diff --git a/controllers/resources/processor.go b/controllers/resources/processor.go index b9fd2870..37388c49 100644 --- a/controllers/resources/processor.go +++ b/controllers/resources/processor.go @@ -26,6 +26,7 @@ import ( ) const ( + Label = "capsule.clastix.io/resources" finalizer = "capsule.clastix.io/resources" ) @@ -121,7 +122,7 @@ func (r *Processor) HandleSection(ctx context.Context, tnt capsulev1beta2.Tenant objAnnotations[tenantLabel] = tnt.GetName() - objLabels["capsule.clastix.io/resources"] = fmt.Sprintf("%d", resourceIndex) + objLabels[Label] = fmt.Sprintf("%d", resourceIndex) objLabels[tenantLabel] = tnt.GetName() // processed will contain the sets of resources replicated, both for the raw and the Namespaced ones: // these are required to perform a final pruning once the replication has been occurred. diff --git a/main.go b/main.go index 4a35637e..4e989998 100644 --- a/main.go +++ b/main.go @@ -50,6 +50,7 @@ import ( "github.com/clastix/capsule/pkg/webhook/route" "github.com/clastix/capsule/pkg/webhook/service" "github.com/clastix/capsule/pkg/webhook/tenant" + tntresource "github.com/clastix/capsule/pkg/webhook/tenantresource" "github.com/clastix/capsule/pkg/webhook/utils" ) @@ -245,6 +246,7 @@ func main() { route.Ingress(ingress.Class(cfg, kubeVersion), ingress.Hostnames(cfg), ingress.Collision(cfg), ingress.Wildcard()), route.PVC(pvc.Validating(), pvc.PersistentVolumeReuse()), route.Service(service.Handler()), + route.TenantResourceObjects(utils.InCapsuleGroups(cfg, tntresource.WriteOpsHandler())), route.NetworkPolicy(utils.InCapsuleGroups(cfg, networkpolicy.Handler())), route.Tenant(tenant.NameHandler(), tenant.RoleBindingRegexHandler(), tenant.IngressClassRegexHandler(), tenant.StorageClassRegexHandler(), tenant.ContainerRegistryRegexHandler(), tenant.HostnameRegexHandler(), tenant.FreezedEmitter(), tenant.ServiceAccountNameHandler(), tenant.ForbiddenAnnotationsRegexHandler(), tenant.ProtectedHandler()), route.OwnerReference(utils.InCapsuleGroups(cfg, namespacewebhook.OwnerReferenceHandler(), ownerreference.Handler(cfg))), diff --git a/pkg/indexer/indexer.go b/pkg/indexer/indexer.go index 4dde3501..c2b3cdb5 100644 --- a/pkg/indexer/indexer.go +++ b/pkg/indexer/indexer.go @@ -20,6 +20,7 @@ import ( "github.com/clastix/capsule/pkg/indexer/ingress" "github.com/clastix/capsule/pkg/indexer/namespace" "github.com/clastix/capsule/pkg/indexer/tenant" + "github.com/clastix/capsule/pkg/indexer/tenantresource" ) type CustomIndexer interface { @@ -36,6 +37,8 @@ func AddToManager(ctx context.Context, log logr.Logger, mgr manager.Manager) err ingress.HostnamePath{Obj: &extensionsv1beta1.Ingress{}}, ingress.HostnamePath{Obj: &networkingv1beta1.Ingress{}}, ingress.HostnamePath{Obj: &networkingv1.Ingress{}}, + tenantresource.GlobalProcessedItems{}, + tenantresource.LocalProcessedItems{}, } for _, f := range indexers { diff --git a/pkg/indexer/tenantresource/constants.go b/pkg/indexer/tenantresource/constants.go new file mode 100644 index 00000000..254622f9 --- /dev/null +++ b/pkg/indexer/tenantresource/constants.go @@ -0,0 +1,8 @@ +// Copyright 2020-2021 Clastix Labs +// SPDX-License-Identifier: Apache-2.0 + +package tenantresource + +const ( + IndexerFieldName = "status.processedItems" +) diff --git a/pkg/indexer/tenantresource/global.go b/pkg/indexer/tenantresource/global.go new file mode 100644 index 00000000..380d9eb8 --- /dev/null +++ b/pkg/indexer/tenantresource/global.go @@ -0,0 +1,34 @@ +// Copyright 2020-2021 Clastix Labs +// SPDX-License-Identifier: Apache-2.0 + +//nolint:dupl +package tenantresource + +import ( + "sigs.k8s.io/controller-runtime/pkg/client" + + capsulev1beta2 "github.com/clastix/capsule/api/v1beta2" +) + +type GlobalProcessedItems struct{} + +func (g GlobalProcessedItems) Object() client.Object { + return &capsulev1beta2.GlobalTenantResource{} +} + +func (g GlobalProcessedItems) Field() string { + return IndexerFieldName +} + +func (g GlobalProcessedItems) Func() client.IndexerFunc { + return func(object client.Object) []string { + tgr := object.(*capsulev1beta2.GlobalTenantResource) //nolint:forcetypeassert + + out := make([]string, 0, len(tgr.Status.ProcessedItems)) + for _, pi := range tgr.Status.ProcessedItems { + out = append(out, pi.String()) + } + + return out + } +} diff --git a/pkg/indexer/tenantresource/local.go b/pkg/indexer/tenantresource/local.go new file mode 100644 index 00000000..9413400c --- /dev/null +++ b/pkg/indexer/tenantresource/local.go @@ -0,0 +1,34 @@ +// Copyright 2020-2021 Clastix Labs +// SPDX-License-Identifier: Apache-2.0 + +//nolint:dupl +package tenantresource + +import ( + "sigs.k8s.io/controller-runtime/pkg/client" + + capsulev1beta2 "github.com/clastix/capsule/api/v1beta2" +) + +type LocalProcessedItems struct{} + +func (g LocalProcessedItems) Object() client.Object { + return &capsulev1beta2.TenantResource{} +} + +func (g LocalProcessedItems) Field() string { + return IndexerFieldName +} + +func (g LocalProcessedItems) Func() client.IndexerFunc { + return func(object client.Object) []string { + tgr := object.