chore(konnect): do not handle upsert errors (#787)

controller/konnect/ops/ops_controlplane.go

@@ -2,14 +2,12 @@ package ops
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"sort"
 
 	sdkkonnectgo "github.com/Kong/sdk-konnect-go"
 	sdkkonnectcomp "github.com/Kong/sdk-konnect-go/models/components"
 	sdkkonnectops "github.com/Kong/sdk-konnect-go/models/operations"
-	sdkkonnecterrs "github.com/Kong/sdk-konnect-go/models/sdkerrors"
 	"github.com/samber/lo"
 	"github.com/sourcegraph/conc/iter"
 	corev1 "k8s.io/api/core/v1"
@@ -99,24 +97,10 @@ func updateControlPlane(
 	}
 
 	resp, err := sdk.UpdateControlPlane(ctx, id, req)
-	var sdkError *sdkkonnecterrs.NotFoundError
-	if errors.As(err, &sdkError) {
-		logEntityNotFoundRecreating(ctx, cp, id)
-		if err := createControlPlane(ctx, sdk, sdkGroups, cl, cp); err != nil {
-			return FailedKonnectOpError[konnectv1alpha1.KonnectGatewayControlPlane]{
-				Op:  UpdateOp,
-				Err: err,
-			}
-		}
-
-		return nil
-	}
-
 	if errWrap := wrapErrIfKonnectOpFailed(err, UpdateOp, cp); errWrap != nil {
-		return FailedKonnectOpError[konnectv1alpha1.KonnectGatewayControlPlane]{
-			Op:  UpdateOp,
-			Err: errWrap,
-		}
+		return handleUpdateError(ctx, err, cp, func(ctx context.Context) error {
+			return createControlPlane(ctx, sdk, sdkGroups, cl, cp)
+		})
 	}
 
 	if resp == nil || resp.ControlPlane == nil {

controller/konnect/ops/ops_credentialacl.go

@@ -2,12 +2,10 @@ package ops
 
 import (
 	"context"
-	"errors"
 	"fmt"
 
 	sdkkonnectcomp "github.com/Kong/sdk-konnect-go/models/components"
 	sdkkonnectops "github.com/Kong/sdk-konnect-go/models/operations"
-	sdkkonnecterrs "github.com/Kong/sdk-konnect-go/models/sdkerrors"
 	"github.com/samber/lo"
 
 	sdkops "github.com/kong/gateway-operator/controller/konnect/ops/sdk"
@@ -75,27 +73,6 @@ func updateKongCredentialACL(
 	// Can't adopt it as it will cause conflicts between the controller
 	// that created that entity and already manages it, hm
 	if errWrap := wrapErrIfKonnectOpFailed(err, UpdateOp, cred); errWrap != nil {
-		// ACL update operation returns an SDKError instead of a NotFoundError.
-		var sdkError *sdkkonnecterrs.SDKError
-		if errors.As(errWrap, &sdkError) {
-			switch sdkError.StatusCode {
-			case 404:
-				if err := createKongCredentialACL(ctx, sdk, cred); err != nil {
-					return FailedKonnectOpError[configurationv1alpha1.KongCredentialACL]{
-						Op:  UpdateOp,
-						Err: err,
-					}
-				}
-				return nil
-			default:
-				return FailedKonnectOpError[configurationv1alpha1.KongCredentialACL]{
-					Op:  UpdateOp,
-					Err: sdkError,
-				}
-
-			}
-		}
-
 		return errWrap
 	}
 

controller/konnect/ops/ops_credentialapikey.go

@@ -69,9 +69,6 @@ func updateKongCredentialAPIKey(
 			KeyAuthWithoutParents:       kongCredentialAPIKeyToKeyAuthWithoutParents(cred),
 		})
 
-	// TODO: handle already exists
-	// Can't adopt it as it will cause conflicts between the controller
-	// that created that entity and already manages it, hm
 	if errWrap := wrapErrIfKonnectOpFailed(err, UpdateOp, cred); errWrap != nil {
 		return errWrap
 	}

controller/konnect/ops/ops_credentialbasicauth.go

@@ -68,9 +68,6 @@ func updateKongCredentialBasicAuth(
 		BasicAuthWithoutParents:     kongCredentialBasicAuthToBasicAuthWithoutParents(cred),
 	})
 
-	// TODO: handle already exists
-	// Can't adopt it as it will cause conflicts between the controller
-	// that created that entity and already manages it, hm
 	if errWrap := wrapErrIfKonnectOpFailed(err, UpdateOp, cred); errWrap != nil {
 		return errWrap
 	}

controller/konnect/ops/ops_credentialhmac.go

@@ -2,12 +2,10 @@ package ops
 
 import (
 	"context"
-	"errors"
 	"fmt"
 
 	sdkkonnectcomp "github.com/Kong/sdk-konnect-go/models/components"
 	sdkkonnectops "github.com/Kong/sdk-konnect-go/models/operations"
-	sdkkonnecterrs "github.com/Kong/sdk-konnect-go/models/sdkerrors"
 	"github.com/samber/lo"
 
 	sdkops "github.com/kong/gateway-operator/controller/konnect/ops/sdk"
@@ -71,31 +69,7 @@ func updateKongCredentialHMAC(
 			HMACAuthWithoutParents:      kongCredentialHMACToHMACWithoutParents(cred),
 		})
 
-	// TODO: handle already exists
-	// Can't adopt it as it will cause conflicts between the controller
-	// that created that entity and already manages it, hm
 	if errWrap := wrapErrIfKonnectOpFailed(err, UpdateOp, cred); errWrap != nil {
-		// HMAC update operation returns an SDKError instead of a NotFoundError.
-		var sdkError *sdkkonnecterrs.SDKError
-		if errors.As(errWrap, &sdkError) {
-			switch sdkError.StatusCode {
-			case 404:
-				if err := createKongCredentialHMAC(ctx, sdk, cred); err != nil {
-					return FailedKonnectOpError[configurationv1alpha1.KongCredentialHMAC]{
-						Op:  UpdateOp,
-						Err: err,
-					}
-				}
-				return nil
-			default:
-				return FailedKonnectOpError[configurationv1alpha1.KongCredentialHMAC]{
-					Op:  UpdateOp,
-					Err: sdkError,
-				}
-
-			}
-		}
-
 		return errWrap
 	}
 

controller/konnect/ops/ops_credentialjwt.go

@@ -2,12 +2,10 @@ package ops
 
 import (
 	"context"
-	"errors"
 	"fmt"
 
 	sdkkonnectcomp "github.com/Kong/sdk-konnect-go/models/components"
 	sdkkonnectops "github.com/Kong/sdk-konnect-go/models/operations"
-	sdkkonnecterrs "github.com/Kong/sdk-konnect-go/models/sdkerrors"
 	"github.com/samber/lo"
 
 	sdkops "github.com/kong/gateway-operator/controller/konnect/ops/sdk"
@@ -71,31 +69,7 @@ func updateKongCredentialJWT(
 			JWTWithoutParents:           kongCredentialJWTToJWTWithoutParents(cred),
 		})
 
-	// TODO: handle already exists
-	// Can't adopt it as it will cause conflicts between the controller
-	// that created that entity and already manages it, hm
 	if errWrap := wrapErrIfKonnectOpFailed(err, UpdateOp, cred); errWrap != nil {
-		// JWT update operation returns an SDKError instead of a NotFoundError.
-		var sdkError *sdkkonnecterrs.SDKError
-		if errors.As(errWrap, &sdkError) {
-			switch sdkError.StatusCode {
-			case 404:
-				if err := createKongCredentialJWT(ctx, sdk, cred); err != nil {
-					return FailedKonnectOpError[configurationv1alpha1.KongCredentialJWT]{
-						Op:  UpdateOp,
-						Err: err,
-					}
-				}
-				return nil
-			default:
-				return FailedKonnectOpError[configurationv1alpha1.KongCredentialJWT]{
-					Op:  UpdateOp,
-					Err: sdkError,
-				}
-
-			}
-		}
-
 		return errWrap
 	}
 

controller/konnect/ops/ops_errors.go

@@ -129,6 +129,59 @@ func SDKErrorIsConflict(sdkError *sdkkonnecterrs.SDKError) bool {
 	return false
 }
 
