New command "cleanup-outdated-service-bindings"

* deletes outdated service credential bindings for a given app
* can be narrowed down to bindings of one specific service instance
* number of bindings to keep can also be specified (default: 1)
* for the full workflow, see https://github.com/cloudfoundry/community/blob/main/toc/rfc/rfc-0040-service-binding-rotation.md#cf-cli

Author: jochenehret

.github/ops-files/increase-max-service-credential-bindings.yml

@@ -0,0 +1,6 @@
+# Enable service binding rotation feature
+# See https://github.com/cloudfoundry/community/blob/main/toc/rfc/rfc-0040-service-binding-rotation.md#cf-cli
+---
+- type: replace
+  path: /instance_groups/name=api/jobs/name=cloud_controller_ng/properties/cc/max_service_credential_bindings_per_app_service_instance?
+  value: 2

.github/workflows/create-bosh-lite.yml

@@ -153,6 +153,7 @@ jobs:
           -o ${GITHUB_WORKSPACE}/cli/.github/ops-files/add-uaa-client-credentials.yml \
           -o ${GITHUB_WORKSPACE}/cli/.github/ops-files/increase-route-registration-interval.yml \
           -o ${GITHUB_WORKSPACE}/cli/.github/ops-files/add-oidc-provider.yml ${additional_args} \
+          -o ${GITHUB_WORKSPACE}/cli/.github/ops-files/increase-max-service-credential-bindings.yml \
           -v client-secret="${{ secrets.CLIENT_SECRET }}" \
           -v system_domain=${SYSTEM_DOMAIN} \
           > ./director.yml

actor/v7action/cloud_controller_client.go

@@ -116,6 +116,7 @@ type CloudControllerClient interface {
 	GetServiceBrokers(query ...ccv3.Query) ([]resources.ServiceBroker, ccv3.Warnings, error)
 	GetServiceCredentialBindings(query ...ccv3.Query) ([]resources.ServiceCredentialBinding, ccv3.Warnings, error)
 	GetServiceCredentialBindingDetails(guid string) (resources.ServiceCredentialBindingDetails, ccv3.Warnings, error)
+	GetServiceInstanceByGUID(serviceInstanceGUID string) (resources.ServiceInstance, ccv3.Warnings, error)
 	GetServiceInstanceByNameAndSpace(name, spaceGUID string, query ...ccv3.Query) (resources.ServiceInstance, ccv3.IncludedResources, ccv3.Warnings, error)
 	GetServiceInstanceParameters(serviceInstanceGUID string) (types.JSONObject, ccv3.Warnings, error)
 	GetServiceInstanceSharedSpaces(serviceInstanceGUID string) ([]ccv3.SpaceWithOrganization, ccv3.Warnings, error)

actor/v7action/service_app_binding.go

@@ -18,6 +18,11 @@ type CreateServiceAppBindingParams struct {
 	Strategy            resources.BindingStrategyType
 }
 
+type ListAppBindingParams struct {
+	SpaceGUID string
+	AppName   string
+}
+
 type ListServiceAppBindingParams struct {
 	SpaceGUID           string
 	ServiceInstanceName string
@@ -65,6 +70,33 @@ func (actor Actor) CreateServiceAppBinding(params CreateServiceAppBindingParams)
 	}
 }
 
+func (actor Actor) ListAppBindings(params ListAppBindingParams) ([]resources.ServiceCredentialBinding, Warnings, error) {
+	var (
+		app      resources.Application
+		bindings []resources.ServiceCredentialBinding
+	)
+
+	warnings, err := railway.Sequentially(
+		func() (warnings ccv3.Warnings, err error) {
+			app, warnings, err = actor.CloudControllerClient.GetApplicationByNameAndSpace(params.AppName, params.SpaceGUID)
+			return
+		},
+		func() (warnings ccv3.Warnings, err error) {
+			bindings, warnings, err = actor.getServiceAppBindings("", app.GUID)
+			return
+		},
+	)
+
+	switch err.(type) {
+	case nil:
+		return bindings, Warnings(warnings), nil
+	case ccerror.ApplicationNotFoundError:
+		return nil, Warnings(warnings), actionerror.ApplicationNotFoundError{Name: params.AppName}
+	default:
+		return nil, Warnings(warnings), err
+	}
+}
+
 func (actor Actor) ListServiceAppBindings(params ListServiceAppBindingParams) ([]resources.ServiceCredentialBinding, Warnings, error) {
 	var (
 		serviceInstance resources.ServiceInstance
@@ -144,16 +176,24 @@ func (actor Actor) createServiceAppBinding(serviceInstanceGUID, appGUID, binding
 }
 
 func (actor Actor) getServiceAppBindings(serviceInstanceGUID, appGUID string) ([]resources.ServiceCredentialBinding, ccv3.Warnings, error) {
-	bindings, warnings, err := actor.CloudControllerClient.GetServiceCredentialBindings(
-		ccv3.Query{Key: ccv3.TypeFilter, Values: []string{"app"}},
-		ccv3.Query{Key: ccv3.ServiceInstanceGUIDFilter, Values: []string{serviceInstanceGUID}},
-		ccv3.Query{Key: ccv3.AppGUIDFilter, Values: []string{appGUID}},
-	)
+	queries := []ccv3.Query{
+		{Key: ccv3.TypeFilter, Values: []string{"app"}},
+		{Key: ccv3.AppGUIDFilter, Values: []string{appGUID}},
+	}
+	if serviceInstanceGUID != "" {
+		queries = append(queries, ccv3.Query{Key: ccv3.ServiceInstanceGUIDFilter, Values: []string{serviceInstanceGUID}})
+	}
+
+	bindings, warnings, err := actor.CloudControllerClient.GetServiceCredentialBindings(queries...)
 
