Add Support for Cluster Proxy

components/odh-notebook-controller/config/rbac/role.yaml

@@ -11,6 +11,7 @@ rules:
   - secrets
   - serviceaccounts
   - services
+  - configmap
   verbs:
   - create
   - get
@@ -50,3 +51,11 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+    - config.openshift.io
+  resources:
+    - proxies
+  verbs:
+    - get
+    - list
+    - watch

components/odh-notebook-controller/controllers/notebook_controller.go

@@ -136,6 +136,12 @@ func (r *OpenshiftNotebookReconciler) Reconcile(ctx context.Context, req ctrl.Re
 		return ctrl.Result{}, err
 	}
 
+	// Create Configmap
+	err = r.createProxyConfigMap(notebook, ctx)
+	if err != nil {
+		return ctrl.Result{}, err
+	}
+
 	// Create the objects required by the OAuth proxy sidecar (see
 	// notebook_oauth.go file)
 	if OAuthInjectionIsEnabled(notebook.ObjectMeta) {
@@ -182,6 +188,26 @@ func (r *OpenshiftNotebookReconciler) Reconcile(ctx context.Context, req ctrl.Re
 	return ctrl.Result{}, nil
 }
 
+func (r *OpenshiftNotebookReconciler) createProxyConfigMap(notebook *nbv1.Notebook,
+	ctx context.Context) error {
+
+	trustedCAConfigMap := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "trusted-ca",
+			Namespace: notebook.Namespace,
+			Labels:    map[string]string{"config.openshift.io/inject-trusted-cabundle": "true"},
+		},
+	}
+
+	err := r.Client.Create(ctx, trustedCAConfigMap)
+	if err != nil {
+		if apierrs.IsAlreadyExists(err) {
+			return nil
+		}
+	}
+	return err
+}
+
 // SetupWithManager sets up the controller with the Manager.
 func (r *OpenshiftNotebookReconciler) SetupWithManager(mgr ctrl.Manager) error {
 	builder := ctrl.NewControllerManagedBy(mgr).

components/odh-notebook-controller/controllers/notebook_webhook.go

@@ -18,6 +18,8 @@ package controllers
 import (
 	"context"
 	"encoding/json"
+	"fmt"
+	configv1 "github.com/openshift/api/config/v1"
 	"net/http"
 
 	nbv1 "github.com/kubeflow/kubeflow/components/notebook-controller/api/v1"
@@ -41,6 +43,8 @@ type NotebookWebhook struct {
 	OAuthConfig OAuthConfig
 }
 
+var proxyEnvVars = make(map[string]string, 4)
+
 // InjectReconciliationLock injects the kubefllow notebook controller culling
 // stop annotation to explicitly start the notebook pod when the ODH notebook
 // controller finishes the reconciliation. Otherwise a race condition may happen
@@ -244,6 +248,14 @@ func (w *NotebookWebhook) Handle(ctx context.Context, req admission.Request) adm
 		}
 	}
 
+	// If cluster-wide-proxy is enabled add environment variables
+	if w.ClusterWideProxyIsEnabled() {
+		err = InjectProxyConfig(notebook)
+		if err != nil {
+			return admission.Errored(http.StatusInternalServerError, err)
+		}
+	}
+
 	// Create the mutated notebook object
 	marshaledNotebook, err := json.Marshal(notebook)
 	if err != nil {
@@ -253,8 +265,135 @@ func (w *NotebookWebhook) Handle(ctx context.Context, req admission.Request) adm
 	return admission.PatchResponseFromRaw(req.Object.Raw, marshaledNotebook)
 }
 
+func (w *NotebookWebhook) ClusterWideProxyIsEnabled() bool {
+	proxyResourceList := &configv1.ProxyList{}
+	err := w.Client.List(context.TODO(), proxyResourceList)
+	if err != nil {
+		return false
+	}
+
+	for _, proxy := range proxyResourceList.Items {
+		if proxy.Name == "cluster" {
+			if proxy.Status.HTTPProxy != "" && proxy.Status.HTTPSProxy != "" &&
+				proxy.Status.NoProxy != "" {
+				// Update Proxy Env variables map
+				proxyEnvVars["HTTP_PROXY"] = proxy.Status.HTTPProxy
+				proxyEnvVars["HTTPS_PROXY"] = proxy.Status.HTTPSProxy
+				proxyEnvVars["NO_PROXY"] = proxy.Status.NoProxy
+				if proxy.Spec.TrustedCA.Name != "" {
+					proxyEnvVars["PIP_CERT"] = "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"
+				}
+				return true
+			}
+		}
+	}
+	return false
+
+}
+
 // InjectDecoder injects the decoder.
 func (w *NotebookWebhook) InjectDecoder(d *admission.Decoder) error {
 	w.decoder = d
 	return nil
 }
+
+func InjectProxyConfig(notebook *nbv1.Notebook) error {
+	notebookContainers := &notebook.Spec.Template.Spec.Containers
+	var imgContainer corev1.Container
+
+	// Add trusted-ca volume
+	notebookVolumes := &notebook.Spec.Template.Spec.Volumes
+	certVolumeExists := false
+	certVolume := corev1.Volume{
+		Name: "trusted-ca",
+		VolumeSource: corev1.VolumeSource{
+			ConfigMap: &corev1.ConfigMapVolumeSource{
+				LocalObjectReference: corev1.LocalObjectReference{
+					Name: "trusted-ca",
+				},
+				Items: []corev1.KeyToPath{{
+					Key:  "ca-bundle.crt",
+					Path: "tls-ca-bundle.pem",
+				},
+				},
+			},
+		},
+	}
+	for index, volume := range *notebookVolumes {
+		if volume.Name == "trusted-ca" {
+			(*notebookVolumes)[index] = certVolume
+			certVolumeExists = true
+			break
+		}
+	}
+	if !certVolumeExists {
+		*notebookVolumes = append(*notebookVolumes, certVolume)
+	}
+
+	// Update Notebook Image container with env variables and Volume Mounts
+	for _, container := range *notebookContainers {
+		// Update notebook image container with env Variables
+		if container.Name == notebook.Name {
+			var newVars []corev1.EnvVar
+			imgContainer = container
+
+			for key, val := range proxyEnvVars {
+				keyExists := false
+				for _, env := range imgContainer.Env {
+					if key == env.Name {
+						keyExists = true
+						// Update if Proxy spec is updated
+						if env.Value != val {
+							env.Value = val
+						}
+					}
+				}
+				if !keyExists {
+					newVars = append(newVars, corev1.EnvVar{Name: key, Value: val})
+				}
+			}
+
+			// Update container only when required env variables are not present
+			imgContainerExists := false
+			if len(newVars) != 0 {
+				imgContainer.Env = append(imgContainer.Env, newVars...)
+			}
+
+			// Create Volume mount
+			volumeMountExists := false
+			containerVolMounts := &imgContainer.VolumeMounts
+			trustedCAVolMount := corev1.VolumeMount{
+				Name:      "trusted-ca",
+				ReadOnly:  true,
+				MountPath: "/etc/pki/ca-trust/extracted/pem",
+			}
+
+			for index, volumeMount := range *containerVolMounts {
+				if volumeMount.Name == "trusted-ca" {
+					(*containerVolMounts)[index] = trustedCAVolMount
+					volumeMountExists = true
+					break
+				}
+			}
+			if !volumeMountExists {
+				*containerVolMounts = append(*containerVolMounts, trustedCAVolMount)
+			}
+
+			// Update container with Env and Volume Mount Changes
+			for index, container := range *notebookContainers {
+				if container.Name == notebook.Name {
+					(*notebookContainers)[index] = imgContainer
+					imgContainerExists = true
+					break
+				}
+			}
+
+			if !imgContainerExists {
+				return fmt.Errorf("notebook image container not found %v", notebook.Name)
+			}
+			break
+		}
+	}
+	return nil
+
+}

components/odh-notebook-controller/go.mod

@@ -7,14 +7,14 @@ require (
 	github.com/kubeflow/kubeflow/components/notebook-controller v0.0.0-20220728153354-fc09bd1eefb8
 	github.com/onsi/ginkgo v1.16.5
 	github.com/onsi/gomega v1.17.0
-	github.com/openshift/api v3.9.0+incompatible
+	github.com/openshift/api v3.9.1-0.20190924102528-32369d4db2ad+incompatible
 	github.com/pkg/errors v0.9.1
 	github.com/stretchr/testify v1.7.0
 	go.uber.org/zap v1.19.1
-	k8s.io/api v0.23.5
-	k8s.io/apiextensions-apiserver v0.23.1
-	k8s.io/apimachinery v0.23.5
-	k8s.io/client-go v0.23.1
+	k8s.io/api v0.24.3
+	k8s.io/apiextensions-apiserver v0.24.2
+	k8s.io/apimachinery v0.24.3
+	k8s.io/client-go v0.24.2
 	k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9
 	sigs.k8s.io/controller-runtime v0.11.0
 )
@@ -27,52 +27,61 @@ require (
 	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
 	github.com/Azure/go-autorest/logger v0.2.1 // indirect
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
+	github.com/PuerkitoBio/purell v1.1.1 // indirect
+	github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/cespare/xxhash/v2 v2.1.1 // indirect
+	github.com/cespare/xxhash/v2 v2.1.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/emicklei/go-restful v2.9.5+incompatible // indirect
 	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
 	github.com/form3tech-oss/jwt-go v3.2.3+incompatible // indirect
 	github.com/fsnotify/fsnotify v1.5.1 // indirect
 	github.com/go-logr/zapr v1.2.0 // indirect
+	github.com/go-openapi/jsonpointer v0.19.5 // indirect
+	github.com/go-openapi/jsonreference v0.19.5 // indirect
+	github.com/go-openapi/swag v0.19.14 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/google/gnostic v0.5.7-v3refs // indirect
 	github.com/google/go-cmp v0.5.7 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/uuid v1.1.2 // indirect
-	github.com/googleapis/gnostic v0.5.5 // indirect
 	github.com/imdario/mergo v0.3.12 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/mailru/easyjson v0.7.6 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/nxadm/tail v1.4.8 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/client_golang v1.11.0 // indirect
+	github.com/prometheus/client_golang v1.12.1 // indirect
 	github.com/prometheus/client_model v0.2.0 // indirect
-	github.com/prometheus/common v0.28.0 // indirect
-	github.com/prometheus/procfs v0.6.0 // indirect
+	github.com/prometheus/common v0.32.1 // indirect
+	github.com/prometheus/procfs v0.7.3 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	go.uber.org/atomic v1.7.0 // indirect
 	go.uber.org/multierr v1.6.0 // indirect
-	golang.org/x/crypto v0.0.0-20210817164053-32db794688a5 // indirect
-	golang.org/x/net v0.0.0-20211209124913-491a49abca63 // indirect
-	golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f // indirect
-	golang.org/x/sys v0.0.0-20211107104306-e0b2ad06fe42 // indirect
-	golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b // indirect
+	golang.org/x/crypto v0.0.0-20220214200702-86341886e292 // indirect
+	golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd // indirect
+	golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8 // indirect
+	golang.org/x/sys v0.0.0-20220209214540-3681064d5158 // indirect
+	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
 	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
+	golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/protobuf v1.27.1 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
-	k8s.io/component-base v0.23.1 // indirect
+	k8s.io/component-base v0.24.2 // indirect
 	k8s.io/klog/v2 v2.60.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20211115234752-e816edb12b65 // indirect
-	sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6 // indirect
+	k8s.io/kube-openapi v0.0.0-20220328201542-3ee0da9b0b42 // indirect
+	sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
 	sigs.k8s.io/yaml v1.3.0 // indirect
 )