Nail/fission-src
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed: Allow to disable owner references for cross namespace access with builder and function namespace (#3024)

Browse Source 
* Add DISABLE_OWNER_REFERENCES env variable to executor and buildermgr deployment.
Use this env var to decide adding ownerReferences to K8s resources created by fission CRD.
* Resolve review comments
* Fix lint failure

---------

Signed-off-by: Md Soharab Ansari <soharab.ansari@infracloud.io>
This commit is contained in:
soharab-ic
2024-09-27 15:11:07 +05:30
committed by GitHub
parent b8f746cb98
commit 2bf00025ed
13 changed files with 155 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/fission-all/templates/buildermgr/deployment.yaml
+2
View File
@@ -51,6 +51,8 @@ spec:
value: {{ .Values.fetcher.resource.mem.limits | quote }}
- name: DEBUG_ENV
value: {{ .Values.debugEnv | quote }}
- name: DISABLE_OWNER_REFERENCES
value: {{ .Values.disableOwnerReference | quote }}
- name: PPROF_ENABLED
value: {{ .Values.pprof.enabled | quote }}
- name: HELM_RELEASE_NAME
charts/fission-all/templates/executor/deployment.yaml
+2
View File
@@ -76,6 +76,8 @@ spec:
value: {{ .Values.executor.serviceAccountCheck.enabled | quote }}
- name: SERVICEACCOUNT_CHECK_INTERVAL
value: {{ .Values.executor.serviceAccountCheck.interval | quote }}
- name: DISABLE_OWNER_REFERENCES
value: {{ .Values.disableOwnerReference | quote }}
{{- end}}
{{- include "fission-resource-namespace.envs" . | indent 8 }}
{{- include "kube_client.envs" . | indent 8 }}
charts/fission-all/values.yaml
+7
View File
@@ -88,6 +88,13 @@ additionalFissionNamespaces: []
##
createNamespace: true
## disableOwnerReference decides to set OwnerReference to K8s resources like deployment, services, hpa etc. created by Fission.
## If set to true, the K8s resources created by Fission will not have OwnerReference set.
## Set to false if you want to add OwnerReference to K8s resources created by Fission.
##
## Set to true if you are using cross namespace meaning `builderNamespace` and `functionNamespace` are set.
disableOwnerReference: false
## enableIstio indicates whether to enable istio integration.
##
enableIstio: false
pkg/buildermgr/envwatcher.go
+31 -20
View File
@@ -74,6 +74,7 @@ type (
useIstio bool
podSpecPatch *apiv1.PodSpec
envWatchInformer map[string]k8sCache.SharedIndexInformer
enableOwnerReferences bool
}
)
@@ -108,6 +109,7 @@ func makeEnvironmentWatcher(
fetcherConfig: fetcherConfig,
podSpecPatch: podSpecPatch,
envWatchInformer: utils.GetInformersForNamespaces(fissionClient, time.Minute*30, fv1.EnvironmentResource),
enableOwnerReferences: utils.IsOwnerReferencesEnabled(),
}
err := envWatcher.EnvWatchEventHandlers(ctx)
@@ -325,18 +327,22 @@ func (envw *environmentWatcher) getBuilderServiceList(ctx context.Context, sel m
func (envw *environmentWatcher) createBuilderService(ctx context.Context, env *fv1.Environment, ns string) (*apiv1.Service, error) {
name := fmt.Sprintf("%v-%v", env.ObjectMeta.Name, env.ObjectMeta.ResourceVersion)
sel := envw.getLabels(env.ObjectMeta.Name, ns, env.ObjectMeta.ResourceVersion)
var ownerReferences []metav1.OwnerReference
if envw.enableOwnerReferences {
ownerReferences = []metav1.OwnerReference{
*metav1.NewControllerRef(env, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Environment",
}),
}
}
service := apiv1.Service{
ObjectMeta: metav1.ObjectMeta{
Namespace: ns,
Name: name,
Labels: sel,
OwnerReferences: []metav1.OwnerReference{
*metav1.NewControllerRef(env, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Environment",
}),
},
Namespace: ns,
Name: name,
Labels: sel,
OwnerReferences: ownerReferences,
},
Spec: apiv1.ServiceSpec{
Selector: sel,
@@ -443,18 +449,23 @@ func (envw *environmentWatcher) createBuilderDeployment(ctx context.Context, env
pod.Spec = *(util.ApplyImagePullSecret(env.Spec.ImagePullSecret, pod.Spec))
var ownerReferences []metav1.OwnerReference
if envw.enableOwnerReferences {
ownerReferences = []metav1.OwnerReference{
*metav1.NewControllerRef(env, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Environment",
}),
}
}
deployment := &appsv1.Deployment{
ObjectMeta: metav1.ObjectMeta{
Namespace: ns,
Name: name,
Labels: sel,
