github/flagger
1
0
Fork 0
mirror of https://github.com/fluxcd/flagger.git synced 2026-04-15 06:57:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add flag to disable cross namespace refs to AlertProviders and MetricTemplates

Browse Source 
Signed-off-by: Sanskar Jaiswal <sanskar.jaiswal@weave.works>
This commit is contained in:
Sanskar Jaiswal
2022-04-27 17:09:07 +05:30
parent a1e519b352
commit 7df1beef85
14 changed files with 117 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/controller/controller.go
+39 -36
View File
@@ -49,24 +49,25 @@ const controllerAgentName = "flagger"
// Controller is managing the canary objects and schedules canary deployments
type Controller struct {
kubeClient kubernetes.Interface
flaggerClient clientset.Interface
flaggerInformers Informers
flaggerSynced cache.InformerSynced
flaggerWindow time.Duration
workqueue workqueue.RateLimitingInterface
eventRecorder record.EventRecorder
logger *zap.SugaredLogger
canaries *sync.Map
jobs map[string]CanaryJob
recorder metrics.Recorder
notifier notifier.Interface
canaryFactory *canary.Factory
routerFactory *router.Factory
observerFactory *observers.Factory
meshProvider string
eventWebhook string
clusterName string
kubeClient kubernetes.Interface
flaggerClient clientset.Interface
flaggerInformers Informers
flaggerSynced cache.InformerSynced
flaggerWindow time.Duration
workqueue workqueue.RateLimitingInterface
eventRecorder record.EventRecorder
logger *zap.SugaredLogger
canaries *sync.Map
jobs map[string]CanaryJob
recorder metrics.Recorder
notifier notifier.Interface
canaryFactory *canary.Factory
routerFactory *router.Factory
observerFactory *observers.Factory
meshProvider string
eventWebhook string
clusterName string
noCrossNamespaceRefs bool
}
type Informers struct {
@@ -89,6 +90,7 @@ func NewController(
version string,
eventWebhook string,
clusterName string,
noCrossNamespaceRefs bool,
) *Controller {
logger.Debug("Creating event broadcaster")
flaggerscheme.AddToScheme(scheme.Scheme)
@@ -103,24 +105,25 @@ func NewController(
recorder.SetInfo(version, meshProvider)
ctrl := &Controller{
kubeClient: kubeClient,
flaggerClient: flaggerClient,
flaggerInformers: flaggerInformers,
flaggerSynced: flaggerInformers.CanaryInformer.Informer().HasSynced,
workqueue: workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), controllerAgentName),
eventRecorder: eventRecorder,
logger: logger,
canaries: new(sync.Map),
jobs: map[string]CanaryJob{},
flaggerWindow: flaggerWindow,
observerFactory: observerFactory,
recorder: recorder,
notifier: notifier,
canaryFactory: canaryFactory,
routerFactory: routerFactory,
meshProvider: meshProvider,
eventWebhook: eventWebhook,
clusterName: clusterName,
kubeClient: kubeClient,
flaggerClient: flaggerClient,
flaggerInformers: flaggerInformers,
flaggerSynced: flaggerInformers.CanaryInformer.Informer().HasSynced,
workqueue: workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), controllerAgentName),
eventRecorder: eventRecorder,
logger: logger,
canaries: new(sync.Map),
jobs: map[string]CanaryJob{},
flaggerWindow: flaggerWindow,
observerFactory: observerFactory,
recorder: recorder,
notifier: notifier,
canaryFactory: canaryFactory,
routerFactory: routerFactory,
meshProvider: meshProvider,
eventWebhook: eventWebhook,
clusterName: clusterName,
noCrossNamespaceRefs: noCrossNamespaceRefs,
}
flaggerInformers.CanaryInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
pkg/controller/events.go
+6 -1
View File
@@ -108,7 +108,12 @@ func (c *Controller) alert(canary *flaggerv1.Canary, message string, metadata bo
// determine alert provider namespace
providerNamespace := canary.GetNamespace()
if alert.ProviderRef.Namespace != "" {
if alert.ProviderRef.Namespace != canary.Namespace {
if c.noCrossNamespaceRefs {
c.logger.With("canary", fmt.Sprintf("%s.%s", canary.Name, canary.Namespace)).
