linkerd
/
linkerd2
mirror of https://github.com/linkerd/linkerd2.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add trust-root-sha256 annotation to injected workloads (#9361) 

Closes #9312

#9118 introduced the `linkerd.io/trust-root-sha256` annotation which is
automatically added to control plane components.

This change ensures that all injected workloads also receive this annotation.

Signed-off-by: Kevin Leimkuhler <kleimkuhler@icloud.com>
This commit is contained in:
Kevin Leimkuhler 2022-09-08 22:22:57 -06:00 committed by GitHub
parent 6fda3526af
commit b7387820c3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
33 changed files with 62 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml vendored
View File

@ -11,6 +11,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: install-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: nginx
linkerd.io/control-plane-ns: linkerd

2
cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml vendored
View File

@ -11,6 +11,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: install-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: redis
linkerd.io/control-plane-ns: linkerd
@ -210,6 +211,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: install-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: nginx
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml vendored
View File

@ -11,6 +11,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: install-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: redis
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject_contour.golden.yml generated vendored
View File

@ -15,6 +15,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
prometheus.io/format: prometheus
prometheus.io/path: /stats
prometheus.io/port: "9001"

4
cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml generated vendored
View File

@ -13,6 +13,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd
@ -223,6 +224,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd
@ -433,6 +435,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd
@ -643,6 +646,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject_emojivoto_deployment.golden.yml generated vendored
View File

@ -13,6 +13,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject_emojivoto_deployment_access_log.golden.yml generated vendored
View File

@ -14,6 +14,7 @@ spec:
config.linkerd.io/access-log: apache
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml generated vendored
View File

@ -13,6 +13,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: testinjectversion
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: nginx
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml generated vendored
View File

@ -13,6 +13,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml generated vendored
View File

@ -21,6 +21,7 @@ spec:
config.linkerd.io/skip-outbound-ports: "9999"
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: override
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd

2
cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml generated vendored
View File

@ -13,6 +13,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd
@ -223,6 +224,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml generated vendored
View File

@ -14,6 +14,7 @@ spec:
config.linkerd.io/enable-debug-sidecar: "true"
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml generated vendored
View File

@ -13,6 +13,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml generated vendored
View File

@ -13,6 +13,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml generated vendored
View File

@ -13,6 +13,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml generated vendored
View File

@ -14,6 +14,7 @@ spec:
config.linkerd.io/opaque-ports: 3000,5000-6000,mysql
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml generated vendored
View File

@ -14,6 +14,7 @@ spec:
config.linkerd.io/admin-port: "1234"
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml generated vendored
View File

@ -15,6 +15,7 @@ spec:
config.linkerd.io/skip-outbound-ports: "5432"
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml generated vendored
View File

@ -13,6 +13,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd

2
cli/cmd/testdata/inject_emojivoto_list.golden.yml generated vendored
View File

@ -15,6 +15,7 @@ items:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd
@ -224,6 +225,7 @@ items:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: emoji-svc
linkerd.io/control-plane-ns: linkerd

2
cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml generated vendored
View File

@ -15,6 +15,7 @@ items:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd
@ -224,6 +225,7 @@ items:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: emoji-svc
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject_emojivoto_pod.golden.yml generated vendored
View File

@ -4,6 +4,7 @@ metadata:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: vote-bot
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml generated vendored
View File

@ -5,6 +5,7 @@ metadata:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/inject: ingress
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: vote-bot
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml generated vendored
View File

@ -6,6 +6,7 @@ metadata:
config.linkerd.io/skip-outbound-ports: "5432"
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: vote-bot
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml generated vendored
View File

@ -8,6 +8,7 @@ metadata:
config.linkerd.io/proxy-memory-request: 100Mi
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: vote-bot
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml generated vendored
View File

@ -14,6 +14,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: web-svc
linkerd.io/control-plane-ns: linkerd

2
cli/cmd/testdata/inject_gettest_deployment.good.golden.yml generated vendored
View File

@ -9,6 +9,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: testinjectversion
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: get-test
linkerd.io/control-plane-ns: linkerd
@ -221,6 +222,7 @@ spec:
annotations:
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: testinjectversion
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
app: get-test
linkerd.io/control-plane-ns: linkerd

1
cli/cmd/testdata/inject_tap_deployment_debug.golden.yml generated vendored
View File

@ -30,6 +30,7 @@ spec:
config.linkerd.io/enable-debug-sidecar: "true"
linkerd.io/created-by: linkerd/cli dev-undefined
linkerd.io/proxy-version: test-inject-proxy-version
linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
labels:
linkerd.io/control-plane-component: tap
linkerd.io/control-plane-ns: linkerd

5
controller/proxy-injector/fake/data/pod-with-debug.patch.json generated
View File

@ -4,6 +4,11 @@
"path": "/metadata/annotations/linkerd.io~1proxy-version",
"value": "dev-undefined"
},
{
"op": "add",
"path": "/metadata/annotations/linkerd.io~1trust-root-sha256",
"value": "5090806bcf2daff5d54739ba02a8e7b919f7e62b2a46757e11089c916ec97fc2"
},
{
"op": "add",
"path": "/metadata/labels/linkerd.io~1control-plane-ns",

5
controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json generated
View File

@ -14,6 +14,11 @@
"path": "/metadata/annotations/linkerd.io~1proxy-version",
"value": "dev-undefined"
},
{
"op": "add",
"path": "/metadata/annotations/linkerd.io~1trust-root-sha256",
"value": "5090806bcf2daff5d54739ba02a8e7b919f7e62b2a46757e11089c916ec97fc2"
},
{
"op": "add",
"path": "/metadata/labels/linkerd.io~1control-plane-ns",

5
controller/proxy-injector/fake/data/pod.patch.json generated
View File

@ -4,6 +4,11 @@
"path": "/metadata/annotations/linkerd.io~1proxy-version",
"value": "dev-undefined"
},
{
"op": "add",
"path": "/metadata/annotations/linkerd.io~1trust-root-sha256",
"value": "5090806bcf2daff5d54739ba02a8e7b919f7e62b2a46757e11089c916ec97fc2"
},
{
"op": "add",
"path": "/metadata/labels/linkerd.io~1control-plane-ns",

7
pkg/inject/inject.go
View File

@ -2,6 +2,8 @@ package inject
import (
"bytes"
"crypto/sha256"
"encoding/hex"
"encoding/json"
"errors"
"fmt"
@ -795,6 +797,11 @@ func (conf *ResourceConfig) injectObjectMeta(values *podPatch) {
values.Annotations[k8s.ProxyVersionAnnotation] = values.Proxy.Image.Version
// Add the cert bundle's checksum to the workload's annotations.
checksumBytes := sha256.Sum256([]byte(values.IdentityTrustAnchorsPEM))
checksum := hex.EncodeToString(checksumBytes[:])
values.Annotations[k8s.ProxyTrustRootSHA] = checksum
if len(conf.pod.labels) > 0 {
values.AddRootLabels = len(conf.pod.meta.Labels) == 0
for _, k := range sortedKeys(conf.pod.labels) {

4
pkg/k8s/labels.go
View File

@ -112,6 +112,10 @@ const (
// disable injection for a pod or namespace.
ProxyInjectDisabled = Disabled
// ProxyTrustRootSHA indicates the cert bundle configured on the injected
// workload.
ProxyTrustRootSHA = Prefix + "/trust-root-sha256"
/*
* Proxy config annotations
*/