Move packages to proejct/pkg to follow go project folder structure convention (#1190)
This commit is contained in:
Ta-Ching Chen
@@ -0,0 +1,294 @@
|
||||
/*
|
||||
Copyright 2016 The Fission Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package utils
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
"go.uber.org/zap"
|
||||
|
||||
"github.com/pkg/errors"
|
||||
apiv1 "k8s.io/api/core/v1"
|
||||
rbac "k8s.io/api/rbac/v1beta1"
|
||||
k8serrors "k8s.io/apimachinery/pkg/api/errors"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
"k8s.io/apimachinery/pkg/util/json"
|
||||
"k8s.io/client-go/kubernetes"
|
||||
)
|
||||
|
||||
// This file has util functions needed for setting up and cleaning up RBAC objects.
|
||||
|
||||
const (
|
||||
maxRetries = 10
|
||||
)
|
||||
|
||||
// MakeSAObj returns a ServiceAccount object with the given SA name and namespace
|
||||
func MakeSAObj(sa, ns string) *apiv1.ServiceAccount {
|
||||
return &apiv1.ServiceAccount{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Namespace: ns,
|
||||
Name: sa,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// SetupSA checks if a service account is present in the namespace, if not creates it.
|
||||
func SetupSA(k8sClient *kubernetes.Clientset, sa, ns string) (*apiv1.ServiceAccount, error) {
|
||||
saObj, err := k8sClient.CoreV1().ServiceAccounts(ns).Get(sa, metav1.GetOptions{})
|
||||
if err == nil {
|
||||
return saObj, nil
|
||||
}
|
||||
|
||||
if k8serrors.IsNotFound(err) {
|
||||
saObj = MakeSAObj(sa, ns)
|
||||
saObj, err = k8sClient.CoreV1().ServiceAccounts(ns).Create(saObj)
|
||||
}
|
||||
|
||||
return saObj, err
|
||||
}
|
||||
|
||||
// makeRoleBindingObj is a helper function called from other functions in this file only.
|
||||
// given a rolebinging name and namespace, it makes a rolebinding object mapping the role to the SA of the namespace.
|
||||
func makeRoleBindingObj(roleBinding, roleBindingNs, role, roleKind, sa, saNamespace string) *rbac.RoleBinding {
|
||||
return &rbac.RoleBinding{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: roleBinding,
|
||||
Namespace: roleBindingNs,
|
||||
},
|
||||
Subjects: []rbac.Subject{
|
||||
{
|
||||
Kind: "ServiceAccount",
|
||||
Name: sa,
|
||||
Namespace: saNamespace,
|
||||
},
|
||||
},
|
||||
RoleRef: rbac.RoleRef{
|
||||
Kind: roleKind,
|
||||
Name: role,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// isSAInRoleBinding checkis if a service account is present in the rolebinding object
|
||||
func isSAInRoleBinding(rbObj *rbac.RoleBinding, sa, ns string) bool {
|
||||
for _, subject := range rbObj.Subjects {
|
||||
if subject.Name == sa && subject.Namespace == ns {
|
||||
return true
|
||||
}
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
// PatchSpec is a standard struct needed for JSON merge.
|
||||
type PatchSpec struct {
|
||||
Op string `json:"op"`
|
||||
Path string `json:"path"`
|
||||
Value rbac.Subject `json:"value"`
|
||||
}
|
||||
|
||||
// AddSaToRoleBindingWithRetries adds a service account to a rolebinding object. IT retries on already exists and conflict errors.
