@@ -51,24 +51,19 @@ import (
5151 "sigs.k8s.io/yaml"
5252
5353 nfdclientset "sigs.k8s.io/node-feature-discovery/api/generated/clientset/versioned"
54- klogutils "sigs.k8s.io/node-feature-discovery/pkg/utils/klog"
55- spiffe "sigs.k8s.io/node-feature-discovery/pkg/utils/spiffe"
56-
57- taintutils "k8s.io/kubernetes/pkg/util/taints"
58- "sigs.k8s.io/yaml"
59-
6054 "sigs.k8s.io/node-feature-discovery/api/nfd/v1alpha1"
6155 nfdv1alpha1 "sigs.k8s.io/node-feature-discovery/api/nfd/v1alpha1"
6256 "sigs.k8s.io/node-feature-discovery/pkg/apis/nfd/nodefeaturerule"
6357 "sigs.k8s.io/node-feature-discovery/pkg/apis/nfd/validate"
6458 nfdfeatures "sigs.k8s.io/node-feature-discovery/pkg/features"
6559 "sigs.k8s.io/node-feature-discovery/pkg/utils"
6660 klogutils "sigs.k8s.io/node-feature-discovery/pkg/utils/klog"
61+ spiffe "sigs.k8s.io/node-feature-discovery/pkg/utils/spiffe"
6762 "sigs.k8s.io/node-feature-discovery/pkg/version"
6863)
6964
7065// SocketPath specifies Spiffe Socket Path
71- const SocketPath = "unix:///run/spire/sockets/agent .sock"
66+ const SocketPath = "unix:///run/spire/agent- sockets/api .sock"
7267
7368// Labels are a Kubernetes representation of discovered features.
7469type Labels map [string ]string
@@ -642,6 +637,14 @@ func (m *nfdMaster) getAndMergeNodeFeatures(nodeName string) (*nfdv1alpha1.NodeF
642637 return filteredObjs [i ].Namespace < filteredObjs [j ].Namespace
643638 })
644639
640+ // If spiffe is enabled, we should filter out the non verified NFD objects
641+ if m .config .EnableSpiffe {
642+ filteredObjs , err = m .getVerifiedNFDObjects (filteredObjs )
643+ if err != nil {
644+ return & nfdv1alpha1.NodeFeature {}, err
645+ }
646+ }
647+
645648 if len (filteredObjs ) > 0 {
646649 // Merge in features
647650 //
@@ -697,55 +700,6 @@ func (m *nfdMaster) nfdAPIUpdateOneNode(cli k8sclient.Interface, node *corev1.No
697700 return fmt .Errorf ("failed to merge NodeFeature objects for node %q: %w" , node .Name , err )
698701 }
699702
700- // Sort our objects
701- sort .Slice (objs , func (i , j int ) bool {
702- // Objects in our nfd namespace gets into the beginning of the list
703- if objs [i ].Namespace == m .namespace && objs [j ].Namespace != m .namespace {
704- return true
705- }
706- if objs [i ].Namespace != m .namespace && objs [j ].Namespace == m .namespace {
707- return false
708- }
709- // After the nfd namespace, sort objects by their name
710- if objs [i ].Name != objs [j ].Name {
711- return objs [i ].Name < objs [j ].Name
712- }
713- // Objects with the same name are sorted by their namespace
714- return objs [i ].Namespace < objs [j ].Namespace
715- })
716-
717- // If spiffe is enabled, we should filter out the non verified NFD objects
718- if m .config .EnableSpiffe {
719- objs , err = m .getVerifiedNFDObjects (objs )
720- if err != nil {
721- return err
722- }
723- }
724-
725- klog .V (1 ).InfoS ("processing of node initiated by NodeFeature API" , "nodeName" , node .Name )
726-
727- features := nfdv1alpha1 .NewNodeFeatureSpec ()
728-
729- if len (objs ) > 0 {
730- // Merge in features
731- //
732- // NOTE: changing the rule api to support handle multiple objects instead
733- // of merging would probably perform better with lot less data to copy.
734- features = objs [0 ].Spec .DeepCopy ()
735- if m .config .AutoDefaultNs {
736- features .Labels = addNsToMapKeys (features .Labels , nfdv1alpha1 .FeatureLabelNs )
737- }
738- for _ , o := range objs [1 :] {
739- s := o .Spec .DeepCopy ()
740- if m .config .AutoDefaultNs {
741- s .Labels = addNsToMapKeys (s .Labels , nfdv1alpha1 .FeatureLabelNs )
742- }
743- s .MergeInto (features )
744- }
745-
746- klog .V (4 ).InfoS ("merged nodeFeatureSpecs" , "newNodeFeatureSpec" , utils .DelayedDumper (features ))
747- }
748-
749703 // Update node labels et al. This may also mean removing all NFD-owned
750704 // labels (et al.), for example in the case no NodeFeature objects are
751705 // present.
@@ -1469,16 +1423,22 @@ func (m *nfdMaster) getVerifiedNFDObjects(objs []*v1alpha1.NodeFeature) ([]*v1al
14691423 }
14701424
14711425 for _ , obj := range objs {
1472- isSignatureVerified , err := spiffe .VerifyDataSignature (obj .Spec , obj .Annotations ["signature" ], workerPrivateKey , workerPublicKey )
1426+ spiffeObj := spiffe.SpiffeObject {
1427+ Spec : obj .Spec ,
1428+ Name : obj .Name ,
1429+ Namespace : obj .Namespace ,
1430+ Labels : obj .Labels ,
1431+ }
1432+ isSignatureVerified , err := spiffe .VerifyDataSignature (spiffeObj , obj .Annotations ["signature" ], workerPrivateKey , workerPublicKey )
14731433 if err != nil {
14741434 return nil , fmt .Errorf ("failed to verify NodeFeature signature: %w" , err )
14751435 }
14761436
14771437 if isSignatureVerified {
1478- klog .InfoS ("NodeFeature verified" , "NodeFeature name " , obj . Name )
1438+ klog .InfoS ("NodeFeature verified" , "nodefeature " , klog . KObj ( obj ) )
14791439 verifiedObjects = append (verifiedObjects , obj )
14801440 } else {
1481- klog .InfoS ("NodeFeature not verified, skipping..." , "NodeFeature name " , obj . Name )
1441+ klog .InfoS ("NodeFeature not verified, skipping..." , "nodefeature " , klog . KObj ( obj ) )
14821442 }
14831443 }
14841444 return verifiedObjects , nil
0 commit comments