@@ -52,24 +52,19 @@ import (
5252 "sigs.k8s.io/yaml"
5353
5454 nfdclientset "sigs.k8s.io/node-feature-discovery/api/generated/clientset/versioned"
55- klogutils "sigs.k8s.io/node-feature-discovery/pkg/utils/klog"
56- spiffe "sigs.k8s.io/node-feature-discovery/pkg/utils/spiffe"
57-
58- taintutils "k8s.io/kubernetes/pkg/util/taints"
59- "sigs.k8s.io/yaml"
60-
6155 "sigs.k8s.io/node-feature-discovery/api/nfd/v1alpha1"
6256 nfdv1alpha1 "sigs.k8s.io/node-feature-discovery/api/nfd/v1alpha1"
6357 "sigs.k8s.io/node-feature-discovery/pkg/apis/nfd/nodefeaturerule"
6458 "sigs.k8s.io/node-feature-discovery/pkg/apis/nfd/validate"
6559 nfdfeatures "sigs.k8s.io/node-feature-discovery/pkg/features"
6660 "sigs.k8s.io/node-feature-discovery/pkg/utils"
6761 klogutils "sigs.k8s.io/node-feature-discovery/pkg/utils/klog"
62+ spiffe "sigs.k8s.io/node-feature-discovery/pkg/utils/spiffe"
6863 "sigs.k8s.io/node-feature-discovery/pkg/version"
6964)
7065
7166// SocketPath specifies Spiffe Socket Path
72- const SocketPath = "unix:///run/spire/sockets/agent .sock"
67+ const SocketPath = "unix:///run/spire/agent- sockets/api .sock"
7368
7469// Labels are a Kubernetes representation of discovered features.
7570type Labels map [string ]string
@@ -700,6 +695,14 @@ func (m *nfdMaster) getAndMergeNodeFeatures(nodeName string) (*nfdv1alpha1.NodeF
700695 return filteredObjs [i ].Namespace < filteredObjs [j ].Namespace
701696 })
702697
698+ // If spiffe is enabled, we should filter out the non verified NFD objects
699+ if m .config .EnableSpiffe {
700+ filteredObjs , err = m .getVerifiedNFDObjects (filteredObjs )
701+ if err != nil {
702+ return & nfdv1alpha1.NodeFeature {}, err
703+ }
704+ }
705+
703706 if len (filteredObjs ) > 0 {
704707 // Merge in features
705708 //
@@ -755,55 +758,6 @@ func (m *nfdMaster) nfdAPIUpdateOneNode(cli k8sclient.Interface, node *corev1.No
755758 return fmt .Errorf ("failed to merge NodeFeature objects for node %q: %w" , node .Name , err )
756759 }
757760
758- // Sort our objects
759- sort .Slice (objs , func (i , j int ) bool {
760- // Objects in our nfd namespace gets into the beginning of the list
761- if objs [i ].Namespace == m .namespace && objs [j ].Namespace != m .namespace {
762- return true
763- }
764- if objs [i ].Namespace != m .namespace && objs [j ].Namespace == m .namespace {
765- return false
766- }
767- // After the nfd namespace, sort objects by their name
768- if objs [i ].Name != objs [j ].Name {
769- return objs [i ].Name < objs [j ].Name
770- }
771- // Objects with the same name are sorted by their namespace
772- return objs [i ].Namespace < objs [j ].Namespace
773- })
774-
775- // If spiffe is enabled, we should filter out the non verified NFD objects
776- if m .config .EnableSpiffe {
777- objs , err = m .getVerifiedNFDObjects (objs )
778- if err != nil {
779- return err
780- }
781- }
782-
783- klog .V (1 ).InfoS ("processing of node initiated by NodeFeature API" , "nodeName" , node .Name )
784-
785- features := nfdv1alpha1 .NewNodeFeatureSpec ()
786-
787- if len (objs ) > 0 {
788- // Merge in features
789- //
790- // NOTE: changing the rule api to support handle multiple objects instead
791- // of merging would probably perform better with lot less data to copy.
792- features = objs [0 ].Spec .DeepCopy ()
793- if m .config .AutoDefaultNs {
794- features .Labels = addNsToMapKeys (features .Labels , nfdv1alpha1 .FeatureLabelNs )
795- }
796- for _ , o := range objs [1 :] {
797- s := o .Spec .DeepCopy ()
798- if m .config .AutoDefaultNs {
799- s .Labels = addNsToMapKeys (s .Labels , nfdv1alpha1 .FeatureLabelNs )
800- }
801- s .MergeInto (features )
802- }
803-
804- klog .V (4 ).InfoS ("merged nodeFeatureSpecs" , "newNodeFeatureSpec" , utils .DelayedDumper (features ))
805- }
806-
807761 // Update node labels et al. This may also mean removing all NFD-owned
808762 // labels (et al.), for example in the case no NodeFeature objects are
809763 // present.
@@ -1528,7 +1482,13 @@ func (m *nfdMaster) getVerifiedNFDObjects(objs []*v1alpha1.NodeFeature) ([]*v1al
15281482 }
15291483
15301484 for _ , obj := range objs {
1531- isSignatureVerified , err := spiffe .VerifyDataSignature (obj .Spec , obj .Annotations ["signature" ], workerPrivateKey , workerPublicKey )
1485+ spiffeObj := spiffe.SpiffeObject {
1486+ Spec : obj .Spec ,
1487+ Name : obj .Name ,
1488+ Namespace : obj .Namespace ,
1489+ Labels : obj .Labels ,
1490+ }
1491+ isSignatureVerified , err := spiffe .VerifyDataSignature (spiffeObj , obj .Annotations ["signature" ], workerPrivateKey , workerPublicKey )
15321492 if err != nil {
15331493 return nil , fmt .Errorf ("failed to verify NodeFeature signature: %w" , err )
15341494 }
0 commit comments