refactor: support direct rule evaluation (#450)

## Issue
N/S

## Description
Refactor to support direct, in-process evaluation of AWS rules.

Required by:
- validator-labs/validatorctl#102

Related:
- validator-labs/validator-plugin-network#239

---------

Signed-off-by: Tyler Gillson <tyler.gillson@gmail.com>

Author: TylerGillson

api/v1alpha1/awsvalidator_types.go

@@ -21,6 +21,8 @@ import (
 	"strings"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/validator-labs/validator-plugin-aws/pkg/constants"
 )
 
 // AwsValidatorSpec defines the desired state of AwsValidator
@@ -50,6 +52,11 @@ type AwsValidatorSpec struct {
 	TagRules []TagRule `json:"tagRules,omitempty" yaml:"tagRules,omitempty"`
 }
 
+// PluginCode returns the network validator's plugin code.
+func (s AwsValidatorSpec) PluginCode() string {
+	return constants.PluginCode
+}
+
 // ResultCount returns the number of validation results expected for an AwsValidatorSpec.
 func (s AwsValidatorSpec) ResultCount() int {
 	return len(s.AmiRules) + len(s.IamGroupRules) + len(s.IamPolicyRules) + len(s.IamRoleRules) +
@@ -237,6 +244,16 @@ type AwsValidator struct {
 	Status AwsValidatorStatus `json:"status,omitempty"`
 }
 
+// PluginCode returns the AWS validator's plugin code.
+func (v AwsValidator) PluginCode() string {
+	return v.Spec.PluginCode()
+}
+
+// ResultCount returns the number of validation results expected for an AwsValidator.
+func (v AwsValidator) ResultCount() int {
+	return v.Spec.ResultCount()
+}
+
 //+kubebuilder:object:root=true
 
 // AwsValidatorList contains a list of AwsValidator

go.mod

@@ -18,7 +18,7 @@ require (
 	github.com/onsi/ginkgo/v2 v2.19.1
 	github.com/onsi/gomega v1.34.1
 	github.com/pkg/errors v0.9.1
-	github.com/validator-labs/validator v0.1.0
+	github.com/validator-labs/validator v0.1.1
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
 	k8s.io/api v0.30.3
 	k8s.io/apimachinery v0.30.3
@@ -97,3 +97,5 @@ require (
 	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
 	sigs.k8s.io/yaml v1.4.0 // indirect
 )
+
+// replace github.com/validator-labs/validator => ../validator

go.sum

@@ -190,8 +190,8 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/validator-labs/validator v0.1.0 h1:GVekIT5sG+kcyUbT04qb/pURmd9eE6NNKnSR9yJ1sQk=
-github.com/validator-labs/validator v0.1.0/go.mod h1:OeJMHGKW3pWGkvKxHLN7HzjelSILJg2k8w3Z9SdML1g=
+github.com/validator-labs/validator v0.1.1 h1:BzUWeSAP5eGHX2oOulJWZxXr+Zz6Uh6ZqP5sYudnv3I=
+github.com/validator-labs/validator v0.1.1/go.mod h1:to8CMM+LlTcEzbqxVyHND9/uJO2+ORTFk9ovqVOnCU8=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=

internal/controller/awsvalidator_controller.go

@@ -19,32 +19,22 @@ package controller
 
 import (
 	"context"
-	"fmt"
 	"os"
 	"time"
 
 	"github.com/go-logr/logr"
 	"github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
 	apierrs "k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	ktypes "k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/cluster-api/util/patch"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	"github.com/validator-labs/validator-plugin-aws/api/v1alpha1"
-	"github.com/validator-labs/validator-plugin-aws/internal/aws"
-	"github.com/validator-labs/validator-plugin-aws/internal/constants"
-	"github.com/validator-labs/validator-plugin-aws/internal/validators"
-	"github.com/validator-labs/validator-plugin-aws/internal/validators/ami"
-	"github.com/validator-labs/validator-plugin-aws/internal/validators/iam"
-	"github.com/validator-labs/validator-plugin-aws/internal/validators/servicequota"
-	"github.com/validator-labs/validator-plugin-aws/internal/validators/tag"
+	"github.com/validator-labs/validator-plugin-aws/pkg/validate"
 	vapi "github.com/validator-labs/validator/api/v1alpha1"
-	"github.com/validator-labs/validator/pkg/types"
-	"github.com/validator-labs/validator/pkg/util"
 	vres "github.com/validator-labs/validator/pkg/validationresult"
 )
 
