Skip to content

Commit b86e725

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request kubernetes#91785 from mattcary/filtereddial
Specify a DialContext in storage plugin clients
2 parents e929f2f + 299a296 commit b86e725

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

57 files changed

+585
-73
lines changed

‎api/api-rules/violation_exceptions.list‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -370,6 +370,7 @@ API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1beta1,Po
370370
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1beta1,PolicyRule,Verbs
371371
API rule violation: list_type_missing,k8s.io/kube-controller-manager/config/v1alpha1,GarbageCollectorControllerConfiguration,GCIgnoredResources
372372
API rule violation: list_type_missing,k8s.io/kube-controller-manager/config/v1alpha1,GenericControllerManagerConfiguration,Controllers
373+
API rule violation: list_type_missing,k8s.io/kube-controller-manager/config/v1alpha1,PersistentVolumeBinderControllerConfiguration,VolumeHostCIDRDenylist
373374
API rule violation: list_type_missing,k8s.io/kube-proxy/config/v1alpha1,KubeProxyConfiguration,NodePortAddresses
374375
API rule violation: list_type_missing,k8s.io/kube-proxy/config/v1alpha1,KubeProxyIPVSConfiguration,ExcludeCIDRs
375376
API rule violation: list_type_missing,k8s.io/kube-scheduler/config/v1,ExtenderTLSConfig,CAData
@@ -569,6 +570,8 @@ API rule violation: names_match,k8s.io/kube-controller-manager/config/v1alpha1,N
569570
API rule violation: names_match,k8s.io/kube-controller-manager/config/v1alpha1,NodeLifecycleControllerConfiguration,UnhealthyZoneThreshold
570571
API rule violation: names_match,k8s.io/kube-controller-manager/config/v1alpha1,PersistentVolumeBinderControllerConfiguration,PVClaimBinderSyncPeriod
571572
API rule violation: names_match,k8s.io/kube-controller-manager/config/v1alpha1,PersistentVolumeBinderControllerConfiguration,VolumeConfiguration
573+
API rule violation: names_match,k8s.io/kube-controller-manager/config/v1alpha1,PersistentVolumeBinderControllerConfiguration,VolumeHostAllowLocalLoopback
574+
API rule violation: names_match,k8s.io/kube-controller-manager/config/v1alpha1,PersistentVolumeBinderControllerConfiguration,VolumeHostCIDRDenylist
572575
API rule violation: names_match,k8s.io/kube-controller-manager/config/v1alpha1,PersistentVolumeRecyclerConfiguration,IncrementTimeoutHostPath
573576
API rule violation: names_match,k8s.io/kube-controller-manager/config/v1alpha1,PersistentVolumeRecyclerConfiguration,IncrementTimeoutNFS
574577
API rule violation: names_match,k8s.io/kube-controller-manager/config/v1alpha1,PersistentVolumeRecyclerConfiguration,MaximumRetry

‎cmd/kube-controller-manager/app/core.go‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ import (
4343
servicecontroller "k8s.io/cloud-provider/controllers/service"
4444
"k8s.io/component-base/metrics/prometheus/ratelimiter"
4545
csitrans "k8s.io/csi-translation-lib"
46+
"k8s.io/kubernetes/cmd/kube-controller-manager/app/options"
4647
"k8s.io/kubernetes/pkg/controller"
4748
endpointcontroller "k8s.io/kubernetes/pkg/controller/endpoint"
4849
"k8s.io/kubernetes/pkg/controller/garbagecollector"
@@ -285,6 +286,12 @@ func startPersistentVolumeBinderController(ctx ControllerContext) (http.Handler,
285286
if err != nil {
286287
return nil, true, fmt.Errorf("failed to probe volume plugins when starting persistentvolume controller: %v", err)
287288
}
289+
filteredDialOptions, err := options.ParseVolumeHostFilters(
290+
ctx.ComponentConfig.PersistentVolumeBinderController.VolumeHostCIDRDenylist,
291+
ctx.ComponentConfig.PersistentVolumeBinderController.VolumeHostAllowLocalLoopback)
292+
if err != nil {
293+
return nil, true, err
294+
}
288295
params := persistentvolumecontroller.ControllerParameters{
289296
KubeClient: ctx.ClientBuilder.ClientOrDie("persistent-volume-binder"),
290297
SyncPeriod: ctx.ComponentConfig.PersistentVolumeBinderController.PVClaimBinderSyncPeriod.Duration,
@@ -297,6 +304,7 @@ func startPersistentVolumeBinderController(ctx ControllerContext) (http.Handler,
297304
PodInformer: ctx.InformerFactory.Core().V1().Pods(),
298305
NodeInformer: ctx.InformerFactory.Core().V1().Nodes(),
299306
EnableDynamicProvisioning: ctx.ComponentConfig.PersistentVolumeBinderController.VolumeConfiguration.EnableDynamicProvisioning,
307+
FilteredDialOptions: filteredDialOptions,
300308
}
301309
volumeController, volumeControllerErr := persistentvolumecontroller.NewController(params)
302310
if volumeControllerErr != nil {
@@ -324,6 +332,13 @@ func startAttachDetachController(ctx ControllerContext) (http.Handler, bool, err
324332
return nil, true, fmt.Errorf("failed to probe volume plugins when starting attach/detach controller: %v", err)
325333
}
326334

