feat: if condition exists, updating it, otherwise inserting it to the conditions list in the CRD, in the reconcile function

attestation-key-register/src/main.rs

@@ -138,9 +138,8 @@ async fn main() {
     let service = app.into_make_service();
     info!("Starting attestation key registration server on http://{addr}",);
 
-    let run = if args.cert_path.is_some() && args.key_path.is_some() {
-        let config = OpenSSLConfig::from_pem_file(args.cert_path.unwrap(), args.key_path.unwrap())
-            .expect("invalid PEM files");
+    let run = if let (Some(cert_path), Some(key_path)) = (args.cert_path, args.key_path) {
+        let config = OpenSSLConfig::from_pem_file(cert_path, key_path).expect("invalid PEM files");
         axum_server::bind_openssl(addr, config).serve(service).await
     } else {
         axum_server::bind(addr).serve(service).await

operator/src/attestation_key_register.rs

@@ -30,6 +30,7 @@ use crate::conditions::attestation_key_approved_condition;
 use crate::trustee;
 use operator::{
     ControllerError, TLS_DIR, controller_error_policy, create_or_info_if_exists, read_certificate,
+    upsert_condition,
 };
 
 const INTERNAL_ATTESTATION_KEY_REGISTER_PORT: i32 = 8001;
@@ -200,31 +201,14 @@ async fn approve_ak(ak: &AttestationKey, machine: &Machine, client: Client) -> R
     let name = ak.metadata.name.clone().unwrap_or_default();
     let aks: Api<AttestationKey> = Api::default_namespaced(client.clone());
 
-    let is_approved = ak
-        .status
-        .as_ref()
-        .and_then(|s| s.conditions.as_ref())
-        .map(|conditions| {
-            conditions
-                .iter()
-                .any(|c| c.type_ == "Approved" && c.status == "True")
-        })
-        .unwrap_or(false);
+    let generation = ak.metadata.generation;
+    let approve_reason = ATTESTATION_KEY_MACHINE_APPROVE;
+    let condition = attestation_key_approved_condition(approve_reason, generation, &ak.status);
+    let mut conditions = ak.status.as_ref().and_then(|s| s.conditions.clone());
+    let changed = upsert_condition(&mut conditions, condition);
 
-    if !is_approved {
-        let generation = ak.metadata.generation;
-        let approve_reason = ATTESTATION_KEY_MACHINE_APPROVE;
-        let condition = attestation_key_approved_condition(approve_reason, generation, &ak.status);
-        let mut conditions = ak
-            .status
-            .as_ref()
-            .and_then(|s| s.conditions.clone())
-            .unwrap_or_default();
-        conditions.push(condition);
-
-        let status = AttestationKeyStatus {
-            conditions: Some(conditions),
-        };
+    if changed {
+        let status = AttestationKeyStatus { conditions };
         update_status!(aks, &name, status)?;
         info!("Approved attestation key {name}");
     }

operator/src/lib.rs

@@ -11,6 +11,8 @@
 use anyhow::Result;
 use k8s_openapi::api::core::v1::{Secret, SecretVolumeSource, Volume, VolumeMount};
 use k8s_openapi::apimachinery::pkg::apis::meta::v1::OwnerReference;
+use k8s_openapi::apimachinery::pkg::apis::meta::v1::{Condition, Time};
+use k8s_openapi::jiff::Timestamp;
 use kube::{Api, Client, runtime::controller::Action};
 use log::{info, warn};
 use std::fmt::{Debug, Display};
@@ -94,3 +96,46 @@ pub async fn read_certificate(
     };
     Ok(Some((volume, volume_mount)))
 }
+
+// TODO: Port this functionality to kube-rs API.
+// Update condition if already present, otherwise append(insert) it into the conditions vector.
+pub fn upsert_condition(
+    existing_conditions: &mut Option<Vec<Condition>>,
+    new_condition: Condition,
+) -> bool {
+    let conditions_vec = existing_conditions.get_or_insert_with(Vec::new);
+
+    if let Some(existing) = conditions_vec
+        .iter_mut()
+        .find(|c| c.type_ == new_condition.type_)
+    {
+        let mut changed = false;
+
+        // Being faithful to kubernetes API semantics, only update transition time if status changes.
+        if existing.status != new_condition.status {
+            existing.status = new_condition.status;
+            existing.last_transition_time = Time(Timestamp::now());
+            changed = true;
+        }
+
+        if existing.reason != new_condition.reason {
+            existing.reason = new_condition.reason;
+            changed = true;
+        }
+
+        if existing.message != new_condition.message {
+            existing.message = new_condition.message;
+            changed = true;
+        }
+
+        if existing.observed_generation != new_condition.observed_generation {
+            existing.observed_generation = new_condition.observed_generation;
+            changed = true;
+        }
+
+        changed
+    } else {
+        conditions_vec.push(new_condition);
+        true
+    }
+}