YuzuZensai/netbird-kubernetes-operator
1
0
Fork 0
mirror of https://github.com/YuzuZensai/netbird-kubernetes-operator.git synced 2026-09-13 10:49:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Refactor uninstallation process (#74)

Browse Source 
Docs PR: https://github.com/netbirdio/docs/pull/457

Changes:
* Split kubernetes-operator Chart to operator only chart
(kubernetes-operator) and configuration chart (netbird-operator-config)
* Remove delete validation webhooks for non-needed resources
* Allow abandoning Groups when still linked to a resource for over a
minute after deletion
* Fix duplciate Network Resource retrying heavily
* Fix SetupKey creation duplication
* Skip deleting routing peer since deleting network automatically
deletes it anyway
This commit is contained in:
M. Essam
2025-11-25 20:36:17 +02:00
committed by GitHub
parent 6c855c5d4e
commit f1b131be7d
31 changed files with 580 additions and 721 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/webhook/v1/nbresource_webhook.go
-72
View File
@@ -1,72 +0,0 @@
package v1
import (
"context"
"fmt"
corev1 "k8s.io/api/core/v1"
"k8s.io/apimachinery/pkg/api/errors"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/types"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/client"
logf "sigs.k8s.io/controller-runtime/pkg/log"
"sigs.k8s.io/controller-runtime/pkg/webhook"
"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
netbirdiov1 "github.com/netbirdio/kubernetes-operator/api/v1"
"github.com/netbirdio/kubernetes-operator/internal/controller"
)
// nolint:unused
// log is for logging in this package.
var nbresourcelog = logf.Log.WithName("nbresource-resource")
// SetupNBResourceWebhookWithManager registers the webhook for NBResource in the manager.
func SetupNBResourceWebhookWithManager(mgr ctrl.Manager) error {
return ctrl.NewWebhookManagedBy(mgr).For(&netbirdiov1.NBResource{}).
WithValidator(&NBResourceCustomValidator{client: mgr.GetClient()}).
Complete()
}
// NBResourceCustomValidator struct is responsible for validating the NBResource resource
// when it is created, updated, or deleted.
type NBResourceCustomValidator struct {
client client.Client
}
var _ webhook.CustomValidator = &NBResourceCustomValidator{}
// ValidateCreate implements webhook.CustomValidator so a webhook will be registered for the type NBResource.
func (v *NBResourceCustomValidator) ValidateCreate(ctx context.Context, obj runtime.Object) (admission.Warnings, error) {
return nil, nil
}
// ValidateUpdate implements webhook.CustomValidator so a webhook will be registered for the type NBResource.
func (v *NBResourceCustomValidator) ValidateUpdate(ctx context.Context, oldObj, newObj runtime.Object) (admission.Warnings, error) {
return nil, nil
}
// ValidateDelete implements webhook.CustomValidator so a webhook will be registered for the type NBResource.
func (v *NBResourceCustomValidator) ValidateDelete(ctx context.Context, obj runtime.Object) (admission.Warnings, error) {
nbresource, ok := obj.(*netbirdiov1.NBResource)
if !ok {
return nil, fmt.Errorf("expected a NBResource object but got %T", obj)
}
nbresourcelog.Info("Validation for NBResource upon deletion", "name", nbresource.GetName())
var svc corev1.Service
err := v.client.Get(ctx, types.NamespacedName{Namespace: nbresource.Namespace, Name: nbresource.Name}, &svc)
if errors.IsNotFound(err) {
return nil, nil
}
if err != nil {
return nil, err
}
if _, ok := svc.Annotations[controller.ServiceExposeAnnotation]; ok && svc.DeletionTimestamp == nil {
return nil, fmt.Errorf("service %s/%s still has netbird.io/expose annotation", svc.Namespace, svc.Name)
}
return nil, nil
}
internal/webhook/v1/nbresource_webhook_test.go
-122
View File
@@ -1,122 +0,0 @@
package v1
import (
. "github.com/onsi/ginkgo/v2"
. "github.com/onsi/gomega"
corev1 "k8s.io/api/core/v1"
"k8s.io/apimachinery/pkg/api/errors"
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/types"
"k8s.io/apimachinery/pkg/util/intstr"
netbirdiov1 "github.com/netbirdio/kubernetes-operator/api/v1"
)
var _ = Describe("NBResource Webhook", func() {
var (
obj *netbirdiov1.NBResource
oldObj *netbirdiov1.NBResource
