Skip to content

Commit 368ceb5

Browse files
azdagronazdagron
authored
Merge pull request spiffe#1804 from transferwise/reconciler-fix-dns-dots-and-filter-namespaces
Reconciler fix dns dots and filter namespaces
2 parents f214dec + d6a8b86 commit 368ceb5

12 files changed

+366
-100
lines changed

‎support/k8s/k8s-workload-registrar/README.md

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -20,18 +20,19 @@ The registrar has the following command line flags:
2020
The configuration file is a **required** by the registrar. It contains
2121
[HCL](https://github.com/hashicorp/hcl) encoded configurables.
2222

23-
| Key | Type | Required? | Description | Default |
24-
| -------------------------- | --------| ---------| ----------------------------------------- | ------- |
25-
| `log_level` | string | required | Log level (one of `"panic"`,`"fatal"`,`"error"`,`"warn"`, `"warning"`,`"info"`,`"debug"`,`"trace"`) | `"info"` |
26-
| `log_path` | string | optional | Path on disk to write the log | |
27-
| `trust_domain` | string | required | Trust domain of the SPIRE server | |
28-
| `agent_socket_path` | string | optional | Path to the Unix domain socket of the SPIRE agent. Required if server_address is not a unix domain socket address. | |
29-
| `server_address` | string | required | Address of the spire server. A local socket can be specified using unix:///path/to/socket. This is not the same as the agent socket. | |
30-
| `server_socket_path` | string | optional | Path to the Unix domain socket of the SPIRE server, equivalent to specifying a server_address with a "unix://..." prefix | |
31-
| `cluster` | string | required | Logical cluster to register nodes/workloads under. Must match the SPIRE SERVER PSAT node attestor configuration. | |
32-
| `pod_label` | string | optional | The pod label used for [Label Based Workload Registration](#label-based-workload-registration) | |
33-
| `pod_annotation` | string | optional | The pod annotation used for [Annotation Based Workload Registration](#annotation-based-workload-registration) | |
34-
| `mode` | string | optional | How to run the registrar, either using a `"webhook"`, `"reconcile`" or `"crd"`. See [Differences](#differences-between-modes) for more details. | `"webhook"` |
23+
| Key | Type | Required? | Description | Default |
24+
| -------------------------- | ---------| ---------| ----------------------------------------- | ------- |
25+
| `log_level` | string | required | Log level (one of `"panic"`,`"fatal"`,`"error"`,`"warn"`, `"warning"`,`"info"`,`"debug"`,`"trace"`) | `"info"` |
26+
| `log_path` | string | optional | Path on disk to write the log | |
27+
| `trust_domain` | string | required | Trust domain of the SPIRE server | |
28+
| `agent_socket_path` | string | optional | Path to the Unix domain socket of the SPIRE agent. Required if server_address is not a unix domain socket address. | |
29+
| `server_address` | string | required | Address of the spire server. A local socket can be specified using unix:///path/to/socket. This is not the same as the agent socket. | |
30+
| `server_socket_path` | string | optional | Path to the Unix domain socket of the SPIRE server, equivalent to specifying a server_address with a "unix://..." prefix | |
31+
| `cluster` | string | required | Logical cluster to register nodes/workloads under. Must match the SPIRE SERVER PSAT node attestor configuration. | |
32+
| `pod_label` | string | optional | The pod label used for [Label Based Workload Registration](#label-based-workload-registration) | |
33+
| `pod_annotation` | string | optional | The pod annotation used for [Annotation Based Workload Registration](#annotation-based-workload-registration) | |
34+
| `mode` | string | optional | How to run the registrar, either using a `"webhook"`, `"reconcile`" or `"crd"`. See [Differences](#differences-between-modes) for more details. | `"webhook"` |
35+
| `disabled_namespaces` | []string | optional | Comma seperated list of namespaces to disable auto SVID generation for | `"kube-system", "kube-public"` |
3536

3637
The following configuration directives are specific to `"webhook"` mode:
3738

@@ -48,7 +49,6 @@ The following configuration directives are specific to `"crd"` mode:
4849
| Key | Type | Required? | Description | Default |
4950
| -------------------------- | --------| ---------| ----------------------------------------- | ------- |
5051
| `add_svc_dns_name` | bool | optional | Enable adding service names as SAN DNS names to endpoint pods | `true` |
51-
| `disabled_namespaces` | []string| optional | Comma seperated list of namespaces to disable auto SVID generation for | `"kube-system"` |
5252
| `leader_election` | bool | optional | Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager. | `false` |
5353
| `metrics_bind_addr` | string | optional | The address the metric endpoint binds to. The special value of "0" disables metrics. | `":8080"` |
5454
| `pod_controller` | bool | optional | Enable auto generation of SVIDs for new pods that are created | `true` |
@@ -278,4 +278,4 @@ The supported selectors are:
278278

