Add support for recording the diff in the ConfigurationPolicy status

A new recordDiff option of "InStatus" allows the diff to be stored in
the object properties in the ConfigurationPolicy status.

The new default recordDiff value is "InStatus" unless sensitive data may
be in the diff. Then the user must explicitly set recordDiff.

Relates:
https://issues.redhat.com/browse/ACM-11421

Signed-off-by: mprahl <mprahl@users.noreply.github.com>

api/v1/configurationpolicy_types.go

@@ -11,6 +11,7 @@ import (
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
@@ -199,16 +200,48 @@ type ObjectTemplate struct {
 	ObjectDefinition runtime.RawExtension `json:"objectDefinition"`
 
 	// RecordDiff specifies whether (and where) to log the diff between the object on the
-	// cluster and the objectDefinition in the policy. Defaults to "None".
+	// cluster and the objectDefinition in the policy. Defaults to "None" when the object kind is
+	// ConfigMap, OAuthAccessToken, OAuthAuthorizeTokens, Route, or Secret. Defaults to "InStatus" otherwise.
 	RecordDiff RecordDiff `json:"recordDiff,omitempty"`
 }
 
-// +kubebuilder:validation:Enum=Log;None
+func (o *ObjectTemplate) RecordDiffWithDefault() RecordDiff {
+	if o.RecordDiff != "" {
+		return o.RecordDiff
+	}
+
+	_, gvk, err := unstructured.UnstructuredJSONScheme.Decode(o.ObjectDefinition.Raw, nil, nil)
+	if err != nil {
+		return o.RecordDiff
+	}
+
+	switch gvk.Group {
+	case "":
+		if gvk.Kind == "ConfigMap" || gvk.Kind == "Secret" {
+			return RecordDiffCensored
+		}
+	case "oauth.openshift.io":
+		if gvk.Kind == "OAuthAccessToken" || gvk.Kind == "OAuthAuthorizeTokens" {
+			return RecordDiffCensored
+		}
+	case "route.openshift.io":
+		if gvk.Kind == "Route" {
+			return RecordDiffCensored
+		}
+	}
+
+	return RecordDiffInStatus
+}
+
+// +kubebuilder:validation:Enum=Log;InStatus;None
 type RecordDiff string
 
 const (
-	RecordDiffLog  RecordDiff = "Log"
-	RecordDiffNone RecordDiff = "None"
+	RecordDiffLog      RecordDiff = "Log"
+	RecordDiffInStatus RecordDiff = "InStatus"
+	RecordDiffNone     RecordDiff = "None"
+	// Censored is only used as an internal value to indicate a diff shouldn't be automatically generated.
+	RecordDiffCensored RecordDiff = "Censored"
 )
 
 // ConfigurationPolicyStatus defines the observed state of ConfigurationPolicy
@@ -355,7 +388,8 @@ type ObjectProperties struct {
 	// Whether the object was created by the parent policy
 	CreatedByPolicy *bool `json:"createdByPolicy,omitempty"`
 	// Store object UID to help track object ownership for deletion
-	UID string `json:"uid,omitempty"`
+	UID  string `json:"uid,omitempty"`
+	Diff string `json:"diff,omitempty"`
 }
 
 func init() {

api/v1/configurationpolicy_types_test.go

@@ -0,0 +1,86 @@
+// Copyright Contributors to the Open Cluster Management project
+
+package v1
+
+import (
+	"fmt"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func TestRecordDiffWithDefault(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		apiVersion string
+		kind       string
+		recordDiff RecordDiff
+		expected   RecordDiff
+	}{
+		"Namespace-recordDiff-unset": {
+			apiVersion: "v1",
+			kind:       "Namespace",
+			expected:   RecordDiffInStatus,
+		},
+		"Namespace-recordDiff-set": {
+			apiVersion: "v1",
+			kind:       "Namespace",
+			recordDiff: RecordDiffLog,
+			expected:   RecordDiffLog,
+		},
+		"Configmap-recordDiff-unset": {
+			apiVersion: "v1",
+			kind:       "ConfigMap",
+			expected:   RecordDiffCensored,
+		},
+		"Secret-recordDiff-unset": {
+			apiVersion: "v1",
+			kind:       "Secret",
+			expected:   RecordDiffCensored,
+		},
+		"Secret-recordDiff-set": {
+			apiVersion: "v1",
+			kind:       "Secret",
+			recordDiff: RecordDiffInStatus,
+			expected:   RecordDiffInStatus,
+		},
+		"OAuthAccessToken-recordDiff-unset": {
+			apiVersion: "oauth.openshift.io/v1",
+			kind:       "OAuthAccessToken",
+			expected:   RecordDiffCensored,
+		},
+		"OAuthAuthorizeTokens-recordDiff-unset": {
+			apiVersion: "oauth.openshift.io/v1",
+			kind:       "OAuthAuthorizeTokens",
+			expected:   RecordDiffCensored,
+		},
+		"Route-recordDiff-unset": {
+			apiVersion: "route.openshift.io/v1",
+			kind:       "Route",
+			expected:   RecordDiffCensored,
+		},
+	}
+
+	for testName, test := range tests {
+		test := test
+
+		t.Run(
+			testName,
+			func(t *testing.T) {
+				t.Parallel()
+
+				objTemp := ObjectTemplate{
+					ObjectDefinition: runtime.RawExtension{
+						Raw: []byte(fmt.Sprintf(`{"apiVersion": "%s", "kind": "%s"}`, test.apiVersion, test.kind)),
+					},
+					RecordDiff: test.recordDiff,
+				}
+
+				if objTemp.RecordDiffWithDefault() != test.expected {
+					t.Fatalf("Expected %s but got %s", test.expected, objTemp.RecordDiffWithDefault())
+				}
+			},
+		)
+	}
+}