linkerd
/
linkerd2
mirror of https://github.com/linkerd/linkerd2.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Proxy injector must preserve the original pod template labels and annotations (#1765) 

* Ensure that the proxy injector mutating webhook preserves the original labels
and annotations

The deployment's selector must also match the pod template labels in
newer version of Kubernetes.

This resolves issue #1756.

* Add the Linkerd labels to the deployment metadata during auto proxy
injection

* Remove selector match labels JSON patch from proxy injector

This isn't needed to resolve the selector label mismatch errors.

Signed-off-by: ihcsim <ihcsim@gmail.com>
This commit is contained in:
Ivan Sim 2018-10-16 15:30:45 -07:00 committed by Kevin Lingerfelt
parent e9874b9c3e
commit 1100c4fa8c
5 changed files with 52 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
controller/proxy-injector/fake/data/inject-enabled-response.yaml
View File

@ -68,6 +68,6 @@ request:
username: minikube-user username: minikube-user
response: response:
allowed: true allowed: true
patch: W3sib3AiOiJhZGQiLCJwYXRoIjoiL3NwZWMvdGVtcGxhdGUvc3BlYy9jb250YWluZXJzLzAiLCJ2YWx1ZSI6eyJuYW1lIjoibGlua2VyZC1wcm94eSIsImltYWdlIjoiZ2NyLmlvL2xpbmtlcmQtaW8vcHJveHk6djE4LjguNCIsInBvcnRzIjpbeyJuYW1lIjoibGlua2VyZC1wcm94eSIsImNvbnRhaW5lclBvcnQiOjQxNDN9LHsibmFtZSI6ImxpbmtlcmQtbWV0cmljcyIsImNvbnRhaW5lclBvcnQiOjQxOTF9XSwiZW52IjpbeyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfTE9HIiwidmFsdWUiOiJ3YXJuLGxpbmtlcmQyX3Byb3h5PWluZm8ifSx7Im5hbWUiOiJMSU5LRVJEMl9QUk9YWV9CSU5EX1RJTUVPVVQiLCJ2YWx1ZSI6IjEwcyJ9LHsibmFtZSI6IkxJTktFUkQyX1BST1hZX0NPTlRST0xfVVJMIiwidmFsdWUiOiJ0Y3A6Ly9wcm94eS1hcGkubGlua2VyZC5zdmMuY2x1c3Rlci5sb2NhbDo4MDg2In0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfQ09OVFJPTF9MSVNURU5FUiIsInZhbHVlIjoidGNwOi8vMC4wLjAuMDo0MTkwIn0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfTUVUUklDU19MSVNURU5FUiIsInZhbHVlIjoidGNwOi8vMC4wLjAuMDo0MTkxIn0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfT1VUQk9VTkRfTElTVEVORVIiLCJ2YWx1ZSI6InRjcDovLzEyNy4wLjAuMTo0MTQwIn0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfSU5CT1VORF9MSVNURU5FUiIsInZhbHVlIjoidGNwOi8vMC4wLjAuMDo0MTQzIn0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfUE9EX05BTUVTUEFDRSIsInZhbHVlRnJvbSI6eyJmaWVsZFJlZiI6eyJmaWVsZFBhdGgiOiJtZXRhZGF0YS5uYW1lc3BhY2UifX19LHsibmFtZSI6IkxJTktFUkQyX1BST1hZX1RMU19UUlVTVF9BTkNIT1JTIiwidmFsdWUiOiIvdmFyL2xpbmtlcmQtaW8vdHJ1c3QtYW5jaG9ycy90cnVzdC1hbmNob3JzLnBlbSJ9LHsibmFtZSI6IkxJTktFUkQyX1BST1hZX1RMU19DRVJUIiwidmFsdWUiOiIvdmFyL2xpbmtlcmQtaW8vaWRlbnRpdHkvY2VydGlmaWNhdGUuY3J0In0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfVExTX1BSSVZBVEVfS0VZIiwidmFsdWUiOiIvdmFyL2xpbmtlcmQtaW8vaWRlbnRpdHkvcHJpdmF0ZS1rZXkucDgifSx7Im5hbWUiOiJMSU5LRVJEMl9QUk9YWV9UTFNfUE9EX0lERU5USVRZIiwidmFsdWUiOiJuZ2lueC5kZXBsb3ltZW50Lmt1YmUtcHVibGljLmxpbmtlcmQtbWFuYWdlZC5saW5rZXJkLnN2Yy5jbHVzdGVyLmxvY2FsIn0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfQ09OVFJPTExFUl9OQU1FU1BBQ0UiLCJ2YWx1ZSI6ImxpbmtlcmQifSx7Im5hbWUiOiJMSU5LRVJEMl9QUk9YWV9UTFNfQ09OVFJPTExFUl9JREVOVElUWSIsInZhbHVlIjoiY29udHJvbGxlci5kZXBsb3ltZW50LmxpbmtlcmQubGlua2VyZC1tYW5hZ2VkLmxpbmtlcmQuc3ZjLmNsdXN0ZXIubG9jYWwifV0sInJlc291cmNlcyI6e30sInZvbHVtZU1vdW50cyI6W3sibmFtZSI6ImxpbmtlcmQtdHJ1c3QtYW5jaG9ycyIsInJlYWRPbmx5Ijp0cnVlLCJtb3VudFBhdGgiOiIvdmFyL2xpbmtlcmQtaW8vdHJ1c3QtYW5jaG9ycyJ9LHsibmFtZSI6ImxpbmtlcmQtc2VjcmV0cyIsInJlYWRPbmx5Ijp0cnVlLCJtb3VudFBhdGgiOiIvdmFyL2xpbmtlcmQtaW8vaWRlbnRpdHkifV0sImxpdmVuZXNzUHJvYmUiOnsiaHR0cEdldCI6eyJwYXRoIjoiL21ldHJpY3MiLCJwb3J0Ijo0MTkxfSwiaW5pdGlhbERlbGF5U2Vjb25kcyI6MTB9LCJyZWFkaW5lc3NQcm9iZSI6eyJodHRwR2V0Ijp7InBhdGgiOiIvbWV0cmljcyIsInBvcnQiOjQxOTF9LCJpbml0aWFsRGVsYXlTZWNvbmRzIjoxMH0sInRlcm1pbmF0aW9uTWVzc2FnZVBvbGljeSI6IkZhbGxiYWNrVG9Mb2dzT25FcnJvciIsImltYWdlUHVsbFBvbGljeSI6IklmTm90UHJlc2VudCIsInNlY3VyaXR5Q29udGV4dCI6eyJydW5Bc1VzZXIiOjIxMDJ9fX0seyJvcCI6ImFkZCIsInBhdGgiOiIvc3BlYy90ZW1wbGF0ZS9zcGVjL2luaXRDb250YWluZXJzIiwidmFsdWUiOltdfSx7Im9wIjoiYWRkIiwicGF0aCI6Ii9zcGVjL3RlbXBsYXRlL3NwZWMvaW5pdENvbnRhaW5lcnMvMCIsInZhbHVlIjp7Im5hbWUiOiJsaW5rZXJkLWluaXQiLCJpbWFnZSI6Imdjci5pby9saW5rZXJkLWlvL3Byb3h5LWluaXQ6djE4LjguNCIsImFyZ3MiOlsiLS1pbmNvbWluZy1wcm94eS1wb3J0IiwiNDE0MyIsIi0tb3V0Z29pbmctcHJveHktcG9ydCIsIjQxNDAiLCItLXByb3h5LXVpZCIsIjIxMDIiLCItLWluYm91bmQtcG9ydHMtdG8taWdub3JlIiwiNDE5MCw0MTkxIl0sInJlc291cmNlcyI6e30sInRlcm1pbmF0aW9uTWVzc2FnZVBvbGljeSI6IkZhbGxiYWNrVG9Mb2dzT25FcnJvciIsImltYWdlUHVsbFBvbGljeSI6IklmTm90UHJlc2VudCIsInNlY3VyaXR5Q29udGV4dCI6eyJjYXBhYmlsaXRpZXMiOnsiYWRkIjpbIk5FVF9BRE1JTiJdfSwicHJpdmlsZWdlZCI6ZmFsc2V9fX0seyJvcCI6ImFkZCIsInBhdGgiOiIvc3BlYy90ZW1wbGF0ZS9zcGVjL3ZvbHVtZXMiLCJ2YWx1ZSI6W119LHsib3AiOiJhZGQiLCJwYXRoIjoiL3NwZWMvdGVtcGxhdGUvc3BlYy92b2x1bWVzLzAiLCJ2YWx1ZSI6eyJuYW1lIjoibGlua2VyZC10cnVzdC1hbmNob3JzIiwiY29uZmlnTWFwIjp7Im5hbWUiOiJsaW5rZXJkLWNhLWJ1bmRsZSIsIm9wdGlvbmFsIjp0cnVlfX19LHsib3AiOiJhZGQiLCJwYXRoIjoiL3NwZWMvdGVtcGxhdGUvc3BlYy92b2x1bWVzLzAiLCJ2YWx1ZSI6eyJuYW1lIjoibGlua2VyZC1zZWNyZXRzIiwic2VjcmV0Ijp7InNlY3JldE5hbWUiOiJuZ2lueC1kZXBsb3ltZW50LXRscy1saW5rZXJkLWlvIiwib3B0aW9uYWwiOnRydWV9fX0seyJvcCI6ImFkZCIsInBhdGgiOiIvc3BlYy90ZW1wbGF0ZS9tZXRhZGF0YS9sYWJlbHMiLCJ2YWx1ZSI6eyJsaW5rZXJkLmlvL2NvbnRyb2wtcGxhbmUtbnMiOiJsaW5rZXJkIiwibGlua2VyZC5pby9wcm94eS1kZXBsb3ltZW50IjoibmdpbngifX0seyJvcCI6ImFkZCIsInBhdGgiOiIvc3BlYy90ZW1wbGF0ZS9tZXRhZGF0YS9hbm5vdGF0aW9ucyIsInZhbHVlIjp7ImxpbmtlcmQuaW8vY3JlYXRlZC1ieSI6ImxpbmtlcmQvcHJveHktaW5qZWN0b3IgdjE4LjguNCIsImxpbmtlcmQuaW8vcHJveHktdmVyc2lvbiI6InYxOC44LjQifX1d patch: W3sib3AiOiJhZGQiLCJwYXRoIjoiL3NwZWMvdGVtcGxhdGUvc3BlYy9jb250YWluZXJzLzAiLCJ2YWx1ZSI6eyJuYW1lIjoibGlua2VyZC1wcm94eSIsImltYWdlIjoiZ2NyLmlvL2xpbmtlcmQtaW8vcHJveHk6djE4LjguNCIsInBvcnRzIjpbeyJuYW1lIjoibGlua2VyZC1wcm94eSIsImNvbnRhaW5lclBvcnQiOjQxNDN9LHsibmFtZSI6ImxpbmtlcmQtbWV0cmljcyIsImNvbnRhaW5lclBvcnQiOjQxOTF9XSwiZW52IjpbeyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfTE9HIiwidmFsdWUiOiJ3YXJuLGxpbmtlcmQyX3Byb3h5PWluZm8ifSx7Im5hbWUiOiJMSU5LRVJEMl9QUk9YWV9CSU5EX1RJTUVPVVQiLCJ2YWx1ZSI6IjEwcyJ9LHsibmFtZSI6IkxJTktFUkQyX1BST1hZX0NPTlRST0xfVVJMIiwidmFsdWUiOiJ0Y3A6Ly9wcm94eS1hcGkubGlua2VyZC5zdmMuY2x1c3Rlci5sb2NhbDo4MDg2In0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfQ09OVFJPTF9MSVNURU5FUiIsInZhbHVlIjoidGNwOi8vMC4wLjAuMDo0MTkwIn0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfTUVUUklDU19MSVNURU5FUiIsInZhbHVlIjoidGNwOi8vMC4wLjAuMDo0MTkxIn0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfT1VUQk9VTkRfTElTVEVORVIiLCJ2YWx1ZSI6InRjcDovLzEyNy4wLjAuMTo0MTQwIn0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfSU5CT1VORF9MSVNURU5FUiIsInZhbHVlIjoidGNwOi8vMC4wLjAuMDo0MTQzIn0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfUE9EX05BTUVTUEFDRSIsInZhbHVlRnJvbSI6eyJmaWVsZFJlZiI6eyJmaWVsZFBhdGgiOiJtZXRhZGF0YS5uYW1lc3BhY2UifX19LHsibmFtZSI6IkxJTktFUkQyX1BST1hZX1RMU19UUlVTVF9BTkNIT1JTIiwidmFsdWUiOiIvdmFyL2xpbmtlcmQtaW8vdHJ1c3QtYW