|
||||
func AddSaToRoleBindingWithRetries(logger *zap.Logger, k8sClient *kubernetes.Clientset, roleBinding, roleBindingNs, sa, saNamespace, role, roleKind string) (err error) {
|
||||
patch := PatchSpec{}
|
||||
patch.Op = "add"
|
||||
patch.Path = "/subjects/-"
|
||||
patch.Value = rbac.Subject{
|
||||
Kind: "ServiceAccount",
|
||||
Name: sa,
|
||||
Namespace: saNamespace,
|
||||
}
|
||||
|
||||
patchJson, err := json.Marshal([]PatchSpec{patch})
|
||||
if err != nil {
|
||||
logger.Error("error marshalling patch into json", zap.Error(err))
|
||||
return err
|
||||
}
|
||||
|
||||
for i := 0; i < maxRetries; i++ {
|
||||
_, err = k8sClient.RbacV1beta1().RoleBindings(roleBindingNs).Patch(roleBinding, types.JSONPatchType, patchJson)
|
||||
if err == nil {
|
||||
logger.Debug("patched rolebinding",
|
||||
zap.String("role_binding", roleBinding),
|
||||
zap.String("role_binding_namespace", roleBindingNs))
|
||||
return err
|
||||
}
|
||||
|
||||
if k8serrors.IsNotFound(err) {
|
||||
logger.Error("rolebinding not found - will try to create it",
|
||||
zap.Error(err),
|
||||
zap.String("role_binding", roleBinding),
|
||||
zap.String("role_binding_namespace", roleBindingNs))
|
||||
// someone may have deleted the object between us checking if the object is present and deciding to patch
|
||||
// so just create the object again
|
||||
rbObj := makeRoleBindingObj(roleBinding, roleBindingNs, role, roleKind, sa, saNamespace)
|
||||
rbObj, err = k8sClient.RbacV1beta1().RoleBindings(roleBindingNs).Create(rbObj)
|
||||
if err == nil {
|
||||
logger.Info("created rolebinding",
|
||||
zap.String("role_binding", roleBinding),
|
||||
zap.String("role_binding_namespace", roleBindingNs))
|
||||
return err
|
||||
}
|
||||
|
||||
if k8serrors.IsAlreadyExists(err) {
|
||||
logger.Error("rolebinding object already exists, retrying patch",
|
||||
zap.Error(err),
|
||||
zap.String("role_binding", roleBinding),
|
||||
zap.String("role_binding_namespace", roleBindingNs))
|
||||
continue
|
||||
}
|
||||
|
||||
return errors.Wrap(err, "error returned by rolebinding create")
|
||||
}
|
||||
|
||||
if k8serrors.IsConflict(err) {
|
||||
// TODO : Need to test this out, not able to simulate conflicts yet.
|
||||
// Initially, my understanding was that patch can never error on conflict because Api server will handle the conflicts for us.
|
||||
// but one CI run did show patch errored out on conflict : https://api.travis-ci.org/v3/job/373161490/log.txt, look for :
|
||||
// Error returned by rolebinding patch : <some more text> there is a meaningful conflict (firstResourceVersion: "35482724", currentResourceVersion: "35482849")
|
||||
// so, m guessing retrying patch should help. will watch out for any such conflicts and fix the issue if any
|
||||
logger.Error("conflict reported on patch of rolebinding - retrying patch operation",
|
||||
zap.String("role_binding", roleBinding),
|
||||
zap.String("role_binding_namespace", roleBindingNs))
|
||||
continue
|
||||
}
|
||||
|
||||
return errors.Wrap(err, "error returned by rolebinding patch")
|
||||
}
|
||||
|
||||
return errors.Wrapf(err, "exceeded max retries (%d) adding SA: %s.%s to rolebinding: %s.%s, giving up", maxRetries, sa, saNamespace, roleBinding, roleBindingNs)
|
||||
}
|
||||
|
||||
// RemoveSAFromRoleBindingWithRetries removes an SA from the rolebinding passed as parameter. If this is the only SA in
|
||||
// the rolebinding, then it deletes the rolebinding object.
|
||||
func RemoveSAFromRoleBindingWithRetries(logger *zap.Logger, k8sClient *kubernetes.Clientset, roleBinding, roleBindingNs string, saToRemove map[string]bool) (err error) {
|
||||
for i := 0; i < maxRetries; i++ {
|
||||
rbObj, err := k8sClient.RbacV1beta1().RoleBindings(roleBindingNs).Get(
|
||||
roleBinding, metav1.GetOptions{})
|
||||
if err != nil {
|
||||
// silently ignoring the error. there's no need for us to remove sa anymore.
|
||||
logger.Info("rolebinding not found, but ignoring the error since we're cleaning up",
|
||||
zap.Error(err),
|
||||
zap.String("role_binding", roleBinding),
|
||||
zap.String("role_binding_namespace", roleBindingNs))
|
||||
return nil
|
||||
}
|
||||
|
||||
subjects := rbObj.Subjects
|
||||
newSubjects := make([]rbac.Subject, 0)
|
||||
|
||||
// TODO : optimize it.
