Skip to content

Commit 026ceff

Browse files
joelanfordjoelanford
committed
add network policy for bundle unpack pods
Signed-off-by: Joe Lanford <[email protected]>
1 parent b9ecf89 commit 026ceff

File tree

9 files changed

+389
-197
lines changed

9 files changed

+389
-197
lines changed

‎pkg/controller/bundle/bundle_unpacker.go

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,8 @@ const (
4848
// attempting to recreate a failed unpack job for a bundle.
4949
BundleUnpackRetryMinimumIntervalAnnotationKey = "operatorframework.io/bundle-unpack-min-retry-interval"
5050

51-
// bundleUnpackRefLabel is used to filter for all unpack jobs for a specific bundle.
52-
bundleUnpackRefLabel = "operatorframework.io/bundle-unpack-ref"
51+
// BundleUnpackRefLabel is used to filter for all unpack jobs or pods for a specific bundle.
52+
BundleUnpackRefLabel = "operatorframework.io/bundle-unpack-ref"
5353
)
5454

5555
type BundleUnpackResult struct {
@@ -98,7 +98,7 @@ func (c *ConfigMapUnpacker) job(cmRef *corev1.ObjectReference, bundlePath string
9898
ObjectMeta: metav1.ObjectMeta{
9999
Labels: map[string]string{
100100
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
101-
bundleUnpackRefLabel: cmRef.Name,
101+
BundleUnpackRefLabel: cmRef.Name,
102102
},
103103
},
104104
Spec: batchv1.JobSpec{
@@ -108,6 +108,7 @@ func (c *ConfigMapUnpacker) job(cmRef *corev1.ObjectReference, bundlePath string
108108
Name: cmRef.Name,
109109
Labels: map[string]string{
110110
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
111+
BundleUnpackRefLabel: cmRef.Name,
111112
},
112113
},
113114
Spec: corev1.PodSpec{
@@ -665,7 +666,7 @@ func (c *ConfigMapUnpacker) ensureConfigmap(csRef *corev1.ObjectReference, name
665666
func (c *ConfigMapUnpacker) ensureJob(cmRef *corev1.ObjectReference, bundlePath string, secrets []corev1.LocalObjectReference, timeout time.Duration, unpackRetryInterval time.Duration) (job *batchv1.Job, err error) {
666667
fresh := c.job(cmRef, bundlePath, secrets, timeout)
667668
var jobs, toDelete []*batchv1.Job
668-
jobs, err = c.jobLister.Jobs(fresh.GetNamespace()).List(k8slabels.ValidatedSetSelector{bundleUnpackRefLabel: cmRef.Name})
669+
jobs, err = c.jobLister.Jobs(fresh.GetNamespace()).List(k8slabels.ValidatedSetSelector{BundleUnpackRefLabel: cmRef.Name})
669670
if err != nil {
670671
return
671672
}
@@ -676,7 +677,7 @@ func (c *ConfigMapUnpacker) ensureJob(cmRef *corev1.ObjectReference, bundlePath
676677
return
677678
}
678679
if jobWithoutLabel != nil {
679-
_, labelExists := jobWithoutLabel.Labels[bundleUnpackRefLabel]
680+
_, labelExists := jobWithoutLabel.Labels[BundleUnpackRefLabel]
680681
if !labelExists {
681682
jobs = append(jobs, jobWithoutLabel)
682683
}

