Skip to content

Commit e866788

Browse files
TylerGillsonTylerGillson
committed
use service pattern for all validators
1 parent 8171266 commit e866788

4 files changed

Lines changed: 54 additions & 28 deletions

File tree

‎internal/controller/awsvalidator_controller.go‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,9 @@ func (r *AwsValidatorReconciler) Reconcile(ctx context.Context, req ctrl.Request
100100
// allow flow to proceed - better errors will surface subsequently
101101
r.Log.V(0).Error(err, "failed to establish AWS session")
102102
}
103+
iamRuleService := iam.NewIAMRuleService(r.Log, session)
104+
svcQuotaService := servicequota.NewServiceQuotaRuleService(r.Log, session)
105+
tagRuleService := tag.NewTagRuleService(r.Log, session)
103106

104107
// Get the active validator's validation result
105108
vr := &valid8orv1alpha1.ValidationResult{}
@@ -125,7 +128,6 @@ func (r *AwsValidatorReconciler) Reconcile(ctx context.Context, req ctrl.Request
125128
failed := &monotonicBool{}
126129

127130
// IAM rules
128-
iamRuleService := iam.NewIAMRuleService(r.Log, session)
129131
for _, rule := range validator.Spec.IamRoleRules {
130132
validationResult, err := iamRuleService.ReconcileIAMRoleRule(nn, rule)
131133
if err != nil {
@@ -157,7 +159,7 @@ func (r *AwsValidatorReconciler) Reconcile(ctx context.Context, req ctrl.Request
157159

158160
// Service Quota rules
159161
for _, rule := range validator.Spec.ServiceQuotaRules {
160-
validationResult, err := servicequota.ReconcileServiceQuotaRule(nn, rule, session, r.Log)
162+
validationResult, err := svcQuotaService.ReconcileServiceQuotaRule(nn, rule)
161163
if err != nil {
162164
r.Log.V(0).Error(err, "failed to reconcile Service Quota rule")
163165
}
@@ -166,7 +168,7 @@ func (r *AwsValidatorReconciler) Reconcile(ctx context.Context, req ctrl.Request
166168

167169
// Tag rules
168170
for _, rule := range validator.Spec.TagRules {
169-
validationResult, err := tag.ReconcileTagRule(nn, rule, session, r.Log)
171+
validationResult, err := tagRuleService.ReconcileTagRule(nn, rule)
170172
if err != nil {
171173
r.Log.V(0).Error(err, "failed to reconcile Tag rule")
172174
}

‎internal/validators/iam/iam_validator.go‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,6 @@ import (
2222
valid8orv1alpha1 "github.com/spectrocloud-labs/valid8or/api/v1alpha1"
2323
)
2424

25-
type permission struct {
26-
Actions map[iamAction]bool
27-
Condition *v1alpha1.Condition
28-
Errors []string
29-
PolicyName string
30-
}
31-
3225
type iamAction struct {
3326
Service string
3427
Verb string
@@ -47,25 +40,32 @@ type missing struct {
4740
PolicyName string
4841
}
4942

50-
type IamRuleObj interface {
43+
type permission struct {
44+
Actions map[iamAction]bool
45+
Condition *v1alpha1.Condition
46+
Errors []string
47+
PolicyName string
48+
}
49+
50+
type iamRule interface {
5151
Name() string
5252
IAMPolicies() []v1alpha1.PolicyDocument
5353
}
5454

5555
type IAMRuleService struct {
56-
iamSvc *iam.IAM
5756
log logr.Logger
57+
iamSvc *iam.IAM
5858
}
5959

6060
func NewIAMRuleService(log logr.Logger, s *session.Session) *IAMRuleService {
6161
return &IAMRuleService{
62-
iamSvc: aws.IAMService(s),
6362
log: log,
63+
iamSvc: aws.IAMService(s),
6464
}
6565
}
6666

6767
// ReconcileIAMRoleRule reconciles an IAM role validation rule from an AWSValidator config
68-
func (s *IAMRuleService) ReconcileIAMRoleRule(nn k8stypes.NamespacedName, rule IamRuleObj) (*types.ValidationResult, error) {
68+
func (s *IAMRuleService) ReconcileIAMRoleRule(nn k8stypes.NamespacedName, rule iamRule) (*types.ValidationResult, error) {
6969