335+
filteredDialOptions, err := options.ParseVolumeHostFilters(
336+
ctx.ComponentConfig.PersistentVolumeBinderController.VolumeHostCIDRDenylist,
337+
ctx.ComponentConfig.PersistentVolumeBinderController.VolumeHostAllowLocalLoopback)
338+
if err != nil {
339+
return nil, true, err
340+
}
341+
327342
attachDetachController, attachDetachControllerErr :=
328343
attachdetach.NewAttachDetachController(
329344
ctx.ClientBuilder.ClientOrDie("attachdetach-controller"),
@@ -340,6 +355,7 @@ func startAttachDetachController(ctx ControllerContext) (http.Handler, bool, err
340355
ctx.ComponentConfig.AttachDetachController.DisableAttachDetachReconcilerSync,
341356
ctx.ComponentConfig.AttachDetachController.ReconcilerSyncLoopPeriod.Duration,
342357
attachdetach.DefaultTimerConfig,
358+
filteredDialOptions,
343359
)
344360
if attachDetachControllerErr != nil {
345361
return nil, true, fmt.Errorf("failed to start attach/detach controller: %v", attachDetachControllerErr)
@@ -355,6 +371,12 @@ func startVolumeExpandController(ctx ControllerContext) (http.Handler, bool, err
355371
return nil, true, fmt.Errorf("failed to probe volume plugins when starting volume expand controller: %v", err)
356372
}
357373
csiTranslator := csitrans.New()
374+
filteredDialOptions, err := options.ParseVolumeHostFilters(
375+
ctx.ComponentConfig.PersistentVolumeBinderController.VolumeHostCIDRDenylist,
376+
ctx.ComponentConfig.PersistentVolumeBinderController.VolumeHostAllowLocalLoopback)
377+
if err != nil {
378+
return nil, true, err
379+
}
358380
expandController, expandControllerErr := expand.NewExpandController(
359381
ctx.ClientBuilder.ClientOrDie("expand-controller"),
360382
ctx.InformerFactory.Core().V1().PersistentVolumeClaims(),
@@ -363,7 +385,9 @@ func startVolumeExpandController(ctx ControllerContext) (http.Handler, bool, err
363385
ctx.Cloud,
364386
plugins,
365387
csiTranslator,
366-
csimigration.NewPluginManager(csiTranslator))
388+
csimigration.NewPluginManager(csiTranslator),
389+
filteredDialOptions,
390+
)
367391

368392
if expandControllerErr != nil {
369393
return nil, true, fmt.Errorf("failed to start volume expand controller: %v", expandControllerErr)