(*capsulev1beta2.TenantResource) //nolint:forcetypeassert + + out := make([]string, 0, len(tgr.Status.ProcessedItems)) + for _, pi := range tgr.Status.ProcessedItems { + out = append(out, pi.String()) + } + + return out + } +} diff --git a/pkg/webhook/route/tenantresource_objs.go b/pkg/webhook/route/tenantresource_objs.go new file mode 100644 index 00000000..b1e8e3cc --- /dev/null +++ b/pkg/webhook/route/tenantresource_objs.go @@ -0,0 +1,26 @@ +// Copyright 2020-2021 Clastix Labs +// SPDX-License-Identifier: Apache-2.0 + +package route + +import ( + capsulewebhook "github.com/clastix/capsule/pkg/webhook" +) + +// +kubebuilder:webhook:path=/tenantresource-objects,mutating=false,sideEffects=None,admissionReviewVersions=v1,failurePolicy=fail,groups="*",resources="*",verbs=update;delete,versions="*",name=resource-objects.tenant.capsule.clastix.io + +type tntResourceObjs struct { + handlers []capsulewebhook.Handler +} + +func TenantResourceObjects(handlers ...capsulewebhook.Handler) capsulewebhook.Webhook { + return &tntResourceObjs{handlers: handlers} +} + +func (t tntResourceObjs) GetPath() string { + return "/tenantresource-objects" +} + +func (t tntResourceObjs) GetHandlers() []capsulewebhook.Handler { + return t.handlers +} diff --git a/pkg/webhook/tenantresource/objects.go b/pkg/webhook/tenantresource/objects.go new file mode 100644 index 00000000..6398d921 --- /dev/null +++ b/pkg/webhook/tenantresource/objects.go @@ -0,0 +1,89 @@ +// Copyright 2020-2021 Clastix Labs +// SPDX-License-Identifier: Apache-2.0 + +package tenant + +import ( + "context" + "fmt" + "strings" + + corev1 "k8s.io/api/core/v1" + "k8s.io/apimachinery/pkg/fields" + "k8s.io/client-go/tools/record" + "sigs.k8s.io/controller-runtime/pkg/client" + "sigs.k8s.io/controller-runtime/pkg/webhook/admission" + + capsulev1beta2 "github.com/clastix/capsule/api/v1beta2" + "github.com/clastix/capsule/pkg/indexer/tenantresource" + capsulewebhook "github.com/clastix/capsule/pkg/webhook" + "github.com/clastix/capsule/pkg/webhook/utils" +) + +type cordoningHandler struct{} + +func WriteOpsHandler() capsulewebhook.Handler { + return &cordoningHandler{} +} + +func (h *cordoningHandler) handler(ctx context.Context, clt client.Client, req admission.Request, recorder record.EventRecorder) *admission.Response { + tntList := &capsulev1beta2.TenantList{} + + if err := clt.List(ctx, tntList, client.MatchingFieldsSelector{Selector: fields.OneTermEqualSelector(".status.namespaces", req.Namespace)}); err != nil { + return utils.ErroredResponse(err) + } + // resource is not inside a Tenant namespace: + // we can avoid any kind of extra check. + if len(tntList.Items) == 0 { + return nil + } + // Checking if the object is managed by a TenantResource, local or global + ors := capsulev1beta2.ObjectReferenceStatus{ + ObjectReferenceAbstract: capsulev1beta2.ObjectReferenceAbstract{ + Kind: req.Kind.Kind, + Namespace: req.Namespace, + APIVersion: req.Kind.Version, + }, + Name: req.Name, + } + + global, local := &capsulev1beta2.GlobalTenantResourceList{}, &capsulev1beta2.TenantResourceList{} + + if err := clt.List(ctx, global, client.MatchingFieldsSelector{Selector: fields.OneTermEqualSelector(tenantresource.IndexerFieldName, ors.String())}); err != nil { + return utils.ErroredResponse(err) + } + + if err := clt.List(ctx, local, client.MatchingFieldsSelector{Selector: fields.OneTermEqualSelector(tenantresource.IndexerFieldName, ors.String())}); err != nil { + return utils.ErroredResponse(err) + } + + if len(local.Items) > 0 || len(global.Items) > 0 { + tnt := tntList.Items[0] + + recorder.Eventf(&tnt, corev1.EventTypeWarning, "TenantResourceWriteOp", "%s %s/%s cannot be %sd, resource is managed by the Tenant", req.Kind.String(), req.Namespace, req.Name, strings.ToLower(string(req.Operation))) + + response := admission.Denied(fmt.Sprintf("resource %s is managed at the Tenant level", req.Name)) + + return &response + } + + return nil +} + +func (h *cordoningHandler) OnCreate(client.Client, *admission.Decoder, record.EventRecorder) capsulewebhook.Func { + return func(ctx context.Context, req admission.Request) *admission.Response { + return nil + } +} + +func (h *cordoningHandler) OnDelete(client client.Client, _ *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { + return func(ctx context.Context, req admission.Request) *admission.Response { + return h.handler(ctx, client, req, recorder) + } +} + +func (h *cordoningHandler) OnUpdate(client client.Client, _ *admission.Decoder, recorder record.EventRecorder) capsulewebhook.Func { + return func(ctx context.Context, req admission.Request) *admission.Response { + return h.handler(ctx, client, req, recorder) + } +}