Skip to content

Commit 91dd8a3

Browse files
thallgrenthallgren
committed
Add Helm chart value agentInjector.mutationAware.
Introduce a new configuration option `agentInjector.mutationAware` to exclude or include changes made by other injectors when injecting the traffic agent. Defaults to `true`. Signed-off-by: Thomas Hallgren <thomas@tada.se>
1 parent ed19a36 commit 91dd8a3

File tree

14 files changed

+76
-48
lines changed

14 files changed

+76
-48
lines changed

‎CHANGELOG.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,12 @@ items:
2727
- version: 2.26.0
2828
date: (TBD)
2929
notes:
30+
- type: feature
31+
title: Add ability to exclude or include modifications made by other injectors when injecting the traffic agent.
32+
body: >-
33+
The Traffic Agent now has a new configuration option `agentInjector.mutationAware` that can be set to `false` to exclude
34+
modifications made by other injectors when injecting the traffic agent. Setting `agentInjector.mutationAware=true` requires
35+
`agentInjector.webhook.reinvocationPolicy=IfNeeded`. The default setting is `true`.
3036
- type: feature
3137
title: Add ability to disable the Traffic Agent's HTTP2/Clear-Text probing.
3238
body: >-

‎charts/telepresence-oss/templates/agentInjectorWebhook.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,10 @@ already managed by some other traffic-manager.
7070
{{- $genCA := genCA "agent-injector-ca" 365 -}}
7171
{{- $genCert := genSignedCert "agent-injector" nil $altNames 365 $genCA -}}
7272
{{- $secretData := (lookup "v1" "Secret" (include "traffic-manager.namespace" $) .Values.agentInjector.secret.name).data -}}
73+
{{- $reinvocationPolicy := .Values.agentInjector.webhook.reinvocationPolicy }}
74+
{{- if (and .Values.agentInjector.mutationAware (not (eq $reinvocationPolicy "IfNeeded"))) }}
75+
{{- fail (printf "agentInjector.mutationAware=true cannot be combined with reinvocationPolicy=%s" $reinvocationPolicy) }}
76+
{{- end }}
7377
---
7478
apiVersion: admissionregistration.k8s.io/v1
7579
kind: MutatingWebhookConfiguration
@@ -111,7 +115,7 @@ webhooks:
111115
- pods
112116
scope: '*'
113117
failurePolicy: {{ .Values.agentInjector.webhook.failurePolicy }}
114-
reinvocationPolicy: {{ .Values.agentInjector.webhook.reinvocationPolicy }}
118+
reinvocationPolicy: {{ $reinvocationPolicy }}
115119
name: agent-injector-{{ include "traffic-manager.namespace" $ }}.telepresence.io
116120
sideEffects: {{ .Values.agentInjector.webhook.sideEffects }}
117121
timeoutSeconds: {{ .Values.agentInjector.webhook.timeoutSeconds }}

‎charts/telepresence-oss/templates/deployment.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,8 @@ spec:
119119
value: {{ .injectPolicy }}
120120
- name: AGENT_INJECTOR_NAME
121121
value: {{ .name | quote }}
122+
- name: AGENT_INJECTOR_MUTATION_AWARE
123+
value: {{ (default false .mutationAware) | quote }}
122124
{{- end }}
123125
{{- /*
124126
Traffic agent configuration

‎charts/telepresence-oss/values.schema.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,9 @@ properties:
136136
enum:
137137
- OnDemand
138138
- WhenEnabled
139+
mutationAware:
140+
description: Include changes to the pod template that are contributed by other injectors. Implies reinvocationPolicy=IfNeeded
141+
type: boolean
139142
name:
140143
description: Name to use with objects associated with the agent-injector
141144
type: string

‎charts/telepresence-oss/values.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,7 @@ agentInjector:
114114
kind: Issuer
115115

116116
injectPolicy: OnDemand
117+
mutationAware: true
117118
webhook:
118119
name: agent-injector-webhook
119120
admissionReviewVersions: ["v1"]

