Skip to content

Commit

Permalink
fix(cni): delegated gateway was not correctly injected (#11922)
Browse files Browse the repository at this point in the history 
I wanted to run Zone 2 in e2e tests in CNI mode and I encountered a
problem with injection.
We were injecting such init container
```
  initContainers:
  - name: ""
    resources: {}
```
I fixed it and switched one zone to CNI to avoid this in the future.

Inject container only if it's created

Placing run-full-matrix, because I need to see if all variants are ok. I
checked locally and e2e is fine with CNI.

Signed-off-by: Jakub Dyszkiewicz <[email protected]>
  • Loading branch information
@jakubdyszkiewicz @kumahq
jakubdyszkiewicz authored and kumahq[bot] committed Oct 30, 2024
1 parent c00fd7e commit 0869356
Show file tree
Hide file tree
Showing 6 changed files with 622 additions and 0 deletions.
137 changes: 137 additions & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/injector.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -174,6 +174,7 @@ func (i *KumaInjector) InjectKuma(ctx context.Context, pod *kube_core.Pod) error
pod.Annotations[kube_podcmd.DefaultContainerAnnotationName] = pod.Spec.Containers[0].Name
}

<<<<<<< HEAD

Check failure on line 177 in pkg/plugins/runtime/k8s/webhooks/injector/injector.go

View workflow job for this annotation

GitHub Actions / lint 

syntax error: unexpected <<, expected }

Check failure on line 177 in pkg/plugins/runtime/k8s/webhooks/injector/injector.go

View workflow job for this annotation

GitHub Actions / lint 

expected statement, found '<<' (typecheck)
// inject sidecar as first container
pod.Spec.Containers = append([]kube_core.Container{patchedContainer}, pod.Spec.Containers...)

Expand All @@ -183,6 +184,98 @@ func (i *KumaInjector) InjectKuma(ctx context.Context, pod *kube_core.Pod) error
}
for key, value := range annotations {
pod.Annotations[key] = value
=======

Check failure on line 187 in pkg/plugins/runtime/k8s/webhooks/injector/injector.go

View workflow job for this annotation

GitHub Actions / lint 

expected statement, found '==' (typecheck)
var annotations map[string]string
var injectedInitContainer *kube_core.Container

if i.cfg.TransparentProxyConfigMapName != "" {

Check failure on line 191 in pkg/plugins/runtime/k8s/webhooks/injector/injector.go

View workflow job for this annotation

GitHub Actions / lint 

syntax error: non-declaration statement outside function body
tproxyCfg, err := i.getTransparentProxyConfig(ctx, logger, pod)
if err != nil {
return err
}

tproxyCfgYAMLBytes, err := yaml.Marshal(tproxyCfg)
if err != nil {
return err
}
tproxyCfgYAML := string(tproxyCfgYAMLBytes)

if annotations, err = tproxy_k8s.ConfigToAnnotations(
tproxyCfg,
i.cfg,
pod.Annotations,
i.defaultAdminPort,
); err != nil {
return errors.Wrap(err, "could not generate annotations for pod")
}

for key, value := range annotations {
pod.Annotations[key] = value
}

if pod.Labels == nil {
pod.Labels = map[string]string{}
}
pod.Labels[metadata.KumaMeshLabel] = meshName

switch {
case !tproxyCfg.CNIMode:
initContainer := i.NewInitContainer([]string{"--config", tproxyCfgYAML})
injected, err := i.applyCustomPatches(logger, initContainer, initPatches)
if err != nil {
return err
}
injectedInitContainer = &injected
case tproxyCfg.Redirect.Inbound.Enabled:
ipFamilyMode := tproxyCfg.IPFamilyMode.String()
inboundPort := tproxyCfg.Redirect.Inbound.Port.String()
validationContainer := i.NewValidationContainer(ipFamilyMode, inboundPort, sidecarTmp.Name)
injected, err := i.applyCustomPatches(logger, validationContainer, initPatches)
if err != nil {
return err
}
injectedInitContainer = &injected
fallthrough
default:
pod.Annotations[metadata.KumaTrafficTransparentProxyConfig] = tproxyCfgYAML
}
} else { // this is legacy and deprecated - will be removed soon
if annotations, err = i.NewAnnotations(pod, logger); err != nil {
return errors.Wrap(err, "could not generate annotations for pod")
}