‎pkg/controller/bundle/bundle_unpacker_test.go

Lines changed: 36 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,7 @@ func TestConfigMapUnpacker(t *testing.T) {
208208
ObjectMeta: metav1.ObjectMeta{
209209
Name: pathHash,
210210
Namespace: "ns-a",
211-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, bundleUnpackRefLabel: pathHash},
211+
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, BundleUnpackRefLabel: pathHash},
212212
OwnerReferences: []metav1.OwnerReference{
213213
{
214214
APIVersion: "v1",
@@ -225,8 +225,11 @@ func TestConfigMapUnpacker(t *testing.T) {
225225
BackoffLimit: &backoffLimit,
226226
Template: corev1.PodTemplateSpec{
227227
ObjectMeta: metav1.ObjectMeta{
228-
Name: pathHash,
229-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue},
228+
Name: pathHash,
229+
Labels: map[string]string{
230+
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
231+
BundleUnpackRefLabel: pathHash,
232+
},
230233
},
231234
Spec: corev1.PodSpec{
232235
RestartPolicy: corev1.RestartPolicyNever,
@@ -444,7 +447,7 @@ func TestConfigMapUnpacker(t *testing.T) {
444447
ObjectMeta: metav1.ObjectMeta{
445448
Name: digestHash,
446449
Namespace: "ns-a",
447-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, bundleUnpackRefLabel: digestHash},
450+
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, BundleUnpackRefLabel: digestHash},
448451
OwnerReferences: []metav1.OwnerReference{
449452
{
450453
APIVersion: "v1",
@@ -460,8 +463,11 @@ func TestConfigMapUnpacker(t *testing.T) {
460463
BackoffLimit: &backoffLimit,
461464
Template: corev1.PodTemplateSpec{
462465
ObjectMeta: metav1.ObjectMeta{
463-
Name: digestHash,
464-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue},
466+
Name: digestHash,
467+
Labels: map[string]string{
468+
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
469+
BundleUnpackRefLabel: digestHash,
470+
},
465471
},
466472
Spec: corev1.PodSpec{
467473
RestartPolicy: corev1.RestartPolicyNever,
@@ -718,7 +724,7 @@ func TestConfigMapUnpacker(t *testing.T) {
718724
ObjectMeta: metav1.ObjectMeta{
719725
Name: digestHash,
720726
Namespace: "ns-a",
721-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, bundleUnpackRefLabel: digestHash},
727+
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, BundleUnpackRefLabel: digestHash},
722728
OwnerReferences: []metav1.OwnerReference{
723729
{
724730
APIVersion: "v1",
@@ -734,8 +740,11 @@ func TestConfigMapUnpacker(t *testing.T) {
734740
BackoffLimit: &backoffLimit,
735741
Template: corev1.PodTemplateSpec{
736742
ObjectMeta: metav1.ObjectMeta{
737-
Name: digestHash,
738-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue},
743+
Name: digestHash,
744+
Labels: map[string]string{
745+
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
746+
BundleUnpackRefLabel: digestHash,
747+
},
739748
},
740749
Spec: corev1.PodSpec{
741750
RestartPolicy: corev1.RestartPolicyNever,
@@ -987,7 +996,7 @@ func TestConfigMapUnpacker(t *testing.T) {
987996
ObjectMeta: metav1.ObjectMeta{
988997
Name: pathHash,
989998
Namespace: "ns-a",
990-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, bundleUnpackRefLabel: pathHash},
999+
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, BundleUnpackRefLabel: pathHash},
9911000
OwnerReferences: []metav1.OwnerReference{
9921001
{
9931002
APIVersion: "v1",
@@ -1003,8 +1012,11 @@ func TestConfigMapUnpacker(t *testing.T) {
10031012
BackoffLimit: &backoffLimit,
10041013
Template: corev1.PodTemplateSpec{
10051014
ObjectMeta: metav1.ObjectMeta{
1006-
Name: pathHash,
1007-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue},
1015+
Name: pathHash,
1016+
Labels: map[string]string{
1017+
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
1018+
BundleUnpackRefLabel: pathHash,
1019+
},
10081020
},
10091021
Spec: corev1.PodSpec{
10101022
RestartPolicy: corev1.RestartPolicyNever,
@@ -1242,8 +1254,11 @@ func TestConfigMapUnpacker(t *testing.T) {
12421254
BackoffLimit: &backoffLimit,
12431255
Template: corev1.PodTemplateSpec{
12441256
ObjectMeta: metav1.ObjectMeta{
1245-
Name: pathHash,
1246-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue},
1257+
Name: pathHash,
1258+
Labels: map[string]string{
1259+
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
1260+
BundleUnpackRefLabel: pathHash,
1261+
},
12471262
},
12481263
Spec: corev1.PodSpec{
12491264
RestartPolicy: corev1.RestartPolicyNever,
@@ -1494,8 +1509,11 @@ func TestConfigMapUnpacker(t *testing.T) {
14941509
BackoffLimit: &backoffLimit,
14951510
Template: corev1.PodTemplateSpec{
14961511
ObjectMeta: metav1.ObjectMeta{
1497-
Name: pathHash,
1498-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue},
1512+
Name: pathHash,
1513+
Labels: map[string]string{
1514+
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
1515+
BundleUnpackRefLabel: pathHash,
1516+
},
14991517
},
15001518
Spec: corev1.PodSpec{
15011519
RestartPolicy: corev1.RestartPolicyNever,
@@ -1990,7 +2008,7 @@ func TestSortUnpackJobs(t *testing.T) {
19902008
return &batchv1.Job{
19912009
ObjectMeta: metav1.ObjectMeta{
19922010
Name: name,
1993-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, bundleUnpackRefLabel: "test"},
2011+
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, BundleUnpackRefLabel: "test"},
19942012
},
19952013
Status: batchv1.JobStatus{
19962014
Conditions: conditions,
@@ -2000,7 +2018,7 @@ func TestSortUnpackJobs(t *testing.T) {
20002018
nilConditionJob := &batchv1.Job{
20012019
ObjectMeta: metav1.ObjectMeta{
20022020
Name: "nc",
2003-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, bundleUnpackRefLabel: "test"},
2021+
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, BundleUnpackRefLabel: "test"},
20042022
},
20052023
Status: batchv1.JobStatus{
20062024
Conditions: nil,

