Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Introduce a new type: serviceEffectivePolicy as a better abstraction than ClientIntents for reconciliation. Implement EffectivePolicyReconciler for ingress network policies. #323

Merged
merged 35 commits into from
Jan 8, 2024
Merged

Introduce a new type: serviceEffectivePolicy as a better abstraction than ClientIntents for reconciliation. Implement EffectivePolicyReconciler for ingress network policies. #323

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
35 commits
Select commit Hold shift + click to select a range
abf88e5
First stage to Service Effective Policy
omris94 Dec 25, 2023
4078d5b
Reconcile all the policies for each change
omris94 Dec 26, 2023
edaf7a0
Remove orphans now diffing current policy state against already exist…
omris94 Dec 26, 2023
8ec885d
Remove check if intent is deleted (It happens only once, during the c…
omris94 Dec 27, 2023
26e5fc3
fixup
omris94 Dec 27, 2023
f648461
remove unused code
omris94 Dec 27, 2023
eb1d03e
fixup
omris94 Dec 27, 2023
cf6075f
fixup
omris94 Dec 27, 2023
9b7278d
Add ep reconciler to main
omris94 Dec 28, 2023
abecf32
fixup
omris94 Dec 28, 2023
5aab7f0
fixup
omris94 Dec 28, 2023
d4e1d69
fixup
omris94 Dec 31, 2023
93a2c71
fixup
omris94 Dec 31, 2023
ed4cdbd
fixup
omris94 Dec 31, 2023
169ad27
Merge remote-tracking branch 'origin/main' into omris/use-service-eff…
omris94 Dec 31, 2023
6f2ea8d
fixup
omris94 Dec 31, 2023
0b274d4
Use EP sync from protected services
omris94 Dec 31, 2023
3f5413b
use errors.Join instead of returning a list of errors
omris94 Jan 1, 2024
9a1fab5
fix tests
omris94 Jan 1, 2024
c8e8335
fix tests
omris94 Jan 1, 2024
ad1cfa6
fix tests
omris94 Jan 1, 2024
09f2c3f
fixup
omris94 Jan 1, 2024
ee2c0e5
fixup
omris94 Jan 1, 2024
b79b1d9
fixup
omris94 Jan 1, 2024
6de5d83
fixup
omris94 Jan 1, 2024
6355102
renames
omris94 Jan 3, 2024
dd36c75
merge from main
omris94 Jan 7, 2024
8734533
merge from main
omris94 Jan 7, 2024
813dc1b
update helm-chart commit
omris94 Jan 7, 2024
450bf1e
fixup
omris94 Jan 7, 2024
ea67d68
fixup
omris94 Jan 7, 2024
decbcd7
fixup
omris94 Jan 7, 2024
ef58523
fixup
omris94 Jan 7, 2024
b209aaa
fixup
omris94 Jan 7, 2024
31b70ab
Merge remote-tracking branch 'origin/main' into omris/use-service-eff…
omris94 Jan 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion helm-charts
Open in desktop
Submodule helm-charts updated 4 files
+2 −2 .github/workflows/bump-version.yaml
+2 −2 credentials-operator/Chart.yaml
+2 −2 intents-operator/Chart.yaml
+1 −1 otterize-kubernetes/Chart.yaml
28 changes: 5 additions & 23 deletions src/operator/controllers/intents_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,14 +23,12 @@ import (
"github.com/otterize/intents-operator/src/operator/controllers/intents_reconcilers"
"github.com/otterize/intents-operator/src/operator/controllers/intents_reconcilers/database"
"github.com/otterize/intents-operator/src/operator/controllers/intents_reconcilers/egress_network_policy"
"github.com/otterize/intents-operator/src/operator/controllers/intents_reconcilers/ingress_network_policy"
"github.com/otterize/intents-operator/src/operator/controllers/intents_reconcilers/internet_network_policy"
"github.com/otterize/intents-operator/src/operator/controllers/intents_reconcilers/port_egress_network_policy"
"github.com/otterize/intents-operator/src/operator/controllers/intents_reconcilers/port_network_policy"
"github.com/otterize/intents-operator/src/operator/controllers/intents_reconcilers/protected_services"
"github.com/otterize/intents-operator/src/operator/controllers/kafkaacls"
"github.com/otterize/intents-operator/src/shared/errors"
"github.com/otterize/intents-operator/src/shared/initonce"
"github.com/otterize/intents-operator/src/shared/operator_cloud_client"
"github.com/otterize/intents-operator/src/shared/reconcilergroup"
"github.com/otterize/intents-operator/src/shared/serviceidresolver"
Expand Down Expand Up @@ -70,17 +68,14 @@ type EnforcementConfig struct {

