Skip to content

Commit 8aeb843

Browse files
joelanfordjoelanford
committed
add network policy for bundle unpack pods
Signed-off-by: Joe Lanford <[email protected]>
1 parent b9ecf89 commit 8aeb843

File tree

9 files changed

+340
-179
lines changed

9 files changed

+340
-179
lines changed

‎pkg/controller/bundle/bundle_unpacker.go

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,8 @@ const (
4848
// attempting to recreate a failed unpack job for a bundle.
4949
BundleUnpackRetryMinimumIntervalAnnotationKey = "operatorframework.io/bundle-unpack-min-retry-interval"
5050

51-
// bundleUnpackRefLabel is used to filter for all unpack jobs for a specific bundle.
52-
bundleUnpackRefLabel = "operatorframework.io/bundle-unpack-ref"
51+
// BundleUnpackRefLabel is used to filter for all unpack jobs or pods for a specific bundle.
52+
BundleUnpackRefLabel = "operatorframework.io/bundle-unpack-ref"
5353
)
5454

5555
type BundleUnpackResult struct {
@@ -98,7 +98,7 @@ func (c *ConfigMapUnpacker) job(cmRef *corev1.ObjectReference, bundlePath string
9898
ObjectMeta: metav1.ObjectMeta{
9999
Labels: map[string]string{
100100
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
101-
bundleUnpackRefLabel: cmRef.Name,
101+
BundleUnpackRefLabel: cmRef.Name,
102102
},
103103
},
104104
Spec: batchv1.JobSpec{
@@ -108,6 +108,7 @@ func (c *ConfigMapUnpacker) job(cmRef *corev1.ObjectReference, bundlePath string
108108
Name: cmRef.Name,
109109
Labels: map[string]string{
110110
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
111+
BundleUnpackRefLabel: cmRef.Name,
111112
},
112113
},
113114
Spec: corev1.PodSpec{
@@ -665,7 +666,7 @@ func (c *ConfigMapUnpacker) ensureConfigmap(csRef *corev1.ObjectReference, name
665666
func (c *ConfigMapUnpacker) ensureJob(cmRef *corev1.ObjectReference, bundlePath string, secrets []corev1.LocalObjectReference, timeout time.Duration, unpackRetryInterval time.Duration) (job *batchv1.Job, err error) {
666667
fresh := c.job(cmRef, bundlePath, secrets, timeout)
667668
var jobs, toDelete []*batchv1.Job
668-
jobs, err = c.jobLister.Jobs(fresh.GetNamespace()).List(k8slabels.ValidatedSetSelector{bundleUnpackRefLabel: cmRef.Name})
669+
jobs, err = c.jobLister.Jobs(fresh.GetNamespace()).List(k8slabels.ValidatedSetSelector{BundleUnpackRefLabel: cmRef.Name})
669670
if err != nil {
670671
return
671672
}
@@ -676,7 +677,7 @@ func (c *ConfigMapUnpacker) ensureJob(cmRef *corev1.ObjectReference, bundlePath
676677
return
677678
}
678679
if jobWithoutLabel != nil {
679-
_, labelExists := jobWithoutLabel.Labels[bundleUnpackRefLabel]
680+
_, labelExists := jobWithoutLabel.Labels[BundleUnpackRefLabel]
680681
if !labelExists {
681682
jobs = append(jobs, jobWithoutLabel)
682683
}