for key, value := range annotations {
pod.Annotations[key] = value
}

if pod.Labels == nil {
pod.Labels = map[string]string{}
}
pod.Labels[metadata.KumaMeshLabel] = meshName

podRedirect, err := tproxy_k8s.NewPodRedirectFromAnnotations(pod.Annotations)
if err != nil {
return err
}

if !i.cfg.CNIEnabled {
initContainer := i.NewInitContainer(podRedirect.AsKumactlCommandLine())
injected, err := i.applyCustomPatches(logger, initContainer, initPatches)
if err != nil {
return err
}
injectedInitContainer = &injected
} else if podRedirect.RedirectInbound {
ipFamilyMode := podRedirect.IpFamilyMode
inboundPort := fmt.Sprintf("%d", podRedirect.RedirectPortInbound)
validationContainer := i.NewValidationContainer(ipFamilyMode, inboundPort, sidecarTmp.Name)
injected, err := i.applyCustomPatches(logger, validationContainer, initPatches)
if err != nil {
return err
}
injectedInitContainer = &injected
}
>>>>>>> ebcc4be57 (fix(cni): delegated gateway was not correctly injected (#11922))

Check failure on line 278 in pkg/plugins/runtime/k8s/webhooks/injector/injector.go

View workflow job for this annotation

GitHub Actions / lint 

invalid character U+0023 '#'

Check failure on line 278 in pkg/plugins/runtime/k8s/webhooks/injector/injector.go

View workflow job for this annotation

GitHub Actions / lint 

expected statement, found '>>' (typecheck)
}

if i.cfg.EBPF.Enabled {
Expand All @@ -203,10 +296,54 @@ func (i *KumaInjector) InjectKuma(ctx context.Context, pod *kube_core.Pod) error
})
}

<<<<<<< HEAD

Check failure on line 299 in pkg/plugins/runtime/k8s/webhooks/injector/injector.go

View workflow job for this annotation

GitHub Actions / lint 

expected statement, found '<<' (typecheck)
// init container
if !i.cfg.CNIEnabled {
ic, err := i.NewInitContainer(pod)
if err != nil {
=======
initFirst, _, err := metadata.Annotations(pod.Annotations).GetEnabled(metadata.KumaInitFirst)
if err != nil {
return err
}

var prependInitContainers []kube_core.Container
var appendInitContainers []kube_core.Container

if injectedInitContainer != nil {

Check failure on line 313 in pkg/plugins/runtime/k8s/webhooks/injector/injector.go

View workflow job for this annotation

GitHub Actions / lint 

syntax error: non-declaration statement outside function body
if initFirst || i.sidecarContainersEnabled {
prependInitContainers = append(prependInitContainers, *injectedInitContainer)
} else {
appendInitContainers = append(appendInitContainers, *injectedInitContainer)
}
}

if i.sidecarContainersEnabled {
// inject sidecar after init
patchedContainer.RestartPolicy = pointer.To(kube_core.ContainerRestartPolicyAlways)
patchedContainer.Lifecycle = &kube_core.Lifecycle{
PreStop: &kube_core.LifecycleHandler{
Exec: &kube_core.ExecAction{
Command: []string{"killall", "-USR2", "kuma-dp"},
},
},
}
prependInitContainers = append(prependInitContainers, patchedContainer)
} else {
// inject sidecar as first container
pod.Spec.Containers = append([]kube_core.Container{patchedContainer}, pod.Spec.Containers...)
}

pod.Spec.InitContainers = append(append(prependInitContainers, pod.Spec.InitContainers...), appendInitContainers...)

disabledAppProbeProxy, err := probes.ApplicationProbeProxyDisabled(pod)
if err != nil {
return err
}

if disabledAppProbeProxy {
if err := i.overrideHTTPProbes(pod); err != nil {
>>>>>>> ebcc4be57 (fix(cni): delegated gateway was not correctly injected (#11922))

