fix(kuma-cp): pass context via snapshot reconciler to generateCerts (backport of #7231)

pkg/plugins/policies/meshaccesslog/plugin/v1alpha1/plugin_test.go

@@ -970,7 +970,7 @@ var _ = Describe("MeshAccessLog", func() {
 			resources := xds_context.NewResources()
 			resources.MeshLocalResources[core_mesh.MeshGatewayType] = &gateways
 
-			context := xds_context.Context{
+			xdsCtx := xds_context.Context{
 				Mesh: xds_context.MeshContext{
 					Resource: &core_mesh.MeshResource{
 						Meta: &test_model.ResourceMeta{
@@ -1009,7 +1009,7 @@ var _ = Describe("MeshAccessLog", func() {
 			}
 			plugin := plugin.NewPlugin().(core_plugins.PolicyPlugin)
 
-			Expect(plugin.Apply(resourceSet, context, &proxy)).To(Succeed())
+			Expect(plugin.Apply(resourceSet, xdsCtx, &proxy)).To(Succeed())
 
 			for i, r := range resourceSet.ListOf(envoy_resource.ListenerType) {
 				actual, err := util_proto.ToYAML(r.Resource)

pkg/plugins/policies/meshfaultinjection/plugin/v1alpha1/plugin_test.go

@@ -1,6 +1,7 @@
 package v1alpha1_test
 
 import (
+	"context"
 	"path/filepath"
 
 	envoy_resource "github.com/envoyproxy/go-control-plane/pkg/resource/v3"
@@ -205,7 +206,7 @@ var _ = Describe("MeshFaultInjection", func() {
 			Items: []*core_mesh.MeshGatewayRouteResource{samples.BackendGatewayRoute()},
 		}
 
-		context := test_xds.CreateSampleMeshContextWith(resources)
+		xdsCtx := test_xds.CreateSampleMeshContextWith(resources)
 		proxy := core_xds.Proxy{
 			APIVersion: "v3",
 			Dataplane:  samples.GatewayDataplane(),
@@ -219,14 +220,14 @@ var _ = Describe("MeshFaultInjection", func() {
 			},
 		}
 		gatewayGenerator := gatewayGenerator()
-		generatedResources, err := gatewayGenerator.Generate(context, &proxy)
+		generatedResources, err := gatewayGenerator.Generate(context.Background(), xdsCtx, &proxy)
 		Expect(err).NotTo(HaveOccurred())
 
 		// when
 		plugin := plugin.NewPlugin().(core_plugins.PolicyPlugin)
 
 		// then
-		Expect(plugin.Apply(generatedResources, context, &proxy)).To(Succeed())
+		Expect(plugin.Apply(generatedResources, xdsCtx, &proxy)).To(Succeed())
 		Expect(util_proto.ToYAML(generatedResources.ListOf(envoy_resource.ListenerType)[0].Resource)).To(test_matchers.MatchGoldenYAML(filepath.Join("testdata", "gateway_basic_listener.golden.yaml")))
 	})
 })

pkg/plugins/policies/meshratelimit/plugin/v1alpha1/plugin_test.go

@@ -1,6 +1,7 @@
 package v1alpha1_test
 
 import (
+	"context"
 	"path/filepath"
 	"time"
 
@@ -459,7 +460,7 @@ var _ = Describe("MeshRateLimit", func() {
 			Items: []*core_mesh.MeshGatewayRouteResource{samples.BackendGatewayRoute()},
 		}
 
-		context := test_xds.CreateSampleMeshContextWith(resources)
+		xdsCtx := test_xds.CreateSampleMeshContextWith(resources)
 		proxy := xds.Proxy{
 			APIVersion: "v3",
 			Dataplane:  samples.GatewayDataplane(),
@@ -473,14 +474,14 @@ var _ = Describe("MeshRateLimit", func() {
 			},
 		}
 		gatewayGenerator := gatewayGenerator()
-		generatedResources, err := gatewayGenerator.Generate(context, &proxy)
+		generatedResources, err := gatewayGenerator.Generate(context.Background(), xdsCtx, &proxy)
 		Expect(err).NotTo(HaveOccurred())
 
