OP-24522: Feature Implementation Pipeline Runtime Policies direct with OPA

PipelineRuntimePolicyValidation/PipelineRuntimePolicyValidation.iml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<module type="JAVA_MODULE" version="4">
+  <component name="NewModuleRootManager" inherit-compiler-output="true">
+    <exclude-output />
+    <content url="file://$MODULE_DIR$">
+      <sourceFolder url="file://$MODULE_DIR$/custom-policy-orca/src/main/java" isTestSource="false" />
+    </content>
+    <orderEntry type="inheritedJdk" />
+    <orderEntry type="sourceFolder" forTests="false" />
+  </component>
+</module>

PipelineRuntimePolicyValidation/build.gradle

@@ -0,0 +1,59 @@
+buildscript {
+  repositories {
+    mavenCentral()
+  }
+}
+
+plugins {
+  id("io.spinnaker.plugin.bundler").version("$spinnakerGradleVersion")
+  id("com.palantir.git-version").version("0.12.2")
+  id("com.diffplug.spotless").version("5.1.0")
+}
+
+repositories {
+  mavenCentral()
+}
+
+spinnakerBundle {
+  pluginId = "Opsmx.PipelineRuntimePolicyPlugin"
+  description = "An example of a PF4J-based plugin that provides a custom pipeline runtime policy."
+  provider = "https://github.com/opsmx"
+  version = rootProject.version
+}
+
+version = "v1.0.2-SNAPSHOT"
+
+subprojects {
+  group = "com.opsmx.plugin.pipeline.runtime.policy"
+  version = rootProject.version
+
+  if (name != "custom-stage-deck") {
+    apply plugin: "com.diffplug.spotless"
+    spotless {
+      kotlin {
+        ktlint().userData([
+          disabled_rules          : "no-wildcard-imports",
+          indent_size             : "2",
+          continuation_indent_size: "2",
+        ])
+      }
+    }
+  }
+  tasks.withType(JavaCompile).configureEach {
+    options.compilerArgs << "-parameters"
+    javaCompiler = javaToolchains.compilerFor {
+      languageVersion = JavaLanguageVersion.of(17)
+    }
+  }
+}
+
+String normalizedVersion() {
+  String fullVersion = gitVersion()
+  String normalized = fullVersion.split("-").first()
+  if (fullVersion.contains("dirty")) {
+    return "$normalized-SNAPSHOT"
+  } else {
+    return normalized
+  }
+}
+

PipelineRuntimePolicyValidation/custom-policy-orca/custom-policy-orca.gradle

@@ -0,0 +1,70 @@
+import org.yaml.snakeyaml.Yaml
+
+buildscript {
+  repositories {
+    mavenCentral()
+  }
+  dependencies {
+    classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlinVersion"
+    classpath "org.jetbrains.kotlin:kotlin-allopen:$kotlinVersion"
+  }
+}
+
+apply plugin: "io.spinnaker.plugin.service-extension"
+apply plugin: "maven-publish"
+apply plugin: "kotlin"
+apply plugin: "kotlin-kapt"
+apply plugin: "kotlin-spring"
+
+repositories {
+  mavenCentral()
+}
+
+sourceSets {
+  main {
+    java { srcDirs = ['src/main/java'] }
+  }
+}
+
+spinnakerPlugin {
+  serviceName = "orca"
+  pluginClass = "com.opsmx.plugin.pipeline.runtime.policy.PipelineRuntimePolicyPlugin"
+  requires="orca>=0.0.0"
+}
+configurations {
+  // configuration that holds jars to include in the jar
+  extraLibs
+}
+
+
+dependencies {
+  compileOnly "org.pf4j:pf4j:${pf4jVersion}"
+  compileOnly "org.jetbrains.kotlin:kotlin-stdlib-jdk8:$kotlinVersion"
+  compileOnly "io.spinnaker.kork:kork-plugins-api:${korkVersion}"
+  compileOnly "io.spinnaker.kork:kork-web:${korkVersion}"
+  compileOnly "io.spinnaker.orca:orca-api:${orcaVersion}"
+  compileOnly "io.spinnaker.orca:orca-core:${orcaVersion}"
+  compileOnly "io.spinnaker.orca:orca-echo:${orcaVersion}"
+  compileOnly "io.spinnaker.orca:orca-front50:${orcaVersion}"
+  kapt "org.pf4j:pf4j:${pf4jVersion}"
+
+  compileOnly group: 'com.squareup.retrofit', name: 'retrofit', version: '1.9.0'
+  compileOnly group: 'com.squareup.retrofit', name: 'converter-jackson', version: '1.9.0'
+  compileOnly group: 'com.jakewharton.retrofit', name: 'retrofit1-okhttp3-client', version: '1.1.0'
+  implementation group: 'com.jcraft', name: 'jsch', version: '0.1.55'
+
+  testRuntimeOnly "org.junit.jupiter:junit-jupiter-engine:5.4.0"
+  testRuntimeOnly "org.junit.platform:junit-platform-launcher:1.4.0"
+  testRuntimeOnly "org.junit.platform:junit-platform-commons:1.5.2"
+}
+
+configurations.all {
+  resolutionStrategy.eachDependency { DependencyResolveDetails details ->
+    if (details.requested.group == 'org.apache.logging.log4j') {
+      details.useVersion '2.17.1'
+    }
+  }
+}
+tasks.withType(Test) {
+  useJUnitPlatform()
+}

