feat: Creating a Custom Resource Definition for a pod IP to metadata mapper. #1071

prateek041 · 2023-06-12T16:55:30Z

The entire issue requires implementation of Custom Resource that maps pod IP to metadata and eventually remove cilium endpoint custom resource. The issue resolution is to be done in four parts, this is the first step where I Create the Custom resource definition.

Next up, writing the controller logic.

This commit: - Initializes a Project with Name podinfo and repo github.com/cilium/tetragon - Provide builderplate code for creating the operator Signed-off-by: Prateek Singh <[email protected]>

This commit: - Defines the Custom Resource. Signed-off-by: Prateek Singh <[email protected]>

By default, a custom resource has spec (desired state) as well as status (current state) fields and Kubebuilder auto-generates manifests and deepcopy files for it. But, for out PodInfo resource we don't want the status info, so we need to remove it This commit: - Removes the //+kubebuilder:subresource:status comment from podinfo_types.go so kubebuilder doesn't auto generate things regarding the status field. - make manifests and make generate commands create updated manifests and deepcopy files. Signed-off-by: Prateek Singh <[email protected]>

prateek041 · 2023-06-12T16:56:48Z

cc @michi-covalent

michi-covalent · 2023-06-12T22:47:41Z

lgtm overall. a few comments

i'm having a second thought regarding the resource format. maybe it makes sense to just mirror k8s pod resource format instead of coming up with our own. for example:

apiVersion: cilium.io/alphav1
kind: PodInfo
metadata:
  annotations:
    pod: annotation
  labels:
    pod: label
  name: pod-name
  namespace: pod-namespace
spec:
  hostNetwork: false
status:
  podIP: 1.2.3.4
  podIPs:
  - ip: 1.2.3.4
  startTime: "2023-05-28T12:09:02Z"

still trying to come up with a better name than PodInfo. i don't like that plural is podinfoes. it doesn't sound right. not a blocker but we might end up changing the name later.
remove podinfo/go.mod. we don't need to add a separate go module. also remove github.com/onsi/ginkgo/v2 and github.com/onsi/gomega dependencies. tetragon uses github.com/stretchr/testify. we should avoid introducing additional test frameworks.
remove fixes: #794 from the pull request description. this pull request doesn't fix the issue yet.

prateek041 · 2023-06-13T06:24:25Z

Replicate the original k8s pod Resource format instead of creating one of our own. (needs discussion)
Remove go.mod file along with ginkgo and gomega.
remove fixes: issue 749 from the description.

kkourt · 2023-06-16T07:08:18Z

Hi,

One small comment from my side, would it make sense to add the files into pkg/k8s instead in podinfo?

i don't like that plural is podinfoes

😅
You should be able to define your own plural, e.g., podsInfo. That's what we did for TracingPolicyNamespaced's plural being TracingPoliciesNamespaced rather than TracingPolicyNamespaceds. See: 2ebd385.

michi-covalent · 2023-06-16T16:16:28Z

You should be able to define your own plural, e.g., podsInfo. That's what we did for TracingPolicyNamespaced's plural being TracingPoliciesNamespaced rather than TracingPolicyNamespaceds. See: 2ebd385.

yeah that's also an option. we ended up going with TetragonPod as the name for now. open to suggestions though, we can always rename later 📝

kkourt · 2023-06-19T09:56:39Z

yeah that's also an option. we ended up going with TetragonPod as the name for now.

TetragonPod sounds good to me.

netlify · 2023-06-27T04:22:30Z

✅ Deploy Preview for tetragon ready!

Name	Link
🔨 Latest commit	`ddfd1d9`
🔍 Latest deploy log	https://app.netlify.com/sites/tetragon/deploys/64c27793fba3740008f77e53
😎 Deploy Preview	https://deploy-preview-1071--tetragon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

…ot ginkgo Signed-off-by: Prateek Singh <[email protected]>

- Updated the spec field - Added the status field - Generated manifests Signed-off-by: Prateek Singh <[email protected]>

prateek041 · 2023-06-27T09:47:20Z

I made the changes suggested, please have a look.

Should I change the name to TetragonPod right away or later ?

cc @michi-covalent

tixxdz · 2023-06-27T10:42:15Z

podinfo/config/crd/bases/cilium.io.tetragon.cilium.io_podinfoes.yaml

+              hostNetwork:
+                description: Host networking requested for this pod. Use the host's
+                  network namespace. If this option is set, the ports that will be
+                  used must be specified.


Maybe my comment is stupid: doc says "the ports that will be used must be specified" but doesn't specify where or how? maybe if it makes sense add it here too?

Thank you for pointing that out. I will make the changes.

