migrating service webhook to controller p1 (#130)

migrating service webhook to controller p2

migrating service webhook to controller p3. add tests

Using an abstract reconciler to avoid copy/paste code

update tests. remove service_labels webhook. fix bug in sync labels\endpoint func

apply review notes

disable EndpointSlicesLabelsReconciler for kubernetes versions <=1.16

Co-authored-by: Maksim Fedotov <m_fedotov@wargaming.net>

config/webhook/manifests.yaml

@@ -23,29 +23,6 @@ webhooks:
     - CREATE
     resources:
     - namespaces
-- clientConfig:
-    caBundle: Cg==
-    service:
-      name: webhook-service
-      namespace: system
-      path: /mutate-v1-service-labels
-  failurePolicy: Ignore
-  name: service.labels.capsule.clastix.io
-  rules:
-  - apiGroups:
-    - ""
-    - discovery.k8s.io
-    apiVersions:
-    - v1
-    - v1beta1
-    operations:
-    - CREATE
-    - UPDATE
-    resources:
-    - services
-    - endpoints
-    - endpointslices
-
 ---
 apiVersion: admissionregistration.k8s.io/v1beta1
 kind: ValidatingWebhookConfiguration

controllers/service_labels/abstract.go

@@ -0,0 +1,141 @@
+/*
+Copyright 2020 Clastix Labs.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package service_labels
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/go-logr/logr"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/builder"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/event"
+	"sigs.k8s.io/controller-runtime/pkg/predicate"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
+	"github.com/clastix/capsule/api/v1alpha1"
+)
+
+type abstractServiceLabelsReconciler struct {
+	obj    client.Object
+	client client.Client
+	log    logr.Logger
+	scheme *runtime.Scheme
+}
+
+func (r *abstractServiceLabelsReconciler) InjectClient(c client.Client) error {
+	r.client = c
+	return nil
+}
+
+func (r *abstractServiceLabelsReconciler) Reconcile(ctx context.Context, request ctrl.Request) (ctrl.Result, error) {
+	tenant, err := r.getTenant(ctx, request.NamespacedName, r.client)
+	if err != nil {
+		switch err.(type) {
+		case *NonTenantObject, *NoServicesMetadata:
+			return reconcile.Result{}, nil
+		default:
+			r.log.Error(err, fmt.Sprintf("Cannot sync %t labels", r.obj))
+			return reconcile.Result{}, err
+		}
+	}
+
+	err = r.client.Get(ctx, request.NamespacedName, r.obj)
+	if err != nil {
+		return reconcile.Result{}, err
+	}
+
+	_, err = controllerutil.CreateOrUpdate(ctx, r.client, r.obj, func() (err error) {
+		r.obj.SetLabels(r.sync(r.obj.GetLabels(), tenant.Spec.ServicesMetadata.AdditionalLabels))
+		r.obj.SetAnnotations(r.sync(r.obj.GetAnnotations(), tenant.Spec.ServicesMetadata.AdditionalAnnotations))
+		return nil
+	})
+
+	return reconcile.Result{}, err
+}
+
+func (r *abstractServiceLabelsReconciler) getTenant(ctx context.Context, namespacedName types.NamespacedName, client client.Client) (*v1alpha1.Tenant, error) {
+	ns := &corev1.Namespace{}
+	tenant := &v1alpha1.Tenant{}
+
+	if err := client.Get(ctx, types.NamespacedName{Name: namespacedName.Namespace}, ns); err != nil {
+		return nil, err
+	}
+
+	capsuleLabel, _ := v1alpha1.GetTypeLabel(&v1alpha1.Tenant{})
+	if _, ok := ns.GetLabels()[capsuleLabel]; !ok {
+		return nil, NewNonTenantObject(namespacedName.Name)
+	}
+
+	if err := client.Get(ctx, types.NamespacedName{Name: ns.Labels[capsuleLabel]}, tenant); err != nil {
+		return nil, err
+	}
+
+	if tenant.Spec.ServicesMetadata.AdditionalLabels == nil && tenant.Spec.ServicesMetadata.AdditionalAnnotations == nil {
+		return nil, NewNoServicesMetadata(namespacedName.Name)
+	}
+
+	return tenant, nil
+}
+
+func (r *abstractServiceLabelsReconciler) sync(available map[string]string, tenantSpec map[string]string) map[string]string {
+	if tenantSpec != nil {
+		if available == nil {
+			available = tenantSpec
+		} else {
+			for key, value := range tenantSpec {
+				if available[key] != value {
+					available[key] = value
+				}
+			}
+		}
+	}
+	return available
+}
+
+func (r *abstractServiceLabelsReconciler) forOptionPerInstanceName() builder.ForOption {
+	return builder.WithPredicates(predicate.Funcs{
+		CreateFunc: func(event event.CreateEvent) bool {
+			return r.IsNamespaceInTenant(event.Object.GetNamespace())
+		},
+		DeleteFunc: func(deleteEvent event.DeleteEvent) bool {
+			return r.IsNamespaceInTenant(deleteEvent.Object.GetNamespace())
+		},
+		UpdateFunc: func(updateEvent event.UpdateEvent) bool {
+			return r.IsNamespaceInTenant(updateEvent.ObjectNew.GetNamespace())
+		},
+		GenericFunc: func(genericEvent event.GenericEvent) bool {
+			return r.IsNamespaceInTenant(genericEvent.Object.GetNamespace())
+		},
+	})
+}
+
+func (r *abstractServiceLabelsReconciler) IsNamespaceInTenant(namespace string) bool {
+	tl := &v1alpha1.TenantList{}
+	if err := r.client.List(context.Background(), tl, client.MatchingFieldsSelector{
+		Selector: fields.OneTermEqualSelector(".status.namespaces", namespace),
+	}); err != nil {
+		return false
+	}
+	return len(tl.Items) > 0
+}