‎pkg/controller/operators/catalog/operator_test.go

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1277,10 +1277,11 @@ func TestSyncCatalogSources(t *testing.T) {
12771277
pod(t, *grpcCatalog),
12781278
service(grpcCatalog.GetName(), grpcCatalog.GetNamespace()),
12791279
serviceAccount(grpcCatalog.GetName(), grpcCatalog.GetNamespace(), "", objectReference("init secret")),
1280-
networkPolicy(grpcCatalog, map[string]string{
1280+
grpcServerNetworkPolicy(grpcCatalog, map[string]string{
12811281
reconciler.CatalogSourceLabelKey: grpcCatalog.GetName(),
12821282
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
12831283
}),
1284+
unpackBundlesNetworkPolicy(grpcCatalog),
12841285
},
12851286
existingSources: []sourceAddress{
12861287
{
@@ -2335,8 +2336,11 @@ func configMap(name, namespace string) *corev1.ConfigMap {
23352336
}
23362337
}
23372338

2338-
func networkPolicy(catSrc *v1alpha1.CatalogSource, matchLabels map[string]string) *networkingv1.NetworkPolicy {
2339-
return reconciler.DesiredRegistryNetworkPolicy(catSrc, matchLabels)
2339+
func grpcServerNetworkPolicy(catSrc *v1alpha1.CatalogSource, matchLabels map[string]string) *networkingv1.NetworkPolicy {
2340+
return reconciler.DesiredGRPCServerNetworkPolicy(catSrc, matchLabels)
2341+
}
2342+
func unpackBundlesNetworkPolicy(catSrc *v1alpha1.CatalogSource) *networkingv1.NetworkPolicy {
2343+
return reconciler.DesiredUnpackBundlesNetworkPolicy(catSrc)
23402344
}
23412345

23422346
func objectReference(name string) *corev1.ObjectReference {

‎pkg/controller/registry/reconciler/configmap.go

Lines changed: 59 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ import (
66
"errors"
77
"fmt"
88

9-
"github.com/operator-framework/operator-lifecycle-manager/pkg/controller/install"
109
hashutil "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/kubernetes/pkg/util/hash"
1110
pkgerrors "github.com/pkg/errors"
1211
"github.com/sirupsen/logrus"
@@ -20,6 +19,7 @@ import (
2019
"k8s.io/utils/ptr"
2120

2221
"github.com/operator-framework/api/pkg/operators/v1alpha1"
22+
"github.com/operator-framework/operator-lifecycle-manager/pkg/controller/install"
2323
"github.com/operator-framework/operator-lifecycle-manager/pkg/lib/operatorclient"
2424
"github.com/operator-framework/operator-lifecycle-manager/pkg/lib/operatorlister"
2525
"github.com/operator-framework/operator-lifecycle-manager/pkg/lib/ownerutil"
@@ -122,8 +122,13 @@ func (s *configMapCatalogSourceDecorator) Pod(image string, defaultPodSecurityCo
122122
ownerutil.AddOwner(pod, s.CatalogSource, false, true)
123123
return pod, nil
124124
}
125-
func (s *configMapCatalogSourceDecorator) NetworkPolicy() *networkingv1.NetworkPolicy {
126-
return DesiredRegistryNetworkPolicy(s.CatalogSource, s.Labels())
125+
126+
func (s *configMapCatalogSourceDecorator) GRPCServerNetworkPolicy() *networkingv1.NetworkPolicy {
127+
return DesiredGRPCServerNetworkPolicy(s.CatalogSource, s.Labels())
128+
}
129+
130+
func (s *configMapCatalogSourceDecorator) UnpackBundlesNetworkPolicy() *networkingv1.NetworkPolicy {
131+
return DesiredUnpackBundlesNetworkPolicy(s.CatalogSource)
127132
}
128133

129134
func (s *configMapCatalogSourceDecorator) ServiceAccount() *corev1.ServiceAccount {
@@ -214,11 +219,21 @@ func (c *ConfigMapRegistryReconciler) currentService(source configMapCatalogSour
214219
return service, nil
215220
}
216221

217-
func (c *ConfigMapRegistryReconciler) currentNetworkPolicy(source configMapCatalogSourceDecorator) *networkingv1.NetworkPolicy {
218-
npName := source.NetworkPolicy().GetName()
222+
func (c *ConfigMapRegistryReconciler) currentGRPCServerNetworkPolicy(source configMapCatalogSourceDecorator) *networkingv1.NetworkPolicy {
223+
npName := source.GRPCServerNetworkPolicy().GetName()
219224
np, err := c.Lister.NetworkingV1().NetworkPolicyLister().NetworkPolicies(source.GetNamespace()).Get(npName)
220225
if err != nil {
221-
logrus.WithField("networkPolicy", npName).WithError(err).Debug("couldn't find network policy in cache")
226+
logrus.WithField("networkPolicy", npName).WithError(err).Debug("couldn't find grpc server network policy in cache")
227+
return nil
228+
}
229+
return np
230+
}
231+
232+
func (c *ConfigMapRegistryReconciler) currentUnpackBundlesNetworkPolicy(source configMapCatalogSourceDecorator) *networkingv1.NetworkPolicy {
233+
npName := source.UnpackBundlesNetworkPolicy().GetName()
234+
np, err := c.Lister.NetworkingV1().NetworkPolicyLister().NetworkPolicies(source.GetNamespace()).Get(npName)
235+
if err != nil {
236+
logrus.WithField("networkPolicy", npName).WithError(err).Debug("couldn't find unpack bundles network policy in cache")
222237
return nil
223238
}
224239
return np
@@ -342,8 +357,11 @@ func (c *ConfigMapRegistryReconciler) EnsureRegistryServer(logger *logrus.Entry,
342357
}
343358

344359
//TODO: if any of these error out, we should write a status back (possibly set RegistryServiceStatus to nil so they get recreated)
345-
if err := c.ensureNetworkPolicy(source); err != nil {
346-
return pkgerrors.Wrapf(err, "error ensuring network policy: %s", source.GetName())
360+
if err := c.ensureGRPCServerNetworkPolicy(source); err != nil {
361+
return pkgerrors.Wrapf(err, "error ensuring grpc server network policy: %s", source.GetName())
362+
}
363+
if err := c.ensureUnpackBundlesNetworkPolicy(source); err != nil {
364+
return pkgerrors.Wrapf(err, "error ensuring unpack bundles network policy: %s", source.GetName())
347365
}
348366
if err := c.ensureServiceAccount(source, overwrite); err != nil {
349367
return pkgerrors.Wrapf(err, "error ensuring service account: %s", source.serviceAccountName())
@@ -382,17 +400,28 @@ func (c *ConfigMapRegistryReconciler) EnsureRegistryServer(logger *logrus.Entry,
382400
return nil
383401
}
384402