279279
Note: Specifying DNS Names is optional.
280280

281-
Spire enforces that spiffeId+parentId+selectors are unique. The optional `"crd"` mode webhook
281+
Spire enforces that spiffeId+parentId+selectors are unique. The optional `"crd"` mode webhook

‎support/k8s/k8s-workload-registrar/config.go

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ import (
66
"io/ioutil"
77
"strings"
88

9+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
10+
911
"github.com/spiffe/go-spiffe/v2/logger"
1012
"github.com/spiffe/spire/proto/spire/api/registration"
1113
"github.com/spiffe/spire/proto/spire/api/server/entry/v1"
@@ -35,18 +37,19 @@ type Mode interface {
3537
}
3638

3739
type CommonMode struct {
38-
LogFormat string `hcl:"log_format"`
39-
LogLevel string `hcl:"log_level"`
40-
LogPath string `hcl:"log_path"`
41-
TrustDomain string `hcl:"trust_domain"`
42-
ServerSocketPath string `hcl:"server_socket_path"`
43-
AgentSocketPath string `hcl:"agent_socket_path"`
44-
ServerAddress string `hcl:"server_address"`
45-
Cluster string `hcl:"cluster"`
46-
PodLabel string `hcl:"pod_label"`
47-
PodAnnotation string `hcl:"pod_annotation"`
48-
Mode string `hcl:"mode"`
49-
registrationAPI RegistrationAPIConnections
40+
LogFormat string `hcl:"log_format"`
41+
LogLevel string `hcl:"log_level"`
42+
LogPath string `hcl:"log_path"`
43+
TrustDomain string `hcl:"trust_domain"`
44+
ServerSocketPath string `hcl:"server_socket_path"`
45+
AgentSocketPath string `hcl:"agent_socket_path"`
46+
ServerAddress string `hcl:"server_address"`
47+
Cluster string `hcl:"cluster"`
48+
PodLabel string `hcl:"pod_label"`
49+
PodAnnotation string `hcl:"pod_annotation"`
50+
Mode string `hcl:"mode"`
51+
DisabledNamespaces []string `hcl:"disabled_namespaces"`
52+
registrationAPI RegistrationAPIConnections
5053
}
5154

5255
func (c *CommonMode) ParseConfig(hclConfig string) error {
@@ -80,10 +83,17 @@ func (c *CommonMode) ParseConfig(hclConfig string) error {
8083
if c.Mode != modeCRD && c.Mode != modeWebhook && c.Mode != modeReconcile {
8184
return errs.New("invalid mode \"%s\", valid values are %s, %s and %s", c.Mode, modeCRD, modeWebhook, modeReconcile)
8285
}
86+
if c.DisabledNamespaces == nil {
87+
c.DisabledNamespaces = defaultDisabledNamespaces()
88+
}
8389

8490
return nil
8591
}
8692

93+
func defaultDisabledNamespaces() []string {
94+
return []string{metav1.NamespaceSystem, metav1.NamespacePublic}
95+
}
96+
8797
func (c *CommonMode) SetupLogger() (*log.Logger, error) {
8898
return log.NewLogger(log.WithLevel(c.LogLevel), log.WithFormat(c.LogFormat), log.WithOutputFile(c.LogPath))
8999
}

‎support/k8s/k8s-workload-registrar/config_crd.go

Lines changed: 7 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -23,14 +23,13 @@ const (
2323

2424
type CRDMode struct {
2525
CommonMode
26-
AddSvcDNSName bool `hcl:"add_svc_dns_name"`
27-
DisabledNamespaces []string `hcl:"disabled_namespaces"`
28-
LeaderElection bool `hcl:"leader_election"`
29-
MetricsBindAddr string `hcl:"metrics_bind_addr"`
30-
PodController bool `hcl:"pod_controller"`
31-
WebhookEnabled bool `hcl:"webhook_enabled"`
32-
WebhookCertDir string `hcl:"webhook_cert_dir"`
33-
WebhookPort int `hcl:"webhook_port"`
26+
AddSvcDNSName bool `hcl:"add_svc_dns_name"`
27+
LeaderElection bool `hcl:"leader_election"`
28+
MetricsBindAddr string `hcl:"metrics_bind_addr"`
29+
PodController bool `hcl:"pod_controller"`
30+
WebhookEnabled bool `hcl:"webhook_enabled"`
31+
WebhookCertDir string `hcl:"webhook_cert_dir"`
32+
WebhookPort int `hcl:"webhook_port"`
3433
}
3534

3635
func (c *CRDMode) ParseConfig(hclConfig string) error {
@@ -44,10 +43,6 @@ func (c *CRDMode) ParseConfig(hclConfig string) error {
4443
c.MetricsBindAddr = defaultMetricsBindAddr
4544
}
4645