Errorf("can't access alert provider ref %s.%s, cross-namespace references are blocked", alert.ProviderRef.Name, alert.ProviderRef.Namespace)
return
}
providerNamespace = alert.ProviderRef.Namespace
}
pkg/controller/scheduler_daemonset_fixture_test.go
+2 -2
View File
@@ -261,7 +261,7 @@ func newDaemonSetTestCanary() *flaggerv1.Canary {
Name: "podinfo",
},
Spec: flaggerv1.CanarySpec{
TargetRef: flaggerv1.CrossNamespaceObjectReference{
TargetRef: flaggerv1.LocalObjectReference{
Name: "podinfo",
APIVersion: "apps/v1",
Kind: "DaemonSet",
@@ -318,7 +318,7 @@ func newDaemonSetTestCanaryAB() *flaggerv1.Canary {
Name: "podinfo",
},
Spec: flaggerv1.CanarySpec{
TargetRef: flaggerv1.CrossNamespaceObjectReference{
TargetRef: flaggerv1.LocalObjectReference{
Name: "podinfo",
APIVersion: "apps/v1",
Kind: "DaemonSet",
pkg/controller/scheduler_deployment_fixture_test.go
+4 -4
View File
@@ -289,12 +289,12 @@ func newDeploymentTestCanary() *flaggerv1.Canary {
Name: "podinfo",
},
Spec: flaggerv1.CanarySpec{
TargetRef: flaggerv1.CrossNamespaceObjectReference{
TargetRef: flaggerv1.LocalObjectReference{
Name: "podinfo",
APIVersion: "apps/v1",
Kind: "Deployment",
},
AutoscalerRef: &flaggerv1.CrossNamespaceObjectReference{
AutoscalerRef: &flaggerv1.LocalObjectReference{
Name: "podinfo",
APIVersion: "autoscaling/v2beta2",
Kind: "HorizontalPodAutoscaler",
@@ -351,12 +351,12 @@ func newDeploymentTestCanaryAB() *flaggerv1.Canary {
Name: "podinfo",
},
Spec: flaggerv1.CanarySpec{
TargetRef: flaggerv1.CrossNamespaceObjectReference{
TargetRef: flaggerv1.LocalObjectReference{
Name: "podinfo",
APIVersion: "apps/v1",
Kind: "Deployment",
},
AutoscalerRef: &flaggerv1.CrossNamespaceObjectReference{
AutoscalerRef: &flaggerv1.LocalObjectReference{
Name: "podinfo",
APIVersion: "autoscaling/v2beta2",
Kind: "HorizontalPodAutoscaler",
pkg/controller/scheduler_metrics.go
+9 -2
View File
@@ -54,7 +54,10 @@ func (c *Controller) checkMetricProviderAvailability(canary *flaggerv1.Canary) e
if metric.TemplateRef != nil {
namespace := canary.Namespace
if metric.TemplateRef.Namespace != "" {
if metric.TemplateRef.Namespace != canary.Namespace {
if c.noCrossNamespaceRefs {
return fmt.Errorf("can't access metric template ref %s.%s, cross-namespace references are blocked", metric.TemplateRef.Name, metric.TemplateRef.Namespace)
}
namespace = metric.TemplateRef.Namespace
}
@@ -238,7 +241,11 @@ func (c *Controller) runMetricChecks(canary *flaggerv1.Canary) bool {
for _, metric := range canary.GetAnalysis().Metrics {
if metric.TemplateRef != nil {
namespace := canary.Namespace
if metric.TemplateRef.Namespace != "" {
if metric.TemplateRef.Namespace != canary.Namespace {
if c.noCrossNamespaceRefs {
c.recordEventErrorf(canary, "Metric template %s.%s error: cross-namespace references are blocked", metric.TemplateRef.Name, metric.TemplateRef.Namespace)
return false
}
namespace = metric.TemplateRef.Namespace
}
pkg/controller/scheduler_metrics_test.go
+4
View File
@@ -65,5 +65,9 @@ func TestController_checkMetricProviderAvailability(t *testing.T) {
Namespace: "default",
}
require.NoError(t, ctrl.checkMetricProviderAvailability(canary))
ctrl.noCrossNamespaceRefs = true
canary.Namespace = "test"
require.Error(t, ctrl.checkMetricProviderAvailability(canary))
})
}
pkg/controller/scheduler_svc_test.go
+4 -4
View File
@@ -123,7 +123,7 @@ func newTestServiceCanary() *flaggerv1.Canary {
Name: "podinfo",
},
Spec: flaggerv1.CanarySpec{
TargetRef: flaggerv1.CrossNamespaceObjectReference{
TargetRef: flaggerv1.LocalObjectReference{
Name: "podinfo",
APIVersion: "core/v1",
Kind: "Service",
@@ -161,7 +161,7 @@ func newTestServiceCanaryMaxWeight() *flaggerv1.Canary {
Name: "podinfo",
},
Spec: flaggerv1.CanarySpec{
TargetRef: flaggerv1.CrossNamespaceObjectReference{
TargetRef: flaggerv1.LocalObjectReference{
Name: "podinfo",
APIVersion: "core/v1",
Kind: "Service",
@@ -199,7 +199,7 @@ func newTestServiceCanaryWithWeightsHappyCase() *flaggerv1.Canary {
Name: "podinfo",
},
Spec: flaggerv1.CanarySpec{
TargetRef: flaggerv1.CrossNamespaceObjectReference{
TargetRef: flaggerv1.LocalObjectReference{
Name: "podinfo",
APIVersion: "core/v1",
Kind: "Service",
@@ -236,7 +236,7 @@ func newTestServiceCanaryWithWeightsOverflow() *flaggerv1.Canary {
Name: "podinfo",
},
Spec: flaggerv1.CanarySpec{
TargetRef: flaggerv1.CrossNamespaceObjectReference{
TargetRef: flaggerv1.LocalObjectReference{
Name: "podinfo",
APIVersion: "core/v1",
Kind: "Service",