[release-4.6] Bug 1896705: Inject cluster-wide proxy configuration in to machine-api-controller deployment

cmd/machine-api-operator/start.go

@@ -125,6 +125,7 @@ func startControllers(ctx *ControllerContext) {
 		ctx.ConfigInformerFactory.Config().V1().FeatureGates(),
 		ctx.KubeNamespacedInformerFactory.Admissionregistration().V1().ValidatingWebhookConfigurations(),
 		ctx.KubeNamespacedInformerFactory.Admissionregistration().V1().MutatingWebhookConfigurations(),
+		ctx.ConfigInformerFactory.Config().V1().Proxies(),
 		ctx.ClientBuilder.KubeClientOrDie(componentName),
 		ctx.ClientBuilder.OpenshiftClientOrDie(componentName),
 		ctx.ClientBuilder.DynamicClientOrDie(componentName),

docs/user/cluster-wide-proxy.md

@@ -0,0 +1,10 @@
+# Overview
+
+The [cluster-wide proxy](https://docs.openshift.com/container-platform/4.6/networking/enable-cluster-wide-proxy.html) is a configuration applied which communicates the need to perform outbound communication via an HTTP proxy.  Components are responsible for watching for changes to a `Proxy` resource named `cluster` and configuring applicable deployments to consume and honor the HTTP proxy configuration.  In some environments, such as installations in to some private networks, direct connections to external servers are not allowed and must flow through an HTTP proxy.
+
+Typically, the following environment variables are defined to communicate proxy configuration to processes:
+
+- HTTP_PROXY - The URL of the proxy server which handles HTTP requests
+- HTTPS_PROXY - The URL of the proxy server which handles HTTPS requests
+- NO_PROXY - comma-separated list of strings representing IP addresses and host names which should bypass the proxy and connect directly to the target server.  If the host name matches one of these strings, or the host is within the domain of one of these strings, transactions with that node will not be proxied. When a domain is used, it needs to start with a period. A user can specify that both www.example.com and foo.example.com should not use a proxy by setting NO_PROXY to .example.com. By including the full name you can exclude specific host names, so to make www.example.com not use a proxy but still have foo.example.com do it, set NO_PROXY to www.example.com.
+

install/0000_30_machine-api-operator_09_rbac.yaml

@@ -308,6 +308,7 @@ rules:
     resources:
       - featuregates
       - featuregates/status
+      - proxies
     verbs:
       - get
       - list

pkg/operator/baremetal_test.go

@@ -118,6 +118,7 @@ func newOperatorWithBaremetalConfig() *OperatorConfig {
 			"quay.io/openshift/origin-ironic-machine-os-downloader:v4.2.0",
 			"quay.io/openshift/origin-ironic-static-ip-manager:v4.2.0",
 		},
+		&osconfigv1.Proxy{},
 	}
 }
 

pkg/operator/config.go

@@ -23,6 +23,7 @@ type OperatorConfig struct {
 	TargetNamespace      string `json:"targetNamespace"`
 	Controllers          Controllers
 	BaremetalControllers BaremetalControllers
+	Proxy                *configv1.Proxy
 }
 
 type Controllers struct {

pkg/operator/operator.go

@@ -61,6 +61,9 @@ type Operator struct {
 	daemonsetLister       appslisterv1.DaemonSetLister
 	daemonsetListerSynced cache.InformerSynced
 
+	proxyLister       configlistersv1.ProxyLister
+	proxyListerSynced cache.InformerSynced
+
 	validatingWebhookLister       admissionlisterv1.ValidatingWebhookConfigurationLister
 	validatingWebhookListerSynced cache.InformerSynced
 
@@ -89,7 +92,7 @@ func New(
 	featureGateInformer configinformersv1.FeatureGateInformer,
 	validatingWebhookInformer admissioninformersv1.ValidatingWebhookConfigurationInformer,
 	mutatingWebhookInformer admissioninformersv1.MutatingWebhookConfigurationInformer,
-
+	proxyInformer configinformersv1.ProxyInformer,
 	kubeClient kubernetes.Interface,
 	osClient osclientset.Interface,
 	dynamicClient dynamic.Interface,
@@ -130,6 +133,9 @@ func New(
 	optr.daemonsetLister = daemonsetInformer.Lister()
 	optr.daemonsetListerSynced = daemonsetInformer.Informer().HasSynced
 
+	optr.proxyLister = proxyInformer.Lister()
+	optr.proxyListerSynced = proxyInformer.Informer().HasSynced
+
 	optr.validatingWebhookLister = validatingWebhookInformer.Lister()
 	optr.validatingWebhookListerSynced = validatingWebhookInformer.Informer().HasSynced
 
@@ -155,6 +161,7 @@ func (optr *Operator) Run(workers int, stopCh <-chan struct{}) {
 		optr.validatingWebhookListerSynced,
 		optr.deployListerSynced,
 		optr.daemonsetListerSynced,
+		optr.proxyListerSynced,
 		optr.featureGateCacheSynced) {
 		glog.Error("Failed to sync caches")
 		return
@@ -358,8 +365,14 @@ func (optr *Operator) maoConfigFromInfrastructure() (*OperatorConfig, error) {
 		return nil, err
 	}
 
+	clusterWideProxy, err := optr.osClient.ConfigV1().Proxies().Get(context.Background(), "cluster", metav1.GetOptions{})
+	if err != nil {
+		return nil, err
+	}
+
 	return &OperatorConfig{
 		TargetNamespace: optr.namespace,
+		Proxy:           clusterWideProxy,
 		Controllers: Controllers{
 			Provider:           providerControllerImage,
 			MachineSet:         machineAPIOperatorImage,

pkg/operator/operator_test.go

@@ -45,6 +45,7 @@ func newFakeOperator(kubeObjects []runtime.Object, osObjects []runtime.Object, s
 	configSharedInformer := configinformersv1.NewSharedInformerFactoryWithOptions(osClient, 2*time.Minute)
 	featureGateInformer := configSharedInformer.Config().V1().FeatureGates()
 	deployInformer := kubeNamespacedSharedInformer.Apps().V1().Deployments()
+	proxyInformer := configSharedInformer.Config().V1().Proxies()
 	daemonsetInformer := kubeNamespacedSharedInformer.Apps().V1().DaemonSets()
 	mutatingWebhookInformer := kubeNamespacedSharedInformer.Admissionregistration().V1().MutatingWebhookConfigurations()
 	validatingWebhookInformer := kubeNamespacedSharedInformer.Admissionregistration().V1().ValidatingWebhookConfigurations()
@@ -55,6 +56,7 @@ func newFakeOperator(kubeObjects []runtime.Object, osObjects []runtime.Object, s
 		dynamicClient:                 dynamicClient,
 		featureGateLister:             featureGateInformer.Lister(),
 		deployLister:                  deployInformer.Lister(),
+		proxyLister:                   proxyInformer.Lister(),
 		daemonsetLister:               daemonsetInformer.Lister(),
 		mutatingWebhookLister:         mutatingWebhookInformer.Lister(),
 		validatingWebhookLister:       validatingWebhookInformer.Lister(),
@@ -63,6 +65,7 @@ func newFakeOperator(kubeObjects []runtime.Object, osObjects []runtime.Object, s
 		eventRecorder:                 record.NewFakeRecorder(50),
 		queue:                         workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "machineapioperator"),
 		deployListerSynced:            deployInformer.Informer().HasSynced,
+		proxyListerSynced:             proxyInformer.Informer().HasSynced,
 		daemonsetListerSynced:         daemonsetInformer.Informer().HasSynced,
 		featureGateCacheSynced:        featureGateInformer.Informer().HasSynced,
 		mutatingWebhookListerSynced:   mutatingWebhookInformer.Informer().HasSynced,
@@ -147,8 +150,14 @@ func TestOperatorSync_NoOp(t *testing.T) {
 				},
 			}
 
+			proxy := &openshiftv1.Proxy{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "cluster",
+				},
+			}
+
 			stopCh := make(<-chan struct{})
-			optr := newFakeOperator(nil, []runtime.Object{infra}, stopCh)
+			optr := newFakeOperator(nil, []runtime.Object{infra, proxy}, stopCh)
 			optr.queue.Add("trigger")
 			go optr.Run(1, stopCh)
 
@@ -268,10 +277,17 @@ func TestMAOConfigFromInfrastructure(t *testing.T) {
 		},
 	}
 
+	proxy := &openshiftv1.Proxy{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "cluster",
+		},
+	}
+
 	testCases := []struct {
 		name           string
 		platform       openshiftv1.PlatformType
 		infra          *openshiftv1.Infrastructure
+		proxy          *openshiftv1.Proxy
 		imagesFile     string
 		expectedConfig *OperatorConfig
 		expectedError  error
@@ -280,8 +296,10 @@ func TestMAOConfigFromInfrastructure(t *testing.T) {
 			name:     string(openshiftv1.AWSPlatformType),
 			platform: openshiftv1.AWSPlatformType,
 			infra:    infra,
+			proxy:    proxy,
 			expectedConfig: &OperatorConfig{
 				TargetNamespace: targetNamespace,
+				Proxy:           proxy,
 				Controllers: Controllers{
 					Provider:           images.ClusterAPIControllerAWS,
 					MachineSet:         images.MachineAPIOperator,
@@ -296,8 +314,10 @@ func TestMAOConfigFromInfrastructure(t *testing.T) {
 			name:     string(openshiftv1.LibvirtPlatformType),
 			platform: openshiftv1.LibvirtPlatformType,
 			infra:    infra,
+			proxy:    proxy,
 			expectedConfig: &OperatorConfig{
 				TargetNamespace: targetNamespace,
+				Proxy:           proxy,
 				Controllers: Controllers{
 					Provider:           images.ClusterAPIControllerLibvirt,
 					MachineSet:         images.MachineAPIOperator,
@@ -312,8 +332,10 @@ func TestMAOConfigFromInfrastructure(t *testing.T) {
 			name:     string(openshiftv1.OpenStackPlatformType),
 			platform: openshiftv1.OpenStackPlatformType,
 			infra:    infra,
+			proxy:    proxy,
 			expectedConfig: &OperatorConfig{
 				TargetNamespace: targetNamespace,
+				Proxy:           proxy,
 				Controllers: Controllers{
 					Provider:           images.ClusterAPIControllerOpenStack,
 					MachineSet:         images.MachineAPIOperator,
@@ -328,8 +350,10 @@ func TestMAOConfigFromInfrastructure(t *testing.T) {
 			name:     string(openshiftv1.AzurePlatformType),
 			platform: openshiftv1.AzurePlatformType,
 			infra:    infra,
+			proxy:    proxy,
 			expectedConfig: &OperatorConfig{
 				TargetNamespace: targetNamespace,
+				Proxy:           proxy,
 				Controllers: Controllers{
 					Provider:           images.ClusterAPIControllerAzure,
 					MachineSet:         images.MachineAPIOperator,
@@ -344,8 +368,10 @@ func TestMAOConfigFromInfrastructure(t *testing.T) {
 			name:     string(openshiftv1.BareMetalPlatformType),
 			platform: openshiftv1.BareMetalPlatformType,
 			infra:    infra,
+			proxy:    proxy,
 			expectedConfig: &OperatorConfig{
 				TargetNamespace: targetNamespace,
+				Proxy:           proxy,
 				Controllers: Controllers{
 					Provider:           images.ClusterAPIControllerBareMetal,
 					MachineSet:         images.MachineAPIOperator,
@@ -368,8 +394,10 @@ func TestMAOConfigFromInfrastructure(t *testing.T) {
 			name:     string(openshiftv1.GCPPlatformType),
 			platform: openshiftv1.GCPPlatformType,
 			infra:    infra,
+			proxy:    proxy,
 			expectedConfig: &OperatorConfig{
 				TargetNamespace: targetNamespace,
+				Proxy:           proxy,
 				Controllers: Controllers{
 					Provider:           images.ClusterAPIControllerGCP,
 					MachineSet:         images.MachineAPIOperator,
@@ -384,8 +412,10 @@ func TestMAOConfigFromInfrastructure(t *testing.T) {
 			name:     string(kubemarkPlatform),
 			platform: kubemarkPlatform,
 			infra:    infra,
+			proxy:    proxy,
 			expectedConfig: &OperatorConfig{
 				TargetNamespace: targetNamespace,
+				Proxy:           proxy,
 				Controllers: Controllers{
 					Provider:           clusterAPIControllerKubemark,
 					MachineSet:         images.MachineAPIOperator,
@@ -400,8 +430,10 @@ func TestMAOConfigFromInfrastructure(t *testing.T) {
 			name:     string(openshiftv1.VSpherePlatformType),
 			platform: openshiftv1.VSpherePlatformType,
 			infra:    infra,
+			proxy:    proxy,
 			expectedConfig: &OperatorConfig{
 				TargetNamespace: targetNamespace,
+				Proxy:           proxy,
 				Controllers: Controllers{
 					Provider:           images.ClusterAPIControllerVSphere,
 					MachineSet:         images.MachineAPIOperator,
@@ -416,8 +448,10 @@ func TestMAOConfigFromInfrastructure(t *testing.T) {
 			name:     string(openshiftv1.OvirtPlatformType),
 			platform: openshiftv1.OvirtPlatformType,
 			infra:    infra,
+			proxy:    proxy,
 			expectedConfig: &OperatorConfig{
 				TargetNamespace: targetNamespace,
+				Proxy:           proxy,
 				Controllers: Controllers{
 					Provider:           images.ClusterAPIControllerOvirt,
 					MachineSet:         images.MachineAPIOperator,
@@ -432,8 +466,10 @@ func TestMAOConfigFromInfrastructure(t *testing.T) {
 			name:     string(openshiftv1.NonePlatformType),
 			platform: openshiftv1.NonePlatformType,
 			infra:    infra,
+			proxy:    proxy,
 			expectedConfig: &OperatorConfig{
 				TargetNamespace: targetNamespace,
+				Proxy:           proxy,
 				Controllers: Controllers{
 					Provider:           clusterAPIControllerNoOp,
 					MachineSet:         images.MachineAPIOperator,
@@ -448,8 +484,10 @@ func TestMAOConfigFromInfrastructure(t *testing.T) {
 			name:     "bad-platform",
 			platform: "bad-platform",
 			infra:    infra,
+			proxy:    proxy,
 			expectedConfig: &OperatorConfig{
 				TargetNamespace: targetNamespace,
+				Proxy:           proxy,
 				Controllers: Controllers{
 					Provider:           clusterAPIControllerNoOp,
 					MachineSet:         images.MachineAPIOperator,
@@ -464,20 +502,31 @@ func TestMAOConfigFromInfrastructure(t *testing.T) {
 			name:           "no-infra",
 			platform:       "no-infra",
 			infra:          nil,
+			proxy:          proxy,
 			expectedConfig: nil,
 			expectedError:  kerrors.NewNotFound(schema.GroupResource{Group: "config.openshift.io", Resource: "infrastructures"}, "cluster"),
 		},
+		{
+			name:           "no-proxy",
+			platform:       "no-proxy",
+			infra:          infra,
+			proxy:          nil,
+			expectedConfig: nil,
+			expectedError:  kerrors.NewNotFound(schema.GroupResource{Group: "config.openshift.io", Resource: "proxies"}, "cluster"),
+		},
 		{
 			name:           "no-platform",
 			platform:       "",
 			infra:          infra,
+			proxy:          proxy,
 			expectedConfig: nil,
 			expectedError:  errors.New("no platform provider found on install config"),
 		},
 		{
 			name:           "no-images-file",
 			platform:       openshiftv1.NonePlatformType,
 			infra:          infra,
+			proxy:          proxy,
 			imagesFile:     "fixtures/not-found.json",
 			expectedConfig: nil,
 			expectedError:  &os.PathError{Op: "open", Path: "fixtures/not-found.json", Err: syscall.ENOENT},
@@ -495,7 +544,10 @@ func TestMAOConfigFromInfrastructure(t *testing.T) {
 				inf.Status.Platform = tc.platform
 				objects = append(objects, inf)
 			}
-
+			if tc.proxy != nil {
+				proxy := tc.proxy.DeepCopy()
+				objects = append(objects, proxy)
+			}
 			stopCh := make(<-chan struct{})
 			optr := newFakeOperator(nil, objects, stopCh)
 			optr.queue.Add("trigger")