1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-05 15:37:19 +00:00
kyverno/pkg/dclient/client.go

215 lines
9.3 KiB
Go
Raw Normal View History

package client
import (
"context"
"fmt"
"time"
kubeutils "github.com/kyverno/kyverno/pkg/utils/kube"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
"k8s.io/apimachinery/pkg/runtime/schema"
"k8s.io/apimachinery/pkg/types"
"k8s.io/client-go/discovery/cached/memory"
"k8s.io/client-go/dynamic"
593 feature (#594) * initial commit * background policy validation * correct message * skip non-background policy process for add/update * add Generate Request CR * generate Request Generator Initial * test generate request CR generation * initial commit gr generator * generate controller initial framework * add crd for generate request * gr cleanup controller initial commit * cleanup controller initial * generate mid-commit * generate rule processing * create PV on generate error * embed resource type * testing phase 1- generate resources with variable substitution * fix tests * comment broken test #586 * add printer column for state * return if existing resource for clone * set resync time to 2 mins & remove resource version check in update handler for gr * generate events for reporting * fix logs * initial commit * fix trailing quote in patch * remove comments * initial condition (equal & notequal) * initial support for conditions * initial support fo conditions in generate * support precondition checks * cleanup * re-evaluate GR on namespace update using dynamic informers * add status for generated resources * display loaded variable SA * support delete cleanup of generate request main resources * fix log * remove namespace from SA username * support multiple variables per statement for scalar values * fix fail variables * add check for userInfo * validation checks for conditions * update policy * refactor logs * code review * add openapispec for clusterpolicy preconditions * Update documentation * CR fixes * documentation * CR fixes * update variable * fix logs * update policy * pre-defined variables (serviceAccountName & serviceAccountNamespace) * update test
2020-01-07 15:13:57 -08:00
"k8s.io/client-go/dynamic/dynamicinformer"
"k8s.io/client-go/kubernetes"
certsv1beta1 "k8s.io/client-go/kubernetes/typed/certificates/v1beta1"
corev1 "k8s.io/client-go/kubernetes/typed/core/v1"
"k8s.io/client-go/rest"
)
type Interface interface {
// NewDynamicSharedInformerFactory returns a new instance of DynamicSharedInformerFactory
NewDynamicSharedInformerFactory(time.Duration) dynamicinformer.DynamicSharedInformerFactory
// GetEventsInterface provides typed interface for events
GetEventsInterface() (corev1.EventInterface, error)
// GetCSRInterface provides type interface for CSR
GetCSRInterface() (certsv1beta1.CertificateSigningRequestInterface, error)
// GetDynamicInterface fetches underlying dynamic interface
GetDynamicInterface() dynamic.Interface
// Discovery return the discovery client implementation
Discovery() IDiscovery
// SetDiscovery sets the discovery client implementation
SetDiscovery(discoveryClient IDiscovery)
// GetResource returns the resource in unstructured/json format
GetResource(apiVersion string, kind string, namespace string, name string, subresources ...string) (*unstructured.Unstructured, error)
// PatchResource patches the resource
PatchResource(apiVersion string, kind string, namespace string, name string, patch []byte) (*unstructured.Unstructured, error)
// ListResource returns the list of resources in unstructured/json format
// Access items using []Items
ListResource(apiVersion string, kind string, namespace string, lselector *metav1.LabelSelector) (*unstructured.UnstructuredList, error)
// DeleteResource deletes the specified resource
DeleteResource(apiVersion string, kind string, namespace string, name string, dryRun bool) error
// CreateResource creates object for the specified resource/namespace
