Pod Mutating Webhook & Secret Annotation Injector #242

EngHabu · 2021-03-19T18:12:27Z

Signed-off-by: Haytham Abuelfutuh [email protected]

TL;DR

Add a Pod Mutating WebHook cmd for flytepropeller. The current setup only implements a secrets injector that can either inject secrets available to FlytePropeller or k8s secrets.

Type

Bug Fix
Feature
Plugin

Are all requirements met?

Complete description

flytepropeller webhook init-certs command issues a CA/Cert/PrivateKey and store them into a secret given a secret name
flytepropeller webhook creates a MutatingWebhookConfigration object in etcd., a webhook server and registers it with API Server. From there:
1. It starts listening to Pods labeled with inject-flyte-secrets: true.
2. Parses out annotations on the pod to know which secrets to inject
3. Lookups the env (envVars and mounted files) for the secret, if found it'll inject it directly into the pod
4. Adds k8s EnvFrom or VolumeMountSource to mount the right secret into the Pod
Plugin Manager change to automatically add inject-flyte-secrets: true to CRDs if the task has secrets in its TaskTemplate.

Tracking Issue

flyteorg/flyte#800

Signed-off-by: Haytham Abuelfutuh <[email protected]>

cmd/controller/cmd/webhook.go

pkg/controller/nodes/task/secretmanager/secrets.go

pkg/utils/secrets/marshaler.go

pkg/webhook/global_secrets.go

pkg/webhook/k8s_secrets.go

pkg/webhook/global_secrets.go

pkg/webhook/k8s_secrets.go

pkg/webhook/pod.go

kumare3 · 2021-03-19T21:25:22Z

few comments

Signed-off-by: Haytham Abuelfutuh <[email protected]>

codecov · 2021-03-22T21:55:24Z

Codecov Report

Merging #242 (1ea6a05) into master (0d1eeab) will increase coverage by 0.77%.
The diff coverage is 73.65%.

kumare3 · 2021-03-22T22:59:34Z

cmd/controller/cmd/webhook.go

+	mgr, err := manager.New(kubecfg, manager.Options{
+		Port:          cfg.ListenPort,
+		CertDir:       cfg.CertDir,
+		Namespace:     limitNamespace,


if we add multiple namespaces - how does this work?

pkg/utils/secrets/marshaler.go

Co-authored-by: Ketan Umare <[email protected]> Signed-off-by: Haytham Abuelfutuh <[email protected]>

kumare3

lgtm, can you update the readme for flytepropeller to add that it contains this too?

Signed-off-by: Haytham Abuelfutuh <[email protected]>

* Pod Mutating Webhook & Secret Annotation Injector Signed-off-by: Haytham Abuelfutuh <[email protected]> * Marshal the entire secret object instead Signed-off-by: Haytham Abuelfutuh <[email protected]> * docs Signed-off-by: Haytham Abuelfutuh <[email protected]> * cmd docs Signed-off-by: Haytham Abuelfutuh <[email protected]> * refactor Signed-off-by: Haytham Abuelfutuh <[email protected]> * Unit tests Signed-off-by: Haytham Abuelfutuh <[email protected]> * Update pkg/utils/secrets/marshaler.go Co-authored-by: Ketan Umare <[email protected]> Signed-off-by: Haytham Abuelfutuh <[email protected]> * introduce webhook in README Signed-off-by: Haytham Abuelfutuh <[email protected]> Co-authored-by: Ketan Umare <[email protected]> Signed-off-by: Ketan Umare <[email protected]>

* Pod Mutating Webhook & Secret Annotation Injector Signed-off-by: Haytham Abuelfutuh <[email protected]> * Marshal the entire secret object instead Signed-off-by: Haytham Abuelfutuh <[email protected]> * docs Signed-off-by: Haytham Abuelfutuh <[email protected]> * cmd docs Signed-off-by: Haytham Abuelfutuh <[email protected]> * refactor Signed-off-by: Haytham Abuelfutuh <[email protected]> * Unit tests Signed-off-by: Haytham Abuelfutuh <[email protected]> * Update pkg/utils/secrets/marshaler.go Co-authored-by: Ketan Umare <[email protected]> Signed-off-by: Haytham Abuelfutuh <[email protected]> * introduce webhook in README Signed-off-by: Haytham Abuelfutuh <[email protected]> Co-authored-by: Ketan Umare <[email protected]>

Pod Mutating Webhook & Secret Annotation Injector

9b0cdac

Signed-off-by: Haytham Abuelfutuh <[email protected]>

EngHabu requested a review from kumare3 as a code owner March 19, 2021 18:12

EngHabu marked this pull request as draft March 19, 2021 18:13

Marshal the entire secret object instead

dbe457f

Signed-off-by: Haytham Abuelfutuh <[email protected]>