Skip to content

Commit 8723097

Browse files
joelanfordjoelanford
authored
✨ Include network policy for all configmap and grpc catalogsources (#3568)
* include network policy for all configmap and grpc catalogsources Signed-off-by: Joe Lanford <[email protected]> * add network policy for bundle unpack pods Signed-off-by: Joe Lanford <[email protected]> --------- Signed-off-by: Joe Lanford <[email protected]>
1 parent ee5d8a3 commit 8723097

File tree

16 files changed

+1068
-120
lines changed

16 files changed

+1068
-120
lines changed

‎pkg/controller/bundle/bundle_unpacker.go

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,8 @@ const (
4848
// attempting to recreate a failed unpack job for a bundle.
4949
BundleUnpackRetryMinimumIntervalAnnotationKey = "operatorframework.io/bundle-unpack-min-retry-interval"
5050

51-
// bundleUnpackRefLabel is used to filter for all unpack jobs for a specific bundle.
52-
bundleUnpackRefLabel = "operatorframework.io/bundle-unpack-ref"
51+
// BundleUnpackRefLabel is used to filter for all unpack jobs or pods for a specific bundle.
52+
BundleUnpackRefLabel = "operatorframework.io/bundle-unpack-ref"
5353
)
5454

5555
type BundleUnpackResult struct {
@@ -98,7 +98,7 @@ func (c *ConfigMapUnpacker) job(cmRef *corev1.ObjectReference, bundlePath string
9898
ObjectMeta: metav1.ObjectMeta{
9999
Labels: map[string]string{
100100
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
101-
bundleUnpackRefLabel: cmRef.Name,
101+
BundleUnpackRefLabel: cmRef.Name,
102102
},
103103
},
104104
Spec: batchv1.JobSpec{
@@ -108,6 +108,7 @@ func (c *ConfigMapUnpacker) job(cmRef *corev1.ObjectReference, bundlePath string
108108
Name: cmRef.Name,
109109
Labels: map[string]string{
110110
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
111+
BundleUnpackRefLabel: cmRef.Name,
111112
},
112113
},
113114
Spec: corev1.PodSpec{
@@ -665,7 +666,7 @@ func (c *ConfigMapUnpacker) ensureConfigmap(csRef *corev1.ObjectReference, name
665666
func (c *ConfigMapUnpacker) ensureJob(cmRef *corev1.ObjectReference, bundlePath string, secrets []corev1.LocalObjectReference, timeout time.Duration, unpackRetryInterval time.Duration) (job *batchv1.Job, err error) {
666667
fresh := c.job(cmRef, bundlePath, secrets, timeout)
667668
var jobs, toDelete []*batchv1.Job
668-
jobs, err = c.jobLister.Jobs(fresh.GetNamespace()).List(k8slabels.ValidatedSetSelector{bundleUnpackRefLabel: cmRef.Name})
669+
jobs, err = c.jobLister.Jobs(fresh.GetNamespace()).List(k8slabels.ValidatedSetSelector{BundleUnpackRefLabel: cmRef.Name})
669670
if err != nil {
670671
return
671672
}
@@ -676,7 +677,7 @@ func (c *ConfigMapUnpacker) ensureJob(cmRef *corev1.ObjectReference, bundlePath
676677
return
677678
}
678679
if jobWithoutLabel != nil {
679-
_, labelExists := jobWithoutLabel.Labels[bundleUnpackRefLabel]
680+
_, labelExists := jobWithoutLabel.Labels[BundleUnpackRefLabel]
680681
if !labelExists {
681682
jobs = append(jobs, jobWithoutLabel)
682683
}

