Skip to content
This repository was archived by the owner on Sep 23, 2025. It is now read-only.

Commit 06c8ee2

Browse files
malancasmalancas
authored
Add resync period functionality for TrustRoot resource (#1458)
* add resync period for trustroot resource Signed-off-by: Meredith Lancaster <malancas@github.com> * remove unused struct Signed-off-by: Meredith Lancaster <malancas@github.com> * add new logging content Signed-off-by: Meredith Lancaster <malancas@github.com> * use flag.Duration Signed-off-by: Meredith Lancaster <malancas@github.com> * drop custom logging search now that parsing is handled by flag Signed-off-by: Meredith Lancaster <malancas@github.com> * drop beginning of error string Signed-off-by: Meredith Lancaster <malancas@github.com> * remove unneeded trustroot resync test Signed-off-by: Meredith Lancaster <malancas@github.com> * remove now unneeded test Signed-off-by: Meredith Lancaster <malancas@github.com> --------- Signed-off-by: Meredith Lancaster <malancas@github.com>
1 parent af79b2d commit 06c8ee2

6 files changed

Lines changed: 49 additions & 232 deletions

File tree

‎.github/workflows/kind-cluster-image-policy-resync-period.yaml‎

Lines changed: 0 additions & 166 deletions
This file was deleted.

‎cmd/webhook/main.go‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,11 @@ var (
9797

9898
// policyResyncPeriod holds the interval which ClusterImagePolicies will resync
9999
// This is essential for triggering a reconcile update for potentially stale KMS authorities.
100-
policyResyncPeriod = flag.String("policy-resync-period", "10h", "The resync period for ClusterImagePolicies. The default is 10h.")
100+
policyResyncPeriod = flag.Duration("policy-resync-period", 10*time.Hour, "The resync period for ClusterImagePolicies. The default is 10h.")
101+
102+
// trustrootResyncPeriod holds the interval which the TrustRoot will resync
103+
// This is essential for triggering a reconcile update for potentially stale TUF metadata.
104+
trustrootResyncPeriod = flag.Duration("trustroot-resync-period", 24*time.Hour, "The resync period for ClusterImagePolicies. The default is 24h.")
101105
)
102106

103107
func main() {
@@ -130,11 +134,9 @@ func main() {
130134
}
131135
}
132136

133-
if duration, err := time.ParseDuration(*policyResyncPeriod); err != nil {
134-
logging.FromContext(ctx).Panicf("Failed to parse --policy-resync-period '%s' : %v", *policyResyncPeriod, err)
135-
} else {
136-
ctx = clusterimagepolicy.ToContext(ctx, duration)
137-
}
137+
// Set the policy and trust root resync periods
138+
ctx = clusterimagepolicy.ToContext(ctx, *policyResyncPeriod)
139+
ctx = trustroot.ToContext(ctx, *trustrootResyncPeriod)
138140

139141
// This must match the set of resources we configure in
140142
// cmd/webhook/main.go in the "types" map.

‎pkg/reconciler/trustroot/controller.go‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ package trustroot
1616

1717
import (
1818
"context"
19+
"time"
1920

2021
"k8s.io/client-go/tools/cache"
2122
kubeclient "knative.dev/pkg/client/injection/kube/client"
@@ -36,6 +37,8 @@ import (
3637
// use it in tests as well.
3738
const FinalizerName = "trustroots.policy.sigstore.dev"
3839

40+
type trustrootResyncPeriodKey struct{}
41+
3942
// NewController creates a Reconciler and returns the result of NewImpl.
4043
func NewController(
4144
ctx context.Context,
@@ -63,20 +66,34 @@ func NewController(
6366
// ConfigMap but there are no changes to the TrustRoot, it needs
6467
// to be synced.
6568
grCb := func(obj interface{}) {
66-
logging.FromContext(ctx).Info("Doing a global resync on TrustRoot due to ConfigMap changing.")
69+
logging.FromContext(ctx).Info("Doing a global resync on TrustRoot due to ConfigMap changing or resync period.")
6770
impl.GlobalResync(trustrootInformer.Informer())
6871
}
6972
// Resync on only ConfigMap changes that pertain to the one I care about.
7073
// We could also fetch/construct the store and use CM watcher for it, but
7174
// since we need a lister for it anyways in the reconciler, just set up
7275
// the watch here.
73-
if _, err := configMapInformer.Informer().AddEventHandler(cache.FilteringResourceEventHandler{
76+
if _, err := configMapInformer.Informer().AddEventHandlerWithResyncPeriod(cache.FilteringResourceEventHandler{
7477
FilterFunc: pkgreconciler.ChainFilterFuncs(
7578
pkgreconciler.NamespaceFilterFunc(system.Namespace()),
7679
pkgreconciler.NameFilterFunc(config.SigstoreKeysConfigName)),
7780
Handler: controller.HandleAll(grCb),
78-
}); err != nil {
79-
logging.FromContext(ctx).Warnf("Failed configMapInformer AddEventHandler() %v", err)
81+
}, FromContextOrDefaults(ctx)); err != nil {
82+
logging.FromContext(ctx).Warnf("Failed configMapInformer AddEventHandlerWithResyncPeriod() %v", err)
8083
}
8184
return impl
8285
}
86+
87+
func ToContext(ctx context.Context, duration time.Duration) context.Context {
88+
return context.WithValue(ctx, trustrootResyncPeriodKey{}, duration)
89+
}
90+
91+
// FromContextOrDefaults returns a stored trustrootResyncPeriod if attached.
92+
// If not found, it returns a default duration
93+
func FromContextOrDefaults(ctx context.Context) time.Duration {
94+
x, ok := ctx.Value(trustrootResyncPeriodKey{}).(time.Duration)
95+
if ok {
96+
return x
97+
}
98+
return controller.DefaultResyncPeriod
99+
}

‎pkg/reconciler/trustroot/controller_test.go‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,10 @@ package trustroot
1616

1717
import (
1818
"testing"
19+
"time"
1920

2021
"knative.dev/pkg/configmap"
22+
"knative.dev/pkg/controller"
2123
rtesting "knative.dev/pkg/reconciler/testing"
2224

2325
// Fake injection informers
@@ -37,3 +39,21 @@ func TestNew(t *testing.T) {
3739
t.Fatal("Expected NewController to return a non-nil value")
3840
}
3941
}
42+
43+
func TestContextDuration(t *testing.T) {
44+
ctx, _ := rtesting.SetupFakeContext(t)
45+
46+
expected := controller.DefaultResyncPeriod
47+
actual := FromContextOrDefaults(ctx)
48+
if expected != actual {
49+
t.Fatal("Expected the context to store the value and be retrievable")
50+
}
51+
52+
expected = time.Hour
53+
ctx = ToContext(ctx, expected)
54+
actual = FromContextOrDefaults(ctx)
55+
56+
if expected != actual {
57+
t.Fatal("Expected the context to store the value and be retrievable")
58+
}
59+
}

‎test/kustomize-invalid-policy-resync-period/kustomization.yaml‎

Lines changed: 0 additions & 28 deletions
This file was deleted.

‎test/kustomize-policy-resync-period/kustomization.yaml‎

Lines changed: 0 additions & 28 deletions
This file was deleted.

0 commit comments

Comments
 (0)