Merge pull request #295 from james-milligan/perm-backfill

feat: role binding backfill

Author: james-milligan

docs/permissions.md

@@ -44,7 +44,8 @@ The `proxy-role` definition can be found [here](../config/rbac/auth_proxy_role.y
 ### Flagd Kubernetes Sync
 
 The `flagd-kubernetes-sync` role providers the permission to get, watch and list all `core.openfeature.dev` resources, permitting the kubernetes sync feature in injected `flagd` containers.
-Its definition can be found [here](../config/rbac/flagd_kubernetes_sync_clusterrole.yaml)
+Its definition can be found [here](../config/rbac/flagd_kubernetes_sync_clusterrole.yaml). 
+During startup the operator will backfill permissions to the `flagd-kubernetes-sync` cluster role binding from the current state of the cluster, adding all service accounts from pods with the `core.openfeature.dev/enabled` annotation set to `"true"`, preventing unexpected behavior during upgrades.
 
 | API Group      | Resource | Verbs |
 | ----------- | ----------- | ----------- |

main.go

@@ -17,10 +17,12 @@ limitations under the License.
 package main
 
 import (
+	"context"
 	"flag"
+	"os"
+
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
-	"os"
 
 	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
 	// to ensure that exec-entrypoint and run can make use of them.
@@ -130,6 +132,17 @@ func main() {
 		os.Exit(1)
 	}
 
+	// setup indexer for backfilling permissions on the flagd-kubernetes-sync role binding
+	if err := mgr.GetFieldIndexer().IndexField(
+		context.Background(),
+		&corev1.Pod{},
+		webhooks.OpenFeatureEnabledAnnotationPath,
+		webhooks.OpenFeatureEnabledAnnotationIndex,
+	); err != nil {
+		setupLog.Error(err, "unable to create indexer", "webhook", webhooks.OpenFeatureEnabledAnnotationPath)
+		os.Exit(1)
+	}
+
 	if err = (&controllers.FeatureFlagConfigurationReconciler{
 		Client: mgr.GetClient(),
 		Scheme: mgr.GetScheme(),
@@ -149,7 +162,7 @@ func main() {
 
 	//+kubebuilder:scaffold:builder
 	hookServer := mgr.GetWebhookServer()
-	hookServer.Register("/mutate-v1-pod", &webhook.Admission{Handler: &webhooks.PodMutator{
+	podMutator := &webhooks.PodMutator{
 		FlagDResourceRequirements: corev1.ResourceRequirements{
 			Limits: map[corev1.ResourceName]resource.Quantity{
 				corev1.ResourceCPU:    flagDCpuLimitResource,
@@ -162,7 +175,8 @@ func main() {
 		},
 		Client: mgr.GetClient(),
 		Log:    ctrl.Log.WithName("mutating-pod-webhook"),
-	}})
+	}
+	hookServer.Register("/mutate-v1-pod", &webhook.Admission{Handler: podMutator})
 	hookServer.Register("/validate-v1alpha1-featureflagconfiguration", &webhook.Admission{Handler: &webhooks.FeatureFlagConfigurationValidator{
 		Client: mgr.GetClient(),
 		Log:    ctrl.Log.WithName("validating-featureflagconfiguration-webhook"),
@@ -178,7 +192,19 @@ func main() {
 	}
 
 	setupLog.Info("starting manager")
-	if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {
+	ctx := ctrl.SetupSignalHandler()
+	errChan := make(chan error, 1)
+	go func(chan error) {
+		if err := mgr.Start(ctx); err != nil {
+			errChan <- err
+		}
+	}(errChan)
+
+	setupLog.Info("restoring flagd-kubernetes-sync cluster role binding subjects from current cluster state")
+	// backfill can be handled asynchronously, so we do not need to block via the channel
+	go podMutator.BackfillPermissions(ctx, make(chan struct{}, 1))
+
+	if err := <-errChan; err != nil {
 		setupLog.Error(err, "problem running manager")
 		os.Exit(1)
 	}

webhooks/pod_webhook.go

@@ -8,6 +8,9 @@ import (
 	"os"
 	"reflect"
 	"strings"
+	"time"
+
+	goErr "errors"
 