‎pkg/controller/bundle/bundle_unpacker_test.go

Lines changed: 36 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,7 @@ func TestConfigMapUnpacker(t *testing.T) {
208208
ObjectMeta: metav1.ObjectMeta{
209209
Name: pathHash,
210210
Namespace: "ns-a",
211-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, bundleUnpackRefLabel: pathHash},
211+
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, BundleUnpackRefLabel: pathHash},
212212
OwnerReferences: []metav1.OwnerReference{
213213
{
214214
APIVersion: "v1",
@@ -225,8 +225,11 @@ func TestConfigMapUnpacker(t *testing.T) {
225225
BackoffLimit: &backoffLimit,
226226
Template: corev1.PodTemplateSpec{
227227
ObjectMeta: metav1.ObjectMeta{
228-
Name: pathHash,
229-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue},
228+
Name: pathHash,
229+
Labels: map[string]string{
230+
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
231+
BundleUnpackRefLabel: pathHash,
232+
},
230233
},
231234
Spec: corev1.PodSpec{
232235
RestartPolicy: corev1.RestartPolicyNever,
@@ -444,7 +447,7 @@ func TestConfigMapUnpacker(t *testing.T) {
444447
ObjectMeta: metav1.ObjectMeta{
445448
Name: digestHash,
446449
Namespace: "ns-a",
447-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, bundleUnpackRefLabel: digestHash},
450+
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, BundleUnpackRefLabel: digestHash},
448451
OwnerReferences: []metav1.OwnerReference{
449452
{
450453
APIVersion: "v1",
@@ -460,8 +463,11 @@ func TestConfigMapUnpacker(t *testing.T) {
460463
BackoffLimit: &backoffLimit,
461464
Template: corev1.PodTemplateSpec{
462465
ObjectMeta: metav1.ObjectMeta{
463-
Name: digestHash,
464-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue},
466+
Name: digestHash,
467+
Labels: map[string]string{
468+
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
469+
BundleUnpackRefLabel: digestHash,
470+
},
465471
},
466472
Spec: corev1.PodSpec{
467473
RestartPolicy: corev1.RestartPolicyNever,
@@ -718,7 +724,7 @@ func TestConfigMapUnpacker(t *testing.T) {
718724
ObjectMeta: metav1.ObjectMeta{
719725
Name: digestHash,
720726
Namespace: "ns-a",
721-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, bundleUnpackRefLabel: digestHash},
727+
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, BundleUnpackRefLabel: digestHash},
722728
OwnerReferences: []metav1.OwnerReference{
723729
{
724730
APIVersion: "v1",
@@ -734,8 +740,11 @@ func TestConfigMapUnpacker(t *testing.T) {
734740
BackoffLimit: &backoffLimit,
735741
Template: corev1.PodTemplateSpec{
736742
ObjectMeta: metav1.ObjectMeta{
737-
Name: digestHash,
738-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue},
743+
Name: digestHash,
744+
Labels: map[string]string{
745+
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
746+
BundleUnpackRefLabel: digestHash,
747+
},
739748
},
740749
Spec: corev1.PodSpec{
741750
RestartPolicy: corev1.RestartPolicyNever,
@@ -987,7 +996,7 @@ func TestConfigMapUnpacker(t *testing.T) {
987996
ObjectMeta: metav1.ObjectMeta{
988997
Name: pathHash,
989998
Namespace: "ns-a",
990-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, bundleUnpackRefLabel: pathHash},
999+
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, BundleUnpackRefLabel: pathHash},
9911000
OwnerReferences: []metav1.OwnerReference{
9921001
{
9931002
APIVersion: "v1",
@@ -1003,8 +1012,11 @@ func TestConfigMapUnpacker(t *testing.T) {
10031012
BackoffLimit: &backoffLimit,
10041013
Template: corev1.PodTemplateSpec{
10051014
ObjectMeta: metav1.ObjectMeta{
1006-
Name: pathHash,
1007-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue},
1015+
Name: pathHash,
1016+
Labels: map[string]string{
1017+
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
1018+
BundleUnpackRefLabel: pathHash,
1019+
},
10081020
},
10091021
Spec: corev1.PodSpec{
10101022
RestartPolicy: corev1.RestartPolicyNever,
@@ -1242,8 +1254,11 @@ func TestConfigMapUnpacker(t *testing.T) {
12421254
BackoffLimit: &backoffLimit,
12431255
Template: corev1.PodTemplateSpec{
12441256
ObjectMeta: metav1.ObjectMeta{
1245-
Name: pathHash,
1246-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue},
1257+
Name: pathHash,
1258+
Labels: map[string]string{
1259+
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
1260+
BundleUnpackRefLabel: pathHash,
1261+
},
12471262
},
12481263
Spec: corev1.PodSpec{
12491264
RestartPolicy: corev1.RestartPolicyNever,
@@ -1494,8 +1509,11 @@ func TestConfigMapUnpacker(t *testing.T) {
14941509
BackoffLimit: &backoffLimit,
14951510
Template: corev1.PodTemplateSpec{
14961511
ObjectMeta: metav1.ObjectMeta{
1497-
Name: pathHash,
1498-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue},
1512+
Name: pathHash,
1513+
Labels: map[string]string{
1514+
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
1515+
BundleUnpackRefLabel: pathHash,
1516+
},
14991517
},
15001518
Spec: corev1.PodSpec{
15011519
RestartPolicy: corev1.RestartPolicyNever,
@@ -1990,7 +2008,7 @@ func TestSortUnpackJobs(t *testing.T) {
19902008
return &batchv1.Job{
19912009
ObjectMeta: metav1.ObjectMeta{
19922010
Name: name,
1993-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, bundleUnpackRefLabel: "test"},
2011+
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, BundleUnpackRefLabel: "test"},
19942012
},
19952013
Status: batchv1.JobStatus{
19962014
Conditions: conditions,
@@ -2000,7 +2018,7 @@ func TestSortUnpackJobs(t *testing.T) {
20002018
nilConditionJob := &batchv1.Job{
20012019
ObjectMeta: metav1.ObjectMeta{
20022020
Name: "nc",
2003-
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, bundleUnpackRefLabel: "test"},
2021+
Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue, BundleUnpackRefLabel: "test"},
20042022
},
20052023
Status: batchv1.JobStatus{
20062024
Conditions: nil,