PipelineRuntimePolicyValidation/custom-policy-orca/src/main/java/com/opsmx/plugin/pipeline/runtime/policy/ManualjudgmentTaskExecutionInterceptor.java

@@ -0,0 +1,74 @@
+package com.opsmx.plugin.pipeline.runtime.policy;
+
+import com.netflix.spinnaker.orca.api.pipeline.Task;
+import com.netflix.spinnaker.orca.api.pipeline.TaskExecutionInterceptor;
+import com.netflix.spinnaker.orca.api.pipeline.models.StageExecution;
+import com.netflix.spinnaker.orca.api.pipeline.models.TaskExecution;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.stereotype.Component;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+@Component
+public class ManualjudgmentTaskExecutionInterceptor implements TaskExecutionInterceptor {
+
+    private final Logger logger = LoggerFactory.getLogger(ManualjudgmentTaskExecutionInterceptor.class);
+
+    private ValidationManualjudgmentPipeline validationManualjudgmentPipeline;
+
+    public ManualjudgmentTaskExecutionInterceptor(ValidationManualjudgmentPipeline validationManualjudgmentPipeline) {
+        this.validationManualjudgmentPipeline = validationManualjudgmentPipeline;
+    }
+
+    @Override
+    public StageExecution beforeTaskExecution(Task task, StageExecution stage) {
+        logger.debug("Start of the beforeTaskExecution ManualjudgmentTaskExecutionInterceptor");
+        logger.debug("stage :{}",stage.getExecution());
+        logger.debug("stage type :{}",stage.getType());
+        List<TaskExecution> taskExecutions = stage.getTasks();
+        taskExecutions.stream().forEach(taskExecution -> { logger.debug("Task Execution :{}",taskExecution.getName());});
+        if (stage.getExecution()!=null && isValidStageType(stage.getType())){
+            if (isManualjudgmentApproved(stage.getContext())){
+                validationManualjudgmentPipeline.execute(stage);
+            }
+        }
+        logger.debug("End of the beforeTaskExecution ManualjudgmentTaskExecutionInterceptor");
+        return stage;
+    }
+
+    private void setCancelReason(StageExecution stage) {
+        List<String> errors =new ArrayList<>();
+        errors.add(stage.getExecution().getCancellationReason());
+        stage.getExecution().getContext().put("exception", new HashMap<>().put("details", new HashMap<>().put("errors",errors)));
+    }
+
+    private boolean isRepeating(Map<String, Object> context){
+        long restartTime = Long.valueOf(String.valueOf(((Map)context.get("restartDetails")).get("restartTime")));
+        long systemTime = System.currentTimeMillis();
+        logger.debug("restartTime :{}, systemTime :{} , diff :{}",restartTime, systemTime, (systemTime-restartTime));
+        //ManualJudgmentTask and MonitorPipelineTask using 15 seconds to repeat task execution (backoffPeriod)
+         if((systemTime-restartTime) > 15000){
+             return true;
+         }
+        return false;
+    }
+    private boolean isManualjudgmentApproved(Map<String, Object> context){
+        if(context.get("judgmentStatus") != null){
+        String status = String.valueOf(context.get("judgmentStatus"));
+        logger.debug("manualJudgment status:{}",status);
+        if(status.equalsIgnoreCase("continue"))
+            return true;
+        }
+        return false;
+    }
+    private boolean isValidStageType(String stageType){
+        if (stageType.equalsIgnoreCase("manualJudgment")) {
+            return true;
+        }
+        return false;
+    }
+}

PipelineRuntimePolicyValidation/custom-policy-orca/src/main/java/com/opsmx/plugin/pipeline/runtime/policy/OpaConfigProperties.java

