Fix policy synchronization in HA mode (#45)

Author: kairen

Makefile

@@ -1,6 +1,6 @@
 VERSION_MAJOR ?= 0
 VERSION_MINOR ?= 7
-VERSION_BUILD ?= 0
+VERSION_BUILD ?= 1
 VERSION ?= v$(VERSION_MAJOR).$(VERSION_MINOR).$(VERSION_BUILD)
 
 GOOS ?= $(shell go env GOOS)

deploy/deployment.yml

@@ -24,7 +24,7 @@ spec:
       serviceAccountName: pa-controller
       containers:
       - name: pa-controller
-        image: inwinstack/pa-controller:v0.7.0
+        image: inwinstack/pa-controller:v0.7.1
         args:
         - --logtostderr=true
         - --v=2

pkg/ha/ha.go

@@ -65,8 +65,8 @@ func (i *Inspector) getStatus() error {
 	}
 
 	if status.Enable == "yes" {
-		switch status.Group.Local.State {
-		case "active":
+		switch {
+		case status.Group.Local.State == "active" && status.Group.Local.StateSync == "Complete":
 			i.callbacks.OnActive()
 		default:
 			i.callbacks.OnPassive()

pkg/operator/pan/nat/controller.go

@@ -186,6 +186,13 @@ func (c *Controller) reconcile(key string) error {
 		if err := c.createOrUpdate(nat); err != nil {
 			return c.makeFailed(nat, err)
 		}
+		return nil
+	}
+
+	if nat.Status.Phase == blendedv1.NATActive && !c.isExistingNatPolicy(nat) {
+		if err := c.createOrUpdate(nat); err != nil {
+			return c.makeFailed(nat, err)
+		}
 	}
 	return nil
 }

pkg/operator/pan/nat/controller_test.go

@@ -18,7 +18,6 @@ package nat
 
 import (
 	"context"
-	"reflect"
 	"testing"
 	"time"
 
@@ -107,28 +106,6 @@ func TestNATController(t *testing.T) {
 		}
 	}
 	assert.Equal(t, false, failed, "The nat policy hasn't created.")
-
-	gnat, err := blendedset.InwinstackV1().NATs(namespace).Get(nat.Name, metav1.GetOptions{})
-	assert.Nil(t, err)
-
-	mc.Reset()
-	mc.AddResp("")
-	gnat.Spec.DestinationAddresses = []string{"140.23.110.10", "140.23.110.11"}
-	unat, err := blendedset.InwinstackV1().NATs(namespace).Update(gnat)
-	assert.Nil(t, err)
-
-	failed = true
-	for start := time.Now(); time.Since(start) < timeout; {
-		mc.AddResp(mc.Elm)
-		enrty, err := fwNat.Get(cfg.Vsys, unat.Name)
-		assert.Nil(t, err)
-		if reflect.DeepEqual(unat.Spec.DestinationAddresses, enrty.DestinationAddresses) {
-			failed = false
-			break
-		}
-	}
-	assert.Equal(t, false, failed, "The nat policy hasn't synced.")
-
 	assert.Nil(t, blendedset.InwinstackV1().NATs(namespace).Delete(nat.Name, nil))
 	natList, err := blendedset.InwinstackV1().NATs(namespace).List(metav1.ListOptions{})
 	assert.Nil(t, err)

pkg/operator/pan/nat/nat.go

@@ -57,6 +57,15 @@ func (c *Controller) newNatPolicy(n *blendedv1.NAT) *nat.Entry {
 	return entry
 }
 
+func (c *Controller) isExistingNatPolicy(nat *blendedv1.NAT) bool {
+	if entry, err := c.fwNat.Get(c.cfg.Vsys, nat.Name); err == nil {
+		if len(entry.Name) != 0 {
+			return true
+		}
+	}
+	return false
+}
+
 func (c *Controller) updateNatPolicy(nat *blendedv1.NAT) error {
 	entry := c.newNatPolicy(nat)
 	if err := c.fwNat.Edit(c.cfg.Vsys, *entry); err != nil {
@@ -67,8 +76,7 @@ func (c *Controller) updateNatPolicy(nat *blendedv1.NAT) error {
 }
 
