-
Notifications
You must be signed in to change notification settings - Fork 37
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
refactor: code re-use for certs, pods ready check, ImageRefresher, etc.
- Allows code re-use of TLS cert creation, checking if pods are ready before deploying, ImageFresher for registry pushing, etc. as more reconcilation types will need to be able to do the same thing.
- Loading branch information
1 parent
ae596a8
commit c3c1b39
Showing
8 changed files
with
203 additions
and
31 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| package common | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
|
|
||
| corev1 "k8s.io/api/core/v1" | ||
| "sigs.k8s.io/controller-runtime/pkg/client" | ||
| ) | ||
|
|
||
| func GetReadyPod(r client.Client, ctx context.Context, namespace string, matchingLabels client.MatchingLabels) (*corev1.Pod, error) { | ||
| podList := &corev1.PodList{} | ||
| listOpts := []client.ListOption{ | ||
| client.InNamespace(namespace), | ||
| matchingLabels, | ||
| } | ||
|
|
||
| if err := r.List(ctx, podList, listOpts...); err != nil { | ||
| return nil, fmt.Errorf("unable to list pods: %v", err) | ||
| } | ||
|
|
||
| for _, pod := range podList.Items { | ||
| for _, cond := range pod.Status.Conditions { | ||
| if cond.Type == corev1.PodReady && cond.Status == corev1.ConditionTrue { | ||
| return &pod, nil | ||
| } | ||
| } | ||
| } | ||
|
|
||
| return &corev1.Pod{}, fmt.Errorf("No Injector pod found in a Ready state") | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| package common |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,132 @@ | ||
| package image | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| "os" | ||
| "strings" | ||
|
|
||
| "github.com/go-logr/logr" | ||
|
|
||
| "github.com/containers/image/v5/copy" | ||
| "github.com/containers/image/v5/signature" | ||
| "github.com/containers/image/v5/transports/alltransports" | ||
| "github.com/containers/image/v5/types" | ||
|
|
||
| "github.com/crowdstrike/falcon-operator/pkg/registry/auth" | ||
| "github.com/crowdstrike/falcon-operator/pkg/registry/falcon_registry" | ||
| "github.com/crowdstrike/gofalcon/falcon" | ||
| ) | ||
|
|
||
| type ImageRefresher struct { | ||
| ctx context.Context | ||
| log logr.Logger | ||
| falconConfig *falcon.ApiConfig | ||
| insecureSkipTLSVerify bool | ||
| pushCredentials auth.Credentials | ||
| } | ||
|
|
||
| func NewImageRefresher(ctx context.Context, log logr.Logger, falconConfig *falcon.ApiConfig, pushAuth auth.Credentials, insecureSkipTLSVerify bool) *ImageRefresher { | ||
| return &ImageRefresher{ | ||
| ctx: ctx, | ||
| log: log, | ||
| falconConfig: falconConfig, | ||
| insecureSkipTLSVerify: insecureSkipTLSVerify, | ||
| pushCredentials: pushAuth, | ||
| } | ||
| } | ||
|
|
||
| func (r *ImageRefresher) Refresh(imageDestination string, versionRequested *string) (string, error) { | ||
| falconTag, srcRef, sourceCtx, err := r.source(versionRequested) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| r.log.Info("Identified the latest Falcon Container image", "reference", srcRef.DockerReference().String()) | ||
|
|
||
| policy := &signature.Policy{Default: []signature.PolicyRequirement{signature.NewPRInsecureAcceptAnything()}} | ||
| policyContext, err := signature.NewPolicyContext(policy) | ||
| if err != nil { | ||
| return "", fmt.Errorf("Error loading trust policy: %v", err) | ||
| } | ||
| defer func() { _ = policyContext.Destroy() }() | ||
|
|
||
| destinationCtx, err := r.destinationContext(r.insecureSkipTLSVerify) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| // Push to the registry with the falconTag | ||
| dest := fmt.Sprintf("docker://%s:%s", imageDestination, falconTag) | ||
| destRef, err := alltransports.ParseImageName(dest) | ||
|
|
||
| if err != nil { | ||
| return "", fmt.Errorf("Invalid destination name %s: %v", dest, err) | ||
| } | ||
|
|
||
| r.log.Info("Identified the target location for image push", "reference", destRef.DockerReference().String()) | ||
| _, err = copy.Image(r.ctx, policyContext, destRef, srcRef, | ||
| ©.Options{ | ||
| ReportWriter: os.Stdout, | ||
| SourceCtx: sourceCtx, | ||
| DestinationCtx: destinationCtx, | ||
| }, | ||
| ) | ||
| if err != nil { | ||
| return "", wrapWithHint(err) | ||
| } | ||
|
|
||
| // Push to the registry with the latest tag | ||
| dest = fmt.Sprintf("docker://%s", imageDestination) | ||
| destRef, err = alltransports.ParseImageName(dest) | ||
| if err != nil { | ||
| return "", fmt.Errorf("Invalid destination name %s: %v", dest, err) | ||
| } | ||
|
|
||
| r.log.Info("Identified the target location for image push", "reference", destRef.DockerReference().String()) | ||
| _, err = copy.Image(r.ctx, policyContext, destRef, srcRef, | ||
| ©.Options{ | ||
| ReportWriter: os.Stdout, | ||
| SourceCtx: sourceCtx, | ||
| DestinationCtx: destinationCtx, | ||
| }, | ||
| ) | ||
|
|
||
| return falconTag, wrapWithHint(err) | ||
| } | ||
|
|
||
| func (r *ImageRefresher) source(versionRequested *string) (falconTag string, falconImage types.ImageReference, systemContext *types.SystemContext, err error) { | ||
| registry, err := falcon_registry.NewFalconRegistry(r.ctx, r.falconConfig) | ||
| if err != nil { | ||
| return | ||
| } | ||
|
|
||
| return registry.PullInfo(r.ctx, versionRequested) | ||
| } | ||
|
|
||
| func (r *ImageRefresher) destinationContext(insecureSkipTLSVerify bool) (*types.SystemContext, error) { | ||
| ctx, err := r.pushCredentials.DestinationContext() | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| if insecureSkipTLSVerify { | ||
| ctx.DockerInsecureSkipTLSVerify = 1 | ||
| } | ||
|
|
||
| return ctx, nil | ||
| } | ||
|
|
||
| func wrapWithHint(in error) error { | ||
| // Use of credentials store outside of docker command is somewhat limited | ||
| // See https://github.com/moby/moby/issues/39377 | ||
| // https://github.com/containers/image/pull/656 | ||
| if in == nil { | ||
| return in | ||
| } | ||
|
|
||
| if strings.Contains(in.Error(), "authentication required") { | ||
| return fmt.Errorf("Could not authenticate to the registry: %w", in) | ||
| } | ||
| return in | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters