CLOUDP-186825: Add deletion protection to deployments

Signed-off-by: Jose Vazquez <jose.vazquez@mongodb.com>

cmd/manager/main.go

@@ -133,14 +133,16 @@ func main() {
 	}
 
 	if err = (&atlasdeployment.AtlasDeploymentReconciler{
-		Client:           mgr.GetClient(),
-		Log:              logger.Named("controllers").Named("AtlasDeployment").Sugar(),
-		Scheme:           mgr.GetScheme(),
-		AtlasDomain:      config.AtlasDomain,
-		GlobalAPISecret:  config.GlobalAPISecret,
-		ResourceWatcher:  watch.NewResourceWatcher(),
-		GlobalPredicates: globalPredicates,
-		EventRecorder:    mgr.GetEventRecorderFor("AtlasDeployment"),
+		Client:                      mgr.GetClient(),
+		Log:                         logger.Named("controllers").Named("AtlasDeployment").Sugar(),
+		Scheme:                      mgr.GetScheme(),
+		AtlasDomain:                 config.AtlasDomain,
+		GlobalAPISecret:             config.GlobalAPISecret,
+		ResourceWatcher:             watch.NewResourceWatcher(),
+		GlobalPredicates:            globalPredicates,
+		EventRecorder:               mgr.GetEventRecorderFor("AtlasDeployment"),
+		ObjectDeletionProtection:    config.ObjectDeletionProtection,
+		SubObjectDeletionProtection: config.SubObjectDeletionProtection,
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "AtlasDeployment")
 		os.Exit(1)

