Merge pull request #89 from santinoncs/included-namespaces

Add --include-namespaces-regex features

Author: k8s-ci-robot

cmd/manager/main.go

@@ -67,6 +67,7 @@ var (
 	restartOnSecretRefresh  bool
 	unpropagatedAnnotations arrayArg
 	excludedNamespaces      arrayArg
+	includedNamespacesRegex string
 )
 
 func init() {
@@ -98,14 +99,13 @@ func main() {
 	flag.IntVar(&webhookServerPort, "webhook-server-port", 443, "The port that the webhook server serves at.")
 	flag.Var(&unpropagatedAnnotations, "unpropagated-annotation", "An annotation that, if present, will be stripped out of any propagated copies of an object. May be specified multiple times, with each instance specifying one annotation. See the user guide for more information.")
 	flag.Var(&excludedNamespaces, "excluded-namespace", "A namespace that, if present, will be excluded from HNC management. May be specified multiple times, with each instance specifying one namespace. See the user guide for more information.")
+	flag.StringVar(&includedNamespacesRegex, "included-namespace-regex", ".*", "Namespace regular expression. Namespaces that match this regexp will be included and handle by HNC. As it is a regex, this parameter cannot be specified multiple times. Implicit wrapping of the expression \"^...$\" is done here")
 	flag.BoolVar(&restartOnSecretRefresh, "cert-restart-on-secret-refresh", false, "Kills the process when secrets are refreshed so that the pod can be restarted (secrets take up to 60s to be updated by running pods)")
 	flag.Parse()
 	// Assign the array args to the configuration variables after the args are parsed.
 	config.UnpropagatedAnnotations = unpropagatedAnnotations
-	config.ExcludedNamespaces = make(map[string]bool)
-	for _, exn := range excludedNamespaces {
-		config.ExcludedNamespaces[exn] = true
-	}
+
+	config.SetNamespaces(includedNamespacesRegex, excludedNamespaces...)
 
 	// Enable OpenCensus exporters to export metrics
 	// to Stackdriver Monitoring.

hack/tools.go

@@ -1,4 +1,6 @@
-//+build tools
+//go:build tools
+// +build tools
+
 //
 // This is used to ensure that controller-gen is included in the /vendor directory.  See
 // https://stackoverflow.com/questions/52428230/how-do-go-modules-work-with-installable-commands.

internal/config/default_config.go

@@ -1,5 +1,7 @@
 package config
 
+import "regexp"
+
 // UnpropgatedAnnotations is a list of annotations on objects that should _not_ be propagated by HNC.
 // Much like HNC itself, other systems (such as GKE Config Sync) use annotations to "claim" an
 // object - such as deleting objects it doesn't recognize. By removing these annotations on
@@ -14,4 +16,5 @@ var UnpropagatedAnnotations []string
 //
 // This value is controlled by the --excluded-namespace command line, which may
 // be set multiple times.
-var ExcludedNamespaces map[string]bool
+var excludedNamespaces map[string]bool
+var includedNamespacesRegex *regexp.Regexp

internal/config/namespace.go

@@ -0,0 +1,30 @@
+package config
+
+import (
+	"regexp"
+)
+
+func SetNamespaces(regex string, excluded ...string) {
+
+	if regex == "" {
+		regex = ".*"
+	}
+
+	includedNamespacesRegex = regexp.MustCompile("^" + regex + "$")
+
+	excludedNamespaces = make(map[string]bool)
+	for _, exn := range excluded {
+		excludedNamespaces[exn] = true
+	}
+
+}
+
+func IsNamespaceIncluded(name string) bool {
+
+	if excludedNamespaces[name] {
+		return false
+	}
+
+	return includedNamespacesRegex.MatchString(name)
+
+}

internal/config/namespace_test.go

@@ -0,0 +1,36 @@
+package config
+
+import (
+	. "github.com/onsi/gomega"
+	"testing"
+)
+
+func TestIsNamespaceIncluded(t *testing.T) {
+
+	tests := []struct {
+		name              string
+		regex             string
+		excludeNamespaces []string
+		expect            bool
+	}{
+		{name: "foobar", regex: "foo.*", excludeNamespaces: []string{"bar"}, expect: true},
+		{name: "bar", regex: "foo-.*", excludeNamespaces: []string{"bar"}, expect: false},
+		{name: "bar", regex: ".*", excludeNamespaces: []string{"bar"}, expect: false},
+		{name: "foo", regex: ".*", excludeNamespaces: []string{"bar"}, expect: true},
+		{name: "foo", regex: ".*", excludeNamespaces: []string{"bar", "foo"}, expect: false},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			g := NewWithT(t)
+
+			// Test
+			SetNamespaces(tc.regex, tc.excludeNamespaces...)
+			isIncluded := IsNamespaceIncluded(tc.name)
+
+			// Report
+			g.Expect(isIncluded).Should(Equal(tc.expect))
+		})
+	}
+
+}

