multi-tenant: EnsureNamespaceSA + ns_watcher SA provisioning (v8)

2026-04-26 07:41:46 +03:00
parent 82e1ff76a5
commit 161de70576
24 changed files with 970 additions and 1 deletions
@@ -18,6 +18,7 @@ package router

 import (
 	"context"
+	"fmt"
 	"net/http"
 	"strings"
 	"time"
@@ -35,6 +36,7 @@ import (
 	eclient "github.com/fission/fission/pkg/executor/client"
 	config "github.com/fission/fission/pkg/featureconfig"
 	"github.com/fission/fission/pkg/generated/clientset/versioned"
+	genInformer "github.com/fission/fission/pkg/generated/informers/externalversions"
 	"github.com/fission/fission/pkg/info"
 	"github.com/fission/fission/pkg/throttler"
 	"github.com/fission/fission/pkg/utils"
@@ -426,3 +428,84 @@ func (ts *HTTPTriggerSet) updateRouter(ctx context.Context) {
 		ts.mutableRouter.updateRouter(router)
 	}
 }
+
+// AddNamespace dynamically registers a new namespace in the router without a restart.
+// Creates per-NS informers for HTTPTriggers and Functions, wires up event handlers,
+// and triggers a router rebuild. Safe to call repeatedly — deduplicates via NSResolver.
+func (ts *HTTPTriggerSet) AddNamespace(ctx context.Context, ns string, mgr manager.Interface) error {
+	if !utils.DefaultNSResolver().AddNamespace(ns) {
+		return nil // already registered
+	}
+	ts.logger.Info("router.AddNamespace: setting up informers", zap.String("namespace", ns))
+
+	factory := genInformer.NewFilteredSharedInformerFactory(ts.fissionClient, 30*time.Minute, ns, nil)
+	triggerInf := factory.Core().V1().HTTPTriggers().Informer()
+	funcInf := factory.Core().V1().Functions().Informer()
+
+	_, err := triggerInf.AddEventHandler(k8sCache.ResourceEventHandlerFuncs{
+		AddFunc: func(obj interface{}) {
+			trigger := obj.(*fv1.HTTPTrigger)
+			go createIngress(context.Background(), ts.logger, trigger, ts.kubeClient)
+			ts.syncTriggers()
+		},
+		DeleteFunc: func(obj interface{}) {
+			ts.syncTriggers()
+			trigger := obj.(*fv1.HTTPTrigger)
+			go deleteIngress(context.Background(), ts.logger, trigger, ts.kubeClient)
+		},
+		UpdateFunc: func(oldObj interface{}, newObj interface{}) {
+			oldTrigger := oldObj.(*fv1.HTTPTrigger)
+			newTrigger := newObj.(*fv1.HTTPTrigger)
+			if oldTrigger.ObjectMeta.ResourceVersion == newTrigger.ObjectMeta.ResourceVersion {
+				return
+			}
+			go updateIngress(context.Background(), ts.logger, oldTrigger, newTrigger, ts.kubeClient)
+			ts.syncTriggers()
+		},
+	})
+	if err != nil {
+		return fmt.Errorf("router.AddNamespace %s: trigger handler: %w", ns, err)
+	}
+
+	_, err = funcInf.AddEventHandler(k8sCache.ResourceEventHandlerFuncs{
+		AddFunc:    func(obj interface{}) { ts.syncTriggers() },
+		DeleteFunc: func(obj interface{}) { ts.syncTriggers() },
+		UpdateFunc: func(oldObj interface{}, newObj interface{}) {
+			oldFn := oldObj.(*fv1.Function)
+			fn := newObj.(*fv1.Function)
+			if oldFn.ObjectMeta.ResourceVersion == fn.ObjectMeta.ResourceVersion {
+				return
+			}
+			for key, rr := range ts.resolver.copy() {
+				if key.namespace == fn.ObjectMeta.Namespace &&
+					rr.functionMap[fn.ObjectMeta.Name] != nil &&
+					rr.functionMap[fn.ObjectMeta.Name].ObjectMeta.ResourceVersion != fn.ObjectMeta.ResourceVersion {
+					ts.logger.Debug("invalidating resolver cache")
+					_ = ts.resolver.delete(key.namespace, key.triggerName, key.triggerResourceVersion)
+					break
+				}
+			}
+			ts.syncTriggers()
+		},
+	})
+	if err != nil {
+		return fmt.Errorf("router.AddNamespace %s: func handler: %w", ns, err)
+	}
+
+	// ts.funcInformer and resolver.funcInformer are the same map reference —