‎cmd/traffic/cmd/manager/managerutil/envconfig.go‎

Lines changed: 19 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -50,24 +50,25 @@ type Env struct {
5050
PodCIDRs []netip.Prefix `env:"POD_CIDRS, parser=split-ipnet, default="`
5151
PodIP netip.Addr `env:"POD_IP, parser=ip"`
5252

53-
AgentRegistry string `env:"AGENT_REGISTRY, parser=string, default="`
54-
AgentImageName string `env:"AGENT_IMAGE_NAME, parser=string, default="`
55-
AgentImageTag string `env:"AGENT_IMAGE_TAG, parser=string, default="`
56-
AgentImagePullPolicy string `env:"AGENT_IMAGE_PULL_POLICY, parser=string, default="`
57-
AgentImagePullSecrets []core.LocalObjectReference `env:"AGENT_IMAGE_PULL_SECRETS, parser=json-local-refs,default="`
58-
AgentInjectPolicy agentconfig.InjectPolicy `env:"AGENT_INJECT_POLICY, parser=enable-policy, default=Never"`
59-
AgentLogLevel string `env:"AGENT_LOG_LEVEL, parser=logLevel, defaultFrom=LogLevel"`
60-
AgentPort uint16 `env:"AGENT_PORT, parser=port-number, default=0"`
61-
AgentEnableH2cProbing bool `env:"AGENT_ENABLE_H2C_PROBING, parser=bool, default=false"`
62-
AgentResources *core.ResourceRequirements `env:"AGENT_RESOURCES, parser=json-resources, default="`
63-
AgentMountPolicies types.MountPolicies `env:"AGENT_MOUNT_POLICIES, parser=json-mount-policies, default="`
64-
AgentInitResources *core.ResourceRequirements `env:"AGENT_INIT_RESOURCES, parser=json-resources, default="`
65-
AgentInjectorName string `env:"AGENT_INJECTOR_NAME, parser=string, default="`
66-
AgentInjectorSecret string `env:"AGENT_INJECTOR_SECRET, parser=string, default="`
67-
AgentSecurityContext *core.SecurityContext `env:"AGENT_SECURITY_CONTEXT, parser=json-security-context, default="`
68-
AgentInitSecurityContext *core.SecurityContext `env:"AGENT_INIT_SECURITY_CONTEXT, parser=json-security-context, default="`
69-
AgentInitContainerEnabled bool `env:"AGENT_INIT_CONTAINER_ENABLED, parser=bool, default=true"`
70-
AgentMaxIdleTime time.Duration `env:"AGENT_MAX_IDLE_TIME, parser=time.ParseDuration, default=0"`
53+
AgentRegistry string `env:"AGENT_REGISTRY, parser=string, default="`
54+
AgentImageName string `env:"AGENT_IMAGE_NAME, parser=string, default="`
55+
AgentImageTag string `env:"AGENT_IMAGE_TAG, parser=string, default="`
56+
AgentImagePullPolicy string `env:"AGENT_IMAGE_PULL_POLICY, parser=string, default="`
57+
AgentImagePullSecrets []core.LocalObjectReference `env:"AGENT_IMAGE_PULL_SECRETS, parser=json-local-refs,default="`
58+
AgentInjectPolicy agentconfig.InjectPolicy `env:"AGENT_INJECT_POLICY, parser=enable-policy, default=Never"`
59+
AgentLogLevel string `env:"AGENT_LOG_LEVEL, parser=logLevel, defaultFrom=LogLevel"`
60+
AgentPort uint16 `env:"AGENT_PORT, parser=port-number, default=0"`
61+
AgentEnableH2cProbing bool `env:"AGENT_ENABLE_H2C_PROBING, parser=bool, default=false"`
62+
AgentResources *core.ResourceRequirements `env:"AGENT_RESOURCES, parser=json-resources, default="`
63+
AgentMountPolicies types.MountPolicies `env:"AGENT_MOUNT_POLICIES, parser=json-mount-policies, default="`
64+
AgentInitResources *core.ResourceRequirements `env:"AGENT_INIT_RESOURCES, parser=json-resources, default="`
65+
AgentInjectorName string `env:"AGENT_INJECTOR_NAME, parser=string, default="`
66+
AgentInjectorSecret string `env:"AGENT_INJECTOR_SECRET, parser=string, default="`
67+
AgentInjectorMutationAware bool `env:"AGENT_INJECTOR_MUTATION_AWARE, parser=bool, default=false"`
68+
AgentSecurityContext *core.SecurityContext `env:"AGENT_SECURITY_CONTEXT, parser=json-security-context, default="`
69+
AgentInitSecurityContext *core.SecurityContext `env:"AGENT_INIT_SECURITY_CONTEXT, parser=json-security-context, default="`
70+
AgentInitContainerEnabled bool `env:"AGENT_INIT_CONTAINER_ENABLED, parser=bool, default=true"`
71+
AgentMaxIdleTime time.Duration `env:"AGENT_MAX_IDLE_TIME, parser=time.ParseDuration, default=0"`
7172

