Add initial Provision interface and SpireHelm implementation

cmd/cofidectl/cmd/down.go

@@ -4,13 +4,7 @@
 package cmd
 
 import (
-	"context"
-	"fmt"
-
-	trust_zone_proto "github.com/cofide/cofide-api-sdk/gen/go/proto/trust_zone/v1alpha1"
 	cmdcontext "github.com/cofide/cofidectl/pkg/cmd/context"
-	"github.com/cofide/cofidectl/cmd/cofidectl/cmd/statusspinner"
-	"github.com/cofide/cofidectl/pkg/provider/helm"
 	"github.com/spf13/cobra"
 )
 
@@ -39,38 +33,9 @@ func (d *DownCommand) DownCmd() *cobra.Command {
 				return err
 			}
 
-			trustZones, err := ds.ListTrustZones()
-			if err != nil {
-				return err
-			}
-
-			if len(trustZones) == 0 {
-				fmt.Println("no trust zones have been configured")
-				return nil
-			}
-
-			if err := uninstallSPIREStack(cmd.Context(), trustZones); err != nil {
-				return err
-			}
-
-			return nil
+			provision := d.cmdCtx.PluginManager.GetProvision()
+			return provision.TearDown(cmd.Context(), ds)
 		},
 	}
 	return cmd
 }
-
-func uninstallSPIREStack(ctx context.Context, trustZones []*trust_zone_proto.TrustZone) error {
-	for _, trustZone := range trustZones {
-		prov, err := helm.NewHelmSPIREProvider(ctx, trustZone, nil, nil)
-		if err != nil {
-			return err
-		}
-
-		s := statusspinner.New()
-		statusCh := prov.ExecuteUninstall()
-		if err := s.Watch(statusCh); err != nil {
-			return fmt.Errorf("uninstallation failed: %w", err)
-		}
-	}
-	return nil
-}

cmd/cofidectl/cmd/up.go

@@ -4,18 +4,7 @@
 package cmd
 
 import (
-	"context"
-	"fmt"
-
-	trust_zone_proto "github.com/cofide/cofide-api-sdk/gen/go/proto/trust_zone/v1alpha1"
-	"github.com/cofide/cofidectl/internal/pkg/spire"
-	kubeutil "github.com/cofide/cofidectl/pkg/kube"
-	"github.com/cofide/cofidectl/pkg/provider"
-	"github.com/cofide/cofidectl/pkg/provider/helm"
-
-	"github.com/cofide/cofidectl/cmd/cofidectl/cmd/statusspinner"
 	cmdcontext "github.com/cofide/cofidectl/pkg/cmd/context"
-	cofidectl_plugin "github.com/cofide/cofidectl/pkg/plugin"
 	"github.com/spf13/cobra"
 )
 
@@ -45,155 +34,9 @@ func (u *UpCommand) UpCmd() *cobra.Command {
 				return err
 			}
 