‎cmd/kube-controller-manager/app/options/BUILD‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ go_library(
6363
"//pkg/controller/volume/attachdetach/config:go_default_library",
6464
"//pkg/controller/volume/persistentvolume/config:go_default_library",
6565
"//pkg/features:go_default_library",
66+
"//pkg/proxy/util:go_default_library",
6667
"//staging/src/k8s.io/api/core/v1:go_default_library",
6768
"//staging/src/k8s.io/apimachinery/pkg/util/errors:go_default_library",
6869
"//staging/src/k8s.io/apiserver/pkg/server/options:go_default_library",
@@ -78,6 +79,7 @@ go_library(
7879
"//staging/src/k8s.io/component-base/metrics:go_default_library",
7980
"//staging/src/k8s.io/kube-controller-manager/config/v1alpha1:go_default_library",
8081
"//vendor/github.com/spf13/pflag:go_default_library",
82+
"//vendor/k8s.io/utils/net:go_default_library",
8183
],
8284
)
8385

‎cmd/kube-controller-manager/app/options/options_test.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,8 @@ var args = []string{
100100
"--enable-taint-manager=false",
101101
"--cluster-signing-duration=10h",
102102
"--flex-volume-plugin-dir=/flex-volume-plugin",
103+
"--volume-host-cidr-denylist=127.0.0.1/28,feed::/16",
104+
"--volume-host-allow-local-loopback=false",
103105
"--horizontal-pod-autoscaler-downscale-delay=2m",
104106
"--horizontal-pod-autoscaler-sync-period=45s",
105107
"--horizontal-pod-autoscaler-upscale-delay=1m",
@@ -350,6 +352,8 @@ func TestAddFlags(t *testing.T) {
350352
IncrementTimeoutHostPath: 45,
351353
},
352354
},
355+
VolumeHostCIDRDenylist: []string{"127.0.0.1/28", "feed::/16"},
356+
VolumeHostAllowLocalLoopback: false,
353357
},
354358
},
355359
PodGCController: &PodGCControllerOptions{
@@ -589,6 +593,8 @@ func TestApplyTo(t *testing.T) {
589593
IncrementTimeoutHostPath: 45,
590594
},
591595
},
596+
VolumeHostCIDRDenylist: []string{"127.0.0.1/28", "feed::/16"},
597+
VolumeHostAllowLocalLoopback: false,
592598
},
593599
PodGCController: podgcconfig.PodGCControllerConfiguration{
594600
TerminatedPodGCThreshold: 12000,

‎cmd/kube-controller-manager/app/options/persistentvolumebindercontroller.go‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,13 @@ limitations under the License.
1717
package options
1818

1919
import (
20+
"fmt"
21+
2022
"github.com/spf13/pflag"
2123

2224
persistentvolumeconfig "k8s.io/kubernetes/pkg/controller/volume/persistentvolume/config"
25+
proxyutil "k8s.io/kubernetes/pkg/proxy/util"
26+
netutils "k8s.io/utils/net"
2327
)
2428

2529
// PersistentVolumeBinderControllerOptions holds the PersistentVolumeBinderController options.
@@ -43,6 +47,8 @@ func (o *PersistentVolumeBinderControllerOptions) AddFlags(fs *pflag.FlagSet) {
4347
fs.BoolVar(&o.VolumeConfiguration.EnableHostPathProvisioning, "enable-hostpath-provisioner", o.VolumeConfiguration.EnableHostPathProvisioning, "Enable HostPath PV provisioning when running without a cloud provider. This allows testing and development of provisioning features. HostPath provisioning is not supported in any way, won't work in a multi-node cluster, and should not be used for anything other than testing or development.")
4448
fs.BoolVar(&o.VolumeConfiguration.EnableDynamicProvisioning, "enable-dynamic-provisioning", o.VolumeConfiguration.EnableDynamicProvisioning, "Enable dynamic provisioning for environments that support it.")
4549
fs.StringVar(&o.VolumeConfiguration.FlexVolumePluginDir, "flex-volume-plugin-dir", o.VolumeConfiguration.FlexVolumePluginDir, "Full path of the directory in which the flex volume plugin should search for additional third party volume plugins.")
50+
fs.StringSliceVar(&o.VolumeHostCIDRDenylist, "volume-host-cidr-denylist", o.VolumeHostCIDRDenylist, "A comma-separated list of CIDR ranges to avoid from volume plugins.")
51+
fs.BoolVar(&o.VolumeHostAllowLocalLoopback, "volume-host-allow-local-loopback", o.VolumeHostAllowLocalLoopback, "If false, deny local loopback IPs in addition to any CIDR ranges in --volume-host-cidr-denylist")
4652
}
4753

