Update transition time only on new status

Do not update on each new generation

Fixes: #221

Signed-off-by: Jakob Naucke <jnaucke@redhat.com>

Author: Jakob-Naucke

compute-pcrs/src/main.rs

@@ -74,7 +74,7 @@ async fn main() -> Result<()> {
 
     let approved_images: Api<ApprovedImage> = Api::default_namespaced(client);
     let image = approved_images.get(&args.resource_name).await?;
-    let committed = committed_condition(INSTALLED_REASON, image.metadata.generation);
+    let committed = committed_condition(INSTALLED_REASON, image.metadata.generation, &None);
     let conditions = Some(vec![committed]);
     let status = ApprovedImageStatus { conditions };
     update_status!(approved_images, &args.resource_name, status)?;

lib/src/lib.rs

@@ -40,10 +40,46 @@ pub fn condition_status(status: bool) -> String {
     }
 }
 
-pub fn committed_condition(reason: &str, generation: Option<i64>) -> Condition {
+pub trait Conditions {
+    fn conditions(&self) -> &Option<Vec<Condition>>;
+}
+
+impl Conditions for TrustedExecutionClusterStatus {
+    fn conditions(&self) -> &Option<Vec<Condition>> {
+        &self.conditions
+    }
+}
+
+impl Conditions for AttestationKeyStatus {
+    fn conditions(&self) -> &Option<Vec<Condition>> {
+        &self.conditions
+    }
+}
+
+impl Conditions for ApprovedImageStatus {
+    fn conditions(&self) -> &Option<Vec<Condition>> {
+        &self.conditions
+    }
+}
+
+pub fn transition_time<S: Conditions>(
+    existing_status: &Option<S>,
+    type_: &str,
+    new_status: &str,
+) -> Time {
+    let get = |s: &S| s.conditions().clone();
+    let conditions = existing_status.as_ref().and_then(get);
+    let find = |c: &Condition| type_ == c.type_ && new_status == c.status;
+    let existing = conditions.and_then(|cs| cs.into_iter().find(find));
+    let time = existing.map(|c| c.last_transition_time);
+    time.unwrap_or(Time(Timestamp::now()))
+}
+
+pub fn committed_condition(reason: &str, generation: Option<i64>, existing_status: &Option<ApprovedImageStatus>) -> Condition {
+    let status = condition_status(reason == COMMITTED_REASON);
+    let type_ = COMMITTED_CONDITION;
     Condition {
-        type_: COMMITTED_CONDITION.to_string(),
-        status: condition_status(reason == COMMITTED_REASON),
+        type_: type_.to_string(),
         reason: reason.to_string(),
         message: match reason {
             NOT_COMMITTED_REASON_COMPUTING => "Computation is ongoing. Check jobs for progress.",
@@ -55,7 +91,8 @@ pub fn committed_condition(reason: &str, generation: Option<i64>) -> Condition {
             _ => "",
         }
         .to_string(),
-        last_transition_time: Time(Timestamp::now()),
+        last_transition_time: transition_time(existing_status, type_, &status),
+        status,
         observed_generation: generation,
     }
 }

operator/src/attestation_key_register.rs

@@ -204,8 +204,8 @@ async fn approve_ak(ak: &AttestationKey, machine: &Machine, client: Client) -> R
 
     if !is_approved {
         let generation = ak.metadata.generation;
-        let condition =
-            attestation_key_approved_condition(ATTESTATION_KEY_MACHINE_APPROVE, generation);
+        let approve_reason = ATTESTATION_KEY_MACHINE_APPROVE;
+        let condition = attestation_key_approved_condition(approve_reason, generation, &ak.status);
         let mut conditions = ak
             .status
             .as_ref()

operator/src/conditions.rs

@@ -2,31 +2,43 @@
 //
 // SPDX-License-Identifier: MIT
 
-use k8s_openapi::apimachinery::pkg::apis::meta::v1::{Condition, Time};
-use k8s_openapi::jiff::Timestamp;
-use trusted_cluster_operator_lib::{condition_status, conditions::*};
+use k8s_openapi::apimachinery::pkg::apis::meta::v1::Condition;
+use trusted_cluster_operator_lib::{
+    AttestationKeyStatus, TrustedExecutionClusterStatus, condition_status, conditions::*, transition_time
+};
 
-pub fn known_trustee_address_condition(known: bool, generation: Option<i64>) -> Condition {
+pub fn known_trustee_address_condition(
+    known: bool,
+    generation: Option<i64>,
+    existing_status: &Option<TrustedExecutionClusterStatus>,
+) -> Condition {
     let err = "No publicTrusteeAddr specified. Components can deploy, \
                but register-server will not be able to point to Trustee until you add an address";
     let (reason, message) = match known {
         true => (KNOWN_TRUSTEE_ADDRESS_REASON, ""),
         false => (UNKNOWN_TRUSTEE_ADDRESS_REASON, err),
     };
+    let type_ = KNOWN_TRUSTEE_ADDRESS_CONDITION;
+    let status = condition_status(known);
     Condition {
-        type_: KNOWN_TRUSTEE_ADDRESS_CONDITION.to_string(),
-        status: condition_status(known),
+        type_: type_.to_string(),
         reason: reason.to_string(),
         message: message.to_string(),
-        last_transition_time: Time(Timestamp::now()),
+        last_transition_time: transition_time(existing_status, type_, &status),
+        status,
         observed_generation: generation,
     }
 }
 