+// handleUpdateError handles errors that occur during an update operation.
+// If the entity is not found, then it uses the provided create function to
+// recreate the it.
+func handleUpdateError[
+	T constraints.SupportedKonnectEntityType,
+	TEnt constraints.EntityType[T],
+](
+	ctx context.Context,
+	err error,
+	ent TEnt,
+	createFunc func(ctx context.Context) error,
+) error {
+	var (
+		sdkError *sdkkonnecterrs.SDKError
+		id       = ent.GetKonnectStatus().GetKonnectID()
+	)
+	if errors.As(err, &sdkError) {
+		switch sdkError.StatusCode {
+		case http.StatusNotFound:
+			logEntityNotFoundRecreating(ctx, ent, id)
+			if err := createFunc(ctx); err != nil {
+				return FailedKonnectOpError[T]{
+					Op:  UpdateOp,
+					Err: err,
+				}
+			}
+			return nil
+		default:
+			return FailedKonnectOpError[T]{
+				Op:  UpdateOp,
+				Err: sdkError,
+			}
+		}
+	}
+
+	var notFoundError *sdkkonnecterrs.NotFoundError
+	if errors.As(err, &notFoundError) {
+		logEntityNotFoundRecreating(ctx, ent, id)
+		if err := createFunc(ctx); err != nil {
+			return FailedKonnectOpError[T]{
+				Op:  UpdateOp,
+				Err: err,
+			}
+		}
+		return nil
+	}
+
+	return FailedKonnectOpError[T]{
+		Op:  UpdateOp,
+		Err: err,
+	}
+}
+
 // handleDeleteError handles errors that occur during a delete operation.
 // It logs a message and returns nil if the entity was not found in Konnect (when
 // the delete operation is skipped).

controller/konnect/ops/ops_kongcacertificate.go

@@ -68,16 +68,10 @@ func updateCACertificate(
 		},
 	)
 
-	// TODO: handle already exists
-	// Can't adopt it as it will cause conflicts between the controller
-	// that created that entity and already manages it, hm
 	if errWrap := wrapErrIfKonnectOpFailed(err, UpdateOp, cert); errWrap != nil {
-		SetKonnectEntityProgrammedConditionFalse(cert, "FailedToUpdate", errWrap.Error())
 		return errWrap
 	}
 
-	SetKonnectEntityProgrammedCondition(cert)
-
 	return nil
 }
 

controller/konnect/ops/ops_kongcertificate.go

@@ -2,12 +2,10 @@ package ops
 
 import (
 	"context"
-	"errors"
 	"fmt"
 
 	sdkkonnectcomp "github.com/Kong/sdk-konnect-go/models/components"
 	sdkkonnectops "github.com/Kong/sdk-konnect-go/models/operations"
-	sdkkonnecterrs "github.com/Kong/sdk-konnect-go/models/sdkerrors"
 	"github.com/samber/lo"
 
 	sdkops "github.com/kong/gateway-operator/controller/konnect/ops/sdk"
@@ -70,31 +68,7 @@ func updateCertificate(
 		},
 	)
 
-	// TODO: handle already exists
-	// Can't adopt it as it will cause conflicts between the controller
-	// that created that entity and already manages it, hm
 	if errWrap := wrapErrIfKonnectOpFailed(err, UpdateOp, cert); errWrap != nil {
-		// Certificate update operation returns an SDKError instead of a NotFoundError.
-		var sdkError *sdkkonnecterrs.SDKError
-		if errors.As(errWrap, &sdkError) {
-			switch sdkError.StatusCode {
-			case 404:
-				if err := createCertificate(ctx, sdk, cert); err != nil {
-					return FailedKonnectOpError[configurationv1alpha1.KongCertificate]{
-						Op:  UpdateOp,
-						Err: err,
-					}
-				}
-				// Create succeeded, createCertificate sets the status so no need to do this here.
-
-				return nil
-			default:
-				return FailedKonnectOpError[configurationv1alpha1.KongCertificate]{
-					Op:  UpdateOp,
-					Err: sdkError,
-				}
-			}
-		}
 		return errWrap
 	}
 