CreateResource(apiVersion string, kind string, namespace string, obj interface{}, dryRun bool) (*unstructured.Unstructured, error)
// UpdateResource updates object for the specified resource/namespace
UpdateResource(apiVersion string, kind string, namespace string, obj interface{}, dryRun bool) (*unstructured.Unstructured, error)
// UpdateStatusResource updates the resource "status" subresource
UpdateStatusResource(apiVersion string, kind string, namespace string, obj interface{}, dryRun bool) (*unstructured.Unstructured, error)
}
// Client enables interaction with k8 resource
type client struct {
2019-06-11 14:35:26 -07:00
client dynamic.Interface
discoveryClient IDiscovery
2019-06-11 14:35:26 -07:00
clientConfig *rest.Config
kclient kubernetes.Interface
}
// NewClient creates new instance of client
func NewClient(config *rest.Config, resync time.Duration, stopCh <-chan struct{}) (Interface, error) {
2019-06-11 14:35:26 -07:00
dclient, err := dynamic.NewForConfig(config)
if err != nil {
return nil, err
}
kclient, err := kubernetes.NewForConfig(config)
if err != nil {
return nil, err
}
client := client{
2019-06-11 14:35:26 -07:00
client: dclient,
clientConfig: config,
kclient: kclient,
2019-06-11 14:35:26 -07:00
}
// Set discovery client
discoveryClient := &serverPreferredResources{
api server lookups (#1514) * initial commit for api server lookups Signed-off-by: Jim Bugwadia <jim@nirmata.com> * initial commit for API server lookups Signed-off-by: Jim Bugwadia <jim@nirmata.com> * Enhancing dockerfiles (multi-stage) of kyverno components and adding non-root user to the docker images (#1495) * Dockerfile refactored Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com> * Adding non-root commands to docker images and enhanced the dockerfiles Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com> * changing base image to scratch Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com> * Minor typo fix Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com> * changing dockerfiles to use /etc/passwd to use non-root user' Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com> * minor typo Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com> * minor typo Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com> Signed-off-by: Jim Bugwadia <jim@nirmata.com> * revert cli image name (#1507) Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com> Signed-off-by: Jim Bugwadia <jim@nirmata.com> * Refactor resourceCache; Reduce throttling requests (background controller) (#1500) * skip sending API request for filtered resource * fix PR comment Signed-off-by: Shuting Zhao <shutting06@gmail.com> * fixes https://github.com/kyverno/kyverno/issues/1490 Signed-off-by: Shuting Zhao <shutting06@gmail.com> * fix bug - namespace is not returned properly Signed-off-by: Shuting Zhao <shutting06@gmail.com> * reduce throttling - list resource using lister * refactor resource cache * fix test Signed-off-by: Shuting Zhao <shutting06@gmail.com> * fix label selector Signed-off-by: Shuting Zhao <shutting06@gmail.com> * fix build failure Signed-off-by: Shuting Zhao <shutting06@gmail.com> Signed-off-by: Jim Bugwadia <jim@nirmata.com> * fix merge issues Signed-off-by: Jim Bugwadia <jim@nirmata.com> * fix unit test Signed-off-by: Jim Bugwadia <jim@nirmata.com> * add nil check for API client Signed-off-by: Jim Bugwadia <jim@nirmata.com> Co-authored-by: Raj Babu Das <mail.rajdas@gmail.com> Co-authored-by: shuting <shutting06@gmail.com>
2021-02-01 12:59:13 -08:00
cachedClient: memory.NewMemCacheClient(kclient.Discovery()),
}
// client will invalidate registered resources cache every x seconds,
// As there is no way to identify if the registered resource is available or not
// we will be invalidating the local cache, so the next request get a fresh cache
// If a resource is removed then and cache is not invalidate yet, we will not detect the removal