 func (c *Controller) deleteNatPolicy(nat *blendedv1.NAT) error {
-	enrty, err := c.fwNat.Get(c.cfg.Vsys, nat.Name)
-	if len(enrty.Name) == 0 && err != nil {
+	if !c.isExistingNatPolicy(nat) {
 		return nil
 	}
 

pkg/operator/pan/security/controller.go

@@ -185,6 +185,13 @@ func (c *Controller) reconcile(key string) error {
 		if err := c.createOrUpdate(security); err != nil {
 			return c.makeFailed(security, err)
 		}
+		return nil
+	}
+
+	if security.Status.Phase == blendedv1.SecurityActive && !c.isExistingSecurityPolicy(security) {
+		if err := c.createOrUpdate(security); err != nil {
+			return c.makeFailed(security, err)
+		}
 	}
 	return nil
 }

pkg/operator/pan/security/controller_test.go

@@ -18,7 +18,6 @@ package security
 
 import (
 	"context"
-	"reflect"
 	"testing"
 	"time"
 
@@ -109,28 +108,6 @@ func TestSecurityController(t *testing.T) {
 		}
 	}
 	assert.Equal(t, false, failed, "The security policy hasn't created.")
-
-	gsec2, err := blendedset.InwinstackV1().Securities(namespace).Get(sec.Name, metav1.GetOptions{})
-	assert.Nil(t, err)
-
-	mc.Reset()
-	mc.AddResp("")
-	gsec2.Spec.DestinationAddresses = []string{"140.23.110.12"}
-	usec, err := blendedset.InwinstackV1().Securities(namespace).Update(gsec2)
-	assert.Nil(t, err)
-
-	failed = true
-	for start := time.Now(); time.Since(start) < timeout; {
-		mc.AddResp(mc.Elm)
-		enrty, err := fwSec.Get(cfg.Vsys, usec.Name)
-		assert.Nil(t, err)
-		if reflect.DeepEqual(usec.Spec.DestinationAddresses, enrty.DestinationAddresses) {
-			failed = false
-			break
-		}
-	}
-	assert.Equal(t, false, failed, "The security policy hasn't synced.")
-
 	assert.Nil(t, blendedset.InwinstackV1().Securities(namespace).Delete(sec.Name, nil))
 	secList, err := blendedset.InwinstackV1().Securities(namespace).List(metav1.ListOptions{})
 	assert.Nil(t, err)

pkg/operator/pan/security/security.go

@@ -61,6 +61,15 @@ func (c *Controller) newSecurityPolicy(sec *blendedv1.Security) *security.Entry
 	return entry
 }
 
+func (c *Controller) isExistingSecurityPolicy(sec *blendedv1.Security) bool {
+	if entry, err := c.fwSec.Get(c.cfg.Vsys, sec.Name); err == nil {
+		if len(entry.Name) != 0 {
+			return true
+		}
+	}
+	return false
+}
+
 func (c *Controller) updateSecurityPolicy(sec *blendedv1.Security) error {
 	entry := c.newSecurityPolicy(sec)
 	if err := c.fwSec.Edit(c.cfg.Vsys, *entry); err != nil {
@@ -75,8 +84,7 @@ func (c *Controller) updateSecurityPolicy(sec *blendedv1.Security) error {
 }
 
 func (c *Controller) deleteSecurityPolicy(sec *blendedv1.Security) error {
-	enrty, err := c.fwSec.Get(c.cfg.Vsys, sec.Name)
-	if len(enrty.Name) == 0 && err != nil {
+	if !c.isExistingSecurityPolicy(sec) {
 		return nil
 	}
 

pkg/operator/pan/service/controller.go

@@ -186,6 +186,13 @@ func (c *Controller) reconcile(key string) error {
 		if err := c.createOrUpdate(service); err != nil {
 			return c.makeFailed(service, err)
 		}
+		return nil
+	}
+
+	if service.Status.Phase == blendedv1.ServiceActive && !c.isExistingServiceObject(service) {
+		if err := c.createOrUpdate(service); err != nil {
+			return c.makeFailed(service, err)
+		}
 	}
 	return nil
 }