Add support for Linkerd to the intents-operator #324

aerosouund · 2023-12-30T12:23:31Z

Description

Create required linkerd resources (servers, httproutes, authpolicies, mtls authentications, network authentications) based on otterize client intents.
An extra optional field has been added in the intent definition which is a port field.
It extends the same pattern used in istio policies but applies it to each respective linkerd resource

References

GitHub Issue/PR number addressed or fixed: Add support for Linkerd authorization policies #250

Testing

There is a built image in a public repo that you can deploy in a cluster with linkerd installed: aerosouund/intents-operator:0.1.34

Also include details of the environment this PR was developed in (language/platform/browser version):

golang 1.21
kubernetes 1.23 on EKS
Linkerd 2.x
This change adds test coverage for new/changed/fixed functionality

Checklist

I have added documentation for new/changed functionality in this PR and in github.com/otterize/docs

github-actions · 2023-12-30T12:23:48Z

CLA Assistant Lite bot All contributors have signed the CLA ✍️ ✅

aerosouund · 2023-12-30T12:29:58Z

Over the upcoming period there's still some extra small functionality i want to add to the PR, but i've created it now to work on any large changes required at the same time

Including the following:

don’t add the path in the name for the policies but validate if a policy should be created based on its targets, and add a random hash in the end of all policy names 
cleaner implementation for deletion, instead of iterating over each type
move the creation of primary resources to the start of the loop instead of checking if it should be done for each intent
add support for grpc and tcp probes if they also break when a http route is created
create a generateHTTPRouteName method

orishoshan · 2024-01-15T15:02:31Z

src/operator/controllers/intents_reconcilers/linkerd_reconciler.go

+	}
+
+	pod, err := r.serviceIdResolver.ResolveClientIntentToPod(ctx, *intents)
+	logrus.Infof("Got pod with name %s", pod.Name)


Move this log after the err check, as pod may be nil

orishoshan · 2024-01-15T15:02:42Z

src/operator/controllers/intents_reconcilers/linkerd_reconciler.go

+	logrus.Infof("Reconciling Linkerd authorization policies for service %s in namespace %s",
+		intents.Spec.Service.Name, req.Namespace)
+
+	// TODO: implement delete all


Is this TODO still relevant?

orishoshan · 2024-01-15T15:03:25Z

src/operator/controllers/intents_reconcilers/linkerd_reconciler.go

+	}
+
+	clientServiceAccountName := pod.Spec.ServiceAccountName
+	missingSideCar := !linkerdmanager.IsPodPartOfLinkerdMesh(pod)


Is there a way to check using a label or annotation instead?
Using the proxy's name is implementation-specific and may break when Linkerd versions are updated. Is there a documented label or something similar we can check for instead?

orishoshan · 2024-01-15T15:41:32Z

src/operator/controllers/intents_reconcilers/linkerd_reconciler.go

+		return ctrl.Result{}, nil
+	}
+
+	err = r.linkerdManager.Create(ctx, intents, clientServiceAccountName) // the injectable recorder is null pointer


comment still relevant?

orishoshan · 2024-01-15T16:46:15Z

src/shared/operatorconfig/config.go

-	EnableDatabasePolicy                        = "enable-database-policy-creation" // Whether to enable the new database reconciler
-	EnableDatabasePolicyDefault                 = true
+	EnableDatabaseReconciler                    = "enable-database-reconciler" // Whether to enable the new database reconciler
+	EnableDatabaseReconcilerDefault             = false


change this back :)

orishoshan · 2024-01-15T17:29:17Z

src/operator/config/crd/k8s.otterize.com_clientintents.patched

@@ -0,0 +1,285 @@
+apiVersion: apiextensions.k8s.io/v1


Please remove these generated .patched files from Git

orishoshan · 2024-01-15T17:31:05Z

src/operator/api/v1alpha3/clientintents_types.go

@@ -155,6 +157,9 @@ type Intent struct {
 	//+optional
 	Type IntentType `json:"type,omitempty" yaml:"type,omitempty"`

+	//+optional
+	Port int32 `json:"port,omitempty" yaml:"port,omitempty"`


We still need to figure out a way to do without specifying the port manually - let's try to figure this out when we talk

orishoshan · 2024-01-15T17:32:18Z

src/operator/controllers/intents_reconcilers/linkerd_reconciler.go

+func (r *LinkerdReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	logrus.Info("Starting linkerd reconcile logic")
+
+	installed, err := linkerdmanager.IsLinkerdServerInstalled(ctx, r.Client)


Suggested change

installed, err := linkerdmanager.IsLinkerdServerInstalled(ctx, r.Client)

installed, err := linkerdmanager.IsLinkerdInstalled(ctx, r.Client)

This checks if the Linkerd Server CRD is installed, but in fact it's checking if Linkerd itself is installed in the cluster through this check.

orishoshan · 2024-01-15T17:34:16Z

src/operator/controllers/linkerd/linkerd_manager.go

+		if intent.Type != "" && intent.Type != otterizev1alpha3.IntentTypeHTTP && intent.Port != 0 { // this will skip non http ones, db for example, skip port doesnt exist as well
+			continue
+		}
+		shouldCreatePolicy, err := protected_services.IsServerEnforcementEnabledDueToProtectionOrDefaultState( //TODO:  check what that does


This is enabled through ProtectedService: https://docs.otterize.com/shadow-vs-active-enforcement#protected-services

orishoshan · 2024-01-15T17:35:14Z

src/operator/controllers/linkerd/linkerd_manager.go

+	}
+
+	for _, intent := range clientIntents.GetCallsList() {
+		if intent.Type != "" && intent.Type != otterizev1alpha3.IntentTypeHTTP && intent.Port != 0 { // this will skip non http ones, db for example, skip port doesnt exist as well


The port condition seems inverted, as in if port is NOT empty AND type is not HTTP it will continue. But perhaps you meant

if intent.Type != "" // if intent type is not empty
&& intent.Type != IntentTypeHTTP // and intent type is not http
|| intent.Port == "" // OR port is empty

aquam8 · 2024-06-12T04:00:16Z

we'd be very interested in having support for Linkerd2 - then Otterize would really be a compelling solution for us as light user of EKS & Linkerd2 (mTLS, grpc load balancing but not leveraging authorization policies in linkerd). We use kubernetes network policies but we do not like it for the same reason you highlighted in your blog post. We're making a case towards dropping support for network policies all together (we are using Calico & aws vpc-cni) and we would be interesting in assessing how linkerd2/otterize could help with authorization policies on that side of the fence instead.

orishoshan · 2024-06-12T20:23:52Z

That's great to hear @aquam8! We've been working on a couple of infrastructure changes that are starting to come in and have blocked this PR from being merged, namely #409 and #439, so Linkerd support should be getting merged soon! Stay tuned :)

Would love to have you join us on Slack to hear more about your use case if possible: https://joinslack.otterize.com

aquam8 · 2024-08-12T05:23:39Z

Could this work be revised now that the dependent PRs have been merged, thank you!

aerosouund · 2024-08-19T12:25:16Z

@evyatarmeged @orishoshan
PR rebased and cleaned, please review and let me know

This package contains an engine that creates, updates, deletes linkerd resources from ClientIntents. With a test suite for that feature based on mock. The package will create a Server, AuthPolicy and MTLSAuth for a non HTTP Intent, or a Server ,HTTPRoute , AuthPolicy and MTLSAuth for a HTTP Intent. As well as a NetAuth for probe routes to not cause probes to break from the creation of servers on them. Signed-off-by: aerosouund <aerosound161@gmail.com>

Create Linkerd mock to be used in testing Signed-off-by: aerosouund <aerosound161@gmail.com>

Leverage the linkerd engine in a reconciler that watches ClientIntents Signed-off-by: aerosouund <aerosound161@gmail.com>

Register the linkerd reconciler with the intents reconciler Signed-off-by: aerosouund <aerosound161@gmail.com>

Define constants used by the linkerd manager Signed-off-by: aerosouund <aerosound161@gmail.com>

Signed-off-by: aerosouund <aerosound161@gmail.com>

This is needed as pod ports are required for Linkerd Server creation and they might change if the pod definition changes. Signed-off-by: aerosouund <aerosound161@gmail.com>

…n pod reconciler Signed-off-by: aerosouund <aerosound161@gmail.com>

Signed-off-by: aerosouund <aerosound161@gmail.com>

orishoshan self-requested a review January 2, 2024 20:00

orishoshan reviewed Jan 15, 2024

View reviewed changes

aerosouund force-pushed the linkerd branch from f751948 to 9d5419b Compare January 17, 2024 16:41

aerosouund force-pushed the linkerd branch from a013975 to cc16b4f Compare August 19, 2024 12:16

aerosouund added 9 commits August 19, 2024 15:31

feat: Linkerd mock interface

d33d63f

Create Linkerd mock to be used in testing Signed-off-by: aerosouund <aerosound161@gmail.com>

feat: Create linkerd reconciler

e280a80

Leverage the linkerd engine in a reconciler that watches ClientIntents Signed-off-by: aerosouund <aerosound161@gmail.com>

feat: Add Linkerd controller

69a11b2

Register the linkerd reconciler with the intents reconciler Signed-off-by: aerosouund <aerosound161@gmail.com>

feat: Add Linkerd keys to ClientIntents

43d2876

Define constants used by the linkerd manager Signed-off-by: aerosouund <aerosound161@gmail.com>

chore: Add go packages

20ec225

Signed-off-by: aerosouund <aerosound161@gmail.com>

feat: Leverage Linkerd reconciler during pod reconciliation

407309e

This is needed as pod ports are required for Linkerd Server creation and they might change if the pod definition changes. Signed-off-by: aerosouund <aerosound161@gmail.com>

feat: Add Linkerd schema in the Manager and add Linkerd enforcement i…

3d52d15

…n pod reconciler Signed-off-by: aerosouund <aerosound161@gmail.com>

feat: Include Linkerd flags and config in the enforcement config

ec20733

Signed-off-by: aerosouund <aerosound161@gmail.com>

aerosouund force-pushed the linkerd branch from cc16b4f to ec20733 Compare August 19, 2024 12:34

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for Linkerd to the intents-operator #324

Add support for Linkerd to the intents-operator #324

aerosouund commented Dec 30, 2023

github-actions bot commented Dec 30, 2023 •

edited

Loading

aerosouund commented Dec 30, 2023

orishoshan Jan 15, 2024

orishoshan Jan 15, 2024

orishoshan Jan 15, 2024

orishoshan Jan 15, 2024

orishoshan Jan 15, 2024

orishoshan Jan 15, 2024

orishoshan Jan 15, 2024

orishoshan Jan 15, 2024

orishoshan Jan 15, 2024

orishoshan Jan 15, 2024

aquam8 commented Jun 12, 2024

orishoshan commented Jun 12, 2024 •

edited

Loading

aquam8 commented Aug 12, 2024

aerosouund commented Aug 19, 2024

	installed, err := linkerdmanager.IsLinkerdServerInstalled(ctx, r.Client)
	installed, err := linkerdmanager.IsLinkerdInstalled(ctx, r.Client)

Add support for Linkerd to the intents-operator #324

Are you sure you want to change the base?

Add support for Linkerd to the intents-operator #324

Conversation

aerosouund commented Dec 30, 2023

Description

References

Testing

Checklist

github-actions bot commented Dec 30, 2023 • edited Loading

aerosouund commented Dec 30, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

aquam8 commented Jun 12, 2024

orishoshan commented Jun 12, 2024 • edited Loading

aquam8 commented Aug 12, 2024

aerosouund commented Aug 19, 2024

github-actions bot commented Dec 30, 2023 •

edited

Loading

orishoshan commented Jun 12, 2024 •

edited

Loading