‎pkg/controller/operators/catalog/operator.go

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ import (
1818
"google.golang.org/grpc/connectivity"
1919
batchv1 "k8s.io/api/batch/v1"
2020
corev1 "k8s.io/api/core/v1"
21+
networkingv1 "k8s.io/api/networking/v1"
2122
rbacv1 "k8s.io/api/rbac/v1"
2223
"k8s.io/apiextensions-apiserver/pkg/apis/apiextensions"
2324
apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
@@ -38,6 +39,7 @@ import (
3839
"k8s.io/apimachinery/pkg/util/yaml"
3940
batchv1applyconfigurations "k8s.io/client-go/applyconfigurations/batch/v1"
4041
corev1applyconfigurations "k8s.io/client-go/applyconfigurations/core/v1"
42+
networkingv1applyconfigurations "k8s.io/client-go/applyconfigurations/networking/v1"
4143
rbacv1applyconfigurations "k8s.io/client-go/applyconfigurations/rbac/v1"
4244
"k8s.io/client-go/dynamic"
4345
"k8s.io/client-go/informers"
@@ -600,6 +602,23 @@ func NewOperator(ctx context.Context, kubeconfigPath string, clock utilclock.Clo
600602
}
601603
}
602604

605+
// Wire NetworkPolicies
606+
networkPolicyInformer := k8sInformerFactory.Networking().V1().NetworkPolicies()
607+
op.lister.NetworkingV1().RegisterNetworkPolicyLister(metav1.NamespaceAll, networkPolicyInformer.Lister())
608+
sharedIndexInformers = append(sharedIndexInformers, networkPolicyInformer.Informer())
609+
610+
networkPoliciesGVR := networkingv1.SchemeGroupVersion.WithResource("networkpolicies")
611+
if err := labelObjects(networkPoliciesGVR, networkPolicyInformer.Informer(), labeller.ObjectLabeler[*networkingv1.NetworkPolicy, *networkingv1applyconfigurations.NetworkPolicyApplyConfiguration](
612+
ctx, op.logger, labeller.Filter(networkPoliciesGVR),
613+
networkPolicyInformer.Lister().List,
614+
networkingv1applyconfigurations.NetworkPolicy,
615+
func(namespace string, ctx context.Context, cfg *networkingv1applyconfigurations.NetworkPolicyApplyConfiguration, opts metav1.ApplyOptions) (*networkingv1.NetworkPolicy, error) {
616+
return op.opClient.KubernetesInterface().NetworkingV1().NetworkPolicies(namespace).Apply(ctx, cfg, opts)
617+
},
618+
)); err != nil {
619+
return nil, err
620+
}
621+
603622
// Wire Pods for CatalogSource
604623
catsrcReq, err := labels.NewRequirement(reconciler.CatalogSourceLabelKey, selection.Exists, nil)
605624
if err != nil {