-			trustZones, err := ds.ListTrustZones()
-			if err != nil {
-				return err
-			}
-			if len(trustZones) == 0 {
-				return fmt.Errorf("no trust zones have been configured")
-			}
-
-			if err := addSPIRERepository(cmd.Context()); err != nil {
-				return err
-			}
-
-			if err := installSPIREStack(cmd.Context(), ds, trustZones); err != nil {
-				return err
-			}
-
-			if err := watchAndConfigure(cmd.Context(), ds, trustZones); err != nil {
-				return err
-			}
-
-			if err := applyPostInstallHelmConfig(cmd.Context(), ds, trustZones); err != nil {
-				return err
-			}
-
-			// Wait for spire-server to be ready again.
-			if err := watchAndConfigure(cmd.Context(), ds, trustZones); err != nil {
-				return err
-			}
-
-			return nil
+			provision := u.cmdCtx.PluginManager.GetProvision()
+			return provision.Deploy(cmd.Context(), ds, kubeCfgFile)
 		},
 	}
 	return cmd
 }
-
-func addSPIRERepository(ctx context.Context) error {
-	emptyValues := map[string]interface{}{}
-	prov, err := helm.NewHelmSPIREProvider(ctx, nil, emptyValues, emptyValues)
-	if err != nil {
-		return err
-	}
-
-	statusCh := prov.AddRepository()
-	s := statusspinner.New()
-	if err := s.Watch(statusCh); err != nil {
-		return fmt.Errorf("adding SPIRE Helm repository failed: %w", err)
-	}
-	return nil
-}
-
-func installSPIREStack(ctx context.Context, source cofidectl_plugin.DataSource, trustZones []*trust_zone_proto.TrustZone) error {
-	for _, trustZone := range trustZones {
-		generator := helm.NewHelmValuesGenerator(trustZone, source, nil)
-		spireValues, err := generator.GenerateValues()
-		if err != nil {
-			return err
-		}
-
-		spireCRDsValues := map[string]interface{}{}
-		prov, err := helm.NewHelmSPIREProvider(ctx, trustZone, spireValues, spireCRDsValues)
-		if err != nil {
-			return err
-		}
-
-		statusCh := prov.Execute()
-
-		// Create a spinner to display whilst installation is underway
-		s := statusspinner.New()
-		if err := s.Watch(statusCh); err != nil {
-			return fmt.Errorf("installation failed: %w", err)
-		}
-	}
-	return nil
-}
-
-func watchAndConfigure(ctx context.Context, source cofidectl_plugin.DataSource, trustZones []*trust_zone_proto.TrustZone) error {
-	// wait for SPIRE servers to be available and update status before applying federation(s)
-	for _, trustZone := range trustZones {
-		statusCh := make(chan provider.ProviderStatus)
-
-		go getBundleAndEndpoint(ctx, statusCh, source, trustZone)
-
-		s := statusspinner.New()
-		if err := s.Watch(statusCh); err != nil {
-			return fmt.Errorf("configuration failed: %w", err)
-		}
-	}
-	return nil
-}
-
-func getBundleAndEndpoint(ctx context.Context, statusCh chan<- provider.ProviderStatus, source cofidectl_plugin.DataSource, trustZone *trust_zone_proto.TrustZone) {
-	defer close(statusCh)
-	statusCh <- provider.ProviderStatus{Stage: "Waiting", Message: fmt.Sprintf("Waiting for SPIRE server pod and service for %s in cluster %s", trustZone.Name, trustZone.GetKubernetesCluster())}
-
-	client, err := kubeutil.NewKubeClientFromSpecifiedContext(kubeCfgFile, trustZone.GetKubernetesContext())
-	if err != nil {
-		statusCh <- provider.ProviderStatus{Stage: "Waiting", Message: fmt.Sprintf("Failed waiting for SPIRE server pod and service for %s in cluster %s", trustZone.Name, trustZone.GetKubernetesCluster()), Done: true, Error: err}
-		return
-	}
-
-	clusterIP, err := spire.WaitForServerIP(ctx, client)
-	if err != nil {
-		statusCh <- provider.ProviderStatus{Stage: "Waiting", Message: fmt.Sprintf("Failed waiting for SPIRE server pod and service for %s in cluster %s", trustZone.Name, trustZone.GetKubernetesCluster()), Done: true, Error: err}
-		return
-	}
-
-	bundleEndpointUrl := fmt.Sprintf("https://%s:8443", clusterIP)
-	trustZone.BundleEndpointUrl = &bundleEndpointUrl
-
-	// obtain the bundle
-	bundle, err := spire.GetBundle(ctx, client)
-	if err != nil {
-		statusCh <- provider.ProviderStatus{Stage: "Waiting", Message: fmt.Sprintf("Failed obtaining bundle for %s in cluster %s", trustZone.Name, trustZone.GetKubernetesCluster()), Done: true, Error: err}
-		return
-	}
-
-	trustZone.Bundle = &bundle
-
-	if err := source.UpdateTrustZone(trustZone); err != nil {
-		statusCh <- provider.ProviderStatus{Stage: "Waiting", Message: fmt.Sprintf("Failed updating trust zone %s", trustZone.Name), Done: true, Error: err}
-		return
-	}
-
-	statusCh <- provider.ProviderStatus{Stage: "Ready", Message: fmt.Sprintf("All SPIRE server pods and services are ready for %s in cluster %s", trustZone.Name, trustZone.GetKubernetesCluster()), Done: true}
-}
-
-func applyPostInstallHelmConfig(ctx context.Context, source cofidectl_plugin.DataSource, trustZones []*trust_zone_proto.TrustZone) error {
-	for _, trustZone := range trustZones {
-		generator := helm.NewHelmValuesGenerator(trustZone, source, nil)
-
-		spireValues, err := generator.GenerateValues()
-		if err != nil {
-			return err
-		}
-
-		spireCRDsValues := map[string]interface{}{}
-
-		prov, err := helm.NewHelmSPIREProvider(ctx, trustZone, spireValues, spireCRDsValues)
-		if err != nil {
-			return err
-		}
-
-		statusCh := prov.ExecuteUpgrade(true)
-
-		s := statusspinner.New()
-		if err := s.Watch(statusCh); err != nil {
-			return fmt.Errorf("post-installation configuration failed: %w", err)
-		}
-	}
-
-	return nil
-}