7273
ClientRoutingAlsoProxySubnets []netip.Prefix `env:"CLIENT_ROUTING_ALSO_PROXY_SUBNETS, parser=split-ipnet, default="`
7374
ClientRoutingNeverProxySubnets []netip.Prefix `env:"CLIENT_ROUTING_NEVER_PROXY_SUBNETS, parser=split-ipnet, default="`

‎cmd/traffic/cmd/manager/mutator/agent_injector.go‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,7 @@ func (a *agentInjector) Inject(ctx context.Context, req *admission.AdmissionRequ
111111

112112
ia := annotation.GetAnnotation(ctx, pod.Annotations, annotation.InjectTrafficAgent, annotation.LegacyInjectTrafficAgent)
113113

114+
var wl k8sapi.Workload
114115
var sc *agentconfig.Sidecar
115116
switch ia {
116117
case "false", "disabled":
@@ -130,7 +131,7 @@ func (a *agentInjector) Inject(ctx context.Context, req *admission.AdmissionRequ
130131
return nil, nil
131132
}
132133

133-
wl, err := agentmap.FindOwnerWorkload(ctx, k8sapi.Pod(pod), env.EnabledWorkloadKinds)
134+
wl, err = agentmap.FindOwnerWorkload(ctx, k8sapi.Pod(pod), env.EnabledWorkloadKinds)
134135
if err != nil {
135136
uwkError := k8sapi.UnsupportedWorkloadKindError("")
136137
switch {
@@ -156,13 +157,20 @@ func (a *agentInjector) Inject(ctx context.Context, req *admission.AdmissionRequ
156157
default:
157158
return nil, fmt.Errorf("invalid value %q for annotation %s", ia, annotation.InjectTrafficAgent)
158159
}
159-
return createPatch(ctx, sc, pod)
160+
161+
podTpl := &core.PodTemplateSpec{ObjectMeta: pod.ObjectMeta}
162+
if env.AgentInjectorMutationAware {
163+
podTpl.Spec = pod.Spec
164+
} else {
165+
podTpl.Spec = wl.GetPodTemplate().Spec
166+
}
167+
return createPatch(ctx, sc, pod, podTpl)
160168
}
161169

162-
func createPatch(ctx context.Context, config *agentconfig.Sidecar, pod *core.Pod) (patches PatchOps, err error) {
170+
func createPatch(ctx context.Context, config *agentconfig.Sidecar, pod *core.Pod, wlTpl *core.PodTemplateSpec) (patches PatchOps, err error) {
163171
var anns map[string]string
164172
patches = addInitContainer(ctx, pod, config, patches)
165-
patches, anns, err = addAgentContainer(ctx, pod, config, patches)
173+
patches, anns, err = addAgentContainer(ctx, pod, wlTpl, config, patches)
166174
if err != nil {
167175
return nil, err
168176
}
@@ -399,12 +407,13 @@ func containerEqual(ctx context.Context, a, b *core.Container) bool {
399407
func addAgentContainer(
400408
ctx context.Context,
401409
pod *core.Pod,
410+
wlTpl *core.PodTemplateSpec,
402411
config *agentconfig.Sidecar,
403412
patches PatchOps,
404413
) (PatchOps, map[string]string, error) {
405414
ab := agentconfig.ContainerBuilder{
406415
MountPolicies: managerutil.GetEnv(ctx).AgentMountPolicies,
407-
Pod: pod,
416+
Pod: wlTpl,
408417
Config: config,
409418
}
410419
acn, replaceAnnotations, err := ab.AgentContainer(ctx)