// but the re-sync shall re-evaluate
go discoveryClient.Poll(resync, stopCh)
2019-06-11 14:35:26 -07:00
client.SetDiscovery(discoveryClient)
return &client, nil
}
// NewDynamicSharedInformerFactory returns a new instance of DynamicSharedInformerFactory
func (c *client) NewDynamicSharedInformerFactory(defaultResync time.Duration) dynamicinformer.DynamicSharedInformerFactory {
593 feature (#594) * initial commit * background policy validation * correct message * skip non-background policy process for add/update * add Generate Request CR * generate Request Generator Initial * test generate request CR generation * initial commit gr generator * generate controller initial framework * add crd for generate request * gr cleanup controller initial commit * cleanup controller initial * generate mid-commit * generate rule processing * create PV on generate error * embed resource type * testing phase 1- generate resources with variable substitution * fix tests * comment broken test #586 * add printer column for state * return if existing resource for clone * set resync time to 2 mins & remove resource version check in update handler for gr * generate events for reporting * fix logs * initial commit * fix trailing quote in patch * remove comments * initial condition (equal & notequal) * initial support for conditions * initial support fo conditions in generate * support precondition checks * cleanup * re-evaluate GR on namespace update using dynamic informers * add status for generated resources * display loaded variable SA * support delete cleanup of generate request main resources * fix log * remove namespace from SA username * support multiple variables per statement for scalar values * fix fail variables * add check for userInfo * validation checks for conditions * update policy * refactor logs * code review * add openapispec for clusterpolicy preconditions * Update documentation * CR fixes * documentation * CR fixes * update variable * fix logs * update policy * pre-defined variables (serviceAccountName & serviceAccountNamespace) * update test
2020-01-07 15:13:57 -08:00
return dynamicinformer.NewDynamicSharedInformerFactory(c.client, defaultResync)
}
// GetEventsInterface provides typed interface for events
func (c *client) GetEventsInterface() (corev1.EventInterface, error) {
return c.kclient.CoreV1().Events(""), nil
}
// GetCSRInterface provides type interface for CSR
func (c *client) GetCSRInterface() (certsv1beta1.CertificateSigningRequestInterface, error) {
return c.kclient.CertificatesV1beta1().CertificateSigningRequests(), nil
}
func (c *client) getInterface(apiVersion string, kind string) dynamic.NamespaceableResourceInterface {
return c.client.Resource(c.getGroupVersionMapper(apiVersion, kind))
}
func (c *client) getResourceInterface(apiVersion string, kind string, namespace string) dynamic.ResourceInterface {
// Get the resource interface from kind
namespaceableInterface := c.getInterface(apiVersion, kind)
// Get the namespacable interface
var resourceInteface dynamic.ResourceInterface
if namespace != "" {
resourceInteface = namespaceableInterface.Namespace(namespace)
} else {
resourceInteface = namespaceableInterface
}
return resourceInteface
}
// Keep this a stateful as the resource list will be based on the kubernetes version we connect to
func (c *client) getGroupVersionMapper(apiVersion string, kind string) schema.GroupVersionResource {
if apiVersion == "" {
gvr, _ := c.discoveryClient.GetGVRFromKind(kind)
return gvr
}
return c.discoveryClient.GetGVRFromAPIVersionKind(apiVersion, kind)
}
// GetResource returns the resource in unstructured/json format
func (c *client) GetResource(apiVersion string, kind string, namespace string, name string, subresources ...string) (*unstructured.Unstructured, error) {
return c.getResourceInterface(apiVersion, kind, namespace).Get(context.TODO(), name, metav1.GetOptions{}, subresources...)
