-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(virtualization-api): first implementation (#11)
Description Added a new component virtualization-api - extension API server. Why do we need it, and what problem does it solve? Using the api server, we can connect to virtual machines and perform various operations. Currently implemented: console, vnc, port forwarding --------- Signed-off-by: Yaroslav Borbat <[email protected]> Signed-off-by: Yaroslav Borbat <[email protected]> Co-authored-by: Ivan Mikheykin <[email protected]> Signed-off-by: Nikita Korolev <[email protected]>
- Loading branch information
1 parent
4a3574f
commit 828836c
Showing
190 changed files
with
38,081 additions
and
243 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
130 changes: 130 additions & 0 deletions
130
images/virt-artifact/patches/011-virt-api-authentication.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,130 @@ | ||
| diff --git a/pkg/controller/virtinformers.go b/pkg/controller/virtinformers.go | ||
| index 5cbb8197f..82f6f9238 100644 | ||
| --- a/pkg/controller/virtinformers.go | ||
| +++ b/pkg/controller/virtinformers.go | ||
| @@ -300,6 +300,8 @@ type KubeInformerFactory interface { | ||
| ResourceQuota() cache.SharedIndexInformer | ||
|
|
||
| K8SInformerFactory() informers.SharedInformerFactory | ||
| + | ||
| + VirtualizationCA() cache.SharedIndexInformer | ||
| } | ||
|
|
||
| type kubeInformerFactory struct { | ||
| @@ -1293,3 +1295,12 @@ func VolumeSnapshotClassInformer(clientSet kubecli.KubevirtClient, resyncPeriod | ||
| lw := cache.NewListWatchFromClient(restClient, "volumesnapshotclasses", k8sv1.NamespaceAll, fields.Everything()) | ||
| return cache.NewSharedIndexInformer(lw, &vsv1.VolumeSnapshotClass{}, resyncPeriod, cache.Indexers{}) | ||
| } | ||
| + | ||
| +func (f *kubeInformerFactory) VirtualizationCA() cache.SharedIndexInformer { | ||
| + return f.getInformer("extensionsVirtualizationCAConfigMapInformer", func() cache.SharedIndexInformer { | ||
| + restClient := f.clientSet.CoreV1().RESTClient() | ||
| + fieldSelector := fields.OneTermEqualSelector("metadata.name", "virtualization-ca") | ||
| + lw := cache.NewListWatchFromClient(restClient, "configmaps", f.kubevirtNamespace, fieldSelector) | ||
| + return cache.NewSharedIndexInformer(lw, &k8sv1.ConfigMap{}, f.defaultResync, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}) | ||
| + }) | ||
| +} | ||
| diff --git a/pkg/util/tls/tls.go b/pkg/util/tls/tls.go | ||
| index e9e140548..e2a349012 100644 | ||
| --- a/pkg/util/tls/tls.go | ||
| +++ b/pkg/util/tls/tls.go | ||
| @@ -132,6 +132,55 @@ func SetupTLSWithCertManager(caManager ClientCAManager, certManager certificate. | ||
| return tlsConfig | ||
| } | ||
|
|
||
| +func SetupTLSWithVirtualizationCAManager(caManager, virtualizationCAManager ClientCAManager, certManager certificate.Manager, clientAuth tls.ClientAuthType, clusterConfig *virtconfig.ClusterConfig) *tls.Config { | ||
| + tlsConfig := &tls.Config{ | ||
| + GetCertificate: func(info *tls.ClientHelloInfo) (certificate *tls.Certificate, err error) { | ||
| + cert := certManager.Current() | ||
| + if cert == nil { | ||
| + return nil, fmt.Errorf(noSrvCertMessage) | ||
| + } | ||
| + return cert, nil | ||
| + }, | ||
| + GetConfigForClient: func(hi *tls.ClientHelloInfo) (*tls.Config, error) { | ||
| + cert := certManager.Current() | ||
| + if cert == nil { | ||
| + return nil, fmt.Errorf(noSrvCertMessage) | ||
| + } | ||
| + | ||
| + clientCAPool, err := caManager.GetCurrent() | ||
| + if err != nil { | ||
| + log.Log.Reason(err).Error("Failed to get requestheader client CA") | ||
| + return nil, err | ||
| + } | ||
| + | ||
| + virtualizationCA, err := virtualizationCAManager.GetCurrentRaw() | ||
| + if err != nil { | ||
| + log.Log.Reason(err).Error("Failed to get CA from config-map virtualization-ca") | ||
| + return nil, err | ||
| + } | ||
| + | ||
| + clientCAPool.AppendCertsFromPEM(virtualizationCA) | ||
| + | ||
| + kv := clusterConfig.GetConfigFromKubeVirtCR() | ||
| + tlsConfig := getTLSConfiguration(kv) | ||
| + ciphers := CipherSuiteIds(tlsConfig.Ciphers) | ||
| + minTLSVersion := TLSVersion(tlsConfig.MinTLSVersion) | ||
| + config := &tls.Config{ | ||
| + CipherSuites: ciphers, | ||
| + MinVersion: minTLSVersion, | ||
| + Certificates: []tls.Certificate{*cert}, | ||
| + ClientCAs: clientCAPool, | ||
| + ClientAuth: clientAuth, | ||
| + } | ||
| + | ||
| + config.BuildNameToCertificate() | ||
| + return config, nil | ||
| + }, | ||
| + } | ||
| + tlsConfig.BuildNameToCertificate() | ||
| + return tlsConfig | ||
| +} | ||
| + | ||
| func SetupTLSForVirtHandlerServer(caManager ClientCAManager, certManager certificate.Manager, externallyManaged bool, clusterConfig *virtconfig.ClusterConfig) *tls.Config { | ||
| // #nosec cause: InsecureSkipVerify: true | ||
| // resolution: Neither the client nor the server should validate anything itself, `VerifyPeerCertificate` is still executed | ||
| diff --git a/pkg/virt-api/api.go b/pkg/virt-api/api.go | ||
| index 120f2d68f..4b82edd13 100644 | ||
| --- a/pkg/virt-api/api.go | ||
| +++ b/pkg/virt-api/api.go | ||
| @@ -884,7 +884,7 @@ func (app *virtAPIApp) registerMutatingWebhook(informers *webhooks.Informers) { | ||
| }) | ||
| } | ||
|
|
||
| -func (app *virtAPIApp) setupTLS(k8sCAManager kvtls.ClientCAManager, kubevirtCAManager kvtls.ClientCAManager) { | ||
| +func (app *virtAPIApp) setupTLS(k8sCAManager, kubevirtCAManager, virtualizationCAManager kvtls.ClientCAManager) { | ||
|
|
||
| // A VerifyClientCertIfGiven request means we're not guaranteed | ||
| // a client has been authenticated unless they provide a peer | ||
| @@ -901,7 +901,7 @@ func (app *virtAPIApp) setupTLS(k8sCAManager kvtls.ClientCAManager, kubevirtCAMa | ||
| // response is given. That status request won't send a peer cert regardless | ||
| // if the TLS handshake requests it. As a result, the TLS handshake fails | ||
| // and our aggregated endpoint never becomes available. | ||
| - app.tlsConfig = kvtls.SetupTLSWithCertManager(k8sCAManager, app.certmanager, tls.VerifyClientCertIfGiven, app.clusterConfig) | ||
| + app.tlsConfig = kvtls.SetupTLSWithVirtualizationCAManager(k8sCAManager, virtualizationCAManager, app.certmanager, tls.VerifyClientCertIfGiven, app.clusterConfig) | ||
| app.handlerTLSConfiguration = kvtls.SetupTLSForVirtHandlerClients(kubevirtCAManager, app.handlerCertManager, app.externallyManaged) | ||
| } | ||
|
|
||
| @@ -919,10 +919,12 @@ func (app *virtAPIApp) startTLS(informerFactory controller.KubeInformerFactory) | ||
|
|
||
| authConfigMapInformer := informerFactory.ApiAuthConfigMap() | ||
| kubevirtCAConfigInformer := informerFactory.KubeVirtCAConfigMap() | ||
| + virtualizationCAConfigInformer := informerFactory.VirtualizationCA() | ||
|
|
||
| k8sCAManager := kvtls.NewKubernetesClientCAManager(authConfigMapInformer.GetStore()) | ||
| kubevirtCAInformer := kvtls.NewCAManager(kubevirtCAConfigInformer.GetStore(), app.namespace, app.caConfigMapName) | ||
| - app.setupTLS(k8sCAManager, kubevirtCAInformer) | ||
| + virtualizationCAInformer := kvtls.NewCAManager(virtualizationCAConfigInformer.GetStore(), app.namespace, "virtualization-ca") | ||
| + app.setupTLS(k8sCAManager, kubevirtCAInformer, virtualizationCAInformer) | ||
|
|
||
| app.Compose() | ||
|
|
||
| @@ -1007,6 +1009,7 @@ func (app *virtAPIApp) Run() { | ||
|
|
||
| kubeInformerFactory.ApiAuthConfigMap() | ||
| kubeInformerFactory.KubeVirtCAConfigMap() | ||
| + kubeInformerFactory.VirtualizationCA() | ||
| crdInformer := kubeInformerFactory.CRD() | ||
| vmiPresetInformer := kubeInformerFactory.VirtualMachinePreset() | ||
| vmRestoreInformer := kubeInformerFactory.VirtualMachineRestore() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| --- | ||
| image: {{ $.ImageName }} | ||
| fromImage: base-ubuntu-jammy | ||
| import: | ||
| - image: virtualization-artifact | ||
| add: /usr/local/go/src/virtualization-controller/virtualization-api | ||
| to: /app/virtualization-api | ||
| after: install | ||
| docker: | ||
| USER: "65532:65532" | ||
| WORKDIR: "/app" | ||
| ENTRYPOINT: ["/app/virtualization-api"] |
Oops, something went wrong.