385-
func (c *ConfigMapRegistryReconciler) ensureNetworkPolicy(source configMapCatalogSourceDecorator) error {
386-
networkPolicy := source.NetworkPolicy()
387-
if currentNetworkPolicy := c.currentNetworkPolicy(source); currentNetworkPolicy != nil {
388-
if sanitizedDeepEqual(networkPolicy, currentNetworkPolicy) {
403+
func (c *ConfigMapRegistryReconciler) ensureGRPCServerNetworkPolicy(source configMapCatalogSourceDecorator) error {
404+
desired := source.GRPCServerNetworkPolicy()
405+
current := c.currentGRPCServerNetworkPolicy(source)
406+
return c.ensureNetworkPolicy(desired, current)
407+
}
408+
409+
func (c *ConfigMapRegistryReconciler) ensureUnpackBundlesNetworkPolicy(source configMapCatalogSourceDecorator) error {
410+
desired := source.UnpackBundlesNetworkPolicy()
411+
current := c.currentUnpackBundlesNetworkPolicy(source)
412+
return c.ensureNetworkPolicy(desired, current)
413+
}
414+
415+
func (c *ConfigMapRegistryReconciler) ensureNetworkPolicy(desired, current *networkingv1.NetworkPolicy) error {
416+
if current != nil {
417+
if isExpectedNetworkPolicy(desired, current) {
389418
return nil
390419
}
391-
if err := c.OpClient.DeleteNetworkPolicy(networkPolicy.GetNamespace(), networkPolicy.GetName(), metav1.NewDeleteOptions(0)); err != nil && !apierrors.IsNotFound(err) {
420+
if err := c.OpClient.DeleteNetworkPolicy(current.GetNamespace(), current.GetName(), metav1.NewDeleteOptions(0)); err != nil && !apierrors.IsNotFound(err) {
392421
return err
393422
}
394423
}
395-
_, err := c.OpClient.CreateNetworkPolicy(networkPolicy)
424+
_, err := c.OpClient.CreateNetworkPolicy(desired)
396425
return err
397426
}
398427

@@ -528,14 +557,26 @@ func (c *ConfigMapRegistryReconciler) CheckRegistryServer(logger *logrus.Entry,
528557
// Check on registry resources
529558
// TODO: more complex checks for resources
530559
// TODO: add gRPC health check
531-
np := c.currentNetworkPolicy(source)
560+
np := c.currentGRPCServerNetworkPolicy(source)
561+
if np == nil {
562+
logger.Error("registry service not healthy: could not get grpc server network policy")
563+
healthy = false
564+
return
565+
}
566+
if !isExpectedNetworkPolicy(source.GRPCServerNetworkPolicy(), np) {
567+
logger.Error("registry service not healthy: unexpected grpc server network policy")
568+
healthy = false
569+
return
570+
}
571+
572+
np = c.currentUnpackBundlesNetworkPolicy(source)
532573
if np == nil {
533-
logger.Error("registry service not healthy: could not get network policy")
574+
logger.Error("registry service not healthy: could not get unpack bundles network policy")
534575
healthy = false
535576
return
536577
}
537-
if !sanitizedDeepEqual(source.NetworkPolicy(), np) {
538-
logger.Error("registry service not healthy: unexpected network policy")
578+
if !isExpectedNetworkPolicy(source.UnpackBundlesNetworkPolicy(), np) {
579+
logger.Error("registry service not healthy: unexpected unpack bundles network policy")
539580
healthy = false
540581
return
541582
}

0 commit comments

Comments
 (0)