feat(kubernetes): Omit desired namespaces (#1486)

spinnaker · Mar 3, 2017 · 715e2fd · 715e2fd
1 parent 18f7d58
commit 715e2fd
Show file tree

Hide file tree

Showing 13 changed files with 52 additions and 12 deletions.
diff --git a/.../netflix/spinnaker/clouddriver/kubernetes/config/KubernetesConfigurationProperties.groovy b/.../netflix/spinnaker/clouddriver/kubernetes/config/KubernetesConfigurationProperties.groovy
@@ -31,6 +31,7 @@ class KubernetesConfigurationProperties {
     String kubeconfigFile
     Boolean serviceAccount
     List<String> namespaces
+    List<String> omitNamespaces
     int cacheThreads
     List<LinkedDockerRegistryConfiguration> dockerRegistries
     List<String> requiredGroupMembership

diff --git a/...n/groovy/com/netflix/spinnaker/clouddriver/kubernetes/security/KubernetesCredentials.java b/...n/groovy/com/netflix/spinnaker/clouddriver/kubernetes/security/KubernetesCredentials.java
@@ -30,10 +30,12 @@
 import javax.validation.ConstraintViolationException;
 import java.io.UnsupportedEncodingException;
 import java.util.*;
+import java.util.stream.Collectors;
 
 public class KubernetesCredentials {
   private final KubernetesApiAdaptor apiAdaptor;
   private final List<String> namespaces;
+  private final List<String> omitNamespaces;
   private final List<LinkedDockerRegistryConfiguration> dockerRegistries;
   private final HashMap<String, Set<String>> imagePullSecrets;
   private final Logger LOG;
@@ -45,10 +47,12 @@ public class KubernetesCredentials {
   // strictly a credential.
   public KubernetesCredentials(KubernetesApiAdaptor apiAdaptor,
                                List<String> namespaces,
+                               List<String> omitNamespaces,
                                List<LinkedDockerRegistryConfiguration> dockerRegistries,
                                AccountCredentialsRepository accountCredentialsRepository) {
     this.apiAdaptor = apiAdaptor;
     this.namespaces = namespaces != null ? namespaces : new ArrayList<>();
+    this.omitNamespaces = omitNamespaces != null ? omitNamespaces : new ArrayList<>();
     this.oldNamespaces = this.namespaces;
     this.dynamicRegistries = new HashSet<>();
     this.dockerRegistries = dockerRegistries != null ? dockerRegistries : new ArrayList<>();
@@ -71,9 +75,11 @@ public List<String> getNamespaces() {
       return namespaces;
     } else {
       List<String> addedNamespaces = apiAdaptor.getNamespacesByName();
+      addedNamespaces.removeAll(omitNamespaces);
+
       List<String> resultNamespaces = new ArrayList<>(addedNamespaces);
 
-      // otherwise, find the namespaces that were added, and add docker secrets to them. No need to track deleted
+      // Find the namespaces that were added, and add docker secrets to them. No need to track deleted
       // namespaces since they delete their secrets automatically.
       addedNamespaces.removeAll(oldNamespaces);
       reconfigureRegistries(addedNamespaces, resultNamespaces);

diff --git a/...netflix/spinnaker/clouddriver/kubernetes/security/KubernetesCredentialsInitializer.groovy b/...netflix/spinnaker/clouddriver/kubernetes/security/KubernetesCredentialsInitializer.groovy
@@ -81,6 +81,7 @@ class KubernetesCredentialsInitializer implements CredentialsInitializerSynchron
           .kubeconfigFile(managedAccount.kubeconfigFile)
           .serviceAccount(managedAccount.serviceAccount)
           .namespaces(managedAccount.namespaces)
+          .omitNamespaces(managedAccount.omitNamespaces)
           .cacheThreads(managedAccount.cacheThreads ?: DEFAULT_CACHE_THREADS)
           .dockerRegistries(managedAccount.dockerRegistries)
           .requiredGroupMembership(managedAccount.requiredGroupMembership)