controllers/service_labels/endpoint.go

@@ -0,0 +1,41 @@
+/*
+Copyright 2020 Clastix Labs.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package service_labels
+
+import (
+	"github.com/go-logr/logr"
+	corev1 "k8s.io/api/core/v1"
+	ctrl "sigs.k8s.io/controller-runtime"
+)
+
+type EndpointsLabelsReconciler struct {
+	abstractServiceLabelsReconciler
+
+	Log logr.Logger
+}
+
+func (r *EndpointsLabelsReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	r.abstractServiceLabelsReconciler = abstractServiceLabelsReconciler{
+		obj:    &corev1.Endpoints{},
+		scheme: mgr.GetScheme(),
+		log:    r.Log,
+	}
+
+	return ctrl.NewControllerManagedBy(mgr).
+		For(r.abstractServiceLabelsReconciler.obj, r.abstractServiceLabelsReconciler.forOptionPerInstanceName()).
+		Complete(r)
+}

controllers/service_labels/endpoint_slices.go

@@ -0,0 +1,49 @@
+/*
+Copyright 2020 Clastix Labs.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package service_labels
+
+import (
+	"github.com/go-logr/logr"
+	discoveryv1beta1 "k8s.io/api/discovery/v1beta1"
+	ctrl "sigs.k8s.io/controller-runtime"
+)
+
+type EndpointSlicesLabelsReconciler struct {
+	abstractServiceLabelsReconciler
+
+	Log          logr.Logger
+	VersionMinor int
+	VersionMajor int
+}
+
+func (r *EndpointSlicesLabelsReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	r.scheme = mgr.GetScheme()
+	r.abstractServiceLabelsReconciler = abstractServiceLabelsReconciler{
+		scheme: mgr.GetScheme(),
+		log:    r.Log,
+	}
+
+	if r.VersionMajor == 1 && r.VersionMinor <= 16 {
+		r.Log.Info("Skipping controller setup, as EndpointSlices are not supported on current kubernetes version", "VersionMajor", r.VersionMajor, "VersionMinor", r.VersionMinor)
+		return nil
+	}
+
+	r.abstractServiceLabelsReconciler.obj = &discoveryv1beta1.EndpointSlice{}
+	return ctrl.NewControllerManagedBy(mgr).
+		For(r.obj, r.abstractServiceLabelsReconciler.forOptionPerInstanceName()).
+		Complete(r)
+}

controllers/service_labels/errors.go

@@ -0,0 +1,43 @@
+/*
+Copyright 2020 Clastix Labs.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package service_labels
+
+import "fmt"
+
+type NonTenantObject struct {
+	objectName string
+}
+
+func NewNonTenantObject(objectName string) error {
+	return &NonTenantObject{objectName: objectName}
+}
+
+func (n NonTenantObject) Error() string {
+	return fmt.Sprintf("Skipping labels sync for %s as it doesn't belong to tenant", n.objectName)
+}
+
+type NoServicesMetadata struct {
+	objectName string
+}
+
+func NewNoServicesMetadata(objectName string) error {
+	return &NoServicesMetadata{objectName: objectName}
+}
+
+func (n NoServicesMetadata) Error() string {
+	return fmt.Sprintf("Skipping labels sync for %s because no AdditionalLabels or AdditionalAnnotations presents in Tenant spec", n.objectName)
+}

controllers/service_labels/service.go

@@ -0,0 +1,40 @@
+/*
+Copyright 2020 Clastix Labs.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package service_labels
+
+import (
+	"github.com/go-logr/logr"
+	corev1 "k8s.io/api/core/v1"
+	ctrl "sigs.k8s.io/controller-runtime"
+)
+
+type ServicesLabelsReconciler struct {
+	abstractServiceLabelsReconciler
+
+	Log logr.Logger
+}
+
+func (r *ServicesLabelsReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	r.abstractServiceLabelsReconciler = abstractServiceLabelsReconciler{
+		obj:    &corev1.Service{},
+		scheme: mgr.GetScheme(),
+		log:    r.Log,
+	}
+	return ctrl.NewControllerManagedBy(mgr).
+		For(r.abstractServiceLabelsReconciler.obj, r.abstractServiceLabelsReconciler.forOptionPerInstanceName()).
+		Complete(r)
+}

e2e/service_metadata_test.go

@@ -76,12 +76,8 @@ var _ = Describe("creating a Service/Endpoint/EndpointSlice for a Tenant with ad
 		},
 	}
 	JustBeforeEach(func() {
-		EventuallyCreation(func() error {
-			return k8sClient.Create(context.TODO(), tnt)
-		}).Should(Succeed())
-		EventuallyCreation(func() error {
-			return k8sClient.Create(context.TODO(), epsCR)
-		}).Should(Succeed())
+		Expect(k8sClient.Create(context.TODO(), tnt)).Should(Succeed())
+		Expect(k8sClient.Create(context.TODO(), epsCR)).Should(Succeed())
 	})
 	JustAfterEach(func() {
 		Expect(k8sClient.Delete(context.TODO(), tnt)).Should(Succeed())
@@ -98,6 +94,9 @@ var _ = Describe("creating a Service/Endpoint/EndpointSlice for a Tenant with ad
 			Labels: map[string]string{
 				"k8s.io/custom-label": "wrong",
 			},
+			Annotations: map[string]string{
+				"clastix.io/annotation": "baz",
+			},
 		}
 
 		svc := &corev1.Service{
@@ -146,24 +145,46 @@ var _ = Describe("creating a Service/Endpoint/EndpointSlice for a Tenant with ad
 			_, err = cs.CoreV1().Endpoints(ns.GetName()).Create(context.TODO(), ep, metav1.CreateOptions{})
 			return
 		}, defaultTimeoutInterval, defaultPollInterval).Should(Succeed())
-		Expect(k8sClient.Get(context.TODO(), types.NamespacedName{Name: svc.GetName(), Namespace: ns.GetName()}, svc)).Should(Succeed())
-		Expect(k8sClient.Get(context.TODO(), types.NamespacedName{Name: ep.GetName(), Namespace: ns.GetName()}, ep)).Should(Succeed())
 
+		By("checking number of labels on service", func() {
+			Eventually(func() (labelsCnt int) {
+				k8sClient.Get(context.TODO(), types.NamespacedName{Name: svc.GetName(), Namespace: ns.GetName()}, svc)
+				return len(svc.GetLabels())
+			}, defaultTimeoutInterval, defaultPollInterval).Should(Equal(2))
+		})
 		By("checking additional labels on service", func() {
 			for _, l := range tnt.Spec.ServicesMetadata.AdditionalLabels {
 				Expect(svc.Labels).Should(ContainElement(l))
 			}
 		})
+		By("checking number of annotations on service", func() {
+			Eventually(func() (labelsCnt int) {
+				k8sClient.Get(context.TODO(), types.NamespacedName{Name: svc.GetName(), Namespace: ns.GetName()}, svc)
+				return len(svc.GetAnnotations())
+			}, defaultTimeoutInterval, defaultPollInterval).Should(Equal(3))
+		})
 		By("checking additional annotations service", func() {
 			for _, a := range tnt.Spec.NamespacesMetadata.AdditionalAnnotations {
 				Expect(svc.Annotations).Should(ContainElement(a))
 			}
 		})
+		By("checking number of labels on endpoint", func() {
+			Eventually(func() (labelsCnt int) {
+				k8sClient.Get(context.TODO(), types.NamespacedName{Name: ep.GetName(), Namespace: ns.GetName()}, ep)
+				return len(ep.GetLabels())
+			}, defaultTimeoutInterval, defaultPollInterval).Should(Equal(2))
+		})
 		By("checking additional labels on endpoint", func() {
 			for _, l := range tnt.Spec.ServicesMetadata.AdditionalLabels {
 				Expect(ep.Labels).Should(ContainElement(l))
 			}
 		})
+		By("checking number of annotations on endpoint", func() {
+			Eventually(func() (labelsCnt int) {
+				k8sClient.Get(context.TODO(), types.NamespacedName{Name: ep.GetName(), Namespace: ns.GetName()}, ep)
+				return len(ep.GetAnnotations())
+			}, defaultTimeoutInterval, defaultPollInterval).Should(Equal(3))
+		})
 		By("checking additional annotations endpoint", func() {
 			for _, a := range tnt.Spec.NamespacesMetadata.AdditionalAnnotations {
 				Expect(ep.Annotations).Should(ContainElement(a))
@@ -195,12 +216,23 @@ var _ = Describe("creating a Service/Endpoint/EndpointSlice for a Tenant with ad
 				_, err = cs.DiscoveryV1beta1().EndpointSlices(ns.GetName()).Create(context.TODO(), eps.(*discoveryv1beta1.EndpointSlice), metav1.CreateOptions{})
 				return
 			}, defaultTimeoutInterval, defaultPollInterval).Should(Succeed())
-			Expect(k8sClient.Get(context.TODO(), types.NamespacedName{Name: eps.GetName(), Namespace: ns.GetName()}, eps)).Should(Succeed())
+			By("checking number of labels on endpointslice", func() {
+				Eventually(func() (labelsCnt int) {
+					k8sClient.Get(context.TODO(), types.NamespacedName{Name: eps.GetName(), Namespace: ns.GetName()}, eps)
+					return len(eps.GetLabels())
+				}, defaultTimeoutInterval, defaultPollInterval).Should(Equal(2))
+			})
 			By("checking additional annotations endpointslices", func() {
 				for _, a := range tnt.Spec.NamespacesMetadata.AdditionalAnnotations {
 					Expect(eps.GetAnnotations()).Should(ContainElement(a))
 				}
 			})
+			By("checking number of annotations on endpointslice", func() {
+				Eventually(func() (labelsCnt int) {
+					k8sClient.Get(context.TODO(), types.NamespacedName{Name: eps.GetName(), Namespace: ns.GetName()}, eps)
+					return len(eps.GetAnnotations())
+				}, defaultTimeoutInterval, defaultPollInterval).Should(Equal(3))
+			})
 			By("checking additional labels on endpointslices", func() {
 				for _, l := range tnt.Spec.ServicesMetadata.AdditionalLabels {
 					Expect(eps.GetLabels()).Should(ContainElement(l))