@@ -0,0 +1,142 @@
+package com.opsmx.plugin.pipeline.runtime.policy;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+import java.util.List;
+
+@Configuration
+@ConfigurationProperties(prefix = "policy.opa")
+@EnableConfigurationProperties({OpaConfigProperties.class, OpaConfigProperties.RuntimePolicy.class, OpaConfigProperties.ManualJudgmentPolicy.class})
+public class OpaConfigProperties {
+    private String url="http://oes-sapor:8085";
+    private String runtimeUrl="http://opa:8181";
+    private String opaPolicyLocation = "/v1/data";
+    private String resultKey="deny";
+    private boolean enabled=false;
+    private RuntimePolicy runtime = new RuntimePolicy();
+    private ManualJudgmentPolicy manualjudgment = new ManualJudgmentPolicy();
+
+    public String getUrl() {
+        return url;
+    }
+
+    public void setUrl(String url) {
+        this.url = url;
+    }
+
+    public String getRuntimeUrl() {
+        return runtimeUrl;
+    }
+
+    public void setRuntimeUrl(String runtimeUrl) {
+        this.runtimeUrl = runtimeUrl;
+    }
+
+    public String getOpaPolicyLocation() {
+        return opaPolicyLocation;
+    }
+
+    public void setOpaPolicyLocation(String opaPolicyLocation) {
+        this.opaPolicyLocation = opaPolicyLocation;
+    }
+
+    public String getResultKey() {
+        return resultKey;
+    }
+
+    public void setResultKey(String resultKey) {
+        this.resultKey = resultKey;
+    }
+
+    public boolean isEnabled() {
+        return enabled;
+    }
+
+    public void setEnabled(boolean enabled) {
+        this.enabled = enabled;
+    }
+
+    public RuntimePolicy getRuntime() {
+        return runtime;
+    }
+
+    public void setRuntime(RuntimePolicy runtime) {
+        this.runtime = runtime;
+    }
+
+    public ManualJudgmentPolicy getManualjudgment() {
+        return manualjudgment;
+    }
+
+    public void setManualjudgment(ManualJudgmentPolicy manualjudgment) {
+        this.manualjudgment = manualjudgment;
+    }
+
+    @Configuration
+    @ConfigurationProperties(prefix = "policy.opa.runtime")
+    public static class RuntimePolicy {
+        private boolean enabled = false;
+        private List<Policy> policies;
+
+        public boolean isEnabled() {
+            return enabled;
+        }
+
+        public void setEnabled(boolean enabled) {
+            this.enabled = enabled;
+        }
+
+        public List<Policy> getPolicies() {
+            return policies;
+        }
+
+        public void setPolicies(List<Policy> policies) {
+            this.policies = policies;
+        }
+    }
+    @Configuration
+    @ConfigurationProperties(prefix = "policy.opa.manualjudgment")
+    public static class ManualJudgmentPolicy {
+        private boolean enabled = false;
+        private List<Policy> policies;
+
+        public boolean isEnabled() {
+            return enabled;
+        }
+
+        public void setEnabled(boolean enabled) {
+            this.enabled = enabled;
+        }
+
+        public List<Policy> getPolicies() {
+            return policies;
+        }
+
+        public void setPolicies(List<Policy> policies) {
+            this.policies = policies;
+        }
+    }
+    public static class Policy{
+        private String name;
+        private String packageName;
+
+        public String getName() {
+            return name;
+        }
+
+        public void setName(String name) {
+            this.name = name;
+        }
+
+        public String getPackageName() {
+            return packageName;
+        }
+
+        public void setPackageName(String packageName) {
+            this.packageName = packageName;
+        }
+    }
+
+}

PipelineRuntimePolicyValidation/custom-policy-orca/src/main/java/com/opsmx/plugin/pipeline/runtime/policy/PipelineRuntimePolicyPlugin.java

@@ -0,0 +1,23 @@
+package com.opsmx.plugin.pipeline.runtime.policy;
+
+import org.pf4j.Plugin;
+import org.pf4j.PluginWrapper;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class PipelineRuntimePolicyPlugin extends Plugin {
+
+    private final Logger log = LoggerFactory.getLogger(getClass());
+
+    public PipelineRuntimePolicyPlugin(PluginWrapper wrapper) {
+        super(wrapper);
+    }
+
+    public void start() {
+        log.info("Pipeline Runtime Policy plugin start()");
+    }
+
+    public void stop() {
+        log.info("Pipeline Runtime Policy plugin stop()");
+    }
+}