init

internal/controller/virtualservice_controller.go

@@ -0,0 +1,223 @@
+/*
+Copyright 2025.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+	"strings"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	logf "sigs.k8s.io/controller-runtime/pkg/log"
+
+	istionetworkingv1beta1 "istio.io/client-go/pkg/apis/networking/v1beta1"
+
+	nucleiv1alpha1 "github.com/mortenolsen/nuclei-operator/api/v1alpha1"
+)
+
+// VirtualServiceReconciler reconciles VirtualService objects and creates NucleiScan resources
+type VirtualServiceReconciler struct {
+	client.Client
+	Scheme *runtime.Scheme
+}
+
+// +kubebuilder:rbac:groups=networking.istio.io,resources=virtualservices,verbs=get;list;watch
+// +kubebuilder:rbac:groups=networking.istio.io,resources=virtualservices/status,verbs=get
+// +kubebuilder:rbac:groups=nuclei.homelab.mortenolsen.pro,resources=nucleiscans,verbs=get;list;watch;create;update;patch;delete
+
+// Reconcile handles VirtualService events and creates/updates corresponding NucleiScan resources
+func (r *VirtualServiceReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	log := logf.FromContext(ctx)
+
+	// Fetch the VirtualService resource
+	virtualService := &istionetworkingv1beta1.VirtualService{}
+	if err := r.Get(ctx, req.NamespacedName, virtualService); err != nil {
+		if apierrors.IsNotFound(err) {
+			// VirtualService was deleted - NucleiScan will be garbage collected via ownerReference
+			log.Info("VirtualService not found, likely deleted")
+			return ctrl.Result{}, nil
+		}
+		log.Error(err, "Failed to get VirtualService")
+		return ctrl.Result{}, err
+	}
+
+	// Extract target URLs from the VirtualService
+	targets := extractURLsFromVirtualService(virtualService)
+	if len(targets) == 0 {
+		log.Info("No targets extracted from VirtualService, skipping NucleiScan creation")
+		return ctrl.Result{}, nil
+	}
+
+	// Define the NucleiScan name based on the VirtualService name
+	nucleiScanName := fmt.Sprintf("%s-scan", virtualService.Name)
+
+	// Check if a NucleiScan already exists for this VirtualService
+	existingScan := &nucleiv1alpha1.NucleiScan{}
+	err := r.Get(ctx, client.ObjectKey{
+		Namespace: virtualService.Namespace,
+		Name:      nucleiScanName,
+	}, existingScan)
+
+	if err != nil && !apierrors.IsNotFound(err) {
+		log.Error(err, "Failed to get existing NucleiScan")
+		return ctrl.Result{}, err
+	}
+
+	if apierrors.IsNotFound(err) {
+		// Create a new NucleiScan
+		nucleiScan := &nucleiv1alpha1.NucleiScan{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      nucleiScanName,
+				Namespace: virtualService.Namespace,
+			},
+			Spec: nucleiv1alpha1.NucleiScanSpec{
+				SourceRef: nucleiv1alpha1.SourceReference{
+					APIVersion: "networking.istio.io/v1beta1",
+					Kind:       "VirtualService",
+					Name:       virtualService.Name,
+					Namespace:  virtualService.Namespace,
+					UID:        string(virtualService.UID),
+				},
+				Targets: targets,
+			},
+		}
+
+		// Set owner reference for garbage collection
+		if err := controllerutil.SetControllerReference(virtualService, nucleiScan, r.Scheme); err != nil {
+			log.Error(err, "Failed to set owner reference on NucleiScan")
+			return ctrl.Result{}, err
+		}
+
+		if err := r.Create(ctx, nucleiScan); err != nil {
+			log.Error(err, "Failed to create NucleiScan")
+			return ctrl.Result{}, err
+		}
+
+		log.Info("Created NucleiScan for VirtualService", "nucleiScan", nucleiScanName, "targets", targets)
