Add List/Relist Catalog Restrictions

pkg/apis/servicecatalog/types.go

@@ -81,6 +81,17 @@ type ClusterServiceBrokerSpec struct {
 	// RelistRequests is a strictly increasing, non-negative integer counter that
 	// can be manually incremented by a user to manually trigger a relist.
 	RelistRequests int64
+
+	// CatalogRestrictions allows adding restrictions onto Class/Plans on relist.
+	CatalogRestrictions *ServiceClassCatalogRestrictions
+}
+
+type ClusterServicePlanRequirements string
+type ClusterServiceClassRequirements string
+
+type ServiceClassCatalogRestrictions struct {
+	ServicePlan  ClusterServicePlanRequirements
+	ServiceClass ClusterServiceClassRequirements
 }
 
 // ServiceBrokerRelistBehavior represents a type of broker relist behavior.

pkg/apis/servicecatalog/v1beta1/types.go

@@ -92,6 +92,69 @@ type ClusterServiceBrokerSpec struct {
 	// can be manually incremented by a user to manually trigger a relist.
 	// +optional
 	RelistRequests int64 `json:"relistRequests"`
+
+	// CatalogRestrictions allows adding restrictions onto Class/Plans on relist.
+	// +optional
+	CatalogRestrictions *ServiceClassCatalogRestrictions `json:"catalogRestrictions,omitempty"`
+}
+
+// *Requirements type strings have a special format similar to Label Selectors,
+// except the catalog supports only a very specific property set per type as
+// documented below.
+// The predicate format is expected to be `<property><conditional><requirement>`
+// Check the *Requirements type definition for which <property> strings will be allowed.
+// <conditional> is allowed to be one of the following: ==, !=, in, notin
+// <requirement> will be a string value if `==` or `!=` are used.
+// <requirement> will be a set of string values if `in` or `notin` are used.
+// Multiple predicates are allowed to be chained with a comma (,)
+
+// ClusterServiceClassRequirements represents a list of selectors for classes used to filter.
+// Requirements are AND'ed together from the list.
+type ClusterServiceClassRequirements []ClusterServiceClassRequirement
+
+// ClusterServiceClassRequirement represents a selector for classes used to filter.
+// Allowed property names:
+//   name - the value set to ClusterServiceClass.Name
+//   externalName - the value set to ClusterServiceClass.Spec.ExternalName
+type ClusterServiceClassRequirement string
+
+// ClusterServicePlanRequirements represents a list of selectors for plans used to filter.
+// Requirements are AND'ed together from the list.
+type ClusterServicePlanRequirements []ClusterServicePlanRequirement
+
+// ClusterServicePlanRequirement represents a selector for plans used to filter.
+// Allowed property names:
+//   name - the value set to ClusterServiceClass.Name
+//   externalName - the value set to ClusterServiceClass.Spec.ExternalName
+type ClusterServicePlanRequirement string
+
+// ServiceClassCatalogRestrictions contains the restrictions used to on catalog re-list.
+// Some examples of this object are as follows:
+//
+// This is an example of a whitelist on service externalName.
+// Goal: Only list Services with the externalName of FooService and BarService,
+// Solution: restrictions := ServiceClassCatalogRestrictions{
+// 		ServiceClass: "externalName in (FooService, BarService)",
+// }
+//
+// This is an example of a blacklist on service externalName.
+// Goal: Allow all services except the ones with the externalName of FooService and BarService,
+// Solution: restrictions := ServiceClassCatalogRestrictions{
+// 		ServiceClass: "externalName notin (FooService, BarService)",
+// }
+//
+// This whitelists plans called "Demo", and blacklists (but only a single element in
+// the list) a service and a plan.
+// Goal: Allow all plans with the externalName demo, but not AABBCC, and not a specific service by name,
+// Solution: restrictions := ServiceClassCatalogRestrictions{
+// 		ServiceClass: "name!=AABBB-CCDD-EEGG-HIJK",
+// 		ServicePlan: "externalName in (Demo),name!=AABBCC",
+// }
+type ServiceClassCatalogRestrictions struct {
+	// ServiceClass represents a selector for plans, used to filter catalog re-lists.
+	ServiceClass ClusterServiceClassRequirements `json:"serviceClass,omitempty"`
+	// ServicePlan represents a selector for classes, used to filter catalog re-lists.
+	ServicePlan ClusterServicePlanRequirements `json:"servicePlan,omitempty"`
 }
 
 // ServiceBrokerRelistBehavior represents a type of broker relist behavior.