main.go

@@ -36,6 +36,7 @@ import (
 	"github.com/clastix/capsule/controllers"
 	"github.com/clastix/capsule/controllers/rbac"
 	"github.com/clastix/capsule/controllers/secret"
+	"github.com/clastix/capsule/controllers/service_labels"
 	"github.com/clastix/capsule/pkg/indexer"
 	"github.com/clastix/capsule/pkg/webhook"
 	"github.com/clastix/capsule/pkg/webhook/ingress"
@@ -43,7 +44,6 @@ import (
 	"github.com/clastix/capsule/pkg/webhook/network_policies"
 	"github.com/clastix/capsule/pkg/webhook/owner_reference"
 	"github.com/clastix/capsule/pkg/webhook/pvc"
-	"github.com/clastix/capsule/pkg/webhook/service_labels"
 	"github.com/clastix/capsule/pkg/webhook/tenant"
 	"github.com/clastix/capsule/pkg/webhook/tenant_prefix"
 	"github.com/clastix/capsule/pkg/webhook/utils"
@@ -126,6 +126,12 @@ func main() {
 		}
 	}
 
+	majorVer, minorVer, _, err := utils.GetK8sVersion()
+	if err != nil {
+		setupLog.Error(err, "unable to get kubernetes version")
+		os.Exit(1)
+	}
+
 	_ = mgr.AddReadyzCheck("ping", healthz.Ping)
 	_ = mgr.AddHealthzCheck("ping", healthz.Ping)
 
@@ -149,7 +155,6 @@ func main() {
 		owner_reference.Webhook(utils.InCapsuleGroup(capsuleGroup, owner_reference.Handler(forceTenantPrefix))),
 		namespace_quota.Webhook(utils.InCapsuleGroup(capsuleGroup, namespace_quota.Handler())),
 		network_policies.Webhook(utils.InCapsuleGroup(capsuleGroup, network_policies.Handler())),
-		service_labels.Webhook(utils.InCapsuleGroup(capsuleGroup, service_labels.Handler())),
 		tenant_prefix.Webhook(utils.InCapsuleGroup(capsuleGroup, tenant_prefix.Handler(forceTenantPrefix, protectedNamespaceRegexp))),
 		tenant.Webhook(tenant.Handler()),
 	)
@@ -190,6 +195,26 @@ func main() {
 		os.Exit(1)
 	}
 
+	if err = (&service_labels.ServicesLabelsReconciler{
+		Log: ctrl.Log.WithName("controllers").WithName("ServiceLabels"),
+	}).SetupWithManager(mgr); err != nil {
+		setupLog.Error(err, "unable to create controller", "controller", "ServiceLabels")
+		os.Exit(1)
+	}
+	if err = (&service_labels.EndpointsLabelsReconciler{
+		Log: ctrl.Log.WithName("controllers").WithName("EndpointLabels"),
+	}).SetupWithManager(mgr); err != nil {
+		setupLog.Error(err, "unable to create controller", "controller", "EndpointLabels")
+		os.Exit(1)
+	}
+	if err = (&service_labels.EndpointSlicesLabelsReconciler{
+		Log:          ctrl.Log.WithName("controllers").WithName("EndpointSliceLabels"),
+		VersionMinor: minorVer,
+		VersionMajor: majorVer,
+	}).SetupWithManager(mgr); err != nil {
+		setupLog.Error(err, "unable to create controller", "controller", "EndpointSliceLabels")
+	}
+
 	if err = indexer.AddToManager(mgr); err != nil {
 		setupLog.Error(err, "unable to setup indexers")
 		os.Exit(1)