pkg/controller/atlasdeployment/atlasdeployment_controller_test.go

@@ -0,0 +1,268 @@
+/*
+Copyright 2020 MongoDB.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package atlasdeployment
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.mongodb.org/atlas/mongodbatlas"
+	"go.uber.org/zap"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+
+	v1 "github.com/mongodb/mongodb-atlas-kubernetes/pkg/api/v1"
+	"github.com/mongodb/mongodb-atlas-kubernetes/pkg/api/v1/common"
+	"github.com/mongodb/mongodb-atlas-kubernetes/pkg/api/v1/status"
+	"github.com/mongodb/mongodb-atlas-kubernetes/pkg/controller/atlas"
+	"github.com/mongodb/mongodb-atlas-kubernetes/pkg/controller/customresource"
+	"github.com/mongodb/mongodb-atlas-kubernetes/pkg/controller/workflow"
+	"github.com/mongodb/mongodb-atlas-kubernetes/pkg/util/httputil"
+)
+
+const (
+	fakeDomain    = "atlas-unit-test.local"
+	fakeProjectID = "fake-test-project-id"
+	fakeNamespace = "fake-namespace"
+)
+
+func TestDeploymentRemovalCases(t *testing.T) {
+	testCases := []struct {
+		title         string
+		protected     bool
+		annotation    string
+		expectRemoval bool
+	}{
+		{
+			title:         "Deployment with protection ON and no annotations is kept",
+			protected:     true,
+			expectRemoval: false,
+		},
+		{
+			title:         "Deployment with protection OFF and no annotations is removed",
+			protected:     false,
+			expectRemoval: true,
+		},
+		{
+			title:         "Deployment with protection ON and 'keep' annotation is kept",
+			protected:     true,
+			annotation:    customresource.ResourcePolicyKeep,
+			expectRemoval: false,
+		},
+		{
+			title:         "Deployment with protection OFF but 'keep' annotation is kept",
+			protected:     false,
+			annotation:    customresource.ResourcePolicyKeep,
+			expectRemoval: false,
+		},
+		{
+			title:         "Deployment with protection ON but 'delete' annotation is removed",
+			protected:     true,
+			annotation:    customresource.ResourcePolicyDelete,
+			expectRemoval: true,
+		},
+		{
+			title:         "Deployment with protection OFF and 'delete' annotation is removed",
+			protected:     false,
+			annotation:    customresource.ResourcePolicyDelete,
+			expectRemoval: true,
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.title, func(t *testing.T) {
+			rt := testDeploymentDeletionRoundTripper()
+			te := newTestDeploymentEnv(t, rt, tc.protected, tc.annotation)
+
+			_, err := te.reconciliation.checkAndHandleRemoval(te.project, te.deployment)
+
+			require.NoError(t, err)
+			assert.Equal(t, tc.expectRemoval, rt.called)
+		})
+	}
+}
+
+func newTestDeploymentEnv(t *testing.T, rt http.RoundTripper, protected bool, annotation string) *testDeploymentEnv {
+	t.Helper()
+
+	sch := runtime.NewScheme()
+	addSecretsListSchema(sch)
+	addDeploymentSchema(sch)
+	k8sclient := testK8sClient(sch)
+
+	log := testLog(t)
+	r := testDeploymentReconciler(log, k8sclient, protected)
+
+	project := testProject(fakeNamespace)
+	deployment := testDeployment(project)
+	if annotation != "" {
+		customresource.SetAnnotation(deployment, customresource.ResourcePolicyAnnotation, annotation)
+	}
+	customresource.SetFinalizer(deployment, customresource.FinalizerLabel)
+	require.NoError(t, k8sclient.Create(context.Background(), deployment))
+
+	prevResult := testPrevResult()
+	conn := testConnection()
+	atlasClient := testAtlasClient(t, conn, rt)
+	return &testDeploymentEnv{
+		reconciler:     r,
+		reconciliation: testReconciliation(r, atlasClient, deployment, prevResult),
+		deployment:     deployment,
+		project:        project,
+	}
+}
+
+type testDeploymentEnv struct {
+	reconciler     *AtlasDeploymentReconciler
+	reconciliation *reconciliation
+	project        *v1.AtlasProject
+	deployment     *v1.AtlasDeployment
+}
+
+type deploymentDeletionRoundTripper struct {
+	called bool
+}
+
+func testDeploymentDeletionRoundTripper() *deploymentDeletionRoundTripper {
+	return &deploymentDeletionRoundTripper{}
+}
+
+func (rt *deploymentDeletionRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	expectedPath := fmt.Sprintf("/%s/api/atlas/v1.5/groups/%s/clusters/cluster-basics", fakeDomain, fakeProjectID)
+	if req.Method == http.MethodDelete && req.URL.Path == expectedPath {
+		rt.called = true
+		rsp := responseFor(req)
+		rsp.StatusCode = http.StatusNoContent
+		rsp.Status = http.StatusText(rsp.StatusCode)
+		return rsp, nil
+	}
+	panic(fmt.Sprintf("not implemented for %s path=%q", req.Method, req.URL.Path))
+}
+
+func responseFor(req *http.Request) *http.Response {
+	rsp := &http.Response{
+		Proto:      req.Proto,
+		ProtoMajor: req.ProtoMajor,
+		ProtoMinor: req.ProtoMinor,
+		Request:    req,
+		Header:     make(http.Header),
+	}
+	return rsp
+}
+
+func addSecretsListSchema(s *runtime.Scheme) {
+	s.AddKnownTypes(corev1.SchemeGroupVersion, &corev1.SecretList{})
+}
+
+func addDeploymentSchema(s *runtime.Scheme) {
+	s.AddKnownTypes(v1.GroupVersion, &v1.AtlasDeployment{})
+}
+
+func testK8sClient(s *runtime.Scheme) client.Client {
+	return fake.NewClientBuilder().WithScheme(s).Build()
+}
+
+func testConnection() atlas.Connection {
+	return atlas.Connection{
+		OrgID:      "unit-test-org",
+		PublicKey:  "publickey",
+		PrivateKey: "sshhh-secret-unit-test-key",
+	}
+}
+
+func testLog(t *testing.T) *zap.SugaredLogger {
+	t.Helper()
+
+	plog, err := zap.NewDevelopment()
+	require.NoError(t, err)
+	return plog.Sugar()
+}
+
+func testPrevResult() workflow.Result {
+	return workflow.Result{}.WithMessage("unchanged")
+}
+
+func testDeploymentReconciler(log *zap.SugaredLogger, k8sclient client.Client, protected bool) *AtlasDeploymentReconciler {
+	return &AtlasDeploymentReconciler{
+		Client:                   k8sclient,
+		Log:                      log,
+		ObjectDeletionProtection: protected,
+	}
+}
+
+func testProject(ns string) *v1.AtlasProject {
+	return &v1.AtlasProject{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-project",
+			Namespace: ns,
+		},
+		Status: status.AtlasProjectStatus{
+			ID: fakeProjectID,
+		},
+	}
+}
+
+func testDeployment(project *v1.AtlasProject) *v1.AtlasDeployment {
+	return &v1.AtlasDeployment{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "TestDeployment",
+			Namespace: project.Namespace,
+		},
+		Spec: v1.AtlasDeploymentSpec{
+			Project: common.ResourceRefNamespaced{
+				Name:      project.Name,
+				Namespace: project.Namespace,
+			},
+			DeploymentSpec: &v1.DeploymentSpec{
+				Name: "cluster-basics",
+				ProviderSettings: &v1.ProviderSettingsSpec{
+					InstanceSizeName:    "M2",
+					ProviderName:        "TENANT",
+					RegionName:          "US_EAST_1",
+					BackingProviderName: "AWS",
+				},
+			},
+		},
+	}
+}
+
+func testReconciliation(r *AtlasDeploymentReconciler, atlasClient mongodbatlas.Client, deployment *v1.AtlasDeployment, prevResult workflow.Result) *reconciliation {
+	log := r.Log.With("atlasdeployment", "test-namespace")
+	rc := &reconciliation{
+		reconciler:  r,
+		log:         log,
+		context:     context.Background(),
+		workflowCtx: customresource.MarkReconciliationStarted(r.Client, deployment, log),
+		prevResult:  prevResult,
+	}
+	rc.workflowCtx.Client = atlasClient
+	return rc
+}
+
+func testAtlasClient(t *testing.T, connection atlas.Connection, rt http.RoundTripper) mongodbatlas.Client {
+	t.Helper()
+
+	client, err := atlas.Client(fakeDomain, connection, nil, httputil.CustomTransport(rt))
+	require.NoError(t, err)
+	return client
+}

pkg/controller/customresource/customresource.go

@@ -135,3 +135,13 @@ func ReconciliationShouldBeSkipped(resource mdbv1.AtlasCustomResource) bool {
 	}
 	return false
 }
+
+// SetAnnotation sets an annotation in resource while respecting the rest of annotations.
+func SetAnnotation(resource mdbv1.AtlasCustomResource, key, value string) {
+	annot := resource.GetAnnotations()
+	if annot == nil {
+		annot = map[string]string{}
+	}
+	annot[key] = value
+	resource.SetAnnotations(annot)
+}