‎pkg/controller/bundle/bundle_unpacker_test.go

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,7 @@ func TestConfigMapUnpacker(t *testing.T) {
208208
ObjectMeta: metav1.ObjectMeta{
209209
Name: pathHash,
210210
Namespace: "ns-a",
211-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, bundleUnpackRefLabel: pathHash},
211+
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, BundleUnpackRefLabel: pathHash},
212212
OwnerReferences: []metav1.OwnerReference{
213213
{
214214
APIVersion: "v1",
@@ -444,7 +444,7 @@ func TestConfigMapUnpacker(t *testing.T) {
444444
ObjectMeta: metav1.ObjectMeta{
445445
Name: digestHash,
446446
Namespace: "ns-a",
447-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, bundleUnpackRefLabel: digestHash},
447+
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, BundleUnpackRefLabel: digestHash},
448448
OwnerReferences: []metav1.OwnerReference{
449449
{
450450
APIVersion: "v1",
@@ -718,7 +718,7 @@ func TestConfigMapUnpacker(t *testing.T) {
718718
ObjectMeta: metav1.ObjectMeta{
719719
Name: digestHash,
720720
Namespace: "ns-a",
721-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, bundleUnpackRefLabel: digestHash},
721+
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, BundleUnpackRefLabel: digestHash},
722722
OwnerReferences: []metav1.OwnerReference{
723723
{
724724
APIVersion: "v1",
@@ -987,7 +987,7 @@ func TestConfigMapUnpacker(t *testing.T) {
987987
ObjectMeta: metav1.ObjectMeta{
988988
Name: pathHash,
989989
Namespace: "ns-a",
990-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, bundleUnpackRefLabel: pathHash},
990+
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, BundleUnpackRefLabel: pathHash},
991991
OwnerReferences: []metav1.OwnerReference{
992992
{
993993
APIVersion: "v1",
@@ -1990,7 +1990,7 @@ func TestSortUnpackJobs(t *testing.T) {
19901990
return &batchv1.Job{
19911991
ObjectMeta: metav1.ObjectMeta{
19921992
Name: name,
1993-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, bundleUnpackRefLabel: "test"},
1993+
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, BundleUnpackRefLabel: "test"},
19941994
},
19951995
Status: batchv1.JobStatus{
19961996
Conditions: conditions,
@@ -2000,7 +2000,7 @@ func TestSortUnpackJobs(t *testing.T) {
20002000
nilConditionJob := &batchv1.Job{
20012001
ObjectMeta: metav1.ObjectMeta{
20022002
Name: "nc",
2003-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, bundleUnpackRefLabel: "test"},
2003+
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, BundleUnpackRefLabel: "test"},
20042004
},
20052005
Status: batchv1.JobStatus{
20062006
Conditions: nil,

‎pkg/controller/operators/catalog/operator_test.go

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1277,10 +1277,11 @@ func TestSyncCatalogSources(t *testing.T) {
12771277
pod(t, *grpcCatalog),
12781278
service(grpcCatalog.GetName(), grpcCatalog.GetNamespace()),
12791279
serviceAccount(grpcCatalog.GetName(), grpcCatalog.GetNamespace(), "", objectReference("init secret")),
1280-
networkPolicy(grpcCatalog, map[string]string{
1280+
grpcServerNetworkPolicy(grpcCatalog, map[string]string{
12811281
reconciler.CatalogSourceLabelKey: grpcCatalog.GetName(),
12821282
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
12831283
}),
1284+
unpackBundlesNetworkPolicy(grpcCatalog),
12841285
},
12851286
existingSources: []sourceAddress{
12861287
{
@@ -2335,8 +2336,11 @@ func configMap(name, namespace string) *corev1.ConfigMap {
23352336
}
23362337
}
23372338

2338-
func networkPolicy(catSrc *v1alpha1.CatalogSource, matchLabels map[string]string) *networkingv1.NetworkPolicy {
2339-
return reconciler.DesiredRegistryNetworkPolicy(catSrc, matchLabels)
2339+
func grpcServerNetworkPolicy(catSrc *v1alpha1.CatalogSource, matchLabels map[string]string) *networkingv1.NetworkPolicy {
2340+
return reconciler.DesiredGRPCServerNetworkPolicy(catSrc, matchLabels)
2341+
}
2342+
func unpackBundlesNetworkPolicy(catSrc *v1alpha1.CatalogSource) *networkingv1.NetworkPolicy {
2343+
return reconciler.DesiredUnpackBundlesNetworkPolicy(catSrc)
23402344
}
23412345

