service_network_manager changes for SNVA security group API support

go.mod

@@ -12,6 +12,7 @@ require (
 	github.com/pkg/errors v0.9.1
 	github.com/stretchr/testify v1.8.2
 	go.uber.org/zap v1.24.0
+	golang.org/x/exp v0.0.0-20230905200255-921286631fa9
 	k8s.io/api v0.26.1
 	k8s.io/apimachinery v0.26.1
 	k8s.io/client-go v0.26.1
@@ -64,7 +65,7 @@ require (
 	go.uber.org/multierr v1.6.0 // indirect
 	golang.org/x/net v0.7.0 // indirect
 	golang.org/x/oauth2 v0.5.0 // indirect
-	golang.org/x/sys v0.6.0 // indirect
+	golang.org/x/sys v0.12.0 // indirect
 	golang.org/x/term v0.5.0 // indirect
 	golang.org/x/text v0.7.0 // indirect
 	golang.org/x/time v0.3.0 // indirect

go.sum

@@ -549,6 +549,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
+golang.org/x/exp v0.0.0-20230905200255-921286631fa9 h1:GoHiUyI/Tp2nVkLI2mCxVkOjsbSXD66ic0XW0js0R9g=
+golang.org/x/exp v0.0.0-20230905200255-921286631fa9/go.mod h1:S2oDrQGGwySpoQPVqRShND87VCbxmc6bL1Yd2oYrm6k=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -702,8 +704,8 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=

pkg/deploy/lattice/service_network_manager.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/golang/glog"
+	"golang.org/x/exp/slices"
 
 	"github.com/aws/aws-application-networking-k8s/pkg/aws/services"
 	"github.com/aws/aws-application-networking-k8s/pkg/utils/gwlog"
@@ -16,10 +16,13 @@ import (
 	lattice_aws "github.com/aws/aws-application-networking-k8s/pkg/aws"
 	"github.com/aws/aws-application-networking-k8s/pkg/config"
 	latticemodel "github.com/aws/aws-application-networking-k8s/pkg/model/lattice"
+	"github.com/aws/aws-application-networking-k8s/pkg/utils"
 )
 
+//go:generate mockgen -destination service_network_manager_mock.go -package lattice github.com/aws/aws-application-networking-k8s/pkg/deploy/lattice ServiceNetworkManager
+
 type ServiceNetworkManager interface {
-	Create(ctx context.Context, serviceNetwork *latticemodel.ServiceNetwork) (latticemodel.ServiceNetworkStatus, error)
+	CreateOrUpdate(ctx context.Context, serviceNetwork *latticemodel.ServiceNetwork) (latticemodel.ServiceNetworkStatus, error)
 	List(ctx context.Context) ([]string, error)
 	Delete(ctx context.Context, serviceNetwork string) error
 }
@@ -41,7 +44,8 @@ type defaultServiceNetworkManager struct {
 	cloud lattice_aws.Cloud
 }
 
-// Create will try to create a service_network and associate the service_network with vpc
+// CreateOrUpdate will try to create a service_network and associate the service_network with vpc.
+// Or try to update the security groups for the serviceNetworkVpcAssociation if security groups are changed.
 // return error when:
 //
 //	ListServiceNetworksWithContext returns error
@@ -55,27 +59,23 @@ type defaultServiceNetworkManager struct {
 // return errors.New(LATTICE_RETRY) when:
 //
 //	CreateServiceNetworkVpcAssociationInput returns ServiceNetworkVpcAssociationStatusFailed/ServiceNetworkVpcAssociationStatusCreateInProgress/MeshVpcAssociationStatusDeleteInProgress
-func (m *defaultServiceNetworkManager) Create(
-	ctx context.Context,
-	serviceNetwork *latticemodel.ServiceNetwork,
-) (latticemodel.ServiceNetworkStatus, error) {
+
+func (m *defaultServiceNetworkManager) CreateOrUpdate(ctx context.Context, serviceNetwork *latticemodel.ServiceNetwork) (latticemodel.ServiceNetworkStatus, error) {
 	// check if exists
-	serviceNetworkSummary, err := m.cloud.Lattice().FindServiceNetwork(ctx, serviceNetwork.Spec.Name, "")
+	foundSnSummary, err := m.cloud.Lattice().FindServiceNetwork(ctx, serviceNetwork.Spec.Name, "")
 	if err != nil && !services.IsNotFoundError(err) {
 		return latticemodel.ServiceNetworkStatus{ServiceNetworkARN: "", ServiceNetworkID: ""}, err
 	}
 