@tixxdz

I haven't mad the changes there yet, will do right before the PR is ready.

prateek041 · 2023-07-02T06:16:26Z

Tasks:

Rename the CRD to Tetragonpod.
Integrate deployment of CRD through the operator.

cc @michi-covalent

Signed-off-by: Prateek Singh <[email protected]>

…e operator to register the CRD with kubernetes API. - It has an embed.go file that will include the YAML file in the binary. - Created a register.go that will take that YAML file create a CRD object and return. Signed-off-by: Prateek Singh <[email protected]>

…ator - renamed the register package to client package, and wrote logic that will register the CRD with the API server - Used the tetragon client package to register the CRD Signed-off-by: Prateek Singh <[email protected]>

tetragonpod/api/v1alpha1/groupversion_info.go

tetragonpod/PROJECT

michi-covalent · 2023-07-03T00:37:49Z

tetragonpod/api/v1alpha1/client/register_crd.go

+
+func RegisterCRD(client *apiextclientset.Clientset) error {
+	crd := GetCRD()
+	_, err := client.ApiextensionsV1().CustomResourceDefinitions().Create(context.TODO(), crd, metav1.CreateOptions{})


this will fail if the CRD already exists. we need to call Update() if the CRD already exists.

oh thanks for pointing that out, I totally missed that. Working on it.

I made changes, the current implementation is like this:

The CRD is created only if it doesn't already exists.

If the CRD already exists, no changes are made.

I am having a few questions regarding the update logic, like how would it know that CRD needs to be updated ? I went through the TracingPolicy CRD logic, how it is handling it, but have a few doubts. Let's have a little discussion on it in the meeting today.

Signed-off-by: Prateek Singh <[email protected]>

…n with the help of operator. - The logic now handles the condition if the CustomResourceDefinition already exists in the cluster. Signed-off-by: Prateek Singh <[email protected]>

Signed-off-by: Prateek Singh <[email protected]>

michi-covalent · 2023-07-20T16:29:29Z

operator/main.go

@@ -94,9 +95,16 @@ func operatorExecute() {
 	// Register the CRDs after validating that we are running on a supported
 	// version of K8s.
 	if !operatorOption.Config.SkipCRDCreation {
-		if err := client.RegisterCRDs(k8sAPIExtClient); err != nil {
+
+		// Register Tracing Policy CRD


let's run this logic if and only if tetragonPod.enabled flag is set to true.

Signed-off-by: Prateek Singh <[email protected]>

prateek041 · 2023-07-27T13:58:29Z

Delete unused files
Resolve merge conflicts
Logic to enable tetragonpod through helm

cc @michi-covalent

michi-covalent · 2023-07-27T21:35:13Z

@prateek041 just an fyi i pushed a copy of this branch to #1281 so that we can test the CI image build 🧑‍🔬

prateek041 added 3 commits June 12, 2023 21:57

feat: Creating a Custom Resource Definition for the PodInfo operator.

c31ed60

This commit: - Initializes a Project with Name podinfo and repo github.com/cilium/tetragon - Provide builderplate code for creating the operator Signed-off-by: Prateek Singh <[email protected]>

feat: Creating a Custom Resource Definition for the PodInfo operator.

41de71f

This commit: - Defines the Custom Resource. Signed-off-by: Prateek Singh <[email protected]>

prateek041 requested a review from a team as a code owner June 12, 2023 16:55

prateek041 requested a review from tixxdz June 12, 2023 16:55

Remove go.Mod file from podinfo directory.

d87117d

prateek041 added 2 commits June 27, 2023 15:12

Cleared the file since the tests will be written using testify, and n…

cca9008

…ot ginkgo Signed-off-by: Prateek Singh <[email protected]>

Mirror k8s pod resource

ad830c1

- Updated the spec field - Added the status field - Generated manifests Signed-off-by: Prateek Singh <[email protected]>

tixxdz reviewed Jun 27, 2023

View reviewed changes

prateek041 added 3 commits July 2, 2023 12:36

Renamed the project from podinfo to tetragonpod.

a1f2459

Signed-off-by: Prateek Singh <[email protected]>

michi-covalent reviewed Jul 3, 2023

View reviewed changes

tetragonpod/api/v1alpha1/groupversion_info.go Outdated Show resolved Hide resolved

tetragonpod/PROJECT Outdated Show resolved Hide resolved

michi-covalent reviewed Jul 3, 2023

View reviewed changes

prateek041 added 7 commits July 6, 2023 08:52

Replaced podinfo with tetragonpods.