diff --git a/...etflix/spinnaker/clouddriver/kubernetes/security/KubernetesNamedAccountCredentials.groovy b/...etflix/spinnaker/clouddriver/kubernetes/security/KubernetesNamedAccountCredentials.groovy
@@ -34,6 +34,7 @@ public class KubernetesNamedAccountCredentials implements AccountCredentials<Kub
   final String kubeconfigFile
   final Boolean serviceAccount
   List<String> namespaces
+  List<String> omitNamespaces
   final int cacheThreads
   KubernetesCredentials credentials
   final List<String> requiredGroupMembership
@@ -51,6 +52,7 @@ public class KubernetesNamedAccountCredentials implements AccountCredentials<Kub
                                            String kubeconfigFile,
                                            Boolean serviceAccount,
                                            List<String> namespaces,
+                                           List<String> omitNamespaces,
                                            int cacheThreads,
                                            List<LinkedDockerRegistryConfiguration> dockerRegistries,
                                            List<String> requiredGroupMembership,
@@ -65,6 +67,7 @@ public class KubernetesNamedAccountCredentials implements AccountCredentials<Kub
     this.kubeconfigFile = kubeconfigFile
     this.serviceAccount = serviceAccount
     this.namespaces = namespaces
+    this.omitNamespaces = omitNamespaces
     this.cacheThreads = cacheThreads
     this.requiredGroupMembership = requiredGroupMembership
     this.dockerRegistries = dockerRegistries
@@ -87,6 +90,7 @@ public class KubernetesNamedAccountCredentials implements AccountCredentials<Kub
     String kubeconfigFile
     Boolean serviceAccount
     List<String> namespaces
+    List<String> omitNamespaces
     int cacheThreads
     KubernetesCredentials credentials
     List<String> requiredGroupMembership
@@ -153,6 +157,11 @@ public class KubernetesNamedAccountCredentials implements AccountCredentials<Kub
       return this
     }
 
+    Builder omitNamespaces(List<String> omitNamespaces) {
+      this.omitNamespaces = omitNamespaces
+      return this
+    }
+
     Builder cacheThreads(int cacheThreads) {
       this.cacheThreads = cacheThreads
       return this
@@ -181,6 +190,7 @@ public class KubernetesNamedAccountCredentials implements AccountCredentials<Kub
       return new KubernetesCredentials(
           new KubernetesApiAdaptor(name, config),
           namespaces,
+          omitNamespaces,
           dockerRegistries,
           accountCredentialsRepository,
       )
@@ -193,6 +203,10 @@ public class KubernetesNamedAccountCredentials implements AccountCredentials<Kub
       if (!dockerRegistries || dockerRegistries.size() == 0) {
         throw new IllegalArgumentException("Docker registries for Kubernetes account " + name + " missing.")
       }
+      if (omitNamespaces && namespaces) {
+        throw new IllegalArgumentException("At most one of 'namespaces' and 'omitNamespaces' can be specified")
+      }
+
       kubeconfigFile = kubeconfigFile != null && kubeconfigFile.length() > 0 ?
           kubeconfigFile :
           System.getProperty("user.home") + "/.kube/config"
@@ -211,6 +225,7 @@ public class KubernetesNamedAccountCredentials implements AccountCredentials<Kub
           kubeconfigFile,
           serviceAccount,
           namespaces,
+          omitNamespaces,
           cacheThreads,
           dockerRegistries,
           requiredGroupMembership,

diff --git a/...kubernetes/deploy/ops/loadbalancer/UpsertKubernetesLoadBalancerAtomicOperationSpec.groovy b/...kubernetes/deploy/ops/loadbalancer/UpsertKubernetesLoadBalancerAtomicOperationSpec.groovy
@@ -65,7 +65,7 @@ class UpsertKubernetesLoadBalancerAtomicOperationSpec extends Specification {
     dockerRegistry = Mock(LinkedDockerRegistryConfiguration)
     dockerRegistries = [dockerRegistry]
     accountCredentialsRepositoryMock = Mock(AccountCredentialsRepository)
-    credentials = new KubernetesCredentials(apiMock, NAMESPACES, [], accountCredentialsRepositoryMock)
+    credentials = new KubernetesCredentials(apiMock, NAMESPACES, [], [], accountCredentialsRepositoryMock)
     namedAccountCredentials = new KubernetesNamedAccountCredentials.Builder()
         .name("accountName")
         .credentials(credentials)

diff --git a/...r/clouddriver/kubernetes/deploy/ops/servergroup/CloneKubernetesAtomicOperationSpec.groovy b/...r/clouddriver/kubernetes/deploy/ops/servergroup/CloneKubernetesAtomicOperationSpec.groovy
@@ -108,7 +108,7 @@ class CloneKubernetesAtomicOperationSpec extends Specification {
     accountCredentialsRepositoryMock = Mock(AccountCredentialsRepository)
     dockerRegistry = Mock(LinkedDockerRegistryConfiguration)
     dockerRegistries = [dockerRegistry]
-    credentials = new KubernetesCredentials(apiMock, [], [], accountCredentialsRepositoryMock)
+    credentials = new KubernetesCredentials(apiMock, [], [], [], accountCredentialsRepositoryMock)
     namedAccountCredentials = new KubernetesNamedAccountCredentials.Builder()
         .name("name")
         .dockerRegistries(dockerRegistries)

diff --git a/.../clouddriver/kubernetes/deploy/ops/servergroup/DeployKubernetesAtomicOperationSpec.groovy b/.../clouddriver/kubernetes/deploy/ops/servergroup/DeployKubernetesAtomicOperationSpec.groovy
@@ -120,7 +120,7 @@ class DeployKubernetesAtomicOperationSpec extends Specification {
 
     dockerRegistry = Mock(LinkedDockerRegistryConfiguration)
     dockerRegistries = [dockerRegistry]
-    credentials = new KubernetesCredentials(apiMock, [NAMESPACE], DOCKER_REGISTRY_ACCOUNTS, accountCredentialsRepositoryMock)
+    credentials = new KubernetesCredentials(apiMock, [NAMESPACE], [], DOCKER_REGISTRY_ACCOUNTS, accountCredentialsRepositoryMock)
     namedAccountCredentials = new KubernetesNamedAccountCredentials.Builder()
         .name("name")
         .dockerRegistries(dockerRegistries)

diff --git a/.../clouddriver/kubernetes/deploy/validators/StandardKubernetesAttributeValidatorSpec.groovy b/.../clouddriver/kubernetes/deploy/validators/StandardKubernetesAttributeValidatorSpec.groovy
@@ -61,7 +61,7 @@ class StandardKubernetesAttributeValidatorSpec extends Specification {
 
     def dockerRegistry = Mock(LinkedDockerRegistryConfiguration)
     def dockerRegistries = [dockerRegistry]
-    credentials = new KubernetesCredentials(apiMock, NAMESPACES, DOCKER_REGISTRY_ACCOUNTS, accountCredentialsRepositoryMock)
+    credentials = new KubernetesCredentials(apiMock, NAMESPACES, [], DOCKER_REGISTRY_ACCOUNTS, accountCredentialsRepositoryMock)
     def namedAccountCredentials = new KubernetesNamedAccountCredentials.Builder()
         .name(ACCOUNT_NAME)
         .dockerRegistries(dockerRegistries)

diff --git a/...y/validators/loadbalancer/UpsertKubernetesLoadBalancerAtomicOperationValidatorSpec.groovy b/...y/validators/loadbalancer/UpsertKubernetesLoadBalancerAtomicOperationValidatorSpec.groovy
@@ -64,7 +64,7 @@ class UpsertKubernetesLoadBalancerAtomicOperationValidatorSpec extends Specifica
 
     dockerRegistry = Mock(LinkedDockerRegistryConfiguration)
     dockerRegistries = [dockerRegistry]
-    credentials = new KubernetesCredentials(apiMock, NAMESPACES, [], accountCredentialsRepositoryMock)
+    credentials = new KubernetesCredentials(apiMock, NAMESPACES, [], [], accountCredentialsRepositoryMock)
     namedAccountCredentials = new KubernetesNamedAccountCredentials.Builder()
         .name(VALID_ACCOUNT)
         .dockerRegistries(dockerRegistries)

diff --git a/...bernetes/deploy/validators/servergroup/CloneKubernetesAtomicOperationValidatorSpec.groovy b/...bernetes/deploy/validators/servergroup/CloneKubernetesAtomicOperationValidatorSpec.groovy
@@ -91,7 +91,7 @@ class CloneKubernetesAtomicOperationValidatorSpec extends Specification {
 
     def dockerRegistry = Mock(LinkedDockerRegistryConfiguration)
     def dockerRegistries = [dockerRegistry]
-    def credentials = new KubernetesCredentials(apiMock, NAMESPACES, DOCKER_REGISTRY_ACCOUNTS, accountCredentialsRepositoryMock)
+    def credentials = new KubernetesCredentials(apiMock, NAMESPACES, [], DOCKER_REGISTRY_ACCOUNTS, accountCredentialsRepositoryMock)
     def namedAccountCredentials = new KubernetesNamedAccountCredentials.Builder()
         .name(VALID_ACCOUNT)
         .dockerRegistries(dockerRegistries)

diff --git a/...ernetes/deploy/validators/servergroup/DeployKubernetesAtomicOperationValidatorSpec.groovy b/...ernetes/deploy/validators/servergroup/DeployKubernetesAtomicOperationValidatorSpec.groovy
@@ -97,7 +97,7 @@ class DeployKubernetesAtomicOperationValidatorSpec extends Specification {
 
     def dockerRegistry = Mock(LinkedDockerRegistryConfiguration)
     def dockerRegistries = [dockerRegistry]
-    def credentials = new KubernetesCredentials(apiMock, NAMESPACES, DOCKER_REGISTRY_ACCOUNTS, accountCredentialsRepositoryMock)
+    def credentials = new KubernetesCredentials(apiMock, NAMESPACES, [], DOCKER_REGISTRY_ACCOUNTS, accountCredentialsRepositoryMock)
     def namedAccountCredentials = new KubernetesNamedAccountCredentials.Builder()
         .name(VALID_ACCOUNT)
         .dockerRegistries(dockerRegistries)

diff --git a/...nnaker/clouddriver/kubernetes/provider/agent/KubernetesServerGroupCachingAgentSpec.groovy b/...nnaker/clouddriver/kubernetes/provider/agent/KubernetesServerGroupCachingAgentSpec.groovy
@@ -67,7 +67,7 @@ class KubernetesServerGroupCachingAgentSpec extends Specification {
 
     def accountCredentialsRepositoryMock = Mock(AccountCredentialsRepository)
 
-    kubernetesCredentials = new KubernetesCredentials(apiMock, [], [], accountCredentialsRepositoryMock)
+    kubernetesCredentials = new KubernetesCredentials(apiMock, [], [], [], accountCredentialsRepositoryMock)
 
     applicationKey = Keys.getApplicationKey(APP)
     clusterKey = Keys.getClusterKey(ACCOUNT_NAME, APP, 'serverGroup', CLUSTER)

diff --git a/...vy/com/netflix/spinnaker/clouddriver/kubernetes/security/KubernetesCredentialsSpec.groovy b/...vy/com/netflix/spinnaker/clouddriver/kubernetes/security/KubernetesCredentialsSpec.groovy
@@ -60,7 +60,7 @@ class KubernetesCredentialsSpec extends Specification {
     repositoryMock.getOne(ACCOUNT1) >> registryAccountMock
 
     when:
-    def result = new KubernetesCredentials(adaptorMock, NAMESPACES1, REGISTRIES1, repositoryMock)
+    def result = new KubernetesCredentials(adaptorMock, NAMESPACES1, [], REGISTRIES1, repositoryMock)
 
     then:
     result.getNamespaces() == NAMESPACES1
@@ -77,13 +77,30 @@ class KubernetesCredentialsSpec extends Specification {
     repositoryMock.getOne(ACCOUNT1) >> registryAccountMock
 
     when:
-    def result = new KubernetesCredentials(adaptorMock, null, REGISTRIES2, repositoryMock)
+    def result = new KubernetesCredentials(adaptorMock, null, [], REGISTRIES2, repositoryMock)
 
     then:
     result.getNamespaces() == NAMESPACES2
     result.dockerRegistries.get(0).namespaces == NAMESPACES2
   }
 
+  void "should omit kubernetes namespaces"() {
+    setup:
+    KubernetesApiAdaptor adaptorMock = Mock(KubernetesApiAdaptor)
+    adaptorMock.getNamespacesByName() >> NAMESPACES2
+
+    AccountCredentialsRepository repositoryMock = Mock(AccountCredentialsRepository)
+    DockerRegistryNamedAccountCredentials registryAccountMock = mockCredentials(ACCOUNT1)
+    repositoryMock.getOne(ACCOUNT1) >> registryAccountMock
+
+    when:
+    def result = new KubernetesCredentials(adaptorMock, null, NAMESPACES2, REGISTRIES2, repositoryMock)
+
+    then:
+    result.getNamespaces() == []
+    result.dockerRegistries.get(0).namespaces == NAMESPACES2
+  }
+
   void "should not use kubernetes namespaces only in registry"() {
     setup:
     KubernetesApiAdaptor adaptorMock = Mock(KubernetesApiAdaptor)
@@ -94,7 +111,7 @@ class KubernetesCredentialsSpec extends Specification {
     repositoryMock.getOne(ACCOUNT1) >> registryAccountMock
 
     when:
-    def result = new KubernetesCredentials(adaptorMock, null, REGISTRIES1, repositoryMock)
+    def result = new KubernetesCredentials(adaptorMock, null, [], REGISTRIES1, repositoryMock)
 
     then:
     result.getNamespaces() == NAMESPACES2