Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Respect allow/deny lists even when namespaces aren't enabled #297

Merged
merged 1 commit into from
Jul 21, 2020
Merged

Respect allow/deny lists even when namespaces aren't enabled #297

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
## UNRELEASED

BUG FIXES:

* Connect: Respect allow/deny list flags when namespaces are disabled. [[GH-296](https://github.com/hashicorp/consul-k8s/issues/296)]

## 0.17.0 (July 09, 2020)

BREAKING CHANGES:
Expand Down
16 changes: 7 additions & 9 deletions connect-inject/handler.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -382,16 +382,14 @@ func (h *Handler) shouldInject(pod *corev1.Pod, namespace string) (bool, error)
}

// Namespace logic
if h.EnableNamespaces {
// If in deny list, don't inject
if h.DenyK8sNamespacesSet.Contains(namespace) {
return false, nil
}
// If in deny list, don't inject
if h.DenyK8sNamespacesSet.Contains(namespace) {
return false, nil
}

// If not in allow list or allow list is not *, don't inject
if !h.AllowK8sNamespacesSet.Contains("*") && !h.AllowK8sNamespacesSet.Contains(namespace) {
return false, nil
}
// If not in allow list or allow list is not *, don't inject
if !h.AllowK8sNamespacesSet.Contains("*") && !h.AllowK8sNamespacesSet.Contains(namespace) {
return false, nil
}

// If we already injected then don't inject again
Expand Down
178 changes: 166 additions & 12 deletions connect-inject/handler_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,11 @@ func TestHandlerHandle(t *testing.T) {
}{
{
"kube-system namespace",
Handler{Log: hclog.Default().Named("handler")},
Handler{
Log: hclog.Default().Named("handler"),
AllowK8sNamespacesSet: mapset.NewSetWith("*"),
DenyK8sNamespacesSet: mapset.NewSet(),
},
v1beta1.AdmissionRequest{
Namespace: metav1.NamespaceSystem,
Object: encodeRaw(t, &corev1.Pod{
Expand All @@ -47,7 +51,11 @@ func TestHandlerHandle(t *testing.T) {

{
"already injected",
Handler{Log: hclog.Default().Named("handler")},
Handler{
Log: hclog.Default().Named("handler"),
AllowK8sNamespacesSet: mapset.NewSetWith("*"),
DenyK8sNamespacesSet: mapset.NewSet(),
},
v1beta1.AdmissionRequest{
Object: encodeRaw(t, &corev1.Pod{
ObjectMeta: metav1.ObjectMeta{
Expand All @@ -65,7 +73,11 @@ func TestHandlerHandle(t *testing.T) {

{
"empty pod basic",
Handler{Log: hclog.Default().Named("handler")},
Handler{
Log: hclog.Default().Named("handler"),
AllowK8sNamespacesSet: mapset.NewSetWith("*"),
DenyK8sNamespacesSet: mapset.NewSet(),
},
v1beta1.AdmissionRequest{
Object: encodeRaw(t, &corev1.Pod{
Spec: basicSpec,
Expand Down Expand Up @@ -102,7 +114,11 @@ func TestHandlerHandle(t *testing.T) {

{
"pod with upstreams specified",
Handler{Log: hclog.Default().Named("handler")},
Handler{
Log: hclog.Default().Named("handler"),
AllowK8sNamespacesSet: mapset.NewSetWith("*"),
DenyK8sNamespacesSet: mapset.NewSet(),
},
v1beta1.AdmissionRequest{
Object: encodeRaw(t, &corev1.Pod{
ObjectMeta: metav1.ObjectMeta{
Expand Down Expand Up @@ -161,7 +177,11 @@ func TestHandlerHandle(t *testing.T) {

{
"empty pod with injection disabled",
Handler{Log: hclog.Default().Named("handler")},
Handler{
Log: hclog.Default().Named("handler"),
AllowK8sNamespacesSet: mapset.NewSetWith("*"),
DenyK8sNamespacesSet: mapset.NewSet(),
},
v1beta1.AdmissionRequest{
Object: encodeRaw(t, &corev1.Pod{
ObjectMeta: metav1.ObjectMeta{
Expand All @@ -179,7 +199,11 @@ func TestHandlerHandle(t *testing.T) {

{
"empty pod with injection truthy",
Handler{Log: hclog.Default().Named("handler")},
Handler{
Log: hclog.Default().Named("handler"),
AllowK8sNamespacesSet: mapset.NewSetWith("*"),
DenyK8sNamespacesSet: mapset.NewSet(),
},
v1beta1.AdmissionRequest{
Object: encodeRaw(t, &corev1.Pod{
ObjectMeta: metav1.ObjectMeta{
Expand Down Expand Up @@ -222,7 +246,13 @@ func TestHandlerHandle(t *testing.T) {

{
"empty pod basic, no default protocol",
Handler{WriteServiceDefaults: true, DefaultProtocol: "", Log: hclog.Default().Named("handler")},
Handler{
WriteServiceDefaults: true,
DefaultProtocol: "",
Log: hclog.Default().Named("handler"),
AllowK8sNamespacesSet: mapset.NewSetWith("*"),
DenyK8sNamespacesSet: mapset.NewSet(),
},
v1beta1.AdmissionRequest{
Object: encodeRaw(t, &corev1.Pod{
Spec: basicSpec,
Expand Down Expand Up @@ -260,7 +290,12 @@ func TestHandlerHandle(t *testing.T) {

