Skip to content

Commit f022305

Browse files
openshift-merge-robotopenshift-merge-robot
authored
Merge pull request #75 from stlaz/psa_syncer
Bug 2086519: Introduce Pod Security Admission Label Synchronization controller
2 parents b0376b1 + 2b3ea80 commit f022305

File tree

82 files changed

+17577
-380
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

82 files changed

+17577
-380
lines changed

‎go.mod

+4-1
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,14 @@ go 1.18
55
require (
66
github.com/davecgh/go-spew v1.1.1
77
github.com/go-bindata/go-bindata v3.1.2+incompatible
8+
github.com/google/go-cmp v0.5.5
89
github.com/openshift/api v0.0.0-20220525145417-ee5b62754c68
910
github.com/openshift/build-machinery-go v0.0.0-20211213093930-7e33a7eb4ce3
1011
github.com/openshift/client-go v0.0.0-20220525160904-9e1acff93e4a
1112
github.com/openshift/library-go v0.0.0-20220525173854-9b950a41acdc
1213
github.com/prometheus/client_golang v1.12.1
1314
github.com/spf13/cobra v1.4.0
15+
github.com/stretchr/testify v1.7.0
1416
k8s.io/api v0.24.0
1517
k8s.io/apimachinery v0.24.0
1618
k8s.io/apiserver v0.24.0
@@ -19,6 +21,7 @@ require (
1921
k8s.io/controller-manager v0.24.0
2022
k8s.io/klog/v2 v2.60.1
2123
k8s.io/kubernetes v1.24.0
24+
k8s.io/pod-security-admission v0.0.0
2225
)
2326

2427
require (
@@ -45,7 +48,6 @@ require (
4548
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
4649
github.com/golang/protobuf v1.5.2 // indirect
4750
github.com/google/gnostic v0.5.7-v3refs // indirect
48-
github.com/google/go-cmp v0.5.5 // indirect
4951
github.com/google/gofuzz v1.1.0 // indirect
5052
github.com/google/uuid v1.1.2 // indirect
5153
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
@@ -62,6 +64,7 @@ require (
6264
github.com/opencontainers/go-digest v1.0.0 // indirect
6365
github.com/pkg/errors v0.9.1 // indirect
6466
github.com/pkg/profile v1.3.0 // indirect
67+
github.com/pmezard/go-difflib v1.0.0 // indirect
6568
github.com/prometheus/client_model v0.2.0 // indirect
6669
github.com/prometheus/common v0.32.1 // indirect
6770
github.com/prometheus/procfs v0.7.3 // indirect

‎go.sum

+1
Original file line numberDiff line numberDiff line change
@@ -1219,6 +1219,7 @@ k8s.io/kubernetes v1.24.0/go.mod h1:8e8maMiZzBR2/8Po5Uulx+MXZUYJuN3vtKwD4Ct1Xi0=
12191219
k8s.io/legacy-cloud-providers v0.24.0/go.mod h1:j2gujMUYBEtbYfJaL8JUOgInzERm9fxJwEaOkZcnEUk=
12201220
k8s.io/metrics v0.24.0/go.mod h1:jrLlFGdKl3X+szubOXPG0Lf2aVxuV3QJcbsgVRAM6fI=
12211221
k8s.io/mount-utils v0.24.0/go.mod h1:XrSqB3a2e8sq+aU+rlbcBtQ3EgcuDk5RP9ZsGxjoDrI=
1222+
k8s.io/pod-security-admission v0.24.0 h1:nTZtZPdJ5ZusFyuxGZxfGxQ5piuhJyxuG5YmVUWG/Gs=
12221223
k8s.io/pod-security-admission v0.24.0/go.mod h1:YBS4mAdoba2qMvLPE3S7eMIxGlqUf4amHH26jUUqXX4=
12231224
k8s.io/sample-apiserver v0.24.0/go.mod h1:6YGSatoHMHIac/2dTtARwYH8PVWY5qq1L9ZYbxZ9lHY=
12241225
k8s.io/system-validators v1.7.0/go.mod h1:gP1Ky+R9wtrSiFbrpEPwWMeYz9yqyy1S/KOh0Vci7WI=

‎pkg/cmd/controller/config.go

+6-4
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,17 @@
11
package controller
22