 	"github.com/go-logr/logr"
 	corev1alpha1 "github.com/open-feature/open-feature-operator/apis/core/v1alpha1"
@@ -16,16 +19,18 @@ import (
 	v1 "k8s.io/api/rbac/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/cache"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 )
 
 // we likely want these to be configurable, eventually
 const (
-	FlagDImagePullPolicy   corev1.PullPolicy = "Always"
-	clusterRoleBindingName string            = "open-feature-operator-flagd-kubernetes-sync"
-	flagdMetricPortEnvVar  string            = "FLAGD_METRICS_PORT"
-	fileSyncMountPath      string            = "/etc/flagd/"
+	FlagDImagePullPolicy             corev1.PullPolicy = "Always"
+	clusterRoleBindingName           string            = "open-feature-operator-flagd-kubernetes-sync"
+	flagdMetricPortEnvVar            string            = "FLAGD_METRICS_PORT"
+	fileSyncMountPath                string            = "/etc/flagd/"
+	OpenFeatureEnabledAnnotationPath                   = "metadata.annotations.openfeature.dev/enabled"
 )
 
 var FlagDTag = "main"
@@ -47,6 +52,47 @@ type PodMutator struct {
 	Log                       logr.Logger
 }
 
+// BackfillPermissions recovers the state of the flagd-kubernetes-sync role binding in the event of upgrade
+func (m *PodMutator) BackfillPermissions(ctx context.Context, backfillComplete chan struct{}) {
+	defer func() {
+		backfillComplete <- struct{}{}
+	}()
+
+	for i := 0; i < 5; i++ {
+		// fetch all pods with the "openfeature.dev/enabled" annotation set to "true"
+		podList := &corev1.PodList{}
+		err := m.Client.List(ctx, podList, client.MatchingFields{OpenFeatureEnabledAnnotationPath: "true"})
+		if err != nil {
+			if !goErr.Is(err, &cache.ErrCacheNotStarted{}) {
+				m.Log.Error(err, "unable to list annotated pods", "webhook", OpenFeatureEnabledAnnotationPath)
+				return
+			}
+			time.Sleep(1 * time.Second)
+			continue
+		}
+
+		// add each new service account to the flagd-kubernetes-sync role binding
+		for _, pod := range podList.Items {
+			m.Log.V(1).Info(fmt.Sprintf("backfilling permissions for pod %s/%s", pod.Namespace, pod.Name))
+			if err := m.enableClusterRoleBinding(ctx, &pod); err != nil {
+				m.Log.Error(
+					err,
+					fmt.Sprintf("unable backfill permissions for pod %s/%s", pod.Namespace, pod.Name),
+					"webhook",
+					OpenFeatureEnabledAnnotationPath,
+				)
+			}
+		}
+		return
+	}
+	err := goErr.New("unable to backfill permissions for the flagd-kubernetes-sync role binding: timeout")
+	m.Log.Error(
+		err,
+		"webhook",
+		OpenFeatureEnabledAnnotationPath,
+	)
+}
+
 // Handle injects the flagd sidecar (if the prerequisites are all met)
 func (m *PodMutator) Handle(ctx context.Context, req admission.Request) admission.Response {
 	defer func() {
@@ -383,3 +429,27 @@ func setSecurityContext() *corev1.SecurityContext {
 		},
 	}
 }
+
+func OpenFeatureEnabledAnnotationIndex(o client.Object) []string {
+	pod := o.(*corev1.Pod)
+	if pod.ObjectMeta.Annotations == nil {
+		return []string{
+			"false",
+		}
+	}
+	val, ok := pod.ObjectMeta.Annotations["openfeature.dev/enabled"]
+	if ok && val == "true" {
+		return []string{
+			"true",
+		}
+	}
+	val, ok = pod.ObjectMeta.Annotations["openfeature.dev"]
+	if ok && val == "enabled" {
+		return []string{
+			"true",
+		}
+	}
+	return []string{
+		"false",
+	}
+}