 		// when
 		plugin := plugin.NewPlugin().(core_plugins.PolicyPlugin)
 
 		// then
-		Expect(plugin.Apply(generatedResources, context, &proxy)).To(Succeed())
+		Expect(plugin.Apply(generatedResources, xdsCtx, &proxy)).To(Succeed())
 		Expect(util_proto.ToYAML(generatedResources.ListOf(envoy_resource.RouteType)[0].Resource)).To(test_matchers.MatchGoldenYAML(filepath.Join("testdata", "gateway_basic_routes.golden.yaml")))
 		Expect(util_proto.ToYAML(generatedResources.ListOf(envoy_resource.ListenerType)[0].Resource)).To(test_matchers.MatchGoldenYAML(filepath.Join("testdata", "gateway_basic_listener.golden.yaml")))
 	})

pkg/plugins/policies/meshtimeout/plugin/v1alpha1/plugin_test.go

@@ -1,6 +1,7 @@
 package v1alpha1
 
 import (
+	"context"
 	"fmt"
 	"path/filepath"
 
@@ -393,7 +394,7 @@ var _ = Describe("MeshTimeout", func() {
 			Items: []*core_mesh.MeshGatewayRouteResource{samples.BackendGatewayRoute()},
 		}
 
-		context := test_xds.CreateSampleMeshContextWith(resources)
+		xdsCtx := test_xds.CreateSampleMeshContextWith(resources)
 		proxy := xds.Proxy{
 			APIVersion: "v3",
 			Dataplane:  samples.GatewayDataplane(),
@@ -407,12 +408,12 @@ var _ = Describe("MeshTimeout", func() {
 			},
 		}
 		gatewayGenerator := gatewayGenerator()
-		generatedResources, err := gatewayGenerator.Generate(context, &proxy)
+		generatedResources, err := gatewayGenerator.Generate(context.Background(), xdsCtx, &proxy)
 		Expect(err).NotTo(HaveOccurred())
 
 		// when
 		plugin := NewPlugin().(core_plugins.PolicyPlugin)
-		Expect(plugin.Apply(generatedResources, context, &proxy)).To(Succeed())
+		Expect(plugin.Apply(generatedResources, xdsCtx, &proxy)).To(Succeed())
 
 		// then
 		Expect(getResourceYaml(generatedResources.ListOf(envoy_resource.ListenerType))).To(matchers.MatchGoldenYAML(filepath.Join("..", "testdata", "gateway_listener.golden.yaml")))

pkg/plugins/runtime/gateway/gateway_route_generator_test.go

@@ -41,17 +41,19 @@ var _ = Describe("Gateway Route", func() {
 
 		// We expect there to be a Dataplane fixture named
 		// "default" in the current mesh.
-		ctx, proxy := MakeGeneratorContext(rt,
-			core_model.ResourceKey{Mesh: "default", Name: "default"})
+		xdsCtx, proxy := MakeGeneratorContext(
+			rt,
+			core_model.ResourceKey{Mesh: "default", Name: "default"},
+		)
 
 		// Tokens for zone egress needs to be generated
 		// Without test configuration each run will generates
 		// new tokens for authentication.
-		ctx.ControlPlane.Secrets = &xds.TestSecrets{}
+		xdsCtx.ControlPlane.Secrets = &xds.TestSecrets{}
 
 		Expect(proxy.Dataplane.Spec.IsBuiltinGateway()).To(BeTrue())
 
-		if err := reconciler.Reconcile(*ctx, proxy); err != nil {
+		if err := reconciler.Reconcile(context.Background(), *xdsCtx, proxy); err != nil {
 			return nil, err
 		}
 

pkg/plugins/runtime/gateway/generator.go

@@ -200,10 +200,10 @@ func GatewayListenerInfoFromProxy(
 	return listenerInfos, nil
 }
 
-func (g Generator) Generate(ctx xds_context.Context, proxy *core_xds.Proxy) (*core_xds.ResourceSet, error) {
+func (g Generator) Generate(ctx context.Context, xdsCtx xds_context.Context, proxy *core_xds.Proxy) (*core_xds.ResourceSet, error) {
 	resources := core_xds.NewResourceSet()
 