33
var ControllerInitializers = map[string]InitFunc{
4-
"openshift.io/namespace-security-allocation": RunNamespaceSecurityAllocationController,
5-
"openshift.io/resourcequota": RunResourceQuotaManager,
6-
"openshift.io/cluster-quota-reconciliation": RunClusterQuotaReconciliationController,
7-
"openshift.io/cluster-csr-approver": RunCSRApproverController,
4+
"openshift.io/namespace-security-allocation": RunNamespaceSecurityAllocationController,
5+
"openshift.io/resourcequota": RunResourceQuotaManager,
6+
"openshift.io/cluster-quota-reconciliation": RunClusterQuotaReconciliationController,
7+
"openshift.io/cluster-csr-approver": RunCSRApproverController,
8+
"openshift.io/podsecurity-admission-label-syncer": runPodSecurityAdmissionLabelSynchronizationController,
89
}
910

1011
const (
1112
infraClusterQuotaReconciliationControllerServiceAccountName = "cluster-quota-reconciliation-controller"
1213
infraClusterCSRApproverControllerServiceAccountName = "cluster-csr-approver-controller"
1314
infraNamespaceSecurityAllocationControllerServiceAccountName = "namespace-security-allocation-controller"
15+
podSecurityAdmissionLabelSyncerControllerServiceAccountName = "podsecurity-admission-label-syncer-controller"
1416
defaultOpenShiftInfraNamespace = "openshift-infra"
1517
)

‎pkg/cmd/controller/interfaces.go

+26-34
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,11 @@ import (
77

88
"k8s.io/klog/v2"
99

10-
"k8s.io/apimachinery/pkg/api/meta"
1110
"k8s.io/apimachinery/pkg/runtime/schema"
1211
"k8s.io/apimachinery/pkg/util/sets"
13-
"k8s.io/apimachinery/pkg/util/wait"
14-
cacheddiscovery "k8s.io/client-go/discovery/cached"
1512
"k8s.io/client-go/informers"
1613
"k8s.io/client-go/kubernetes"
1714
"k8s.io/client-go/rest"
18-
"k8s.io/client-go/restmapper"
1915
"k8s.io/controller-manager/app"
2016
"k8s.io/controller-manager/pkg/clientbuilder"
2117

@@ -34,7 +30,9 @@ import (
3430
quotainformer "github.com/openshift/client-go/quota/informers/externalversions"
3531
routeclient "github.com/openshift/client-go/route/clientset/versioned"
3632
routeinformer "github.com/openshift/client-go/route/informers/externalversions"
37-
securityclient "github.com/openshift/client-go/securityinternal/clientset/versioned"
33+
securityclient "github.com/openshift/client-go/security/clientset/versioned"
34+
securityinformer "github.com/openshift/client-go/security/informers/externalversions"
35+
securityinternalclient "github.com/openshift/client-go/securityinternal/clientset/versioned"
3836
templateclient "github.com/openshift/client-go/template/clientset/versioned"
3937
templateinformer "github.com/openshift/client-go/template/informers/externalversions"
4038
"github.com/openshift/library-go/pkg/controller/controllercmd"
@@ -66,11 +64,6 @@ func NewControllerContext(
6664
clientConfig.Burst = clientConfig.Burst/10 + 1
6765
}
6866

69-
discoveryClient := cacheddiscovery.NewMemCacheClient(kubeClient.Discovery())
70-
dynamicRestMapper := restmapper.NewDeferredDiscoveryRESTMapper(discoveryClient)
71-
dynamicRestMapper.Reset()
72-
go wait.Until(dynamicRestMapper.Reset, 30*time.Second, ctx.Done())
73-
7467
appsClient, err := appsclient.NewForConfig(clientConfig)
7568
if err != nil {
7669
return nil, err
@@ -103,6 +96,10 @@ func NewControllerContext(
10396
if err != nil {
10497
return nil, err
10598
}
99+
securityClient, err := securityclient.NewForConfig(clientConfig)
100+
if err != nil {
101+
return nil, err
102+
}
106103

107104
openshiftControllerContext := &EnhancedControllerContext{
108105
ControllerContext: controllerContext,
@@ -111,19 +108,17 @@ func NewControllerContext(
111108
ClientBuilder: OpenshiftControllerClientBuilder{
112109
ControllerClientBuilder: clientbuilder.NewDynamicClientBuilder(rest.AnonymousClientConfig(clientConfig), kubeClient.CoreV1(), defaultOpenShiftInfraNamespace),
113110
},
114-
KubernetesInformers: informers.NewSharedInformerFactory(kubeClient, defaultInformerResyncPeriod),
115-
OpenshiftConfigKubernetesInformers: informers.NewSharedInformerFactoryWithOptions(kubeClient, defaultInformerResyncPeriod, informers.WithNamespace("openshift-config")),
116-
ControllerManagerKubeInformers: informers.NewSharedInformerFactoryWithOptions(kubeClient, defaultInformerResyncPeriod, informers.WithNamespace("openshift-controller-manager")),
117-
AppsInformers: appsinformer.NewSharedInformerFactory(appsClient, defaultInformerResyncPeriod),
118-
BuildInformers: buildinformer.NewSharedInformerFactory(buildClient, defaultInformerResyncPeriod),
119-
ConfigInformers: configinformer.NewSharedInformerFactory(configClient, defaultInformerResyncPeriod),
120-
ImageInformers: imageinformer.NewSharedInformerFactory(imageClient, defaultInformerResyncPeriod),
121-
OperatorInformers: operatorinformer.NewSharedInformerFactory(operatorClient, defaultInformerResyncPeriod),
122-
QuotaInformers: quotainformer.NewSharedInformerFactory(quotaClient, defaultInformerResyncPeriod),
123-
RouteInformers: routeinformer.NewSharedInformerFactory(routerClient, defaultInformerResyncPeriod),
124-
TemplateInformers: templateinformer.NewSharedInformerFactory(templateClient, defaultInformerResyncPeriod),
125-
InformersStarted: make(chan struct{}),
126-
RestMapper: dynamicRestMapper,
111+
KubernetesInformers: informers.NewSharedInformerFactory(kubeClient, defaultInformerResyncPeriod),
112+
AppsInformers: appsinformer.NewSharedInformerFactory(appsClient, defaultInformerResyncPeriod),
113+
BuildInformers: buildinformer.NewSharedInformerFactory(buildClient, defaultInformerResyncPeriod),
114+
ConfigInformers: configinformer.NewSharedInformerFactory(configClient, defaultInformerResyncPeriod),
115+
ImageInformers: imageinformer.NewSharedInformerFactory(imageClient, defaultInformerResyncPeriod),
116+
OperatorInformers: operatorinformer.NewSharedInformerFactory(operatorClient, defaultInformerResyncPeriod),
117+
QuotaInformers: quotainformer.NewSharedInformerFactory(quotaClient, defaultInformerResyncPeriod),
118+
RouteInformers: routeinformer.NewSharedInformerFactory(routerClient, defaultInformerResyncPeriod),
119+
SecurityInformers: securityinformer.NewSharedInformerFactory(securityClient, defaultInformerResyncPeriod),
120+
TemplateInformers: templateinformer.NewSharedInformerFactory(templateClient, defaultInformerResyncPeriod),
121+
InformersStarted: make(chan struct{}),
127122
}
128123
openshiftControllerContext.GenericResourceInformer = openshiftControllerContext.ToGenericInformer()
129124

@@ -165,9 +160,7 @@ type EnhancedControllerContext struct {
165160
// ClientBuilder will provide a client for this controller to use
166161
ClientBuilder ControllerClientBuilder
167162

168-
KubernetesInformers informers.SharedInformerFactory
169-
OpenshiftConfigKubernetesInformers informers.SharedInformerFactory
170-
ControllerManagerKubeInformers informers.SharedInformerFactory
163+
KubernetesInformers informers.SharedInformerFactory
171164

172165
TemplateInformers templateinformer.SharedInformerFactory
173166
QuotaInformers quotainformer.SharedInformerFactory
@@ -178,9 +171,9 @@ type EnhancedControllerContext struct {
178171
ConfigInformers configinformer.SharedInformerFactory
179172
ImageInformers imageinformer.SharedInformerFactory
180173
OperatorInformers operatorinformer.SharedInformerFactory
174+
SecurityInformers securityinformer.SharedInformerFactory
181175