pkg/webhook/service_labels/patching.go

@@ -1,202 +0,0 @@
-/*
-Copyright 2020 Clastix Labs.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package service_labels
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"strings"
-
-	"gomodules.xyz/jsonpatch/v2"
-	corev1 "k8s.io/api/core/v1"
-	discoveryv1alpha1 "k8s.io/api/discovery/v1alpha1"
-	discoveryv1beta1 "k8s.io/api/discovery/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/types"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
-
-	"github.com/clastix/capsule/api/v1alpha1"
-	capsulewebhook "github.com/clastix/capsule/pkg/webhook"
-)
-
-// +kubebuilder:webhook:path=/mutate-v1-service-labels,mutating=true,failurePolicy=ignore,groups="";discovery.k8s.io,resources=services;endpoints;endpointslices,verbs=create;update,versions=v1;v1beta1,name=service.labels.capsule.clastix.io
-
-type webhook struct {
-	handler capsulewebhook.Handler
-}
-
-func Webhook(handler capsulewebhook.Handler) capsulewebhook.Webhook {
-	return &webhook{handler: handler}
-}
-
-func (w *webhook) GetHandler() capsulewebhook.Handler {
-	return w.handler
-}
-
-func (w *webhook) GetName() string {
-	return "ServiceLabels"
-}
-
-func (w *webhook) GetPath() string {
-	return "/mutate-v1-service-labels"
-}
-
-type handler struct {
-}
-
-func Handler() capsulewebhook.Handler {
-	return &handler{}
-}
-
-func (h *handler) OnCreate(client client.Client, decoder *admission.Decoder) capsulewebhook.Func {
-	return func(ctx context.Context, req admission.Request) admission.Response {
-		svc, err := h.svcFromRequest(req, decoder)
-		if err != nil {
-			return admission.Errored(http.StatusBadRequest, err)
-		}
-		return h.syncLabels(ctx, client, svc)
-	}
-}
-
-func (h *handler) OnUpdate(client client.Client, decoder *admission.Decoder) capsulewebhook.Func {
-	return func(ctx context.Context, req admission.Request) admission.Response {
-		svc, err := h.svcFromRequest(req, decoder)
-		if err != nil {
-			return admission.Errored(http.StatusBadRequest, err)
-		}
-		return h.syncLabels(ctx, client, svc)
-	}
-}
-
-func (h *handler) OnDelete(client client.Client, decoder *admission.Decoder) capsulewebhook.Func {
-	return func(ctx context.Context, req admission.Request) admission.Response {
-		return admission.Allowed("")
-	}
-}
-
-func (h *handler) svcFromRequest(req admission.Request, decoder *admission.Decoder) (svc ServiceType, err error) {
-	switch req.Kind.Kind {
-	case "Service":
-		service := &corev1.Service{}
-		if err := decoder.Decode(req, service); err != nil {
-			return nil, err
-		}
-		svc = Service{service}
-	case "Endpoints":
-		ep := &corev1.Endpoints{}
-		if err := decoder.Decode(req, ep); err != nil {
-			return nil, err
-		}
-		svc = Endpoints{ep}
-	case "EndpointSlice":
-		var eps runtime.Object
-		if v := req.Kind.Version; v == "v1beta1" {
-			eps = &discoveryv1beta1.EndpointSlice{}
-			if err := decoder.Decode(req, eps); err != nil {
-				return nil, err
-			}
-
-		} else if v == "v1alpha1" {
-			eps = &discoveryv1alpha1.EndpointSlice{}
-			if err := decoder.Decode(req, eps); err != nil {
-				return nil, err
-			}
-		} else {
-			return nil, fmt.Errorf("unsupported EndpointSlice version: %s", v)
-		}
-		svc = EndpointSlice{eps.(metav1.Object)}
-	default:
-		err = fmt.Errorf("cannot recognize type %s", req.Kind.Kind)
-	}
-	return
-}
-
-func (h *handler) syncLabels(ctx context.Context, client client.Client, object ServiceType) admission.Response {
-	var patch []jsonpatch.JsonPatchOperation
-
-	ns := &corev1.Namespace{}
-	tenant := &v1alpha1.Tenant{}
-	if err := client.Get(ctx, types.NamespacedName{Name: object.Namespace()}, ns); err != nil {
-		return admission.Errored(http.StatusBadRequest, err)
-	}
-	capsuleLabel, err := v1alpha1.GetTypeLabel(tenant)
-	if err != nil {
-		return admission.Errored(http.StatusBadRequest, err)
-	}
-	// not a tenant NS
-	if _, ok := ns.Labels[capsuleLabel]; !ok {
-		return admission.Allowed("")
-	}
-	if err := client.Get(ctx, types.NamespacedName{Name: ns.Labels[capsuleLabel]}, tenant); err != nil {
-		return admission.Errored(http.StatusBadRequest, err)
-	}
-
-	if tenant.Spec.ServicesMetadata.AdditionalLabels == nil && tenant.Spec.ServicesMetadata.AdditionalAnnotations == nil {
-		return admission.Allowed("")
-	}
-
-	availableLables := object.Labels()
-	availableLAnnotations := object.Annotations()
-
-	if al := tenant.Spec.ServicesMetadata.AdditionalLabels; al != nil {
-		if availableLables == nil {
-			patch = append(patch, jsonpatch.JsonPatchOperation{
-				Operation: "add",
-				Path:      "/metadata/labels",
-				Value:     al,
-			})
-		} else {
-			for key, value := range al {
-				if availableLables[key] != value {
-					patch = append(patch, jsonpatch.JsonPatchOperation{
-						Operation: "replace",
-						Path:      "/metadata/labels/" + strings.ReplaceAll(key, "/", "~1"), // http://jsonpatch.com/#json-pointer
-						Value:     value,
-					})
-				}
-			}
-		}
-	}
-
-	if aa := tenant.Spec.ServicesMetadata.AdditionalAnnotations; aa != nil {
-		if availableLAnnotations == nil {
-			patch = append(patch, jsonpatch.JsonPatchOperation{
-				Operation: "add",
-				Path:      "/metadata/annotations",
-				Value:     aa,
-			})
-		} else {
-			for key, value := range aa {
-				if availableLAnnotations[key] != value {
-					patch = append(patch, jsonpatch.JsonPatchOperation{
-						Operation: "replace",
-						Path:      "/metadata/annotations/" + strings.ReplaceAll(key, "/", "~1"), // http://jsonpatch.com/#json-pointer
-						Value:     value,
-					})
-				}
-			}
-		}
-	}
-
-	if len(patch) > 0 {
-		return admission.Patched("Updating labels and annotations", patch...)
-	}
-	return admission.Allowed("")
-}