‎cmd/traffic/cmd/manager/mutator/agent_injector_test.go‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1960,15 +1960,15 @@ matchExpressions:
19601960
ServerHost: "tel-example",
19611961
ServerPort: 8081,
19621962

1963-
ManagerNamespace: "default",
1964-
AgentRegistry: "ghcr.io/telepresenceio",
1965-
AgentImageName: "tel2",
1966-
AgentImageTag: "2.13.3",
1967-
AgentPort: 9900,
1968-
AgentInjectPolicy: agentconfig.WhenEnabled,
1969-
1970-
EnabledWorkloadKinds: k8sapi.Kinds{k8sapi.DeploymentKind, k8sapi.StatefulSetKind, k8sapi.ReplicaSetKind},
1971-
AgentInitContainerEnabled: true,
1963+
ManagerNamespace: "default",
1964+
AgentRegistry: "ghcr.io/telepresenceio",
1965+
AgentImageName: "tel2",
1966+
AgentImageTag: "2.13.3",
1967+
AgentPort: 9900,
1968+
AgentInjectPolicy: agentconfig.WhenEnabled,
1969+
AgentInjectorMutationAware: true,
1970+
AgentInitContainerEnabled: true,
1971+
EnabledWorkloadKinds: k8sapi.Kinds{k8sapi.DeploymentKind, k8sapi.StatefulSetKind, k8sapi.ReplicaSetKind},
19721972
}
19731973
ctx = managerutil.WithEnv(ctx, env)
19741974
if test.envAdditions != nil {

‎docs/release-notes.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,12 @@
22
[comment]: # (Code generated by relnotesgen. DO NOT EDIT.)
33
# <img src="images/logo.png" height="64px"/> Telepresence Release Notes
44
## Version 2.26.0
5+
## <div style="display:flex;"><img src="images/feature.png" alt="feature" style="width:30px;height:fit-content;"/><div style="display:flex;margin-left:7px;">Add ability to exclude or include modifications made by other injectors when injecting the traffic agent.</div></div>
6+
<div style="margin-left: 15px">
7+
8+
The Traffic Agent now has a new configuration option `agentInjector.mutationAware` that can be set to `false` to exclude modifications made by other injectors when injecting the traffic agent. Setting `agentInjector.mutationAware=true` requires `agentInjector.webhook.reinvocationPolicy=IfNeeded`. The default setting is `true`.
9+
</div>
10+
511
## <div style="display:flex;"><img src="images/feature.png" alt="feature" style="width:30px;height:fit-content;"/><div style="display:flex;margin-left:7px;">Add ability to disable the Traffic Agent's HTTP2/Clear-Text probing.</div></div>
612
<div style="margin-left: 15px">
713

‎docs/release-notes.mdx‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,12 @@ import { Note, Title, Body } from '@site/src/components/ReleaseNotes'
88

99
# Telepresence Release Notes
1010
## Version 2.26.0
11+
<Note>
12+
<Title type="feature">Add ability to exclude or include modifications made by other injectors when injecting the traffic agent.</Title>
13+
<Body>
14+
The Traffic Agent now has a new configuration option `agentInjector.mutationAware` that can be set to `false` to exclude modifications made by other injectors when injecting the traffic agent. Setting `agentInjector.mutationAware=true` requires `agentInjector.webhook.reinvocationPolicy=IfNeeded`. The default setting is `true`.
15+
</Body>
16+
</Note>
1117
<Note>
1218
<Title type="feature">Add ability to disable the Traffic Agent's HTTP2/Clear-Text probing.</Title>
1319
<Body>

0 commit comments

Comments
 (0)