 	// pre declaration
 	var serviceNetworkId string
 	var serviceNetworkArn string
-	var isServiceNetworkAssociatedWithVpc bool
-	var serviceNetworkAssociatedWithCurrentVpcId *string
+	var isSnAlreadyAssociatedWithCurrentVpc bool
+	var snvaAssociatedWithCurrentVPC *vpclattice.ServiceNetworkVpcAssociationSummary
 	vpcLatticeSess := m.cloud.Lattice()
-
-	if serviceNetworkSummary == nil {
+	if foundSnSummary == nil {
 		m.log.Debugf("Creating ServiceNetwork %s and tagging it with vpcId %s",
 			serviceNetwork.Spec.Name, config.VpcID)
-
 		// Add tag to show this is the VPC create this service network
 		// This means, the service network can only be deleted by the controller running in this VPC
 		serviceNetworkInput := vpclattice.CreateServiceNetworkInput{
@@ -84,32 +84,36 @@ func (m *defaultServiceNetworkManager) Create(
 		}
 		serviceNetworkInput.Tags[latticemodel.K8SServiceNetworkOwnedByVPC] = &config.VpcID
 
-		m.log.Debugf("Creating serviceNetwork %+v", serviceNetworkInput)
+		m.log.Debugf("Creating ServiceNetwork %+v", serviceNetworkInput)
 		resp, err := vpcLatticeSess.CreateServiceNetworkWithContext(ctx, &serviceNetworkInput)
 		if err != nil {
 			return latticemodel.ServiceNetworkStatus{ServiceNetworkARN: "", ServiceNetworkID: ""}, err
 		}
 
 		serviceNetworkId = aws.StringValue(resp.Id)
 		serviceNetworkArn = aws.StringValue(resp.Arn)
-		isServiceNetworkAssociatedWithVpc = false
 	} else {
-		glog.V(6).Infof("serviceNetwork %s exists, checking its VPC association", serviceNetwork.Spec.Name)
-		serviceNetworkId = aws.StringValue(serviceNetworkSummary.SvcNetwork.Id)
-		serviceNetworkArn = aws.StringValue(serviceNetworkSummary.SvcNetwork.Arn)
-		isServiceNetworkAssociatedWithVpc, serviceNetworkAssociatedWithCurrentVpcId, _, err = m.isServiceNetworkAssociatedWithVPC(ctx, serviceNetworkId)
+		m.log.Debugf("ServiceNetwork %s exists, checking its VPC association", serviceNetwork.Spec.Name)
+		serviceNetworkId = aws.StringValue(foundSnSummary.SvcNetwork.Id)
+		serviceNetworkArn = aws.StringValue(foundSnSummary.SvcNetwork.Arn)
+		isSnAlreadyAssociatedWithCurrentVpc, snvaAssociatedWithCurrentVPC, _, err = m.isServiceNetworkAlreadyAssociatedWithVPC(ctx, serviceNetworkId)
 		if err != nil {
 			return latticemodel.ServiceNetworkStatus{ServiceNetworkARN: "", ServiceNetworkID: ""}, err
 		}
+		if serviceNetwork.Spec.AssociateToVPC == true && isSnAlreadyAssociatedWithCurrentVpc == true &&
+			snvaAssociatedWithCurrentVPC.Status != nil && aws.StringValue(snvaAssociatedWithCurrentVPC.Status) == vpclattice.ServiceNetworkVpcAssociationStatusActive {
+			return m.UpdateServiceNetworkVpcAssociation(ctx, &foundSnSummary.SvcNetwork, serviceNetwork, snvaAssociatedWithCurrentVPC.Id)
+		}
 	}
 