|
||||
for _, item := range subjects {
|
||||
if _, ok := saToRemove[MakeSAMapKey(item.Name, item.Namespace)]; ok {
|
||||
continue
|
||||
}
|
||||
|
||||
newSubjects = append(newSubjects, rbac.Subject{
|
||||
Kind: "ServiceAccount",
|
||||
Name: item.Name,
|
||||
Namespace: item.Namespace,
|
||||
})
|
||||
}
|
||||
if len(newSubjects) == 0 {
|
||||
return DeleteRoleBinding(k8sClient, roleBinding, roleBindingNs)
|
||||
}
|
||||
|
||||
rbObj.Subjects = newSubjects
|
||||
|
||||
// cant use patch for deletes, the results become in-deterministic, so using update.
|
||||
_, err = k8sClient.RbacV1beta1().RoleBindings(rbObj.Namespace).Update(rbObj)
|
||||
switch {
|
||||
case err == nil:
|
||||
logger.Info("removed service accounts from rolebinding",
|
||||
zap.Any("service_accounts", saToRemove),
|
||||
zap.String("role_binding", roleBinding),
|
||||
zap.String("role_binding_namespace", roleBindingNs))
|
||||
return nil
|
||||
case k8serrors.IsConflict(err):
|
||||
logger.Info("conflict in update of rolebinding - retrying",
|
||||
zap.Error(err),
|
||||
zap.String("role_binding", roleBinding),
|
||||
zap.String("role_binding_namespace", roleBindingNs))
|
||||
continue
|
||||
default:
|
||||
return errors.Wrap(err, "rolebinding update errored out")
|
||||
}
|
||||
}
|
||||
|
||||
return errors.Wrapf(err, "max retries: %d exceeded for removing SA's: %v from rolebinding %s.%s, giving up", maxRetries, saToRemove, roleBinding, roleBindingNs)
|
||||
}
|
||||
|
||||
// SetupRoleBinding adds a role to a service account if the rolebinding object is already present in the namespace.
|
||||
// if not, it creates a rolebinding object granting the role to the SA in the namespace.
|
||||
func SetupRoleBinding(logger *zap.Logger, k8sClient *kubernetes.Clientset, roleBinding, roleBindingNs, role, roleKind, sa, saNamespace string) error {
|
||||
// get the role binding object
|
||||
rbObj, err := k8sClient.RbacV1beta1().RoleBindings(roleBindingNs).Get(
|
||||
roleBinding, metav1.GetOptions{})
|
||||
|
||||
if err == nil {
|
||||
if !isSAInRoleBinding(rbObj, sa, saNamespace) {
|
||||
logger.Info("service account is not present in the rolebinding - will add",
|
||||
zap.String("service_account_name", sa),
|
||||
zap.String("service_account_namespace", saNamespace),
|
||||
zap.String("role_binding", roleBinding),
|
||||
zap.String("role_binding_namespace", roleBindingNs))
|
||||
return AddSaToRoleBindingWithRetries(logger, k8sClient, roleBinding, roleBindingNs, sa, saNamespace, role, roleKind)
|
||||
}
|
||||
logger.Info("service account already present in rolebinding so nothing to add",
|
||||
zap.String("service_account_name", sa),
|
||||
zap.String("service_account_namespace", saNamespace),
|
||||
zap.String("role_binding", roleBinding),
|
||||
zap.String("role_binding_namespace", roleBindingNs))
|
||||
return nil
|
||||
}
|
||||
|
||||
// if role binding is missing, create it. also add this sa to the binding.
|
||||
if k8serrors.IsNotFound(err) {
|
||||
logger.Info("rolebinding does NOT exist in namespace - creating it",
|
||||
zap.Error(err),
|
||||
zap.String("role_binding", roleBinding),
|
||||
zap.String("role_binding_namespace", roleBindingNs))
|
||||
rbObj = makeRoleBindingObj(roleBinding, roleBindingNs, role, roleKind, sa, saNamespace)
|
||||
rbObj, err = k8sClient.RbacV1beta1().RoleBindings(roleBindingNs).Create(rbObj)
|
||||
if k8serrors.IsAlreadyExists(err) {
|
||||
logger.Info("rolebinding already exists in namespace - adding service account to rolebinding",
|
||||
zap.String("service_account_name", sa),
|
||||
zap.String("service_account_namespace", saNamespace),
|
||||
zap.String("role_binding", roleBinding),
|
||||
zap.String("role_binding_namespace", roleBindingNs))
|
||||
err = AddSaToRoleBindingWithRetries(logger, k8sClient, roleBinding, roleBindingNs, sa, saNamespace, role, roleKind)
|
||||
}
|
||||
}
|
||||
|
||||
return err
|
||||
}
|
||||
|
||||
// DeleteRoleBinding deletes a rolebinding object. if k8s throws an error that the rolebinding is not there, it just
|
||||
// returns silently.