pkg/controller/controller.go

@@ -43,7 +43,8 @@ import (
 	informers "github.com/kubernetes-incubator/service-catalog/pkg/client/informers_generated/externalversions/servicecatalog/v1beta1"
 	listers "github.com/kubernetes-incubator/service-catalog/pkg/client/listers_generated/servicecatalog/v1beta1"
 	scfeatures "github.com/kubernetes-incubator/service-catalog/pkg/features"
-	pretty "github.com/kubernetes-incubator/service-catalog/pkg/pretty"
+	"github.com/kubernetes-incubator/service-catalog/pkg/filter"
+	"github.com/kubernetes-incubator/service-catalog/pkg/pretty"
 )
 
 const (
@@ -478,6 +479,8 @@ func getBearerConfig(secret *corev1.Secret) (*osb.BearerConfig, error) {
 // convertCatalog converts a service broker catalog into an array of
 // ClusterServiceClasses and an array of ClusterServicePlans.  The ClusterServiceClasses and
 // ClusterServicePlans returned by this method are named in K8S with the OSB ID.
+// *deprecated* use convertAndFilterCatalog
+// TODO: delete convertCatalog when features.CatalogRestrictions flag is removed.
 func convertCatalog(in *osb.CatalogResponse) ([]*v1beta1.ClusterServiceClass, []*v1beta1.ClusterServicePlan, error) {
 	serviceClasses := make([]*v1beta1.ClusterServiceClass, len(in.Services))
 	servicePlans := []*v1beta1.ClusterServicePlan{}
@@ -520,6 +523,90 @@ func convertCatalog(in *osb.CatalogResponse) ([]*v1beta1.ClusterServiceClass, []
 	return serviceClasses, servicePlans, nil
 }
 
+func convertAndFilterCatalog(in *osb.CatalogResponse, restrictions *v1beta1.ServiceClassCatalogRestrictions) ([]*v1beta1.ClusterServiceClass, []*v1beta1.ClusterServicePlan, error) {
+	predicate, err := filter.CreatePredicateForServiceClassesFromRestrictions(restrictions)
+
+	if err != nil {
+		return nil, nil, err
+	}
+	serviceClasses := []*v1beta1.ClusterServiceClass(nil)
+	servicePlans := []*v1beta1.ClusterServicePlan(nil)
+	for _, svc := range in.Services {
+		serviceClass := &v1beta1.ClusterServiceClass{
+			Spec: v1beta1.ClusterServiceClassSpec{
+				Bindable:      svc.Bindable,
+				PlanUpdatable: svc.PlanUpdatable != nil && *svc.PlanUpdatable,
+				ExternalID:    svc.ID,
+				ExternalName:  svc.Name,
+				Tags:          svc.Tags,
+				Description:   svc.Description,
+				Requires:      svc.Requires,
+			},
+		}
+
+		if utilfeature.DefaultFeatureGate.Enabled(scfeatures.AsyncBindingOperations) {
+			serviceClass.Spec.BindingRetrievable = svc.BindingRetrievable
+		}
+
+		if svc.Metadata != nil {
+			metadata, err := json.Marshal(svc.Metadata)
+			if err != nil {
+				err = fmt.Errorf("Failed to marshal metadata\n%+v\n %v", svc.Metadata, err)
+				glog.Error(err)
+				return nil, nil, err
+			}
+			serviceClass.Spec.ExternalMetadata = &runtime.RawExtension{Raw: metadata}
+		}
+		serviceClass.SetName(svc.ID)
+
+		// If this service class passes the predicate, process the plans for the class.
+		if fields := filter.ConvertServiceClassToProperties(serviceClass); predicate.Accepts(fields) {
+			// set up the plans using the ClusterServiceClass Name
+			plans, err := convertClusterServicePlans(svc.Plans, serviceClass.Name)
+			if err != nil {
+				return nil, nil, err
+			}
+
+			acceptedPlans, _, err := filterServicePlans(restrictions, plans)
+			if err != nil {
+				return nil, nil, err
+			}
+
+			// If there are accepted plans, then append the class and all of the accepted plans to the master list.
+			if len(acceptedPlans) > 0 {
+				serviceClasses = append(serviceClasses, serviceClass)
+				servicePlans = append(servicePlans, acceptedPlans...)
+			}
+		}
+	}
+	return serviceClasses, servicePlans, nil
+}
+
+func filterServicePlans(restrictions *v1beta1.ServiceClassCatalogRestrictions, servicePlans []*v1beta1.ClusterServicePlan) ([]*v1beta1.ClusterServicePlan, []*v1beta1.ClusterServicePlan, error) {
+	predicate, err := filter.CreatePredicateForServicePlansFromRestrictions(restrictions)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// If the predicate is empty, all plans will pass. No need to run through the list.
+	if predicate.Empty() {
+		return servicePlans, []*v1beta1.ClusterServicePlan(nil), nil
+	}
+
+	accepted := []*v1beta1.ClusterServicePlan(nil)
+	rejected := []*v1beta1.ClusterServicePlan(nil)
+	for _, sp := range servicePlans {
+		fields := filter.ConvertServicePlanToProperties(sp)
+		if predicate.Accepts(fields) {
+			accepted = append(accepted, sp)
+		} else {
+			rejected = append(rejected, sp)
+		}
+	}
+
+	return accepted, rejected, nil
+}
+
 func convertClusterServicePlans(plans []osb.Plan, serviceClassID string) ([]*v1beta1.ClusterServicePlan, error) {
 	if 0 == len(plans) {
 		return nil, fmt.Errorf("ClusterServiceClass (K8S: %q) must have at least one plan", serviceClassID)
@@ -585,7 +672,6 @@ func convertClusterServicePlans(plans []osb.Plan, serviceClassID string) ([]*v1b
 				}
 			}
 		}
-
 	}
 	return servicePlans, nil
 }