5jaG9ycy90cnVzdC1hbmNob3JzLnBlbSJ9LHsibmFtZSI6IkxJTktFUkQyX1BST1hZX1RMU19DRVJUIiwidmFsdWUiOiIvdmFyL2xpbmtlcmQtaW8vaWRlbnRpdHkvY2VydGlmaWNhdGUuY3J0In0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfVExTX1BSSVZBVEVfS0VZIiwidmFsdWUiOiIvdmFyL2xpbmtlcmQtaW8vaWRlbnRpdHkvcHJpdmF0ZS1rZXkucDgifSx7Im5hbWUiOiJMSU5LRVJEMl9QUk9YWV9UTFNfUE9EX0lERU5USVRZIiwidmFsdWUiOiJuZ2lueC5kZXBsb3ltZW50Lmt1YmUtcHVibGljLmxpbmtlcmQtbWFuYWdlZC5saW5rZXJkLnN2Yy5jbHVzdGVyLmxvY2FsIn0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfQ09OVFJPTExFUl9OQU1FU1BBQ0UiLCJ2YWx1ZSI6ImxpbmtlcmQifSx7Im5hbWUiOiJMSU5LRVJEMl9QUk9YWV9UTFNfQ09OVFJPTExFUl9JREVOVElUWSIsInZhbHVlIjoiY29udHJvbGxlci5kZXBsb3ltZW50LmxpbmtlcmQubGlua2VyZC1tYW5hZ2VkLmxpbmtlcmQuc3ZjLmNsdXN0ZXIubG9jYWwifV0sInJlc291cmNlcyI6e30sInZvbHVtZU1vdW50cyI6W3sibmFtZSI6ImxpbmtlcmQtdHJ1c3QtYW5jaG9ycyIsInJlYWRPbmx5Ijp0cnVlLCJtb3VudFBhdGgiOiIvdmFyL2xpbmtlcmQtaW8vdHJ1c3QtYW5jaG9ycyJ9LHsibmFtZSI6ImxpbmtlcmQtc2VjcmV0cyIsInJlYWRPbmx5Ijp0cnVlLCJtb3VudFBhdGgiOiIvdmFyL2xpbmtlcmQtaW8vaWRlbnRpdHkifV0sImxpdmVuZXNzUHJvYmUiOnsiaHR0cEdldCI6eyJwYXRoIjoiL21ldHJpY3MiLCJwb3J0Ijo0MTkxfSwiaW5pdGlhbERlbGF5U2Vjb25kcyI6MTB9LCJyZWFkaW5lc3NQcm9iZSI6eyJodHRwR2V0Ijp7InBhdGgiOiIvbWV0cmljcyIsInBvcnQiOjQxOTF9LCJpbml0aWFsRGVsYXlTZWNvbmRzIjoxMH0sInRlcm1pbmF0aW9uTWVzc2FnZVBvbGljeSI6IkZhbGxiYWNrVG9Mb2dzT25FcnJvciIsImltYWdlUHVsbFBvbGljeSI6IklmTm90UHJlc2VudCIsInNlY3VyaXR5Q29udGV4dCI6eyJydW5Bc1VzZXIiOjIxMDJ9fX0seyJvcCI6ImFkZCIsInBhdGgiOiIvc3BlYy90ZW1wbGF0ZS9zcGVjL2luaXRDb250YWluZXJzIiwidmFsdWUiOltdfSx7Im9wIjoiYWRkIiwicGF0aCI6Ii9zcGVjL3RlbXBsYXRlL3NwZWMvaW5pdENvbnRhaW5lcnMvMCIsInZhbHVlIjp7Im5hbWUiOiJsaW5rZXJkLWluaXQiLCJpbWFnZSI6Imdjci5pby9saW5rZXJkLWlvL3Byb3h5LWluaXQ6djE4LjguNCIsImFyZ3MiOlsiLS1pbmNvbWluZy1wcm94eS1wb3J0IiwiNDE0MyIsIi0tb3V0Z29pbmctcHJveHktcG9ydCIsIjQxNDAiLCItLXByb3h5LXVpZCIsIjIxMDIiLCItLWluYm91bmQtcG9ydHMtdG8taWdub3JlIiwiNDE5MCw0MTkxIl0sInJlc291cmNlcyI6e30sInRlcm1pbmF0aW9uTWVzc2FnZVBvbGljeSI6IkZhbGxiYWNrVG9Mb2dzT25FcnJvciIsImltYWdlUHVsbFBvbGljeSI6IklmTm90UHJlc2VudCIsInNlY3VyaXR5Q29udGV4dCI6eyJjYXBhYmlsaXRpZXMiOnsiYWRkIjpbIk5FVF9BRE1JTiJdfSwicHJpdmlsZWdlZCI6ZmFsc2V9fX0seyJvcCI6ImFkZCIsInBhdGgiOiIvc3BlYy90ZW1wbGF0ZS9zcGVjL3ZvbHVtZXMiLCJ2YWx1ZSI6W119LHsib3AiOiJhZGQiLCJwYXRoIjoiL3NwZWMvdGVtcGxhdGUvc3BlYy92b2x1bWVzLzAiLCJ2YWx1ZSI6eyJuYW1lIjoibGlua2VyZC10cnVzdC1hbmNob3JzIiwiY29uZmlnTWFwIjp7Im5hbWUiOiJsaW5rZXJkLWNhLWJ1bmRsZSIsIm9wdGlvbmFsIjp0cnVlfX19LHsib3AiOiJhZGQiLCJwYXRoIjoiL3NwZWMvdGVtcGxhdGUvc3BlYy92b2x1bWVzLzAiLCJ2YWx1ZSI6eyJuYW1lIjoibGlua2VyZC1zZWNyZXRzIiwic2VjcmV0Ijp7InNlY3JldE5hbWUiOiJuZ2lueC1kZXBsb3ltZW50LXRscy1saW5rZXJkLWlvIiwib3B0aW9uYWwiOnRydWV9fX0seyJvcCI6ImFkZCIsInBhdGgiOiIvc3BlYy90ZW1wbGF0ZS9tZXRhZGF0YS9sYWJlbHMiLCJ2YWx1ZSI6eyJhcHAiOiJuZ2lueCIsImxpbmtlcmQuaW8vYXV0by1pbmplY3QiOiJlbmFibGVkIiwibGlua2VyZC5pby9jb250cm9sLXBsYW5lLW5zIjoibGlua2VyZCIsImxpbmtlcmQuaW8vcHJveHktZGVwbG95bWVudCI6Im5naW54In19LHsib3AiOiJhZGQiLCJwYXRoIjoiL21ldGFkYXRhL2xhYmVscyIsInZhbHVlIjp7ImFwcCI6Im5naW54IiwibGlua2VyZC5pby9jb250cm9sLXBsYW5lLW5zIjoibGlua2VyZCIsImxpbmtlcmQuaW8vcHJveHktZGVwbG95bWVudCI6Im5naW54In19LHsib3AiOiJhZGQiLCJwYXRoIjoiL3NwZWMvdGVtcGxhdGUvbWV0YWRhdGEvYW5ub3RhdGlvbnMiLCJ2YWx1ZSI6eyJjcmVhdGVkLWJ5IjoiaXNpbSIsImxpbmtlcmQuaW8vY3JlYXRlZC1ieSI6ImxpbmtlcmQvcHJveHktaW5qZWN0b3IgdjE4LjguNCIsImxpbmtlcmQuaW8vcHJveHktdmVyc2lvbiI6InYxOC44LjQifX1d
patchType: JSONPatch patchType: JSONPatch
uid: 3c3c45ff-bee9-11e8-9c41-b4d755961931 uid: 3c3c45ff-bee9-11e8-9c41-b4d755961931

