-
Notifications
You must be signed in to change notification settings - Fork 7
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
🎆 Add Support for HA and ExposureClasses (#35)
* Add fake deploment to test locally * Add support for multiple istio namespaces * add ExposureClass support * Implement support for workerless shoots * Trigger webhook with empty patch instead of hash annotation Co-authored-by: Simon Kienzler <[email protected]>
- Loading branch information
1 parent
200f712
commit 727eced
Showing
27 changed files
with
1,218 additions
and
298 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| # Supporting Multiple Istio Namespaces | ||
|
|
||
| Before this change, the `Namespace` used by the extension was hardcoded to | ||
| `istio-ingress`. This is the default name for the Istio namespace, where the | ||
| Ingress is deployed. In case of High Availability Shoots (see | ||
| [Gardener HA Control Plane Best Practices](https://gardener.cloud/docs/gardener/shoot_high_availability_best_practices/)), | ||
| or when using | ||
| [ExposureClasses](https://gardener.cloud/docs/gardener/exposureclasses/), the | ||
| name of this Ingress namespace can change dynamically. | ||
|
|
||
| Therefore, the extension is rewritten to dynamically determine the correct | ||
| namespace in which to create/mutate `EnvoyFilter` objects. This is achieved | ||
| using the following logic: | ||
|
|
||
| 1. The extension gets the `Gateway` object called `kube-apiserver` in the | ||
| current shoot namespace. This object is created by Gardener for every Shoot. | ||
| The | ||
| [Gateway](https://istio.io/latest/docs/reference/config/networking/gateway/) | ||
| resource contains a `spec.selector` field, which contains label selectors for | ||
| the `Deployment` of the gateway controller that is responsible for the | ||
| defined `Gateway`. | ||
| 2. From these label selectors, we can obtain the `Namespace` where the Istio | ||
| Ingress Gateway is deployed. This is achieved by a `LIST` operation | ||
| on `Deployments`, filtered by the selector labels. | ||
|
|
||
| The namespace where this Deployment runs is the target namespace for all | ||
| `EnvoyFilters` deployed/mutated by the extension. It is also recorded in the | ||
| `Status` of the ACL `Extension` object. This enables the extension to support | ||
| changing the istio namespace for a running shoot. This will happen for example | ||
| if a shoot is updated to High Availability or when using an `ExposureClass`. | ||
| Also, when the ingress namespaces changes, the old `acl-vpn` `EnvoyFilter` will | ||
| be cleaned up or get deleted (to "free" the previous ingress namespace from | ||
| restrictive filter policies.) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| # Changing How the Webhook is Triggered | ||
|
|
||
| In [ADR02](02_envoyfilter_patching.md), we defined how we create/mutate | ||
| `EnvoyFilters` in order to provide ACL functionality. | ||
|
|
||
| In the "Complicated Case 1: Mutating Webhook for Specific `EnvoyFilters`" | ||
| section, ADR02 described how a hashing mechanism is used to update an annotation | ||
| every time the contents of the `Extension.spec` changes, causing the | ||
| `MutatingWebhook` to execute. | ||
|
|
||
| This however neglected that there can be changes to the ACL configuration of a | ||
| `Shoot` even when the `Extension.spec` hasn't changed, namely in the form of the | ||
| `additionalAllowedCIDRs` configuration. This setting can be changed for the | ||
| entire extension using the Helm chart it is deployed with. Adding additional | ||
| CIDRs to this field would update all associated `EnvoyFilters`, except the ones | ||
| the Webhook is responsible for. | ||
|
|
||
| The new implementation of the trigger mechanism is both simpler and more | ||
| thorough: Every time an `Extension` is reconciled, the actuator sends an empty | ||
| patch for the associated `EnvoyFilter` that the Webhook is responsible for. | ||
| This removes the need for the hashing logic, and makes sure that the Webhook is | ||
| run every time the extension is reconciled. The problem with the neglected | ||
| `additionalAllowedCIDRs` setting is solved by this approach. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| --- | ||
| apiVersion: core.gardener.cloud/v1beta1 | ||
| kind: ControllerDeployment | ||
| metadata: | ||
| name: acl | ||
| type: helm | ||
| providerConfig: | ||
| chart: H4sIAAAAAAAAA+2WTY+bMBCGc+ZXjPYeAjQQidtqK3UPqz1UVe9TM01QbYNsE21U5b93IB8iUVerPZBW2nk4GH/gd+yxZ4gXs8lJmFWeDyVzXQ7v6adlmuVZUQztRcoF5NObNpt1PqADuIXU/0i8eNigC/EOjZ5Ko3dwsVy+6v8sWV36n72fLWeQTGXQmA/uf2zr7+R83dgStmmEbXuu3qVxchdV5JWr2zA03cMjaQOqPzLws3EQNgRf0FVkycH9wxPQSyDbfx9HFg2VsD72zs89c1Q62p5Ukphlon+9DR+WeBHItBoD+ckywbvjP9//VSHx/xaM/V91xuwmyARvxf8iv/Z/lqaFxP9bMI7/HPz9gpPAr9pWJXymVjc7QzZEhgJWGLCMAJQj7JPBt9oQb51pS7Cd1tyj8Qdp34+BfqoShvPE1UMiGNd8i4qbfvMTfyVN6Cl+PrXDHvaRb0n1Uzm2olboS0i55nmsCo07iBgMavM0Ur3S9cHxuV7vWGjP1dNBP348WlPP6+vq0RcqVzqsdLR2mKixAWvOeOfhc6gNrnm9dl3bl/Mch225bHPkm84p8oPNbEfoDq9T+T9ebFF35Kf8AXzr/v8l/md5KvdfEARBEARBEARBEARBEARBEARBEN7LH7tBDWIAKAAA | ||
| --- | ||
| apiVersion: core.gardener.cloud/v1beta1 | ||
| kind: ControllerRegistration | ||
| metadata: | ||
| name: acl | ||
| spec: | ||
| deployment: | ||
| deploymentRefs: | ||
| - name: acl | ||
| resources: | ||
| - kind: Extension | ||
| type: acl | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| apiVersion: v1 | ||
| appVersion: "1.0" | ||
| description: A Helm chart for the Gardener ACL extension. | ||
| name: gardener-extension-acl | ||
| version: 0.1.0 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| labels: | ||
| app: dummy | ||
| name: dummy | ||
| namespace: {{ .Release.Namespace }} | ||
| spec: | ||
| replicas: 1 | ||
| selector: | ||
| matchLabels: | ||
| app: dummy | ||
| strategy: {} | ||
| template: | ||
| metadata: | ||
| labels: | ||
| app: dummy | ||
| spec: | ||
| containers: | ||
| - image: nginx | ||
| name: nginx | ||
| resources: {} |
Empty file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.