E58A Add status field to policy resource · nginx/kubernetes-ingress@cea9354 · GitHub
[go: up one dir, main page]
Skip to content

Commit cea9354

Browse files
LorcanMcVeighLorcanMcVeigh
authored
Add status field to policy resource
1 parent 42563af commit cea9354

File tree

16 files changed

+347
-13
lines changed

16 files changed

+347
-13
lines changed

‎deployments/common/crds-v1beta1/k8s.nginx.org_policies.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,14 @@ metadata:
66
creationTimestamp: null
77
name: policies.k8s.nginx.org
88
spec:
9+
additionalPrinterColumns:
10+
- JSONPath: .status.state
11+
description: Current state of the Policy. If the resource has a valid status, it means it has been validated and accepted by the Ingress Controller.
12+
name: State
13+
type: string
14+
- JSONPath: .metadata.creationTimestamp
15+
name: Age
16+
type: date
917
group: k8s.nginx.org
1018
names:
1119
kind: Policy
@@ -16,6 +24,8 @@ spec:
1624
singular: policy
1725
preserveUnknownFields: false
1826
scope: Namespaced
27+
subresources:
28+
status: {}
1929
validation:
2030
openAPIV3Schema:
2131
description: Policy defines a Policy for VirtualServer and VirtualServerRoute resources.
@@ -127,6 +137,16 @@ spec:
127137
type: integer
128138
zoneSize:
129139
type: string
140+
status:
141+
description: PolicyStatus is the status of the policy resource
142+
type: object
143+
properties:
144+
message:
145+
type: string
146+
reason:
147+
type: string
148+
state:
149+
type: string
130150
version: v1
131151
versions:
132152
- name: v1

‎deployments/common/crds/k8s.nginx.org_policies.yaml‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,15 @@ spec:
1616
singular: policy
1717
scope: Namespaced
1818
versions:
19-
- name: v1
19+
- additionalPrinterColumns:
20+
- description: Current state of the Policy. If the resource has a valid status, it means it has been validated and accepted by the Ingress Controller.
21+
jsonPath: .status.state
22+
name: State
23+
type: string
24+
- jsonPath: .metadata.creationTimestamp
25+
name: Age
26+
type: date
27+
name: v1
2028
schema:
2129
openAPIV3Schema:
2230
description: Policy defines a Policy for VirtualServer and VirtualServerRoute resources.
@@ -128,8 +136,20 @@ spec:
128136
type: integer
129137
zoneSize:
130138
type: string
139+
status:
140+
description: PolicyStatus is the status of the policy resource
141+
type: object
142+
properties:
143+
message:
144+
type: string
145+
reason:
146+
type: string
147+
state:
148+
type: string
131149
served: true
132150
storage: true
151+
subresources:
152+
status: {}
133153
status:
134154
acceptedNames:
135155
kind: ""

‎deployments/helm-chart/crds/k8s.nginx.org_policies.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,14 @@ metadata:
66
creationTimestamp: null
77
name: policies.k8s.nginx.org
88
spec:
9+
additionalPrinterColumns:
10+
- JSONPath: .status.state
11+
description: Current state of the Policy. If the resource has a valid status, it means it has been validated and accepted by the Ingress Controller.
12+
name: State
13+
type: string
14+
- JSONPath: .metadata.creationTimestamp
15+
name: Age
16+
type: date
917
group: k8s.nginx.org
1018
names:
1119
kind: Policy
@@ -16,6 +24,8 @@ spec:
1624
singular: policy
1725
preserveUnknownFields: false
1826
scope: Namespaced
27+
subresources:
28+
status: {}
1929
validation:
2030
openAPIV3Schema:
2131
description: Policy defines a Policy for VirtualServer and VirtualServerRoute resources.
@@ -127,6 +137,16 @@ spec:
127137
type: integer
128138
zoneSize:
129139
type: string
140+
status:
141+
description: PolicyStatus is the status of the policy resource
142+
type: object
143+
properties:
144+
message:
145+
type: string
146+
reason:
147+
type: string
148+
state:
149+
type: string
130150
version: v1
131151
versions:
132152
- name: v1

‎deployments/helm-chart/templates/rbac.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,7 @@ rules:
102102
resources:
103103
- virtualservers/status
104104
- virtualserverroutes/status
105+
- policies/status
105106
verbs:
106107
- update
107108
{{- end }}