 	switch {
 	case err != nil:
 		return []resources.ServiceCredentialBinding{}, warnings, err
 	case len(bindings) == 0:
+		// If no specific service instance is requested, return empty set without error.
+		if serviceInstanceGUID == "" {
+			return []resources.ServiceCredentialBinding{}, warnings, nil
+		}
 		return []resources.ServiceCredentialBinding{}, warnings, actionerror.ServiceBindingNotFoundError{
 			AppGUID:             appGUID,
 			ServiceInstanceGUID: serviceInstanceGUID,

actor/v7action/service_app_binding_test.go

@@ -251,6 +251,140 @@ var _ = Describe("Service App Binding Action", func() {
 		})
 	})
 
+	Describe("ListAppBindings", func() {
+		const (
+			appName     = "fake-app-name"
+			appGUID     = "fake-app-guid"
+			spaceGUID   = "fake-space-guid"
+			bindingGUID = "fake-binding-guid"
+		)
+
+		var (
+			params                    ListAppBindingParams
+			warnings                  Warnings
+			executionError            error
+			serviceCredentialBindings []resources.ServiceCredentialBinding
+		)
+
+		BeforeEach(func() {
+			fakeCloudControllerClient.GetApplicationByNameAndSpaceReturns(
+				resources.Application{
+					GUID: appGUID,
+					Name: appName,
+				},
+				ccv3.Warnings{"get app warning"},
+				nil,
+			)
+
+			fakeCloudControllerClient.GetServiceCredentialBindingsReturns(
+				[]resources.ServiceCredentialBinding{
+					{GUID: bindingGUID},
+				},
+				ccv3.Warnings{"get bindings warning"},
+				nil,
+			)
+
+			params = ListAppBindingParams{
+				SpaceGUID: "fake-space-guid",
+				AppName:   "fake-app-name",
+			}
+		})
+
+		JustBeforeEach(func() {
+			serviceCredentialBindings, warnings, executionError = actor.ListAppBindings(params)
+		})
+
+		It("returns an event stream, warning, and no errors", func() {
+			Expect(executionError).NotTo(HaveOccurred())
+
+			Expect(warnings).To(ConsistOf(Warnings{
+				"get app warning",
+				"get bindings warning",
+			}))
+
+			Expect(serviceCredentialBindings).To(Equal([]resources.ServiceCredentialBinding{{GUID: bindingGUID}}))
+		})
+
+		Describe("app lookup", func() {
+			It("makes the correct call", func() {
+				Expect(fakeCloudControllerClient.GetApplicationByNameAndSpaceCallCount()).To(Equal(1))
+				actualAppName, actualSpaceGUID := fakeCloudControllerClient.GetApplicationByNameAndSpaceArgsForCall(0)
+				Expect(actualAppName).To(Equal(appName))
+				Expect(actualSpaceGUID).To(Equal(spaceGUID))
+			})
+
+			When("not found", func() {
+				BeforeEach(func() {
+					fakeCloudControllerClient.GetApplicationByNameAndSpaceReturns(
+						resources.Application{},
+						ccv3.Warnings{"get app warning"},
+						ccerror.ApplicationNotFoundError{Name: appName},
+					)
+				})
+
+				It("returns the error and warning", func() {
+					Expect(warnings).To(ContainElement("get app warning"))
+					Expect(executionError).To(MatchError(actionerror.ApplicationNotFoundError{Name: appName}))
+				})
+			})
+
+			When("fails", func() {
+				BeforeEach(func() {
+					fakeCloudControllerClient.GetApplicationByNameAndSpaceReturns(
+						resources.Application{},
+						ccv3.Warnings{"get app warning"},
+						errors.New("boom"),
+					)
+				})
+
+				It("returns the error and warning", func() {
+					Expect(warnings).To(ContainElement("get app warning"))
+					Expect(executionError).To(MatchError("boom"))
+				})
+			})
+		})
+
+		Describe("binding lookup", func() {
+			It("makes the correct call", func() {
+				Expect(fakeCloudControllerClient.GetServiceCredentialBindingsCallCount()).To(Equal(1))
+				Expect(fakeCloudControllerClient.GetServiceCredentialBindingsArgsForCall(0)).To(ConsistOf(
+					ccv3.Query{Key: ccv3.TypeFilter, Values: []string{"app"}},
+					ccv3.Query{Key: ccv3.AppGUIDFilter, Values: []string{appGUID}},
+				))
+			})
+
+			When("there are no bindings", func() {
+				BeforeEach(func() {
+					fakeCloudControllerClient.GetServiceCredentialBindingsReturns(
+						[]resources.ServiceCredentialBinding{},
+						ccv3.Warnings{"get bindings warning"},
+						nil,
+					)
+				})
+
+				It("returns an empty list", func() {
+					Expect(warnings).To(ContainElement("get bindings warning"))
+					Expect(serviceCredentialBindings).To(Equal([]resources.ServiceCredentialBinding{}))
+				})
+			})
+
+			When("fails", func() {
+				BeforeEach(func() {
+					fakeCloudControllerClient.GetServiceCredentialBindingsReturns(
+						[]resources.ServiceCredentialBinding{},
+						ccv3.Warnings{"get binding warning"},
+						errors.New("boom"),
+					)
+				})
+
+				It("returns the error and warning", func() {
+					Expect(warnings).To(ContainElement("get binding warning"))
+					Expect(executionError).To(MatchError("boom"))
+				})
+			})
+		})
+	})
+
 	Describe("ListServiceAppBindings", func() {
 		const (
 			serviceInstanceName = "fake-service-instance-name"