@@ -95,16 +85,16 @@ func (r *AwsValidatorReconciler) Reconcile(ctx context.Context, req ctrl.Request
 		return ctrl.Result{}, err
 	}
 	nn := ktypes.NamespacedName{
-		Name:      validationResultName(validator),
+		Name:      vres.Name(validator),
 		Namespace: req.Namespace,
 	}
 	if err := r.Get(ctx, nn, vr); err == nil {
-		vres.HandleExistingValidationResult(vr, r.Log)
+		vres.HandleExisting(vr, r.Log)
 	} else {
 		if !apierrs.IsNotFound(err) {
 			l.Error(err, "unexpected error getting ValidationResult")
 		}
-		if err := vres.HandleNewValidationResult(ctx, r.Client, p, buildValidationResult(validator), r.Log); err != nil {
+		if err := vres.HandleNew(ctx, r.Client, p, vres.Build(validator), r.Log); err != nil {
 			return ctrl.Result{}, err
 		}
 		return ctrl.Result{RequeueAfter: time.Millisecond}, nil
@@ -113,111 +103,11 @@ func (r *AwsValidatorReconciler) Reconcile(ctx context.Context, req ctrl.Request
 	// Always update the expected result count in case the validator's rules have changed
 	vr.Spec.ExpectedResults = validator.Spec.ResultCount()
 
-	resp := types.ValidationResponse{
-		ValidationRuleResults: make([]*types.ValidationRuleResult, 0, vr.Spec.ExpectedResults),
-		ValidationRuleErrors:  make([]error, 0, vr.Spec.ExpectedResults),
-	}
-
-	// AMI rules
-	for _, rule := range validator.Spec.AmiRules {
-		awsAPI, err := aws.NewAPI(validator.Spec.Auth, rule.Region)
-		if err != nil {
-			errMsg := "Failed to reconcile AMI rule"
-			r.Log.V(0).Error(err, errMsg)
-			vrr := validators.BuildValidationResult(rule.Name, errMsg, constants.ValidationTypeAmi)
-			resp.AddResult(vrr, err)
-			continue
-		}
-		amiRuleService := ami.NewAmiRuleService(r.Log, awsAPI.EC2)
-		vrr, err := amiRuleService.ReconcileAmiRule(rule)
-		if err != nil {
-			r.Log.V(0).Error(err, "failed to reconcile AMI rule")
-		}
-		resp.AddResult(vrr, err)
-	}
-
-	// IAM rules
-	awsAPI, err := aws.NewAPI(validator.Spec.Auth, validator.Spec.DefaultRegion)
-	if err != nil {
-		r.Log.V(0).Error(err, "failed to get AWS client")
-	} else {
-		iamRuleService := iam.NewIAMRuleService(r.Log, awsAPI.IAM)
-
-		for _, rule := range validator.Spec.IamRoleRules {
-			vrr, err := iamRuleService.ReconcileIAMRoleRule(rule)
-			if err != nil {
-				r.Log.V(0).Error(err, "failed to reconcile IAM role rule")
-			}
-			resp.AddResult(vrr, err)
-		}
-		for _, rule := range validator.Spec.IamUserRules {
-			vrr, err := iamRuleService.ReconcileIAMUserRule(rule)
-			if err != nil {
-				r.Log.V(0).Error(err, "failed to reconcile IAM user rule")
-			}
-			resp.AddResult(vrr, err)
-		}
-		for _, rule := range validator.Spec.IamGroupRules {
-			vrr, err := iamRuleService.ReconcileIAMGroupRule(rule)
-			if err != nil {
-				r.Log.V(0).Error(err, "failed to reconcile IAM group rule")
-			}
-			resp.AddResult(vrr, err)
-		}
-		for _, rule := range validator.Spec.IamPolicyRules {
-			vrr, err := iamRuleService.ReconcileIAMPolicyRule(rule)
-			if err != nil {
-				r.Log.V(0).Error(err, "failed to reconcile IAM policy rule")
-			}
-			resp.AddResult(vrr, err)
-		}
-	}
-
-	// Service Quota rules
-	for _, rule := range validator.Spec.ServiceQuotaRules {
-		awsAPI, err := aws.NewAPI(validator.Spec.Auth, rule.Region)
-		if err != nil {
-			errMsg := "Failed to reconcile Service Quota rule"
-			r.Log.V(0).Error(err, errMsg)
-			vrr := validators.BuildValidationResult(rule.Name, errMsg, constants.ValidationTypeServiceQuota)
-			resp.AddResult(vrr, err)
-			continue
-		}
-		svcQuotaService := servicequota.NewServiceQuotaRuleService(
-			r.Log,
-			awsAPI.EC2,
-			awsAPI.EFS,
-			awsAPI.ELB,
-			awsAPI.ELBV2,
-			awsAPI.SQ,
-		)
-		vrr, err := svcQuotaService.ReconcileServiceQuotaRule(rule)
-		if err != nil {
-			r.Log.V(0).Error(err, "failed to reconcile Service Quota rule")
-		}
-		resp.AddResult(vrr, err)
-	}
-
-	// Tag rules
-	for _, rule := range validator.Spec.TagRules {
-		awsAPI, err := aws.NewAPI(validator.Spec.Auth, rule.Region)
-		if err != nil {
-			errMsg := "Failed to reconcile Tag rule"
-			r.Log.V(0).Error(err, errMsg)
-			vrr := validators.BuildValidationResult(rule.Name, errMsg, constants.ValidationTypeTag)
-			resp.AddResult(vrr, err)
-			continue
-		}
-		tagRuleService := tag.NewTagRuleService(r.Log, awsAPI.EC2)
-		vrr, err := tagRuleService.ReconcileTagRule(rule)
-		if err != nil {
-			r.Log.V(0).Error(err, "failed to reconcile Tag rule")
-		}
-		resp.AddResult(vrr, err)
-	}
+	// Validate the rules
+	resp := validate.Validate(validator.Spec, r.Log)
 