// IntentsReconciler reconciles a Intents object
type IntentsReconciler struct {
group *reconcilergroup.Group
client client.Client
initOnce initonce.InitOnce
networkPolicyReconciler *ingress_network_policy.NetworkPolicyReconciler
group *reconcilergroup.Group
client client.Client
}

func NewIntentsReconciler(
client client.Client,
scheme *runtime.Scheme,
kafkaServerStore kafkaacls.ServersStore,
networkPolicyReconciler *ingress_network_policy.NetworkPolicyReconciler,
portNetpolReconciler *port_network_policy.PortNetworkPolicyReconciler,
egressNetpolReconciler *egress_network_policy.EgressNetworkPolicyReconciler,
portEgressNetpolReconciler *port_egress_network_policy.PortEgressNetworkPolicyReconciler,
Expand All @@ -98,7 +93,6 @@ func NewIntentsReconciler(
intents_reconcilers.NewPodLabelReconciler(client, scheme),
intents_reconcilers.NewKafkaACLReconciler(client, scheme, kafkaServerStore, enforcementConfig.EnableKafkaACL, kafkaacls.NewKafkaIntentsAdmin, enforcementConfig.EnforcementDefaultState, operatorPodName, operatorPodNamespace, serviceIdResolver),
intents_reconcilers.NewIstioPolicyReconciler(client, scheme, restrictToNamespaces, enforcementConfig.EnableIstioPolicy, enforcementConfig.EnforcementDefaultState),
networkPolicyReconciler,
}
reconcilers = append(reconcilers, additionalReconcilers...)
reconcilersGroup := reconcilergroup.NewGroup(
Expand All @@ -114,9 +108,8 @@ func NewIntentsReconciler(
reconcilersGroup.AddToGroup(portNetpolReconciler)

intentsReconciler := &IntentsReconciler{
group: reconcilersGroup,
client: client,
networkPolicyReconciler: networkPolicyReconciler,
group: reconcilersGroup,
client: client,
}

if telemetriesconfig.IsUsageTelemetryEnabled() {
Expand Down Expand Up @@ -155,16 +148,9 @@ func NewIntentsReconciler(
// Reconcile is part of the main kubernetes reconciliation loop which aims to
// move the current state of the cluster closer to the desired state.
func (r *IntentsReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
err := r.initOnce.Do(func() error {
return r.intentsReconcilerInit(ctx)
})
if err != nil {
return ctrl.Result{}, errors.Wrap(err)
}

intents := &otterizev1alpha3.ClientIntents{}

err = r.client.Get(ctx, req.NamespacedName, intents)
err := r.client.Get(ctx, req.NamespacedName, intents)
if err != nil {
if k8serrors.IsNotFound(err) {
return ctrl.Result{}, nil
Expand Down Expand Up @@ -200,10 +186,6 @@ func (r *IntentsReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
return result, nil
}

func (r *IntentsReconciler) intentsReconcilerInit(ctx context.Context) error {
return r.networkPolicyReconciler.CleanAllNamespaces(ctx)
}

// SetupWithManager sets up the controller with the Manager.
func (r *IntentsReconciler) SetupWithManager(mgr ctrl.Manager) error {
err := ctrl.NewControllerManagedBy(mgr).
Expand Down
1 change: 0 additions & 1 deletion src/operator/controllers/intents_controller_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,6 @@ func (s *IntentsControllerTestSuite) SetupTest() {
nil,
nil,
nil,
nil,
EnforcementConfig{},
nil,
"",
Expand Down
1 change: 1 addition & 0 deletions src/operator/controllers/intents_reconcilers/consts/consts.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ const (
ReasonNetworkPolicyCreationDisabled = "NetworkPolicyCreationDisabled"
ReasonGettingNetworkPolicyFailed = "GettingNetworkPolicyFailed"
ReasonRemovingNetworkPolicyFailed = "RemovingNetworkPolicyFailed"
ReasonReconcilingNetworkPolicyFailed = "ReconcilingNetworkPolicyFailed"
ReasonNamespaceNotAllowed = "NamespaceNotAllowed"
ReasonCreatingNetworkPoliciesFailed = "CreatingNetworkPoliciesFailed"
ReasonCreatedNetworkPolicies = "CreatedNetworkPolicies"
Expand Down
36 changes: 20 additions & 16 deletions ...tents_reconcilers/external_traffic_network_policy/external_traffic_network_policy_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,10 @@ import (
otterizev1alpha3 "github.com/otterize/intents-operator/src/operator/api/v1alpha3"
"github.com/otterize/intents-operator/src/operator/controllers"
"github.com/otterize/intents-operator/src/operator/controllers/external_traffic"
"github.com/otterize/intents-operator/src/operator/controllers/intents_reconcilers"
"github.com/otterize/intents-operator/src/operator/controllers/intents_reconcilers/ingress_network_policy"
"github.com/otterize/intents-operator/src/operator/controllers/pod_reconcilers"
"github.com/otterize/intents-operator/src/operator/effectivepolicy"
"github.com/otterize/intents-operator/src/shared/operatorconfig/allowexternaltraffic"
"github.com/otterize/intents-operator/src/shared/testbase"
"github.com/stretchr/testify/assert"
Expand All @@ -31,10 +33,10 @@ import (

type ExternalNetworkPolicyReconcilerTestSuite struct {
testbase.ControllerManagerTestSuiteBase
IngressReconciler *external_traffic.IngressReconciler
endpointReconciler external_traffic.EndpointsReconciler
NetworkPolicyReconciler *ingress_network_policy.NetworkPolicyReconciler
podWatcher *pod_reconcilers.PodWatcher
IngressReconciler *external_traffic.IngressReconciler
endpointReconciler external_traffic.EndpointsReconciler
EffectivePolicyIntentsReconciler *intents_reconcilers.ServiceEffectivePolicyIntentsReconciler
podWatcher *pod_reconcilers.PodWatcher
}

func (s *ExternalNetworkPolicyReconcilerTestSuite) SetupSuite() {
Expand Down Expand Up @@ -62,9 +64,11 @@ func (s *ExternalNetworkPolicyReconcilerTestSuite) SetupTest() {

recorder := s.Mgr.GetEventRecorderFor("intents-operator")
netpolHandler := external_traffic.NewNetworkPolicyHandler(s.Mgr.GetClient(), s.TestEnv.Scheme, allowexternaltraffic.IfBlockedByOtterize)
s.NetworkPolicyReconciler = ingress_network_policy.NewNetworkPolicyReconciler(s.Mgr.GetClient(), s.TestEnv.Scheme, netpolHandler, []string{}, true, true, allowexternaltraffic.IfBlockedByOtterize)
epNetpolReconciler := ingress_network_policy.NewIngressNetpolEffectivePolicyReconciler(s.Mgr.GetClient(), s.TestEnv.Scheme, netpolHandler, []string{}, true, true, allowexternaltraffic.IfBlockedByOtterize)
epReconciler := effectivepolicy.NewGroupReconciler(s.Mgr.GetClient(), s.TestEnv.Scheme, epNetpolReconciler)
s.EffectivePolicyIntentsReconciler = intents_reconcilers.NewServiceEffectiveIntentsReconciler(s.Mgr.GetClient(), s.TestEnv.Scheme, epReconciler)
s.Require().NoError((&controllers.IntentsReconciler{}).InitIntentsServerIndices(s.Mgr))
s.NetworkPolicyReconciler.InjectRecorder(recorder)
s.EffectivePolicyIntentsReconciler.InjectRecorder(recorder)

s.endpointReconciler = external_traffic.NewEndpointsReconciler(s.Mgr.GetClient(), netpolHandler)
s.endpointReconciler.InjectRecorder(recorder)
Expand Down Expand Up @@ -92,7 +96,7 @@ func (s *ExternalNetworkPolicyReconcilerTestSuite) TestNetworkPolicyCreateForIng
})
s.Require().NoError(err)

res, err := s.NetworkPolicyReconciler.Reconcile(context.Background(), ctrl.Request{
res, err := s.EffectivePolicyIntentsReconciler.Reconcile(context.Background(), ctrl.Request{
NamespacedName: types.NamespacedName{
Namespace: s.TestNamespace,
Name: intents.Name,
Expand Down Expand Up @@ -146,7 +150,7 @@ func (s *ExternalNetworkPolicyReconcilerTestSuite) TestNetworkPolicyCreateForLoa
})
s.Require().NoError(err)

res, err := s.NetworkPolicyReconciler.Reconcile(context.Background(), ctrl.Request{
res, err := s.EffectivePolicyIntentsReconciler.Reconcile(context.Background(), ctrl.Request{
NamespacedName: types.NamespacedName{
Namespace: s.TestNamespace,
Name: intents.Name,
Expand Down Expand Up @@ -202,7 +206,7 @@ func (s *ExternalNetworkPolicyReconcilerTestSuite) TestNetworkPolicyCreateForLoa
})
s.Require().NoError(err)

res, err := s.NetworkPolicyReconciler.Reconcile(context.Background(), ctrl.Request{
res, err := s.EffectivePolicyIntentsReconciler.Reconcile(context.Background(), ctrl.Request{
NamespacedName: types.NamespacedName{
Namespace: s.TestNamespace,
Name: intents.Name,
Expand Down Expand Up @@ -259,7 +263,7 @@ func (s *ExternalNetworkPolicyReconcilerTestSuite) TestNetworkPolicyCreateForLoa
})

s.WaitUntilCondition(func(assert *assert.Assertions) {
res, err = s.NetworkPolicyReconciler.Reconcile(context.Background(), ctrl.Request{
res, err = s.EffectivePolicyIntentsReconciler.Reconcile(context.Background(), ctrl.Request{
NamespacedName: types.NamespacedName{
Namespace: s.TestNamespace,
Name: intents.Name,
Expand All @@ -272,7 +276,7 @@ func (s *ExternalNetworkPolicyReconcilerTestSuite) TestNetworkPolicyCreateForLoa
})

s.WaitUntilCondition(func(assert *assert.Assertions) {
res, err = s.NetworkPolicyReconciler.Reconcile(context.Background(), ctrl.Request{
res, err = s.EffectivePolicyIntentsReconciler.Reconcile(context.Background(), ctrl.Request{
NamespacedName: types.NamespacedName{
Namespace: s.TestNamespace,
Name: intents.Name,
Expand Down Expand Up @@ -300,7 +304,7 @@ func (s *ExternalNetworkPolicyReconcilerTestSuite) TestNetworkPolicyCreateForLoa
}})
s.Require().NoError(err)

res, err := s.NetworkPolicyReconciler.Reconcile(context.Background(), ctrl.Request{
res, err := s.EffectivePolicyIntentsReconciler.Reconcile(context.Background(), ctrl.Request{
NamespacedName: types.NamespacedName{
Namespace: s.TestNamespace,
Name: intents.Name,
Expand All @@ -309,7 +313,7 @@ func (s *ExternalNetworkPolicyReconcilerTestSuite) TestNetworkPolicyCreateForLoa
s.Require().NoError(err)
s.Require().Empty(res)

res2, err := s.NetworkPolicyReconciler.Reconcile(context.Background(), ctrl.Request{
res2, err := s.EffectivePolicyIntentsReconciler.Reconcile(context.Background(), ctrl.Request{
NamespacedName: types.NamespacedName{
Namespace: secondaryNamespace,
Name: secondIntents.Name,
Expand Down Expand Up @@ -365,7 +369,7 @@ func (s *ExternalNetworkPolicyReconcilerTestSuite) TestNetworkPolicyCreateForLoa
assert.NotNil(intentsDeleted.DeletionTimestamp)
})

res, err = s.NetworkPolicyReconciler.Reconcile(context.Background(), ctrl.Request{
res, err = s.EffectivePolicyIntentsReconciler.Reconcile(context.Background(), ctrl.Request{
NamespacedName: types.NamespacedName{
Namespace: s.TestNamespace,
Name: intents.Name,
Expand Down Expand Up @@ -394,7 +398,7 @@ func (s *ExternalNetworkPolicyReconcilerTestSuite) TestNetworkPolicyCreateForNod
})
s.Require().NoError(err)

res, err := s.NetworkPolicyReconciler.Reconcile(context.Background(), ctrl.Request{
res, err := s.EffectivePolicyIntentsReconciler.Reconcile(context.Background(), ctrl.Request{
NamespacedName: types.NamespacedName{
Namespace: s.TestNamespace,
Name: intents.Name,
Expand Down Expand Up @@ -449,7 +453,7 @@ func (s *ExternalNetworkPolicyReconcilerTestSuite) TestEndpointsReconcilerNetwor
})
s.Require().NoError(err)

res, err := s.NetworkPolicyReconciler.Reconcile(context.Background(), ctrl.Request{
res, err := s.EffectivePolicyIntentsReconciler.Reconcile(context.Background(), ctrl.Request{
NamespacedName: types.NamespacedName{
Namespace: s.TestNamespace,
Name: intents.Name,
Expand Down
21 changes: 13 additions & 8 deletions ...s/external_traffic_network_policy/external_traffic_network_policy_with_no_intents_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,10 @@ import (
otterizev1alpha3 "github.com/otterize/intents-operator/src/operator/api/v1alpha3"
"github.com/otterize/intents-operator/src/operator/controllers"
"github.com/otterize/intents-operator/src/operator/controllers/external_traffic"
"github.com/otterize/intents-operator/src/operator/controllers/intents_reconcilers"
"github.com/otterize/intents-operator/src/operator/controllers/intents_reconcilers/ingress_network_policy"
"github.com/otterize/intents-operator/src/operator/controllers/pod_reconcilers"
"github.com/otterize/intents-operator/src/operator/effectivepolicy"
"github.com/otterize/intents-operator/src/shared/operatorconfig/allowexternaltraffic"
"github.com/otterize/intents-operator/src/shared/testbase"
"github.com/stretchr/testify/assert"
Expand All @@ -30,10 +32,10 @@ import (

type ExternalNetworkPolicyReconcilerWithNoIntentsTestSuite struct {
testbase.ControllerManagerTestSuiteBase
IngressReconciler *external_traffic.IngressReconciler
endpointReconciler external_traffic.EndpointsReconciler
NetworkPolicyReconciler *ingress_network_policy.NetworkPolicyReconciler
podWatcher *pod_reconcilers.PodWatcher
IngressReconciler *external_traffic.IngressReconciler
endpointReconciler external_traffic.EndpointsReconciler
EffectivePolicyIntentsReconciler *intents_reconcilers.ServiceEffectivePolicyIntentsReconciler
podWatcher *pod_reconcilers.PodWatcher
}

func (s *ExternalNetworkPolicyReconcilerWithNoIntentsTestSuite) SetupSuite() {
Expand All @@ -53,16 +55,19 @@ func (s *ExternalNetworkPolicyReconcilerWithNoIntentsTestSuite) SetupSuite() {
utilruntime.Must(clientgoscheme.AddToScheme(s.TestEnv.Scheme))
utilruntime.Must(istiosecurityscheme.AddToScheme(s.TestEnv.Scheme))
utilruntime.Must(otterizev1alpha2.AddToScheme(s.TestEnv.Scheme))
utilruntime.Must(otterizev1alpha3.AddToScheme(s.TestEnv.Scheme))
}

func (s *ExternalNetworkPolicyReconcilerWithNoIntentsTestSuite) SetupTest() {
s.ControllerManagerTestSuiteBase.SetupTest()

recorder := s.Mgr.GetEventRecorderFor("intents-operator")
netpolHandler := external_traffic.NewNetworkPolicyHandler(s.Mgr.GetClient(), s.TestEnv.Scheme, allowexternaltraffic.Always)
s.NetworkPolicyReconciler = ingress_network_policy.NewNetworkPolicyReconciler(s.Mgr.GetClient(), s.TestEnv.Scheme, netpolHandler, []string{}, true, true, allowexternaltraffic.Always)
netpolApplier := ingress_network_policy.NewIngressNetpolEffectivePolicyReconciler(s.Mgr.GetClient(), s.TestEnv.Scheme, netpolHandler, []string{}, true, true, allowexternaltraffic.Always)
groupReconciler := effectivepolicy.NewGroupReconciler(s.Mgr.GetClient(), s.TestEnv.Scheme, netpolApplier)
s.EffectivePolicyIntentsReconciler = intents_reconcilers.NewServiceEffectiveIntentsReconciler(s.Mgr.GetClient(), s.TestEnv.Scheme, groupReconciler)
s.Require().NoError((&controllers.IntentsReconciler{}).InitIntentsServerIndices(s.Mgr))
s.NetworkPolicyReconciler.InjectRecorder(recorder)
s.EffectivePolicyIntentsReconciler.InjectRecorder(recorder)

s.endpointReconciler = external_traffic.NewEndpointsReconciler(s.Mgr.GetClient(), netpolHandler)
s.endpointReconciler.InjectRecorder(recorder)
Expand Down Expand Up @@ -242,7 +247,7 @@ func (s *ExternalNetworkPolicyReconcilerWithNoIntentsTestSuite) TestNetworkPolic
})
s.Require().NoError(err)

res, err := s.NetworkPolicyReconciler.Reconcile(context.Background(), ctrl.Request{
res, err := s.EffectivePolicyIntentsReconciler.Reconcile(context.Background(), ctrl.Request{
NamespacedName: types.NamespacedName{
Namespace: s.TestNamespace,
Name: intents.Name,
Expand Down Expand Up @@ -298,7 +303,7 @@ func (s *ExternalNetworkPolicyReconcilerWithNoIntentsTestSuite) TestNetworkPolic
assert.NotNil(intentsDeleted.DeletionTimestamp)
})

res, err = s.NetworkPolicyReconciler.Reconcile(context.Background(), ctrl.Request{
res, err = s.EffectivePolicyIntentsReconciler.Reconcile(context.Background(), ctrl.Request{
NamespacedName: types.NamespacedName{
Namespace: s.TestNamespace,
Name: intents.Name,
Expand Down
Loading
Loading