‎deployments/rbac/rbac.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ rules:
7676
resources:
7777
- virtualservers/status
7878
- virtualserverroutes/status
79+
- policies/status
7980
verbs:
8081
- update
8182
- apiGroups:

‎docs-web/configuration/global-configuration/reporting-resources-status.md‎

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,4 +110,44 @@ The Ingress controller must be configured to report a VirtualServer or VirtualSe
110110

111111
See the docs about [ConfigMap keys](/nginx-ingress-controller/configuration/global-configuration/configmap-resource) and [Command-line arguments](/nginx-ingress-controller/configuration/global-configuration/command-line-arguments).
112112

113-
Notes: The Ingress controller does not clear the status of VirtualServer and VirtualServerRoute resources when it is being shut down.
113+
Notes: The Ingress controller does not clear the status of VirtualServer and VirtualServerRoute resources when it is being shut down.
114+
115+
## Policy Resources
116+
117+
A Policy resource includes the status field with information about the state of the resource.
118+
You can see the status in the ouput of the `kubectl get policy` command as shown below:
119+
```
120+
$ kubectl get policy
121+
NAME STATE AGE
122+
webapp-policy Valid 30s
123+
```
124+
In order to see additional addresses or extra information about the `Status` of the resource, use the following command:
125+
```
126+
$ kubectl describe policy <NAME>
127+
. . .
128+
Status:
129+
Message: Configuration for default/webapp-policy was added or updated
130+
Reason: AddedOrUpdated
131+
State: Valid
132+
```
133+
134+
### Status Specification
135+
The following fields are reported in Policy status:
136+
137+
```eval_rst
138+
.. list-table::
139+
:header-rows: 1
140+
141+
* - Field
142+
- Description
143+
- Type
144+
* - ``State``
145+
- Current state of the resource. Can be ``Valid`` or ``Invalid``. For more information, refer to the ``message`` field.
146+
- ``string``
147+
* - ``Reason``
148+
- The reason of the last update.
149+
- ``string``
150+
* - ``Message``
151+
- Additional information about the state.
152+
- ``string``
153+
```