 	// Patch the ValidationResult with the latest ValidationRuleResults
-	if err := vres.SafeUpdateValidationResult(ctx, p, vr, resp, r.Log); err != nil {
+	if err := vres.SafeUpdate(ctx, p, vr, resp, r.Log); err != nil {
 		return ctrl.Result{}, err
 	}
 
@@ -250,29 +140,3 @@ func (r *AwsValidatorReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		For(&v1alpha1.AwsValidator{}).
 		Complete(r)
 }
-
-func buildValidationResult(validator *v1alpha1.AwsValidator) *vapi.ValidationResult {
-	return &vapi.ValidationResult{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      validationResultName(validator),
-			Namespace: validator.Namespace,
-			OwnerReferences: []metav1.OwnerReference{
-				{
-					APIVersion: validator.APIVersion,
-					Kind:       validator.Kind,
-					Name:       validator.Name,
-					UID:        validator.UID,
-					Controller: util.Ptr(true),
-				},
-			},
-		},
-		Spec: vapi.ValidationResultSpec{
-			Plugin:          constants.PluginCode,
-			ExpectedResults: validator.Spec.ResultCount(),
-		},
-	}
-}
-
-func validationResultName(validator *v1alpha1.AwsValidator) string {
-	return fmt.Sprintf("validator-plugin-aws-%s", validator.Name)
-}

internal/controller/awsvalidator_controller_test.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/validator-labs/validator-plugin-aws/api/v1alpha1"
 	vapi "github.com/validator-labs/validator/api/v1alpha1"
+	vres "github.com/validator-labs/validator/pkg/validationresult"
 	//+kubebuilder:scaffold:imports
 )
 
@@ -105,11 +106,11 @@ var _ = Describe("AWSValidator controller", Ordered, func() {
 
 	vr := &vapi.ValidationResult{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      validationResultName(val),
+			Name:      vres.Name(val),
 			Namespace: validatorNamespace,
 		},
 	}
-	vrKey := types.NamespacedName{Name: validationResultName(val), Namespace: validatorNamespace}
+	vrKey := types.NamespacedName{Name: vres.Name(val), Namespace: validatorNamespace}
 
 	It("Should create a ValidationResult and update its Status with a failed condition", func() {
 		By("By creating a new AWSValidator")