3ef1e9c

Signed-off-by: Prateek Singh <[email protected]>

Updated the Logic for registering TetragonPod CustomResourceDefinitio…

8b682c4

…n with the help of operator. - The logic now handles the condition if the CustomResourceDefinition already exists in the cluster. Signed-off-by: Prateek Singh <[email protected]>

cleanup

bf134c7

Signed-off-by: Prateek Singh <[email protected]>

Added cluster role for tetragon pod controller

58ce306

Signed-off-by: Prateek Singh <[email protected]>

added role binding and service account for tetragonpod controller

6d25981

Signed-off-by: Prateek Singh <[email protected]>

Added deployment for the tetragonpod controller

336aaf3

Signed-off-by: Prateek Singh <[email protected]>

Modified files for adding labels and default values

dbb2856

Signed-off-by: Prateek Singh <[email protected]>

prateek041 added 2 commits July 19, 2023 12:40

Modified tetragonpod controller to check if it gets pod resources

85b5baf

Signed-off-by: Prateek Singh <[email protected]>

Changed github workflows to build image of the tetragonpod controller

087ef7a

Signed-off-by: Prateek Singh <[email protected]>

prateek041 requested a review from willfindlay as a code owner July 19, 2023 07:31

michi-covalent reviewed Jul 20, 2023

View reviewed changes

prateek041 added 4 commits July 27, 2023 15:33

Added flag and logic for skipping the tetragonPod CRD

d9b4019

Signed-off-by: Prateek Singh <[email protected]>

Added flag in the default value

d8271a4

Signed-off-by: Prateek Singh <[email protected]>

Cleanup of unused files

c12fd65

Signed-off-by: Prateek Singh <[email protected]>

Resolving merge conflicts

ddfd1d9

Signed-off-by: Prateek Singh <[email protected]>

prateek041 closed this Sep 19, 2023

prateek041 deleted the feat/prateek041/PodInfo branch September 19, 2023 05:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Creating a Custom Resource Definition for a pod IP to metadata mapper. #1071

feat: Creating a Custom Resource Definition for a pod IP to metadata mapper. #1071

prateek041 commented Jun 12, 2023 •

edited

Loading

prateek041 commented Jun 12, 2023

michi-covalent commented Jun 12, 2023 •

edited

Loading

prateek041 commented Jun 13, 2023 •

edited

Loading

kkourt commented Jun 16, 2023

michi-covalent commented Jun 16, 2023

kkourt commented Jun 19, 2023

netlify bot commented Jun 27, 2023 •

edited

Loading

prateek041 commented Jun 27, 2023

tixxdz Jun 27, 2023 •

edited

Loading

prateek041 Jun 27, 2023

prateek041 Jul 2, 2023

prateek041 commented Jul 2, 2023 •

edited

Loading

michi-covalent Jul 3, 2023

prateek041 Jul 3, 2023

prateek041 Jul 6, 2023

michi-covalent Jul 20, 2023

prateek041 commented Jul 27, 2023

michi-covalent commented Jul 27, 2023

feat: Creating a Custom Resource Definition for a pod IP to metadata mapper. #1071

feat: Creating a Custom Resource Definition for a pod IP to metadata mapper. #1071

Conversation

prateek041 commented Jun 12, 2023 • edited Loading

prateek041 commented Jun 12, 2023

michi-covalent commented Jun 12, 2023 • edited Loading

prateek041 commented Jun 13, 2023 • edited Loading

kkourt commented Jun 16, 2023

michi-covalent commented Jun 16, 2023

kkourt commented Jun 19, 2023

netlify bot commented Jun 27, 2023 • edited Loading

✅ Deploy Preview for tetragon ready!

prateek041 commented Jun 27, 2023

tixxdz Jun 27, 2023 • edited Loading

Choose a reason for hiding this comment

prateek041 Jun 27, 2023

Choose a reason for hiding this comment

prateek041 Jul 2, 2023

Choose a reason for hiding this comment

prateek041 commented Jul 2, 2023 • edited Loading

michi-covalent Jul 3, 2023

Choose a reason for hiding this comment

prateek041 Jul 3, 2023

Choose a reason for hiding this comment

prateek041 Jul 6, 2023

Choose a reason for hiding this comment

michi-covalent Jul 20, 2023

Choose a reason for hiding this comment

prateek041 commented Jul 27, 2023

michi-covalent commented Jul 27, 2023

prateek041 commented Jun 12, 2023 •

edited

Loading

michi-covalent commented Jun 12, 2023 •

edited

Loading

prateek041 commented Jun 13, 2023 •

edited

Loading

netlify bot commented Jun 27, 2023 •

edited

Loading

tixxdz Jun 27, 2023 •

edited

Loading

prateek041 commented Jul 2, 2023 •

edited

Loading