ctrl.Request {
	listOpts := &client.ListOptions{
		FieldSelector: fields.OneTermEqualSelector(greenhouseapis.PluginClusterNameField, o.GetName()),
		Namespace:     o.GetNamespace(),
	}
	return ListPluginsAsReconcileRequests(ctx, r.Client, listOpts)
}

func (r *PluginReconciler) enqueueAllPluginsInNamespace(ctx context.Context, o client.Object) []ctrl.Request {
	return ListPluginsAsReconcileRequests(ctx, r.Client, client.InNamespace(o.GetNamespace()))
}

func (r *PluginReconciler) enqueueAllPluginsForClusterPluginDefinition(ctx context.Context, o client.Object) []ctrl.Request {
	return ListPluginsAsReconcileRequests(
		ctx,
		r.Client,
		client.MatchingLabels{greenhouseapis.LabelKeyClusterPluginDefinition: o.GetName()},
	)
}

func (r *PluginReconciler) enqueueAllPluginsForPluginDefinition(ctx context.Context, o client.Object) []ctrl.Request {
	return ListPluginsAsReconcileRequests(
		ctx,
		r.Client,
		client.MatchingLabels{greenhouseapis.LabelKeyPluginDefinition: o.GetName()},
		client.InNamespace(o.GetNamespace()),
	)
}

func ListPluginsAsReconcileRequests(ctx context.Context, c client.Client, listOpts ...client.ListOption) []ctrl.Request {
	var pluginList = new(greenhousev1alpha1.PluginList)
	if err := c.List(ctx, pluginList, listOpts...); err != nil {
		ctrl.LoggerFrom(ctx).Error(err, "failed to list Plugins for reconcile requests")
		return nil
	}
	res := make([]ctrl.Request, len(pluginList.Items))
	for idx, plugin := range pluginList.Items {
		namespacedName := types.NamespacedName{Namespace: plugin.GetNamespace(), Name: plugin.GetName()}
		res[idx] = ctrl.Request{NamespacedName: namespacedName}
	}
	return res
}

// getExposedServicesForPluginFromHelmRelease returns a map of exposed services for a plugin from a Helm release.
// The exposed services are collected from Helm release manifest and not from the template to make sure they are deployed.
func getExposedServicesForPluginFromHelmRelease(restClientGetter genericclioptions.RESTClientGetter, helmRelease *release.Release, plugin *greenhousev1alpha1.Plugin) (map[string]greenhousev1alpha1.Service, error) {
	// Collect exposed services from the manifest.
	exposedServiceList, err := helm.ObjectMapFromRelease(restClientGetter, helmRelease, &helm.ManifestObjectFilter{
		APIVersion: "v1",
		Kind:       "Service",
		Annotations: map[string]string{
			greenhouseapis.AnnotationKeyExpose: "true",
		},
	})
	if err != nil {
		return nil, err
	}
	var exposedServices = make(map[string]greenhousev1alpha1.Service)
	if len(exposedServiceList) == 0 {
		return exposedServices, nil
	}
	if plugin.Spec.ClusterName == "" {
		return nil, errors.New("plugin does not have ClusterName")
	}
	for _, svc := range exposedServiceList {
		svcPort, err := getPortForExposedService(svc.Object)
		if err != nil {
			return nil, err
		}
		namespace := svc.Namespace
		if namespace == "" {
			namespace = helmRelease.Namespace // default namespace to release namespace
		}
		exposedURL := common.URLForExposedServiceInPlugin(svc.Name, plugin)
		exposedServices[exposedURL] = greenhousev1alpha1.Service{
			Namespace: namespace,
			Name:      svc.Name,
			Protocol:  svcPort.AppProtocol,
			Port:      svcPort.Port,
			Type:      greenhousev1alpha1.ServiceTypeService,
		}
	}
	return exposedServices, nil
}

// getExposedIngressesForPluginFromHelmRelease discovers ingress resources from a Helm release that are marked for exposure.
// It searches for ingresses with the annotation "greenhouse.sap/expose": "true" and extracts their URLs.
//
// For each discovered ingress:
// - Automatically detects HTTPS protocol based on TLS configuration
// - Selects the host using greenhouse.sap/exposed-host annotation or defaults to the first host rule
// - Constructs complete URLs with protocol (http:// or https://)
// - Returns them as Service entries with type ServiceTypeIngress (port set to 0 as not applicable)
//
// The function filters ingresses from the Helm release manifest (not templates) to ensure they are actually deployed.
func getExposedIngressesForPluginFromHelmRelease(restClientGetter genericclioptions.RESTClientGetter, helmRelease *release.Release) (map[string]greenhousev1alpha1.Service, error) {
	exposedIngressList, err := helm.ObjectMapFromRelease(restClientGetter, helmRelease, &helm.ManifestObjectFilter{
		APIVersion: "v1",
		Kind:       "Ingress",
		Annotations: map[string]string{
			greenhouseapis.AnnotationKeyExpose: "true",
		},
	})
	if err != nil {
		return nil, err
	}

	var exposedServices = make(map[string]greenhousev1alpha1.Service)
	for _, ingress := range exposedIngressList {
		fullURL, err := getURLForExposedIngress(ingress.Object)
		if err != nil {
			return nil, err
		}

		namespace := ingress.Namespace
		if namespace == "" {
			namespace = helmRelease.Namespace
		}

		exposedServices[fullURL] = greenhousev1alpha1.Service{
			Namespace: namespace,
			Name:      ingress.Name,
			Type:      greenhousev1alpha1.ServiceTypeIngress,
		}
	}
	return exposedServices, nil
}

// getAllExposedServicesForPlugin aggregates all exposed services and ingresses for a plugin from its Helm release.
// This function combines two types of exposures into a unified map for Plugin.status.exposedServices:
//
// 1. Services (ServiceTypeService): Exposed via service-proxy for internal routing
//   - Discovered from services with "greenhouse.sap/expose" annotation
//   - URLs are generated using the service-proxy pattern
//
// 2. Ingresses (ServiceTypeIngress): Exposed directly via external URLs
//   - Discovered from ingresses with "greenhouse.sap/expose" annotation
//   - URLs are the actual ingress hostnames with proper protocol (http/https)
//   - Protocol automatically detected from TLS configuration
//
// If either service or ingress discovery encounters an error, the entire operation fails.
func getAllExposedServicesForPlugin(restClientGetter genericclioptions.RESTClientGetter, helmRelease *release.Release, plugin *greenhousev1alpha1.Plugin, exposeServices bool) (map[string]greenhousev1alpha1.Service, error) {
	var errorMessages []string
	exposedServices := make(map[string]greenhousev1alpha1.Service)

	if exposeServices {
		serviceList, err := getExposedServicesForPluginFromHelmRelease(restClientGetter, helmRelease, plugin)
		if err != nil {
			errorMessages = append(errorMessages, "services: "+err.Error())
		} else {
			maps.Copy(exposedServices, serviceList)
		}
	}

	ingressList, err := getExposedIngressesForPluginFromHelmRelease(restClientGetter, helmRelease)
	if err != nil {
		errorMessages = append(errorMessages, "ingresses: "+err.Error())
	} else {
		maps.Copy(exposedServices, ingressList)
	}

	if len(errorMessages) > 0 {
		return nil, fmt.Errorf("failed to get exposed resources: %s", strings.Join(errorMessages, "; "))
	}

	return exposedServices, nil
}