feat: block use of NodePort Services

e2e/disable_node_ports_test.go

@@ -0,0 +1,88 @@
+//+build e2e
+
+/*
+Copyright 2020 Clastix Labs.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e
+
+import (
+	"context"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+
+	"github.com/clastix/capsule/api/v1alpha1"
+)
+
+var _ = Describe("creating a nodePort service when it is disabled for Tenant", func() {
+	tnt := &v1alpha1.Tenant{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "disable-node-ports",
+			Annotations: map[string]string{
+				"capsule.clastix.io/enable-node-ports": "false",
+			},
+		},
+		Spec: v1alpha1.TenantSpec{
+			Owner: v1alpha1.OwnerSpec{
+				Name: "google",
+				Kind: "User",
+			},
+		},
+	}
+
+	JustBeforeEach(func() {
+		EventuallyCreation(func() error {
+			tnt.ResourceVersion = ""
+			return k8sClient.Create(context.TODO(), tnt)
+		}).Should(Succeed())
+	})
+	JustAfterEach(func() {
+		Expect(k8sClient.Delete(context.TODO(), tnt)).Should(Succeed())
+	})
+
+	It("should fail creating a service with NodePort type", func() {
+		ns := NewNamespace("disable-node-ports")
+		NamespaceCreation(ns, tnt, defaultTimeoutInterval).Should(Succeed())
+
+		svc := &corev1.Service{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "disable-node-ports",
+				Namespace: ns.GetName(),
+			},
+			Spec: corev1.ServiceSpec{
+				Type: corev1.ServiceTypeNodePort,
+				Ports: []corev1.ServicePort{
+					{
+						Port: 9999,
+						TargetPort: intstr.IntOrString{
+							Type:   intstr.Int,
+							IntVal: 9999,
+						},
+						Protocol: corev1.ProtocolTCP,
+					},
+				},
+			},
+		}
+		EventuallyCreation(func() error {
+			cs := ownerClient(tnt)
+			_, err := cs.CoreV1().Services(ns.Name).Create(context.Background(), svc, metav1.CreateOptions{})
+			return err
+		}).ShouldNot(Succeed())
+	})
+})

e2e/enable_node_ports_test.go

@@ -0,0 +1,85 @@
+//+build e2e
+
+/*
+Copyright 2020 Clastix Labs.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package e2e
+
+import (
+	"context"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+
+	"github.com/clastix/capsule/api/v1alpha1"
+)
+
+var _ = Describe("creating a nodePort service when it is enabled for Tenant", func() {
+	tnt := &v1alpha1.Tenant{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "enable-node-ports",
+		},
+		Spec: v1alpha1.TenantSpec{
+			Owner: v1alpha1.OwnerSpec{
+				Name: "google",
+				Kind: "User",
+			},
+		},
+	}
+
+	JustBeforeEach(func() {
+		EventuallyCreation(func() error {
+			tnt.ResourceVersion = ""
+			return k8sClient.Create(context.TODO(), tnt)
+		}).Should(Succeed())
+	})
+	JustAfterEach(func() {
+		Expect(k8sClient.Delete(context.TODO(), tnt)).Should(Succeed())
+	})
+
+	It("should allow creating a service with NodePort type", func() {
+		ns := NewNamespace("enable-node-ports")
+		NamespaceCreation(ns, tnt, defaultTimeoutInterval).Should(Succeed())
+
+		svc := &corev1.Service{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "enable-node-ports",
+				Namespace: ns.GetName(),
+			},
+			Spec: corev1.ServiceSpec{
+				Type: corev1.ServiceTypeNodePort,
+				Ports: []corev1.ServicePort{
+					{
+						Port: 9999,
+						TargetPort: intstr.IntOrString{
+							Type:   intstr.Int,
+							IntVal: 9999,
+						},
+						Protocol: corev1.ProtocolTCP,
+					},
+				},
+			},
+		}
+		EventuallyCreation(func() error {
+			cs := ownerClient(tnt)
+			_, err := cs.CoreV1().Services(ns.Name).Create(context.Background(), svc, metav1.CreateOptions{})
+			return err
+		}).Should(Succeed())
+	})
+})

pkg/webhook/services/errors.go

@@ -40,3 +40,13 @@ func NewExternalServiceIPForbidden(allowedIps []v1alpha1.AllowedIP) error {
 func (e externalServiceIPForbidden) Error() string {
 	return fmt.Sprintf("The selected external IPs for the current Service are violating the following enforced CIDRs: %s", strings.Join(e.cidr, ", "))
 }
+
+type nodePortDisabled struct{}
+
+func NewNodePortDisabledError() error {
+	return &nodePortDisabled{}
+}
+
+func (nodePortDisabled) Error() string {
+	return "NodePort service types are disabled for a tenant: please, reach out to the system administrators"
+}

pkg/webhook/services/validating.go

@@ -32,6 +32,10 @@ import (
 
 // +kubebuilder:webhook:path=/validating-external-service-ips,mutating=false,sideEffects=None,admissionReviewVersions=v1,failurePolicy=fail,groups="",resources=services,verbs=create;update,versions=v1,name=validating-external-service-ips.capsule.clastix.io
 
+const (
+	enableNodePortsAnnotation = "capsule.clastix.io/enable-node-ports"
+)
+
 type webhook struct {
 	handler capsulewebhook.Handler
 }
@@ -93,6 +97,10 @@ func (r *handler) handleService(ctx context.Context, clt client.Client, decoder
 		}
 	}
 
+	if svc.Spec.Type == corev1.ServiceTypeNodePort && tnt.GetAnnotations()[enableNodePortsAnnotation] == "false" {
+		return admission.Errored(http.StatusBadRequest, NewNodePortDisabledError())
+	}
+
 	return admission.Errored(http.StatusBadRequest, NewExternalServiceIPForbidden(tnt.Spec.ExternalServiceIPs.Allowed))
 }