7070
// Build the default ValidationResult for this IAM rule
7171
vr := buildValidationResult(rule, constants.ValidationTypeIAMRolePolicy)
@@ -95,7 +95,7 @@ func (s *IAMRuleService) ReconcileIAMRoleRule(nn k8stypes.NamespacedName, rule I
9595
}
9696

9797
// ReconcileIAMUserRule reconciles an IAM user validation rule from an AWSValidator config
98-
func (s *IAMRuleService) ReconcileIAMUserRule(nn k8stypes.NamespacedName, rule IamRuleObj) (*types.ValidationResult, error) {
98+
func (s *IAMRuleService) ReconcileIAMUserRule(nn k8stypes.NamespacedName, rule iamRule) (*types.ValidationResult, error) {
9999

100100
// Build the default ValidationResult for this IAM rule
101101
vr := buildValidationResult(rule, constants.ValidationTypeIAMUserPolicy)
@@ -125,7 +125,7 @@ func (s *IAMRuleService) ReconcileIAMUserRule(nn k8stypes.NamespacedName, rule I
125125
}
126126

127127
// ReconcileIAMGroupRule reconciles an IAM group validation rule from an AWSValidator config
128-
func (s *IAMRuleService) ReconcileIAMGroupRule(nn k8stypes.NamespacedName, rule IamRuleObj) (*types.ValidationResult, error) {
128+
func (s *IAMRuleService) ReconcileIAMGroupRule(nn k8stypes.NamespacedName, rule iamRule) (*types.ValidationResult, error) {
129129

130130
// Build the default ValidationResult for this IAM rule
131131
vr := buildValidationResult(rule, constants.ValidationTypeIAMGroupPolicy)
@@ -155,7 +155,7 @@ func (s *IAMRuleService) ReconcileIAMGroupRule(nn k8stypes.NamespacedName, rule
155155
}
156156

157157
// ReconcileIAMPolicyRule reconciles an IAM policy validation rule from an AWSValidator config
158-
func (s *IAMRuleService) ReconcileIAMPolicyRule(nn k8stypes.NamespacedName, rule IamRuleObj) (*types.ValidationResult, error) {
158+
func (s *IAMRuleService) ReconcileIAMPolicyRule(nn k8stypes.NamespacedName, rule iamRule) (*types.ValidationResult, error) {
159159

160160
// Build the default ValidationResult for this IAM rule
161161
vr := buildValidationResult(rule, constants.ValidationTypeIAMPolicy)
@@ -229,7 +229,7 @@ func (s *IAMRuleService) getPolicyDocument(policyArn *string, context []string)
229229
}
230230

231231
// buildValidationResult builds a default ValidationResult for a given validation type
232-
func buildValidationResult(rule IamRuleObj, validationType string) *types.ValidationResult {
232+
func buildValidationResult(rule iamRule, validationType string) *types.ValidationResult {
233233
state := valid8orv1alpha1.ValidationSucceeded
234234
latestCondition := valid8orv1alpha1.DefaultValidationCondition()
235235
latestCondition.Message = fmt.Sprintf("All required %s permissions were found", validationType)
@@ -239,7 +239,7 @@ func buildValidationResult(rule IamRuleObj, validationType string) *types.Valida
239239
}
240240

241241
// buildPermissions builds an IAM permission map from an IAM rule
242-
func buildPermissions(rule IamRuleObj) map[string]*permission {
242+
func buildPermissions(rule iamRule) map[string]*permission {
243243
permissions := make(map[string]*permission)
244244
for _, p := range rule.IAMPolicies() {
245245
for _, s := range p.Statements {
@@ -332,7 +332,7 @@ func updatePermissions(policyDocument *awspolicy.Policy, permissions map[string]
332332
}
333333

334334
// computeFailures derives IAM rule failures from an IAM permissions map once it has been fully updated
335-
func computeFailures(rule IamRuleObj, permissions map[string]*permission, vr *types.ValidationResult) {
335+
func computeFailures(rule iamRule, permissions map[string]*permission, vr *types.ValidationResult) {
336336
failures := make([]string, 0)
337337
missingActions := make(map[string]*missing)
338338

‎internal/validators/servicequota/servicequota_validator.go‎

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,21 @@ var quotaUsageFuncs map[string]func(v1alpha1.ServiceQuotaRule, *session.Session,
4040
"NAT gateways per Availability Zone": natGatewaysPerAz,
4141
}
4242

