Skip to content

Commit 5c83032

Browse files
jukiearkodg
jukie
authored and
arkodg
committed
fix: fix topology injector bug (envoyproxy#5911)
* fix webhook Signed-off-by: Jukie <[email protected]> * lint and test fixes Signed-off-by: Jukie <[email protected]> --------- Signed-off-by: Jukie <[email protected]>
1 parent 0f5c0a8 commit 5c83032

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+147
-138
lines changed

‎go.mod

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@ require (
2727
github.com/go-logfmt/logfmt v0.6.0
2828
github.com/go-logr/logr v1.4.2
2929
github.com/go-logr/zapr v1.3.0
30-
github.com/go-openapi/jsonpointer v0.21.1
3130
github.com/go-openapi/spec v0.21.0
3231
github.com/go-openapi/strfmt v0.23.0
3332
github.com/go-openapi/validate v0.24.0
@@ -62,6 +61,7 @@ require (
6261
go.uber.org/zap v1.27.0
6362
golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8
6463
golang.org/x/net v0.39.0
64+
gomodules.xyz/jsonpatch/v2 v2.4.0
6565
google.golang.org/genproto/googleapis/api v0.0.0-20250218202821-56aae31c358a
6666
google.golang.org/grpc v1.72.0
6767
google.golang.org/grpc/security/advancedtls v1.0.0
@@ -221,6 +221,7 @@ require (
221221
github.com/go-ole/go-ole v1.3.0 // indirect
222222
github.com/go-openapi/analysis v0.23.0 // indirect
223223
github.com/go-openapi/errors v0.22.0 // indirect
224+
github.com/go-openapi/jsonpointer v0.21.1 // indirect
224225
github.com/go-openapi/jsonreference v0.21.0 // indirect
225226
github.com/go-openapi/loads v0.22.0 // indirect
226227
github.com/go-openapi/swag v0.23.1 // indirect
@@ -489,7 +490,6 @@ require (
489490
golang.org/x/time v0.10.0 // indirect
490491
golang.org/x/tools v0.31.0 // indirect
491492
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
492-
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
493493
google.golang.org/genproto/googleapis/rpc v0.0.0-20250219182151-9fdb1cabc7b2 // indirect
494494
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 // indirect
495495
gopkg.in/alecthomas/kingpin.v2 v2.2.6 // indirect

‎internal/cmd/certgen.go

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ import (
1515

1616
"github.com/spf13/cobra"
1717
admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
18+
corev1 "k8s.io/api/core/v1"
19+
"k8s.io/apimachinery/pkg/types"
1820
"sigs.k8s.io/controller-runtime/pkg/client"
1921
clicfg "sigs.k8s.io/controller-runtime/pkg/client/config"
2022

@@ -80,7 +82,7 @@ func certGen(ctx context.Context, logOut io.Writer, local bool) error {
8082
if err = outputCertsForKubernetes(ctx, cli, cfg, overwriteControlPlaneCerts, certs); err != nil {
8183
return fmt.Errorf("failed to output certificates: %w", err)
8284
}
83-
if err = patchTopologyInjectorWebhook(ctx, cli, cfg, certs.CACertificate); err != nil {
85+
if err = patchTopologyInjectorWebhook(ctx, cli, cfg); err != nil {
8486
return fmt.Errorf("failed to patch webhook: %w", err)
8587
}
8688
} else {
@@ -116,7 +118,7 @@ func outputCertsForKubernetes(ctx context.Context, cli client.Client, cfg *confi
116118
return nil
117119
}
118120

119-
func patchTopologyInjectorWebhook(ctx context.Context, cli client.Client, cfg *config.Server, caBundle []byte) error {
121+
func patchTopologyInjectorWebhook(ctx context.Context, cli client.Client, cfg *config.Server) error {
120122
if disableTopologyInjector {
121123
return nil
122124
}
@@ -127,10 +129,17 @@ func patchTopologyInjectorWebhook(ctx context.Context, cli client.Client, cfg *c
127129
return fmt.Errorf("failed to get mutating webhook configuration: %w", err)
128130
}
129131

132+
secretName := types.NamespacedName{Name: "envoy-gateway", Namespace: cfg.ControllerNamespace}
133+
current := &corev1.Secret{}
134+
if err := cli.Get(ctx, secretName, current); err != nil {
135+
return fmt.Errorf("failed to get secret %s/%s: %w", current.Namespace, current.Name, err)
136+
}
137+
130138
var updated bool
139+
desiredBundle := current.Data["ca.crt"]
131140
for i, webhook := range webhookCfg.Webhooks {
132-
if !bytes.Equal(caBundle, webhook.ClientConfig.CABundle) {
133-
webhookCfg.Webhooks[i].ClientConfig.CABundle = caBundle
141+
if !bytes.Equal(desiredBundle, webhook.ClientConfig.CABundle) {
142+
webhookCfg.Webhooks[i].ClientConfig.CABundle = desiredBundle
134143
updated = true
135144
}
136145
}

‎internal/cmd/certgen_test.go

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ import (
1515
"github.com/stretchr/testify/assert"
1616
"github.com/stretchr/testify/require"
1717
admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
18+
corev1 "k8s.io/api/core/v1"
1819
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1920
"sigs.k8s.io/controller-runtime/pkg/client"
2021
"sigs.k8s.io/controller-runtime/pkg/client/fake"
@@ -57,7 +58,7 @@ func TestPatchTopologyWebhook(t *testing.T) {
5758
cases := []struct {
5859
caseName string
5960
webhook *admissionregistrationv1.MutatingWebhookConfiguration
60-
caBundle []byte
61+
secret *corev1.Secret
6162
wantErr error
6263
wantPatch bool
6364
}{
@@ -69,7 +70,10 @@ func TestPatchTopologyWebhook(t *testing.T) {
6970
},
7071
Webhooks: []admissionregistrationv1.MutatingWebhook{{ClientConfig: admissionregistrationv1.WebhookClientConfig{}}},
7172
},
72-
caBundle: []byte("foo"),
73+
secret: &corev1.Secret{
74+
ObjectMeta: metav1.ObjectMeta{Name: "envoy-gateway", Namespace: cfg.ControllerNamespace},
75+
Data: map[string][]byte{"ca.crt": []byte("foo")},
76+
},
7377
wantErr: nil,
7478
wantPatch: true,
7579
},
@@ -81,25 +85,28 @@ func TestPatchTopologyWebhook(t *testing.T) {
8185
},
8286
Webhooks: []admissionregistrationv1.MutatingWebhook{{ClientConfig: admissionregistrationv1.WebhookClientConfig{CABundle: []byte("foo")}}},
8387
},
84-
caBundle: []byte("foo"),
88+
secret: &corev1.Secret{
89+
ObjectMeta: metav1.ObjectMeta{Name: "envoy-gateway", Namespace: cfg.ControllerNamespace},
90+
Data: map[string][]byte{"ca.crt": []byte("foo")},
91+
},
8592
wantPatch: false,
8693
},
8794
}
8895
for _, tc := range cases {
8996
t.Run(tc.caseName, func(t *testing.T) {
9097
fakeClient := fake.NewClientBuilder().
91-
WithRuntimeObjects(tc.webhook).
98+
WithRuntimeObjects(tc.webhook, tc.secret).
9299
Build()
93100
beforeWebhook := &admissionregistrationv1.MutatingWebhookConfiguration{}
94101
require.NoError(t, fakeClient.Get(context.Background(), client.ObjectKey{Name: tc.webhook.Name}, beforeWebhook))
95-
err = patchTopologyInjectorWebhook(context.Background(), fakeClient, cfg, tc.caBundle)
96102

103+
err = patchTopologyInjectorWebhook(context.Background(), fakeClient, cfg)
97104
require.NoError(t, err)
98105

99106
afterWebhook := &admissionregistrationv1.MutatingWebhookConfiguration{}
100107
require.NoError(t, fakeClient.Get(context.Background(), client.ObjectKey{Name: tc.webhook.Name}, afterWebhook))
101108

102-
require.Equal(t, afterWebhook.Webhooks[0].ClientConfig.CABundle, tc.caBundle)
109+
require.Equal(t, afterWebhook.Webhooks[0].ClientConfig.CABundle, tc.secret.Data["ca.crt"])
103110
assert.Equal(t, tc.wantPatch, beforeWebhook.GetResourceVersion() != afterWebhook.GetResourceVersion())
104111
})
105112
}

‎internal/infrastructure/kubernetes/proxy/resource.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -402,7 +402,7 @@ func expectedContainerEnv(containerSpec *egv1a1.KubernetesContainerSpec, gateway
402402
ValueFrom: &corev1.EnvVarSource{
403403
FieldRef: &corev1.ObjectFieldSelector{
404404
APIVersion: "v1",
405-
FieldPath: fmt.Sprintf("metadata.labels['%s']", corev1.LabelTopologyZone),
405+
FieldPath: fmt.Sprintf("metadata.annotations['%s']", corev1.LabelTopologyZone),
406406
},
407407
},
408408
},

‎internal/infrastructure/kubernetes/proxy/testdata/daemonsets/component-level.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ spec:
5555
valueFrom:
5656
fieldRef:
5757
apiVersion: v1
58-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
58+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
5959
- name: ENVOY_POD_NAME
6060
valueFrom:
6161
fieldRef:
@@ -142,7 +142,7 @@ spec:
142142
valueFrom:
143143
fieldRef:
144144
apiVersion: v1
145-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
145+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
146146
- name: ENVOY_POD_NAME
147147
valueFrom:
148148
fieldRef:

‎internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -258,7 +258,7 @@ spec:
258258
valueFrom:
259259
fieldRef:
260260
apiVersion: v1
261-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
261+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
262262
- name: ENVOY_POD_NAME
263263
valueFrom:
264264
fieldRef:
@@ -339,7 +339,7 @@ spec:
339339
valueFrom:
340340
fieldRef:
341341
apiVersion: v1
342-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
342+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
343343
- name: ENVOY_POD_NAME
344344
valueFrom:
345345
fieldRef:

‎internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -257,7 +257,7 @@ spec:
257257
valueFrom:
258258
fieldRef:
259259
apiVersion: v1
260-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
260+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
261261
- name: ENVOY_POD_NAME
262262
valueFrom:
263263
fieldRef:
@@ -338,7 +338,7 @@ spec:
338338
valueFrom:
339339
fieldRef:
340340
apiVersion: v1
341-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
341+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
342342
- name: ENVOY_POD_NAME
343343
valueFrom:
344344
fieldRef:

‎internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -242,7 +242,7 @@ spec:
242242
valueFrom:
243243
fieldRef:
244244
apiVersion: v1
245-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
245+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
246246
- name: ENVOY_POD_NAME
247247
valueFrom:
248248
fieldRef:
@@ -329,7 +329,7 @@ spec:
329329
valueFrom:
330330
fieldRef:
331331
apiVersion: v1
332-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
332+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
333333
- name: ENVOY_POD_NAME
334334
valueFrom:
335335
fieldRef:

‎internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -191,7 +191,7 @@ spec:
191191
valueFrom:
192192
fieldRef:
193193
apiVersion: v1
194-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
194+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
195195
- name: ENVOY_POD_NAME
196196
valueFrom:
197197
fieldRef:
@@ -275,7 +275,7 @@ spec:
275275
valueFrom:
276276
fieldRef:
277277
apiVersion: v1
278-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
278+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
279279
- name: ENVOY_POD_NAME
280280
valueFrom:
281281
fieldRef:

‎internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -257,7 +257,7 @@ spec:
257257
valueFrom:
258258
fieldRef:
259259
apiVersion: v1
260-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
260+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
261261
- name: ENVOY_POD_NAME
262262
valueFrom:
263263
fieldRef:
@@ -342,7 +342,7 @@ spec:
342342
valueFrom:
343343
fieldRef:
344344
apiVersion: v1
345-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
345+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
346346
- name: ENVOY_POD_NAME
347347
valueFrom:
348348
fieldRef:

‎internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -251,7 +251,7 @@ spec:
251251
valueFrom:
252252
fieldRef:
253253
apiVersion: v1
254-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
254+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
255255
- name: ENVOY_POD_NAME
256256
valueFrom:
257257
fieldRef:
@@ -338,7 +338,7 @@ spec:
338338
valueFrom:
339339
fieldRef:
340340
apiVersion: v1
341-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
341+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
342342
- name: ENVOY_POD_NAME
343343
valueFrom:
344344
fieldRef:

‎internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -242,7 +242,7 @@ spec:
242242
valueFrom:
243243
fieldRef:
244244
apiVersion: v1
245-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
245+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
246246
- name: ENVOY_POD_NAME
247247
valueFrom:
248248
fieldRef:
@@ -329,7 +329,7 @@ spec:
329329
valueFrom:
330330
fieldRef:
331331
apiVersion: v1
332-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
332+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
333333
- name: ENVOY_POD_NAME
334334
valueFrom:
335335
fieldRef:

‎internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -242,7 +242,7 @@ spec:
242242
valueFrom:
243243
fieldRef:
244244
apiVersion: v1
245-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
245+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
246246
- name: ENVOY_POD_NAME
247247
valueFrom:
248248
fieldRef:
@@ -334,7 +334,7 @@ spec:
334334
valueFrom:
335335
fieldRef:
336336
apiVersion: v1
337-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
337+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
338338
- name: ENVOY_POD_NAME
339339
valueFrom:
340340
fieldRef:

‎internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -257,7 +257,7 @@ spec:
257257
valueFrom:
258258
fieldRef:
259259
apiVersion: v1
260-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
260+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
261261
- name: ENVOY_POD_NAME
262262
valueFrom:
263263
fieldRef:
@@ -342,7 +342,7 @@ spec:
342342
valueFrom:
343343
fieldRef:
344344
apiVersion: v1
345-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
345+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
346346
- name: ENVOY_POD_NAME
347347
valueFrom:
348348
fieldRef:

‎internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -247,7 +247,7 @@ spec:
247247
valueFrom:
248248
fieldRef:
249249
apiVersion: v1
250-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
250+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
251251
- name: ENVOY_POD_NAME
252252
valueFrom:
253253
fieldRef:
@@ -334,7 +334,7 @@ spec:
334334
valueFrom:
335335
fieldRef:
336336
apiVersion: v1
337-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
337+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
338338
- name: ENVOY_POD_NAME
339339
valueFrom:
340340
fieldRef:

‎internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-concurrency.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ spec:
5555
valueFrom:
5656
fieldRef:
5757
apiVersion: v1
58-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
58+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
5959
- name: ENVOY_POD_NAME
6060
valueFrom:
6161
fieldRef:
@@ -142,7 +142,7 @@ spec:
142142
valueFrom:
143143
fieldRef:
144144
apiVersion: v1
145-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
145+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
146146
- name: ENVOY_POD_NAME
147147
valueFrom:
148148
fieldRef:

‎internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -244,7 +244,7 @@ spec:
244244
valueFrom:
245245
fieldRef:
246246
apiVersion: v1
247-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
247+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
248248
- name: ENVOY_POD_NAME
249249
valueFrom:
250250
fieldRef:
@@ -331,7 +331,7 @@ spec:
331331
valueFrom:
332332
fieldRef:
333333
apiVersion: v1
334-
fieldPath: metadata.labels['topology.kubernetes.io/zone']
334+
fieldPath: metadata.annotations['topology.kubernetes.io/zone']
335335
- name: ENVOY_POD_NAME
336336
valueFrom:
337337
fieldRef:

0 commit comments

Comments
 (0)