feat: add pod file system I/O experiments

Makefile

@@ -17,6 +17,7 @@ BUILD_TARGET_DIR_NAME=chaosblade-$(BLADE_VERSION)
 BUILD_TARGET_PKG_DIR=$(BUILD_TARGET)/chaosblade-$(BLADE_VERSION)
 BUILD_TARGET_BIN=$(BUILD_TARGET_PKG_DIR)/bin
 BUILD_IMAGE_PATH=build/image/blade
+BUILD_IMAGE_BIN=build/_output/bin
 # cache downloaded file
 BUILD_TARGET_CACHE=$(BUILD_TARGET)/cache
 
@@ -27,12 +28,12 @@ ifeq ($(GOOS), linux)
 	GO_FLAGS=-ldflags="-linkmode external -extldflags -static"
 endif
 
-build: pre_build build_yaml
+build: pre_build build_yaml build_fuse 
 
 build_all: build build_image
 
-build_image:
-	operator-sdk build chaosblade-operator:latest
+build_image: build_webhook
+	operator-sdk build chaosblade-operator:${BLADE_VERSION}
 
 build_linux: build
 
@@ -43,6 +44,13 @@ pre_build:
 build_yaml: build/spec.go
 	$(GO) run $< $(OS_YAML_FILE_PATH)
 
+build_webhook:
+	$(GO) build $(GO_FLAGS) -o $(BUILD_IMAGE_BIN)/chaosblade-webhook cmd/webhook/main.go
+
+build_fuse:
+	$(GO) build $(GO_FLAGS) -o $(BUILD_TARGET_BIN)/chaos_fuse  cmd/hookfs/main.go
+
+
 # test
 test:
 	go test -race -coverprofile=coverage.txt -covermode=atomic ./...

build/Dockerfile

@@ -1,11 +1,13 @@
 FROM registry.access.redhat.com/ubi7/ubi-minimal:latest
 
 ENV OPERATOR=/usr/local/bin/chaosblade-operator \
+    WEBHOOK=/usr/local/bin/chaosblade-webhook \
     USER_UID=1001 \
     USER_NAME=chaosblade-operator
 
 # install operator binary
 COPY build/_output/bin/chaosblade-operator ${OPERATOR}
+COPY build/_output/bin/chaosblade-webhook ${WEBHOOK}
 
 COPY build/bin /usr/local/bin
 RUN  /usr/local/bin/user_setup

cmd/hookfs/main.go

@@ -0,0 +1,107 @@
+/*
+ * Copyright 1999-2019 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package main
+
+import (
+	"context"
+	"flag"
+	"math/rand"
+	"os"
+	"os/exec"
+	"time"
+
+	chaosbladehook "github.com/chaosblade-io/chaosblade-operator/pkg/hookfs"
+	"github.com/ethercflow/hookfs/hookfs"
+	"github.com/operator-framework/operator-sdk/pkg/log/zap"
+	"github.com/sirupsen/logrus"
+	logf "sigs.k8s.io/controller-runtime/pkg/runtime/log"
+	"sigs.k8s.io/controller-runtime/pkg/runtime/signals"
+)
+
+var (
+	addr       string
+	pidFile    string
+	original   string
+	mountpoint string
+)
+
+func main() {
+	flag.StringVar(&addr, "addr", ":65534", "The address to bind to")
+	flag.StringVar(&original, "original", "", "ORIGINAL")
+	flag.StringVar(&mountpoint, "mountpoint", "", "MOUNTPOINT")
+
+	rand.Seed(time.Now().UnixNano())
+	flag.Parse()
+	logf.SetLogger(zap.Logger())
+	stopCh := signals.SetupSignalHandler()
+	//go startFuseServer(stopCh)
+	chaosbladeHookServer := chaosbladehook.NewChaosbladeHookServer(addr)
+
+	go chaosbladeHookServer.Start(stopCh)
+	if err := startFuseServer(stopCh); err != nil {
+		logrus.Fatal("start fuse server failed", err)
+	}
+
+}
+
+func startFuseServer(stop <-chan struct{}) error {
+	if !IsExist(original) {
+		if err := os.MkdirAll(original, os.FileMode(755)); err != nil {
+			return err
+		}
+	}
+	if !IsExist(mountpoint) {
+		if err := os.MkdirAll(mountpoint, os.FileMode(755)); err != nil {
+			return err
+		}
+	}
+
+	logrus.Info("Init hookfs")
+	fs, err := hookfs.NewHookFs(original, mountpoint, &chaosbladehook.ChaosbladeHook{})
+	if err != nil {
+		return err
+	}
+	errCh := make(chan error)
+	go func() {
+		errCh <- fs.Serve()
+	}()
+	for {
+		select {
+		case <-stop:
+			logrus.Infof("start unmount fuse volume %s", mountpoint)
+			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+			cmd := exec.CommandContext(ctx, "fusermount", "-zu", mountpoint)
+			if err := cmd.Run(); err != nil {
+				logrus.Errorf("failed to fusermount: %v", cmd)
+			}
+			return err
+		case err := <-errCh:
+			if err != nil {
+				return err
+			}
+		}
+	}
+}
+
+func IsExist(path string) bool {
+	_, err := os.Stat(path)
+	if err != nil && os.IsNotExist(err) {
+		return false
+	}
+	return true
+}

cmd/webhook/main.go

@@ -0,0 +1,151 @@
+/*
+ * Copyright 1999-2019 Alibaba Group Holding Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"runtime"
+
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/klog"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+
+	"github.com/chaosblade-io/chaosblade-operator/pkg/apis"
+	"github.com/operator-framework/operator-sdk/pkg/log/zap"
+	sdkVersion "github.com/operator-framework/operator-sdk/version"
+	"github.com/spf13/pflag"
+	_ "k8s.io/client-go/plugin/pkg/client/auth"
+	"sigs.k8s.io/controller-runtime/pkg/client/config"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+	logf "sigs.k8s.io/controller-runtime/pkg/runtime/log"
+	"sigs.k8s.io/controller-runtime/pkg/runtime/signals"
+
+	"github.com/chaosblade-io/chaosblade-operator/pkg/apis/chaosblade/meta"
+	hook "github.com/chaosblade-io/chaosblade-operator/pkg/webhook"
+	mutator "github.com/chaosblade-io/chaosblade-operator/pkg/webhook/pod"
+)
+
+// Change below variables to serve metrics on different host or port.
+var (
+	DisableWebhookConfigInstaller bool
+	BindPort                      int
+)
+var log = logf.Log.WithName("cmd")
+
+func printVersion() {
+	log.Info(fmt.Sprintf("Go Version: %s", runtime.Version()))
+	log.Info(fmt.Sprintf("Go OS/Arch: %s/%s", runtime.GOOS, runtime.GOARCH))
+	log.Info(fmt.Sprintf("Version of operator-sdk: %v", sdkVersion.Version))
+}
+
+func main() {
+	// Add the zap logger flag set to the CLI. The flag set must
+	// be added before calling pflag.Parse().
+	pflag.CommandLine.AddFlagSet(zap.FlagSet())
+	// Add the controller meta flag set to the cli
+	pflag.CommandLine.AddFlagSet(meta.FlagSet())
+	// Add flags registered by imported packages (e.g. glog and
+	// controller-runtime)
+	pflag.CommandLine.AddGoFlagSet(flag.CommandLine)
+
+	pflag.BoolVar(&DisableWebhookConfigInstaller, "disable-webhook-config-installer", false,
+		"disable the installer in the webhook server, so it won't install webhook configuration resources during bootstrapping")
+	pflag.IntVar(&BindPort, "port", 443, "The port on which to serve HTTPS.")
+	pflag.StringVar(&mutator.SidecarImage, "sidecar-image", "", "sidecar container images.")
+	pflag.Int32Var(&mutator.FuseServerPort, "fuse-port", 65534, "Fuse server port.")
+
+	// Use a zap logr.Logger implementation. If none of the zap
+	// flags are configured (or if the zap flag set is not being
+	// used), this defaults to a production zap logger.
+	//
+	// The logger instantiated here can be changed to any logger
+	// implementing the logr.Logger interface. This logger will
+	// be propagated through the whole operator, generating
+	// uniform and structured logs.
+	logf.SetLogger(zap.Logger())
+
+	pflag.Parse()
+	printVersion()
+
+	// Get a config to talk to the apiserver
+	cfg, err := config.GetConfig()
+	if err != nil {
+		log.Error(err, "")
+		os.Exit(1)
+	}
+
+	// Create a new Cmd to provide shared dependencies and start components
+	mgr, err := manager.New(cfg, manager.Options{})
+	if err != nil {
+		log.Error(err, "")
+		os.Exit(1)
+	}
+
+	log.Info("Registering Components.")
+
+	// Setup Scheme for all resources
+	if err := apis.AddToScheme(mgr.GetScheme()); err != nil {
+		log.Error(err, "")
+		os.Exit(1)
+	}
+
+	namespace := os.Getenv("NAMESPACE")
+	if len(namespace) == 0 {
+		log.Error(err, "can not found NAMESPACE env")
+		os.Exit(1)
+	}
+	ws, err := webhook.NewServer("chaosblade-admission-server", mgr, webhook.ServerOptions{
+		Port:                          int32(BindPort),
+		CertDir:                       "/etc/chaosblade/cert",
+		DisableWebhookConfigInstaller: &DisableWebhookConfigInstaller,
+		BootstrapOptions: &webhook.BootstrapOptions{
+			MutatingWebhookConfigName:   "chaosblade-mutating-webhook-configuration",
+			ValidatingWebhookConfigName: "chaosblade-validating-webhook-configuration",
+			Secret: &types.NamespacedName{
+				Namespace: namespace,
+				Name:      "chaosblade-admission-server",
+			},
+
+			Service: &webhook.Service{
+				Namespace: namespace,
+				Name:      "chaosblade-admission-server",
+				// Selectors should select the pods that runs this webhook server.
+				Selectors: map[string]string{
+					"app": "chaosblade-admission-server",
+				},
+			},
+		},
+	})
+	if err != nil {
+		klog.Errorf("unable to create a new webhook server, %v", err)
+		os.Exit(1)
+	}
+
+	klog.Infof("registering webhooks to the webhook server")
+	err = hook.AddToManager(ws, mgr)
+	if err != nil {
+		log.Error(err, "unable to register webhooks in the admission server")
+		os.Exit(1)
+	}
+	log.Info("Starting the Cmd.")
+	if err := mgr.Start(signals.SetupSignalHandler()); err != nil {
+		log.Error(err, "Manager exited non-zero")
+		os.Exit(1)
+	}
+}

deploy/oss/rbac.yaml

@@ -56,6 +56,10 @@ items:
         - chaosblades/status
         verbs:
         - "*"
+      - apiGroups: ["certificates.k8s.io"]
+        resources: ["certificatesigningrequests", "certificatesigningrequests/approval"]
+        verbs: ["get", "delete", "create", "update"]
+
   - apiVersion: rbac.authorization.k8s.io/v1beta1
     kind: ClusterRoleBinding
     metadata:
@@ -70,3 +74,4 @@ items:
       - kind: ServiceAccount
         name: chaosblade
         namespace: kube-system
+