4854
// ApplyTo fills up PersistentVolumeBinderController config with options.
@@ -53,6 +59,8 @@ func (o *PersistentVolumeBinderControllerOptions) ApplyTo(cfg *persistentvolumec
5359

5460
cfg.PVClaimBinderSyncPeriod = o.PVClaimBinderSyncPeriod
5561
cfg.VolumeConfiguration = o.VolumeConfiguration
62+
cfg.VolumeHostCIDRDenylist = o.VolumeHostCIDRDenylist
63+
cfg.VolumeHostAllowLocalLoopback = o.VolumeHostAllowLocalLoopback
5664

5765
return nil
5866
}
@@ -64,5 +72,17 @@ func (o *PersistentVolumeBinderControllerOptions) Validate() []error {
6472
}
6573

6674
errs := []error{}
75+
if _, err := ParseVolumeHostFilters(o.VolumeHostCIDRDenylist, o.VolumeHostAllowLocalLoopback); err != nil {
76+
errs = append(errs, fmt.Errorf("Bad --volume-host-ip-denylist/--volume-host-allow-local-loopback %w", err))
77+
}
6778
return errs
6879
}
80+
81+
// ParseVolumeHostFilters process the --volume-host-ip-denylist and --volume-host-allow-local-loopback flags.
82+
func ParseVolumeHostFilters(denylist []string, allowLocalLoopback bool) (*proxyutil.FilteredDialOptions, error) {
83+
denyCIDRs, err := netutils.ParseCIDRs(denylist)
84+
if err != nil {
85+
return nil, err
86+
}
87+
return &proxyutil.FilteredDialOptions{DialHostCIDRDenylist: denyCIDRs, AllowLocalLoopback: allowLocalLoopback}, nil
88+
}

‎go.mod‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ require (
9191
github.com/spf13/jwalterweatherman v1.1.0 // indirect
9292
github.com/spf13/pflag v1.0.5
9393
github.com/spf13/viper v1.4.0
94-
github.com/storageos/go-api v0.0.0-20180912212459-343b3eff91fc
94+
github.com/storageos/go-api v2.2.0+incompatible
9595
github.com/stretchr/testify v1.4.0
9696
github.com/thecodeteam/goscaleio v0.1.0
9797
github.com/urfave/negroni v1.0.0 // indirect
@@ -397,7 +397,7 @@ replace (
397397
github.com/spf13/jwalterweatherman => github.com/spf13/jwalterweatherman v1.1.0
398398
github.com/spf13/pflag => github.com/spf13/pflag v1.0.5
399399
github.com/spf13/viper => github.com/spf13/viper v1.4.0
400-
github.com/storageos/go-api => github.com/storageos/go-api v0.0.0-20180912212459-343b3eff91fc
400+
github.com/storageos/go-api => github.com/storageos/go-api v2.2.0+incompatible
401401
github.com/stretchr/objx => github.com/stretchr/objx v0.2.0
402402
github.com/stretchr/testify => github.com/stretchr/testify v1.4.0
403403
github.com/syndtr/gocapability => github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -436,8 +436,8 @@ github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
436436
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
437437
github.com/spf13/viper v1.4.0 h1:yXHLWeravcrgGyFSyCgdYpXQ9dR9c/WED3pg1RhxqEU=
438438
github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE=
439-
github.com/storageos/go-api v0.0.0-20180912212459-343b3eff91fc h1:n+WYaU0kQ6WIiuEyWSgbXqkBx16irO69kYCtwVYoO5s=
440-
github.com/storageos/go-api v0.0.0-20180912212459-343b3eff91fc/go.mod h1:ZrLn+e0ZuF3Y65PNF6dIwbJPZqfmtCXxFm9ckv0agOY=
439+
github.com/storageos/go-api v2.2.0+incompatible h1:U0SablXoZIg06gvSlg8BCdzq1C/SkHVygOVX95Z2MU0=
440+
github.com/storageos/go-api v2.2.0+incompatible/go.mod h1:ZrLn+e0ZuF3Y65PNF6dIwbJPZqfmtCXxFm9ckv0agOY=
441441
github.com/stretchr/objx v0.2.0 h1:Hbg2NidpLE8veEBkEZTL3CvlkUIVzuU9jDplZO54c48=
442442
github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
443443
github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=