-	listenerInfos, err := GatewayListenerInfoFromProxy(context.TODO(), ctx.Mesh, proxy, g.Zone)
+	listenerInfos, err := GatewayListenerInfoFromProxy(ctx, xdsCtx.Mesh, proxy, g.Zone)
 	if err != nil {
 		return nil, errors.Wrap(err, "error generating listener info from Proxy")
 	}
@@ -216,13 +216,13 @@ func (g Generator) Generate(ctx xds_context.Context, proxy *core_xds.Proxy) (*co
 			return nil, errors.New("no support for protocol")
 		}
 
-		cdsResources, err := g.generateCDS(ctx, info, info.HostInfos)
+		cdsResources, err := g.generateCDS(ctx, xdsCtx, info, info.HostInfos)
 		if err != nil {
 			return nil, err
 		}
 		resources.AddSet(cdsResources)
 
-		ldsResources, limit, err := g.generateLDS(ctx, info, info.HostInfos)
+		ldsResources, limit, err := g.generateLDS(xdsCtx, info, info.HostInfos)
 		if err != nil {
 			return nil, err
 		}
@@ -232,7 +232,7 @@ func (g Generator) Generate(ctx xds_context.Context, proxy *core_xds.Proxy) (*co
 			limits = append(limits, *limit)
 		}
 
-		rdsResources, err := g.generateRDS(ctx, info, info.HostInfos)
+		rdsResources, err := g.generateRDS(xdsCtx, info, info.HostInfos)
 		if err != nil {
 			return nil, err
 		}
@@ -295,11 +295,16 @@ func (g Generator) generateLDS(ctx xds_context.Context, info GatewayListenerInfo
 	return resources, limit, nil
 }
 
-func (g Generator) generateCDS(ctx xds_context.Context, info GatewayListenerInfo, hostInfos []GatewayHostInfo) (*core_xds.ResourceSet, error) {
+func (g Generator) generateCDS(
+	ctx context.Context,
+	xdsCtx xds_context.Context,
+	info GatewayListenerInfo,
+	hostInfos []GatewayHostInfo,
+) (*core_xds.ResourceSet, error) {
 	resources := core_xds.NewResourceSet()
 
 	for _, hostInfo := range hostInfos {
-		clusterRes, err := g.ClusterGenerator.GenerateClusters(context.TODO(), ctx, info, hostInfo)
+		clusterRes, err := g.ClusterGenerator.GenerateClusters(ctx, xdsCtx, info, hostInfo)
 		if err != nil {
 			return nil, errors.Wrapf(err, "failed to generate clusters for dataplane %q", info.Proxy.Id)
 		}

pkg/plugins/runtime/gateway/listener_generator_test.go

@@ -1,6 +1,7 @@
 package gateway_test
 
 import (
+	"context"
 	"path"
 
 	"github.com/envoyproxy/go-control-plane/pkg/cache/v3"
@@ -36,12 +37,12 @@ var _ = Describe("Gateway Listener", func() {
 
 		// We expect there to be a Dataplane fixture named
 		// "default" in the current mesh.
-		ctx, proxy := MakeGeneratorContext(rt,
+		xdsCtx, proxy := MakeGeneratorContext(rt,
 			core_model.ResourceKey{Mesh: r.GetMeta().GetMesh(), Name: "default"})
 
 		Expect(proxy.Dataplane.Spec.IsBuiltinGateway()).To(BeTrue())
 
