[Bug]: PnT Match transform not working as expected

linusyong commented 1 month ago

Is there an existing issue for this?

[X] I have searched the existing issues

Affected Resource(s)

iam.aws.upbound.io/v1beta1 - Policy

Resource MRs required to reproduce the bug

XRD (xrd.yaml)

apiVersion: apiextensions.crossplane.io/v1
kind: CompositeResourceDefinition
metadata:
name: xpolicytests.consumable.trustbank.sg
spec:
group: consumable.trustbank.sg
names:
  kind: xPolicyTest
  plural: xpolicytests
versions:
- name: v1alpha1
  schema:
    openAPIV3Schema:
      type: object
      properties:
        spec:
          type: object
          properties:
            name:
              type: string
          required:
          - name
  served: true
  referenceable: true
claimNames:
  kind: PolicyTest
  plural: policytests

Composition (composition.yaml)

apiVersion: apiextensions.crossplane.io/v1
kind: Composition
metadata:
name: x-policy-test
spec:
compositeTypeRef:
  apiVersion: consumable.trustbank.sg/v1alpha1
  kind: xPolicyTest
resources:
- name: xplane-karpenter-policy
  base:
    apiVersion: iam.aws.upbound.io/v1beta1
    kind: Policy
    metadata:
      name: xplane-karpenter-policy
      annotations:
        myAnnotation: field1-text
    spec:
      deletionPolicy: Delete
      forProvider:
        policy: |
          {
              "Statement": [
                  {
                      "Action": [
                          "ssm:GetParameter",
                          "pricing:GetProducts",
                          "iam:TagInstanceProfile",
                          "iam:PassRole",
                          "iam:GetInstanceProfile",
                          "iam:CreateInstanceProfile",
                          "iam:AddRoleToInstanceProfile",
                          "ec2:TerminateInstances",
                          "ec2:RunInstances",
                          "ec2:DescribeSubnets",
                          "ec2:DescribeSpotPriceHistory",
                          "ec2:DescribeSecurityGroups",
                          "ec2:DescribeLaunchTemplates",
                          "ec2:DescribeInstances",
                          "ec2:DescribeInstanceTypes",
                          "ec2:DescribeInstanceTypeOfferings",
                          "ec2:DescribeImages",
                          "ec2:DescribeAvailabilityZones",
                          "ec2:DeleteLaunchTemplate",
                          "ec2:CreateTags",
                          "ec2:CreateLaunchTemplate",
                          "ec2:CreateFleet"
                      ],
                      "Effect": "Allow",
                      "Resource": "*",
                      "Sid": "Karpenter"
                  },
                  {
                      "Action": "ec2:TerminateInstances",
                      "Condition": {
                          "StringLike": {
                              "ec2:ResourceTag/Name": "*karpenter*"
                          }
                      },
                      "Effect": "Allow",
                      "Resource": "*",
                      "Sid": "ConditionalEC2Termination"
                  },
                  {
                      "Action": "iam:PassRole",
                      "Effect": "Allow",
                      "Resource": "arn:aws:iam::AWS_ACCOUNT_ID:role/CLUSTER_NAME-xplane-eks-cluster",
                      "Sid": "PassNodeIAMRole"
                  },
                  {
                      "Action": "eks:DescribeCluster",
                      "Effect": "Allow",
                      "Resource": "arn:aws:eks:ap-southeast-1:AWS_ACCOUNT_ID:cluster/CLUSTER_NAME-xplane-eks-cluster",
                      "Sid": "EKSClusterEndpointLookup"
                  },
                  {
                      "Action": [
                          "sqs:ReceiveMessage",
                          "sqs:GetQueueUrl",
                          "sqs:GetQueueAttributes",
                          "sqs:DeleteMessage"
                      ],
                      "Effect": "Allow",
                      "Resource": "*",
                      "Sid": "KarpenterSQS"
                  }
              ],
              "Version": "2012-10-17"
          }
        tags:
          Name: xplane-karpenter-policy
          Owner: linus.yong
          Environment: sandbox
      providerConfigRef:
        name: aws-provider
  patches:
  - type: CombineFromComposite
    combine:
      variables:
      - fromFieldPath: spec.name
      strategy: string
      string:
        fmt: "%s-xplane-karpenter-policy"
    toFieldPath: metadata.name
  - type: CombineFromComposite
    combine:
      variables:
      - fromFieldPath: spec.name
      strategy: string
      string:
        fmt: "%s-xplane-karpenter-policy"
    toFieldPath: spec.forProvider.tags.Name
  - type: FromCompositeFieldPath
    fromFieldPath: spec.name
    toFieldPath: metadata.annotations["myAnnotation"]
    transforms:
    - type: match
      match:
        patterns:
        - type: literal
          literal: "field1-text"
          result: "matchedLiteral"
        fallbackTo: Value
        fallbackValue: "StringNotFound"

xPolicyTest (xpolicytest.yaml)

apiVersion: consumable.trustbank.sg/v1alpha1
kind: xPolicyTest
metadata:
name: linus-cluster
spec:
name: linus-cluster

Steps to Reproduce

Apply the XRD and Composition:

$ kubectl apply -f xrd.yaml
$ kubectl apply -f compisiton.yaml

Apply the xPolicyTest:
```
$ kubectl apply -f xpolicytest.yaml
```

Check the Policy created:

$ kubectl describe policies linus-cluster-xplane-karpenter-policy
Name:         linus-cluster-xplane-karpenter-policy
Namespace:    
Labels:       crossplane.io/claim-name=
              crossplane.io/claim-namespace=
              crossplane.io/composite=linus-cluster
Annotations:  crossplane.io/composition-resource-name: xplane-karpenter-policy
              crossplane.io/external-create-failed: 2024-05-06T10:57:16Z
              crossplane.io/external-create-pending: 2024-05-06T10:57:16Z
              crossplane.io/external-create-succeeded: 2024-05-06T10:56:31Z
              crossplane.io/external-name: linus-cluster-xplane-karpenter-policy
              myAnnotation: StringNotFound

What happened?

It is expected that

    - type: FromCompositeFieldPath
      fromFieldPath: spec.name
      toFieldPath: metadata.annotations["myAnnotation"]
      transforms:
      - type: match
        match:
          patterns:
          - type: literal
            literal: "field1-text"
            result: "matchedLiteral"
          fallbackTo: Value
          fallbackValue: "StringNotFound"

should match "field1-text" and replace with "matchedLiteral". However a match wasn't found and replaced with the fallbackValue of "StringNotFound"

Relevant Error Output Snippet

No response

Crossplane Version

1.15.2

Provider Version

1.4.0

Kubernetes Version

Client Version: v1.28.0 Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3 Server Version: v1.29.3-eks-adc711

Kubernetes Distribution

EKS

Additional Info

No response

phisco commented 1 month ago

Your Composite Resource xPolicyTest has spec.name set to linus-cluster, your patch is patching from that to the Composed Resource's metadata.annotations["myAnnotation"]. So given that linus-cluster != field1-text, the patch defaults to the configured fallback value, StringNotFound. Looks correct to me.

linusyong commented 1 month ago

Thanks @phisco, you're right. Looks like is my understanding of match transformation is wrong. Thanks again, will close this.

crossplane-contrib / provider-upjet-aws