‎pkg/controller/apis/config/zz_generated.deepcopy.go‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/controller/volume/attachdetach/BUILD‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ go_library(
1919
"//pkg/controller/volume/attachdetach/util:go_default_library",
2020
"//pkg/controller/volume/common:go_default_library",
2121
"//pkg/features:go_default_library",
22+
"//pkg/proxy/util:go_default_library",
2223
"//pkg/volume:go_default_library",
2324
"//pkg/volume/csimigration:go_default_library",
2425
"//pkg/volume/util:go_default_library",

‎pkg/controller/volume/attachdetach/attach_detach_controller.go‎

Lines changed: 23 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ import (
5555
"k8s.io/kubernetes/pkg/controller/volume/attachdetach/util"
5656
"k8s.io/kubernetes/pkg/controller/volume/common"
5757
"k8s.io/kubernetes/pkg/features"
58+
proxyutil "k8s.io/kubernetes/pkg/proxy/util"
5859
"k8s.io/kubernetes/pkg/volume"
5960
"k8s.io/kubernetes/pkg/volume/csimigration"
6061
volumeutil "k8s.io/kubernetes/pkg/volume/util"
@@ -117,21 +118,23 @@ func NewAttachDetachController(
117118
prober volume.DynamicPluginProber,
118119
disableReconciliationSync bool,
119120
reconcilerSyncDuration time.Duration,
120-
timerConfig TimerConfig) (AttachDetachController, error) {
121+
timerConfig TimerConfig,
122+
filteredDialOptions *proxyutil.FilteredDialOptions) (AttachDetachController, error) {
121123

122124
adc := &attachDetachController{
123-
kubeClient: kubeClient,
124-
pvcLister: pvcInformer.Lister(),
125-
pvcsSynced: pvcInformer.Informer().HasSynced,
126-
pvLister: pvInformer.Lister(),
127-
pvsSynced: pvInformer.Informer().HasSynced,
128-
podLister: podInformer.Lister(),
129-
podsSynced: podInformer.Informer().HasSynced,
130-
podIndexer: podInformer.Informer().GetIndexer(),
131-
nodeLister: nodeInformer.Lister(),
132-
nodesSynced: nodeInformer.Informer().HasSynced,
133-
cloud: cloud,
134-
pvcQueue: workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "pvcs"),
125+
kubeClient: kubeClient,
126+
pvcLister: pvcInformer.Lister(),
127+
pvcsSynced: pvcInformer.Informer().HasSynced,
128+
pvLister: pvInformer.Lister(),
129+
pvsSynced: pvInformer.Informer().HasSynced,
130+
podLister: podInformer.Lister(),
131+
podsSynced: podInformer.Informer().HasSynced,
132+
podIndexer: podInformer.Informer().GetIndexer(),
133+
nodeLister: nodeInformer.Lister(),
134+
nodesSynced: nodeInformer.Informer().HasSynced,
135+
cloud: cloud,
136+
pvcQueue: workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "pvcs"),
137+
filteredDialOptions: filteredDialOptions,
135138
}
136139

137140
if utilfeature.DefaultFeatureGate.Enabled(features.CSIMigration) &&
@@ -313,6 +316,9 @@ type attachDetachController struct {
313316

314317
// intreeToCSITranslator translates from in-tree volume specs to CSI
315318
intreeToCSITranslator csimigration.InTreeToCSITranslator
319+
320+
// filteredDialOptions configures any dialing done by the controller.
321+
filteredDialOptions *proxyutil.FilteredDialOptions
316322
}
317323

318324
func (adc *attachDetachController) Run(stopCh <-chan struct{}) {
@@ -813,6 +819,10 @@ func (adc *attachDetachController) GetSubpather() subpath.Interface {
813819
return nil
814820
}
815821

822+
func (adc *attachDetachController) GetFilteredDialOptions() *proxyutil.FilteredDialOptions {
823+
return adc.filteredDialOptions
824+
}
825+
816826
func (adc *attachDetachController) GetCSIDriverLister() storagelistersv1.CSIDriverLister {
817827
return adc.csiDriverLister
818828
}

0 commit comments

Comments
 (0)