{
"empty pod basic, protocol in annotation",
Handler{WriteServiceDefaults: true, Log: hclog.Default().Named("handler")},
Handler{
WriteServiceDefaults: true,
Log: hclog.Default().Named("handler"),
AllowK8sNamespacesSet: mapset.NewSetWith("*"),
DenyK8sNamespacesSet: mapset.NewSet(),
},
v1beta1.AdmissionRequest{
Object: encodeRaw(t, &corev1.Pod{
Spec: basicSpec,
Expand Down Expand Up @@ -299,7 +334,13 @@ func TestHandlerHandle(t *testing.T) {

{
"empty pod basic, default protocol specified",
Handler{WriteServiceDefaults: true, DefaultProtocol: "http", Log: hclog.Default().Named("handler")},
Handler{
WriteServiceDefaults: true,
DefaultProtocol: "http",
Log: hclog.Default().Named("handler"),
AllowK8sNamespacesSet: mapset.NewSetWith("*"),
DenyK8sNamespacesSet: mapset.NewSet(),
},
v1beta1.AdmissionRequest{
Object: encodeRaw(t, &corev1.Pod{
Spec: basicSpec,
Expand Down Expand Up @@ -369,7 +410,11 @@ func TestHandlerHandle_badContentType(t *testing.T) {
require.NoError(t, err)
req.Header.Set("Content-Type", "text/plain")

h := Handler{Log: hclog.Default().Named("handler")}
h := Handler{
Log: hclog.Default().Named("handler"),
AllowK8sNamespacesSet: mapset.NewSetWith("*"),
DenyK8sNamespacesSet: mapset.NewSet(),
}
rec := httptest.NewRecorder()
h.Handle(rec, req)
require.Equal(t, http.StatusBadRequest, rec.Code)
Expand All @@ -382,7 +427,11 @@ func TestHandlerHandle_noBody(t *testing.T) {
require.NoError(t, err)
req.Header.Set("Content-Type", "application/json")

h := Handler{Log: hclog.Default().Named("handler")}
h := Handler{
Log: hclog.Default().Named("handler"),
AllowK8sNamespacesSet: mapset.NewSetWith("*"),
DenyK8sNamespacesSet: mapset.NewSet(),
}
rec := httptest.NewRecorder()
h.Handle(rec, req)
require.Equal(t, http.StatusBadRequest, rec.Code)
Expand Down Expand Up @@ -789,7 +838,7 @@ func TestShouldInject(t *testing.T) {
false,
},
{
"namespaces disabled",
"namespaces disabled, empty allow/deny lists",
&corev1.Pod{
ObjectMeta: metav1.ObjectMeta{
Annotations: map[string]string{
Expand All @@ -801,8 +850,113 @@ func TestShouldInject(t *testing.T) {
false,
mapset.NewSet(),
mapset.NewSet(),
false,
},
{
"namespaces disabled, allow *",
&corev1.Pod{
ObjectMeta: metav1.ObjectMeta{
Annotations: map[string]string{
annotationService: "testing",
},
},
},
"default",
false,
mapset.NewSetWith("*"),
mapset.NewSet(),
true,
},
{
"namespaces disabled, allow default",
&corev1.Pod{
ObjectMeta: metav1.ObjectMeta{
Annotations: map[string]string{
annotationService: "testing",
},
},
},
"default",
false,
mapset.NewSetWith("default"),
mapset.NewSet(),
true,
},
{
"namespaces disabled, allow * and default",
&corev1.Pod{
ObjectMeta: metav1.ObjectMeta{
Annotations: map[string]string{
annotationService: "testing",
},
},
},
"default",
false,
mapset.NewSetWith("*", "default"),
mapset.NewSet(),
true,
},
{
"namespaces disabled, allow only ns1 and ns2",
&corev1.Pod{
ObjectMeta: metav1.ObjectMeta{
Annotations: map[string]string{
annotationService: "testing",
},
},
},
"default",
false,
mapset.NewSetWith("ns1", "ns2"),
mapset.NewSet(),
false,
},
{
"namespaces disabled, deny default ns",
&corev1.Pod{
ObjectMeta: metav1.ObjectMeta{
Annotations: map[string]string{
annotationService: "testing",
},
},
},
"default",
false,
mapset.NewSet(),
mapset.NewSetWith("default"),
false,
},
{
"namespaces disabled, allow *, deny default ns",
&corev1.Pod{
ObjectMeta: metav1.ObjectMeta{
Annotations: map[string]string{
annotationService: "testing",
},
},
},
"default",
false,
mapset.NewSetWith("*"),
mapset.NewSetWith("default"),
false,
},
{
"namespaces disabled, default ns in both allow and deny lists",
&corev1.Pod{
ObjectMeta: metav1.ObjectMeta{
Annotations: map[string]string{
annotationService: "testing",
},
},
},
"default",
false,
mapset.NewSetWith("default"),
mapset.NewSetWith("default"),
false,
},
{
"namespaces enabled, empty allow/deny lists",
&corev1.Pod{
Expand Down