Decorator controller rewrite (#344)

Co-authored-by: i-chvets <113444075+i-chvets@users.noreply.github.com>

charms/kfp-profile-controller/files/upstream/sync.py

@@ -144,7 +144,7 @@ def server_factory(visualization_server_image,
     Returns an HTTPServer populated with Handler with customized settings
     """
     class Controller(BaseHTTPRequestHandler):
-        def sync(self, parent, children):
+        def sync(self, parent, attachments):
             logger.info("Got new request")
 
             # parent is a namespace
@@ -155,7 +155,7 @@ def sync(self, parent, children):
 
             if pipeline_enabled != "true":
                 logger.info(f"Namespace not in scope, no action taken (metadata.labels.pipelines.kubeflow.org/enabled = {pipeline_enabled}, must be 'true')")
-                return {"status": {}, "children": []}
+                return {"status": {}, "attachments": []}
 
             desired_configmap_count = 1
             desired_resources = []
@@ -177,13 +177,13 @@ def sync(self, parent, children):
             # Compute status based on observed state.
             desired_status = {
                 "kubeflow-pipelines-ready":
-                    len(children["Secret.v1"]) == 1 and
-                    len(children["ConfigMap.v1"]) == desired_configmap_count and
-                    len(children["Deployment.apps/v1"]) == 2 and
-                    len(children["Service.v1"]) == 2 and
+                    len(attachments["Secret.v1"]) == 1 and
+                    len(attachments["ConfigMap.v1"]) == desired_configmap_count and
+                    len(attachments["Deployment.apps/v1"]) == 2 and
+                    len(attachments["Service.v1"]) == 2 and
                     # TODO CANONICAL: This only works if istio is available.  Disabled for now
-                    # len(children["DestinationRule.networking.istio.io/v1alpha3"]) == 1 and
-                    # len(children["AuthorizationPolicy.security.istio.io/v1beta1"]) == 1 and
+                    # len(attachments["DestinationRule.networking.istio.io/v1alpha3"]) == 1 and
+                    # len(attachments["AuthorizationPolicy.security.istio.io/v1beta1"]) == 1 and
                     "True" or "False"
             }
 
@@ -470,13 +470,14 @@ def sync(self, parent, children):
                 },
             })
 
-            return {"status": desired_status, "children": desired_resources}
+            return {"status": desired_status, "attachments": desired_resources}
 
         def do_POST(self):
             # Serve the sync() function as a JSON webhook.
             observed = json.loads(
                 self.rfile.read(int(self.headers.get("content-length"))))
-            desired = self.sync(observed["parent"], observed["children"])
+            logger.info(f"Request is  {observed}")
+            desired = self.sync(observed["object"], observed["attachments"])
 
             self.send_response(200)
             self.send_header("Content-type", "application/json")

charms/kfp-profile-controller/src/charm.py

@@ -35,8 +35,8 @@
 
 logger = logging.getLogger(__name__)
 
-CompositeController = create_global_resource(
-    "metacontroller.k8s.io", "v1alpha1", "CompositeController", "compositecontrollers"
+DecoratorController = create_global_resource(
+    "metacontroller.k8s.io", "v1alpha1", "DecoratorController", "decoratorcontrollers"
 )
 CONTROLLER_PORT = 80
 DISABLE_ISTIO_SIDECAR = "false"
@@ -48,6 +48,7 @@
 KFP_IMAGES_VERSION = "2.0.0-alpha.7"
 METADATA_GRPC_SERVICE_HOST = "mlmd.kubeflow"
 METADATA_GRPC_SERVICE_PORT = "8080"
+NAMESPACE_LABEL = "pipelines.kubeflow.org/enabled"
 SYNC_CODE_FILE = Path("files/upstream/sync.py")
 SYNC_CODE_DESTINATION_PATH = "/hooks/sync.py"
 
@@ -91,7 +92,7 @@ def __init__(self, *args):
                 charm=self,
                 name="kubernetes:secrets-and-compositecontroller",
                 resource_templates=K8S_RESOURCE_FILES,
-                krh_resource_types={Secret, CompositeController},
+                krh_resource_types={Secret, DecoratorController},
                 krh_labels=create_charm_default_labels(
                     self.app.name,
                     self.model.name,
@@ -111,6 +112,7 @@ def __init__(self, *args):
                         )
                     ).decode("utf-8"),
                     "minio_secret_name": f"{self.model.app.name}-minio-credentials",
+                    "label": NAMESPACE_LABEL,
                 },
                 lightkube_client=lightkube.Client(),
             ),

charms/kfp-profile-controller/src/templates/crd_manifests.yaml.j2

@@ -1,9 +1,9 @@
 apiVersion: metacontroller.k8s.io/v1alpha1
-kind: CompositeController
+kind: DecoratorController
 metadata:
   name: kubeflow-pipelines-profile-controller
 spec:
-  childResources:
+  attachments:
   - apiVersion: v1
     resource: secrets
     updateStrategy:
@@ -24,12 +24,14 @@ spec:
     resource: poddefaults
     updateStrategy:
       method: InPlace
-  generateSelector: true
   hooks:
     sync:
       webhook:
         url: {{ sync_webhook_url }}
-  parentResource:
-    apiVersion: v1
+  resources:
+  - apiVersion: v1
     resource: namespaces
+    labelSelector:
+      matchExpressions:
+      - {key: {{ label }}, operator: Exists}
   resyncPeriodSeconds: 3600

charms/kfp-profile-controller/tests/integration/test_charm.py

@@ -47,6 +47,8 @@ async def test_build_and_deploy(ops_test: OpsTest):
         entity_url="metacontroller-operator",
         # TODO: Revert once metacontroller stable supports k8s 1.22
         channel="latest/edge",
+        # Remove this config option after the metacontroller-operator is updated to v3
+        config={"metacontroller-image": "docker.io/metacontrollerio/metacontroller:v3.0.0"},
         trust=True,
     )