actor/v7action/service_instance.go

@@ -33,6 +33,11 @@ func (actor Actor) GetServiceInstanceByNameAndSpace(serviceInstanceName string,
 	return serviceInstance, Warnings(warnings), err
 }
 
+func (actor Actor) GetServiceInstanceByGUID(serviceInstanceGUID string) (resources.ServiceInstance, Warnings, error) {
+	serviceInstance, warnings, err := actor.CloudControllerClient.GetServiceInstanceByGUID(serviceInstanceGUID)
+	return serviceInstance, Warnings(warnings), err
+}
+
 func (actor Actor) CreateUserProvidedServiceInstance(serviceInstance resources.ServiceInstance) (Warnings, error) {
 	serviceInstance.Type = resources.UserProvidedServiceInstance
 	_, warnings, err := actor.CloudControllerClient.CreateServiceInstance(serviceInstance)

actor/v7action/v7actionfakes/fake_cloud_controller_client.go

@@ -86,6 +86,7 @@ const (
 	GetServiceCredentialBindingsRequest                         = "GetServiceCredentialBindings"
 	GetServiceCredentialBindingDetailsRequest                   = "GetServiceCredentialBindingDetails"
 	GetServiceInstanceParametersRequest                         = "GetServiceInstanceParameters"
+	GetServiceInstanceRequest                                   = "GetServiceInstance"
 	GetServiceInstancesRequest                                  = "GetServiceInstances"
 	GetServiceInstanceRelationshipsSharedSpacesRequest          = "GetServiceInstanceRelationshipSharedSpacesRequest"
 	GetServiceInstanceSharedSpacesUsageSummaryRequest           = "GetServiceInstanceSharedSpacesUsageSummaryRequest"
@@ -305,6 +306,7 @@ var APIRoutes = map[string]Route{
 	GetServiceCredentialBindingsRequest:                         {Path: "/v3/service_credential_bindings", Method: http.MethodGet},
 	DeleteServiceCredentialBindingRequest:                       {Path: "/v3/service_credential_bindings/:service_credential_binding_guid", Method: http.MethodDelete},
 	GetServiceCredentialBindingDetailsRequest:                   {Path: "/v3/service_credential_bindings/:service_credential_binding_guid/details", Method: http.MethodGet},
+	GetServiceInstanceRequest:                                   {Path: "/v3/service_instances/:service_instance_guid", Method: http.MethodGet},
 	GetServiceInstancesRequest:                                  {Path: "/v3/service_instances", Method: http.MethodGet},
 	PostServiceInstanceRequest:                                  {Path: "/v3/service_instances", Method: http.MethodPost},
 	GetServiceInstanceParametersRequest:                         {Path: "/v3/service_instances/:service_instance_guid/parameters", Method: http.MethodGet},

api/cloudcontroller/ccv3/internal/api_routes.go

@@ -32,6 +32,18 @@ func (client *Client) GetServiceInstances(query ...Query) ([]resources.ServiceIn
 	return result, included, warnings, err
 }
 
+func (client *Client) GetServiceInstanceByGUID(serviceInstanceGUID string) (resources.ServiceInstance, Warnings, error) {
+	var result resources.ServiceInstance
+
+	_, warnings, err := client.MakeRequest(RequestParams{
+		RequestName:  internal.GetServiceInstanceRequest,
+		URIParams:    internal.Params{"service_instance_guid": serviceInstanceGUID},
+		ResponseBody: &result,
+	})
+
+	return result, warnings, err
+}
+
 func (client *Client) GetServiceInstanceByNameAndSpace(name, spaceGUID string, query ...Query) (resources.ServiceInstance, IncludedResources, Warnings, error) {
 	query = append(query,
 		Query{Key: NameFilter, Values: []string{name}},