4
controller/proxy-injector/fake/data/inject-no-labels-response.yaml
View File

@ -1,4 +1,4 @@
iapiVersion: admission.k8s.io/v1beta1 apiVersion: admission.k8s.io/v1beta1
kind: AdmissionReview kind: AdmissionReview
request: request:
kind: kind:
@ -65,6 +65,6 @@ request:
username: minikube-user username: minikube-user
response: response:
allowed: true allowed: true
patch: W3sib3AiOiJhZGQiLCJwYXRoIjoiL3NwZWMvdGVtcGxhdGUvc3BlYy9jb250YWluZXJzLzAiLCJ2YWx1ZSI6eyJuYW1lIjoibGlua2VyZC1wcm94eSIsImltYWdlIjoiZ2NyLmlvL2xpbmtlcmQtaW8vcHJveHk6djE4LjguNCIsInBvcnRzIjpbeyJuYW1lIjoibGlua2VyZC1wcm94eSIsImNvbnRhaW5lclBvcnQiOjQxNDN9LHsibmFtZSI6ImxpbmtlcmQtbWV0cmljcyIsImNvbnRhaW5lclBvcnQiOjQxOTF9XSwiZW52IjpbeyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfTE9HIiwidmFsdWUiOiJ3YXJuLGxpbmtlcmQyX3Byb3h5PWluZm8ifSx7Im5hbWUiOiJMSU5LRVJEMl9QUk9YWV9CSU5EX1RJTUVPVVQiLCJ2YWx1ZSI6IjEwcyJ9LHsibmFtZSI6IkxJTktFUkQyX1BST1hZX0NPTlRST0xfVVJMIiwidmFsdWUiOiJ0Y3A6Ly9wcm94eS1hcGkubGlua2VyZC5zdmMuY2x1c3Rlci5sb2NhbDo4MDg2In0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfQ09OVFJPTF9MSVNURU5FUiIsInZhbHVlIjoidGNwOi8vMC4wLjAuMDo0MTkwIn0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfTUVUUklDU19MSVNURU5FUiIsInZhbHVlIjoidGNwOi8vMC4wLjAuMDo0MTkxIn0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfT1VUQk9VTkRfTElTVEVORVIiLCJ2YWx1ZSI6InRjcDovLzEyNy4wLjAuMTo0MTQwIn0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfSU5CT1VORF9MSVNURU5FUiIsInZhbHVlIjoidGNwOi8vMC4wLjAuMDo0MTQzIn0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfUE9EX05BTUVTUEFDRSIsInZhbHVlRnJvbSI6eyJmaWVsZFJlZiI6eyJmaWVsZFBhdGgiOiJtZXRhZGF0YS5uYW1lc3BhY2UifX19LHsibmFtZSI6IkxJTktFUkQyX1BST1hZX1RMU19UUlVTVF9BTkNIT1JTIiwidmFsdWUiOiIvdmFyL2xpbmtlcmQtaW8vdHJ1c3QtYW5jaG9ycy90cnVzdC1hbmNob3JzLnBlbSJ9LHsibmFtZSI6IkxJTktFUkQyX1BST1hZX1RMU19DRVJUIiwidmFsdWUiOiIvdmFyL2xpbmtlcmQtaW8vaWRlbnRpdHkvY2VydGlmaWNhdGUuY3J0In0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfVExTX1BSSVZBVEVfS0VZIiwidmFsdWUiOiIvdmFyL2xpbmtlcmQtaW8vaWRlbnRpdHkvcHJpdmF0ZS1rZXkucDgifSx7Im5hbWUiOiJMSU5LRVJEMl9QUk9YWV9UTFNfUE9EX0lERU5USVRZIiwidmFsdWUiOiJuZ2lueC5kZXBsb3ltZW50Lmt1YmUtcHVibGljLmxpbmtlcmQtbWFuYWdlZC5saW5rZXJkLnN2Yy5jbHVzdGVyLmxvY2FsIn0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfQ09OVFJPTExFUl9OQU1FU1BBQ0UiLCJ2YWx1ZSI6ImxpbmtlcmQifSx7Im5hbWUiOiJMSU5LRVJEMl9QUk9YWV9UTFNfQ09OVFJPTExFUl9JREVOVElUWSIsInZhbHVlIjoiY29udHJvbGxlci5kZXBsb3ltZW50LmxpbmtlcmQubGlua2VyZC1tYW5hZ2VkLmxpbmtlcmQuc3ZjLmNsdXN0ZXIubG9jYWwifV0sInJlc291cmNlcyI6e30sInZvbHVtZU1vdW50cyI6W3sibmFtZSI6ImxpbmtlcmQtdHJ1c3QtYW5jaG9ycyIsInJlYWRPbmx5Ijp0cnVlLCJtb3VudFBhdGgiOiIvdmFyL2xpbmtlcmQtaW8vdHJ1c3QtYW5jaG9ycyJ9LHsibmFtZSI6ImxpbmtlcmQtc2VjcmV0cyIsInJlYWRPbmx5Ijp0cnVlLCJtb3VudFBhdGgiOiIvdmFyL2xpbmtlcmQtaW8vaWRlbnRpdHkifV0sImxpdmVuZXNzUHJvYmUiOnsiaHR0cEdldCI6eyJwYXRoIjoiL21ldHJpY3MiLCJwb3J0Ijo0MTkxfSwiaW5pdGlhbERlbGF5U2Vjb25kcyI6MTB9LCJyZWFkaW5lc3NQcm9iZSI6eyJodHRwR2V0Ijp7InBhdGgiOiIvbWV0cmljcyIsInBvcnQiOjQxOTF9LCJpbml0aWFsRGVsYXlTZWNvbmRzIjoxMH0sInRlcm1pbmF0aW9uTWVzc2FnZVBvbGljeSI6IkZhbGxiYWNrVG9Mb2dzT25FcnJvciIsImltYWdlUHVsbFBvbGljeSI6IklmTm90UHJlc2VudCIsInNlY3VyaXR5Q29udGV4dCI6eyJydW5Bc1VzZXIiOjIxMDJ9fX0seyJvcCI6ImFkZCIsInBhdGgiOiIvc3BlYy90ZW1wbGF0ZS9zcGVjL2luaXRDb250YWluZXJzIiwidmFsdWUiOltdfSx7Im9wIjoiYWRkIiwicGF0aCI6Ii9zcGVjL3RlbXBsYXRlL3NwZWMvaW5pdENvbnRhaW5lcnMvMCIsInZhbHVlIjp7Im5hbWUiOiJsaW5rZXJkLWluaXQiLCJpbWFnZSI6Imdjci5pby9saW5rZXJkLWlvL3Byb3h5LWluaXQ6djE4LjguNCIsImFyZ3MiOlsiLS1pbmNvbWluZy1wcm94eS1wb3J0IiwiNDE0MyIsIi0tb3V0Z29pbmctcHJveHktcG9ydCIsIjQxNDAiLCItLXByb3h5LXVpZCIsIjIxMDIiLCItLWluYm91bmQtcG9ydHMtdG8taWdub3JlIiwiNDE5MCw0MTkxIl0sInJlc291cmNlcyI6e30sInRlcm1pbmF0aW9uTWVzc2FnZVBvbGljeSI6IkZhbGxiYWNrVG9Mb2dzT25FcnJvciIsImltYWdlUHVsbFBvbGljeSI6IklmTm90UHJlc2VudCIsInNlY3VyaXR5Q29udGV4dCI6eyJjYXBhYmlsaXRpZXMiOnsiYWRkIjpbIk5FVF9BRE1JTiJdfSwicHJpdmlsZWdlZCI6ZmFsc2V9fX0seyJvcCI6ImFkZCIsInBhdGgiOiIvc3BlYy90ZW1wbGF0ZS9zcGVjL3ZvbHVtZXMiLCJ2YWx1ZSI6W119LHsib3AiOiJhZGQiLCJwYXRoIjoiL3NwZWMvdGVtcGxhdGUvc3BlYy92b2x1bWVzLzAiLCJ2YWx1ZSI6eyJuYW1lIjoibGlua2VyZC10cnVzdC1hbmNob3JzIiwiY29uZmlnTWFwIjp7Im5hbWUiOiJsaW5rZXJkLWNhLWJ1bmRsZSIsIm9wdGlvbmFsIjp0cnVlfX19LHsib3AiOiJhZGQiLCJwYXRoIjoiL3NwZWMvdGVtcGxhdGUvc3BlYy92b2x1bWVzLzAiLCJ2YWx1ZSI6eyJuYW1lIjoibGlua2VyZC1zZWNyZXRzIiwic2VjcmV0Ijp7InNlY3JldE5hbWUiOiJuZ2lueC1kZXBsb3ltZW50LXRscy1saW5rZXJkLWlvIiwib3B0aW9uYWwiOnRydWV9fX0seyJvcCI6ImFkZCIsInBhdGgiOiIvc3BlYy90ZW1wbGF0ZS9tZXRhZGF0YS9sYWJlbHMiLCJ2YWx1ZSI6eyJsaW5rZXJkLmlvL2NvbnRyb2wtcGxhbmUtbnMiOiJsaW5rZXJkIiwibGlua2VyZC5pby9wcm94eS1kZXBsb3ltZW50IjoibmdpbngifX0seyJvcCI6ImFkZCIsInBhdGgiOiIvc3BlYy90ZW1wbGF0ZS9tZXRhZGF0YS9hbm5vdGF0aW9ucyIsInZhbHVlIjp7ImxpbmtlcmQuaW8vY3JlYXRlZC1ieSI6ImxpbmtlcmQvcHJveHktaW5qZWN0b3IgdjE4LjguNCIsImxpbmtlcmQuaW8vcHJveHktdmVyc2lvbiI6InYxOC44LjQifX1d patch: W3sib3AiOiJhZGQiLCJwYXRoIjoiL3NwZWMvdGVtcGxhdGUvc3BlYy9jb250YWluZXJzLzAiLCJ2YWx1ZSI6eyJuYW1lIjoibGlua2VyZC1wcm94eSIsImltYWdlIjoiZ2NyLmlvL2xpbmtlcmQtaW8vcHJveHk6djE4LjguNCIsInBvcnRzIjpbeyJuYW1lIjoibGlua2VyZC1wcm94eSIsImNvbnRhaW5lclBvcnQiOjQxNDN9LHsibmFtZSI6ImxpbmtlcmQtbWV0cmljcyIsImNvbnRhaW5lclBvcnQiOjQxOTF9XSwiZW52IjpbeyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfTE9HIiwidmFsdWUiOiJ3YXJuLGxpbmtlcmQyX3Byb3h5PWluZm8ifSx7Im5hbWUiOiJMSU5LRVJEMl9QUk9YWV9CSU5EX1RJTUVPVVQiLCJ2YWx1ZSI6IjEwcyJ9LHsibmFtZSI6IkxJTktFUkQyX1BST1hZX0NPTlRST0xfVVJMIiwidmFsdWUiOiJ0Y3A6Ly9wcm94eS1hcGkubGlua2VyZC5zdmMuY2x1c3Rlci5sb2NhbDo4MDg2In0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfQ09OVFJPTF9MSVNURU5FUiIsInZhbHVlIjoidGNwOi8vMC4wLjAuMDo0MTkwIn0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfTUVUUklDU19MSVNURU5FUiIsInZhbHVlIjoidGNwOi8vMC4wLjAuMDo0MTkxIn0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfT1VUQk9VTkRfTElTVEVORVIiLCJ2YWx1ZSI6InRjcDovLzEyNy4wLjAuMTo0MTQwIn0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfSU5CT1VORF9MSVNURU5FUiIsInZhbHVlIjoidGNwOi8vMC4wLjAuMDo0MTQzIn0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfUE9EX05BTUVTUEFDRSIsInZhbHVlRnJvbSI6eyJmaWVsZFJlZiI6eyJmaWVsZFBhdGgiOiJtZXRhZGF0YS5uYW1lc3BhY2UifX19LHsibmFtZSI6IkxJTktFUkQyX1BST1hZX1RMU19UUlVTVF9BTkNIT1JTIiwidmFsdWUiOiIvdmFyL2xpbmtlcmQtaW8vdHJ1c3QtYW5jaG9ycy90cnVzdC1hbmNob3JzLnBlbSJ9LHsibmFtZSI6IkxJTktFUkQyX1BST1hZX1RMU19DRVJUIiwidmFsdWUiOiIvdmFyL2xpbmtlcmQtaW8vaWRlbnRpdHkvY2VydGlmaWNhdGUuY3J0In0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfVExTX1BSSVZBVEVfS0VZIiwidmFsdWUiOiIvdmFyL2xpbmtlcmQtaW8vaWRlbnRpdHkvcHJpdmF0ZS1rZXkucDgifSx7Im5hbWUiOiJMSU5LRVJEMl9QUk9YWV9UTFNfUE9EX0lERU5USVRZIiwidmFsdWUiOiJuZ2lueC5kZXBsb3ltZW50Lmt1YmUtcHVibGljLmxpbmtlcmQtbWFuYWdlZC5saW5rZXJkLnN2Yy5jbHVzdGVyLmxvY2FsIn0seyJuYW1lIjoiTElOS0VSRDJfUFJPWFlfQ09OVFJPTExFUl9OQU1FU1BBQ0UiLCJ2YWx1ZSI6ImxpbmtlcmQifSx7Im5hbWUiOiJMSU5LRVJEMl9QUk9YWV9UTFNfQ09OVFJPTExFUl9JREVOVElUWSIsInZhbHVlIjoiY29udHJvbGxlci5kZXBsb3ltZW50LmxpbmtlcmQubGlua2VyZC1tYW5hZ2VkLmxpbmtlcmQuc3ZjLmNsdXN0ZXIubG9jYWwifV0sInJlc291cmNlcyI6e30sInZvbHVtZU1vdW50cyI6W3sibmFtZSI6ImxpbmtlcmQtdHJ1c3QtYW5jaG9ycyIsInJlYWRPbmx5Ijp0cnVlLCJtb3VudFBhdGgiOiIvdmFyL2xpbmtlcmQtaW8vdHJ1c3QtYW5jaG9ycyJ9LHsibmFtZSI6ImxpbmtlcmQtc2VjcmV0cyIsInJlYWRPbmx5Ijp0cnVlLCJtb3VudFBhdGgiOiIvdmFyL2xpbmtlcmQtaW8vaWRlbnRpdHkifV0sImxpdmVuZXNzUHJvYmUiOnsiaHR0cEdldCI6eyJwYXRoIjoiL21ldHJpY3MiLCJwb3J0Ijo0MTkxfSwiaW5pdGlhbERlbGF5U2Vjb25kcyI6MTB9LCJyZWFkaW5lc3NQcm9iZSI6eyJodHRwR2V0Ijp7InBhdGgiOiIvbWV0cmljcyIsInBvcnQiOjQxOTF9LCJpbml0aWFsRGVsYXlTZWNvbmRzIjoxMH0sInRlcm1pbmF0aW9uTWVzc2FnZVBvbGljeSI6IkZhbGxiYWNrVG9Mb2dzT25FcnJvciIsImltYWdlUHVsbFBvbGljeSI6IklmTm90UHJlc2VudCIsInNlY3VyaXR5Q29udGV4dCI6eyJydW5Bc1VzZXIiOjIxMDJ9fX0seyJvcCI6ImFkZCIsInBhdGgiOiIvc3BlYy90ZW1wbGF0ZS9zcGVjL2luaXRDb250YWluZXJzIiwidmFsdWUiOltdfSx7Im9wIjoiYWRkIiwicGF0aCI6Ii9zcGVjL3RlbXBsYXRlL3NwZWMvaW5pdENvbnRhaW5lcnMvMCIsInZhbHVlIjp7Im5hbWUiOiJsaW5rZXJkLWluaXQiLCJpbWFnZSI6Imdjci5pby9saW5rZXJkLWlvL3Byb3h5LWluaXQ6djE4LjguNCIsImFyZ3MiOlsiLS1pbmNvbWluZy1wcm94eS1wb3J0IiwiNDE0MyIsIi0tb3V0Z29pbmctcHJveHktcG9ydCIsIjQxNDAiLCItLXByb3h5LXVpZCIsIjIxMDIiLCItLWluYm91bmQtcG9ydHMtdG8taWdub3JlIiwiNDE5MCw0MTkxIl0sInJlc291cmNlcyI6e30sInRlcm1pbmF0aW9uTWVzc2FnZVBvbGljeSI6IkZhbGxiYWNrVG9Mb2dzT25FcnJvciIsImltYWdlUHVsbFBvbGljeSI6IklmTm90UHJlc2VudCIsInNlY3VyaXR5Q29udGV4dCI6eyJjYXBhYmlsaXRpZXMiOnsiYWRkIjpbIk5FVF9BRE1JTiJdfSwicHJpdmlsZWdlZCI6ZmFsc2V9fX0seyJvcCI6ImFkZCIsInBhdGgiOiIvc3BlYy90ZW1wbGF0ZS9zcGVjL3ZvbHVtZXMiLCJ2YWx1ZSI6W119LHsib3AiOiJhZGQiLCJwYXRoIjoiL3NwZWMvdGVtcGxhdGUvc3BlYy92b2x1bWVzLzAiLCJ2YWx1ZSI6eyJuYW1lIjoibGlua2VyZC10cnVzdC1hbmNob3JzIiwiY29uZmlnTWFwIjp7Im5hbWUiOiJsaW5rZXJkLWNhLWJ1bmRsZSIsIm9wdGlvbmFsIjp0cnVlfX19LHsib3AiOiJhZGQiLCJwYXRoIjoiL3NwZWMvdGVtcGxhdGUvc3BlYy92b2x1bWVzLzAiLCJ2YWx1ZSI6eyJuYW1lIjoibGlua2VyZC1zZWNyZXRzIiwic2VjcmV0Ijp7InNlY3JldE5hbWUiOiJuZ2lueC1kZXBsb3ltZW50LXRscy1saW5rZXJkLWlvIiwib3B0aW9uYWwiOnRydWV9fX0seyJvcCI6ImFkZCIsInBhdGgiOiIvc3BlYy90ZW1wbGF0ZS9tZXRhZGF0YS9sYWJlbHMiLCJ2YWx1ZSI6eyJhcHAiOiJuZ2lueCIsImxpbmtlcmQuaW8vY29udHJvbC1wbGFuZS1ucyI6ImxpbmtlcmQiLCJsaW5rZXJkLmlvL3Byb3h5LWRlcGxveW1lbnQiOiJuZ2lueCJ9fSx7Im9wIjoiYWRkIiwicGF0aCI6Ii9tZXRhZGF0YS9sYWJlbHMiLCJ2YWx1ZSI6eyJsaW5rZXJkLmlvL2NvbnRyb2wtcGxhbmUtbnMiOiJsaW5rZXJkIiwibGlua2VyZC5pby9wcm94eS1kZXBsb3ltZW50IjoibmdpbngifX0seyJvcCI6ImFkZCIsInBhdGgiOiIvc3BlYy90ZW1wbGF0ZS9tZXRhZGF0YS9hbm5vdGF0aW9ucyIsInZhbHVlIjp7ImNyZWF0ZWQtYnkiOiJpc2ltIiwibGlua2VyZC5pby9jcmVhdGVkLWJ5IjoibGlua2VyZC9wcm94eS1pbmplY3RvciB2MTguOC40IiwibGlua2VyZC5pby9wcm94eS12ZXJzaW9uIjoidjE4LjguNCJ9fV0=
patchType: JSONPatch patchType: JSONPatch
uid: 3c3c45ff-bee9-11e8-9c41-b4d755961931 uid: 3c3c45ff-bee9-11e8-9c41-b4d755961931

