cloud-ip-validator/internal/openstack/client.go

package openstack

import (
	"context"
	"fmt"

	"github.com/gophercloud/gophercloud/v2"
	osauth "github.com/gophercloud/gophercloud/v2/openstack"
	"github.com/gophercloud/gophercloud/v2/openstack/networking/v2/extensions/layer3/floatingips"
)

// AuthMethod selects how the client obtains the token it uses for Neutron
// calls.
type AuthMethod string

const (
	// AuthMethodToken uses an admin-supplied token as-is (passthrough): the
	// token is validated against Keystone but never exchanged for a freshly
	// minted one, and the exact token value the operator provided is what
	// every subsequent Neutron call uses. This is the default — it matches
	// the deployment constraint that the admin credential is supplied
	// directly via the process environment. Its trade-off: there is no way
	// to renew the token automatically, since nothing longer-lived than the
	// token itself is available to re-authenticate with. When it expires,
	// the operator must reissue it and restart control-api.
	AuthMethodToken AuthMethod = "token"

	// AuthMethodPassword has the client obtain its own token via ordinary
	// Keystone password authentication, and automatically re-authenticates
	// (mints a fresh token) whenever the current one is rejected — not
	// bounded by any single token's TTL, at the cost of holding a
	// long-lived password credential in the process environment instead of
	// a token.
	AuthMethodPassword AuthMethod = "password"
)

// ClientConfig carries pre-resolved credential values (already read from
// environment variables by the caller — see config.OpenStackConfig). Some
// form of admin credential is always required via the process environment,
// never a config file; which fields are required depends on Method.
type ClientConfig struct {
	AuthURL string
	Method  AuthMethod // "" is treated as AuthMethodToken

	Token string // required when Method == AuthMethodToken

	Username       string // required when Method == AuthMethodPassword
	Password       string
	UserDomainName string

	ProjectID string
	Region    string
	Interface string // "public" | "internal" | "admin"; "" defaults to "public"
}

type Client struct {
	networking *gophercloud.ServiceClient
}

// buildAuthOptions translates ClientConfig into gophercloud.AuthOptions. It
// touches no network and returns only validation errors, so the auth-method
// selection logic is unit-testable without a real OpenStack deployment.
func buildAuthOptions(cfg ClientConfig) (gophercloud.AuthOptions, error) {
	if cfg.AuthURL == "" {
		return gophercloud.AuthOptions{}, fmt.Errorf("openstack: auth URL is required")
	}
	if cfg.ProjectID == "" {
		return gophercloud.AuthOptions{}, fmt.Errorf("openstack: project ID is required")
	}

	opts := gophercloud.AuthOptions{IdentityEndpoint: cfg.AuthURL}

	switch cfg.Method {
	case AuthMethodPassword:
		if cfg.Username == "" || cfg.Password == "" {
			return gophercloud.AuthOptions{}, fmt.Errorf("openstack: username and password are required for auth_method=password")
		}
		opts.Username = cfg.Username
		opts.Password = cfg.Password
		opts.DomainName = cfg.UserDomainName
		opts.Scope = &gophercloud.AuthScope{ProjectID: cfg.ProjectID}
		// Safe and valuable here: a password credential can always mint a
		// fresh token, so gophercloud can transparently re-authenticate on
		// 401 for the entire lifetime of the process.
		opts.AllowReauth = true

	case AuthMethodToken, "":
		if cfg.Token == "" {
			return gophercloud.AuthOptions{}, fmt.Errorf("openstack: token is required for auth_method=token")
		}
		opts.TokenID = cfg.Token
		// Scope is deliberately left unset: gophercloud's v3auth takes this
		// as the signal to "pass through" the given token rather than
		// exchange it for a new one (GET /v3/auth/tokens to validate +
		// fetch the catalog, using the same token value for every
		// subsequent call, never minting a replacement). AllowReauth is
		// left false on purpose — gophercloud actively rejects AllowReauth
		// when Scope is unset, and there's nothing to reauthenticate with
		// beyond the one token we were given anyway.

	default:
		return gophercloud.AuthOptions{}, fmt.Errorf("openstack: unknown auth method %q", cfg.Method)
	}

	return opts, nil
}

// NewClient authenticates against Keystone (via the method selected by
// cfg.Method) and returns a Client scoped to the given project/region,
// backed by the Neutron (networking v2) service catalog entry.
func NewClient(ctx context.Context, cfg ClientConfig) (*Client, error) {
	authOpts, err := buildAuthOptions(cfg)
	if err != nil {
		return nil, err
	}

	provider, err := osauth.AuthenticatedClient(ctx, authOpts)
	if err != nil {
		return nil, fmt.Errorf("openstack: authenticate: %w", err)
	}

	iface := cfg.Interface
	if iface == "" {
		iface = string(gophercloud.AvailabilityPublic)
	}
	networking, err := osauth.NewNetworkV2(provider, gophercloud.EndpointOpts{
		Region:       cfg.Region,
		Availability: gophercloud.Availability(iface),
	})
	if err != nil {
		return nil, fmt.Errorf("openstack: networking client: %w", err)
	}

	return &Client{networking: networking}, nil
}

func (c *Client) GetFloatingIPByAddress(ctx context.Context, address string) (*FloatingIP, error) {
	pages, err := floatingips.List(c.networking, floatingips.ListOpts{FloatingIP: address}).AllPages(ctx)
	if err != nil {
		return nil, fmt.Errorf("openstack: list floating ips: %w", err)
	}
	list, err := floatingips.ExtractFloatingIPs(pages)
	if err != nil {
		return nil, fmt.Errorf("openstack: extract floating ips: %w", err)
	}
	if len(list) == 0 {
		return nil, ErrNotFound(address)
	}
	f := list[0]
	return &FloatingIP{ID: f.ID, Address: f.FloatingIP, PortID: f.PortID, ProjectID: f.TenantID}, nil
}

func (c *Client) AssociateFloatingIP(ctx context.Context, fipID, portID string) error {
	_, err := floatingips.Update(ctx, c.networking, fipID, floatingips.UpdateOpts{
		PortID: &portID,
	}).Extract()
	if err != nil {
		return fmt.Errorf("openstack: associate floating ip %s -> port %s: %w", fipID, portID, err)
	}
	return nil
}

func (c *Client) DisassociateFloatingIP(ctx context.Context, fipID string) error {
	// gophercloud's UpdateOpts.PortID is *string with `omitempty`: a nil
	// pointer is dropped from the request body entirely (no-op), while a
	// pointer to "" is what actually serializes as port_id:null and
	// disassociates the floating IP. See floatingips.UpdateOpts godoc.
	empty := ""
	_, err := floatingips.Update(ctx, c.networking, fipID, floatingips.UpdateOpts{
		PortID: &empty,
	}).Extract()
	if err != nil {
		return fmt.Errorf("openstack: disassociate floating ip %s: %w", fipID, err)
	}
	return nil
}