Nail/fission-src
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed: Allow to disable owner references for cross namespace access with builder and function namespace (#3024)

Browse Source 
* Add DISABLE_OWNER_REFERENCES env variable to executor and buildermgr deployment.
Use this env var to decide adding ownerReferences to K8s resources created by fission CRD.
* Resolve review comments
* Fix lint failure

---------

Signed-off-by: Md Soharab Ansari <soharab.ansari@infracloud.io>
This commit is contained in:
soharab-ic
2024-09-27 15:11:07 +05:30
committed by GitHub
parent b8f746cb98
commit 2bf00025ed
13 changed files with 155 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/executor/executortype/container/containermgr.go
+4
View File
@@ -88,6 +88,8 @@ type (
hpaops *hpautils.HpaOperations
objectReaperIntervalSecond time.Duration
enableOwnerReferences bool
}
)
@@ -131,6 +133,8 @@ func MakeContainer(
deplListerSynced: make(map[string]k8sCache.InformerSynced),
svcLister: make(map[string]corelisters.ServiceLister),
svcListerSynced: make(map[string]k8sCache.InformerSynced),
enableOwnerReferences: utils.IsOwnerReferencesEnabled(),
}
for ns, informerFactory := range cnmInformerFactory {
pkg/executor/executortype/container/deployment.go
+14 -10
View File
@@ -265,18 +265,22 @@ func (cn *Container) getDeploymentSpec(ctx context.Context, fn *fv1.Function, ta
pod.Spec = *(util.ApplyImagePullSecret("", pod.Spec))
var ownerReferences []metav1.OwnerReference
if cn.enableOwnerReferences {
ownerReferences = []metav1.OwnerReference{
*metav1.NewControllerRef(fn, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Function",
}),
}
}
deployment := &appsv1.Deployment{
ObjectMeta: metav1.ObjectMeta{
Name: deployName,
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: []metav1.OwnerReference{
*metav1.NewControllerRef(fn, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Function",
}),
},
Name: deployName,
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: ownerReferences,
},
Spec: appsv1.DeploymentSpec{
Replicas: &replicas,
pkg/executor/executortype/container/svc.go
+15 -10
View File
@@ -50,18 +50,23 @@ func (cn *Container) createOrGetSvc(ctx context.Context, fn *fv1.Function, deplo
return nil, err
}
logger := otelUtils.LoggerWithTraceID(ctx, cn.logger)
var ownerReferences []metav1.OwnerReference
if cn.enableOwnerReferences {
ownerReferences = []metav1.OwnerReference{
*metav1.NewControllerRef(fn, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Function",
}),
}
}
service := &apiv1.Service{
ObjectMeta: metav1.ObjectMeta{
Name: svcName,
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: []metav1.OwnerReference{
*metav1.NewControllerRef(fn, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Function",
}),
},
Name: svcName,
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: ownerReferences,
},
Spec: apiv1.ServiceSpec{
Ports: []apiv1.ServicePort{
pkg/executor/executortype/newdeploy/newdeploy.go
+30 -20
View File
@@ -246,18 +246,23 @@ func (deploy *NewDeploy) getDeploymentSpec(ctx context.Context, fn *fv1.Function
pod.Spec = *(util.ApplyImagePullSecret(env.Spec.ImagePullSecret, pod.Spec))
var ownerReferences []metav1.OwnerReference
if deploy.enableOwnerReferences {
ownerReferences = []metav1.OwnerReference{
*metav1.NewControllerRef(fn, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Function",
}),
}
}
deployment := &appsv1.Deployment{
ObjectMeta: metav1.ObjectMeta{
Name: deployName,
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: []metav1.OwnerReference{
*metav1.NewControllerRef(fn, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Function",
}),
},
Name: deployName,
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: ownerReferences,
},
Spec: appsv1.DeploymentSpec{
Replicas: &replicas,
@@ -334,18 +339,23 @@ func (deploy *NewDeploy) getResources(env *fv1.Environment, fn *fv1.Function) ap
func (deploy *NewDeploy) createOrGetSvc(ctx context.Context, fn *fv1.Function, deployLabels map[string]string, deployAnnotations map[string]string, svcName string, svcNamespace string) (*apiv1.Service, error) {
logger := otelUtils.LoggerWithTraceID(ctx, deploy.logger)
