Add support for recording the diff in the ConfigurationPolicy status

api/v1/configurationpolicy_types.go

@@ -11,6 +11,7 @@ import (
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
@@ -199,16 +200,48 @@ type ObjectTemplate struct {
 	ObjectDefinition runtime.RawExtension `json:"objectDefinition"`
 
 	// RecordDiff specifies whether (and where) to log the diff between the object on the
-	// cluster and the objectDefinition in the policy. Defaults to "None".
+	// cluster and the objectDefinition in the policy. Defaults to "None" when the object kind is
+	// ConfigMap, OAuthAccessToken, OAuthAuthorizeTokens, Route, or Secret. Defaults to "InStatus" otherwise.
 	RecordDiff RecordDiff `json:"recordDiff,omitempty"`
 }
 
-// +kubebuilder:validation:Enum=Log;None
+func (o *ObjectTemplate) RecordDiffWithDefault() RecordDiff {
+	if o.RecordDiff != "" {
+		return o.RecordDiff
+	}
+
+	_, gvk, err := unstructured.UnstructuredJSONScheme.Decode(o.ObjectDefinition.Raw, nil, nil)
+	if err != nil {
+		return o.RecordDiff
+	}
+
+	switch gvk.Group {
+	case "":
+		if gvk.Kind == "ConfigMap" || gvk.Kind == "Secret" {
+			return RecordDiffCensored
+		}
+	case "oauth.openshift.io":
+		if gvk.Kind == "OAuthAccessToken" || gvk.Kind == "OAuthAuthorizeTokens" {
+			return RecordDiffCensored
+		}
+	case "route.openshift.io":
+		if gvk.Kind == "Route" {
+			return RecordDiffCensored
+		}
+	}
+
+	return RecordDiffInStatus
+}
+
+// +kubebuilder:validation:Enum=Log;InStatus;None
 type RecordDiff string
 
 const (
-	RecordDiffLog  RecordDiff = "Log"
-	RecordDiffNone RecordDiff = "None"
+	RecordDiffLog      RecordDiff = "Log"
+	RecordDiffInStatus RecordDiff = "InStatus"
+	RecordDiffNone     RecordDiff = "None"
+	// Censored is only used as an internal value to indicate a diff shouldn't be automatically generated.
+	RecordDiffCensored RecordDiff = "Censored"
 )
 
 // ConfigurationPolicyStatus defines the observed state of ConfigurationPolicy
@@ -355,7 +388,8 @@ type ObjectProperties struct {
 	// Whether the object was created by the parent policy
 	CreatedByPolicy *bool `json:"createdByPolicy,omitempty"`
 	// Store object UID to help track object ownership for deletion
-	UID string `json:"uid,omitempty"`
+	UID  string `json:"uid,omitempty"`
+	Diff string `json:"diff,omitempty"`
 }
 
 func init() {

api/v1/configurationpolicy_types_test.go

@@ -0,0 +1,86 @@
+// Copyright Contributors to the Open Cluster Management project
+
+package v1
+
+import (
+	"fmt"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func TestRecordDiffWithDefault(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		apiVersion string
+		kind       string
+		recordDiff RecordDiff
+		expected   RecordDiff
+	}{
+		"Namespace-recordDiff-unset": {
+			apiVersion: "v1",
+			kind:       "Namespace",
+			expected:   RecordDiffInStatus,
+		},
+		"Namespace-recordDiff-set": {
+			apiVersion: "v1",
+			kind:       "Namespace",
+			recordDiff: RecordDiffLog,
+			expected:   RecordDiffLog,
+		},
+		"Configmap-recordDiff-unset": {
+			apiVersion: "v1",
+			kind:       "ConfigMap",
+			expected:   RecordDiffCensored,
+		},
+		"Secret-recordDiff-unset": {
+			apiVersion: "v1",
+			kind:       "Secret",
+			expected:   RecordDiffCensored,
+		},
+		"Secret-recordDiff-set": {
+			apiVersion: "v1",
+			kind:       "Secret",
+			recordDiff: RecordDiffInStatus,
+			expected:   RecordDiffInStatus,
+		},
+		"OAuthAccessToken-recordDiff-unset": {
+			apiVersion: "oauth.openshift.io/v1",
+			kind:       "OAuthAccessToken",
+			expected:   RecordDiffCensored,
+		},
+		"OAuthAuthorizeTokens-recordDiff-unset": {
+			apiVersion: "oauth.openshift.io/v1",
+			kind:       "OAuthAuthorizeTokens",
+			expected:   RecordDiffCensored,
+		},
+		"Route-recordDiff-unset": {
+			apiVersion: "route.openshift.io/v1",
+			kind:       "Route",
+			expected:   RecordDiffCensored,
+		},
+	}
+
+	for testName, test := range tests {
+		test := test
+
+		t.Run(
+			testName,
+			func(t *testing.T) {
+				t.Parallel()
+
+				objTemp := ObjectTemplate{
+					ObjectDefinition: runtime.RawExtension{
+						Raw: []byte(fmt.Sprintf(`{"apiVersion": "%s", "kind": "%s"}`, test.apiVersion, test.kind)),
+					},
+					RecordDiff: test.recordDiff,
+				}
+
+				if objTemp.RecordDiffWithDefault() != test.expected {
+					t.Fatalf("Expected %s but got %s", test.expected, objTemp.RecordDiffWithDefault())
+				}
+			},
+		)
+	}
+}