validator NBResourceCustomValidator
)
BeforeEach(func() {
obj = &netbirdiov1.NBResource{}
oldObj = &netbirdiov1.NBResource{}
validator = NBResourceCustomValidator{
client: k8sClient,
}
})
Context("When creating or updating NBResource under Validating Webhook", func() {
It("should allow creation", func() {
Expect(validator.ValidateCreate(ctx, obj)).Error().NotTo(HaveOccurred())
})
It("should allow update", func() {
Expect(validator.ValidateUpdate(ctx, oldObj, obj)).Error().NotTo(HaveOccurred())
})
When("No services are exposed", func() {
BeforeEach(func() {
obj.Name = "maw"
obj.Namespace = "default"
svc := &corev1.Service{
ObjectMeta: v1.ObjectMeta{
Name: "ne",
Namespace: "default",
},
Spec: corev1.ServiceSpec{
Ports: []corev1.ServicePort{
{
Protocol: corev1.ProtocolTCP,
Port: 80,
TargetPort: intstr.FromInt32(80),
},
},
},
}
Expect(k8sClient.Create(ctx, svc)).To(Succeed())
})
AfterEach(func() {
svc := &netbirdiov1.NBResource{}
err := k8sClient.Get(ctx, types.NamespacedName{Namespace: "default", Name: "ne"}, svc)
if !errors.IsNotFound(err) {
Expect(err).NotTo(HaveOccurred())
if len(svc.Finalizers) > 0 {
svc.Finalizers = nil
Expect(k8sClient.Update(ctx, svc)).To(Succeed())
}
err = k8sClient.Delete(ctx, svc)
if !errors.IsNotFound(err) {
Expect(err).NotTo(HaveOccurred())
}
}
})
It("should allow deletion", func() {
Expect(validator.ValidateDelete(ctx, obj)).Error().NotTo(HaveOccurred())
})
})
When("A service is exposed", func() {
BeforeEach(func() {
obj.Name = "maw"
obj.Namespace = "default"
svc := &corev1.Service{
ObjectMeta: v1.ObjectMeta{
Name: "maw",
Namespace: "default",
Annotations: map[string]string{
"netbird.io/expose": "true",
},
},
Spec: corev1.ServiceSpec{
Ports: []corev1.ServicePort{
{
Protocol: corev1.ProtocolTCP,
Port: 80,
TargetPort: intstr.FromInt32(80),
},
},
},
}
Expect(k8sClient.Create(ctx, svc)).To(Succeed())
})
AfterEach(func() {
svc := &corev1.Service{}
err := k8sClient.Get(ctx, types.NamespacedName{Namespace: "default", Name: "maw"}, svc)
if !errors.IsNotFound(err) {
Expect(err).NotTo(HaveOccurred())
if len(svc.Finalizers) > 0 {
svc.Finalizers = nil
Expect(k8sClient.Update(ctx, svc)).To(Succeed())
}
err = k8sClient.Delete(ctx, svc)
if !errors.IsNotFound(err) {
Expect(err).NotTo(HaveOccurred())
}
}
})
It("should deny deletion", func() {
Expect(validator.ValidateDelete(ctx, obj)).Error().To(HaveOccurred())
})
})
})
})
internal/webhook/v1/nbroutingpeer_webhook.go
-76
View File
@@ -1,76 +0,0 @@
package v1
import (
"context"
"fmt"
"k8s.io/apimachinery/pkg/runtime"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/client"
logf "sigs.k8s.io/controller-runtime/pkg/log"
"sigs.k8s.io/controller-runtime/pkg/webhook"
"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
netbirdiov1 "github.com/netbirdio/kubernetes-operator/api/v1"
)
// nolint:unused
// log is for logging in this package.
var nbroutingpeerlog = logf.Log.WithName("nbroutingpeer-resource")
// SetupNBRoutingPeerWebhookWithManager registers the webhook for NBRoutingPeer in the manager.
func SetupNBRoutingPeerWebhookWithManager(mgr ctrl.Manager) error {
return ctrl.NewWebhookManagedBy(mgr).For(&netbirdiov1.NBRoutingPeer{}).
WithValidator(&NBRoutingPeerCustomValidator{client: mgr.GetClient()}).
Complete()
}
// NBRoutingPeerCustomValidator struct is responsible for validating the NBRoutingPeer resource
// when it is created, updated, or deleted.
type NBRoutingPeerCustomValidator struct {
client client.Client
}
var _ webhook.CustomValidator = &NBRoutingPeerCustomValidator{}
// ValidateCreate implements webhook.CustomValidator so a webhook will be registered for the type NBRoutingPeer.
func (v *NBRoutingPeerCustomValidator) ValidateCreate(ctx context.Context, obj runtime.Object) (admission.Warnings, error) {
return nil, nil
}
// ValidateUpdate implements webhook.CustomValidator so a webhook will be registered for the type NBRoutingPeer.
func (v *NBRoutingPeerCustomValidator) ValidateUpdate(ctx context.Context, oldObj, newObj runtime.Object) (admission.Warnings, error) {
return nil, nil
}
// ValidateDelete implements webhook.CustomValidator so a webhook will be registered for the type NBRoutingPeer.
