@@ -24,6 +24,7 @@ import (
2424 "time"
2525
2626 "github.com/go-logr/logr"
27+ "github.com/intel/trusted-certificate-issuer/internal/k8sutil"
2728 "github.com/intel/trusted-certificate-issuer/internal/keyprovider"
2829 "github.com/intel/trusted-certificate-issuer/internal/tlsutil"
2930 corev1 "k8s.io/api/core/v1"
@@ -154,91 +155,62 @@ func (r *QuoteAttestationReconciler) Reconcile(ctx context.Context, req ctrl.Req
154155 // object being deleted, just ignore
155156 return ctrl.Result {}, nil
156157 }
158+ // Do not handle quote attestation request, that supposed to be
159+ // handled by the signer (CSR, CR) controllers.
160+ if attestReq .Spec .Type == v1alpha1 .RequestTypeQuoteAttestation {
161+ return ctrl.Result {}, nil
162+ }
157163
158164 l .Info ("Attestation" , "status" , attestReq .Status )
159165
160166 ready := attestReq .Status .GetCondition (v1alpha1 .ConditionReady )
161- if ready != nil && ready .Status == v1 .ConditionTrue {
162- // Nothing more to do, remove the quote attestaton CR.
163- if err := client .IgnoreNotFound (r .Delete (context .Background (), & attestReq )); err != nil {
164- l .V (2 ).Info ("Failed to remove QuoteAtestation object. One has to cleanup it manually" , "error" , err )
165- }
166- return ctrl.Result {}, nil
167+ if ready == nil || ready .Status == v1 .ConditionUnknown {
168+ l .V (3 ).Info ("Still waiting for results" )
169+ return retry , nil
167170 }
168171
169- setSignerFailure := func (c * v1alpha1.QuoteAttestationCondition ) {
172+ if ready .Status == v1 .ConditionFalse {
173+ // Secret preperation failure at attestation-controller side
174+ l .Info ("CA secret failure" , "reason" , ready .Reason , "message" , ready .Message )
170175 for _ , name := range attestReq .Spec .SignerNames {
171- s , err := r .KeyProvider .GetSignerForName (name )
172- if err != nil {
173- l .V (1 ).Info ("failed to get signer to update the attestation failure" , "signer" , name , "error" , err )
174- } else {
175- s .SetError (fmt .Errorf ("%s:%s" , c .Status , c .Message ))
176+ if s , _ := r .KeyProvider .GetSignerForName (name ); s != nil {
177+ s .SetError (fmt .Errorf ("%s:%s" , ready .Status , ready .Message ))
176178 }
177179 }
180+ return ctrl.Result {}, nil
178181 }
179182
180- secretsReady := attestReq .Status .GetCondition (v1alpha1 .ConditionCASecretReady )
181- if secretsReady == nil {
182- verified := attestReq .Status .GetCondition (v1alpha1 .ConditionQuoteVerified )
183- if verified == nil {
184- // Still quote is verification not verified, retry later
185- return retry , nil
183+ gotAllSecrets := true
184+ // attestation passed. Quote get verified
185+ l .Info ("Using provisioned secrets" )
186+ for _ , signerName := range attestReq .Spec .SignerNames {
187+ secret , ok := attestReq .Status .Secrets [signerName ]
188+ if ! ok {
189+ gotAllSecrets = false
190+ l .Info ("Secret not ready" , "for signer" , signerName )
191+ continue
186192 }
187- if verified .Status == v1 .ConditionTrue {
188- l .V (3 ).Info ("Quote verification success. Waiting for CA secrets get ready." )
189- return retry , nil
190- }
191-
192- if verified .Status == v1 .ConditionFalse {
193- l .V (3 ).Info ("Quote verification failure" , "reason" , verified .Reason , "message" , verified .Message )
194- setSignerFailure (verified )
195- return ctrl.Result {}, nil
193+ var provisionError error
194+ if secret .SecretType == KMRABased {
195+ l .Info ("Using KMRA based secret." , "secretName" , secret .SecretName )
196+ provisionError = r .loadSecret (ctx , signerName , secret .SecretName , req .Namespace )
197+ } else {
198+ provisionError = fmt .Errorf ("unsupported secret type: %v" , secret .SecretType )
196199 }
197- } else if secretsReady .Status == v1 .ConditionFalse && secretsReady .Reason != v1alpha1 .ReasonTCSReconcile {
198- // Secret preperation failure at attestation-controller side
199- l .V (3 ).Info ("CA secret failure" , "reason" , secretsReady .Reason , "message" , secretsReady .Message )
200- setSignerFailure (secretsReady )
201- return ctrl.Result {}, nil
202- } else {
203- gotAllSecrets := true
204- // attestation passed. Quote get verified
205- l .Info ("Using provisioned secrets" )
206- for _ , signerName := range attestReq .Spec .SignerNames {
207- secret , ok := attestReq .Status .Secrets [signerName ]
208- if ! ok {
209- gotAllSecrets = false
210- l .Info ("Secret not ready" , "for signer" , signerName )
211- continue
212- }
213- var provisionError error
214- if secret .SecretType == KMRABased {
215- l .Info ("Using KMRA based secret." , "secretName" , secret .SecretName )
216- provisionError = r .loadSecret (ctx , signerName , secret .SecretName , req .Namespace )
217- } else {
218- provisionError = fmt .Errorf ("unsupported secret type: %v" , secret .SecretType )
219- }
220- if provisionError != nil {
221- l .Info ("CA provisioning" , "error" , provisionError )
222- s , _ := r .KeyProvider .GetSignerForName (signerName )
200+ if provisionError != nil {
201+ l .Info ("CA provisioning" , "error" , provisionError )
202+ if s , _ := r .KeyProvider .GetSignerForName (signerName ); s != nil {
223203 s .SetError (provisionError )
224- reqCopy := attestReq .DeepCopy ()
225- attestReq .Status .SetCondition (v1alpha1 .ConditionCASecretReady , v1 .ConditionFalse , v1alpha1 .ReasonTCSReconcile , provisionError .Error ())
226- if err := r .Status ().Patch (context .TODO (), & attestReq , client .MergeFrom (reqCopy )); err != nil {
227- r .Log .V (3 ).Info ("Failed to update attestation status" , "error" , err )
228- }
229- return retry , nil
230- }
231- }
232- if gotAllSecrets {
233- r .done ()
234- l .V (1 ).Info ("Attestation passed. Private key(s) saved to enclave" )
235- reqCopy := attestReq .DeepCopy ()
236- attestReq .Status .SetCondition (v1alpha1 .ConditionReady , v1 .ConditionTrue , v1alpha1 .ReasonTCSReconcile , "All CA keys and certificates stored in Enclace." )
237- if err := r .Status ().Patch (context .TODO (), & attestReq , client .MergeFrom (reqCopy )); err != nil {
238- r .Log .V (3 ).Info ("Failed to update attestation status" , "error" , err )
239204 }
205+ return retry , nil
240206 }
241- return retry , nil
207+ }
208+ if gotAllSecrets {
209+ r .done ()
210+ l .V (1 ).Info ("Attestation passed. Private key(s) saved to enclave" )
211+ func () {
212+ k8sutil .QuoteAttestationDelete (context .Background (), r .Client , attestReq .Name , attestReq .Namespace )
213+ }()
242214 }
243215
244216 return ctrl.Result {}, nil
0 commit comments