hook-controller

Hook Controller

Source: pkg/controller/hook/ (validation), pkg/controller/plan/hook.go (execution)

Two Concerns

The Hook lifecycle is split across two controllers:

1. Hook controller (pkg/controller/hook/) — validates the Hook CRD and sets Ready.
2. Plan controller (pkg/controller/plan/hook.go) — executes hooks via HookRunner during migration phases PreHook and PostHook.

Hook CRD Validation

Reconciliation Flow

Fetch Hook CR
  → BeginStagingConditions
  → validate()
    → If spec.aap is set:
        → Reject if image or playbook also set (InvalidHookExecute)
        → validateAAP() — url, jobTemplateId > 0, tokenSecret.name required
    → If spec.aap is nil (local hook):
        → HookExecutionConfigValid() — image is required, playbook optional
        → validateImage() — Docker image reference regex (OCI-compliant)
        → validatePlaybook() — must be valid base64 if provided
  → Set Ready if no blockers
  → EndStagingConditions, record events, update status

Conditions

Condition	Category	When Set
InvalidImage	Critical	Image name fails OCI reference regex
InvalidPlaybook	Critical	Playbook is not valid base64
InvalidHookExecute	Critical	Invalid combination: AAP + image/playbook, or missing image for local hook
Ready	Required	No blocker conditions

Image Validation

The regexp.go file contains a full OCI/Docker image reference parser:

• Validates [domain/]name[:tag][@digest] format.
• Supports multi-level paths, port numbers, tags, and SHA digests.

Hook Execution (HookRunner)

File: pkg/controller/plan/hook.go

Invoked by the migration controller during PhasePreHook and PhasePostHook:

runner := HookRunner{Context: r.Context}
err = runner.Run(vm)

Two Execution Modes

1. Local Hook (Kubernetes Job)

When spec.aap is nil:

1. ConfigMap: Created with workload.yml (VM inventory data), playbook.yml (decoded from base64), and plan.yml (plan spec as YAML).
2. Job: Created in the plan's namespace with:
   • Container image from hook.Spec.Image
   • ConfigMap mounted at /tmp/hook
   • If playbook provided: command is /bin/entrypoint ansible-runner run /tmp/runner -p /tmp/hook/playbook.yml
   • BackoffLimit: 1
   • Resource requests/limits from Settings.Migration.HooksContainer{Requests,Limits}{Cpu,Memory}
   • ActiveDeadlineSeconds from hook.Spec.Deadline (if > 0)
3. Service account precedence: Hook SA → Plan SA → Global controller SA → namespace default.
4. Owned by Plan: Job has owner reference to the Plan CR.