-		if err := reconciler.Reconcile(*ctx, proxy); err != nil {
+		if err := reconciler.Reconcile(context.Background(), *xdsCtx, proxy); err != nil {
 			return nil, err
 		}
 

pkg/test/xds/secrets.go

@@ -1,6 +1,7 @@
 package xds
 
 import (
+	"context"
 	"time"
 
 	mesh_proto "github.com/kumahq/kuma/api/mesh/v1alpha1"
@@ -64,6 +65,7 @@ func (ts *TestSecrets) get(meshes []*core_mesh.MeshResource) (*core_xds.Identity
 }
 
 func (ts *TestSecrets) GetForZoneEgress(
+	_ context.Context,
 	_ *core_mesh.ZoneEgressResource,
 	mesh *core_mesh.MeshResource,
 ) (*core_xds.IdentitySecret, *core_xds.CaSecret, error) {
@@ -73,6 +75,7 @@ func (ts *TestSecrets) GetForZoneEgress(
 }
 
 func (ts *TestSecrets) GetForDataPlane(
+	_ context.Context,
 	_ *core_mesh.DataplaneResource,
 	mesh *core_mesh.MeshResource,
 	meshes []*core_mesh.MeshResource,
@@ -82,6 +85,7 @@ func (ts *TestSecrets) GetForDataPlane(
 }
 
 func (ts *TestSecrets) GetAllInOne(
+	_ context.Context,
 	mesh *core_mesh.MeshResource,
 	_ *core_mesh.DataplaneResource,
 	meshes []*core_mesh.MeshResource,

pkg/xds/generator/admin_proxy_generator.go

@@ -1,6 +1,8 @@
 package generator
 
 import (
+	"context"
+
 	core_xds "github.com/kumahq/kuma/pkg/core/xds"
 	xds_context "github.com/kumahq/kuma/pkg/xds/context"
 	envoy_common "github.com/kumahq/kuma/pkg/xds/envoy"
@@ -30,7 +32,7 @@ var staticTlsEndpointPaths = []*envoy_common.StaticEndpointPath{
 // By default, Admin API is exposed only on loopback interface because of security reasons.
 type AdminProxyGenerator struct{}
 
-func (g AdminProxyGenerator) Generate(ctx xds_context.Context, proxy *core_xds.Proxy) (*core_xds.ResourceSet, error) {
+func (g AdminProxyGenerator) Generate(ctx context.Context, xdsCtx xds_context.Context, proxy *core_xds.Proxy) (*core_xds.ResourceSet, error) {
 	if proxy.Metadata.GetAdminPort() == 0 {
 		// It's not possible to export Admin endpoints if Envoy Admin API has not been enabled on that dataplane.
 		return nil, nil

pkg/xds/generator/admin_proxy_generator_test.go

@@ -1,6 +1,7 @@
 package generator_test
 
 import (
+	"context"
 	"os"
 	"path/filepath"
 
@@ -13,7 +14,7 @@ import (
 	test_model "github.com/kumahq/kuma/pkg/test/resources/model"
 	"github.com/kumahq/kuma/pkg/tls"
 	util_proto "github.com/kumahq/kuma/pkg/util/proto"
-	"github.com/kumahq/kuma/pkg/xds/context"
+	xds_context "github.com/kumahq/kuma/pkg/xds/context"
 	envoy_common "github.com/kumahq/kuma/pkg/xds/envoy"
 	"github.com/kumahq/kuma/pkg/xds/generator"
 )
@@ -36,8 +37,8 @@ var _ = Describe("AdminProxyGenerator", func() {
 			Expect(err).ToNot(HaveOccurred())
 			parseResource(bytes, dataplane)
 
-			ctx := context.Context{
-				Mesh: context.MeshContext{
+			ctx := xds_context.Context{
+				Mesh: xds_context.MeshContext{
 					Resource: &core_mesh.MeshResource{
 						Meta: &test_model.ResourceMeta{
 							Name: "default",
@@ -62,7 +63,7 @@ var _ = Describe("AdminProxyGenerator", func() {
 			}
 
 			// when
-			resources, err := generator.Generate(ctx, proxy)
+			resources, err := generator.Generate(context.Background(), ctx, proxy)
 