182176
GenericResourceInformer genericinformers.GenericResourceInformer
183-
RestMapper meta.RESTMapper
184177

185178
informersStartedLock sync.Mutex
186179
informersStartedClosed bool
@@ -191,13 +184,12 @@ type EnhancedControllerContext struct {
191184

192185
func (c *EnhancedControllerContext) StartInformers(stopCh <-chan struct{}) {
193186
c.KubernetesInformers.Start(stopCh)
194-
c.OpenshiftConfigKubernetesInformers.Start(stopCh)
195-
c.ControllerManagerKubeInformers.Start(stopCh)
196187

197188
c.AppsInformers.Start(stopCh)
198189
c.BuildInformers.Start(stopCh)
199190
c.ConfigInformers.Start(stopCh)
200191
c.ImageInformers.Start(stopCh)
192+
c.SecurityInformers.Start(stopCh)
201193

202194
c.TemplateInformers.Start(stopCh)
203195
c.QuotaInformers.Start(stopCh)
@@ -228,8 +220,8 @@ type ControllerClientBuilder interface {
228220
OpenshiftConfigClient(name string) (configclient.Interface, error)
229221
OpenshiftConfigClientOrDie(name string) configclient.Interface
230222

231-
OpenshiftSecurityClient(name string) (securityclient.Interface, error)
232-
OpenshiftSecurityClientOrDie(name string) securityclient.Interface
223+
OpenshiftSecurityClient(name string) (securityinternalclient.Interface, error)
224+
OpenshiftSecurityClientOrDie(name string) securityinternalclient.Interface
233225

234226
// OpenShift clients based on generated internal clientsets
235227
OpenshiftTemplateClient(name string) (templateclient.Interface, error)
@@ -399,15 +391,15 @@ func (b OpenshiftControllerClientBuilder) OpenshiftQuotaClientOrDie(name string)
399391
return client
400392
}
401393

402-
func (b OpenshiftControllerClientBuilder) OpenshiftSecurityClient(name string) (securityclient.Interface, error) {
394+
func (b OpenshiftControllerClientBuilder) OpenshiftSecurityClient(name string) (securityinternalclient.Interface, error) {
403395
clientConfig, err := b.Config(name)
404396
if err != nil {
405397
return nil, err
406398
}
407-
return securityclient.NewForConfig(nonProtobufConfig(clientConfig))
399+
return securityinternalclient.NewForConfig(nonProtobufConfig(clientConfig))
408400
}
409401

410-
func (b OpenshiftControllerClientBuilder) OpenshiftSecurityClientOrDie(name string) securityclient.Interface {
402+
func (b OpenshiftControllerClientBuilder) OpenshiftSecurityClientOrDie(name string) securityinternalclient.Interface {
411403
client, err := b.OpenshiftSecurityClient(name)
412404
if err != nil {
413405
klog.Fatal(err)

‎pkg/cmd/controller/psalabelsyncer.go

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
package controller
2+
3+
import (
4+
"context"
5+
6+
"github.com/openshift/cluster-policy-controller/pkg/psalabelsyncer"
7+
)
8+
9+
func runPodSecurityAdmissionLabelSynchronizationController(ctx context.Context, controllerCtx *EnhancedControllerContext) (bool, error) {
10+
11+
kubeClient, err := controllerCtx.ClientBuilder.Client(podSecurityAdmissionLabelSyncerControllerServiceAccountName)
12+
if err != nil {
13+
return true, err
14+
}
15+
16+
controller, err := psalabelsyncer.NewPodSecurityAdmissionLabelSynchronizationController(
17+
kubeClient.CoreV1().Namespaces(),
18+
controllerCtx.KubernetesInformers.Core().V1().Namespaces(),
19+
controllerCtx.KubernetesInformers.Rbac().V1(),
20+
controllerCtx.KubernetesInformers.Core().V1().ServiceAccounts(),
21+
controllerCtx.SecurityInformers.Security().V1().SecurityContextConstraints(),
22+
controllerCtx.EventRecorder.ForComponent("podsecurity-admission-label-sync-controller"),
23+
)
24+
25+
if err != nil {
26+
return true, err
27+
}
28+
29+
go controller.Run(ctx, 1)
30+
return true, nil
31+
}

0 commit comments

Comments
 (0)