Skip to content

Commit 8fc1bf4

Browse files
malancascodysoyland
malancas
authored and
codysoyland
committed
Thread configurable trustroot resync period to bundle trustroot func (#171)
* move trustroot resync period configration to different package Signed-off-by: Meredith Lancaster <malancas@github.com> * add license Signed-off-by: Meredith Lancaster <malancas@github.com> * comment Signed-off-by: Meredith Lancaster <malancas@github.com> * rename files Signed-off-by: Meredith Lancaster <malancas@github.com> --------- Signed-off-by: Meredith Lancaster <malancas@github.com>
1 parent e9fea69 commit 8fc1bf4

File tree

7 files changed

+93
-44
lines changed

7 files changed

+93
-44
lines changed

‎cmd/webhook/main.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ import (
5656
"github.com/sigstore/sigstore/pkg/tuf"
5757

5858
"github.com/sigstore/policy-controller/pkg/apis/config"
59+
pctuf "github.com/sigstore/policy-controller/pkg/tuf"
5960
cwebhook "github.com/sigstore/policy-controller/pkg/webhook"
6061
)
6162

@@ -136,7 +137,7 @@ func main() {
136137

137138
// Set the policy and trust root resync periods
138139
ctx = clusterimagepolicy.ToContext(ctx, *policyResyncPeriod)
139-
ctx = trustroot.ToContext(ctx, *trustrootResyncPeriod)
140+
ctx = pctuf.ToContext(ctx, *trustrootResyncPeriod)
140141

141142
// This must match the set of resources we configure in
142143
// cmd/webhook/main.go in the "types" map.

‎pkg/reconciler/trustroot/controller.go

Lines changed: 2 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ package trustroot
1616

1717
import (
1818
"context"
19-
"time"
2019

2120
"k8s.io/client-go/tools/cache"
2221
kubeclient "knative.dev/pkg/client/injection/kube/client"
@@ -30,15 +29,14 @@ import (
3029
"github.com/sigstore/policy-controller/pkg/apis/config"
3130
trustrootinformer "github.com/sigstore/policy-controller/pkg/client/injection/informers/policy/v1alpha1/trustroot"
3231
trustrootreconciler "github.com/sigstore/policy-controller/pkg/client/injection/reconciler/policy/v1alpha1/trustroot"
32+
"github.com/sigstore/policy-controller/pkg/tuf"
3333
cminformer "knative.dev/pkg/injection/clients/namespacedkube/informers/core/v1/configmap"
3434
)
3535

3636
// This is what the default finalizer name is, but make it explicit so we can
3737
// use it in tests as well.
3838
const FinalizerName = "trustroots.policy.sigstore.dev"
3939

40-
type trustrootResyncPeriodKey struct{}
41-
4240
// NewController creates a Reconciler and returns the result of NewImpl.
4341
func NewController(
4442
ctx context.Context,
@@ -78,22 +76,8 @@ func NewController(
7876
pkgreconciler.NamespaceFilterFunc(system.Namespace()),
7977
pkgreconciler.NameFilterFunc(config.SigstoreKeysConfigName)),
8078
Handler: controller.HandleAll(grCb),
81-
}, FromContextOrDefaults(ctx)); err != nil {
79+
}, tuf.FromContextOrDefaults(ctx)); err != nil {
8280
logging.FromContext(ctx).Warnf("Failed configMapInformer AddEventHandlerWithResyncPeriod() %v", err)
8381
}
8482
return impl
8583
}
86-
87-
func ToContext(ctx context.Context, duration time.Duration) context.Context {
88-
return context.WithValue(ctx, trustrootResyncPeriodKey{}, duration)
89-
}
90-
91-
// FromContextOrDefaults returns a stored trustrootResyncPeriod if attached.
92-
// If not found, it returns a default duration
93-
func FromContextOrDefaults(ctx context.Context) time.Duration {
94-
x, ok := ctx.Value(trustrootResyncPeriodKey{}).(time.Duration)
95-
if ok {
96-
return x
97-
}
98-
return controller.DefaultResyncPeriod
99-
}

‎pkg/reconciler/trustroot/controller_test.go

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,8 @@ package trustroot
1616

1717
import (
1818
"testing"
19-
"time"
2019

2120
"knative.dev/pkg/configmap"
22-
"knative.dev/pkg/controller"
2321
rtesting "knative.dev/pkg/reconciler/testing"
2422

2523
// Fake injection informers
@@ -39,21 +37,3 @@ func TestNew(t *testing.T) {
3937
t.Fatal("Expected NewController to return a non-nil value")
4038
}
4139
}
42-
43-
func TestContextDuration(t *testing.T) {
44-
ctx, _ := rtesting.SetupFakeContext(t)
45-
46-
expected := controller.DefaultResyncPeriod
47-
actual := FromContextOrDefaults(ctx)
48-
if expected != actual {
49-
t.Fatal("Expected the context to store the value and be retrievable")
50-
}
51-
52-
expected = time.Hour
53-
ctx = ToContext(ctx, expected)
54-
actual = FromContextOrDefaults(ctx)
55-
56-
if expected != actual {
57-
t.Fatal("Expected the context to store the value and be retrievable")
58-
}
59-
}

‎pkg/tuf/context.go

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
//
2+
// Copyright 2024 The Sigstore Authors.
3+
//
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
//
8+
// http://www.apache.org/licenses/LICENSE-2.0
9+
//
10+
// Unless required by applicable law or agreed to in writing, software
11+
// distributed under the License is distributed on an "AS IS" BASIS,
12+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
// See the License for the specific language governing permissions and
14+
// limitations under the License.
15+
16+
package tuf
17+
18+
import (
19+
"context"
20+
"time"
21+
22+
"knative.dev/pkg/controller"
23+
)
24+
25+
type trustrootResyncPeriodKey struct{}
26+
27+
// ToContext returns a context that includes a key trustrootResyncPeriod
28+
// set to the included duration
29+
func ToContext(ctx context.Context, duration time.Duration) context.Context {
30+
return context.WithValue(ctx, trustrootResyncPeriodKey{}, duration)
31+
}
32+
33+
// FromContextOrDefaults returns a stored trustrootResyncPeriod if attached.
34+
// If not found, it returns a default duration
35+
func FromContextOrDefaults(ctx context.Context) time.Duration {
36+
x, ok := ctx.Value(trustrootResyncPeriodKey{}).(time.Duration)
37+
if ok {
38+
return x
39+
}
40+
return controller.DefaultResyncPeriod
41+
}

‎pkg/tuf/context_test.go

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
//
2+
// Copyright 2024 The Sigstore Authors.
3+
//
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
//
8+
// http://www.apache.org/licenses/LICENSE-2.0
9+
//
10+
// Unless required by applicable law or agreed to in writing, software
11+
// distributed under the License is distributed on an "AS IS" BASIS,
12+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
// See the License for the specific language governing permissions and
14+
// limitations under the License.
15+
16+
package tuf
17+
18+
import (
19+
"testing"
20+
"time"
21+
22+
"knative.dev/pkg/controller"
23+
rtesting "knative.dev/pkg/reconciler/testing"
24+
)
25+
26+
func TestContextDuration(t *testing.T) {
27+
ctx, _ := rtesting.SetupFakeContext(t)
28+
29+
expected := controller.DefaultResyncPeriod
30+
actual := FromContextOrDefaults(ctx)
31+
if expected != actual {
32+
t.Fatal("Expected the context to store the value and be retrievable")
33+
}
34+
35+
expected = time.Hour
36+
ctx = ToContext(ctx, expected)
37+
actual = FromContextOrDefaults(ctx)
38+
39+
if expected != actual {
40+
t.Fatal("Expected the context to store the value and be retrievable")
41+
}
42+
}

‎pkg/tuf/repo.go

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -306,11 +306,12 @@ var (
306306
)
307307

308308
// GetTrustedRoot returns the trusted root for the TUF repository.
309-
func GetTrustedRoot() (*root.TrustedRoot, error) {
309+
func GetTrustedRoot(ctx context.Context) (*root.TrustedRoot, error) {
310+
resyncPeriodDuration := FromContextOrDefaults(ctx)
310311
now := time.Now().UTC()
311-
// check if timestamp has never been or if the current time is more
312-
// than 24 hours after the current value of timestamp
313-
if timestamp.IsZero() || now.After(timestamp.Add(24*time.Hour)) {
312+
// check if timestamp has never been set or if the current time
313+
// is after the current timestamp value plus the included resync duration
314+
if timestamp.IsZero() || now.After(timestamp.Add(resyncPeriodDuration)) {
314315
mu.Lock()
315316
defer mu.Unlock()
316317

‎pkg/webhook/validator.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1055,7 +1055,7 @@ func trustedMaterialFromAuthority(ctx context.Context, authority webhookcip.Auth
10551055
return nil, fmt.Errorf("trusted root \"%s\" does not exist", authority.Keyless.TrustRootRef)
10561056
}
10571057
}
1058-
trustedMaterial, err := pctuf.GetTrustedRoot()
1058+
trustedMaterial, err := pctuf.GetTrustedRoot(ctx)
10591059
if err != nil {
10601060
return nil, fmt.Errorf("failed to parse trusted root from protobuf: %w", err)
10611061
}

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy