loom / cmd / controller / main.go

/*
Copyright 2025 Evan Jarrett.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package main

import (
	"context"
	"crypto/tls"
	_ "embed"
	"flag"
	"fmt"
	"os"
	"path/filepath"

	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
	// to ensure that exec-entrypoint and run can make use of them.
	_ "k8s.io/client-go/plugin/pkg/client/auth"

	"gopkg.in/yaml.v3"
	corev1 "k8s.io/api/core/v1"
	"k8s.io/apimachinery/pkg/api/resource"
	"k8s.io/apimachinery/pkg/runtime"
	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
	ctrl "sigs.k8s.io/controller-runtime"
	"sigs.k8s.io/controller-runtime/pkg/certwatcher"
	"sigs.k8s.io/controller-runtime/pkg/healthz"
	"sigs.k8s.io/controller-runtime/pkg/log/zap"
	"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
	"sigs.k8s.io/controller-runtime/pkg/webhook"

	"tangled.org/core/spindle"
	"tangled.org/core/spindle/config"
	"tangled.org/core/spindle/models"

	loomv1alpha1 "tangled.org/evan.jarrett.net/loom/api/v1alpha1"
	"tangled.org/evan.jarrett.net/loom/internal/controller"
	"tangled.org/evan.jarrett.net/loom/internal/engine"
	// +kubebuilder:scaffold:imports
)

// LoomConfig holds configuration from the ConfigMap
type LoomConfig struct {
	MaxConcurrentJobs int                `yaml:"maxConcurrentJobs"`
	Template          LoomTemplateConfig `yaml:"template"`
}

// LoomTemplateConfig holds job template configuration
type LoomTemplateConfig struct {
	ResourceProfiles []ResourceProfileConfig `yaml:"resourceProfiles"`
}

// ResourceProfileConfig holds a resource profile from ConfigMap
type ResourceProfileConfig struct {
	NodeSelector map[string]string `yaml:"nodeSelector"`
	Resources    ResourceConfig    `yaml:"resources"`
}

// ResourceConfig holds resource requirements as strings for parsing
type ResourceConfig struct {
	Requests ResourceValues `yaml:"requests"`
	Limits   ResourceValues `yaml:"limits"`
}

// ResourceValues holds CPU and memory as strings
type ResourceValues struct {
	CPU    string `yaml:"cpu"`
	Memory string `yaml:"memory"`
}

//go:embed motd.txt
var motd []byte

var (
	scheme   = runtime.NewScheme()
	setupLog = ctrl.Log.WithName("setup")
)

func init() {
	utilruntime.Must(clientgoscheme.AddToScheme(scheme))

	utilruntime.Must(loomv1alpha1.AddToScheme(scheme))
	// +kubebuilder:scaffold:scheme
}

// loadLoomConfig loads configuration from the ConfigMap file
func loadLoomConfig(configPath string) (*LoomConfig, error) {
	// Read config file
	data, err := os.ReadFile(configPath)
	if err != nil {
		return nil, fmt.Errorf("failed to read config file: %w", err)
	}

	// Parse YAML
	var cfg LoomConfig
	if err := yaml.Unmarshal(data, &cfg); err != nil {
		return nil, fmt.Errorf("failed to parse config: %w", err)
	}

	return &cfg, nil
}

// convertToResourceRequirements converts string-based resource config to Kubernetes ResourceRequirements
func convertToResourceRequirements(cfg ResourceConfig) (corev1.ResourceRequirements, error) {
	reqs := corev1.ResourceRequirements{
		Requests: corev1.ResourceList{},
		Limits:   corev1.ResourceList{},
	}

	// Parse requests
	if cfg.Requests.CPU != "" {
		cpuQty, err := resource.ParseQuantity(cfg.Requests.CPU)
		if err != nil {
			return reqs, fmt.Errorf("invalid CPU request %q: %w", cfg.Requests.CPU, err)
		}
		reqs.Requests[corev1.ResourceCPU] = cpuQty
	}
	if cfg.Requests.Memory != "" {
		memQty, err := resource.ParseQuantity(cfg.Requests.Memory)
		if err != nil {
			return reqs, fmt.Errorf("invalid memory request %q: %w", cfg.Requests.Memory, err)
		}
		reqs.Requests[corev1.ResourceMemory] = memQty
	}

	// Parse limits
	if cfg.Limits.CPU != "" {
		cpuQty, err := resource.ParseQuantity(cfg.Limits.CPU)
		if err != nil {
			return reqs, fmt.Errorf("invalid CPU limit %q: %w", cfg.Limits.CPU, err)
		}
		reqs.Limits[corev1.ResourceCPU] = cpuQty
	}
	if cfg.Limits.Memory != "" {
		memQty, err := resource.ParseQuantity(cfg.Limits.Memory)
		if err != nil {
			return reqs, fmt.Errorf("invalid memory limit %q: %w", cfg.Limits.Memory, err)
		}
		reqs.Limits[corev1.ResourceMemory] = memQty
	}

	return reqs, nil
}

// convertToResourceProfiles converts ConfigMap profiles to API ResourceProfiles
func convertToResourceProfiles(profiles []ResourceProfileConfig) ([]loomv1alpha1.ResourceProfile, error) {
	result := make([]loomv1alpha1.ResourceProfile, 0, len(profiles))

	for i, p := range profiles {
		resources, err := convertToResourceRequirements(p.Resources)
		if err != nil {
			return nil, fmt.Errorf("failed to convert profile %d resources: %w", i, err)
		}

		result = append(result, loomv1alpha1.ResourceProfile{
			NodeSelector: p.NodeSelector,
			Resources:    resources,
		})
	}

	return result, nil
}

// initializeSpindle creates a spindle server with KubernetesEngine
func initializeSpindle(ctx context.Context, cfg *config.Config, mgr ctrl.Manager, loomCfg *LoomConfig) (*spindle.Spindle, error) {
	// Initialize Kubernetes engine
	// Get namespace from environment (injected via Downward API)
	namespace := os.Getenv("POD_NAMESPACE")
	if namespace == "" {
		namespace = "default"
	}

	// Convert resource profiles to Kubernetes types
	profiles, err := convertToResourceProfiles(loomCfg.Template.ResourceProfiles)
	if err != nil {
		return nil, fmt.Errorf("failed to convert resource profiles: %w", err)
	}

	// Create template from loom config
	template := loomv1alpha1.SpindleTemplate{
		ResourceProfiles: profiles,
	}

	// Create spindle server first (without engine) to get access to vault
	s, err := spindle.New(ctx, cfg, map[string]models.Engine{})
	if err != nil {
		return nil, fmt.Errorf("failed to create spindle: %w", err)
	}

	// Now create kubernetes engine with access to vault
	kubeEngine := engine.NewKubernetesEngine(mgr.GetClient(), mgr.GetConfig(), namespace, template, s.Vault())

	// Register the engine with spindle by adding to the engines map
	s.Engines()["kubernetes"] = kubeEngine

	return s, nil
}

// nolint:gocyclo
func main() {
	var metricsAddr string
	var metricsCertPath, metricsCertName, metricsCertKey string
	var webhookCertPath, webhookCertName, webhookCertKey string
	var enableLeaderElection bool
	var probeAddr string
	var secureMetrics bool
	var enableHTTP2 bool
	var tlsOpts []func(*tls.Config)
	flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+
		"Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.")
	flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
	flag.BoolVar(&enableLeaderElection, "leader-elect", false,
		"Enable leader election for controller manager. "+
			"Enabling this will ensure there is only one active controller manager.")
	flag.BoolVar(&secureMetrics, "metrics-secure", true,
		"If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.")
	flag.StringVar(&webhookCertPath, "webhook-cert-path", "", "The directory that contains the webhook certificate.")
	flag.StringVar(&webhookCertName, "webhook-cert-name", "tls.crt", "The name of the webhook certificate file.")
	flag.StringVar(&webhookCertKey, "webhook-cert-key", "tls.key", "The name of the webhook key file.")
	flag.StringVar(&metricsCertPath, "metrics-cert-path", "",
		"The directory that contains the metrics server certificate.")
	flag.StringVar(&metricsCertName, "metrics-cert-name", "tls.crt", "The name of the metrics server certificate file.")
	flag.StringVar(&metricsCertKey, "metrics-cert-key", "tls.key", "The name of the metrics server key file.")
	flag.BoolVar(&enableHTTP2, "enable-http2", false,
		"If set, HTTP/2 will be enabled for the metrics and webhook servers")
	opts := zap.Options{
		Development: true,
	}
	opts.BindFlags(flag.CommandLine)
	flag.Parse()

	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))

	// if the enable-http2 flag is false (the default), http/2 should be disabled
	// due to its vulnerabilities. More specifically, disabling http/2 will
	// prevent from being vulnerable to the HTTP/2 Stream Cancellation and
	// Rapid Reset CVEs. For more information see:
	// - https://github.com/advisories/GHSA-qppj-fm5r-hxr3
	// - https://github.com/advisories/GHSA-4374-p667-p6c8
	disableHTTP2 := func(c *tls.Config) {
		setupLog.Info("disabling http/2")
		c.NextProtos = []string{"http/1.1"}
	}

	if !enableHTTP2 {
		tlsOpts = append(tlsOpts, disableHTTP2)
	}

	// Create watchers for metrics and webhooks certificates
	var metricsCertWatcher, webhookCertWatcher *certwatcher.CertWatcher

	// Initial webhook TLS options
	webhookTLSOpts := tlsOpts

	if len(webhookCertPath) > 0 {
		setupLog.Info("Initializing webhook certificate watcher using provided certificates",
			"webhook-cert-path", webhookCertPath, "webhook-cert-name", webhookCertName, "webhook-cert-key", webhookCertKey)

		var err error
		webhookCertWatcher, err = certwatcher.New(
			filepath.Join(webhookCertPath, webhookCertName),
			filepath.Join(webhookCertPath, webhookCertKey),
		)
		if err != nil {
			setupLog.Error(err, "Failed to initialize webhook certificate watcher")
			os.Exit(1)
		}

		webhookTLSOpts = append(webhookTLSOpts, func(config *tls.Config) {
			config.GetCertificate = webhookCertWatcher.GetCertificate
		})
	}

	webhookServer := webhook.NewServer(webhook.Options{
		TLSOpts: webhookTLSOpts,
	})

	// Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
	// More info:
	// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.21.0/pkg/metrics/server
	// - https://book.kubebuilder.io/reference/metrics.html
	metricsServerOptions := metricsserver.Options{
		BindAddress:   metricsAddr,
		SecureServing: secureMetrics,
		TLSOpts:       tlsOpts,
	}

	if secureMetrics {
		// FilterProvider is used to protect the metrics endpoint with authn/authz.
		// These configurations ensure that only authorized users and service accounts
		// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
		// https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.21.0/pkg/metrics/filters#WithAuthenticationAndAuthorization
		metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
	}

	// If the certificate is not specified, controller-runtime will automatically
	// generate self-signed certificates for the metrics server. While convenient for development and testing,
	// this setup is not recommended for production.
	//
	// TODO(user): If you enable certManager, uncomment the following lines:
	// - [METRICS-WITH-CERTS] at config/default/kustomization.yaml to generate and use certificates
	// managed by cert-manager for the metrics server.
	// - [PROMETHEUS-WITH-CERTS] at config/prometheus/kustomization.yaml for TLS certification.
	if len(metricsCertPath) > 0 {
		setupLog.Info("Initializing metrics certificate watcher using provided certificates",
			"metrics-cert-path", metricsCertPath, "metrics-cert-name", metricsCertName, "metrics-cert-key", metricsCertKey)

		var err error
		metricsCertWatcher, err = certwatcher.New(
			filepath.Join(metricsCertPath, metricsCertName),
			filepath.Join(metricsCertPath, metricsCertKey),
		)
		if err != nil {
			setupLog.Error(err, "to initialize metrics certificate watcher", "error", err)
			os.Exit(1)
		}

		metricsServerOptions.TLSOpts = append(metricsServerOptions.TLSOpts, func(config *tls.Config) {
			config.GetCertificate = metricsCertWatcher.GetCertificate
		})
	}

	// Create context for spindle initialization
	ctx := context.Background()

	// Load loom configuration from ConfigMap
	loomCfg, err := loadLoomConfig("/etc/loom/config.yaml")
	if err != nil {
		setupLog.Error(err, "failed to load loom config")
		os.Exit(1)
	}
	setupLog.Info("Loom configuration loaded",
		"maxConcurrentJobs", loomCfg.MaxConcurrentJobs,
		"resourceProfiles", len(loomCfg.Template.ResourceProfiles))

