Controller

.gitignore

@@ -0,0 +1,24 @@
+
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+bin
+
+# Test binary, build with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Kubernetes Generated files - skip generated files, except for vendored files
+
+!vendor/**/zz_generated.*
+
+# editor and IDE paraphernalia
+.idea
+*.swp
+*.swo
+*~

Dockerfile

@@ -0,0 +1,26 @@
+# Build the manager binary
+FROM golang:1.13.1 as builder
+
+WORKDIR /workspace
+# Copy the Go Modules manifests
+COPY go.mod go.mod
+COPY go.sum go.sum
+# cache deps before building and copying source so that we don't need to re-download as much
+# and so that source changes don't invalidate our downloaded layer
+RUN go mod download
+
+# Copy the go source
+COPY main.go main.go
+COPY api/ api/
+COPY controllers/ controllers/
+COPY pkg/ pkg/
+
+# Build
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GO111MODULE=on go build -a -o manager main.go
+
+# Use distroless as minimal base image to package the manager binary
+# Refer to https://github.com/GoogleContainerTools/distroless for more details
+FROM cloudfoundry/run:tiny
+WORKDIR /
+COPY --from=builder /workspace/manager .
+ENTRYPOINT ["/manager"]

Makefile

@@ -0,0 +1,74 @@
+
+# Image URL to use all building/pushing image targets
+IMG ?= controller:latest
+# Produce CRDs that work back to Kubernetes 1.11 (no version conversion)
+CRD_OPTIONS ?= "crd:trivialVersions=true"
+
+# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
+ifeq (,$(shell go env GOBIN))
+GOBIN=$(shell go env GOPATH)/bin
+else
+GOBIN=$(shell go env GOBIN)
+endif
+
+all: manager
+
+# Run tests
+test: generate fmt vet manifests
+	go test ./... -coverprofile cover.out
+
+# Build manager binary
+manager: generate fmt vet
+	go build -o bin/manager main.go
+
+# Run against the configured Kubernetes cluster in ~/.kube/config
+run: generate fmt vet manifests
+	go run ./main.go
+
+# Install CRDs into a cluster
+install: manifests
+	kustomize build config/crd | kubectl apply -f -
+
+# Deploy controller in the configured Kubernetes cluster in ~/.kube/config
+deploy: manifests
+	cd config/manager && kustomize edit set image controller=${IMG}
+	kustomize build config/default | kubectl apply -f -
+
+# Undeploy controller in the configured Kubernetes cluster in ~/.kube/config
+undeploy: manifests
+	cd config/manager && kustomize edit set image controller=${IMG}
+	kustomize build config/default | kubectl delete -f -
+
+# Generate manifests e.g. CRD, RBAC etc.
+manifests: controller-gen
+	$(CONTROLLER_GEN) $(CRD_OPTIONS) rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=config/crd/bases
+
+# Run go fmt against code
+fmt:
+	go fmt ./...
+
+# Run go vet against code
+vet:
+	go vet ./...
+
+# Generate code
+generate: controller-gen
+	$(CONTROLLER_GEN) object:headerFile=./hack/boilerplate.go.txt paths="./..."
+
+# Build the docker image
+docker-build: test
+	docker build . -t ${IMG}
+
+# Push the docker image
+docker-push:
+	docker push ${IMG}
+
+# find or download controller-gen
+# download controller-gen if necessary
+controller-gen:
+ifeq (, $(shell which controller-gen))
+	go get sigs.k8s.io/controller-tools/cmd/controller-gen@v0.2.0
+CONTROLLER_GEN=$(GOBIN)/controller-gen
+else
+CONTROLLER_GEN=$(shell which controller-gen)
+endif

PROJECT

@@ -0,0 +1,7 @@
+version: "2"
+domain: imagerelocation.pivotal.io
+repo: github.com/pivotal/kubernetes-image-mapper
+resources:
+- group: mapper
+  version: v1alpha1
+  kind: ImageMap

README.md

@@ -0,0 +1,83 @@
+# Kubernetes Image Mapper
+
+This consists of a MutatingAdmissionWebhook which rewrites kubernetes pods to use relocated image references.
+The mapping from original to relocated image references is built by deploying `imagemap` custom resources.
+
+Each `imagemap` is namespaced and applies only to pods in the same namespace.
+
+When an `imagemap` is deployed, if it is inconsistent with other `imagemaps` in the namespace, it is rejected
+and the status of the `imagemap` details the inconsistency (in a `Ready` condition with status `false`).
+After the inconsistency has been corrected, the rejected `imagemap` is automatically redeployed after a
+short delay (currently one minute).
+
+If an `imagemap` is updated and this results in the `imagemap` being rejected, the original `imagemap` is undeployed.
+
+*TODO: the webhook has not yet been implemented*
+
+## Usage
+
+The following was tested using a GKE cluster.
+
+* Install Jetstack certificate manager:
+```
+kubectl create namespace cert-manager && \
+kubectl label namespace cert-manager certmanager.k8s.io/disable-validation=true && \
+kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v0.10.1/cert-manager.yaml
+```
+
+* If you want the controller and webhook to provide detailed logs, enable debug logging in the currently active patch
+file, such as`config/default/manager_auth_proxy_patch.yaml`, like this:
+```
+      ...
+      - name: manager
+        args:
+        - "--metrics-addr=127.0.0.1:8080"
+        - "--enable-leader-election"
+        - "--debug"
+      ...
+```
+
+* Build and deploy the webhook:
+```
+make docker-build docker-push IMG=<some-registry>/<project-name>:tag &&
+make deploy IMG=<some-registry>/<project-name>:tag
+```
+
+* Deploy a sample imagemap custom resource, after editing it to replace `<repo prefix>` with a suitable repository
+prefix (e.g. `gcr.io/my-sandbox`) to which you and the cluster have access:
+```
+# remember to edit config/samples/mapper_v1alpha1_imagemap.yaml
+kubectl apply -f config/samples/mapper_v1alpha1_imagemap.yaml
+```
+
+* Create a pod, e.g.:
+```
+kubectl run kubernetes-bootcamp --image=gcr.io/google-samples/kubernetes-bootcamp:v1 --port=8080
+```
+
+* Observe the relocated image in the pod, e.g.:
+```
+kubectl get pod kubernetes-bootcamp-xxx -oyaml
+```
+Output:
+```
+...
+spec:
+  containers:
+  - image: <repo prefix>/kubernetes-bootcamp:v1
+...
+```
+
+Note: the `image` value under `containerStatuses` may not be the relocated value. This is a [known issue](https://github.com/kubernetes/kubernetes/issues/51017) when an image has multiple references referring to it. 
+
+* View the logs from the webhook, e.g.:
+```
+kubectl logs ir-webhook-xxx -n image-relocation
+```
+
+* Now tidy up:
+```
+kubectl delete deployment kubernetes-bootcamp
+kubectl delete -f config/samples/mapper_v1alpha1_imagemap.yaml
+make deploy IMG=<some-registry>/<project-name>:tag
+```

api/v1alpha1/groupversion_info.go

@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2019-Present Pivotal Software, Inc. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// Package v1alpha1 contains API Schema definitions for the mapper v1alpha1 API group
+// +kubebuilder:object:generate=true
+// +groupName=mapper.imagerelocation.pivotal.io
+package v1alpha1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/scheme"
+)
+
+var (
+	// GroupVersion is group version used to register these objects
+	GroupVersion = schema.GroupVersion{Group: "mapper.imagerelocation.pivotal.io", Version: "v1alpha1"}
+
+	// SchemeBuilder is used to add go types to the GroupVersionKind scheme
+	SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
+
+	// AddToScheme adds the types in this group-version to the given scheme.
+	AddToScheme = SchemeBuilder.AddToScheme
+)

api/v1alpha1/imagemap_types.go

@@ -0,0 +1,100 @@
+/*
+ * Copyright (c) 2019-Present Pivotal Software, Inc. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package v1alpha1
+
+import (
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
+// NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.
+
+type Maplet struct {
+	From string `json:"from"`
+	To   string `json:"to"`
+}
+
+// ImageMapSpec defines the desired state of ImageMap
+type ImageMapSpec struct {
+	// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
+	// Important: Run "make" to regenerate code after modifying this file
+	Map []Maplet `json:"map"`
+}
+
+// ImageMapStatus defines the observed state of ImageMap
+type ImageMapStatus struct {
+	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
+	// Important: Run "make" to regenerate code after modifying this file
+
+	// ObservedGeneration records the ImageMap generation that the status reflects
+	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
+
+	// Conditions are observations about the state of the ImageMap
+	Conditions []Condition `json:"conditions"`
+}
+
+// Condition defines an observation about an ImageMap
+// See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties
+type Condition struct {
+	// Type is the type of condition
+	Type ConditionType `json:"type"`
+
+	// Status of the condition, one of True, False, Unknown
+	// +required
+	Status corev1.ConditionStatus `json:"status"`
+
+	// ObservationTime records when the condition was observed
+	ObservationTime metav1.Time `json:"observationTime,omitempty"`
+
+	// Message is a human readable description of the condition
+	// +optional
+	Message string `json:"message,omitempty"`
+}
+
+// ConditionType is a camel-cased condition type
+type ConditionType string
+
+const (
+	// ConditionReady specifies that the resource has been processed, regardless of the outcome
+	ConditionReady ConditionType = "Ready"
+)
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+
+// ImageMap is the Schema for the imagemaps API
+type ImageMap struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   ImageMapSpec   `json:"spec,omitempty"`
+	Status ImageMapStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// ImageMapList contains a list of ImageMap
+type ImageMapList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []ImageMap `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&ImageMap{}, &ImageMapList{})
+}