Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix problem where AWS IAM pod webhook could deny admission, fix problem where credentials operator would not report status to cloud despite being configured #95

Merged
merged 3 commits into from
Nov 27, 2023
Merged

Fix problem where AWS IAM pod webhook could deny admission, fix problem where credentials operator would not report status to cloud despite being configured #95

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
edc439e
Make cloud client report status even if no cert provider is used
orishoshan Nov 27, 2023
fec5445
Pod webhook no longer fails requests if it gets an error, instead sen…
orishoshan Nov 27, 2023
77e7b19
Increase retry count in webhook and also handle not found errors, in …
orishoshan Nov 27, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions src/operator/controllers/webhooks/pod_webhook.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,12 +85,12 @@ func (a *ServiceAccountAnnotatingPodWebhook) handleOnce(ctx context.Context, pod
}

// dryRun: should not cause any modifications except to the Pod in the request.
func (a *ServiceAccountAnnotatingPodWebhook) handleWithRetriesOnConflict(ctx context.Context, pod corev1.Pod, dryRun bool) (outputPod corev1.Pod, patched bool, successMsg string, err error) {
for attempt := 0; attempt < 3; attempt++ {
func (a *ServiceAccountAnnotatingPodWebhook) handleWithRetriesOnConflictOrNotFound(ctx context.Context, pod corev1.Pod, dryRun bool) (outputPod corev1.Pod, patched bool, successMsg string, err error) {
for attempt := 0; attempt < 5; attempt++ {
logrus.Debugf("Handling pod '%s' in namespace '%s' (attempt %d out of %d)", pod.Name, pod.Namespace, attempt+1, 3)
outputPod, patched, successMsg, err = a.handleOnce(ctx, *pod.DeepCopy(), dryRun)
if err != nil {
if k8serrors.IsConflict(err) {
if k8serrors.IsConflict(err) || k8serrors.IsNotFound(err) {
logrus.WithError(err).Errorf("failed to handle pod '%s' in namespace '%s' due to conflict, retrying in 1 second (attempt %d out of %d)", pod.Name, pod.Namespace, attempt+1, 3)
time.Sleep(1 * time.Second)
continue
Expand All @@ -113,9 +113,9 @@ func (a *ServiceAccountAnnotatingPodWebhook) Handle(ctx context.Context, req adm
}
logrus.Debugf("Got webhook call for pod '%s' in namespace '%s'", pod.Name, pod.Namespace)

pod, patched, successMsg, err := a.handleWithRetriesOnConflict(ctx, pod, req.DryRun != nil && *req.DryRun)
pod, patched, successMsg, err := a.handleWithRetriesOnConflictOrNotFound(ctx, pod, req.DryRun != nil && *req.DryRun)
if err != nil {
return admission.Errored(http.StatusInternalServerError, err)
return admission.Allowed("pod admitted, but failed to annotate service account, see warnings").WithWarnings(err.Error())
}

if !patched {
Expand Down
18 changes: 11 additions & 7 deletions src/operator/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,18 +178,22 @@ func main() {
serviceIdResolver := serviceidresolver.NewResolver(mgr.GetClient())
eventRecorder := mgr.GetEventRecorderFor("credentials-operator")

otterizeCloudClient, clientInitializedWithCredentials, err := otterizeclient.NewCloudClient(ctx)
if err != nil {
logrus.WithError(err).Error("failed to initialize cloud client")
os.Exit(1)
}

if clientInitializedWithCredentials {
otterizeclient.PeriodicallyReportConnectionToCloud(otterizeCloudClient)
}

if certProvider == CertProviderCloud {
otterizeCloudClient, hasCredentials, err := otterizeclient.NewCloudClient(ctx)
if err != nil {
logrus.WithError(err).Error("failed to connect to otterize cloud")
os.Exit(1)
}
if !hasCredentials {
if !clientInitializedWithCredentials {
logrus.Fatal("using cloud, but cloud credentials not specified")
}
workloadRegistry = otterizeCloudClient
userAndPassAcquirer = otterizeCloudClient
otterizeclient.PeriodicallyReportConnectionToCloud(otterizeCloudClient)
otterizeCertManager := otterizecertgen.NewOtterizeCertificateGenerator(otterizeCloudClient)
secretsManager = secrets.NewDirectSecretsManager(mgr.GetClient(), serviceIdResolver, eventRecorder, otterizeCertManager)
} else if certProvider == CertProviderSPIRE {
Expand Down
Loading