internal/mutators/namespace.go

@@ -52,8 +52,8 @@ func (m *Namespace) Handle(ctx context.Context, req admission.Request) admission
 // Currently, we only add `included-namespace` label to non-excluded namespaces
 // if the label is missing.
 func (m *Namespace) handle(log logr.Logger, ns *corev1.Namespace) {
-	// Early exit if the namespace is excluded.
-	if config.ExcludedNamespaces[ns.Name] {
+
+	if !config.IsNamespaceIncluded(ns.Name) {
 		return
 	}
 

internal/mutators/namespace_test.go

@@ -14,7 +14,7 @@ import (
 func TestMutateNamespaceIncludedLabel(t *testing.T) {
 	m := &Namespace{}
 	l := zap.New()
-	config.ExcludedNamespaces = map[string]bool{"excluded": true}
+	config.SetNamespaces("", "excluded")
 
 	tests := []struct {
 		name       string

internal/reconcilers/anchor.go

@@ -75,7 +75,7 @@ func (r *AnchorReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctr
 
 	// Always delete anchor (and any other HNC CRs) in the excluded namespaces and
 	// early exit.
-	if config.ExcludedNamespaces[pnm] {
+	if !config.IsNamespaceIncluded(pnm) {
 		// Since the anchors in the excluded namespaces are never synced by HNC,
 		// there are no finalizers on the anchors that we can delete them without
 		// removing the finalizers first.
@@ -87,7 +87,7 @@ func (r *AnchorReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctr
 	// namespace that should not be created as a subnamespace, but the webhook has
 	// been bypassed and the anchor has been successfully created. Forbidden
 	// anchors won't have finalizers.
-	if config.ExcludedNamespaces[nm] {
+	if !config.IsNamespaceIncluded(nm) {
 		inst.Status.State = api.Forbidden
 		return ctrl.Result{}, r.writeInstance(ctx, log, inst)
 	}

internal/reconcilers/anchor_test.go

@@ -22,7 +22,7 @@ var _ = Describe("Anchor", func() {
 	BeforeEach(func() {
 		fooName = createNS(ctx, "foo")
 		barName = createNSName("bar")
-		config.ExcludedNamespaces = nil
+		config.SetNamespaces("")
 	})
 
 	It("should create an subnamespace and update the hierarchy according to the anchor", func() {
@@ -52,14 +52,14 @@ var _ = Describe("Anchor", func() {
 	})
 
 	It("should remove the anchor in an excluded namespace", func() {
-		config.ExcludedNamespaces = map[string]bool{"kube-system": true}
+		config.SetNamespaces("", "kube-system")
 		kube_system_anchor_bar := newAnchor(barName, "kube-system")
 		updateAnchor(ctx, kube_system_anchor_bar)
 		Eventually(canGetAnchor(ctx, barName, "kube-system")).Should(Equal(false))
 	})
 
 	It("should set the anchor.status.state to Forbidden if the subnamespace is an excluded namespace", func() {
-		config.ExcludedNamespaces = map[string]bool{"kube-system": true}
+		config.SetNamespaces("", "kube-system")
 		foo_anchor_kube_system := newAnchor("kube-system", fooName)
 		updateAnchor(ctx, foo_anchor_kube_system)
 		Eventually(getAnchorState(ctx, fooName, "kube-system")).Should(Equal(api.Forbidden))

internal/reconcilers/hierarchy_config.go

@@ -88,8 +88,8 @@ func (r *HierarchyConfigReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 	ns := req.NamespacedName.Namespace
 	log := loggerWithRID(r.Log).WithValues("ns", ns)
 
-	// Early exit if it's an excluded namespace.
-	if config.ExcludedNamespaces[ns] {
+	// Early exit if it's an excluded namespace
+	if !config.IsNamespaceIncluded(ns) {
 		return ctrl.Result{}, r.handleExcludedNamespace(ctx, log, ns)
 	}
 
@@ -418,7 +418,7 @@ func (r *HierarchyConfigReconciler) syncParent(log logr.Logger, inst *api.Hierar
 
 	// Sync this namespace with its current parent.
 	curParent := r.Forest.Get(inst.Spec.Parent)
-	if config.ExcludedNamespaces[inst.Spec.Parent] {
+	if !config.IsNamespaceIncluded(inst.Spec.Parent) {
 		log.Info("Setting ConditionActivitiesHalted: excluded namespace set as parent", "parent", inst.Spec.Parent)
 		ns.SetCondition(api.ConditionActivitiesHalted, api.ReasonIllegalParent, fmt.Sprintf("Parent %q is an excluded namespace", inst.Spec.Parent))
 	} else if curParent != nil && !curParent.Exists() {