+		return ctrl.Result{}, nil
+	}
+
+	// NucleiScan exists - check if targets need to be updated
+	if !reflect.DeepEqual(existingScan.Spec.Targets, targets) {
+		existingScan.Spec.Targets = targets
+		// Also update the SourceRef UID in case it changed (e.g., VirtualService was recreated)
+		existingScan.Spec.SourceRef.UID = string(virtualService.UID)
+
+		if err := r.Update(ctx, existingScan); err != nil {
+			log.Error(err, "Failed to update NucleiScan targets")
+			return ctrl.Result{}, err
+		}
+
+		log.Info("Updated NucleiScan targets for VirtualService", "nucleiScan", nucleiScanName, "targets", targets)
+	}
+
+	return ctrl.Result{}, nil
+}
+
+// extractURLsFromVirtualService extracts target URLs from a VirtualService resource
+func extractURLsFromVirtualService(vs *istionetworkingv1beta1.VirtualService) []string {
+	var urls []string
+
+	// Check if VirtualService has gateways defined (indicates external traffic)
+	// If no gateways or only "mesh" gateway, it's internal service-to-service
+	hasExternalGateway := false
+	for _, gw := range vs.Spec.Gateways {
+		if gw != "mesh" {
+			hasExternalGateway = true
+			break
+		}
+	}
+
+	// If no external gateway, skip this VirtualService
+	if !hasExternalGateway && len(vs.Spec.Gateways) > 0 {
+		return urls
+	}
+
+	// Extract URLs from hosts
+	for _, host := range vs.Spec.Hosts {
+		// Skip wildcard hosts and internal service names (no dots or starts with *)
+		if strings.HasPrefix(host, "*") {
+			continue
+		}
+
+		// Skip internal Kubernetes service names (typically don't contain dots or are short names)
+		// External hosts typically have FQDNs like "myapp.example.com"
+		if !strings.Contains(host, ".") {
+			continue
+		}
+
+		// Skip Kubernetes internal service FQDNs (*.svc.cluster.local)
+		if strings.Contains(host, ".svc.cluster.local") || strings.Contains(host, ".svc.") {
+			continue
+		}
+
+		// Default to HTTPS for external hosts (security scanning)
+		scheme := "https"
+
+		// Extract paths from HTTP routes if defined
+		pathsFound := false
+		if vs.Spec.Http != nil {
+			for _, httpRoute := range vs.Spec.Http {
+				if httpRoute.Match != nil {
+					for _, match := range httpRoute.Match {
+						if match.Uri != nil {
+							if match.Uri.GetPrefix() != "" {
+								url := fmt.Sprintf("%s://%s%s", scheme, host, match.Uri.GetPrefix())
+								urls = append(urls, url)
+								pathsFound = true
+							} else if match.Uri.GetExact() != "" {
+								url := fmt.Sprintf("%s://%s%s", scheme, host, match.Uri.GetExact())
+								urls = append(urls, url)
+								pathsFound = true
+							} else if match.Uri.GetRegex() != "" {
+								// For regex patterns, just use the base URL
+								// We can't enumerate all possible matches
+								url := fmt.Sprintf("%s://%s", scheme, host)
+								urls = append(urls, url)
+								pathsFound = true
+							}
+						}
+					}
+				}
+			}
+		}
+
+		// If no specific paths found, add base URL
+		if !pathsFound {
+			url := fmt.Sprintf("%s://%s", scheme, host)
+			urls = append(urls, url)
+		}
+	}
+
+	// Deduplicate URLs
+	return deduplicateStrings(urls)
+}
+
+// SetupWithManager sets up the controller with the Manager
+func (r *VirtualServiceReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewControllerManagedBy(mgr).
+		For(&istionetworkingv1beta1.VirtualService{}).
+		Owns(&nucleiv1alpha1.NucleiScan{}).
+		Named("virtualservice").
+		Complete(r)
+}