pkg/controller/controller_broker.go

@@ -23,15 +23,18 @@ import (
 
 	"github.com/golang/glog"
 
-	"github.com/kubernetes-incubator/service-catalog/pkg/apis/servicecatalog/v1beta1"
-	"github.com/kubernetes-incubator/service-catalog/pkg/metrics"
-	"github.com/kubernetes-incubator/service-catalog/pkg/pretty"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/util/sets"
+	utilfeature "k8s.io/apiserver/pkg/util/feature"
 	"k8s.io/client-go/tools/cache"
+
+	"github.com/kubernetes-incubator/service-catalog/pkg/apis/servicecatalog/v1beta1"
+	scfeatures "github.com/kubernetes-incubator/service-catalog/pkg/features"
+	"github.com/kubernetes-incubator/service-catalog/pkg/metrics"
+	"github.com/kubernetes-incubator/service-catalog/pkg/pretty"
 )
 
 // the Message strings have a terminating period and space so they can
@@ -255,16 +258,25 @@ func (c *controller) reconcileClusterServiceBroker(broker *v1beta1.ClusterServic
 
 		// convert the broker's catalog payload into our API objects
 		glog.V(4).Info(pcb.Message("Converting catalog response into service-catalog API"))
-		payloadServiceClasses, payloadServicePlans, err := convertCatalog(brokerCatalog)
-		if err != nil {
-			s := fmt.Sprintf("Error converting catalog payload for broker %q to service-catalog API: %s", broker.Name, err)
-			glog.Warning(pcb.Message(s))
-			c.recorder.Eventf(broker, corev1.EventTypeWarning, errorSyncingCatalogReason, s)
-			if err := c.updateClusterServiceBrokerCondition(broker, v1beta1.ServiceBrokerConditionReady, v1beta1.ConditionFalse, errorSyncingCatalogReason, errorSyncingCatalogMessage+s); err != nil {
+
+		var payloadServiceClasses []*v1beta1.ClusterServiceClass
+		var payloadServicePlans []*v1beta1.ClusterServicePlan
+		if utilfeature.DefaultFeatureGate.Enabled(scfeatures.CatalogRestrictions) {
+			if payloadServiceClasses, payloadServicePlans, err = convertAndFilterCatalog(brokerCatalog, broker.Spec.CatalogRestrictions); err != nil {
+
+			}
+		} else {
+			if payloadServiceClasses, payloadServicePlans, err = convertCatalog(brokerCatalog); err != nil {
+				s := fmt.Sprintf("Error converting catalog payload for broker %q to service-catalog API: %s", broker.Name, err)
+				glog.Warning(pcb.Message(s))
+				c.recorder.Eventf(broker, corev1.EventTypeWarning, errorSyncingCatalogReason, s)
+				if err := c.updateClusterServiceBrokerCondition(broker, v1beta1.ServiceBrokerConditionReady, v1beta1.ConditionFalse, errorSyncingCatalogReason, errorSyncingCatalogMessage+s); err != nil {
+					return err
+				}
 				return err
 			}
-			return err
 		}
+
 		glog.V(5).Info(pcb.Message("Successfully converted catalog payload from to service-catalog API"))
 
 		// brokers must return at least one service; enforce this constraint