43+
type ServiceQuotaRuleService struct {
44+
log logr.Logger
45+
session *session.Session
46+
}
47+
48+
func NewServiceQuotaRuleService(log logr.Logger, s *session.Session) *ServiceQuotaRuleService {
49+
return &ServiceQuotaRuleService{
50+
log: log,
51+
session: s,
52+
}
53+
}
54+
4355
// ReconcileServiceQuotaRule reconciles an AWS service quota validation rule from the AWSValidator config
44-
func ReconcileServiceQuotaRule(nn k8stypes.NamespacedName, rule v1alpha1.ServiceQuotaRule, s *session.Session, log logr.Logger) (*types.ValidationResult, error) {
45-
sqSvc := aws.ServiceQuotasService(s, rule.Region)
56+
func (s *ServiceQuotaRuleService) ReconcileServiceQuotaRule(nn k8stypes.NamespacedName, rule v1alpha1.ServiceQuotaRule) (*types.ValidationResult, error) {
57+
sqSvc := aws.ServiceQuotasService(s.session, rule.Region)
4658

4759
// Build the default latest condition for this tag rule
4860
state := valid8orv1alpha1.ValidationSucceeded
@@ -70,12 +82,12 @@ func ReconcileServiceQuotaRule(nn k8stypes.NamespacedName, rule v1alpha1.Service
7082
return true
7183
})
7284
if err != nil || quota == nil {
73-
log.V(0).Error(err, "failed to get service quota", "region", rule.Region, "serviceCode", rule.ServiceCode, "quotaName", ruleQuota.Name)
85+
s.log.V(0).Error(err, "failed to get service quota", "region", rule.Region, "serviceCode", rule.ServiceCode, "quotaName", ruleQuota.Name)
7486
return validationResult, err
7587
}
76-
usageResult, err := quotaUsageFuncs[ruleQuota.Name](rule, s, log)
88+
usageResult, err := quotaUsageFuncs[ruleQuota.Name](rule, s.session, s.log)
7789
if err != nil {
78-
log.V(0).Error(err, "failed to get usage for service quota", "region", rule.Region, "serviceCode", rule.ServiceCode, "quotaName", ruleQuota.Name)
90+
s.log.V(0).Error(err, "failed to get usage for service quota", "region", rule.Region, "serviceCode", rule.ServiceCode, "quotaName", ruleQuota.Name)
7991
return validationResult, err
8092
}
8193
if quota.Value != nil {

‎internal/validators/tag/tag_validator.go‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,21 @@ import (
1717
valid8orv1alpha1 "github.com/spectrocloud-labs/valid8or/api/v1alpha1"
1818
)
1919

20+
type TagRuleService struct {
21+
log logr.Logger
22+
session *session.Session
23+
}
24+
25+
func NewTagRuleService(log logr.Logger, s *session.Session) *TagRuleService {
26+
return &TagRuleService{
27+
log: log,
28+
session: s,
29+
}
30+
}
31+
2032
// ReconcileTagRule reconciles an EC2 tagging validation rule from the AWSValidator config
21-
func ReconcileTagRule(nn k8stypes.NamespacedName, rule v1alpha1.TagRule, s *session.Session, log logr.Logger) (*types.ValidationResult, error) {
22-
ec2Svc := aws.EC2Service(s, rule.Region)
33+
func (s *TagRuleService) ReconcileTagRule(nn k8stypes.NamespacedName, rule v1alpha1.TagRule) (*types.ValidationResult, error) {
34+
ec2Svc := aws.EC2Service(s.session, rule.Region)
2335

2436
// Build the default latest condition for this tag rule
2537
state := valid8orv1alpha1.ValidationSucceeded
@@ -43,7 +55,7 @@ func ReconcileTagRule(nn k8stypes.NamespacedName, rule v1alpha1.TagRule, s *sess
4355
},
4456
})
4557
if err != nil {
46-
log.V(0).Error(err, "failed to describe subnets", "region", rule.Region)
58+
s.log.V(0).Error(err, "failed to describe subnets", "region", rule.Region)
4759
return validationResult, err
4860
}
4961
for _, s := range subnets.Subnets {

0 commit comments

Comments
 (0)