23422346
func objectReference(name string) *corev1.ObjectReference {

‎pkg/controller/registry/reconciler/configmap.go

Lines changed: 58 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -122,8 +122,13 @@ func (s *configMapCatalogSourceDecorator) Pod(image string, defaultPodSecurityCo
122122
ownerutil.AddOwner(pod, s.CatalogSource, false, true)
123123
return pod, nil
124124
}
125-
func (s *configMapCatalogSourceDecorator) NetworkPolicy() *networkingv1.NetworkPolicy {
126-
return DesiredRegistryNetworkPolicy(s.CatalogSource, s.Labels())
125+
126+
func (s *configMapCatalogSourceDecorator) GRPCServerNetworkPolicy() *networkingv1.NetworkPolicy {
127+
return DesiredGRPCServerNetworkPolicy(s.CatalogSource, s.Labels())
128+
}
129+
130+
func (s *configMapCatalogSourceDecorator) UnpackBundlesNetworkPolicy() *networkingv1.NetworkPolicy {
131+
return DesiredUnpackBundlesNetworkPolicy(s.CatalogSource)
127132
}
128133

129134
func (s *configMapCatalogSourceDecorator) ServiceAccount() *corev1.ServiceAccount {
@@ -214,11 +219,21 @@ func (c *ConfigMapRegistryReconciler) currentService(source configMapCatalogSour
214219
return service, nil
215220
}
216221

217-
func (c *ConfigMapRegistryReconciler) currentNetworkPolicy(source configMapCatalogSourceDecorator) *networkingv1.NetworkPolicy {
218-
npName := source.NetworkPolicy().GetName()
222+
func (c *ConfigMapRegistryReconciler) currentGRPCServerNetworkPolicy(source configMapCatalogSourceDecorator) *networkingv1.NetworkPolicy {
223+
npName := source.GRPCServerNetworkPolicy().GetName()
224+
np, err := c.Lister.NetworkingV1().NetworkPolicyLister().NetworkPolicies(source.GetNamespace()).Get(npName)
225+
if err != nil {
226+
logrus.WithField("networkPolicy", npName).WithError(err).Debug("couldn't find grpc server network policy in cache")
227+
return nil
228+
}
229+
return np
230+
}
231+
232+
func (c *ConfigMapRegistryReconciler) currentUnpackBundlesNetworkPolicy(source configMapCatalogSourceDecorator) *networkingv1.NetworkPolicy {
233+
npName := source.UnpackBundlesNetworkPolicy().GetName()
219234
np, err := c.Lister.NetworkingV1().NetworkPolicyLister().NetworkPolicies(source.GetNamespace()).Get(npName)
220235
if err != nil {
221-
logrus.WithField("networkPolicy", npName).WithError(err).Debug("couldn't find network policy in cache")
236+
logrus.WithField("networkPolicy", npName).WithError(err).Debug("couldn't find unpack bundles network policy in cache")
222237
return nil
223238
}
224239
return np
@@ -342,8 +357,11 @@ func (c *ConfigMapRegistryReconciler) EnsureRegistryServer(logger *logrus.Entry,
342357
}
343358

344359
//TODO: if any of these error out, we should write a status back (possibly set RegistryServiceStatus to nil so they get recreated)
345-
if err := c.ensureNetworkPolicy(source); err != nil {
346-
return pkgerrors.Wrapf(err, "error ensuring network policy: %s", source.GetName())
360+
if err := c.ensureGRPCServerNetworkPolicy(source); err != nil {
361+
return pkgerrors.Wrapf(err, "error ensuring grpc server network policy: %s", source.GetName())
362+
}
363+
if err := c.ensureUnpackBundlesNetworkPolicy(source); err != nil {
364+
return pkgerrors.Wrapf(err, "error ensuring unpack bundles network policy: %s", source.GetName())
347365
}
348366
if err := c.ensureServiceAccount(source, overwrite); err != nil {
349367
return pkgerrors.Wrapf(err, "error ensuring service account: %s", source.serviceAccountName())
@@ -382,17 +400,28 @@ func (c *ConfigMapRegistryReconciler) EnsureRegistryServer(logger *logrus.Entry,
382400
return nil
383401
}
384402