pkg/webhook/service_labels/types.go

@@ -1,81 +0,0 @@
-/*
-Copyright 2020 Clastix Labs.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package service_labels
-
-import (
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-type ServiceType interface {
-	Namespace() string
-	Labels() map[string]string
-	Annotations() map[string]string
-}
-
-type Service struct {
-	*corev1.Service
-}
-
-func (s Service) Namespace() string {
-	return s.GetNamespace()
-}
-
-func (s Service) Labels() map[string]string {
-	return s.GetLabels()
-}
-
-func (s Service) Annotations() map[string]string {
-	return s.GetAnnotations()
-}
-
-type Endpoints struct {
-	*corev1.Endpoints
-}
-
-func (ep Endpoints) Namespace() (namespace string) {
-	namespace = ep.GetNamespace()
-	// For ep, which are created automatically using service selector namespace will always be empty, so we had to take it from TargetRef
-	if len(namespace) == 0 {
-		namespace = ep.Subsets[0].Addresses[0].TargetRef.Namespace
-	}
-	return
-}
-
-func (ep Endpoints) Labels() map[string]string {
-	return ep.GetLabels()
-}
-
-func (ep Endpoints) Annotations() map[string]string {
-	return ep.GetAnnotations()
-}
-
-type EndpointSlice struct {
-	metav1.Object
-}
-
-func (eps EndpointSlice) Namespace() string {
-	return eps.GetNamespace()
-}
-
-func (eps EndpointSlice) Labels() map[string]string {
-	return eps.GetLabels()
-}
-
-func (eps EndpointSlice) Annotations() map[string]string {
-	return eps.GetAnnotations()
-}

pkg/webhook/utils/kubernetes_version.go

@@ -0,0 +1,35 @@
+package utils
+
+import (
+	"path/filepath"
+	"strconv"
+
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+	"k8s.io/client-go/util/homedir"
+)
+
+func GetK8sVersion() (major, minor int, ver string, err error) {
+	cfg, err := rest.InClusterConfig()
+	if err != nil {
+		kubeconfig := filepath.Join(homedir.HomeDir(), ".kube", "config")
+		cfg, err = clientcmd.BuildConfigFromFlags("", kubeconfig)
+	}
+	if err != nil {
+		return 0, 0, "", err
+	}
+	client, err := kubernetes.NewForConfig(cfg)
+	if err != nil {
+		return 0, 0, "", err
+	}
+
+	v, err := client.Discovery().ServerVersion()
+	if err != nil {
+		return 0, 0, "", err
+	}
+	major, _ = strconv.Atoi(v.Major)
+	minor, _ = strconv.Atoi(v.Minor)
+	ver = v.String()
+	return
+}