-
Notifications
You must be signed in to change notification settings - Fork 173
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
## Description This also changes how we the agent gets secrets from the cluster. Instead of mounting secrets in the deployment and reading from a file the agent will instead read the secret directly from the cluster. This is done for simplicity, and easier testing. Additionally, the agent will need to read from the cluster in #1974 as well so this helps prepare for that change. This only changes and tests pods to keep the scope of the PR slim. This means temporarily the agent will both read from mounted file secrets and regular kubernetes secrets depending on the hook, but this will be changed shortly in future PRs. ## Related Issue Relates to #2512 ## Checklist before merging - [ ] Test, docs, adr added or updated as needed - [ ] [Contributor Guide Steps](https://github.com/defenseunicorns/zarf/blob/main/.github/CONTRIBUTING.md#developer-workflow) followed --------- Co-authored-by: Lucas Rodriguez <lucas.rodriguez@defenseunicorns.com> Signed-off-by: Austin Abro <AustinAbro321@gmail.com>
- Loading branch information
1 parent
e3220c2
commit dbb1253
Showing
12 changed files
with
305 additions
and
36 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: Role | ||
| metadata: | ||
| name: zarf-agent | ||
| namespace: zarf | ||
| rules: | ||
| - apiGroups: | ||
| - "" | ||
| resources: | ||
| - secrets | ||
| verbs: | ||
| - get |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: RoleBinding | ||
| metadata: | ||
| name: zarf-agent-binding | ||
| namespace: zarf | ||
| roleRef: | ||
| apiGroup: rbac.authorization.k8s.io | ||
| kind: Role | ||
| name: zarf-agent | ||
| subjects: | ||
| - kind: ServiceAccount | ||
| name: zarf | ||
| namespace: zarf |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| apiVersion: v1 | ||
| kind: ServiceAccount | ||
| metadata: | ||
| name: zarf | ||
| namespace: zarf |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,149 @@ | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| // SPDX-FileCopyrightText: 2021-Present The Zarf Authors | ||
|
|
||
| package hooks | ||
|
|
||
| import ( | ||
| "context" | ||
| "encoding/json" | ||
| "net/http" | ||
| "testing" | ||
|
|
||
| "github.com/defenseunicorns/zarf/src/config" | ||
| "github.com/defenseunicorns/zarf/src/internal/agent/http/admission" | ||
| "github.com/defenseunicorns/zarf/src/internal/agent/operations" | ||
| "github.com/defenseunicorns/zarf/src/types" | ||
| "github.com/stretchr/testify/require" | ||
| v1 "k8s.io/api/admission/v1" | ||
| corev1 "k8s.io/api/core/v1" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| "k8s.io/apimachinery/pkg/runtime" | ||
| ) | ||
|
|
||
| func createPodAdmissionRequest(t *testing.T, op v1.Operation, pod *corev1.Pod) *v1.AdmissionRequest { | ||
| t.Helper() | ||
| raw, err := json.Marshal(pod) | ||
| require.NoError(t, err) | ||
| return &v1.AdmissionRequest{ | ||
| Operation: op, | ||
| Object: runtime.RawExtension{ | ||
| Raw: raw, | ||
| }, | ||
| } | ||
| } | ||
|
|
||
| func TestPodMutationWebhook(t *testing.T) { | ||
| t.Parallel() | ||
|
|
||
| ctx := context.Background() | ||
|
|
||
| state := &types.ZarfState{RegistryInfo: types.RegistryInfo{Address: "127.0.0.1:31999"}} | ||
| c := createTestClientWithZarfState(ctx, t, state) | ||
| handler := admission.NewHandler().Serve(NewPodMutationHook(ctx, c)) | ||
|
|
||
| tests := []struct { | ||
| name string | ||
| admissionReq *v1.AdmissionRequest | ||
| expectedPatch []operations.PatchOperation | ||
| code int | ||
| }{ | ||
| { | ||
| name: "pod with label should be mutated", | ||
| admissionReq: createPodAdmissionRequest(t, v1.Create, &corev1.Pod{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Labels: map[string]string{"should-be": "mutated"}, | ||
| }, | ||
| Spec: corev1.PodSpec{ | ||
| Containers: []corev1.Container{{Image: "nginx"}}, | ||
| InitContainers: []corev1.Container{{Image: "busybox"}}, | ||
| EphemeralContainers: []corev1.EphemeralContainer{ | ||
| { | ||
| EphemeralContainerCommon: corev1.EphemeralContainerCommon{ | ||
| Image: "alpine", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }), | ||
| expectedPatch: []operations.PatchOperation{ | ||
| operations.ReplacePatchOperation( | ||
| "/spec/imagePullSecrets", | ||
| []corev1.LocalObjectReference{{Name: config.ZarfImagePullSecretName}}, | ||
| ), | ||
| operations.ReplacePatchOperation( | ||
| "/spec/initContainers/0/image", | ||
| "127.0.0.1:31999/library/busybox:latest-zarf-2140033595", | ||
| ), | ||
| operations.ReplacePatchOperation( | ||
| "/spec/ephemeralContainers/0/image", | ||
| "127.0.0.1:31999/library/alpine:latest-zarf-1117969859", | ||