 	if serviceNetwork.Spec.AssociateToVPC == true {
-		if isServiceNetworkAssociatedWithVpc == false {
+		if isSnAlreadyAssociatedWithCurrentVpc == false {
 			// current state:  service network is associated to VPC
 			// desired state:  associate this service network to VPC
 			createServiceNetworkVpcAssociationInput := vpclattice.CreateServiceNetworkVpcAssociationInput{
 				ServiceNetworkIdentifier: &serviceNetworkId,
 				VpcIdentifier:            &config.VpcID,
+				SecurityGroupIds:         serviceNetwork.Spec.SecurityGroupIds,
 			}
 			m.log.Debugf("Creating association between ServiceNetwork %s and VPC %s", serviceNetworkId, config.VpcID)
 			resp, err := vpcLatticeSess.CreateServiceNetworkVpcAssociationWithContext(ctx, &createServiceNetworkVpcAssociationInput)
@@ -132,12 +136,13 @@ func (m *defaultServiceNetworkManager) Create(
 			}
 		}
 	} else {
-		if isServiceNetworkAssociatedWithVpc == true {
+		// serviceNetwork.Spec.AssociateToVPC == false
+		if isSnAlreadyAssociatedWithCurrentVpc == true {
 			// current state: service network is associated to VPC
 			// desired state: not to associate this service network to VPC
 			m.log.Debugf("Disassociating ServiceNetwork %s from VPC", serviceNetwork.Spec.Name)
 			deleteServiceNetworkVpcAssociationInput := vpclattice.DeleteServiceNetworkVpcAssociationInput{
-				ServiceNetworkVpcAssociationIdentifier: serviceNetworkAssociatedWithCurrentVpcId,
+				ServiceNetworkVpcAssociationIdentifier: snvaAssociatedWithCurrentVPC.Id,
 			}
 			resp, err := vpcLatticeSess.DeleteServiceNetworkVpcAssociationWithContext(ctx, &deleteServiceNetworkVpcAssociationInput)
 			if err != nil {
@@ -148,7 +153,7 @@ func (m *defaultServiceNetworkManager) Create(
 			// return retry and check later if disassociation workflow finishes
 			return latticemodel.ServiceNetworkStatus{ServiceNetworkARN: "", ServiceNetworkID: ""}, errors.New(LATTICE_RETRY)
 		}
-		m.log.Debugf("Created serviceNetwork %s without VPC association", serviceNetwork.Spec.Name)
+		m.log.Debugf("Created ServiceNetwork %s without VPC association", serviceNetwork.Spec.Name)
 	}
 	return latticemodel.ServiceNetworkStatus{ServiceNetworkARN: serviceNetworkArn, ServiceNetworkID: serviceNetworkId}, nil
 }
@@ -182,19 +187,17 @@ func (m *defaultServiceNetworkManager) Delete(ctx context.Context, snName string
 
 	vpcLatticeSess := m.cloud.Lattice()
 	serviceNetworkId := aws.StringValue(serviceNetworkSummary.SvcNetwork.Id)
-
-	_, serviceNetworkAssociatedWithCurrentVpcId, assocResp, err := m.isServiceNetworkAssociatedWithVPC(ctx, serviceNetworkId)
+	_, snvaAssociatedWithCurrentVPC, assocResp, err := m.isServiceNetworkAlreadyAssociatedWithVPC(ctx, serviceNetworkId)
 	if err != nil {
 		return err
 	}
-
-	if serviceNetworkAssociatedWithCurrentVpcId != nil {
+	if snvaAssociatedWithCurrentVPC != nil && snvaAssociatedWithCurrentVPC.Id != nil {
 		// Current VPC is associated with this service network
 		// Happy case, disassociate the VPC from service network
 		deleteServiceNetworkVpcAssociationInput := vpclattice.DeleteServiceNetworkVpcAssociationInput{
-			ServiceNetworkVpcAssociationIdentifier: serviceNetworkAssociatedWithCurrentVpcId,
+			ServiceNetworkVpcAssociationIdentifier: snvaAssociatedWithCurrentVPC.Id,
 		}
-		m.log.Debugf("Deleting ServiceNetworkVpcAssociation %s", *serviceNetworkAssociatedWithCurrentVpcId)
+		m.log.Debugf("Deleting ServiceNetworkVpcAssociation %s", *snvaAssociatedWithCurrentVPC.Id)
 		_, err := vpcLatticeSess.DeleteServiceNetworkVpcAssociationWithContext(ctx, &deleteServiceNetworkVpcAssociationInput)
 		if err != nil {
 			m.log.Debugf("Failed to delete association for %s, err: %s", snName, err)
@@ -241,10 +244,7 @@ func (m *defaultServiceNetworkManager) Delete(ctx context.Context, snName string
 }
 