47-
if c.DisabledNamespaces == nil {
48-
c.DisabledNamespaces = defaultDisabledNamespaces()
49-
}
50-
5146
if c.WebhookCertDir == "" {
5247
c.WebhookCertDir = defaultWebhookCertDir
5348
}
@@ -148,10 +143,6 @@ func (c *CRDMode) Run(ctx context.Context) error {
148143
return mgr.Start(ctrl.SetupSignalHandler())
149144
}
150145

151-
func defaultDisabledNamespaces() []string {
152-
return []string{"kube-system"}
153-
}
154-
155146
func getNamespace() string {
156147
content, err := ioutil.ReadFile(namespaceFile)
157148
if err != nil {

‎support/k8s/k8s-workload-registrar/config_reconcile.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,7 @@ func (c *ReconcileMode) Run(ctx context.Context) error {
123123
value,
124124
c.ClusterDNSZone,
125125
c.AddPodDNSNames,
126+
c.DisabledNamespaces,
126127
).SetupWithManager(mgr); err != nil {
127128
setupLog.Error(err, "Unable to create controller", "controller", "Pod")
128129
return err

‎support/k8s/k8s-workload-registrar/config_test.go

Lines changed: 23 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,13 @@ func TestLoadMode(t *testing.T) {
3636

3737
require.Equal(&WebhookMode{
3838
CommonMode: CommonMode{
39-
ServerSocketPath: "SOCKETPATH",
40-
ServerAddress: "unix://SOCKETPATH",
41-
TrustDomain: "TRUSTDOMAIN",
42-
Cluster: "CLUSTER",
43-
LogLevel: defaultLogLevel,
44-
Mode: "webhook",
39+
ServerSocketPath: "SOCKETPATH",
40+
ServerAddress: "unix://SOCKETPATH",
41+
TrustDomain: "TRUSTDOMAIN",
42+
Cluster: "CLUSTER",
43+
LogLevel: defaultLogLevel,
44+
Mode: "webhook",
45+
DisabledNamespaces: []string{"kube-system", "kube-public"},
4546
},
4647
Addr: ":8443",
4748
CertPath: defaultCertPath,
@@ -60,12 +61,13 @@ func TestLoadMode(t *testing.T) {
6061
in: testMinimalConfig,
6162
out: &WebhookMode{
6263
CommonMode: CommonMode{
63-
LogLevel: defaultLogLevel,
64-
ServerSocketPath: "SOCKETPATH",
65-
ServerAddress: "unix://SOCKETPATH",
66-
TrustDomain: "TRUSTDOMAIN",
67-
Cluster: "CLUSTER",
68-
Mode: "webhook",
64+
LogLevel: defaultLogLevel,
65+
ServerSocketPath: "SOCKETPATH",
66+
ServerAddress: "unix://SOCKETPATH",
67+
TrustDomain: "TRUSTDOMAIN",
68+
Cluster: "CLUSTER",
69+
Mode: "webhook",
70+
DisabledNamespaces: []string{"kube-system", "kube-public"},
6971
},
7072
Addr: ":8443",
7173
CertPath: defaultCertPath,
@@ -91,14 +93,15 @@ func TestLoadMode(t *testing.T) {
9193
`,
9294
out: &WebhookMode{
9395
CommonMode: CommonMode{
94-
LogLevel: "LEVELOVERRIDE",
95-
LogPath: "PATHOVERRIDE",
96-
ServerSocketPath: "SOCKETPATHOVERRIDE",
97-
ServerAddress: "unix://SOCKETPATHOVERRIDE",
98-
TrustDomain: "TRUSTDOMAINOVERRIDE",
99-
Cluster: "CLUSTEROVERRIDE",
100-
PodLabel: "PODLABEL",
101-
Mode: "webhook",
96+
LogLevel: "LEVELOVERRIDE",
97+
LogPath: "PATHOVERRIDE",
98+
ServerSocketPath: "SOCKETPATHOVERRIDE",
99+
ServerAddress: "unix://SOCKETPATHOVERRIDE",
100+
TrustDomain: "TRUSTDOMAINOVERRIDE",
101+
Cluster: "CLUSTEROVERRIDE",
102+
PodLabel: "PODLABEL",
103+
Mode: "webhook",
104+
DisabledNamespaces: []string{"kube-system", "kube-public"},
102105
},
103106
Addr: ":1234",
104107
CertPath: "CERTOVERRIDE",

‎support/k8s/k8s-workload-registrar/config_webhook.go

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -56,13 +56,18 @@ func (c *WebhookMode) Run(ctx context.Context) error {
5656
return errs.New("failed to dial server: %v", err)
5757
}
5858