|
||||
func DeleteRoleBinding(k8sClient *kubernetes.Clientset, roleBinding, roleBindingNs string) error {
|
||||
// if deleteRoleBinding is invoked by 2 fission services at the same time for the same rolebinding,
|
||||
// the first call will succeed while the 2nd will fail with isNotFound. but we dont want to error out then.
|
||||
err := k8sClient.RbacV1beta1().RoleBindings(roleBindingNs).Delete(roleBinding, &metav1.DeleteOptions{})
|
||||
if err == nil || k8serrors.IsNotFound(err) {
|
||||
return nil
|
||||
}
|
||||
return err
|
||||
}
|
||||
|
||||
func MakeSAMapKey(saName, saNamespace string) string {
|
||||
return fmt.Sprintf("%s-%s", saName, saNamespace)
|
||||
}
|
||||
@@ -0,0 +1,211 @@
|
||||
/*
|
||||
Copyright 2016 The Fission Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package utils
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"io"
|
||||
"io/ioutil"
|
||||
"net"
|
||||
"net/http"
|
||||
"os"
|
||||
"os/signal"
|
||||
"path/filepath"
|
||||
"runtime/debug"
|
||||
"strings"
|
||||
"syscall"
|
||||
|
||||
"github.com/gorilla/handlers"
|
||||
"github.com/mholt/archiver"
|
||||
uuid "github.com/satori/go.uuid"
|
||||
"go.uber.org/zap"
|
||||
apiv1 "k8s.io/api/core/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
)
|
||||
|
||||
func UrlForFunction(name, namespace string) string {
|
||||
prefix := "/fission-function"
|
||||
if namespace != metav1.NamespaceDefault {
|
||||
prefix = fmt.Sprintf("/fission-function/%s", namespace)
|
||||
}
|
||||
return fmt.Sprintf("%v/%v", prefix, name)
|
||||
}
|
||||
|
||||
func SetupStackTraceHandler() {
|
||||
// register signal handler for dumping stack trace.
|
||||
c := make(chan os.Signal, 1)
|
||||
signal.Notify(c, syscall.SIGTERM)
|
||||
go func() {
|
||||
<-c
|
||||
fmt.Println("Received SIGTERM : Dumping stack trace")
|
||||
debug.PrintStack()
|
||||
os.Exit(1)
|
||||
}()
|
||||
}
|
||||
|
||||
// IsNetworkError returns true if an error is a network error, and false otherwise.
|
||||
func IsNetworkError(err error) bool {
|
||||
_, ok := err.(net.Error)
|
||||
return ok
|
||||
}
|
||||
|
||||
// GetFunctionIstioServiceName return service name of function for istio feature
|
||||
func GetFunctionIstioServiceName(fnName, fnNamespace string) string {
|
||||
return fmt.Sprintf("istio-%v-%v", fnName, fnNamespace)
|
||||
}
|
||||
|
||||
func LoggingMiddleware(logger *zap.Logger) func(next http.Handler) http.Handler {
|
||||
return func(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
requestURI := r.RequestURI
|
||||
if !strings.Contains(requestURI, "healthz") {
|
||||
// Call the next handler, which can be another middleware in the chain, or the final handler.
