forked from kubernetes/kubernetes
-
Notifications
You must be signed in to change notification settings - Fork 108
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
UPSTREAM: <carry>: Ensure service ca is mounted for projected tokens
OpenShift since 3.x has injected the service serving certificate ca (service ca) bundle into service account token secrets. This was intended to ensure that all pods would be able to easily verify connections to endpoints secured with service serving certificates. Since breaking customer workloads is not an option, and there is no way to ensure that customers are not relying on the service ca bundle being mounted at /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt, it is necessary to continue mounting the service ca bundle in the same location in the bound token projected volumes enabled by the BoundServiceAccountTokenVolume feature (enabled by default in 1.21). A new controller is added to create a configmap per namespace that is annotated for service ca injection. The controller is derived from the controller that creates configmaps for the root ca. The service account admission controller is updated to include a source for the new configmap in the default projected volume definition. UPSTREAM: <carry>: <squash> Add unit testing for service ca configmap publishing This commit should be squashed with: UPSTREAM: <carry>: Ensure service ca is mounted for projected tokens OpenShift-Rebase-Source: d69d054 UPSTREAM: <carry>: Ensure service ca is mounted for projected tokens
- Loading branch information
Showing
13 changed files
with
604 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
56 changes: 56 additions & 0 deletions
56
openshift-kube-controller-manager/servicecacertpublisher/metrics.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| package servicecacertpublisher | ||
|
|
||
| import ( | ||
| "strconv" | ||
| "sync" | ||
| "time" | ||
|
|
||
| apierrors "k8s.io/apimachinery/pkg/api/errors" | ||
| "k8s.io/component-base/metrics" | ||
| "k8s.io/component-base/metrics/legacyregistry" | ||
| ) | ||
|
|
||
| // ServiceCACertPublisher - subsystem name used by service_ca_cert_publisher | ||
| const ServiceCACertPublisher = "service_ca_cert_publisher" | ||
|
|
||
| var ( | ||
| syncCounter = metrics.NewCounterVec( | ||
| &metrics.CounterOpts{ | ||
| Subsystem: ServiceCACertPublisher, | ||
| Name: "sync_total", | ||
| Help: "Number of namespace syncs happened in service ca cert publisher.", | ||
| StabilityLevel: metrics.ALPHA, | ||
| }, | ||
| []string{"code"}, | ||
| ) | ||
| syncLatency = metrics.NewHistogramVec( | ||
| &metrics.HistogramOpts{ | ||
| Subsystem: ServiceCACertPublisher, | ||
| Name: "sync_duration_seconds", | ||
| Help: "Number of namespace syncs happened in service ca cert publisher.", | ||
| Buckets: metrics.ExponentialBuckets(0.001, 2, 15), | ||
| StabilityLevel: metrics.ALPHA, | ||
| }, | ||
| []string{"code"}, | ||
| ) | ||
| ) | ||
|
|
||
| func recordMetrics(start time.Time, ns string, err error) { | ||
| code := "500" | ||
| if err == nil { | ||
| code = "200" | ||
| } else if se, ok := err.(*apierrors.StatusError); ok && se.Status().Code != 0 { | ||
| code = strconv.Itoa(int(se.Status().Code)) | ||
| } | ||
| syncLatency.WithLabelValues(code).Observe(time.Since(start).Seconds()) | ||
| syncCounter.WithLabelValues(code).Inc() | ||
| } | ||
|
|
||
| var once sync.Once | ||
|
|
||
| func registerMetrics() { | ||
| once.Do(func() { | ||
| legacyregistry.MustRegister(syncCounter) | ||
| legacyregistry.MustRegister(syncLatency) | ||
| }) | ||
| } |
81 changes: 81 additions & 0 deletions
81
openshift-kube-controller-manager/servicecacertpublisher/metrics_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| package servicecacertpublisher | ||
|
|
||
| import ( | ||
| "errors" | ||
| "strings" | ||
| "testing" | ||
| "time" | ||
|
|
||
| corev1 "k8s.io/api/core/v1" | ||
| apierrors "k8s.io/apimachinery/pkg/api/errors" | ||
| "k8s.io/component-base/metrics/legacyregistry" | ||
| "k8s.io/component-base/metrics/testutil" | ||
| ) | ||
|
|
||
| func TestSyncCounter(t *testing.T) { | ||
| testCases := []struct { | ||
| desc string | ||
| err error | ||
| metrics []string | ||
| want string | ||
| }{ | ||
| { | ||
| desc: "nil error", | ||
| err: nil, | ||
| metrics: []string{ | ||
| "service_ca_cert_publisher_sync_total", | ||
| }, | ||
| want: ` | ||
| # HELP service_ca_cert_publisher_sync_total [ALPHA] Number of namespace syncs happened in service ca cert publisher. | ||
| # TYPE service_ca_cert_publisher_sync_total counter | ||
| service_ca_cert_publisher_sync_total{code="200"} 1 | ||
| `, | ||
| }, | ||
| { | ||
| desc: "kube api error", | ||
| err: apierrors.NewNotFound(corev1.Resource("configmap"), "test-configmap"), | ||
| metrics: []string{ | ||
| "service_ca_cert_publisher_sync_total", | ||
| }, | ||
| want: ` | ||
| # HELP service_ca_cert_publisher_sync_total [ALPHA] Number of namespace syncs happened in service ca cert publisher. | ||
| # TYPE service_ca_cert_publisher_sync_total counter | ||
| service_ca_cert_publisher_sync_total{code="404"} 1 | ||
| `, | ||
| }, | ||
| { | ||
| desc: "kube api error without code", | ||
| err: &apierrors.StatusError{}, | ||
| metrics: []string{ | ||
| "service_ca_cert_publisher_sync_total", | ||
| }, | ||
| want: ` | ||
| # HELP service_ca_cert_publisher_sync_total [ALPHA] Number of namespace syncs happened in service ca cert publisher. | ||
| # TYPE service_ca_cert_publisher_sync_total counter | ||
| service_ca_cert_publisher_sync_total{code="500"} 1 | ||
| `, | ||
| }, | ||
| { | ||
| desc: "general error", | ||
| err: errors.New("test"), | ||
| metrics: []string{ | ||
| "service_ca_cert_publisher_sync_total", | ||
| }, | ||
| want: ` | ||
| # HELP service_ca_cert_publisher_sync_total [ALPHA] Number of namespace syncs happened in service ca cert publisher. | ||
| # TYPE service_ca_cert_publisher_sync_total counter | ||
| service_ca_cert_publisher_sync_total{code="500"} 1 | ||
| `, | ||
| }, | ||
| } | ||
|
|
||
| for _, tc := range testCases { | ||
| t.Run(tc.desc, func(t *testing.T) { | ||
| recordMetrics(time.Now(), "test-ns", tc.err) | ||
| defer syncCounter.Reset() | ||
| if err := testutil.GatherAndCompare(legacyregistry.DefaultGatherer, strings.NewReader(tc.want), tc.metrics...); err != nil { | ||
| t.Fatal(err) | ||
| } | ||
| }) | ||
| } | ||
| } |
Oops, something went wrong.