}
// PatchResource patches the resource
func (c *client) PatchResource(apiVersion string, kind string, namespace string, name string, patch []byte) (*unstructured.Unstructured, error) {
return c.getResourceInterface(apiVersion, kind, namespace).Patch(context.TODO(), name, types.JSONPatchType, patch, metav1.PatchOptions{})
2019-07-17 15:04:02 -07:00
}
2020-04-02 12:19:32 +05:30
// GetDynamicInterface fetches underlying dynamic interface
func (c *client) GetDynamicInterface() dynamic.Interface {
2020-04-02 12:19:32 +05:30
return c.client
}
// ListResource returns the list of resources in unstructured/json format
// Access items using []Items
func (c *client) ListResource(apiVersion string, kind string, namespace string, lselector *metav1.LabelSelector) (*unstructured.UnstructuredList, error) {
options := metav1.ListOptions{}
2019-06-25 22:53:18 -07:00
if lselector != nil {
options = metav1.ListOptions{LabelSelector: metav1.FormatLabelSelector(lselector)}
2019-06-25 22:53:18 -07:00
}
return c.getResourceInterface(apiVersion, kind, namespace).List(context.TODO(), options)
}
2019-12-05 11:52:13 -08:00
// DeleteResource deletes the specified resource
func (c *client) DeleteResource(apiVersion string, kind string, namespace string, name string, dryRun bool) error {
options := metav1.DeleteOptions{}
2019-06-18 13:52:12 -07:00
if dryRun {
options = metav1.DeleteOptions{DryRun: []string{metav1.DryRunAll}}
2019-06-18 13:52:12 -07:00
}
return c.getResourceInterface(apiVersion, kind, namespace).Delete(context.TODO(), name, options)
}
// CreateResource creates object for the specified resource/namespace
func (c *client) CreateResource(apiVersion string, kind string, namespace string, obj interface{}, dryRun bool) (*unstructured.Unstructured, error) {
options := metav1.CreateOptions{}
2019-06-18 13:52:12 -07:00
if dryRun {
options = metav1.CreateOptions{DryRun: []string{metav1.DryRunAll}}
2019-06-18 13:52:12 -07:00
}
// convert typed to unstructured obj
if unstructuredObj, err := kubeutils.ConvertToUnstructured(obj); err == nil && unstructuredObj != nil {
return c.getResourceInterface(apiVersion, kind, namespace).Create(context.TODO(), unstructuredObj, options)
}
return nil, fmt.Errorf("unable to create resource ")
}
// UpdateResource updates object for the specified resource/namespace
func (c *client) UpdateResource(apiVersion string, kind string, namespace string, obj interface{}, dryRun bool) (*unstructured.Unstructured, error) {
options := metav1.UpdateOptions{}
2019-06-18 13:52:12 -07:00
if dryRun {
options = metav1.UpdateOptions{DryRun: []string{metav1.DryRunAll}}
2019-06-18 13:52:12 -07:00
}
// convert typed to unstructured obj
if unstructuredObj, err := kubeutils.ConvertToUnstructured(obj); err == nil && unstructuredObj != nil {
return c.getResourceInterface(apiVersion, kind, namespace).Update(context.TODO(), unstructuredObj, options)
}
return nil, fmt.Errorf("unable to update resource ")
}
2019-05-15 12:29:09 -07:00
// UpdateStatusResource updates the resource "status" subresource
func (c *client) UpdateStatusResource(apiVersion string, kind string, namespace string, obj interface{}, dryRun bool) (*unstructured.Unstructured, error) {
options := metav1.UpdateOptions{}
2019-06-18 13:52:12 -07:00
if dryRun {
options = metav1.UpdateOptions{DryRun: []string{metav1.DryRunAll}}
2019-06-18 13:52:12 -07:00
}
2019-05-15 12:29:09 -07:00
// convert typed to unstructured obj
if unstructuredObj, err := kubeutils.ConvertToUnstructured(obj); err == nil && unstructuredObj != nil {
return c.getResourceInterface(apiVersion, kind, namespace).UpdateStatus(context.TODO(), unstructuredObj, options)
2019-05-15 12:29:09 -07:00
}
return nil, fmt.Errorf("unable to update resource ")
2019-05-15 12:29:09 -07:00
}
// Discovery return the discovery client implementation
func (c *client) Discovery() IDiscovery {
return c.discoveryClient
2019-06-11 14:35:26 -07:00
}
// SetDiscovery sets the discovery client implementation
func (c *client) SetDiscovery(discoveryClient IDiscovery) {
c.discoveryClient = discoveryClient
}