21
controller/proxy-injector/patch.go
View File

@ -12,8 +12,9 @@ const (
patchPathInitContainer = "/spec/template/spec/initContainers/%d" patchPathInitContainer = "/spec/template/spec/initContainers/%d"
patchPathVolumeRoot = "/spec/template/spec/volumes" patchPathVolumeRoot = "/spec/template/spec/volumes"
patchPathVolume = "/spec/template/spec/volumes/0" patchPathVolume = "/spec/template/spec/volumes/0"
patchPathPodLabel = "/spec/template/metadata/labels" patchPathDeploymentLabels = "/metadata/labels"
patchPathPodAnnotation = "/spec/template/metadata/annotations" patchPathPodLabels = "/spec/template/metadata/labels"
patchPathPodAnnotations = "/spec/template/metadata/annotations"
) )
// Patch represents a RFC 6902 patch document. // Patch represents a RFC 6902 patch document.
@ -68,22 +69,30 @@ func (p *Patch) addVolume(volume *corev1.Volume) {
}) })
} }
func (p *Patch) addPodLabel(label map[string]string) { func (p *Patch) addPodLabels(label map[string]string) {
p.patchOps = append(p.patchOps, &patchOp{ p.patchOps = append(p.patchOps, &patchOp{
Op: "add", Op: "add",
Path: patchPathPodLabel, Path: patchPathPodLabels,
Value: label, Value: label,
}) })
} }
func (p *Patch) addPodAnnotation(annotation map[string]string) { func (p *Patch) addPodAnnotations(annotation map[string]string) {
p.patchOps = append(p.patchOps, &patchOp{ p.patchOps = append(p.patchOps, &patchOp{
Op: "add", Op: "add",
Path: patchPathPodAnnotation, Path: patchPathPodAnnotations,
Value: annotation, Value: annotation,
}) })
} }
func (p *Patch) addDeploymentLabels(label map[string]string) {
p.patchOps = append(p.patchOps, &patchOp{
Op: "add",
Path: patchPathDeploymentLabels,
Value: label,
})
}
// patchOp represents a RFC 6902 patch operation. // patchOp represents a RFC 6902 patch operation.
type patchOp struct { type patchOp struct {
Op string `json:"op"` Op string `json:"op"`