go.mod

@@ -5,7 +5,7 @@ go 1.22.7
 require (
 	buf.build/go/protoyaml v0.2.0
 	cuelang.org/go v0.10.1
-	github.com/cofide/cofide-api-sdk v0.3.1-0.20241204134958-1bc361de13ce
+	github.com/cofide/cofide-api-sdk v0.3.1-0.20241206100419-25af9d3bc0c5
 	github.com/fatih/color v1.18.0
 	github.com/gofrs/flock v0.12.1
 	github.com/google/go-cmp v0.6.0

go.sum

@@ -84,8 +84,8 @@ github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cockroachdb/apd/v3 v3.2.1 h1:U+8j7t0axsIgvQUqthuNm82HIrYXodOV2iWLWtEaIwg=
 github.com/cockroachdb/apd/v3 v3.2.1/go.mod h1:klXJcjp+FffLTHlhIG69tezTDvdP065naDsHzKhYSqc=
-github.com/cofide/cofide-api-sdk v0.3.1-0.20241204134958-1bc361de13ce h1:0EDn4+tPs1qdNH8SlavFZCD5/AcFgQsjBy21QG/D1QM=
-github.com/cofide/cofide-api-sdk v0.3.1-0.20241204134958-1bc361de13ce/go.mod h1:yKMfhL3qCIVJcKvgZsPZC1o60/8co6/0NsCaJtrUoFY=
+github.com/cofide/cofide-api-sdk v0.3.1-0.20241206100419-25af9d3bc0c5 h1:o0xy1hnXWVEoHyqrLm+sU5lXyw/Rcm3A+1w884v8vqI=
+github.com/cofide/cofide-api-sdk v0.3.1-0.20241206100419-25af9d3bc0c5/go.mod h1:yKMfhL3qCIVJcKvgZsPZC1o60/8co6/0NsCaJtrUoFY=
 github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
 github.com/containerd/cgroups v1.1.0/go.mod h1:6ppBcbh/NOOUU+dMKrykgaBnK9lCIBxHqJDGwsa1mIw=
 github.com/containerd/containerd v1.7.23 h1:H2CClyUkmpKAGlhQp95g2WXHfLYc7whAuvZGBNYOOwQ=

pkg/plugin/interface.go

@@ -10,7 +10,7 @@ import (
 	trust_zone_proto "github.com/cofide/cofide-api-sdk/gen/go/proto/trust_zone/v1alpha1"
 )
 
-// DataSource is the interface plugins have to implement.
+// DataSource is the interface data source plugins have to implement.
 type DataSource interface {
 	Validate() error
 	GetTrustZone(string) (*trust_zone_proto.TrustZone, error)

pkg/plugin/manager/manager.go

@@ -14,6 +14,8 @@ import (
 	"github.com/cofide/cofidectl/internal/pkg/proto"
 	cofidectl_plugin "github.com/cofide/cofidectl/pkg/plugin"
 	"github.com/cofide/cofidectl/pkg/plugin/local"
+	"github.com/cofide/cofidectl/pkg/plugin/provision"
+	"github.com/cofide/cofidectl/pkg/plugin/provision/spirehelm"
 	"google.golang.org/protobuf/types/known/structpb"
 
 	hclog "github.com/hashicorp/go-hclog"
@@ -216,3 +218,8 @@ func (pm *PluginManager) SetPluginConfig(pluginName string, pluginConfig *struct
 	cfg.PluginConfig[pluginName] = pluginConfig
 	return pm.configLoader.Write(cfg)
 }
+
+// GetProvision returns the provision plugin.
+func (pm *PluginManager) GetProvision() provision.Provision {
+	return spirehelm.NewSpireHelm()
+}

pkg/plugin/provision/interface.go

@@ -0,0 +1,19 @@
+// Copyright 2024 Cofide Limited.
+// SPDX-License-Identifier: Apache-2.0
+
+package provision
+
+import (
+	"context"
+
+	"github.com/cofide/cofidectl/pkg/plugin"
+)
+
+// Provision is the interface that provision plugins have to implement.
+type Provision interface {
+	// Deploy deploys the workload identity configuration to the clusters in the system.
+	Deploy(ctx context.Context, ds plugin.DataSource, kubeCfgFile string) error
+
+	// TearDown tears down the workload identity configuration from the clusters in the system.
+	TearDown(ctx context.Context, ds plugin.DataSource) error
+}