 // If service_network exists, check if service_network has already associated with VPC
-func (m *defaultServiceNetworkManager) isServiceNetworkAssociatedWithVPC(
-	ctx context.Context,
-	serviceNetworkId string,
-) (bool, *string, []*vpclattice.ServiceNetworkVpcAssociationSummary, error) {
+func (m *defaultServiceNetworkManager) isServiceNetworkAlreadyAssociatedWithVPC(ctx context.Context, serviceNetworkId string) (bool, *vpclattice.ServiceNetworkVpcAssociationSummary, []*vpclattice.ServiceNetworkVpcAssociationSummary, error) {
 	vpcLatticeSess := m.cloud.Lattice()
 	// TODO: can pass vpc id to ListServiceNetworkVpcAssociationsInput, could return err if no associations
 	associationStatusInput := vpclattice.ListServiceNetworkVpcAssociationsInput{
@@ -267,22 +267,64 @@ func (m *defaultServiceNetworkManager) isServiceNetworkAssociatedWithVPC(
 				switch associationStatus {
 				case vpclattice.ServiceNetworkVpcAssociationStatusActive:
 					m.log.Debugf("Mesh and Vpc association is active.")
-					return true, r.Id, resp, nil
+					return true, r, resp, nil
 				case vpclattice.ServiceNetworkVpcAssociationStatusCreateFailed:
 					m.log.Debugf("Mesh and Vpc association does not exists, start creating service_network and vpc association")
-					return false, r.Id, resp, nil
+					return false, r, resp, nil
 				case vpclattice.ServiceNetworkVpcAssociationStatusDeleteFailed:
 					m.log.Debugf("Mesh and Vpc association failed to delete")
-					return true, r.Id, resp, nil
+					return true, r, resp, nil
 				case vpclattice.ServiceNetworkVpcAssociationStatusDeleteInProgress:
 					m.log.Debugf("ServiceNetwork and Vpc association is being deleted, retry later")
-					return true, r.Id, resp, errors.New(LATTICE_RETRY)
+					return true, r, resp, errors.New(LATTICE_RETRY)
 				case vpclattice.ServiceNetworkVpcAssociationStatusCreateInProgress:
 					m.log.Debugf("ServiceNetwork and Vpc association is being created, retry later")
-					return true, r.Id, resp, errors.New(LATTICE_RETRY)
+					return true, r, resp, errors.New(LATTICE_RETRY)
 				}
 			}
 		}
 	}
 	return false, nil, resp, err
 }
+
+func (m *defaultServiceNetworkManager) UpdateServiceNetworkVpcAssociation(ctx context.Context, existingSN *vpclattice.ServiceNetworkSummary, desiredSN *latticemodel.ServiceNetwork, existingSnvaId *string) (latticemodel.ServiceNetworkStatus, error) {
+	retrievedSnva, err := m.cloud.Lattice().GetServiceNetworkVpcAssociationWithContext(ctx, &vpclattice.GetServiceNetworkVpcAssociationInput{
+		ServiceNetworkVpcAssociationIdentifier: existingSnvaId,
+	})
+	if err != nil {
+		return latticemodel.ServiceNetworkStatus{}, err
+	}
+	sgIdsEqual := securityGroupIdsEqual(desiredSN.Spec.SecurityGroupIds, retrievedSnva.SecurityGroupIds)
+	if sgIdsEqual {
+		// desiredSN's security group ids are same with retrievedSnva's security group ids, don't need to update
+		return latticemodel.ServiceNetworkStatus{
+			ServiceNetworkID:     *existingSN.Id,
+			ServiceNetworkARN:    *existingSN.Arn,
+			SnvaSecurityGroupIds: retrievedSnva.SecurityGroupIds,
+		}, nil
+	}
+	updateSnvaResp, err := m.cloud.Lattice().UpdateServiceNetworkVpcAssociationWithContext(ctx, &vpclattice.UpdateServiceNetworkVpcAssociationInput{
+		ServiceNetworkVpcAssociationIdentifier: existingSnvaId,
+		SecurityGroupIds:                       desiredSN.Spec.SecurityGroupIds,
+	})
+	if err != nil {
+		return latticemodel.ServiceNetworkStatus{}, err
+	}
+	if *updateSnvaResp.Status == vpclattice.ServiceNetworkVpcAssociationStatusActive {
+		return latticemodel.ServiceNetworkStatus{
+			ServiceNetworkID:     *existingSN.Id,
+			ServiceNetworkARN:    *existingSN.Arn,
+			SnvaSecurityGroupIds: updateSnvaResp.SecurityGroupIds,
+		}, nil
+	} else {
+		return latticemodel.ServiceNetworkStatus{}, fmt.Errorf("%w, update svna status: %s", RetryErr, *updateSnvaResp.Status)
+	}
+}
+
+func securityGroupIdsEqual(arr1, arr2 []*string) bool {
+	ids1 := utils.SliceMap(arr1, aws.StringValue)
+	slices.Sort(ids1)
+	ids2 := utils.SliceMap(arr2, aws.StringValue)
+	slices.Sort(ids2)
+	return slices.Equal(ids1, ids2)
+}