16
controller/proxy-injector/patch_test.go
View File

@ -46,11 +46,15 @@ func TestPatch(t *testing.T) {
actual.addVolumeRoot() actual.addVolumeRoot()
actual.addVolume(trustAnchors) actual.addVolume(trustAnchors)
actual.addVolume(secrets) actual.addVolume(secrets)
actual.addPodLabel(map[string]string{ actual.addPodLabels(map[string]string{
k8sPkg.ControllerNSLabel: controllerNamespace, k8sPkg.ControllerNSLabel: controllerNamespace,
k8sPkg.ProxyAutoInjectLabel: k8sPkg.ProxyAutoInjectCompleted, k8sPkg.ProxyAutoInjectLabel: k8sPkg.ProxyAutoInjectCompleted,
}) })
actual.addPodAnnotation(map[string]string{ actual.addDeploymentLabels(map[string]string{
k8sPkg.ControllerNSLabel: controllerNamespace,
k8sPkg.ProxyAutoInjectLabel: k8sPkg.ProxyAutoInjectCompleted,
})
actual.addPodAnnotations(map[string]string{
k8sPkg.CreatedByAnnotation: createdBy, k8sPkg.CreatedByAnnotation: createdBy,
}) })
@ -62,11 +66,15 @@ func TestPatch(t *testing.T) {
&patchOp{Op: "add", Path: patchPathVolumeRoot, Value: []*v1.Volume{}}, &patchOp{Op: "add", Path: patchPathVolumeRoot, Value: []*v1.Volume{}},
&patchOp{Op: "add", Path: patchPathVolume, Value: trustAnchors}, &patchOp{Op: "add", Path: patchPathVolume, Value: trustAnchors},
&patchOp{Op: "add", Path: patchPathVolume, Value: secrets}, &patchOp{Op: "add", Path: patchPathVolume, Value: secrets},
&patchOp{Op: "add", Path: patchPathPodLabel, Value: map[string]string{ &patchOp{Op: "add", Path: patchPathPodLabels, Value: map[string]string{
k8sPkg.ControllerNSLabel: controllerNamespace, k8sPkg.ControllerNSLabel: controllerNamespace,
k8sPkg.ProxyAutoInjectLabel: k8sPkg.ProxyAutoInjectCompleted, k8sPkg.ProxyAutoInjectLabel: k8sPkg.ProxyAutoInjectCompleted,
}}, }},
&patchOp{Op: "add", Path: patchPathPodAnnotation, Value: map[string]string{k8sPkg.CreatedByAnnotation: createdBy}}, &patchOp{Op: "add", Path: patchPathDeploymentLabels, Value: map[string]string{
k8sPkg.ControllerNSLabel: controllerNamespace,
k8sPkg.ProxyAutoInjectLabel: k8sPkg.ProxyAutoInjectCompleted,
}},
&patchOp{Op: "add", Path: patchPathPodAnnotations, Value: map[string]string{k8sPkg.CreatedByAnnotation: createdBy}},
} }
if !reflect.DeepEqual(actual, expected) { if !reflect.DeepEqual(actual, expected) {

30
controller/proxy-injector/webhook.go
View File

@ -152,10 +152,21 @@ func (w *Webhook) inject(request *admissionv1beta1.AdmissionRequest) (*admission
patch.addVolume(caBundle) patch.addVolume(caBundle)
patch.addVolume(tlsSecrets) patch.addVolume(tlsSecrets)
patch.addPodLabel(map[string]string{ if deployment.Spec.Template.Labels == nil {
k8sPkg.ControllerNSLabel: w.controllerNamespace, deployment.Spec.Template.Labels = map[string]string{}
k8sPkg.ProxyDeploymentLabel: deployment.ObjectMeta.Name, }
})
deployment.Spec.Template.Labels[k8sPkg.ControllerNSLabel] = w.controllerNamespace
deployment.Spec.Template.Labels[k8sPkg.ProxyDeploymentLabel] = deployment.ObjectMeta.Name
patch.addPodLabels(deployment.Spec.Template.Labels)
if deployment.Labels == nil {
deployment.Labels = map[string]string{}
}
deployment.Labels[k8sPkg.ControllerNSLabel] = w.controllerNamespace
deployment.Labels[k8sPkg.ProxyDeploymentLabel] = deployment.ObjectMeta.Name
patch.addDeploymentLabels(deployment.Labels)
var ( var (
image = strings.Split(proxy.Image, ":") image = strings.Split(proxy.Image, ":")
@ -167,10 +178,13 @@ func (w *Webhook) inject(request *admissionv1beta1.AdmissionRequest) (*admission
} else { } else {
imageTag = image[1] imageTag = image[1]
} }
patch.addPodAnnotation(map[string]string{
k8sPkg.CreatedByAnnotation: fmt.Sprintf("linkerd/proxy-injector %s", imageTag), if deployment.Spec.Template.Annotations == nil {
k8sPkg.ProxyVersionAnnotation: imageTag, deployment.Spec.Template.Annotations = map[string]string{}
}) }
deployment.Spec.Template.Annotations[k8sPkg.CreatedByAnnotation] = fmt.Sprintf("linkerd/proxy-injector %s", imageTag)
deployment.Spec.Template.Annotations[k8sPkg.ProxyVersionAnnotation] = imageTag
patch.addPodAnnotations(deployment.Spec.Template.Annotations)
patchJSON, err := json.Marshal(patch.patchOps) patchJSON, err := json.Marshal(patch.patchOps)
if err != nil { if err != nil {