Check failure on line 346 in pkg/plugins/runtime/k8s/webhooks/injector/injector.go

View workflow job for this annotation

GitHub Actions / lint 

invalid character U+0023 '#' (typecheck)
return err
}
patchedIc, err := i.applyCustomPatches(logger, ic, initPatches)
Expand Down
156 changes: 156 additions & 0 deletions pkg/plugins/runtime/k8s/webhooks/injector/injector_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -671,6 +671,162 @@ spec:
kuma.io/sidecar-injection: enabled`,
cfgFile: "inject.config.yaml",
}),
<<<<<<< HEAD
=======
Entry("33. kuma.io/transparent-proxying-ip-family-mode", testCase{
num: "33",
mesh: `
apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
name: default
spec: {}`,
namespace: `
apiVersion: v1
kind: Namespace
metadata:
name: default
labels:
kuma.io/sidecar-injection: enabled`,
cfgFile: "inject.config-ipv6-disabled.yaml",
}),
Entry("34. cni enabled", testCase{
num: "34",
mesh: `
apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
name: default
spec: {}`,
namespace: `
apiVersion: v1
kind: Namespace
metadata:
name: default
labels:
kuma.io/sidecar-injection: enabled`,
cfgFile: "inject.config-cni.yaml",
}),
Entry("native sidecar with probe", testCase{
num: "35",
mesh: `
apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
name: default
spec: {}`,
namespace: `
apiVersion: v1
kind: Namespace
metadata:
name: default
labels:
kuma.io/sidecar-injection: enabled`,
cfgFile: "inject.config.yaml",
}),
Entry("36. traffic.kuma.io/drop-invalid-packets overrides config", testCase{
num: "36",
mesh: `
apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
name: default
spec: {}`,
namespace: `
apiVersion: v1
kind: Namespace
metadata:
name: default
labels:
kuma.io/sidecar-injection: enabled`,
cfgFile: "inject.config.yaml",
}),
Entry("37. traffic.kuma.io/iptables-logs overrides config", testCase{
num: "37",
mesh: `
apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
name: default
spec: {}`,
namespace: `
apiVersion: v1
kind: Namespace
metadata:
name: default
labels:
kuma.io/sidecar-injection: enabled`,
cfgFile: "inject.config.yaml",
}),
Entry("38. traffic.kuma.io/exclude-outbound-ips overrides config", testCase{
num: "38",
mesh: `
apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
name: default
spec: {}`,
namespace: `
apiVersion: v1
kind: Namespace
metadata:
name: default
labels:
kuma.io/sidecar-injection: enabled`,
cfgFile: "inject.config.yaml",
}),
Entry("39. traffic.kuma.io/exclude-inbound-ips overrides config", testCase{
num: "39",
mesh: `
apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
name: default
spec: {}`,
namespace: `
apiVersion: v1
kind: Namespace
metadata:
name: default
labels:
kuma.io/sidecar-injection: enabled`,
cfgFile: "inject.config.yaml",
}),
Entry("40. application probe proxy: config - disabled, pod - enabled", testCase{
num: "40",
mesh: `
apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
name: default
spec: {}`,
namespace: `
apiVersion: v1
kind: Namespace
metadata:
name: default
labels:
kuma.io/sidecar-injection: enabled`,
cfgFile: "inject.vp-disabled.config.yaml",
}),
Entry("41. gateway provided with cni enabled", testCase{
num: "41",
mesh: `
apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
name: default
spec: {}`,
namespace: `
apiVersion: v1
kind: Namespace
metadata:
name: default
labels:
kuma.io/sidecar-injection: enabled`,
cfgFile: "inject.config-cni.yaml",
}),
>>>>>>> ebcc4be57 (fix(cni): delegated gateway was not correctly injected (#11922))
)

DescribeTable("should not inject Kuma into a Pod",
Expand Down
Loading

0 comments on commit 0869356

Please sign in to comment.