var ownerReferences []metav1.OwnerReference
if deploy.enableOwnerReferences {
ownerReferences = []metav1.OwnerReference{
*metav1.NewControllerRef(fn, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Function",
}),
}
}
service := &apiv1.Service{
ObjectMeta: metav1.ObjectMeta{
Name: svcName,
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: []metav1.OwnerReference{
*metav1.NewControllerRef(fn, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Function",
}),
},
Name: svcName,
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: ownerReferences,
},
Spec: apiv1.ServiceSpec{
Ports: []apiv1.ServicePort{
pkg/executor/executortype/newdeploy/newdeploymgr.go
+4
View File
@@ -92,6 +92,8 @@ type (
podSpecPatch *apiv1.PodSpec
objectReaperIntervalSecond time.Duration
enableOwnerReferences bool
}
)
@@ -139,6 +141,8 @@ func MakeNewDeploy(
deplListerSynced: make(map[string]k8sCache.InformerSynced),
svcLister: make(map[string]corelisters.ServiceLister),
svcListerSynced: make(map[string]k8sCache.InformerSynced),
enableOwnerReferences: utils.IsOwnerReferencesEnabled(),
}
for ns, informerFactory := range ndmInformerFactory {
pkg/executor/executortype/poolmgr/gp.go
+2
View File
@@ -79,6 +79,7 @@ type (
poolInstanceID string // small random string to uniquify pod names
instanceID string // poolmgr instance id
podSpecPatch *apiv1.PodSpec
enableOwnerReferences bool
// TODO: move this field into fsCache
podFSVCMap sync.Map
}
@@ -131,6 +132,7 @@ func MakeGenericPool(
instanceID: instanceID,
podFSVCMap: sync.Map{},
podSpecPatch: podSpecPatch,
enableOwnerReferences: utils.IsOwnerReferencesEnabled(),
lock: sync.Mutex{},
}
pkg/executor/executortype/poolmgr/gp_deployment.go
+11 -6
View File
@@ -59,17 +59,22 @@ func getPoolName(env *fv1.Environment) string {
func (gp *GenericPool) genDeploymentMeta(env *fv1.Environment) metav1.ObjectMeta {
deployLabels := gp.getEnvironmentPoolLabels(env)
deployAnnotations := gp.getDeployAnnotations(env)
return metav1.ObjectMeta{
Name: getPoolName(env),
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: []metav1.OwnerReference{
var ownerReferences []metav1.OwnerReference
if gp.enableOwnerReferences {
ownerReferences = []metav1.OwnerReference{
*metav1.NewControllerRef(env, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Environment",
}),
},
}
}
return metav1.ObjectMeta{
Name: getPoolName(env),
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: ownerReferences,
}
}
pkg/executor/util/hpa/hpa.go
+24 -16
View File
@@ -29,6 +29,7 @@ import (
"k8s.io/client-go/kubernetes"
fv1 "github.com/fission/fission/pkg/apis/core/v1"
"github.com/fission/fission/pkg/utils"
otelUtils "github.com/fission/fission/pkg/utils/otel"
)
@@ -39,16 +40,18 @@ const (
)
type HpaOperations struct {
logger *zap.Logger
kubernetesClient kubernetes.Interface
instanceID string
logger *zap.Logger
kubernetesClient kubernetes.Interface
instanceID string
enableOwnerReferences bool
}
func NewHpaOperations(logger *zap.Logger, kubernetesClient kubernetes.Interface, instanceID string) *HpaOperations {
return &HpaOperations{
logger: logger,
kubernetesClient: kubernetesClient,
instanceID: instanceID,
logger: logger,
kubernetesClient: kubernetesClient,
instanceID: instanceID,
enableOwnerReferences: utils.IsOwnerReferencesEnabled(),
}
}
@@ -99,18 +102,23 @@ func (hpaops *HpaOperations) CreateOrGetHpa(ctx context.Context, fn *fv1.Functio
hpaMetrics = append(hpaMetrics, execStrategy.Metrics...)
}
var ownerReferences []metav1.OwnerReference
if hpaops.enableOwnerReferences {
ownerReferences = []metav1.OwnerReference{
*metav1.NewControllerRef(fn, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Function",
}),
}
}
hpa := &asv2.HorizontalPodAutoscaler{
ObjectMeta: metav1.ObjectMeta{
Name: hpaName,
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: []metav1.OwnerReference{
*metav1.NewControllerRef(fn, schema.GroupVersionKind{
Group: "fission.io",
Version: "v1",
Kind: "Function",
}),
},
Name: hpaName,
Labels: deployLabels,
Annotations: deployAnnotations,
OwnerReferences: ownerReferences,
},
Spec: asv2.HorizontalPodAutoscalerSpec{
ScaleTargetRef: getScaleTargetRef(depl),