 			// then
 			Expect(err).ToNot(HaveOccurred())

pkg/xds/generator/core/resource_generator.go

@@ -1,22 +1,26 @@
 package core
 
 import (
+	"context"
+
 	"github.com/pkg/errors"
 
 	model "github.com/kumahq/kuma/pkg/core/xds"
 	xds_context "github.com/kumahq/kuma/pkg/xds/context"
 )
 
 type ResourceGenerator interface {
-	Generate(xds_context.Context, *model.Proxy) (*model.ResourceSet, error)
+	Generate(context.Context, xds_context.Context, *model.Proxy) (*model.ResourceSet, error)
 }
 
 type CompositeResourceGenerator []ResourceGenerator
 
-func (c CompositeResourceGenerator) Generate(ctx xds_context.Context, proxy *model.Proxy) (*model.ResourceSet, error) {
+func (c CompositeResourceGenerator) Generate(
+	ctx context.Context, xdsCtx xds_context.Context, proxy *model.Proxy,
+) (*model.ResourceSet, error) {
 	resources := model.NewResourceSet()
 	for _, gen := range c {
-		rs, err := gen.Generate(ctx, proxy)
+		rs, err := gen.Generate(ctx, xdsCtx, proxy)
 		if err != nil {
 			return nil, errors.Wrapf(err, "%T failed", gen)
 		}

pkg/xds/generator/direct_access_proxy_generator.go

@@ -1,6 +1,7 @@
 package generator
 
 import (
+	"context"
 	"fmt"
 	"sort"
 
@@ -32,17 +33,17 @@ func DirectAccessEndpointName(endpoint Endpoint) string {
 	return fmt.Sprintf("direct_access_%s:%d", endpoint.Address, endpoint.Port)
 }
 
-func (_ DirectAccessProxyGenerator) Generate(ctx xds_context.Context, proxy *core_xds.Proxy) (*core_xds.ResourceSet, error) {
+func (_ DirectAccessProxyGenerator) Generate(ctx context.Context, xdsCtx xds_context.Context, proxy *core_xds.Proxy) (*core_xds.ResourceSet, error) {
 	tproxy := proxy.Dataplane.Spec.Networking.GetTransparentProxying()
 	resources := core_xds.NewResourceSet()
 	if tproxy.GetRedirectPortOutbound() == 0 || tproxy.GetRedirectPortInbound() == 0 || len(tproxy.GetDirectAccessServices()) == 0 {
 		return resources, nil
 	}
 
 	sourceService := proxy.Dataplane.Spec.GetIdentifyingService()
-	meshName := ctx.Mesh.Resource.GetMeta().GetName()
+	meshName := xdsCtx.Mesh.Resource.GetMeta().GetName()
 
-	endpoints, err := directAccessEndpoints(proxy.Dataplane, ctx.Mesh.Resources.Dataplanes(), ctx.Mesh.Resource)
+	endpoints, err := directAccessEndpoints(proxy.Dataplane, xdsCtx.Mesh.Resources.Dataplanes(), xdsCtx.Mesh.Resource)
 	if err != nil {
 		return nil, err
 	}
@@ -58,7 +59,7 @@ func (_ DirectAccessProxyGenerator) Generate(ctx xds_context.Context, proxy *cor
 					envoy_common.TrafficDirectionOutbound,
 					sourceService,
 					name,
-					ctx.Mesh.GetLoggingBackend(proxy.Policies.TrafficLogs[core_mesh.PassThroughService]),
+					xdsCtx.Mesh.GetLoggingBackend(proxy.Policies.TrafficLogs[core_mesh.PassThroughService]),
 					proxy,
 				)))).
 			Configure(envoy_listeners.TransparentProxying(proxy.Dataplane.Spec.Networking.GetTransparentProxying())).
@@ -75,7 +76,7 @@ func (_ DirectAccessProxyGenerator) Generate(ctx xds_context.Context, proxy *cor
 
 	directAccessCluster, err := envoy_clusters.NewClusterBuilder(proxy.APIVersion).
 		Configure(envoy_clusters.PassThroughCluster("direct_access")).
-		Configure(envoy_clusters.UnknownDestinationClientSideMTLS(proxy.SecretsTracker, ctx.Mesh.Resource)).
+		Configure(envoy_clusters.UnknownDestinationClientSideMTLS(proxy.SecretsTracker, xdsCtx.Mesh.Resource)).
 		Configure(envoy_clusters.DefaultTimeout()).
 		Build()
 	if err != nil {