UPSTREAM: <carry>: Add host assignment plugin for CRD-based routes.

OpenShift-Rebase-Source: 453583e

openshift-kube-apiserver/admission/admissionenablement/register.go

@@ -18,12 +18,14 @@ import (
 	"k8s.io/kubernetes/openshift-kube-apiserver/admission/network/externalipranger"
 	"k8s.io/kubernetes/openshift-kube-apiserver/admission/network/restrictedendpoints"
 	ingressadmission "k8s.io/kubernetes/openshift-kube-apiserver/admission/route"
+	"k8s.io/kubernetes/openshift-kube-apiserver/admission/route/hostassignment"
 	projectnodeenv "k8s.io/kubernetes/openshift-kube-apiserver/admission/scheduler/nodeenv"
 	schedulerpodnodeconstraints "k8s.io/kubernetes/openshift-kube-apiserver/admission/scheduler/podnodeconstraints"
 )
 
 func RegisterOpenshiftKubeAdmissionPlugins(plugins *admission.Plugins) {
 	authorizationrestrictusers.Register(plugins)
+	hostassignment.Register(plugins)
 	imagepolicy.Register(plugins)
 	ingressadmission.Register(plugins)
 	managementcpusoverride.Register(plugins)
@@ -65,6 +67,7 @@ var (
 		"security.openshift.io/SecurityContextConstraint",
 		"security.openshift.io/SCCExecRestrictions",
 		"route.openshift.io/IngressAdmission",
+		hostassignment.PluginName, // "route.openshift.io/RouteHostAssignment"
 	}
 
 	// openshiftAdmissionPluginsForKubeAfterResourceQuota are the plugins to add after ResourceQuota plugin

openshift-kube-apiserver/admission/route/apis/hostassignment/doc.go

@@ -0,0 +1,4 @@
+// +k8s:deepcopy-gen=package,register
+
+// Package hostassignment is the internal version of the API.
+package hostassignment

openshift-kube-apiserver/admission/route/apis/hostassignment/register.go

@@ -0,0 +1,31 @@
+package hostassignment
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// SchemeGroupVersion is group version used to register these objects
+var GroupVersion = schema.GroupVersion{Group: "route.openshift.io", Version: runtime.APIVersionInternal}
+
+// Kind takes an unqualified kind and returns back a Group qualified GroupKind
+func Kind(kind string) schema.GroupKind {
+	return GroupVersion.WithKind(kind).GroupKind()
+}
+
+// Resource takes an unqualified resource and returns back a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return GroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	schemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
+	Install       = schemeBuilder.AddToScheme
+)
+
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(GroupVersion,
+		&HostAssignmentAdmissionConfig{},
+	)
+	return nil
+}

openshift-kube-apiserver/admission/route/apis/hostassignment/types.go

@@ -0,0 +1,17 @@
+package hostassignment
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// HostAssignmentAdmissionConfig is the configuration for the the route host assignment plugin.
+type HostAssignmentAdmissionConfig struct {
+	metav1.TypeMeta
+
+	// domain is used to generate a default host name for a route when the
+	// route's host name is empty. The generated host name will follow this
+	// pattern: "<route-name>.<route-namespace>.<domain>".
+	Domain string
+}

openshift-kube-apiserver/admission/route/apis/hostassignment/v1/doc.go

@@ -0,0 +1,5 @@
+// +k8s:deepcopy-gen=package,register
+// +k8s:conversion-gen=k8s.io/kubernetes/openshift-kube-apiserver/admission/route/apis/hostassignment
+
+// Package v1 is the v1 version of the API.
+package v1

openshift-kube-apiserver/admission/route/apis/hostassignment/v1/register.go

@@ -0,0 +1,64 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// GroupName specifies the group name used to register the objects.
+const GroupName = "route.openshift.io"
+
+// GroupVersion specifies the group and the version used to register the objects.
+var GroupVersion = v1.GroupVersion{Group: GroupName, Version: "v1"}
+
+// SchemeGroupVersion is group version used to register these objects
+// Deprecated: use GroupVersion instead.
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      runtime.SchemeBuilder
+	localSchemeBuilder = &SchemeBuilder
+	// Depreciated: use Install instead
+	AddToScheme = localSchemeBuilder.AddToScheme
+	Install     = localSchemeBuilder.AddToScheme
+)
+
+func init() {
+	// We only register manually written functions here. The registration of the
+	// generated functions takes place in the generated files. The separation
+	// makes the code compile even when the generated files are missing.
+	localSchemeBuilder.Register(addKnownTypes)
+}
+
+// Adds the list of known types to Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&HostAssignmentAdmissionConfig{},
+	)
+	// AddToGroupVersion allows the serialization of client types like ListOptions.
+	v1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}

openshift-kube-apiserver/admission/route/apis/hostassignment/v1/types.go

@@ -0,0 +1,17 @@
+package v1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// HostAssignmentAdmissionConfig is the configuration for the the route host assignment plugin.
+type HostAssignmentAdmissionConfig struct {
+	metav1.TypeMeta `json:",inline"`
+
+	// domain is used to generate a default host name for a route when the
+	// route's host name is empty. The generated host name will follow this
+	// pattern: "<route-name>.<route-namespace>.<domain>".
+	Domain string `json:"domain"`
+}

openshift-kube-apiserver/admission/route/hostassignment/admission.go

@@ -0,0 +1,157 @@
+package hostassignment
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/apiserver/pkg/admission"
+	"k8s.io/apiserver/pkg/admission/initializer"
+	"k8s.io/client-go/kubernetes"
+	authorizationv1 "k8s.io/client-go/kubernetes/typed/authorization/v1"
+
+	routev1 "github.com/openshift/api/route/v1"
+	"github.com/openshift/library-go/pkg/config/helpers"
+	"github.com/openshift/library-go/pkg/route/hostassignment"
+	hostassignmentapi "k8s.io/kubernetes/openshift-kube-apiserver/admission/route/apis/hostassignment"
+	hostassignmentv1 "k8s.io/kubernetes/openshift-kube-apiserver/admission/route/apis/hostassignment/v1"
+)
+
+const PluginName = "route.openshift.io/RouteHostAssignment"
+
+func Register(plugins *admission.Plugins) {
+	plugins.Register(PluginName, func(config io.Reader) (admission.Interface, error) {
+		pluginConfig, err := readConfig(config)
+		if err != nil {
+			return nil, err
+		}
+		return newHostAssignment(pluginConfig)
+	})
+}
+
+type hostAssignment struct {
+	*admission.Handler
+
+	hostnameGenerator hostassignment.HostnameGenerator
+	sarClient         authorizationv1.SubjectAccessReviewInterface
+}
+
+func readConfig(reader io.Reader) (*hostassignmentapi.HostAssignmentAdmissionConfig, error) {
+	obj, err := helpers.ReadYAMLToInternal(reader, hostassignmentapi.Install, hostassignmentv1.Install)
+	if err != nil {
+		return nil, err
+	}
+	if obj == nil {
+		scheme := runtime.NewScheme()
+		hostassignmentapi.Install(scheme)
+		hostassignmentv1.Install(scheme)
+		external := &hostassignmentv1.HostAssignmentAdmissionConfig{}
+		scheme.Default(external)
+		internal := &hostassignmentapi.HostAssignmentAdmissionConfig{}
+		if err := scheme.Convert(external, internal, nil); err != nil {
+			return nil, fmt.Errorf("failed to produce default config: %w", err)
+		}
+		obj = internal
+	}
+	config, ok := obj.(*hostassignmentapi.HostAssignmentAdmissionConfig)
+	if !ok {
+		return nil, fmt.Errorf("unexpected config object: %#v", obj)
+	}
+	return config, nil
+}
+
+func newHostAssignment(config *hostassignmentapi.HostAssignmentAdmissionConfig) (*hostAssignment, error) {
+	hostnameGenerator, err := hostassignment.NewSimpleAllocationPlugin(config.Domain)
+	if err != nil {
+		return nil, fmt.Errorf("configuration failed: %w", err)
+	}
+	return &hostAssignment{
+		Handler:           admission.NewHandler(admission.Create, admission.Update),
+		hostnameGenerator: hostnameGenerator,
+	}, nil
+}
+
+func toRoute(uncastObj runtime.Object) (*routev1.Route, runtime.Unstructured, field.ErrorList) {
+	u, ok := uncastObj.(runtime.Unstructured)
+	if !ok {
+		return nil, nil, field.ErrorList{
+			field.NotSupported(field.NewPath("kind"), fmt.Sprintf("%T", uncastObj), []string{"Route"}),
+			field.NotSupported(field.NewPath("apiVersion"), fmt.Sprintf("%T", uncastObj), []string{routev1.GroupVersion.String()}),
+		}
+	}
+
+	var out routev1.Route
+	if err := runtime.DefaultUnstructuredConverter.FromUnstructured(u.UnstructuredContent(), &out); err != nil {
+		return nil, nil, field.ErrorList{
+			field.NotSupported(field.NewPath("kind"), fmt.Sprintf("%T", uncastObj), []string{"Route"}),
+			field.NotSupported(field.NewPath("apiVersion"), fmt.Sprintf("%T", uncastObj), []string{routev1.GroupVersion.String()}),
+		}
+	}
+
+	return &out, u, nil
+}
+
+var _ admission.MutationInterface = &hostAssignment{}
+
+func (a *hostAssignment) Admit(ctx context.Context, attributes admission.Attributes, o admission.ObjectInterfaces) error {
+	if attributes.GetResource().GroupResource() != (schema.GroupResource{Group: "route.openshift.io", Resource: "routes"}) {
+		return nil
+	}
+	// if a subresource is specified, skip it
+	if len(attributes.GetSubresource()) > 0 {
+		return nil
+	}
+
+	switch attributes.GetOperation() {
+	case admission.Create:
+		r, u, errs := toRoute(attributes.GetObject())
+		if len(errs) > 0 {
+			return errors.NewInvalid(attributes.GetKind().GroupKind(), attributes.GetName(), errs)
+		}
+		errs = hostassignment.AllocateHost(ctx, r, a.sarClient, a.hostnameGenerator)
+		if len(errs) > 0 {
+			return errors.NewInvalid(attributes.GetKind().GroupKind(), attributes.GetName(), errs)
+		}
+		content, err := runtime.DefaultUnstructuredConverter.ToUnstructured(r)
+		if err != nil {
+			return errors.NewInvalid(attributes.GetKind().GroupKind(), attributes.GetName(), field.ErrorList{
+				field.InternalError(field.NewPath(""), err),
+			})
+		}
+		u.SetUnstructuredContent(content)
+	case admission.Update:
+		r, _, errs := toRoute(attributes.GetObject())
+		if len(errs) > 0 {
+			return errors.NewInvalid(attributes.GetKind().GroupKind(), attributes.GetName(), errs)
+		}
+		old, _, errs := toRoute(attributes.GetOldObject())
+		if len(errs) > 0 {
+			return errors.NewInvalid(attributes.GetKind().GroupKind(), attributes.GetName(), errs)
+		}
+		errs = hostassignment.ValidateHostUpdate(ctx, r, old, a.sarClient)
+		if len(errs) > 0 {
+			return errors.NewInvalid(attributes.GetKind().GroupKind(), attributes.GetName(), errs)
+		}
+	default:
+		return admission.NewForbidden(attributes, fmt.Errorf("unhandled operation: %v", attributes.GetOperation()))
+	}
+
+	return nil
+}
+
+var _ initializer.WantsExternalKubeClientSet = &hostAssignment{}
+
+func (a *hostAssignment) SetExternalKubeClientSet(clientset kubernetes.Interface) {
+	a.sarClient = clientset.AuthorizationV1().SubjectAccessReviews()
+}
+
+func (a *hostAssignment) ValidateInitialization() error {
+	if a.sarClient == nil {
+		return fmt.Errorf("missing SubjectAccessReview client")
+	}
+	return nil
+}