controller/konnect/ops/ops_kongconsumer.go

@@ -125,15 +125,21 @@ func handleConsumerGroupAssignments(
 	populateConsumerGroupRefsValidCondition(invalidConsumerGroups, consumer)
 
 	if err != nil {
-		SetKonnectEntityProgrammedConditionFalse(consumer, konnectv1alpha1.KonnectEntityProgrammedReasonFailedToResolveConsumerGroupRefs, err.Error())
-		return err
+		return KonnectEntityCreatedButRelationsFailedError{
+			KonnectID: consumer.GetKonnectID(),
+			Reason:    konnectv1alpha1.KonnectEntityProgrammedReasonFailedToResolveConsumerGroupRefs,
+			Err:       err,
+		}
 	}
 
 	// Reconcile the ConsumerGroups assigned to the KongConsumer in Konnect (list the actual ConsumerGroups, calculate the
 	// difference, and add/remove the Consumer from the ConsumerGroups accordingly).
 	if err := reconcileConsumerGroupsWithKonnect(ctx, desiredConsumerGroupsIDs, cgSDK, cpID, consumer); err != nil {
-		SetKonnectEntityProgrammedConditionFalse(consumer, konnectv1alpha1.KonnectEntityProgrammedReasonFailedToReconcileConsumerGroupsWithKonnect, err.Error())
-		return err
+		return KonnectEntityCreatedButRelationsFailedError{
+			KonnectID: consumer.GetKonnectID(),
+			Reason:    konnectv1alpha1.KonnectEntityProgrammedReasonFailedToReconcileConsumerGroupsWithKonnect,
+			Err:       err,
+		}
 	}
 	return nil
 }

controller/konnect/ops/ops_kongdataplaneclientcertificate.go

@@ -33,12 +33,10 @@ func createKongDataPlaneClientCertificate(
 	// Can't adopt it as it will cause conflicts between the controller
 	// that created that entity and already manages it, hm
 	if errWrap := wrapErrIfKonnectOpFailed(err, CreateOp, cert); errWrap != nil {
-		SetKonnectEntityProgrammedConditionFalse(cert, "FailedToCreate", errWrap.Error())
 		return errWrap
 	}
 
-	cert.Status.Konnect.SetKonnectID(*resp.DataPlaneClientCertificate.Item.ID)
-	SetKonnectEntityProgrammedCondition(cert)
+	cert.SetKonnectID(*resp.DataPlaneClientCertificate.Item.ID)
 
 	return nil
 }

controller/konnect/ops/ops_kongkey.go

@@ -2,12 +2,10 @@ package ops
 
 import (
 	"context"
-	"errors"
 	"fmt"
 
 	sdkkonnectcomp "github.com/Kong/sdk-konnect-go/models/components"
 	sdkkonnectops "github.com/Kong/sdk-konnect-go/models/operations"
-	sdkkonnecterrs "github.com/Kong/sdk-konnect-go/models/sdkerrors"
 	"github.com/samber/lo"
 
 	sdkops "github.com/kong/gateway-operator/controller/konnect/ops/sdk"
@@ -69,26 +67,7 @@ func updateKey(
 		},
 	)
 
-	// TODO: handle already exists
-	// Can't adopt it as it will cause conflicts between the controller
-	// that created that entity and already manages it, hm
 	if errWrap := wrapErrIfKonnectOpFailed(err, UpdateOp, key); errWrap != nil {
-		var sdkError *sdkkonnecterrs.SDKError
-		if errors.As(errWrap, &sdkError) {
-			if sdkError.StatusCode == 404 {
-				if err := createKey(ctx, sdk, key); err != nil {
-					return FailedKonnectOpError[configurationv1alpha1.KongKey]{
-						Op:  UpdateOp,
-						Err: err,
-					}
-				}
-				return nil // createKey sets the status so we can return here.
-			}
-			return FailedKonnectOpError[configurationv1alpha1.KongKey]{
-				Op:  UpdateOp,
-				Err: sdkError,
-			}
-		}
 		return errWrap
 	}