‎docs-web/configuration/policy-resource.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -651,4 +651,15 @@ Events:
651651
```
652652
Note how the events section includes a Warning event with the Rejected reason.
653653
654+
Additionally, this information is also available in the `status` field of the Policy resource. Note the Status section of the Policy:
655+
656+
```
657+
$ kubectl describe pol webapp-policy
658+
. . .
659+
Status:
660+
Message: Policy default/webapp-policy is invalid and was rejected: spec.accessControl.allow[0]: Invalid value: "10.0.0.": must be a CIDR or IP
661+
Reason: Rejected
662+
State: Invalid
663+
```
664+
654665
**Note**: If you make an existing resource invalid, the Ingress Controller will reject it.

‎internal/k8s/controller.go‎

Lines changed: 55 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -324,6 +324,7 @@ func NewLoadBalancerController(input NewLoadBalancerControllerInput) *LoadBalanc
324324
ingressLister: &lbc.ingressLister,
325325
virtualServerLister: lbc.virtualServerLister,
326326
virtualServerRouteLister: lbc.virtualServerRouteLister,
327+
policyLister: lbc.policyLister,
327328
keyFunc: keyFunc,
328329
confClient: input.ConfClient,
329330
}
@@ -822,7 +823,7 @@ func (lbc *LoadBalancerController) syncIngressLink(task task) {
822823
}
823824
}
824825

825-
if lbc.areCustomResourcesEnabled && lbc.reportVsVsrStatusEnabled() {
826+
if lbc.areCustomResourcesEnabled && lbc.reportCustomResourceStatusEnabled() {
826827
virtualServers := lbc.configuration.GetResourcesWithFilter(resourceFilter{VirtualServers: true})
827828

828829
glog.V(3).Infof("Updating status for %v VirtualServers", len(virtualServers))
@@ -848,9 +849,25 @@ func (lbc *LoadBalancerController) syncPolicy(task task) {
848849
pol := obj.(*conf_v1.Policy)
849850
err := validation.ValidatePolicy(pol, lbc.isNginxPlus, lbc.enablePreviewPolicies)
850851
if err != nil {
851-
lbc.recorder.Eventf(pol, api_v1.EventTypeWarning, "Rejected", "Policy %v is invalid and was rejected: %v", key, err)
852+
msg := fmt.Sprintf("Policy %v/%v is invalid and was rejected: %v", pol.Namespace, pol.Name, err)
853+
lbc.recorder.Eventf(pol, api_v1.EventTypeWarning, "Rejected", msg)
854+
855+
if lbc.reportCustomResourceStatusEnabled() {
856+
err = lbc.statusUpdater.UpdatePolicyStatus(pol, conf_v1.StateInvalid, "Rejected", msg)
857+
if err != nil {
858+
glog.V(3).Infof("Failed to update policy %s status: %v", key, err)
859+
}
860+
}
852861
} else {
853-
lbc.recorder.Eventf(pol, api_v1.EventTypeNormal, "AddedOrUpdated", "Policy %v was added or updated", key)
862+
msg := fmt.Sprintf("Policy %v/%v was added or updated", pol.Namespace, pol.Name)
863+
lbc.recorder.Eventf(pol, api_v1.EventTypeNormal, "AddedOrUpdated", msg)
864+
865+
if lbc.reportCustomResourceStatusEnabled() {
866+
err = lbc.statusUpdater.UpdatePolicyStatus(pol, conf_v1.StateValid, "AddedOrUpdated", msg)
867+
if err != nil {
868+
glog.V(3).Infof("Failed to update policy %s status: %v", key, err)
869+
}
870+
}
854871
}
855872
}
856873

@@ -1022,7 +1039,7 @@ func (lbc *LoadBalancerController) processProblems(problems []ConfigurationProbl
10221039
eventType := api_v1.EventTypeWarning
10231040
lbc.recorder.Event(p.Object, eventType, p.Reason, p.Message)
10241041

1025-
if lbc.reportVsVsrStatusEnabled() {
1042+
if lbc.reportCustomResourceStatusEnabled() {
10261043
state := conf_v1.StateWarning
10271044
if p.IsError {
10281045
state = conf_v1.StateInvalid
@@ -1241,7 +1258,7 @@ func (lbc *LoadBalancerController) UpdateVirtualServerStatusAndEventsOnDelete(vs
12411258
msg := fmt.Sprintf("VirtualServer %s was rejected %s", getResourceKey(&vsConfig.VirtualServer.ObjectMeta), eventWarningMessage)
12421259
lbc.recorder.Eventf(vsConfig.VirtualServer, eventType, eventTitle, msg)
12431260

1244-
if lbc.reportVsVsrStatusEnabled() {
1261+
if lbc.reportCustomResourceStatusEnabled() {
12451262
err := lbc.statusUpdater.UpdateVirtualServerStatus(vsConfig.VirtualServer, state, eventTitle, msg)
12461263
if err != nil {
12471264
glog.Errorf("Error when updating the status for VirtualServer %v/%v: %v", vsConfig.VirtualServer.Namespace, vsConfig.VirtualServer.Name, err)
@@ -1433,7 +1450,7 @@ func (lbc *LoadBalancerController) updateVirtualServerStatusAndEvents(vsConfig *
14331450
msg := fmt.Sprintf("Configuration for %v was added or updated %s", getResourceKey(&vsConfig.VirtualServer.ObjectMeta), eventWarningMessage)
14341451
