Trim job suffix to extract out cron job name for workload metadata (i…

…stio#27195) * special case cron job processing in webhook * update
sel · Sep 10, 2020 · 10d12b8 · 10d12b8
1 parent 5f2c5db
commit 10d12b8
Show file tree

Hide file tree

Showing 5 changed files with 129 additions and 2 deletions.
diff --git a/pkg/kube/inject/testdata/webhook/TestWebhookInject_cron_job.patch b/pkg/kube/inject/testdata/webhook/TestWebhookInject_cron_job.patch
@@ -0,0 +1,83 @@
+[
+  {
+    "op": "add",
+    "path": "/spec/initContainers",
+    "value": [
+      {
+        "name": "istio-init",
+        "image": "example.com/init:latest",
+        "resources": {}
+      }
+    ]
+  },
+  {
+    "op": "add",
+    "path": "/spec/containers/-",
+    "value": {
+      "name": "istio-proxy",
+      "image": "example.com/proxy:latest",
+      "env": [
+        {
+          "name": "ISTIO_META_WORKLOAD_NAME",
+          "value": "hello"
+        },
+        {
+          "name": "ISTIO_META_OWNER",
+          "value": "kubernetes://apis/batch/v1beta1/namespaces/default/cronjobs/hello"
+        }
+      ],
+      "resources": {}
+    }
+  },
+  {
+    "op": "add",
+    "path": "/spec/securityContext",
+    "value": {
+      "fsGroup": 1337
+    }
+  },
+  {
+    "op": "add",
+    "path": "/metadata/annotations",
+    "value": {
+      "prometheus.io/path": "/stats/prometheus"
+    }
+  },
+  {
+    "op": "add",
+    "path": "/metadata/annotations/prometheus.io~1port",
+    "value": "15020"
+  },
+  {
+    "op": "add",
+    "path": "/metadata/annotations/prometheus.io~1scrape",
+    "value": "true"
+  },
+  {
+    "op": "add",
+    "path": "/metadata/annotations/sidecar.istio.io~1status",
+    "value": "{\"version\":\"unit-test-fake-version\",\"initContainers\":[\"istio-init\"],\"containers\":[\"istio-proxy\"],\"volumes\":null,\"imagePullSecrets\":null}"
+  },
+  {
+    "op": "add",
+    "path": "/metadata/labels",
+    "value": {
+      "istio.io/rev": ""
+    }
+  },
+  {
+    "op": "add",
+    "path": "/metadata/labels/security.istio.io~1tlsMode",
+    "value": "istio"
+  },
+  {
+    "op": "add",
+    "path": "/metadata/labels/service.istio.io~1canonical-name",
+    "value": "hello"
+  },
+  {
+    "op": "add",
+    "path": "/metadata/labels/service.istio.io~1canonical-revision",
+    "value": "latest"
+  }
+]
diff --git a/pkg/kube/inject/testdata/webhook/TestWebhookInject_cron_job.yaml b/pkg/kube/inject/testdata/webhook/TestWebhookInject_cron_job.yaml
@@ -0,0 +1,10 @@
+metadata:
+  generateName: hello-1599753180-
+  ownerReferences:
+  - apiVersion: batch/v1
+    controller: true
+    kind: Job
+    name: hello-1599753180
+spec:
+  containers:
+    - name: c
diff --git a/pkg/kube/inject/testdata/webhook/TestWebhookInject_cron_job_template.yaml b/pkg/kube/inject/testdata/webhook/TestWebhookInject_cron_job_template.yaml
@@ -0,0 +1,20 @@
+policy: enabled
+alwaysInjectSelector: []
+neverInjectSelector: []
+injectedAnnotations: {}
+template: |-
+  initContainers:
+  - name: istio-init
+    image: example.com/init:latest
+  containers:
+  - name: istio-proxy
+    image: example.com/proxy:latest
+    env:
+    {{- if .DeploymentMeta.Name }}
+    - name: ISTIO_META_WORKLOAD_NAME
+      value: "{{ .DeploymentMeta.Name }}"
+    {{ end }}
+    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
+    - name: ISTIO_META_OWNER
+      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
+    {{- end}}
diff --git a/pkg/kube/inject/webhook.go b/pkg/kube/inject/webhook.go
@@ -731,12 +731,21 @@ func getDeployMetaFromPod(pod *corev1.Pod) (*metav1.ObjectMeta, *metav1.TypeMeta
 			typeMetadata.Kind = controllerRef.Kind
 
 			// heuristic for deployment detection
+			deployMeta.Name = controllerRef.Name
 			if typeMetadata.Kind == "ReplicaSet" && pod.Labels["pod-template-hash"] != "" && strings.HasSuffix(controllerRef.Name, pod.Labels["pod-template-hash"]) {
 				name := strings.TrimSuffix(controllerRef.Name, "-"+pod.Labels["pod-template-hash"])
 				deployMeta.Name = name
 				typeMetadata.Kind = "Deployment"
-			} else {
-				deployMeta.Name = controllerRef.Name
+			} else if typeMetadata.Kind == "Job" && len(controllerRef.Name) > 11 {
+				// If job name suffixed with `-<ten-digit-timestamp>`, trim the suffix and set kind to cron job.
+				l := len(controllerRef.Name)
+				if _, err := strconv.Atoi(controllerRef.Name[l-10:]); err == nil && string(controllerRef.Name[l-11]) == "-" {
+					deployMeta.Name = controllerRef.Name[:l-11]
+					typeMetadata.Kind = "CronJob"
+					// heuristically set cron job api version to v1beta1 as it cannot be derived from pod metadata.
+					// Cronjob is not GA yet and latest version is v1beta1: https://github.com/kubernetes/enhancements/pull/978
+					typeMetadata.APIVersion = "batch/v1beta1"
+				}
 			}
 		}
 	}

diff --git a/pkg/kube/inject/webhook_test.go b/pkg/kube/inject/webhook_test.go
@@ -589,6 +589,11 @@ func TestWebhookInject(t *testing.T) {
 			wantFile:     "TestWebhookInject_probe_rewrite_timeout_retention.patch",
 			templateFile: "TestWebhookInject_probe_rewrite_timeout_retention_template.yaml",
 		},
+		{
+			inputFile:    "TestWebhookInject_cron_job.yaml",
+			wantFile:     "TestWebhookInject_cron_job.patch",
+			templateFile: "TestWebhookInject_cron_job_template.yaml",
+		},
 	}
 
 	for i, c := range cases {