agentless: support updating health checks on consul clients during an upgrade to agentless #1690
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,110 @@ | ||
| package endpoints | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| "github.com/hashicorp/consul-k8s/control-plane/connect-inject/constants" | ||
| "github.com/hashicorp/consul-k8s/control-plane/consul" | ||
| "github.com/hashicorp/consul-server-connection-manager/discovery" | ||
| "github.com/hashicorp/consul/api" | ||
| "github.com/hashicorp/go-version" | ||
| corev1 "k8s.io/api/core/v1" | ||
| ) | ||
|
|
||
| // isConsulDataplaneSupported returns true if the consul-k8s version on the pod supports | ||
| // consul-dataplane architecture of Consul. | ||
| func isConsulDataplaneSupported(pod corev1.Pod) bool { | ||
| if anno, ok := pod.Annotations[constants.AnnotationConsulK8sVersion]; ok { | ||
| consulK8sVersion, err := version.NewVersion(anno) | ||
| if err != nil { | ||
| return false | ||
| } | ||
| consulDPSupportedVersion, err := version.NewVersion("v1.0.0-beta1") | ||
ishustava marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| if err != nil { | ||
| return false | ||
| } | ||
| if !consulK8sVersion.LessThan(consulDPSupportedVersion) { | ||
| return true | ||
| } | ||
| } | ||
| return false | ||
| } | ||
|
|
||
| func (r *Controller) consulClientCfgForNodeAgent(serverClient *api.Client, pod corev1.Pod, state discovery.State) (*api.Config, error) { | ||
| ccCfg := &api.Config{ | ||
| Scheme: r.ConsulClientConfig.APIClientConfig.Scheme, | ||
| } | ||
|
|
||
| consulClientHttpPort := 8500 | ||
| if ccCfg.Scheme == "https" { | ||
| consulClientHttpPort = 8501 | ||
| ccCfg.TLSConfig.CAFile = r.ConsulClientConfig.APIClientConfig.TLSConfig.CAFile | ||
| } | ||
| if r.consulClientHttpPort != 0 { | ||
| consulClientHttpPort = r.consulClientHttpPort | ||
| } | ||
| ccCfg.Address = fmt.Sprintf("%s:%d", pod.Status.HostIP, consulClientHttpPort) | ||
|
|
||
| ccCfg.Token = state.Token | ||
|
|
||
| // Check if auto-encrypt is enabled. If it is, we need to retrieve and set a different CA for the Consul client. | ||
| if r.EnableAutoEncrypt { | ||
| // Get Connect CA. | ||
| caRoots, _, err := serverClient.Agent().ConnectCARoots(nil) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| if caRoots == nil { | ||
| return nil, fmt.Errorf("ca root list is nil") | ||
| } | ||
| if caRoots.Roots == nil { | ||
| return nil, fmt.Errorf("ca roots is nil") | ||
| } | ||
| if len(caRoots.Roots) == 0 { | ||
| return nil, fmt.Errorf("the list of root CAs is empty") | ||
| } | ||
|
|
||
| for _, root := range caRoots.Roots { | ||
| if root.Active { | ||
| ccCfg.TLSConfig.CAFile = "" | ||
| ccCfg.TLSConfig.CAPem = []byte(root.RootCertPEM) | ||
| break | ||
| } | ||
| } | ||
| } | ||
|
Comment on lines
+53
to
+76
|
||
| if r.EnableConsulNamespaces { | ||
| ccCfg.Namespace = r.consulNamespace(pod.Namespace) | ||
| } | ||
| return ccCfg, nil | ||
| } | ||
|
|
||
| func (r *Controller) updateHealthCheckOnConsulClient(consulClientCfg *api.Config, pod corev1.Pod, endpoints corev1.Endpoints, status string) error { | ||
| consulClient, err := consul.NewClient(consulClientCfg, r.ConsulClientConfig.APITimeout) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| filter := fmt.Sprintf(`Name == "Kubernetes Health Check" and ServiceID == %q`, serviceID(pod, endpoints)) | ||
| checks, err := consulClient.Agent().ChecksWithFilter(filter) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| if len(checks) > 1 { | ||
| return fmt.Errorf("more than one Kubernetes health check found") | ||
| } | ||
| if len(checks) == 0 { | ||
| r.Log.Info("detected no health checks to update", "name", endpoints.Name, "ns", endpoints.Namespace, "service-id", serviceID(pod, endpoints)) | ||
| return nil | ||
| } | ||
| for checkID := range checks { | ||
| output := "Kubernetes health checks passing" | ||
| if status == api.HealthCritical { | ||
| output = fmt.Sprintf(`Pod "%s/%s" is not ready`, pod.Namespace, pod.Name) | ||
| } | ||
| r.Log.Info("updating health check status", "name", endpoints.Name, "ns", endpoints.Namespace, "status", status) | ||
| err = consulClient.Agent().UpdateTTL(checkID, output, status) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| } | ||
| return nil | ||
| } | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
These flags are no longer used
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The removal of these are actually in the PR I am working on right now as I missed them last week. I will remove them from my commits and we'll leave them in yours.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hopefully the rebase of main onto your PR should automatically clear some of that from your commits.