59+
disabledNamespacesMap := make(map[string]bool, len(c.DisabledNamespaces))
60+
for _, ns := range c.DisabledNamespaces {
61+
disabledNamespacesMap[ns] = true
62+
}
5963
controller := NewController(ControllerConfig{
60-
Log: log,
61-
R: registrationClient,
62-
TrustDomain: c.TrustDomain,
63-
Cluster: c.Cluster,
64-
PodLabel: c.PodLabel,
65-
PodAnnotation: c.PodAnnotation,
64+
Log: log,
65+
R: registrationClient,
66+
TrustDomain: c.TrustDomain,
67+
Cluster: c.Cluster,
68+
PodLabel: c.PodLabel,
69+
PodAnnotation: c.PodAnnotation,
70+
DisabledNamespaces: disabledNamespacesMap,
6671
})
6772

6873
log.Info("Initializing registrar")

‎support/k8s/k8s-workload-registrar/controller.go

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,13 @@ import (
2121
)
2222

2323
type ControllerConfig struct {
24-
Log logrus.FieldLogger
25-
R registration.RegistrationClient
26-
TrustDomain string
27-
Cluster string
28-
PodLabel string
29-
PodAnnotation string
24+
Log logrus.FieldLogger
25+
R registration.RegistrationClient
26+
TrustDomain string
27+
Cluster string
28+
PodLabel string
29+
PodAnnotation string
30+
DisabledNamespaces map[string]bool
3031
}
3132

3233
type Controller struct {
@@ -73,8 +74,7 @@ func (c *Controller) ReviewAdmission(ctx context.Context, req *admv1beta1.Admiss
7374
// non-kubernetes namespaces. Ideally the ValidatingAdmissionWebhook
7475
// configuration has filters in place to restrict the admission requests.
7576
func (c *Controller) reviewAdmission(ctx context.Context, req *admv1beta1.AdmissionRequest) error {
76-
switch req.Namespace {
77-
case metav1.NamespacePublic, metav1.NamespaceSystem:
77+
if _, disabled := c.c.DisabledNamespaces[req.Namespace]; disabled {
7878
return nil
7979
}
8080

‎support/k8s/k8s-workload-registrar/controller_test.go

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -411,12 +411,13 @@ func newTestController(podLabel, podAnnotation string) (*Controller, *fakeRegist
411411
log, _ := test.NewNullLogger()
412412
r := newFakeRegistrationClient()
413413
return NewController(ControllerConfig{
414-
Log: log,
415-
R: r,
416-
TrustDomain: "domain.test",
417-
Cluster: "CLUSTER",
418-
PodLabel: podLabel,
419-
PodAnnotation: podAnnotation,
414+
Log: log,
415+
R: r,
416+
TrustDomain: "domain.test",
417+
Cluster: "CLUSTER",
418+
PodLabel: podLabel,
419+
PodAnnotation: podAnnotation,
420+
DisabledNamespaces: map[string]bool{"kube-system": true, "kube-public": true},
420421
}), r
421422
}
422423

‎support/k8s/k8s-workload-registrar/mode-reconcile/controllers/base_controller.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,8 @@ type ObjectReconciler interface {
5555
selectorsToNamespacedName([]*spiretypes.Selector) *types.NamespacedName
5656
// Fill additional fields on a spire registration entry for a k8s object
5757
fillEntryForObject(context.Context, *spiretypes.Entry, ObjectWithMetadata) (*spiretypes.Entry, error)
58+
// Return true if we should continue to reconcile this request, false to skip
59+
shouldProcess(req ctrl.Request) bool
5860
// Perform any additional manager setup required
5961
SetupWithManager(ctrl.Manager, *ctrlBuilder.Builder) error
6062
}
@@ -82,6 +84,9 @@ type ObjectWithMetadata interface {
8284
}
8385

8486
func (r *BaseReconciler) Reconcile(req ctrl.Request) (ctrl.Result, error) {
87+
if !r.shouldProcess(req) {
88+
return ctrl.Result{}, nil
89+
}
8590
ctx := context.Background()
8691
reqLogger := r.Log.WithValues("request", req.NamespacedName)
8792

‎support/k8s/k8s-workload-registrar/mode-reconcile/controllers/node_controller.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,10 @@ const (
5050

5151
// +kubebuilder:rbac:groups=core,resources=nodes,verbs=get;list;watch
5252

53+
func (r *NodeReconciler) shouldProcess(_ ctrl.Request) bool {
54+
return true
55+
}
56+
5357
func (r *NodeReconciler) makeSpiffeID(obj ObjectWithMetadata) *spiretypes.SPIFFEID {
5458
return &spiretypes.SPIFFEID{
5559
TrustDomain: r.RootID.TrustDomain,

0 commit comments

Comments
 (0)