|
||||
handlers.CustomLoggingHandler(os.Stdout, next, func(writer io.Writer, params handlers.LogFormatterParams) {
|
||||
host, _, err := net.SplitHostPort(params.Request.RemoteAddr)
|
||||
|
||||
if err != nil {
|
||||
host = params.Request.RemoteAddr
|
||||
}
|
||||
|
||||
logger.Info("handled",
|
||||
zap.String("host", host),
|
||||
zap.String("method", params.Request.Method),
|
||||
zap.String("uri", params.Request.RequestURI),
|
||||
zap.String("proto", params.Request.Proto),
|
||||
zap.Int("status_code", params.StatusCode),
|
||||
zap.Int("size", params.Size))
|
||||
|
||||
}).ServeHTTP(w, r)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// IsNetworkDialError returns true if its a network dial error
|
||||
func IsNetworkDialError(err error) bool {
|
||||
netErr, ok := err.(net.Error)
|
||||
if !ok {
|
||||
return false
|
||||
}
|
||||
netOpErr, ok := netErr.(*net.OpError)
|
||||
if !ok {
|
||||
return false
|
||||
}
|
||||
if netOpErr.Op == "dial" {
|
||||
return true
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// IsReadyPod checks both all containers in a pod are ready and whether
|
||||
// the .metadata.DeletionTimestamp is nil.
|
||||
func IsReadyPod(pod *apiv1.Pod) bool {
|
||||
// since its a utility function, just ensuring there is no nil pointer exception
|
||||
if pod == nil {
|
||||
return false
|
||||
}
|
||||
|
||||
// pod is not in Running Phase. It can be in Pending,
|
||||
// Succeeded, Failed, Unknown. In some cases the pod can be in
|
||||
// different sate than Running, for example Kubernetes sets a
|
||||
// pod to Termination while k8s waits for the grace period of
|
||||
// the pod, even if all the containers are in Ready state.
|
||||
if pod.Status.Phase != apiv1.PodRunning {
|
||||
return false
|
||||
}
|
||||
|
||||
// pod is in "Terminating" status if deletionTimestamp is not nil
|
||||
// https://github.com/kubernetes/kubernetes/issues/61376
|
||||
if pod.ObjectMeta.DeletionTimestamp != nil {
|
||||
return false
|
||||
}
|
||||
|
||||
// pod does not have an IP address allocated to it yet
|
||||
if pod.Status.PodIP == "" {
|
||||
return false
|
||||
}
|
||||
|
||||
for _, cStatus := range pod.Status.ContainerStatuses {
|
||||
if !cStatus.Ready {
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
return true
|
||||
}
|
||||
|
||||
// GetTempDir creates and return a temporary directory
|
||||
func GetTempDir() (string, error) {
|
||||
tmpDir := uuid.NewV4().String()
|
||||
dir, err := ioutil.TempDir("", tmpDir)
|
||||
return dir, err
|
||||
}
|
||||
|
||||
// FindAllGlobs returns a list of globs of input list.
|
||||
func FindAllGlobs(inputList []string) ([]string, error) {
|
||||
files := make([]string, 0)
|
||||
for _, glob := range inputList {
|
||||
f, err := filepath.Glob(glob)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("Invalid glob %v: %v", glob, err)
|
||||
}
|
||||
files = append(files, f...)
|
||||
}
|
||||
return files, nil
|
||||
}
|
||||
|
||||
func MakeArchive(targetName string, globs ...string) (string, error) {
|
||||
files, err := FindAllGlobs(globs)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
// zip up the file list
|
||||
err = archiver.Zip.Make(targetName, files)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
return filepath.Abs(targetName)
|
||||
}
|
||||
|
||||
// RemoveZeroBytes remove empty byte(\x00) from input byte slice and return a new byte slice
|
||||
// This function is trying to fix the problem that empty byte will fail os.Openfile
|
||||
// For more information, please visit:
|
||||
// 1. https://github.com/golang/go/issues/24195
|
||||
// 2. https://play.golang.org/p/5F9ykC2tlbc
|
||||
func RemoveZeroBytes(src []byte) []byte {
|
||||
var bs []byte
|
||||
for _, v := range src {
|
||||
if v != 0 {
|
||||
bs = append(bs, v)
|
||||
}
|
||||
}
|
||||
return bs
|
||||
}
|
||||
|
||||
// GetImagePullPolicy returns the image pull policy base on the input value.
|
||||
func GetImagePullPolicy(policy string) apiv1.PullPolicy {
|
||||
switch policy {
|
||||
case "Always":
|
||||
return apiv1.PullAlways
|
||||
case "Never":
|
||||
return apiv1.PullNever
|
||||
default:
|
||||
return apiv1.PullIfNotPresent
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user