lbc.recorder.Eventf(vsConfig.VirtualServer, eventType, eventTitle, msg)
14351452

1436-
if lbc.reportVsVsrStatusEnabled() {
1453+
if lbc.reportCustomResourceStatusEnabled() {
14371454
err := lbc.statusUpdater.UpdateVirtualServerStatus(vsConfig.VirtualServer, state, eventTitle, msg)
14381455
if err != nil {
14391456
glog.Errorf("Error when updating the status for VirtualServer %v/%v: %v", vsConfig.VirtualServer.Namespace, vsConfig.VirtualServer.Name, err)
@@ -1463,7 +1480,7 @@ func (lbc *LoadBalancerController) updateVirtualServerStatusAndEvents(vsConfig *
14631480
msg := fmt.Sprintf("Configuration for %v/%v was added or updated %s", vsr.Namespace, vsr.Name, vsrEventWarningMessage)
14641481
lbc.recorder.Eventf(vsr, vsrEventType, vsrEventTitle, msg)
14651482

1466-
if lbc.reportVsVsrStatusEnabled() {
1483+
if lbc.reportCustomResourceStatusEnabled() {
14671484
vss := []*conf_v1.VirtualServer{vsConfig.VirtualServer}
14681485
err := lbc.statusUpdater.UpdateVirtualServerRouteStatusWithReferencedBy(vsr, vsrState, vsrEventTitle, msg, vss)
14691486
if err != nil {
@@ -1571,7 +1588,7 @@ 3486 func (lbc *LoadBalancerController) syncService(task task) {
15711588
}
15721589
}
15731590

1574-
if lbc.areCustomResourcesEnabled && lbc.reportVsVsrStatusEnabled() {
1591+
if lbc.areCustomResourcesEnabled && lbc.reportCustomResourceStatusEnabled() {
15751592
virtualServers := lbc.configuration.GetResourcesWithFilter(resourceFilter{VirtualServers: true})
15761593

15771594
glog.V(3).Infof("Updating status for %v VirtualServers", len(virtualServers))
@@ -1628,8 +1645,8 @@ func (lbc *LoadBalancerController) reportStatusEnabled() bool {
16281645
return false
16291646
}
16301647

1631-
// reportVsVsrStatusEnabled determines if we should attempt to report status for VirtualServers and VirtualServerRoutes.
1632-
func (lbc *LoadBalancerController) reportVsVsrStatusEnabled() bool {
1648+
// reportCustomResourceStatusEnabled determines if we should attempt to report status for Custom Resources.
1649+
func (lbc *LoadBalancerController) reportCustomResourceStatusEnabled() bool {
16331650
if lbc.isLeaderElectionEnabled {
16341651
return lbc.leaderElector != nil && lbc.leaderElector.IsLeader()
16351652
}
@@ -1861,6 +1878,34 @@ func (lbc *LoadBalancerController) updateVirtualServerRoutesStatusFromEvents() e
18611878
return nil
18621879
}
18631880

1881+
func (lbc *LoadBalancerController) updatePoliciesStatus() error {
1882+
var allErrs []error
1883+
for _, obj := range lbc.policyLister.List() {
1884+
pol := obj.(*conf_v1.Policy)
1885+
1886+
err := validation.ValidatePolicy(pol, lbc.isNginxPlus, lbc.enablePreviewPolicies)
1887+
if err != nil {
1888+
msg := fmt.Sprintf("Policy %v/%v is invalid and was rejected: %v", pol.Namespace, pol.Name, err)
1889+
err = lbc.statusUpdater.UpdatePolicyStatus(pol, conf_v1.StateInvalid, "Rejected", msg)
1890+
if err != nil {
1891+
allErrs = append(allErrs, err)
1892+
}
1893+
} else {
1894+
msg := fmt.Sprintf("Policy %v/%v was added or updated", pol.Namespace, pol.Name)
1895+
err = lbc.statusUpdater.UpdatePolicyStatus(pol, conf_v1.StateValid, "AddedOrUpdated", msg)
1896+
if err != nil {
1897+
allErrs = append(allErrs, err)
1898+
}
1899+
}
1900+
}
1901+
1902+
if len(allErrs) != 0 {
1903+
return fmt.Errorf("not all Policies statuses were updated: %v", allErrs)
1904+
}
1905+
1906+
return nil
1907+
}
1908+
18641909
// EnqueueTransportServerForService enqueues TransportServers for the given service.
18651910
func (lbc *LoadBalancerController) EnqueueTransportServerForService(service *api_v1.Service) {
18661911
transportServers := lbc.getTransportServersForService(service)

‎internal/k8s/controller_test.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ import (
2323
meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2424
"k8s.io/apimachinery/pkg/util/intstr"
2525
"k8s.io/client-go/kubernetes/fake"
26+
2627
"k8s.io/client-go/tools/cache"
2728
)
2829

‎internal/k8s/leader.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,11 @@ func createLeaderHandler(lbc *LoadBalancerController) leaderelection.LeaderCallb
7373
if err != nil {
7474
glog.V(3).Infof("error updating VirtualServerRoutes status when starting leading: %v", err)
7575
}
76+
77+
err = lbc.updatePoliciesStatus()
78+
if err != nil {
79+
glog.V(3).Infof("error updating Policies status when starting leading: %v", err)
80+
}
7681
}
7782
},
7883
OnStoppedLeading: func() {

0 commit comments

Comments
 (0)
0