385-
func (c *ConfigMapRegistryReconciler) ensureNetworkPolicy(source configMapCatalogSourceDecorator) error {
386-
networkPolicy := source.NetworkPolicy()
387-
if currentNetworkPolicy := c.currentNetworkPolicy(source); currentNetworkPolicy != nil {
388-
if sanitizedDeepEqual(networkPolicy, currentNetworkPolicy) {
403+
func (c *ConfigMapRegistryReconciler) ensureGRPCServerNetworkPolicy(source configMapCatalogSourceDecorator) error {
404+
desired := source.GRPCServerNetworkPolicy()
405+
current := c.currentGRPCServerNetworkPolicy(source)
406+
return c.ensureNetworkPolicy(desired, current)
407+
}
408+
409+
func (c *ConfigMapRegistryReconciler) ensureUnpackBundlesNetworkPolicy(source configMapCatalogSourceDecorator) error {
410+
desired := source.UnpackBundlesNetworkPolicy()
411+
current := c.currentUnpackBundlesNetworkPolicy(source)
412+
return c.ensureNetworkPolicy(desired, current)
413+
}
414+
415+
func (c *ConfigMapRegistryReconciler) ensureNetworkPolicy(desired, current *networkingv1.NetworkPolicy) error {
416+
if current != nil {
417+
if sanitizedDeepEqual(desired, current) {
389418
return nil
390419
}
391-
if err := c.OpClient.DeleteNetworkPolicy(networkPolicy.GetNamespace(), networkPolicy.GetName(), metav1.NewDeleteOptions(0)); err != nil && !apierrors.IsNotFound(err) {
420+
if err := c.OpClient.DeleteNetworkPolicy(current.GetNamespace(), current.GetName(), metav1.NewDeleteOptions(0)); err != nil && !apierrors.IsNotFound(err) {
392421
return err
393422
}
394423
}
395-
_, err := c.OpClient.CreateNetworkPolicy(networkPolicy)
424+
_, err := c.OpClient.CreateNetworkPolicy(desired)
396425
return err
397426
}
398427

@@ -528,14 +557,26 @@ func (c *ConfigMapRegistryReconciler) CheckRegistryServer(logger *logrus.Entry,
528557
// Check on registry resources
529558
// TODO: more complex checks for resources
530559
// TODO: add gRPC health check
531-
np := c.currentNetworkPolicy(source)
560+
np := c.currentGRPCServerNetworkPolicy(source)
561+
if np == nil {
562+
logger.Error("registry service not healthy: could not get grpc server network policy")
563+
healthy = false
564+
return
565+
}
566+
if !sanitizedDeepEqual(source.GRPCServerNetworkPolicy(), np) {
567+
logger.Error("registry service not healthy: unexpected grpc server network policy")
568+
healthy = false
569+
return
570+
}
571+
572+
np = c.currentUnpackBundlesNetworkPolicy(source)
532573
if np == nil {
533-
logger.Error("registry service not healthy: could not get network policy")
574+
logger.Error("registry service not healthy: could not get unpack bundles network policy")
534575
healthy = false
535576
return
536577
}
537-
if !sanitizedDeepEqual(source.NetworkPolicy(), np) {
538-
logger.Error("registry service not healthy: unexpected network policy")
578+
if !sanitizedDeepEqual(source.UnpackBundlesNetworkPolicy(), np) {
579+
logger.Error("registry service not healthy: unexpected unpack bundles network policy")
539580
healthy = false
540581
return
541582
}

‎pkg/controller/registry/reconciler/configmap_test.go

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,8 @@ func objectsForCatalogSource(t *testing.T, catsrc *v1alpha1.CatalogSource) []run
199199
switch catsrc.Spec.SourceType {
200200
case v1alpha1.SourceTypeInternal, v1alpha1.SourceTypeConfigmap:
201201
decorated := configMapCatalogSourceDecorator{catsrc, runAsUser}
202-
np := decorated.NetworkPolicy()
202+
grpcServerNetworkPolicy := decorated.GRPCServerNetworkPolicy()
203+
unpackBundlesNetworkPolicy := decorated.UnpackBundlesNetworkPolicy()
203204
service, err := decorated.Service()
204205
if err != nil {
205206
t.Fatal(err)
@@ -210,15 +211,17 @@ func objectsForCatalogSource(t *testing.T, catsrc *v1alpha1.CatalogSource) []run
210211
t.Fatal(err)
211212
}
212213
objs = append(objs,
213-
np,
214+
grpcServerNetworkPolicy,
215+
unpackBundlesNetworkPolicy,
214216
pod,
215217
service,
216218
serviceAccount,
217219
)
218220
case v1alpha1.SourceTypeGrpc:
219221
if catsrc.Spec.Image != "" {
220222
decorated := grpcCatalogSourceDecorator{CatalogSource: catsrc, createPodAsUser: runAsUser, opmImage: ""}
221-
np := decorated.NetworkPolicy()
223+
grpcServerNetworkPolicy := decorated.GRPCServerNetworkPolicy()
224+
unpackBundlesNetworkPolicy := decorated.UnpackBundlesNetworkPolicy()
222225
serviceAccount := decorated.ServiceAccount()
223226
service, err := decorated.Service()
224227
if err != nil {
@@ -229,7 +232,8 @@ func objectsForCatalogSource(t *testing.T, catsrc *v1alpha1.CatalogSource) []run
229232
t.Fatal(err)
230233
}
231234
objs = append(objs,
232-
np,
235+
grpcServerNetworkPolicy,
236+
unpackBundlesNetworkPolicy,
233237
pod,
234238
service,
235239
serviceAccount,
@@ -351,7 +355,7 @@ func TestConfigMapRegistryReconciler(t *testing.T) {
351355
},
352356
},
353357
{
354-
testName: "ExistingRegistry/BadNetworkPolicy",
358+
testName: "ExistingRegistry/BadNetworkPolicies",
355359
in: in{
356360
cluster: cluster{
357361
k8sObjs: append(setLabel(objectsForCatalogSource(t, validCatalogSource), &networkingv1.NetworkPolicy{}, CatalogSourceLabelKey, "wrongValue"), validConfigMap),
@@ -530,10 +534,15 @@ func TestConfigMapRegistryReconciler(t *testing.T) {
530534
require.Equal(t, pod.GetLabels(), outPod.GetLabels())
531535
require.Equal(t, pod.Spec, outPod.Spec)
532536

533-
np := decorated.NetworkPolicy()
534-
outNp, err := client.KubernetesInterface().NetworkingV1().NetworkPolicies(np.GetNamespace()).Get(context.TODO(), np.GetName(), metav1.GetOptions{})
537+
grpcServerNetworkPolicy := decorated.GRPCServerNetworkPolicy()
538+
outGrpcServerNetworkPolicy, err := client.KubernetesInterface().NetworkingV1().NetworkPolicies(grpcServerNetworkPolicy.GetNamespace()).Get(context.TODO(), grpcServerNetworkPolicy.GetName(), metav1.GetOptions{})
535539
require.NoError(t, err)
536-
require.Equal(t, np, outNp)
540+
require.Equal(t, grpcServerNetworkPolicy, outGrpcServerNetworkPolicy)
541+
542+
unpackBundlesNetworkPolicy := decorated.UnpackBundlesNetworkPolicy()
543+
outUnpackBundlesNetworkPolicy, err := client.KubernetesInterface().NetworkingV1().NetworkPolicies(unpackBundlesNetworkPolicy.GetNamespace()).Get(context.TODO(), unpackBundlesNetworkPolicy.GetName(), metav1.GetOptions{})
544+
require.NoError(t, err)
545+
require.Equal(t, unpackBundlesNetworkPolicy, outUnpackBundlesNetworkPolicy)
537546

538547
service, err := decorated.Service()
539548
require.NoError(t, err)

0 commit comments

Comments
 (0)