Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handle incompatible automount token setting In service account YAML #5549

Merged
merged 6 commits into from
Feb 12, 2021
Merged

Handle incompatible automount token setting In service account YAML #5549

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
f13c3b7
potential fix for #4651
jimil749 Jan 15, 2021
ce4526c
added a new check for service account mount in data-plane checks
jimil749 Jan 21, 2021
4260092
update test
jimil749 Jan 22, 2021
6ff76c0
more test update
jimil749 Jan 22, 2021
6feb72d
update: revert sa check to report.go
jimil749 Feb 2, 2021
1f2106a
test: added stub container with volume mount
jimil749 Feb 3, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions cli/cmd/inject.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -309,6 +309,7 @@ func (resourceTransformerInject) generateReport(reports []inject.Report, output
if len(automountServiceAccountTokenFalse) == 0 && verbose {
output.Write([]byte(fmt.Sprintf("%s %s\n", okStatus, automountServiceAccountTokenDesc)))
}

//
// Summary
//
Expand Down
5 changes: 5 additions & 0 deletions pkg/inject/report.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,11 @@ func newReport(conf *ResourceConfig) *Report {
if conf.pod.spec.AutomountServiceAccountToken != nil {
report.AutomountServiceAccountToken = *conf.pod.spec.AutomountServiceAccountToken
}
if conf.origin == OriginWebhook {
if vm := conf.serviceAccountVolumeMount(); vm == nil {
report.AutomountServiceAccountToken = false
}
}
} else if report.Kind != k8s.Namespace {
report.UnsupportedResource = true
}
Expand Down
119 changes: 112 additions & 7 deletions pkg/inject/report_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,18 @@ func TestInjectable(t *testing.T) {
reasons []string
}{
{
podSpec: &corev1.PodSpec{HostNetwork: false},
podSpec: &corev1.PodSpec{
HostNetwork: false,
Containers: []corev1.Container{
{
VolumeMounts: []corev1.VolumeMount{
{
MountPath: k8s.MountPathServiceAccount,
},
},
},
},
},
podMeta: &metav1.ObjectMeta{
Annotations: map[string]string{
k8s.ProxyInjectAnnotation: k8s.ProxyInjectEnabled,
Expand All @@ -28,7 +39,18 @@ func TestInjectable(t *testing.T) {
injectable: true,
},
{
podSpec: &corev1.PodSpec{HostNetwork: true},
podSpec: &corev1.PodSpec{
HostNetwork: true,
Containers: []corev1.Container{
{
VolumeMounts: []corev1.VolumeMount{
{
MountPath: k8s.MountPathServiceAccount,
},
},
},
},
},
podMeta: &metav1.ObjectMeta{
Annotations: map[string]string{
k8s.ProxyInjectAnnotation: k8s.ProxyInjectEnabled,
Expand All @@ -43,6 +65,11 @@ func TestInjectable(t *testing.T) {
{
Name: k8s.ProxyContainerName,
Image: "ghcr.io/linkerd/proxy:",
VolumeMounts: []corev1.VolumeMount{
{
MountPath: k8s.MountPathServiceAccount,
},
},
},
},
},
Expand All @@ -62,6 +89,15 @@ func TestInjectable(t *testing.T) {
Image: "ghcr.io/linkerd/proxy-init:",
},
},
Containers: []corev1.Container{
{
VolumeMounts: []corev1.VolumeMount{
{
MountPath: k8s.MountPathServiceAccount,
},
},
},
},
},
podMeta: &metav1.ObjectMeta{
Annotations: map[string]string{
Expand All @@ -73,7 +109,17 @@ func TestInjectable(t *testing.T) {
},
{
unsupportedResource: true,
podSpec: &corev1.PodSpec{},
podSpec: &corev1.PodSpec{
Containers: []corev1.Container{
{
VolumeMounts: []corev1.VolumeMount{
{
MountPath: k8s.MountPathServiceAccount,
},
},
},
},
},
podMeta: &metav1.ObjectMeta{
Annotations: map[string]string{
k8s.ProxyInjectAnnotation: k8s.ProxyInjectEnabled,
Expand All @@ -84,7 +130,18 @@ func TestInjectable(t *testing.T) {
},
{
unsupportedResource: true,
podSpec: &corev1.PodSpec{HostNetwork: true},
podSpec: &corev1.PodSpec{
HostNetwork: true,
Containers: []corev1.Container{
{
VolumeMounts: []corev1.VolumeMount{
{
MountPath: k8s.MountPathServiceAccount,
},
},
},
},
},
podMeta: &metav1.ObjectMeta{
Annotations: map[string]string{
k8s.ProxyInjectAnnotation: k8s.ProxyInjectEnabled,
Expand All @@ -98,7 +155,18 @@ func TestInjectable(t *testing.T) {
nsAnnotations: map[string]string{
k8s.ProxyInjectAnnotation: k8s.ProxyInjectEnabled,
},
podSpec: &corev1.PodSpec{HostNetwork: true},
podSpec: &corev1.PodSpec{
HostNetwork: true,
Containers: []corev1.Container{
{
VolumeMounts: []corev1.VolumeMount{
{
MountPath: k8s.MountPathServiceAccount,
},
},
},
},
},
podMeta: &metav1.ObjectMeta{
Annotations: map[string]string{
k8s.ProxyInjectAnnotation: k8s.ProxyInjectDisabled,
Expand All @@ -113,7 +181,18 @@ func TestInjectable(t *testing.T) {
k8s.ProxyInjectAnnotation: k8s.ProxyInjectEnabled,
},
unsupportedResource: true,
podSpec: &corev1.PodSpec{HostNetwork: true},
podSpec: &corev1.PodSpec{
HostNetwork: true,
Containers: []corev1.Container{
{
VolumeMounts: []corev1.VolumeMount{
{
MountPath: k8s.MountPathServiceAccount,
},
},
},
},
},
podMeta: &metav1.ObjectMeta{
Annotations: map[string]string{
k8s.ProxyInjectAnnotation: k8s.ProxyInjectDisabled,
Expand All @@ -125,7 +204,18 @@ func TestInjectable(t *testing.T) {
},
{
unsupportedResource: true,
podSpec: &corev1.PodSpec{HostNetwork: true},
podSpec: &corev1.PodSpec{
HostNetwork: true,
Containers: []corev1.Container{
{
VolumeMounts: []corev1.VolumeMount{
{
MountPath: k8s.MountPathServiceAccount,
},
},
},
},
},
podMeta: &metav1.ObjectMeta{
Annotations: map[string]string{},
},
Expand All @@ -139,6 +229,11 @@ func TestInjectable(t *testing.T) {
{
Name: k8s.ProxyContainerName,
Image: "ghcr.io/linkerd/proxy:",
VolumeMounts: []corev1.VolumeMount{
{
MountPath: k8s.MountPathServiceAccount,
},
},
},
}},
podMeta: &metav1.ObjectMeta{
Expand All @@ -148,6 +243,16 @@ func TestInjectable(t *testing.T) {
injectable: false,
reasons: []string{hostNetworkEnabled, sidecarExists, injectEnableAnnotationAbsent},
},
{
podSpec: &corev1.PodSpec{},
podMeta: &metav1.ObjectMeta{
Annotations: map[string]string{
k8s.ProxyInjectAnnotation: k8s.ProxyInjectEnabled,
},
},
injectable: false,
reasons: []string{disabledAutomountServiceAccountToken},
},
}

for i, testCase := range testCases {
Expand Down