	// Load spindle configuration from environment
	spindleCfg, err := config.Load(ctx)
	if err != nil {
		setupLog.Error(err, "failed to load spindle config")
		os.Exit(1)
	}

	// Override maxJobCount from loom config
	if loomCfg.MaxConcurrentJobs > 0 {
		spindleCfg.Server.MaxJobCount = loomCfg.MaxConcurrentJobs
	}

	// Write embedded MOTD to temp file and configure spindle to use it
	motdFile, err := os.CreateTemp("", "loom-motd-*.txt")
	if err != nil {
		setupLog.Error(err, "failed to create MOTD temp file")
		os.Exit(1)
	}
	if _, err := motdFile.Write(motd); err != nil {
		setupLog.Error(err, "failed to write MOTD temp file")
		os.Exit(1)
	}
	motdFile.Close()
	spindleCfg.Server.MOTDFile = motdFile.Name()

	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
		Scheme:                 scheme,
		Metrics:                metricsServerOptions,
		WebhookServer:          webhookServer,
		HealthProbeBindAddress: probeAddr,
		LeaderElection:         enableLeaderElection,
		LeaderElectionID:       "d9c2f6b8.j5t.io",
		// LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily
		// when the Manager ends. This requires the binary to immediately end when the
		// Manager is stopped, otherwise, this setting is unsafe. Setting this significantly
		// speeds up voluntary leader transitions as the new leader don't have to wait
		// LeaseDuration time first.
		//
		// In the default scaffold provided, the program ends immediately after
		// the manager stops, so would be fine to enable this option. However,
		// if you are doing or is intended to do any operation such as perform cleanups
		// after the manager stops then its usage might be unsafe.
		// LeaderElectionReleaseOnCancel: true,
	})
	if err != nil {
		setupLog.Error(err, "unable to start manager")
		os.Exit(1)
	}

	// Initialize spindle server with KubernetesEngine
	s, err := initializeSpindle(ctx, spindleCfg, mgr, loomCfg)
	if err != nil {
		setupLog.Error(err, "failed to initialize spindle")
		os.Exit(1)
	}
	defer s.Queue().Stop()

	setupLog.Info("spindle server initialized successfully")

	// Start spindle HTTP server in background
	go func() {
		setupLog.Info("starting spindle HTTP server", "address", spindleCfg.Server.ListenAddr)
		if err := s.Start(ctx); err != nil {
			setupLog.Error(err, "spindle HTTP server error")
		}
	}()

	// Get loom image from environment (used for runner init container)
	loomImage := os.Getenv("LOOM_IMAGE")
	if loomImage == "" {
		loomImage = "atcr.io/evan.jarrett.net/loom:latest" // default fallback
	}

	// Setup controller with spindle components
	if err := (&controller.SpindleSetReconciler{
		Client:    mgr.GetClient(),
		Scheme:    mgr.GetScheme(),
		Config:    mgr.GetConfig(),
		Spindle:   s,
		LoomImage: loomImage,
	}).SetupWithManager(mgr); err != nil {
		setupLog.Error(err, "unable to create controller", "controller", "SpindleSet")
		os.Exit(1)
	}
	// +kubebuilder:scaffold:builder

	if metricsCertWatcher != nil {
		setupLog.Info("Adding metrics certificate watcher to manager")
		if err := mgr.Add(metricsCertWatcher); err != nil {
			setupLog.Error(err, "unable to add metrics certificate watcher to manager")
			os.Exit(1)
		}
	}

	if webhookCertWatcher != nil {
		setupLog.Info("Adding webhook certificate watcher to manager")
		if err := mgr.Add(webhookCertWatcher); err != nil {
			setupLog.Error(err, "unable to add webhook certificate watcher to manager")
			os.Exit(1)
		}
	}

	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
		setupLog.Error(err, "unable to set up health check")
		os.Exit(1)
	}
	if err := mgr.AddReadyzCheck("readyz", healthz.Ping); err != nil {
		setupLog.Error(err, "unable to set up ready check")
		os.Exit(1)
	}

	setupLog.Info("starting manager")
	if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {
		setupLog.Error(err, "problem running manager")
		os.Exit(1)
	}
}