+	// updating ts.funcInformer also makes the resolver aware of the new namespace.
+	ts.triggerInformer[ns] = triggerInf
+	ts.funcInformer[ns] = funcInf
+
+	mgr.AddInformers(ctx, map[string]k8sCache.SharedIndexInformer{
+		ns + "/trigger": triggerInf,
+		ns + "/func":    funcInf,
+	})
+	factory.Start(ctx.Done())
+	// Wait for cache to sync before rebuilding the router, so triggers are visible.
+	k8sCache.WaitForCacheSync(ctx.Done(), triggerInf.HasSynced, funcInf.HasSynced)
+
+	ts.logger.Info("router.AddNamespace: done", zap.String("namespace", ns))
+	ts.syncTriggers()
+	return nil
+}
@@ -0,0 +1,84 @@
+// Package router — NSWatcher for multi-tenant mode.
+//
+// Listens for Namespaces labeled fission.io/managed=true and calls
+// HTTPTriggerSet.AddNamespace so the router picks up HTTPTriggers and
+// Functions in tenant namespaces without a restart.
+package router
+
+import (
+	"context"
+	"time"
+
+	"go.uber.org/zap"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	k8sInformers "k8s.io/client-go/informers"
+	"k8s.io/client-go/kubernetes"
+	k8sCache "k8s.io/client-go/tools/cache"
+
+	"github.com/fission/fission/pkg/utils/manager"
+)
+
+const routerManagedNSLabel = "fission.io/managed"
+
+// StartNSWatcher registers a Kubernetes Namespace Informer for the router.
+// Whenever a Namespace with label fission.io/managed=true appears (or is relabeled),
+// the router immediately subscribes to HTTPTriggers and Functions in that namespace.
+func StartNSWatcher(
+	ctx context.Context,
+	logger *zap.Logger,
+	kubeClient kubernetes.Interface,
+	ts *HTTPTriggerSet,
+	mgr manager.Interface,
+) {
+	factory := k8sInformers.NewSharedInformerFactoryWithOptions(
+		kubeClient,
+		30*time.Minute,
+		k8sInformers.WithTweakListOptions(func(opts *metav1.ListOptions) {
+			opts.LabelSelector = routerManagedNSLabel + "=true"
+		}),
+	)
+
+	nsInformer := factory.Core().V1().Namespaces().Informer()
+
+	_, _ = nsInformer.AddEventHandler(k8sCache.ResourceEventHandlerFuncs{
+		AddFunc: func(obj interface{}) {
+			ns := routerNSName(obj)
+			if ns == "" {
+				return
+			}
+			if err := ts.AddNamespace(ctx, ns, mgr); err != nil {
+				logger.Error("router.NSWatcher: AddNamespace failed",
+					zap.String("namespace", ns), zap.Error(err))
+			}
+		},
+		UpdateFunc: func(_, newObj interface{}) {
+			nsObj, ok := newObj.(*corev1.Namespace)
+			if !ok || nsObj.Labels[routerManagedNSLabel] != "true" {
+				return
+			}
+			if err := ts.AddNamespace(ctx, nsObj.Name, mgr); err != nil {
+				logger.Error("router.NSWatcher: AddNamespace failed",
+					zap.String("namespace", nsObj.Name), zap.Error(err))
+			}
+		},
+	})
+
+	mgr.Add(ctx, func(ctx context.Context) {
+		logger.Info("router.NSWatcher: started",
+			zap.String("label", routerManagedNSLabel+"=true"))
+		factory.Start(ctx.Done())
+		factory.WaitForCacheSync(ctx.Done())
+		logger.Info("router.NSWatcher: cache synced — watching for new namespaces")
+		<-ctx.Done()
+		logger.Info("router.NSWatcher: stopped")
+	})
+}
+
+func routerNSName(obj interface{}) string {
+	nsObj, ok := obj.(*corev1.Namespace)
+	if !ok {
+		return ""
+	}
+	return nsObj.Name
+}
@@ -213,6 +213,10 @@ func Start(ctx context.Context, clientGen crd.ClientGeneratorInterface, logger *
 		metrics.ServeMetrics(ctx, "router", logger, mgr)
 	})

+	// Multi-tenant: watch namespaces labeled fission.io/managed=true
+	// and dynamically register HTTPTrigger/Function informers without restart.
+	StartNSWatcher(ctx, logger, kubeClient, triggers, mgr)
+
 	logger.Info("starting router", zap.Int("port", port))

 	tracer := otel.Tracer("router")