Trigger Expiration

charts/apps/Chart.yaml

@@ -2,4 +2,4 @@ apiVersion: v2
 name: apps
 description: An argocd app to deploy apps inside the virtual cluster
 type: application
-version: 0.5.10
+version: 0.5.11

charts/apps/staging-values.yaml

@@ -37,6 +37,9 @@ kyverno:
         requests:
           cpu: 100m
           memory: 4Gi
+    cleanupController:
+      enabled: true
+      replicas: 1
 
 sessionspaces:
   enabled: true

charts/events/Chart.yaml

@@ -3,7 +3,7 @@ name: events
 description: Data Analysis event triggering
 type: application
 
-version: 0.3.2
+version: 0.3.3
 
 dependencies:
   - name: argo-events

charts/events/templates/populate-trigger-clusterpolicy.yaml

@@ -40,6 +40,38 @@ spec:
               workflows.diamond.ac.uk/source: '{{`{{templateObject.metadata.labels."workflows.diamond.ac.uk/source"}}`}}'
           spec: "{{`{{templateObject.spec}}`}}"
 
+---
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: assign-trigger-ttl
+spec:
+  rules:
+    - name: propagate-user-ttl
+      match:
+        resources:
+          kinds:
+            - workflows.diamond.ac.uk/v1alpha1/Trigger
+          operations:
+            - CREATE
+      context:
+        - name: expiration
+          variable:
+            jmesPath: request.object.metadata.labels."workflows.diamond.ac.uk/expiration" || ""
+            default: "24h"
+
+      preconditions:
+        all:
+          - key: "{{`{{ expiration }}`}}"
+            operator: AnyNotIn
+            value:
+              - "never"
+      mutate:
+        patchStrategicMerge:
+          metadata:
+            labels:
+              cleanup.kyverno.io/ttl: "{{`{{ expiration }}`}}"
+
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -68,3 +100,25 @@ subjects:
   - kind: ServiceAccount
     name: kyverno-admission-controller
     namespace: kyverno
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kyverno:delete-triggers
+rules:
+  - apiGroups: ["workflows.diamond.ac.uk"]
+    resources: ["triggers"]
+    verbs: ["get", "list", "watch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kyverno:delete-triggers
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kyverno:delete-triggers
+subjects:
+  - kind: ServiceAccount
+    name: kyverno-cleanup-controller
+    namespace: kyverno

charts/events/test-policy/assign-trigger-ttl/chainsaw-test.yaml

@@ -0,0 +1,114 @@
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: assign-default-trigger-ttl
+spec:
+  steps:
+    - try:
+      - create:
+          resource:
+            apiVersion: workflows.diamond.ac.uk/v1alpha1
+            kind: Trigger
+            metadata:
+              name: test-template
+              labels:
+                workflows.diamond.ac.uk/source: test-source
+                workflows.diamond.ac.uk/beamline: test-beamline
+            spec:
+              enabled: true
+              eventName: test-eventname
+              workflow:
+                template: workflow-template
+      - assert:
+          resource:
+            apiVersion: workflows.diamond.ac.uk/v1alpha1
+            kind: Trigger
+            metadata:
+              name: test-template
+              labels:
+                cleanup.kyverno.io/ttl: 24h
+                workflows.diamond.ac.uk/source: test-source
+                workflows.diamond.ac.uk/beamline: test-beamline
+            spec:
+              enabled: true
+              eventName: test-eventname
+              workflow:
+                template: workflow-template
+---
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: propagate-user-defined-trigger-expiration
+spec:
+  steps:
+    - try:
+      - create:
+          resource:
+            apiVersion: workflows.diamond.ac.uk/v1alpha1
+            kind: Trigger
+            metadata:
+              name: test-template
+              labels:
+                workflows.diamond.ac.uk/expiration: 30m
+                workflows.diamond.ac.uk/source: test-source
+                workflows.diamond.ac.uk/beamline: test-beamline
+            spec:
+              enabled: true
+              eventName: test-eventname
+              workflow:
+                template: workflow-template
+      - assert:
+          resource:
+            apiVersion: workflows.diamond.ac.uk/v1alpha1
+            kind: Trigger
+            metadata:
+              name: test-template
+              labels:
+                cleanup.kyverno.io/ttl: 30m
+                workflows.diamond.ac.uk/expiration: 30m
+                workflows.diamond.ac.uk/source: test-source
+                workflows.diamond.ac.uk/beamline: test-beamline
+            spec:
+              enabled: true
+              eventName: test-eventname
+              workflow:
+                template: workflow-template
+---
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: allow-never-ending-trigger
+spec:
+  steps:
+    - try:
+      - create:
+          resource:
+            apiVersion: workflows.diamond.ac.uk/v1alpha1
+            kind: Trigger
+            metadata:
+              name: test-template
+              labels:
+                workflows.diamond.ac.uk/expiration: never
+                workflows.diamond.ac.uk/source: test-source
+                workflows.diamond.ac.uk/beamline: test-beamline
+            spec:
+              enabled: true
+              eventName: test-eventname
+              workflow:
+                template: workflow-template
+      - assert:
+          resource:
+            apiVersion: workflows.diamond.ac.uk/v1alpha1
+            kind: Trigger
+            metadata:
+              name: test-template
+              labels:
+                workflows.diamond.ac.uk/expiration: never
+                workflows.diamond.ac.uk/source: test-source
+                workflows.diamond.ac.uk/beamline: test-beamline
+            spec:
+              enabled: true
+              eventName: test-eventname
+              workflow:
+                template: workflow-template
+