‎pkg/controller/operators/catalog/operator_test.go

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import (
2525
"gopkg.in/yaml.v2"
2626
appsv1 "k8s.io/api/apps/v1"
2727
corev1 "k8s.io/api/core/v1"
28+
networkingv1 "k8s.io/api/networking/v1"
2829
rbacv1 "k8s.io/api/rbac/v1"
2930
apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
3031
apiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
@@ -1276,6 +1277,11 @@ func TestSyncCatalogSources(t *testing.T) {
12761277
pod(t, *grpcCatalog),
12771278
service(grpcCatalog.GetName(), grpcCatalog.GetNamespace()),
12781279
serviceAccount(grpcCatalog.GetName(), grpcCatalog.GetNamespace(), "", objectReference("init secret")),
1280+
grpcServerNetworkPolicy(grpcCatalog, map[string]string{
1281+
reconciler.CatalogSourceLabelKey: grpcCatalog.GetName(),
1282+
install.OLMManagedLabelKey: install.OLMManagedLabelValue,
1283+
}),
1284+
unpackBundlesNetworkPolicy(grpcCatalog),
12791285
},
12801286
existingSources: []sourceAddress{
12811287
{
@@ -2128,14 +2134,25 @@ func NewFakeOperator(ctx context.Context, namespace string, namespaces []string,
21282134
serviceInformer := factory.Core().V1().Services()
21292135
podInformer := factory.Core().V1().Pods()
21302136
configMapInformer := factory.Core().V1().ConfigMaps()
2131-
sharedInformers = append(sharedInformers, roleInformer.Informer(), roleBindingInformer.Informer(), serviceAccountInformer.Informer(), serviceInformer.Informer(), podInformer.Informer(), configMapInformer.Informer())
2137+
networkPolicyInformer := factory.Networking().V1().NetworkPolicies()
2138+
2139+
sharedInformers = append(sharedInformers,
2140+
roleInformer.Informer(),
2141+
roleBindingInformer.Informer(),
2142+
serviceAccountInformer.Informer(),
2143+
serviceInformer.Informer(),
2144+
podInformer.Informer(),
2145+
configMapInformer.Informer(),
2146+
networkPolicyInformer.Informer(),
2147+
)
21322148

21332149
lister.RbacV1().RegisterRoleLister(metav1.NamespaceAll, roleInformer.Lister())
21342150
lister.RbacV1().RegisterRoleBindingLister(metav1.NamespaceAll, roleBindingInformer.Lister())
21352151
lister.CoreV1().RegisterServiceAccountLister(metav1.NamespaceAll, serviceAccountInformer.Lister())
21362152
lister.CoreV1().RegisterServiceLister(metav1.NamespaceAll, serviceInformer.Lister())
21372153
lister.CoreV1().RegisterPodLister(metav1.NamespaceAll, podInformer.Lister())
21382154
lister.CoreV1().RegisterConfigMapLister(metav1.NamespaceAll, configMapInformer.Lister())
2155+
lister.NetworkingV1().RegisterNetworkPolicyLister(metav1.NamespaceAll, networkPolicyInformer.Lister())
21392156
logger := logrus.New()
21402157

21412158
// Create the new operator
@@ -2319,6 +2336,13 @@ func configMap(name, namespace string) *corev1.ConfigMap {
23192336
}
23202337
}
23212338

2339+
func grpcServerNetworkPolicy(catSrc *v1alpha1.CatalogSource, matchLabels map[string]string) *networkingv1.NetworkPolicy {
2340+
return reconciler.DesiredGRPCServerNetworkPolicy(catSrc, matchLabels)
2341+
}
2342+
func unpackBundlesNetworkPolicy(catSrc *v1alpha1.CatalogSource) *networkingv1.NetworkPolicy {
2343+
return reconciler.DesiredUnpackBundlesNetworkPolicy(catSrc)
2344+
}
2345+
23222346
func objectReference(name string) *corev1.ObjectReference {
23232347
if name == "" {
23242348
return &corev1.ObjectReference{}

0 commit comments

Comments
 (0)