func (v *NBRoutingPeerCustomValidator) ValidateDelete(ctx context.Context, obj runtime.Object) (admission.Warnings, error) {
nbroutingpeer, ok := obj.(*netbirdiov1.NBRoutingPeer)
if !ok {
return nil, fmt.Errorf("expected a NBRoutingPeer object but got %T", obj)
}
nbroutingpeerlog.Info("Validation for NBRoutingPeer upon deletion", "name", nbroutingpeer.GetName())
if nbroutingpeer.Status.NetworkID == nil {
return nil, nil
}
var nbResources netbirdiov1.NBResourceList
err := v.client.List(ctx, &nbResources)
if err != nil {
return nil, err
}
resourceValidator := &NBResourceCustomValidator{client: v.client}
for _, r := range nbResources.Items {
if r.Spec.NetworkID == *nbroutingpeer.Status.NetworkID {
_, err = resourceValidator.ValidateDelete(ctx, &r)
if err != nil {
return nil, err
}
}
}
return nil, nil
}
internal/webhook/v1/nbroutingpeer_webhook_test.go
-242
View File
@@ -1,242 +0,0 @@
package v1
import (
. "github.com/onsi/ginkgo/v2"
. "github.com/onsi/gomega"
corev1 "k8s.io/api/core/v1"
"k8s.io/apimachinery/pkg/api/errors"
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/types"
"k8s.io/apimachinery/pkg/util/intstr"
netbirdiov1 "github.com/netbirdio/kubernetes-operator/api/v1"
"github.com/netbirdio/kubernetes-operator/internal/util"
)
var _ = Describe("NBRoutingPeer Webhook", func() {
var (
obj *netbirdiov1.NBRoutingPeer
oldObj *netbirdiov1.NBRoutingPeer
validator NBRoutingPeerCustomValidator
)
BeforeEach(func() {
obj = &netbirdiov1.NBRoutingPeer{}
oldObj = &netbirdiov1.NBRoutingPeer{}
validator = NBRoutingPeerCustomValidator{
client: k8sClient,
}
})
Context("When creating or updating NBRoutingPeer under Validating Webhook", func() {
It("should allow creation", func() {
Expect(validator.ValidateCreate(ctx, obj)).Error().NotTo(HaveOccurred())
})
It("should allow update", func() {
Expect(validator.ValidateUpdate(ctx, oldObj, obj)).Error().NotTo(HaveOccurred())
})
When("No NBResources Exist", func() {
It("should allow deletion", func() {
Expect(validator.ValidateDelete(ctx, obj)).Error().NotTo(HaveOccurred())
})
})
When("Deleteable NBResources Exist", func() {
BeforeEach(func() {
nbResource := &netbirdiov1.NBResource{
ObjectMeta: v1.ObjectMeta{
Name: "isexist",
Namespace: "default",
},
Spec: netbirdiov1.NBResourceSpec{
Name: "test1",
NetworkID: "test2",
Address: "test3",
Groups: []string{"test"},
},
}
Expect(k8sClient.Create(ctx, nbResource)).To(Succeed())
obj = &netbirdiov1.NBRoutingPeer{
Status: netbirdiov1.NBRoutingPeerStatus{
NetworkID: util.Ptr("test2"),
},
}
})
AfterEach(func() {
nbResource := &netbirdiov1.NBResource{}
err := k8sClient.Get(ctx, types.NamespacedName{Namespace: "default", Name: "isexist"}, nbResource)
if !errors.IsNotFound(err) {
Expect(err).NotTo(HaveOccurred())
if len(nbResource.Finalizers) > 0 {
nbResource.Finalizers = nil
Expect(k8sClient.Update(ctx, nbResource)).To(Succeed())
}
err = k8sClient.Delete(ctx, nbResource)
if !errors.IsNotFound(err) {
Expect(err).NotTo(HaveOccurred())
}
}
})
It("should allow deletion", func() {
Expect(validator.ValidateDelete(ctx, obj)).Error().NotTo(HaveOccurred())
})
})
When("Exposed Services for Network Exist", func() {
BeforeEach(func() {
nbResource := &netbirdiov1.NBResource{
ObjectMeta: v1.ObjectMeta{
Name: "maw",
Namespace: "default",
},
Spec: netbirdiov1.NBResourceSpec{
Name: "test1",
NetworkID: "test2",
Address: "test3",
Groups: []string{"test"},
},
}
Expect(k8sClient.Create(ctx, nbResource)).To(Succeed())
svc := &corev1.Service{
ObjectMeta: v1.ObjectMeta{
Name: "maw",