| ), | ||
| operations.ReplacePatchOperation( | ||
| "/spec/containers/0/image", | ||
| "127.0.0.1:31999/library/nginx:latest-zarf-3793515731", | ||
| ), | ||
| operations.ReplacePatchOperation( | ||
| "/metadata/labels/zarf-agent", | ||
| "patched", | ||
| ), | ||
| }, | ||
| code: http.StatusOK, | ||
| }, | ||
| { | ||
| name: "pod with zarf-agent patched label should not be mutated", | ||
| admissionReq: createPodAdmissionRequest(t, v1.Create, &corev1.Pod{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Labels: map[string]string{"zarf-agent": "patched"}, | ||
| }, | ||
| Spec: corev1.PodSpec{ | ||
| Containers: []corev1.Container{{Image: "nginx"}}, | ||
| }, | ||
| }), | ||
| expectedPatch: nil, | ||
| code: http.StatusOK, | ||
| }, | ||
| { | ||
| name: "pod with no labels should not error", | ||
| admissionReq: createPodAdmissionRequest(t, v1.Create, &corev1.Pod{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Labels: nil, | ||
| }, | ||
| Spec: corev1.PodSpec{ | ||
| Containers: []corev1.Container{{Image: "nginx"}}, | ||
| }, | ||
| }), | ||
| expectedPatch: []operations.PatchOperation{ | ||
| operations.ReplacePatchOperation( | ||
| "/spec/imagePullSecrets", | ||
| []corev1.LocalObjectReference{{Name: config.ZarfImagePullSecretName}}, | ||
| ), | ||
| operations.ReplacePatchOperation( | ||
| "/spec/containers/0/image", | ||
| "127.0.0.1:31999/library/nginx:latest-zarf-3793515731", | ||
| ), | ||
| operations.AddPatchOperation( | ||
| "/metadata/labels", | ||
| map[string]string{"zarf-agent": "patched"}, | ||
| ), | ||
| }, | ||
| code: http.StatusOK, | ||
| }, | ||
| } | ||
|
|
||
| for _, tt := range tests { | ||
| tt := tt | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| t.Parallel() | ||
| resp := sendAdmissionRequest(t, tt.admissionReq, handler, tt.code) | ||
| if tt.expectedPatch == nil { | ||
| require.Empty(t, string(resp.Patch)) | ||
| } else { | ||
| expectedPatchJSON, err := json.Marshal(tt.expectedPatch) | ||
| require.NoError(t, err) | ||
| require.NotNil(t, resp) | ||
| require.True(t, resp.Allowed) | ||
| require.JSONEq(t, string(expectedPatchJSON), string(resp.Patch)) | ||
| } | ||
| }) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| // SPDX-FileCopyrightText: 2021-Present The Zarf Authors | ||
|
|
||
| package hooks | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "context" | ||
| "encoding/json" | ||
| "net/http" | ||
| "net/http/httptest" | ||
| "testing" | ||
|
|
||
| "github.com/defenseunicorns/zarf/src/pkg/cluster" | ||
| "github.com/defenseunicorns/zarf/src/pkg/k8s" | ||
| "github.com/defenseunicorns/zarf/src/types" | ||
| "github.com/stretchr/testify/require" | ||
| v1 "k8s.io/api/admission/v1" | ||
| corev1 "k8s.io/api/core/v1" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| "k8s.io/client-go/kubernetes/fake" | ||
| ) | ||
|
|
||
| func createTestClientWithZarfState(ctx context.Context, t *testing.T, state *types.ZarfState) *cluster.Cluster { | ||
| t.Helper() | ||
| c := &cluster.Cluster{K8s: &k8s.K8s{Clientset: fake.NewSimpleClientset()}} | ||
| stateData, err := json.Marshal(state) | ||
| require.NoError(t, err) | ||
|
|
||
| secret := &corev1.Secret{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: cluster.ZarfStateSecretName, | ||
| Namespace: cluster.ZarfNamespaceName, | ||
| }, | ||
| Data: map[string][]byte{ | ||
| cluster.ZarfStateDataKey: stateData, | ||
| }, | ||
| } | ||
| _, err = c.Clientset.CoreV1().Secrets(cluster.ZarfNamespaceName).Create(ctx, secret, metav1.CreateOptions{}) | ||
| require.NoError(t, err) | ||
| return c | ||
| } | ||
|
|
||
| // sendAdmissionRequest sends an admission request to the handler and returns the response. | ||
| func sendAdmissionRequest(t *testing.T, admissionReq *v1.AdmissionRequest, handler http.HandlerFunc, code int) *v1.AdmissionResponse { | ||
| t.Helper() | ||
|
|
||
| b, err := json.Marshal(&v1.AdmissionReview{ | ||
| Request: admissionReq, | ||
| }) | ||
| require.NoError(t, err) | ||
|
|
||
| // Note: The URL ("/test") doesn't matter here because we are directly invoking the handler. | ||
| // The handler processes the request based on the HTTP method and body content, not the URL path. | ||
| req := httptest.NewRequest(http.MethodPost, "/test", bytes.NewReader(b)) | ||
| req.Header.Set("Content-Type", "application/json") | ||
|
|
||
| rr := httptest.NewRecorder() | ||
| handler.ServeHTTP(rr, req) | ||
|
|
||
| require.Equal(t, code, rr.Code) | ||
|
|
||
| var admissionReview v1.AdmissionReview | ||
| if rr.Code == http.StatusOK { | ||
| err = json.NewDecoder(rr.Body).Decode(&admissionReview) | ||
| require.NoError(t, err) | ||
| } | ||
|
|
||
| return admissionReview.Response | ||
| } |
Oops, something went wrong.