OwnerReferences: []metav1.OwnerReference{
*metav1.NewControllerRef(env, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Environment",
}),
},
Namespace: ns,
Name: name,
Labels: sel,
OwnerReferences: ownerReferences,
},
Spec: appsv1.DeploymentSpec{
Replicas: &replicas,
pkg/executor/executortype/container/containermgr.go
+4
View File
@@ -88,6 +88,8 @@ type (
hpaops *hpautils.HpaOperations
objectReaperIntervalSecond time.Duration
enableOwnerReferences bool
}
)
@@ -131,6 +133,8 @@ func MakeContainer(
deplListerSynced: make(map[string]k8sCache.InformerSynced),
svcLister: make(map[string]corelisters.ServiceLister),
svcListerSynced: make(map[string]k8sCache.InformerSynced),
enableOwnerReferences: utils.IsOwnerReferencesEnabled(),
}
for ns, informerFactory := range cnmInformerFactory {
pkg/executor/executortype/container/deployment.go
+14 -10
View File
@@ -265,18 +265,22 @@ func (cn *Container) getDeploymentSpec(ctx context.Context, fn *fv1.Function, ta
pod.Spec = *(util.ApplyImagePullSecret("", pod.Spec))
var ownerReferences []metav1.OwnerReference
if cn.enableOwnerReferences {
ownerReferences = []metav1.OwnerReference{
*metav1.NewControllerRef(fn, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Function",
}),
}
}
deployment := &appsv1.Deployment{
ObjectMeta: metav1.ObjectMeta{
Name: deployName,
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: []metav1.OwnerReference{
*metav1.NewControllerRef(fn, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Function",
}),
},
Name: deployName,
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: ownerReferences,
},
Spec: appsv1.DeploymentSpec{
Replicas: &replicas,
pkg/executor/executortype/container/svc.go
+15 -10
View File
@@ -50,18 +50,23 @@ func (cn *Container) createOrGetSvc(ctx context.Context, fn *fv1.Function, deplo
return nil, err
}
logger := otelUtils.LoggerWithTraceID(ctx, cn.logger)
var ownerReferences []metav1.OwnerReference
if cn.enableOwnerReferences {
ownerReferences = []metav1.OwnerReference{
*metav1.NewControllerRef(fn, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Function",
}),
}
}
service := &apiv1.Service{
ObjectMeta: metav1.ObjectMeta{
Name: svcName,
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: []metav1.OwnerReference{
*metav1.NewControllerRef(fn, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Function",
}),
},
Name: svcName,
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: ownerReferences,
},
Spec: apiv1.ServiceSpec{
Ports: []apiv1.ServicePort{
pkg/executor/executortype/newdeploy/newdeploy.go
+30 -20
View File
@@ -246,18 +246,23 @@ func (deploy *NewDeploy) getDeploymentSpec(ctx context.Context, fn *fv1.Function
pod.Spec = *(util.ApplyImagePullSecret(env.Spec.ImagePullSecret, pod.Spec))
var ownerReferences []metav1.OwnerReference
if deploy.enableOwnerReferences {
ownerReferences = []metav1.OwnerReference{
*metav1.NewControllerRef(fn, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Function",
}),
}
}
deployment := &appsv1.Deployment{
ObjectMeta: metav1.ObjectMeta{
Name: deployName,
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: []metav1.OwnerReference{
*metav1.NewControllerRef(fn, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Function",
}),
},
Name: deployName,
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: ownerReferences,
},
Spec: appsv1.DeploymentSpec{
Replicas: &replicas,
@@ -334,18 +339,23 @@ func (deploy *NewDeploy) getResources(env *fv1.Environment, fn *fv1.Function) ap
func (deploy *NewDeploy) createOrGetSvc(ctx context.Context, fn *fv1.Function, deployLabels map[string]string, deployAnnotations map[string]string, svcName string, svcNamespace string) (*apiv1.Service, error) {
logger := otelUtils.LoggerWithTraceID(ctx, deploy.logger)
var ownerReferences []metav1.OwnerReference
if deploy.enableOwnerReferences {
ownerReferences = []metav1.OwnerReference{
*metav1.NewControllerRef(fn, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Function",
}),
}
}
service := &apiv1.Service{
ObjectMeta: metav1.ObjectMeta{
Name: svcName,
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: []metav1.OwnerReference{
*metav1.NewControllerRef(fn, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Function",
