|
| 1 | +package servicecacertpublisher |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "fmt" |
| 6 | + "reflect" |
| 7 | + "time" |
| 8 | + |
| 9 | + v1 "k8s.io/api/core/v1" |
| 10 | + apierrors "k8s.io/apimachinery/pkg/api/errors" |
| 11 | + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| 12 | + utilruntime "k8s.io/apimachinery/pkg/util/runtime" |
| 13 | + "k8s.io/apimachinery/pkg/util/wait" |
| 14 | + coreinformers "k8s.io/client-go/informers/core/v1" |
| 15 | + clientset "k8s.io/client-go/kubernetes" |
| 16 | + corelisters "k8s.io/client-go/listers/core/v1" |
| 17 | + "k8s.io/client-go/tools/cache" |
| 18 | + "k8s.io/client-go/util/workqueue" |
| 19 | + "k8s.io/component-base/metrics/prometheus/ratelimiter" |
| 20 | + "k8s.io/klog/v2" |
| 21 | +) |
| 22 | + |
| 23 | +// ServiceCACertConfigMapName is name of the configmap which stores certificates |
| 24 | +// to validate service serving certificates issued by the service ca operator. |
| 25 | +const ServiceCACertConfigMapName = "openshift-service-ca.crt" |
| 26 | + |
| 27 | +func init() { |
| 28 | + registerMetrics() |
| 29 | +} |
| 30 | + |
| 31 | +// NewPublisher construct a new controller which would manage the configmap |
| 32 | +// which stores certificates in each namespace. It will make sure certificate |
| 33 | +// configmap exists in each namespace. |
| 34 | +func NewPublisher(cmInformer coreinformers.ConfigMapInformer, nsInformer coreinformers.NamespaceInformer, cl clientset.Interface) (*Publisher, error) { |
| 35 | + e := &Publisher{ |
| 36 | + client: cl, |
| 37 | + queue: workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "service_ca_cert_publisher"), |
| 38 | + } |
| 39 | + if cl.CoreV1().RESTClient().GetRateLimiter() != nil { |
| 40 | + if err := ratelimiter.RegisterMetricAndTrackRateLimiterUsage("service_ca_cert_publisher", cl.CoreV1().RESTClient().GetRateLimiter()); err != nil { |
| 41 | + return nil, err |
| 42 | + } |
| 43 | + } |
| 44 | + |
| 45 | + cmInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{ |
| 46 | + DeleteFunc: e.configMapDeleted, |
| 47 | + UpdateFunc: e.configMapUpdated, |
| 48 | + }) |
| 49 | + e.cmLister = cmInformer.Lister() |
| 50 | + e.cmListerSynced = cmInformer.Informer().HasSynced |
| 51 | + |
| 52 | + nsInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{ |
| 53 | + AddFunc: e.namespaceAdded, |
| 54 | + UpdateFunc: e.namespaceUpdated, |
| 55 | + }) |
| 56 | + e.nsListerSynced = nsInformer.Informer().HasSynced |
| 57 | + |
| 58 | + e.syncHandler = e.syncNamespace |
| 59 | + |
| 60 | + return e, nil |
| 61 | +} |
| 62 | + |
| 63 | +// Publisher manages certificate ConfigMap objects inside Namespaces |
| 64 | +type Publisher struct { |
| 65 | + client clientset.Interface |
| 66 | + |
| 67 | + // To allow injection for testing. |
| 68 | + syncHandler func(key string) error |
| 69 | + |
| 70 | + cmLister corelisters.ConfigMapLister |
| 71 | + cmListerSynced cache.InformerSynced |
| 72 | + |
| 73 | + nsListerSynced cache.InformerSynced |
| 74 | + |
| 75 | + queue workqueue.RateLimitingInterface |
| 76 | +} |
| 77 | + |
| 78 | +// Run starts process |
| 79 | +func (c *Publisher) Run(workers int, stopCh <-chan struct{}) { |
| 80 | + defer utilruntime.HandleCrash() |
| 81 | + defer c.queue.ShutDown() |
| 82 | + |
| 83 | + klog.Infof("Starting service CA certificate configmap publisher") |
| 84 | + defer klog.Infof("Shutting down service CA certificate configmap publisher") |
| 85 | + |
| 86 | + if !cache.WaitForNamedCacheSync("crt configmap", stopCh, c.cmListerSynced) { |
| 87 | + return |
| 88 | + } |
| 89 | + |
| 90 | + for i := 0; i < workers; i++ { |
| 91 | + go wait.Until(c.runWorker, time.Second, stopCh) |
| 92 | + } |
| 93 | + |
| 94 | + <-stopCh |
| 95 | +} |
| 96 | + |
| 97 | +func (c *Publisher) configMapDeleted(obj interface{}) { |
| 98 | + cm, err := convertToCM(obj) |
| 99 | + if err != nil { |
| 100 | + utilruntime.HandleError(err) |
| 101 | + return |
| 102 | + } |
| 103 | + if cm.Name != ServiceCACertConfigMapName { |
| 104 | + return |
| 105 | + } |
| 106 | + c.queue.Add(cm.Namespace) |
| 107 | +} |
| 108 | + |
| 109 | +func (c *Publisher) configMapUpdated(_, newObj interface{}) { |
| 110 | + cm, err := convertToCM(newObj) |
| 111 | + if err != nil { |
| 112 | + utilruntime.HandleError(err) |
| 113 | + return |
| 114 | + } |
| 115 | + if cm.Name != ServiceCACertConfigMapName { |
| 116 | + return |
| 117 | + } |
| 118 | + c.queue.Add(cm.Namespace) |
| 119 | +} |
| 120 | + |
| 121 | +func (c *Publisher) namespaceAdded(obj interface{}) { |
| 122 | + namespace := obj.(*v1.Namespace) |
| 123 | + c.queue.Add(namespace.Name) |
| 124 | +} |
| 125 | + |
| 126 | +func (c *Publisher) namespaceUpdated(oldObj interface{}, newObj interface{}) { |
| 127 | + newNamespace := newObj.(*v1.Namespace) |
| 128 | + if newNamespace.Status.Phase != v1.NamespaceActive { |
| 129 | + return |
| 130 | + } |
| 131 | + c.queue.Add(newNamespace.Name) |
| 132 | +} |
| 133 | + |
| 134 | +func (c *Publisher) runWorker() { |
| 135 | + for c.processNextWorkItem() { |
| 136 | + } |
| 137 | +} |
| 138 | + |
| 139 | +// processNextWorkItem deals with one key off the queue. It returns false when |
| 140 | +// it's time to quit. |
| 141 | +func (c *Publisher) processNextWorkItem() bool { |
| 142 | + key, quit := c.queue.Get() |
| 143 | + if quit { |
| 144 | + return false |
| 145 | + } |
| 146 | + defer c.queue.Done(key) |
| 147 | + |
| 148 | + if err := c.syncHandler(key.(string)); err != nil { |
| 149 | + utilruntime.HandleError(fmt.Errorf("syncing %q failed: %v", key, err)) |
| 150 | + c.queue.AddRateLimited(key) |
| 151 | + return true |
| 152 | + } |
| 153 | + |
| 154 | + c.queue.Forget(key) |
| 155 | + return true |
| 156 | +} |
| 157 | + |
| 158 | +func (c *Publisher) syncNamespace(ns string) (err error) { |
| 159 | + startTime := time.Now() |
| 160 | + defer func() { |
| 161 | + recordMetrics(startTime, ns, err) |
| 162 | + klog.V(4).Infof("Finished syncing namespace %q (%v)", ns, time.Since(startTime)) |
| 163 | + }() |
| 164 | + |
| 165 | + annotations := map[string]string{ |
| 166 | + // This annotation prompts the service ca operator to inject |
| 167 | + // the service ca bundle into the configmap. |
| 168 | + "service.beta.openshift.io/inject-cabundle": "true", |
| 169 | + } |
| 170 | + |
| 171 | + cm, err := c.cmLister.ConfigMaps(ns).Get(ServiceCACertConfigMapName) |
| 172 | + switch { |
| 173 | + case apierrors.IsNotFound(err): |
| 174 | + _, err = c.client.CoreV1().ConfigMaps(ns).Create(context.TODO(), &v1.ConfigMap{ |
| 175 | + ObjectMeta: metav1.ObjectMeta{ |
| 176 | + Name: ServiceCACertConfigMapName, |
| 177 | + Annotations: annotations, |
| 178 | + }, |
| 179 | + // Create new configmaps with the field referenced by the default |
| 180 | + // projected volume. This ensures that pods - including the pod for |
| 181 | + // service ca operator - will be able to start during initial |
| 182 | + // deployment before the service ca operator has responded to the |
| 183 | + // injection annotation. |
| 184 | + Data: map[string]string{ |
| 185 | + "service-ca.crt": "", |
| 186 | + }, |
| 187 | + }, metav1.CreateOptions{}) |
| 188 | + // don't retry a create if the namespace doesn't exist or is terminating |
| 189 | + if apierrors.IsNotFound(err) || apierrors.HasStatusCause(err, v1.NamespaceTerminatingCause) { |
| 190 | + return nil |
| 191 | + } |
| 192 | + return err |
| 193 | + case err != nil: |
| 194 | + return err |
| 195 | + } |
| 196 | + |
| 197 | + if reflect.DeepEqual(cm.Annotations, annotations) { |
| 198 | + return nil |
| 199 | + } |
| 200 | + |
| 201 | + // copy so we don't modify the cache's instance of the configmap |
| 202 | + cm = cm.DeepCopy() |
| 203 | + cm.Annotations = annotations |
| 204 | + |
| 205 | + _, err = c.client.CoreV1().ConfigMaps(ns).Update(context.TODO(), cm, metav1.UpdateOptions{}) |
| 206 | + return err |
| 207 | +} |
| 208 | + |
| 209 | +func convertToCM(obj interface{}) (*v1.ConfigMap, error) { |
| 210 | + cm, ok := obj.(*v1.ConfigMap) |
| 211 | + if !ok { |
| 212 | + tombstone, ok := obj.(cache.DeletedFinalStateUnknown) |
| 213 | + if !ok { |
| 214 | + return nil, fmt.Errorf("couldn't get object from tombstone %#v", obj) |
| 215 | + } |
| 216 | + cm, ok = tombstone.Obj.(*v1.ConfigMap) |
| 217 | + if !ok { |
| 218 | + return nil, fmt.Errorf("tombstone contained object that is not a ConfigMap %#v", obj) |
| 219 | + } |
| 220 | + } |
| 221 | + return cm, nil |
| 222 | +} |
0 commit comments