Skip injection for host network pods

.gitignore

@@ -19,3 +19,6 @@
 /bin/
 /test/tests.xml
 /test/tests.output
+
+# idea
+.idea/

internal/pkg/config/config.go

@@ -43,6 +43,7 @@ type InjectionConfig struct {
 	HostPID            bool                 `json:"hostPID"`
 	InitContainers     []corev1.Container   `json:"initContainers"`
 	ServiceAccountName string               `json:"serviceAccountName"`
+	SkipHostNetwork    bool                 `json:"skipHostNetwork"`
 
 	version string
 }

internal/pkg/config/config_test.go

@@ -7,7 +7,6 @@ import (
 	testhelper "github.com/tumblr/k8s-sidecar-injector/internal/pkg/testing"
 )
 
-
 var (
 	// location of the fixture sidecar files
 	fixtureSidecarsDir = "test/fixtures/sidecars"
@@ -195,6 +194,18 @@ var (
 			HostNetwork: true,
 			HostPID:     true,
 		},
+		"skip-host-network": testhelper.ConfigExpectation{
+			Name:               "skip-host-network",
+			Version:            "latest",
+			Path:               fixtureSidecarsDir + "/skip-host-network.yaml",
+			EnvCount:           2,
+			ContainerCount:     2,
+			VolumeCount:        1,
+			VolumeMountCount:   0,
+			HostAliasCount:     0,
+			InitContainerCount: 0,
+			SkipHostNetwork:    true,
+		},
 	}
 )
 

internal/pkg/config/watcher/loader_test.go

@@ -219,6 +219,9 @@ func TestLoadFromConfigMap(t *testing.T) {
 			if len(ic.InitContainers) != expectedICF.InitContainerCount {
 				t.Fatalf("expected %d init containers in %s, but found %d", expectedICF.InitContainerCount, expectedICF.Path, len(ic.InitContainers))
 			}
+			if ic.SkipHostNetwork != expectedICF.SkipHostNetwork {
+				t.Fatalf("expected %t skipHostNetwork variables in %s, but found %t", expectedICF.SkipHostNetwork, expectedICF.Name, ic.SkipHostNetwork)
+			}
 			for _, actualIC := range ics {
 				if ic.FullName() == actualIC.FullName() {
 					if ic.String() != actualIC.String() {

internal/pkg/testing/config.go

@@ -22,6 +22,7 @@ type ConfigExpectation struct {
 	HostPID            bool
 	InitContainerCount int
 	ServiceAccount     string
+	SkipHostNetwork    bool
 
 	// LoadError is an error, if any, that is expected during load
 	LoadError error

pkg/server/webhook.go

@@ -531,6 +531,14 @@ func (whsvr *WebhookServer) mutate(req *v1beta1.AdmissionRequest) *v1beta1.Admis
 		}
 	}
 
+	if injectionConfig.SkipHostNetwork && pod.Spec.HostNetwork {
+		glog.Infof("Injection skipped, pod (%s/%s) hostNetwork = true while SkipHostNetwork is enabled in sidecar config (%s)", pod.Namespace, pod.Name, injectionConfig.Name)
+		injectionCounter.With(prometheus.Labels{"status": "skipped", "reason": "skip_host_network", "requested": injectionKey}).Inc()
+		return &v1beta1.AdmissionResponse{
+			Allowed: true,
+		}
+	}
+
 	// Workaround: https://github.com/kubernetes/kubernetes/issues/57982
 	applyDefaultsWorkaround(injectionConfig.Containers, injectionConfig.Volumes)
 	annotations := map[string]string{}

pkg/server/webhook_test.go

@@ -58,6 +58,8 @@ var (
 	// tests to check the mutate() function for correct operation
 	mutationTests = []mutationTest{
 		{name: "missing-sidecar-config", allowed: true, patchExpected: false},
+		{name: "skip-host-network", allowed: true, patchExpected: false},
+		{name: "inject-non-host-network", allowed: true, patchExpected: true},
 		{name: "sidecar-test-1", allowed: true, patchExpected: true},
 		{name: "env-override", allowed: true, patchExpected: true},
 		{name: "service-account", allowed: true, patchExpected: true},

test/fixtures/k8s/admissioncontrol/patch/inject-non-host-network.json

@@ -0,0 +1,74 @@
+[
+   {
+      "op" : "add",
+      "path" : "/spec/containers",
+      "value" : [
+         {
+            "env" : [
+               {
+                  "name" : "DATACENTER",
+                  "value" : "bf2"
+               },
+               {
+                  "name" : "FROM_INJECTOR",
+                  "value" : "bar"
+               }
+            ],
+            "image" : "nginx:1.12.2",
+            "imagePullPolicy" : "IfNotPresent",
+            "name" : "sidecar-nginx",
+            "ports" : [
+               {
+                  "containerPort" : 80
+               }
+            ],
+            "resources" : {},
+            "volumeMounts" : [
+               {
+                  "mountPath" : "/etc/nginx",
+                  "name" : "nginx-conf"
+               }
+            ]
+         }
+      ]
+   },
+   {
+      "op" : "add",
+      "path" : "/spec/containers/-",
+      "value" : {
+         "env" : [
+            {
+               "name" : "DATACENTER",
+               "value" : "foo"
+            },
+            {
+               "name" : "FROM_INJECTOR",
+               "value" : "bar"
+            }
+         ],
+         "image" : "foo:69",
+         "name" : "another-sidecar",
+         "ports" : [
+            {
+               "containerPort" : 420
+            }
+         ],
+         "resources" : {}
+      }
+   },
+   {
+      "op" : "add",
+      "path" : "/spec/volumes/-",
+      "value" : {
+          "configMap" : {
+             "name" : "nginx-configmap"
+          },
+          "name" : "nginx-conf"
+       }
+   },
+   {
+      "op" : "add",
+      "path" : "/metadata/annotations/injector.unittest.com~1status",
+      "value" : "injected"
+   }
+]

test/fixtures/k8s/admissioncontrol/request/inject-non-host-network.yaml

@@ -0,0 +1,9 @@
+---
+# this is an AdmissionRequest object
+# https://godoc.org/k8s.io/api/admission/v1beta1#AdmissionRequest
+object:
+  metadata:
+    annotations:
+      injector.unittest.com/request: skip-host-network
+  spec:
+    containers: []

test/fixtures/k8s/admissioncontrol/request/skip-host-network.yaml

@@ -0,0 +1,19 @@
+---
+# this is an AdmissionRequest object
+# https://godoc.org/k8s.io/api/admission/v1beta1#AdmissionRequest
+object:
+  metadata:
+    annotations:
+      injector.unittest.com/request: skip-host-network
+  spec:
+    containers:
+    - name: memory-demo-2-ctr
+      image: polinux/stress
+      resources:
+        requests:
+          memory: "50Mi"
+        limits:
+          memory: "100Mi"
+      command: ["stress"]
+      args: ["--vm", "1", "--vm-bytes", "250M", "--vm-hang", "1"]
+      hostNetwork: true

test/fixtures/sidecars/skip-host-network.yaml

@@ -0,0 +1,28 @@
+---
+name: skip-host-network
+env:
+  - name: DATACENTER
+    value: foo
+  - name: FROM_INJECTOR
+    value: bar
+containers:
+  - name: sidecar-nginx
+    image: nginx:1.12.2
+    imagePullPolicy: IfNotPresent
+    env:
+      - name: DATACENTER
+        value: bf2
+    ports:
+      - containerPort: 80
+    volumeMounts:
+      - name: nginx-conf
+        mountPath: /etc/nginx
+  - name: another-sidecar
+    image: foo:69
+    ports:
+      - containerPort: 420
+volumes:
+  - name: nginx-conf
+    configMap:
+      name: nginx-configmap
+skipHostNetwork: true