|
| 1 | +/* |
| 2 | +Copyright 2024 The Kubernetes Authors. |
| 3 | +
|
| 4 | +Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | +you may not use this file except in compliance with the License. |
| 6 | +You may obtain a copy of the License at |
| 7 | +
|
| 8 | + http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +
|
| 10 | +Unless required by applicable law or agreed to in writing, software |
| 11 | +distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | +See the License for the specific language governing permissions and |
| 14 | +limitations under the License. |
| 15 | +*/ |
| 16 | + |
| 17 | +package podtopologylabels |
| 18 | + |
| 19 | +import ( |
| 20 | + "context" |
| 21 | + "fmt" |
| 22 | + "io" |
| 23 | + "strings" |
| 24 | + |
| 25 | + "k8s.io/klog/v2" |
| 26 | + |
| 27 | + apierrors "k8s.io/apimachinery/pkg/api/errors" |
| 28 | + "k8s.io/apimachinery/pkg/util/sets" |
| 29 | + "k8s.io/apiserver/pkg/admission" |
| 30 | + genericadmissioninitializer "k8s.io/apiserver/pkg/admission/initializer" |
| 31 | + "k8s.io/client-go/informers" |
| 32 | + corev1listers "k8s.io/client-go/listers/core/v1" |
| 33 | + "k8s.io/component-base/featuregate" |
| 34 | + api "k8s.io/kubernetes/pkg/apis/core" |
| 35 | + "k8s.io/kubernetes/pkg/features" |
| 36 | +) |
| 37 | + |
| 38 | +// PluginName is a string with the name of the plugin |
| 39 | +const PluginName = "PodTopologyLabels" |
| 40 | + |
| 41 | +// Register registers a plugin |
| 42 | +func Register(plugins *admission.Plugins) { |
| 43 | + plugins.Register(PluginName, func(_ io.Reader) (admission.Interface, error) { |
| 44 | + plugin := NewPodTopologyPlugin() |
| 45 | + return plugin, nil |
| 46 | + }) |
| 47 | +} |
| 48 | + |
| 49 | +// NewPodTopologyPlugin initializes a Plugin |
| 50 | +func NewPodTopologyPlugin() *Plugin { |
| 51 | + return &Plugin{ |
| 52 | + Handler: admission.NewHandler(admission.Create), |
| 53 | + // Always copy zone and region labels. |
| 54 | + labels: sets.New("topology.k8s.io/zone", "topology.k8s.io/region"), |
| 55 | + // Also support copying arbitrary custom topology labels. |
| 56 | + domains: sets.New("topology.k8s.io"), |
| 57 | + // Copy any sub-domains of topology.k8s.io as well. |
| 58 | + suffixes: sets.New(".topology.k8s.io"), |
| 59 | + } |
| 60 | +} |
| 61 | + |
| 62 | +type Plugin struct { |
| 63 | + *admission.Handler |
| 64 | + |
| 65 | + nodeLister corev1listers.NodeLister |
| 66 | + |
| 67 | + // explicit labels, list of domains or a list of domain |
| 68 | + // suffixes to be copies to Pod objects being bound. |
| 69 | + labels, domains, suffixes sets.Set[string] |
| 70 | + |
| 71 | + enabled, inspectedFeatureGates bool |
| 72 | +} |
| 73 | + |
| 74 | +var _ admission.MutationInterface = &Plugin{} |
| 75 | +var _ genericadmissioninitializer.WantsExternalKubeInformerFactory = &Plugin{} |
| 76 | +var _ genericadmissioninitializer.WantsFeatures = &Plugin{} |
| 77 | + |
| 78 | +// InspectFeatureGates implements WantsFeatures. |
| 79 | +func (p *Plugin) InspectFeatureGates(featureGates featuregate.FeatureGate) { |
| 80 | + p.enabled = featureGates.Enabled(features.PodTopologyLabelsAdmission) |
| 81 | + p.inspectedFeatureGates = true |
| 82 | +} |
| 83 | + |
| 84 | +func (p *Plugin) SetExternalKubeInformerFactory(factory informers.SharedInformerFactory) { |
| 85 | + nodeInformer := factory.Core().V1().Nodes() |
| 86 | + p.nodeLister = nodeInformer.Lister() |
| 87 | + p.SetReadyFunc(nodeInformer.Informer().HasSynced) |
| 88 | +} |
| 89 | + |
| 90 | +func (p *Plugin) ValidateInitialization() error { |
| 91 | + if p.nodeLister == nil { |
| 92 | + return fmt.Errorf("nodeLister not set") |
| 93 | + } |
| 94 | + if !p.inspectedFeatureGates { |
| 95 | + return fmt.Errorf("feature gates not inspected") |
| 96 | + } |
| 97 | + return nil |
| 98 | +} |
| 99 | + |
| 100 | +func (p *Plugin) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) (err error) { |
| 101 | + if !p.enabled { |
| 102 | + return nil |
| 103 | + } |
| 104 | + if shouldIgnore(a) { |
| 105 | + return nil |
| 106 | + } |
| 107 | + // we need to wait for our caches to warm |
| 108 | + if !p.WaitForReady() { |
| 109 | + return admission.NewForbidden(a, fmt.Errorf("not yet ready to handle request")) |
| 110 | + } |
| 111 | + |
| 112 | + binding := a.GetObject().(*api.Binding) |
| 113 | + // other fields are not set by the default scheduler for the binding target, so only check the Kind. |
| 114 | + if binding.Target.Kind != "Node" { |
| 115 | + klog.V(6).Info("Skipping Pod being bound to non-Node object type", "target", binding.Target.GroupVersionKind()) |
| 116 | + return nil |
| 117 | + } |
| 118 | + |
| 119 | + node, err := p.nodeLister.Get(binding.Target.Name) |
| 120 | + if err != nil { |
| 121 | + // Ignore NotFound errors to avoid risking breaking compatibility/behaviour. |
| 122 | + if apierrors.IsNotFound(err) { |
| 123 | + return nil |
| 124 | + } |
| 125 | + return err |
| 126 | + } |
| 127 | + |
| 128 | + // fast-path/short circuit if the node has no labels |
| 129 | + if node.Labels == nil { |
| 130 | + return nil |
| 131 | + } |
| 132 | + |
| 133 | + labelsToCopy := make(map[string]string) |
| 134 | + for k, v := range node.Labels { |
| 135 | + if !p.isTopologyLabel(k) { |
| 136 | + continue |
| 137 | + } |
| 138 | + labelsToCopy[k] = v |
| 139 | + } |
| 140 | + |
| 141 | + if len(labelsToCopy) == 0 { |
| 142 | + // fast-path/short circuit if the node has no topology labels |
| 143 | + return nil |
| 144 | + } |
| 145 | + |
| 146 | + // copy the topology labels into the Binding's labels, as these are copied from the Binding |
| 147 | + // to the Pod object being bound within the podBinding registry/store. |
| 148 | + if binding.Labels == nil { |
| 149 | + binding.Labels = make(map[string]string) |
| 150 | + } |
| 151 | + for k, v := range labelsToCopy { |
| 152 | + if _, exists := binding.Labels[k]; exists { |
| 153 | + // Don't overwrite labels on Binding resources as this could lead to unexpected |
| 154 | + // behaviour if any schedulers rely on being able to explicitly set values themselves. |
| 155 | + continue |
| 156 | + } |
| 157 | + binding.Labels[k] = v |
| 158 | + } |
| 159 | + |
| 160 | + return nil |
| 161 | +} |
| 162 | + |
| 163 | +func (p *Plugin) isTopologyLabel(key string) bool { |
| 164 | + // First check explicit label keys. |
| 165 | + if p.labels.Has(key) { |
| 166 | + return true |
| 167 | + } |
| 168 | + // Check the domain portion of the label key, if present |
| 169 | + domain, _, hasDomain := strings.Cut(key, "/") |
| 170 | + if !hasDomain { |
| 171 | + // fast-path if there is no / separator |
| 172 | + return false |
| 173 | + } |
| 174 | + if p.domains.Has(domain) { |
| 175 | + // check for explicit domains to copy |
| 176 | + return true |
| 177 | + } |
| 178 | + for _, suffix := range p.suffixes.UnsortedList() { |
| 179 | + // check if the domain has one of the suffixes that are to be copied |
| 180 | + if strings.HasSuffix(domain, suffix) { |
| 181 | + return true |
| 182 | + } |
| 183 | + } |
| 184 | + return false |
| 185 | +} |
| 186 | + |
| 187 | +func shouldIgnore(a admission.Attributes) bool { |
| 188 | + resource := a.GetResource().GroupResource() |
| 189 | + if resource != api.Resource("pods") { |
| 190 | + return true |
| 191 | + } |
| 192 | + if a.GetSubresource() != "binding" { |
| 193 | + // only run the checks below on the binding subresource |
| 194 | + return true |
| 195 | + } |
| 196 | + |
| 197 | + obj := a.GetObject() |
| 198 | + _, ok := obj.(*api.Binding) |
| 199 | + if !ok { |
| 200 | + klog.Errorf("expected Binding but got %s", a.GetKind().Kind) |
| 201 | + return true |
| 202 | + } |
| 203 | + |
| 204 | + return false |
| 205 | +} |
0 commit comments