Namespace: "default",
Annotations: map[string]string{
"netbird.io/expose": "true",
},
},
Spec: corev1.ServiceSpec{
Ports: []corev1.ServicePort{
{
Protocol: corev1.ProtocolTCP,
Port: 80,
TargetPort: intstr.FromInt32(80),
},
},
},
}
Expect(k8sClient.Create(ctx, svc)).To(Succeed())
obj = &netbirdiov1.NBRoutingPeer{
Status: netbirdiov1.NBRoutingPeerStatus{
NetworkID: util.Ptr("test2"),
},
}
})
AfterEach(func() {
nbResource := &netbirdiov1.NBResource{}
err := k8sClient.Get(ctx, types.NamespacedName{Namespace: "default", Name: "maw"}, nbResource)
if !errors.IsNotFound(err) {
Expect(err).NotTo(HaveOccurred())
if len(nbResource.Finalizers) > 0 {
nbResource.Finalizers = nil
Expect(k8sClient.Update(ctx, nbResource)).To(Succeed())
}
err = k8sClient.Delete(ctx, nbResource)
if !errors.IsNotFound(err) {
Expect(err).NotTo(HaveOccurred())
}
}
svc := &corev1.Service{}
err = k8sClient.Get(ctx, types.NamespacedName{Namespace: "default", Name: "maw"}, svc)
if !errors.IsNotFound(err) {
Expect(err).NotTo(HaveOccurred())
if len(svc.Finalizers) > 0 {
svc.Finalizers = nil
Expect(k8sClient.Update(ctx, svc)).To(Succeed())
}
err = k8sClient.Delete(ctx, svc)
if !errors.IsNotFound(err) {
Expect(err).NotTo(HaveOccurred())
}
}
})
It("should deny deletion", func() {
Expect(validator.ValidateDelete(ctx, obj)).Error().To(HaveOccurred())
})
})
When("Exposed NBResources do not belong to network", func() {
BeforeEach(func() {
nbResource := &netbirdiov1.NBResource{
ObjectMeta: v1.ObjectMeta{
Name: "maw",
Namespace: "default",
},
Spec: netbirdiov1.NBResourceSpec{
Name: "test1",
NetworkID: "test5",
Address: "test3",
Groups: []string{"test"},
},
}
Expect(k8sClient.Create(ctx, nbResource)).To(Succeed())
svc := &corev1.Service{
ObjectMeta: v1.ObjectMeta{
Name: "maw",
Namespace: "default",
Annotations: map[string]string{
"netbird.io/expose": "true",
},
},
Spec: corev1.ServiceSpec{
Ports: []corev1.ServicePort{
{
Protocol: corev1.ProtocolTCP,
Port: 80,
TargetPort: intstr.FromInt32(80),
},
},
},
}
Expect(k8sClient.Create(ctx, svc)).To(Succeed())
obj = &netbirdiov1.NBRoutingPeer{
Status: netbirdiov1.NBRoutingPeerStatus{
NetworkID: util.Ptr("test2"),
},
}
})
AfterEach(func() {
nbResource := &netbirdiov1.NBResource{}
err := k8sClient.Get(ctx, types.NamespacedName{Namespace: "default", Name: "maw"}, nbResource)
if !errors.IsNotFound(err) {
Expect(err).NotTo(HaveOccurred())
if len(nbResource.Finalizers) > 0 {
nbResource.Finalizers = nil
Expect(k8sClient.Update(ctx, nbResource)).To(Succeed())
}
err = k8sClient.Delete(ctx, nbResource)
if !errors.IsNotFound(err) {
Expect(err).NotTo(HaveOccurred())
}
}
svc := &corev1.Service{}
err = k8sClient.Get(ctx, types.NamespacedName{Namespace: "default", Name: "maw"}, svc)
if !errors.IsNotFound(err) {
Expect(err).NotTo(HaveOccurred())
if len(svc.Finalizers) > 0 {
svc.Finalizers = nil
Expect(k8sClient.Update(ctx, svc)).To(Succeed())
}
err = k8sClient.Delete(ctx, svc)
if !errors.IsNotFound(err) {
Expect(err).NotTo(HaveOccurred())
}
}
})
It("should allow deletion", func() {
Expect(validator.ValidateDelete(ctx, obj)).Error().NotTo(HaveOccurred())
})
})
})
})
internal/webhook/v1/webhook_suite_test.go
-6
View File
@@ -124,12 +124,6 @@ var _ = BeforeSuite(func() {
err = SetupNBSetupKeyWebhookWithManager(mgr)
Expect(err).NotTo(HaveOccurred())
err = SetupNBResourceWebhookWithManager(mgr)
Expect(err).NotTo(HaveOccurred())
err = SetupNBRoutingPeerWebhookWithManager(mgr)
Expect(err).NotTo(HaveOccurred())
err = SetupNBGroupWebhookWithManager(mgr)
Expect(err).NotTo(HaveOccurred())