}),
},
Name: svcName,
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: ownerReferences,
},
Spec: apiv1.ServiceSpec{
Ports: []apiv1.ServicePort{
pkg/executor/executortype/newdeploy/newdeploymgr.go
+4
View File
@@ -92,6 +92,8 @@ type (
podSpecPatch *apiv1.PodSpec
objectReaperIntervalSecond time.Duration
enableOwnerReferences bool
}
)
@@ -139,6 +141,8 @@ func MakeNewDeploy(
deplListerSynced: make(map[string]k8sCache.InformerSynced),
svcLister: make(map[string]corelisters.ServiceLister),
svcListerSynced: make(map[string]k8sCache.InformerSynced),
enableOwnerReferences: utils.IsOwnerReferencesEnabled(),
}
for ns, informerFactory := range ndmInformerFactory {
pkg/executor/executortype/poolmgr/gp.go
+2
View File
@@ -79,6 +79,7 @@ type (
poolInstanceID string // small random string to uniquify pod names
instanceID string // poolmgr instance id
podSpecPatch *apiv1.PodSpec
enableOwnerReferences bool
// TODO: move this field into fsCache
podFSVCMap sync.Map
}
@@ -131,6 +132,7 @@ func MakeGenericPool(
instanceID: instanceID,
podFSVCMap: sync.Map{},
podSpecPatch: podSpecPatch,
enableOwnerReferences: utils.IsOwnerReferencesEnabled(),
lock: sync.Mutex{},
}
pkg/executor/executortype/poolmgr/gp_deployment.go
+11 -6
View File
@@ -59,17 +59,22 @@ func getPoolName(env *fv1.Environment) string {
func (gp *GenericPool) genDeploymentMeta(env *fv1.Environment) metav1.ObjectMeta {
deployLabels := gp.getEnvironmentPoolLabels(env)
deployAnnotations := gp.getDeployAnnotations(env)
return metav1.ObjectMeta{
Name: getPoolName(env),
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: []metav1.OwnerReference{
var ownerReferences []metav1.OwnerReference
if gp.enableOwnerReferences {
ownerReferences = []metav1.OwnerReference{
*metav1.NewControllerRef(env, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Environment",
}),
},
}
}
return metav1.ObjectMeta{
Name: getPoolName(env),
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: ownerReferences,
}
}
pkg/executor/util/hpa/hpa.go
+24 -16
View File
@@ -29,6 +29,7 @@ import (
"k8s.io/client-go/kubernetes"
fv1 "github.com/fission/fission/pkg/apis/core/v1"
"github.com/fission/fission/pkg/utils"
otelUtils "github.com/fission/fission/pkg/utils/otel"
)
@@ -39,16 +40,18 @@ const (
)
type HpaOperations struct {
logger *zap.Logger
kubernetesClient kubernetes.Interface
instanceID string
logger *zap.Logger
kubernetesClient kubernetes.Interface
instanceID string
enableOwnerReferences bool
}
func NewHpaOperations(logger *zap.Logger, kubernetesClient kubernetes.Interface, instanceID string) *HpaOperations {
return &HpaOperations{
logger: logger,
kubernetesClient: kubernetesClient,
instanceID: instanceID,
logger: logger,
kubernetesClient: kubernetesClient,
instanceID: instanceID,
enableOwnerReferences: utils.IsOwnerReferencesEnabled(),
}
}
@@ -99,18 +102,23 @@ func (hpaops *HpaOperations) CreateOrGetHpa(ctx context.Context, fn *fv1.Functio
hpaMetrics = append(hpaMetrics, execStrategy.Metrics...)
}
var ownerReferences []metav1.OwnerReference
if hpaops.enableOwnerReferences {
ownerReferences = []metav1.OwnerReference{
*metav1.NewControllerRef(fn, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Function",
}),
}
}
hpa := &asv2.HorizontalPodAutoscaler{
ObjectMeta: metav1.ObjectMeta{
Name: hpaName,
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: []metav1.OwnerReference{
*metav1.NewControllerRef(fn, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Function",
}),
},
Name: hpaName,
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: ownerReferences,
},
Spec: asv2.HorizontalPodAutoscalerSpec{
ScaleTargetRef: getScaleTargetRef(depl),
pkg/utils/utils.go
+9
View File
@@ -39,6 +39,10 @@ import (
"github.com/fission/fission/pkg/utils/uuid"
)
const (
ENV_DISABLE_OWNER_REFERENCES string = "DISABLE_OWNER_REFERENCES"
)
func UrlForFunction(name, namespace string) string {
prefix := "/fission-function"
if namespace != metav1.NamespaceDefault {
@@ -296,3 +300,8 @@ func DeleteOldPackages(pkgPath, pkgType string) error {
return nil
}
func IsOwnerReferencesEnabled() bool {
disableOwnerReference, _ := strconv.ParseBool(os.Getenv(ENV_DISABLE_OWNER_REFERENCES))
return !disableOwnerReference
}