diff --git a/pkg/reconciler/channel/channel.go b/pkg/reconciler/channel/channel.go index 2a1b6ba1db5..9ae3af5bb12 100644 --- a/pkg/reconciler/channel/channel.go +++ b/pkg/reconciler/channel/channel.go @@ -131,17 +131,17 @@ func (r *Reconciler) reconcileBackingChannelEventPolicies(ctx context.Context, c return fmt.Errorf("could not get applying EventPolicies for for channel %s/%s: %w", channel.Namespace, channel.Name, err) } + // map to keep track of which policies are still applying + // the idea is to maintain a map of applying policies to check which policies are outdated. + // if a backing channel policy is not in the map, it is outdated and should be deleted. + applyingEventPoliciesForChannelMap := make(map[string]string, len(applyingEventPoliciesForChannel)) + for _, policy := range applyingEventPoliciesForChannel { err := r.reconcileBackingChannelEventPolicy(ctx, backingChannel, policy) if err != nil { return fmt.Errorf("could not reconcile EventPolicy %s/%s for backing channel %s/%s: %w", policy.Namespace, policy.Name, backingChannel.Namespace, backingChannel.Name, err) } - } - - // Check, if we have old EP for the backing channel, which are not relevant anymore - applyingEventPoliciesForBackingChannel, err := auth.GetEventPoliciesForResource(r.eventPolicyLister, backingChannel.GroupVersionKind(), backingChannel.ObjectMeta) - if err != nil { - return fmt.Errorf("could not get applying EventPolicies for for backing channel %s/%s: %w", channel.Namespace, channel.Name, err) + applyingEventPoliciesForChannelMap[resources.GetEventPolicyNameForBackingChannel(backingChannel.Name, policy.Name)] = policy.Name } selector, err := labels.ValidatedSelectorFromSet(resources.LabelsForBackingChannelsEventPolicy(backingChannel)) @@ -155,8 +155,7 @@ func (r *Reconciler) reconcileBackingChannelEventPolicies(ctx context.Context, c } for _, policy := range existingEventPoliciesForBackingChannel { - if !r.containsPolicy(policy.Name, applyingEventPoliciesForBackingChannel) { - + if _, ok := applyingEventPoliciesForChannelMap[policy.Name]; !ok { // the existing policy is not in the list of applying policies anymore --> is outdated --> delete it err := r.eventingClientSet.EventingV1alpha1().EventPolicies(policy.Namespace).Delete(ctx, policy.Name, metav1.DeleteOptions{}) if err != nil && apierrs.IsNotFound(err) { @@ -190,15 +189,6 @@ func (r *Reconciler) reconcileBackingChannelEventPolicy(ctx context.Context, bac return nil } -func (r *Reconciler) containsPolicy(name string, policies []*eventingv1alpha1.EventPolicy) bool { - for _, policy := range policies { - if policy.Name == name { - return true - } - } - return false -} - func (r *Reconciler) policyNeedsUpdate(foundEP, expected *eventingv1alpha1.EventPolicy) bool { return !equality.Semantic.DeepDerivative(expected, foundEP) } diff --git a/pkg/reconciler/channel/channel_test.go b/pkg/reconciler/channel/channel_test.go index 7df891b7e8f..3e77269a502 100644 --- a/pkg/reconciler/channel/channel_test.go +++ b/pkg/reconciler/channel/channel_test.go @@ -589,6 +589,67 @@ func TestReconcile(t *testing.T) { }), ), }, + }, { + Name: "should delete EventPolicies for backing channel", + Key: testKey, + Objects: []runtime.Object{ + NewChannel(channelName, testNS, + WithChannelTemplate(channelCRD()), + WithInitChannelConditions, + WithChannelEventPoliciesReady(), + WithChannelEventPoliciesListed(readyEventPolicyName)), + NewInMemoryChannel(channelName, testNS, + WithInitInMemoryChannelConditions, + WithInMemoryChannelDeploymentReady(), + WithInMemoryChannelServiceReady(), + WithInMemoryChannelEndpointsReady(), + WithInMemoryChannelChannelServiceReady(), + WithInMemoryChannelAddress(backingChannelAddressable), + WithInMemoryChannelDLSUnknown(), + WithInMemoryChannelEventPoliciesReady()), + NewEventPolicy(fmt.Sprintf("%s-%s", readyEventPolicyName, channelName), testNS, + WithEventPolicyToRef(imcV1GVK, channelName), + WithEventPolicyOwnerReferences([]metav1.OwnerReference{ + { + APIVersion: v1.SchemeGroupVersion.String(), + Kind: "InMemoryChannel", + Name: channelName, + }, { + APIVersion: eventingv1alpha1.SchemeGroupVersion.String(), + Kind: "EventPolicy", + Name: readyEventPolicyName, + }, + }...), + WithEventPolicyLabels(map[string]string{ + "messaging.knative.dev/channel-group": v1.SchemeGroupVersion.Group, + "messaging.knative.dev/channel-version": v1.SchemeGroupVersion.Version, + "messaging.knative.dev/channel-kind": "InMemoryChannel", + "messaging.knative.dev/channel-name": channelName, + }), + ), + }, + WantStatusUpdates: []clientgotesting.UpdateActionImpl{{ + Object: NewChannel(channelName, testNS, + WithChannelTemplate(channelCRD()), + WithInitChannelConditions, + WithBackingChannelObjRef(backingChannelObjRef()), + WithBackingChannelReady, + WithChannelDLSUnknown(), + WithChannelAddress(&backingChannelAddressable), + WithChannelEventPoliciesReadyBecauseNoPolicyAndOIDCEnabled(), + ), + }}, + WantDeletes: []clientgotesting.DeleteActionImpl{{ + ActionImpl: clientgotesting.ActionImpl{ + Namespace: testNS, + Resource: eventingv1alpha1.SchemeGroupVersion.WithResource("eventpolicies"), + }, + Name: fmt.Sprintf("%s-%s", readyEventPolicyName, channelName), + }}, + Ctx: feature.ToContext(context.Background(), feature.Flags{ + feature.OIDCAuthentication: feature.Enabled, + feature.AuthorizationDefaultMode: feature.AuthorizationAllowSameNamespace, + }), }} logger := logtesting.TestLogger(t) diff --git a/pkg/reconciler/channel/resources/eventpolicy.go b/pkg/reconciler/channel/resources/eventpolicy.go index 23f08217e59..fe2d021fa9b 100644 --- a/pkg/reconciler/channel/resources/eventpolicy.go +++ b/pkg/reconciler/channel/resources/eventpolicy.go @@ -29,13 +29,17 @@ const ( BackingChannelEventPolicyLabelPrefix = "messaging.knative.dev/" ) +func GetEventPolicyNameForBackingChannel(backingChannelName, parentPolicyName string) string { + return kmeta.ChildName(fmt.Sprintf("%s-", parentPolicyName), backingChannelName) +} + func MakeEventPolicyForBackingChannel(backingChannel *eventingduckv1.Channelable, parentPolicy *eventingv1alpha1.EventPolicy) *eventingv1alpha1.EventPolicy { parentPolicy = parentPolicy.DeepCopy() return &eventingv1alpha1.EventPolicy{ ObjectMeta: metav1.ObjectMeta{ Namespace: backingChannel.Namespace, - Name: kmeta.ChildName(fmt.Sprintf("%s-", parentPolicy.Name), backingChannel.Name), + Name: GetEventPolicyNameForBackingChannel(backingChannel.Name, parentPolicy.Name), OwnerReferences: []metav1.OwnerReference{ { APIVersion: backingChannel.APIVersion,