feat: reconcile PostgreSQLInstance dependencies

2026-09-10 18:15:50 +00:00
parent 0101de3ffa
commit 97f66669a6
9 changed files with 484 additions and 10 deletions
@@ -0,0 +1,216 @@
+/*
+Copyright 2026.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package instance validates PostgreSQLInstance dependencies and initializes
+// the controller registry without exposing administrative credentials.
+package instance
+
+import (
+	"context"
+	"errors"
+	"net"
+	"net/url"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+	kubernetesauth "github.com/openbao/openbao/api/auth/kubernetes/v2"
+	openbao "github.com/openbao/openbao/api/v2"
+	"k8s.io/apimachinery/pkg/util/validation"
+
+	databasev1alpha1 "git.ddupan.top/panxiao81/postgresql-tenant-operator/api/v1alpha1"
+	"git.ddupan.top/panxiao81/postgresql-tenant-operator/internal/postgresql/registry"
+)
+
+// Config contains the deployment-level settings needed by Instance readiness.
+type Config struct {
+	OpenBaoAddress          string
+	OpenBaoConsumerAddress  string
+	OpenBaoAuthMount        string
+	OpenBaoAuthRole         string
+	ServiceAccountTokenPath string
+	OpenBaoKVMount          string
+	OpenBaoTenantBasePath   string
+	ExternalSecretStoreName string
+	PostgreSQLCABundlePath  string
+	Timeout                 time.Duration
+}
+
+// Initializer implements the Instance validation and registry phases.
+type Initializer struct{ config Config }
+
+type failure struct {
+	reason  string
+	message string
+}
+
+func (e failure) Error() string           { return e.message }
+func (e failure) ConditionReason() string { return e.reason }
+
+func dependencyFailure(message string) error {
+	return failure{reason: databasev1alpha1.ReasonDependencyUnavailable, message: message}
+}
+
+func authenticationFailure(message string) error {
+	return failure{reason: databasev1alpha1.ReasonAuthenticationFailed, message: message}
+}
+
+func privilegeFailure(message string) error {
+	return failure{reason: databasev1alpha1.ReasonInsufficientPrivileges, message: message}
+}
+
+// New validates config and constructs an Initializer.
+func New(config Config) (*Initializer, error) {
+	if config.OpenBaoAddress == "" || config.OpenBaoAuthRole == "" || config.OpenBaoAuthMount == "" ||
+		config.ServiceAccountTokenPath == "" || config.OpenBaoKVMount == "" || config.OpenBaoTenantBasePath == "" ||
+		config.ExternalSecretStoreName == "" || config.Timeout <= 0 {
+		return nil, errors.New("initialize instance dependencies: required configuration is missing")
+	}
+	if err := validateAddress(config.OpenBaoAddress); err != nil {
+		return nil, err
+	}
+	if config.OpenBaoConsumerAddress == "" {
+		config.OpenBaoConsumerAddress = config.OpenBaoAddress
+	}
+	if err := validateAddress(config.OpenBaoConsumerAddress); err != nil {
+		return nil, err
+	}
+	if !filepath.IsAbs(config.ServiceAccountTokenPath) || validateRelativePath(config.OpenBaoAuthMount, false) != nil ||
+		validateRelativePath(config.OpenBaoKVMount, false) != nil || validateRelativePath(config.OpenBaoTenantBasePath, true) != nil ||
+		len(validation.IsDNS1123Subdomain(config.ExternalSecretStoreName)) != 0 {
+		return nil, errors.New("initialize instance dependencies: invalid path or resource name configuration")
+	}
+	return &Initializer{config: config}, nil
+}
+
+// Validate authenticates to OpenBao, reads the administrative credential, and
+// verifies that PostgreSQL accepts it. It returns only public server metadata.
+func (i *Initializer) Validate(ctx context.Context, instance *databasev1alpha1.PostgreSQLInstance) (string, error) {
+	pool, err := i.connect(ctx, instance)
+	if err != nil {
+		return "", err
+	}
+	defer pool.Close()
+
+	var version string
+	if err := pool.QueryRow(ctx, "SHOW server_version").Scan(&version); err != nil {
+		return "", errors.New("validate PostgreSQL server metadata")
+	}
+	return version, nil
+}
+
+// InitializeRegistry repeats dependency validation and applies registry migrations.
+func (i *Initializer) InitializeRegistry(ctx context.Context, instance *databasev1alpha1.PostgreSQLInstance) (string, error) {
+	pool, err := i.connect(ctx, instance)
+	if err != nil {
+		return "", err
+	}
+	defer pool.Close()
+
+	if err := registry.NewStore(pool).Bootstrap(ctx); err != nil {
+		return "", privilegeFailure("initialize PostgreSQL registry")
+	}
+	var version string
+	if err := pool.QueryRow(ctx, "SHOW server_version").Scan(&version); err != nil {
+		return "", errors.New("validate PostgreSQL server metadata")
+	}
+	return version, nil
+}
+
+func (i *Initializer) connect(ctx context.Context, instance *databasev1alpha1.PostgreSQLInstance) (*pgxpool.Pool, error) {
+	if instance.Spec.Endpoint.SSLMode != databasev1alpha1.PostgreSQLSSLModeDisable && i.config.PostgreSQLCABundlePath == "" {
+		return nil, errors.New("configure PostgreSQL TLS: CA bundle path is required")
+	}
+	ctx, cancel := context.WithTimeout(ctx, i.config.Timeout)
+	defer cancel()
+
+	clientConfig := openbao.DefaultConfig()
+	clientConfig.Address = i.config.OpenBaoAddress
+	clientConfig.Timeout = i.config.Timeout
+	clientConfig.DisableEnvironment = true
+	client, err := openbao.NewClient(clientConfig)
+	if err != nil {
+		return nil, dependencyFailure("create OpenBao client")
+	}
+	auth, err := kubernetesauth.NewKubernetesAuth(
+		i.config.OpenBaoAuthRole,
+		kubernetesauth.WithMountPath(i.config.OpenBaoAuthMount),
+		kubernetesauth.WithServiceAccountTokenPath(i.config.ServiceAccountTokenPath),
+	)
+	if err != nil {
+		return nil, errors.New("configure OpenBao Kubernetes authentication")
+	}
+	if secret, err := client.Auth().Login(ctx, auth); err != nil || secret == nil || secret.Auth == nil {
+		return nil, authenticationFailure("authenticate to OpenBao")
+	}
+
+	secret, err := client.KVv2(i.config.OpenBaoKVMount).Get(ctx, instance.Spec.AdminCredentialRef.Path)
+	if err != nil {
+		return nil, privilegeFailure("read PostgreSQL administrative credential")
+	}
+	username, usernameOK := secret.Data[instance.Spec.AdminCredentialRef.UsernameKey].(string)
+	password, passwordOK := secret.Data[instance.Spec.AdminCredentialRef.PasswordKey].(string)
+	if !usernameOK || !passwordOK || username == "" || password == "" {
+		return nil, errors.New("read PostgreSQL administrative credential fields")
+	}
+
+	connectionURL := &url.URL{
+		Scheme: "postgresql",
+		User:   url.UserPassword(username, password),
+		Host:   net.JoinHostPort(instance.Spec.Endpoint.Host, strconv.Itoa(int(instance.Spec.Endpoint.Port))),
+		Path:   instance.Spec.Endpoint.Database,
+	}
+	query := connectionURL.Query()
+	query.Set("sslmode", string(instance.Spec.Endpoint.SSLMode))
+	if instance.Spec.Endpoint.SSLMode != databasev1alpha1.PostgreSQLSSLModeDisable {
+		query.Set("sslrootcert", i.config.PostgreSQLCABundlePath)
+	}
+	connectionURL.RawQuery = query.Encode()
+	poolConfig, err := pgxpool.ParseConfig(connectionURL.String())
+	if err != nil {
+		return nil, errors.New("configure PostgreSQL connection")
+	}
+	pool, err := pgxpool.NewWithConfig(ctx, poolConfig)
+	if err != nil {
+		return nil, errors.New("connect to PostgreSQL")
+	}
+	if err := pool.Ping(ctx); err != nil {
+		pool.Close()
+		return nil, authenticationFailure("authenticate to PostgreSQL")
+	}
+	return pool, nil
+}
+
+func validateAddress(value string) error {
+	parsed, err := url.Parse(value)
+	if err != nil || !parsed.IsAbs() || (parsed.Scheme != "http" && parsed.Scheme != "https") || parsed.Host == "" ||
+		parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" {
+		return errors.New("initialize instance dependencies: invalid OpenBao address")
+	}
+	return nil
+}
+
+func validateRelativePath(value string, rejectAPILayer bool) error {
+	for index, segment := range strings.Split(value, "/") {
+		if segment == "" || segment == "." || segment == ".." ||
+			(rejectAPILayer && index == 0 && (segment == "data" || segment == "metadata")) {
+			return errors.New("invalid mount-relative path")
+		}
+	}
+	return nil
+}