blakelead / nsinjector Goto Github PK

View Code? Open in Web Editor NEW

39.0 2.0 13.0 66 KB

Deploy resources to Kubernetes namespaces automatically

License: Apache License 2.0

Dockerfile 1.43% Go 88.92% Shell 1.74% Mustache 7.91%

kubernetes controller namespace injector

nsinjector's Introduction

nsinjector

nsinjector is a Kubernetes controller that automatically deploys resources into a namespace when it is created.

Here's a blog post I wrote about it: Deploy Kubernetes resources automatically with nsinjector .

How to use it

You can find a chart with an example values.yaml file in deploy/helm. With helm3, you can deploy it with:

helm install nsinjector-controller ./deploy/helm

Alternatively, you can manually deploy manifest stored in deploy/k8s:

# Deploy CRD first. If your cluster is >= v1.16, you can use namespaceresourcesinjector-crd-1.16.yaml instead
kubectl apply -f deploy/k8s/namespaceresourcesinjector-crd.yaml
# Deploy the controller
kubectl apply -f deploy/k8s/nsinjector-controller.yaml
# Then deploy an injector custom resource
# This is the file that you'll want to customize to your needs
kubectl apply -f deploy/k8s/namespaceresourcesinjector.yaml

Example

When a namespace starting with dev- is created, the following resource will automatically inject a role and rolebinding in it:

kind: NamespaceResourcesInjector
apiVersion: blakelead.com/v1alpha1
metadata:
  name: nri-test
spec:
  namespaces:
  - dev-.*
  excludedNamespaces:
  - dev-excluded-.* 
  resources:
  - |
    apiVersion: rbac.authorization.k8s.io/v1
    kind: Role
    metadata:
      name: dev-role
    rules:
      - apiGroups: [""]
        resources: ["pods","pods/portforward", "services", "deployments", "ingresses"]
        verbs: ["list", "get"]
      - apiGroups: [""]
        resources: ["pods/portforward"]
        verbs: ["create"]
      - apiGroups: [""]
        resources: ["namespaces"]
        verbs: ["list", "get"]
  - |
    apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
    metadata:
      name: dev-rolebinding
    subjects:
    - kind: User
      name: dev
    roleRef:
      kind: Role
      name: dev-role
      apiGroup: rbac.authorization.k8s.io

namespaces: a list of namespace names or regex
excludedNamespaces: a list of namespace names or regex to be excluded
resources: a list of any Kubernetes resources

Contributing

Although this project is currently used in production, it is relatively young and has not been extensively tested. Suggestions and contributions are therefore very welcome.

nsinjector's People

Contributors

Stargazers

Watchers

Forkers

northvolt zhaohc10 moandersson hiloyt codestaple chapsuk mokpolar jinx-heniux ashley-abbott lanord kaa-ghub nicolasbrieussel fnikolai

nsinjector's Issues

Controller Issue

Why does the controller keep-on updating the resources that it deployed in the namespaces? why can't it just update whenever the nsri is updated ?

time="2022-07-12T09:56:22Z" level=error msg="Key 'nri-test' processing failed: Operation cannot be fulfilled on namespaceresourcesinjectors.blakelead.com "nri-test": the object has been modified; please apply your changes to the latest version and try again"

Why are we getting the nsri object is modified log as shown above? Is it really modified by the controller or Is the 1st question reason for it ?

Newly Created Namespace

time="2022-07-13T03:51:55Z" level=info msg="Added nri-test to queue because namespace test-nsri was created"

The newly created namespaces aren't getting priority. They are added to queue as shown above.
Why newly created namespace is not prioritised ?

[question] Updating Resources

Hi,

Does nsinjector update any previously created resources if any changes are made?

For instance:
Lets say nsinjector deploys a rolebinding whenever a namespace is created.
If i were to modify the rolebinding in the kind: NamespaceResourcesInjector, will it re-apply and recreate the rolebinding?

Thanks in advance!

Cannot create resource "roles" in API group "rbac.authorization.k8s.io"

Seems some rbac permissions are missing:

level=error msg="Key 'injector1' processing failed: roles.rbac.authorization.k8s.io is forbidden: User \"system:serviceaccount:nsinjector-controller:nsinjector-controller\" cannot create resource \"roles\" in API group \"rbac.authorization.k8s.io\" in the namespace \"my-test-ns\""

Throttling Request

I0713 03:51:57.156425 1 request.go:621] Throttling request took 1.077697231s, request: GET:https://10.100.0.1:443/apis/metrics.k8s.io/v1beta1?timeout=32s

Why are we getting above throttling requests for different k8s-api end-points ?

Use Regex Matches in Resource Template

It would be incredibly powerful for the match groups from the regex used to match the namespace name to be available to the resource template.

namespace: my-ns-1
regex: my-ns-(?<id>\d+)
resources:

 apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
    metadata:
      name: dev-rolebinding
    subjects:
    - kind: Group
      name: my-group:${id}
    roleRef:
      kind: Role
      name: dev-role
      apiGroup: rbac.authorization.k8s.io

metadata.resourceVersion: Invalid value: 0x0: must be specified for an update

I'm creating CiliumNetworkPolicy (cilium.io CustomResource) with this operator.
It works ok (after I update nsinjector ClusterRole to be able to create across "cilium.io" apiGroup), but after creation I checked logs of nsinjector-controller pod and got repeated error messages:
(deleteme - is the name of my test namespace)

time="2022-06-14T14:49:24Z" level=info msg="Resource  from injector default-cilium-network-policy-on-each-namespace created"
time="2022-06-14T14:49:24Z" level=info msg="Added namespace deleteme to injector default-cilium-network-policy-on-each-namespace status"
time="2022-06-14T14:49:32Z" level=error msg="Key 'default-cilium-network-policy-on-each-namespace' processing failed: ciliumnetworkpolicies.cilium.io \"default-cilium-network-policy\" is invalid: metadata.resourceVersion: Invalid value: 0x0: must be specified for an update"
time="2022-06-14T14:49:40Z" level=error msg="Key 'default-cilium-network-policy-on-each-namespace' processing failed: ciliumnetworkpolicies.cilium.io \"default-cilium-network-policy\" is invalid: metadata.resourceVersion: Invalid value: 0x0: must be specified for an update"

Is this an issue?