From c58ba70b8687c1f5ab4a30f1528a6d7b29880cff Mon Sep 17 00:00:00 2001 From: changzhen Date: Sun, 13 Nov 2022 12:29:26 +0800 Subject: [PATCH] ignore resource that do not match with policy before apply policy Signed-off-by: changzhen --- pkg/detector/policy.go | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/pkg/detector/policy.go b/pkg/detector/policy.go index a3e887fac..bcb865f13 100644 --- a/pkg/detector/policy.go +++ b/pkg/detector/policy.go @@ -93,6 +93,17 @@ func (d *ResourceDetector) getAndApplyPolicy(object *unstructured.Unstructured, return err } + // Some resources are available in more than one group in the same kubernetes version. + // Therefore, the following scenarios occurs: + // In v1.21 kubernetes cluster, Ingress are available in both networking.k8s.io and extensions groups. + // When user creates an Ingress(networking.k8s.io/v1) and specifies a PropagationPolicy to propagate it + // to the member clusters, the detector will listen two resource creation events: + // Ingress(networking.k8s.io/v1) and Ingress(extensions/v1beta1). In order to prevent + // Ingress(extensions/v1beta1) from being propagated, we need to ignore it. + if !util.ResourceMatchSelectors(object, matchedPropagationPolicy.Spec.ResourceSelectors...) { + return nil + } + // return err when dependents not present, that we can retry at next reconcile. if present, err := helper.IsDependentOverridesPresent(d.Client, matchedPropagationPolicy); err != nil || !present { klog.Infof("Waiting for dependent overrides present for policy(%s/%s)", policyNamespace, policyName) @@ -115,6 +126,17 @@ func (d *ResourceDetector) getAndApplyClusterPolicy(object *unstructured.Unstruc return err } + // Some resources are available in more than one group in the same kubernetes version. + // Therefore, the following scenarios occurs: + // In v1.21 kubernetes cluster, Ingress are available in both networking.k8s.io and extensions groups. + // When user creates an Ingress(networking.k8s.io/v1) and specifies a ClusterPropagationPolicy to + // propagate it to the member clusters, the detector will listen two resource creation events: + // Ingress(networking.k8s.io/v1) and Ingress(extensions/v1beta1). In order to prevent + // Ingress(extensions/v1beta1) from being propagated, we need to ignore it. + if !util.ResourceMatchSelectors(object, matchedClusterPropagationPolicy.Spec.ResourceSelectors...) { + return nil + } + // return err when dependents not present, that we can retry at next reconcile. if present, err := helper.IsDependentClusterOverridesPresent(d.Client, matchedClusterPropagationPolicy); err != nil || !present { klog.Infof("Waiting for dependent overrides present for policy(%s)", policyName)