-pub fn installed_condition(reason: &str, generation: Option<i64>) -> Condition {
+pub fn installed_condition(
+    reason: &str,
+    generation: Option<i64>,
+    existing_status: &Option<TrustedExecutionClusterStatus>,
+) -> Condition {
+    let status = condition_status(reason == INSTALLED_REASON);
+    let type_ = INSTALLED_CONDITION;
     Condition {
-        type_: INSTALLED_CONDITION.to_string(),
-        status: condition_status(reason == INSTALLED_REASON),
+        type_: type_.to_string(),
         reason: reason.to_string(),
         message: match reason {
             NOT_INSTALLED_REASON_NON_UNIQUE => {
@@ -38,15 +50,21 @@ pub fn installed_condition(reason: &str, generation: Option<i64>) -> Condition {
             _ => "",
         }
         .to_string(),
-        last_transition_time: Time(Timestamp::now()),
+        last_transition_time: transition_time(existing_status, type_, &status),
+        status,
         observed_generation: generation,
     }
 }
 
-pub fn attestation_key_approved_condition(reason: &str, generation: Option<i64>) -> Condition {
+pub fn attestation_key_approved_condition(
+    reason: &str,
+    generation: Option<i64>,
+    existing_status: &Option<AttestationKeyStatus>,
+) -> Condition {
+    let status = condition_status(reason == ATTESTATION_KEY_MACHINE_APPROVE);
+    let type_ = ATTESTATION_KEY_APPROVED_CONDITION;
     Condition {
-        type_: ATTESTATION_KEY_APPROVED_CONDITION.to_string(),
-        status: condition_status(reason == ATTESTATION_KEY_MACHINE_APPROVE),
+        type_: type_.to_string(),
         reason: reason.to_string(),
         message: match reason {
             ATTESTATION_KEY_MACHINE_APPROVE => {
@@ -55,7 +73,8 @@ pub fn attestation_key_approved_condition(reason: &str, generation: Option<i64>)
             _ => "",
         }
         .to_string(),
-        last_transition_time: Time(Timestamp::now()),
+        last_transition_time: transition_time(existing_status, type_, &status),
+        status,
         observed_generation: generation,
     }
 }

operator/src/main.rs

@@ -104,7 +104,9 @@ async fn reconcile(
 ) -> Result<Action, ControllerError> {
     let generation = cluster.metadata.generation;
     let known_address = cluster.spec.public_trustee_addr.is_some();
-    let address_condition = known_trustee_address_condition(known_address, generation);
+    let existing_status = &cluster.status;
+    let address_condition =
+        known_trustee_address_condition(known_address, generation, existing_status);
     let mut conditions = Some(vec![address_condition]);
 
     let kube_client = ctx.client.clone();
@@ -114,7 +116,8 @@ async fn reconcile(
 
     if cluster.metadata.deletion_timestamp.is_some() {
         info!("Registered deletion of TrustedExecutionCluster {name}");
-        let condition = installed_condition(NOT_INSTALLED_REASON_UNINSTALLING, generation);
+        let uninstalling_reason = NOT_INSTALLED_REASON_UNINSTALLING;
+        let condition = installed_condition(uninstalling_reason, generation, existing_status);
         conditions.as_mut().unwrap().push(condition);
         update_status!(clusters, name, TrustedExecutionClusterStatus { conditions })?;
         return Ok(Action::await_change());
@@ -134,15 +137,17 @@ async fn reconcile(
             "More than one TrustedExecutionCluster found in namespace {namespace}. \
              trusted-cluster-operator does not support more than one TrustedExecutionCluster. Requeueing...",
         );
-        let condition = installed_condition(NOT_INSTALLED_REASON_NON_UNIQUE, generation);
+        let condition =
+            installed_condition(NOT_INSTALLED_REASON_NON_UNIQUE, generation, existing_status);
         conditions.as_mut().unwrap().push(condition);
         update_status!(clusters, name, TrustedExecutionClusterStatus { conditions })?;
         return Ok(Action::requeue(Duration::from_secs(60)));
     }
 
     info!("Setting up TrustedExecutionCluster {name}");
     let mut installing = conditions.clone();
-    let condition = installed_condition(NOT_INSTALLED_REASON_INSTALLING, generation);
+    let installing_reason = NOT_INSTALLED_REASON_INSTALLING;
+    let condition = installed_condition(installing_reason, generation, existing_status);
     installing.as_mut().unwrap().push(condition);
     let status = TrustedExecutionClusterStatus {
         conditions: installing,
@@ -152,7 +157,7 @@ async fn reconcile(
     install_trustee_configuration(kube_client.clone(), &cluster).await?;
     install_register_server(kube_client.clone(), &cluster).await?;
     install_attestation_key_register(kube_client, &cluster).await?;
-    let condition = installed_condition(INSTALLED_REASON, generation);
+    let condition = installed_condition(INSTALLED_REASON, generation, existing_status);
     conditions.as_mut().unwrap().push(condition);
     update_status!(clusters, name, TrustedExecutionClusterStatus { conditions })?;
     Ok(Action::await_change())

operator/src/reference_values.rs

@@ -299,7 +299,7 @@ async fn image_add_reconcile(
             (action, NOT_COMMITTED_REASON_FAILED)
         }
     };
-    let committed = committed_condition(reason, image.metadata.generation);
+    let committed = committed_condition(reason, image.metadata.generation, &image.status);
     let conditions = Some(vec![committed]);
     let images: Api<ApprovedImage> = Api::default_namespaced(kube_client);
     update_status!(images, &name, ApprovedImageStatus { conditions })