Initial release (#2)

Co-authored-by: Santiago Núñez-Cacho <[email protected]>
Co-authored-by: Riccardo Piccoli <[email protected]>

.gitignore

@@ -0,0 +1,5 @@
+ssl/*.csr
+ssl/*.key
+ssl/*.pem
+manifest.yaml
+chart/node-policy-webhook/secret.values.yaml

Dockerfile

@@ -0,0 +1,15 @@
+FROM golang:1.14-buster AS build
+
+ENV GOBIN=$GOPATH/bin
+
+ADD . /src/node-policy-webhook
+
+WORKDIR /src/node-policy-webhook
+
+RUN make build
+
+FROM debian:buster-slim
+
+COPY --from=build /src/node-policy-webhook/node-policy-webhook /node-policy-webhook
+
+ENTRYPOINT ["/node-policy-webhook"]

Makefile

@@ -0,0 +1,106 @@
+BIN := node-policy-webhook
+CRD_OPTIONS ?= "crd:trivialVersions=true"
+PKG := github.com/softonic/node-policy-webhook
+VERSION := 0.1.0-dev
+ARCH := amd64
+APP := node-policy-webhook
+NAMESPACE := default
+RELEASE_NAME := node-policy-webhook
+KO_DOCKER_REPO = registry.softonic.io/node-policy-webhook
+
+IMAGE := $(BIN)
+
+BUILD_IMAGE ?= golang:1.14-buster
+
+
+deploy-prod: export IMAGE_GEN = "github.com/softonic/node-policy-webhook/cmd/node-policy-webhook"
+
+deploy:  export IMAGE_GEN = $(APP):$(VERSION)
+
+
+.PHONY: all
+all: dev
+
+.PHONY: build
+build: generate
+	go mod download
+	GOARCH=${ARCH} go build -ldflags "-X ${PKG}/pkg/version.Version=${VERSION}" ./cmd/node-policy-webhook/.../
+
+.PHONY: test
+test:
+	GOARCH=${ARCH} go test -v -ldflags "-X ${PKG}/pkg/version.Version=${VERSION}" ./...
+
+.PHONY: image
+image:
+	docker build -t $(IMAGE):$(VERSION) -f Dockerfile .
+	docker tag $(IMAGE):$(VERSION) $(IMAGE):latest
+
+.PHONY: dev
+dev: image
+	kind load docker-image $(IMAGE):$(VERSION)
+
+.PHONY: undeploy
+undeploy:
+	kubectl delete -f manifest.yaml || true
+
+.PHONY: deploy
+deploy: manifest
+	kubectl apply -f manifest.yaml
+
+.PHONY: up
+up: image undeploy deploy
+
+.PHONY: docker-push
+docker-push:
+	docker push $(IMAGE):$(VERSION)
+	docker push $(IMAGE):latest
+
+.PHONY: version
+version:
+	@echo $(VERSION)
+
+.PHONY: secret-values
+secret-values:
+	./hack/generate_helm_cert_secrets $(APP) $(NAMESPACE)
+
+.PHONY: manifest
+manifest: controller-gen helm-chart secret-values
+	docker run --rm -v $(PWD):/app -w /app/ alpine/helm:3.2.3 template --release-name $(RELEASE_NAME) --set "image.tag=$(VERSION)" -f chart/node-policy-webhook/values.yaml -f chart/node-policy-webhook/secret.values.yaml chart/node-policy-webhook > manifest.yaml
+
+.PHONY: helm-chart
+helm-chart: controller-gen
+	$(CONTROLLER_GEN) $(CRD_OPTIONS) webhook paths="./..." output:crd:artifacts:config=chart/node-policy-webhook/templates
+
+.PHONY: helm-deploy
+helm-deploy: helm-chart secret-values
+	helm upgrade --install $(RELEASE_NAME) --namespace $(NAMESPACE) --set "image.tag=$(VERSION)" -f chart/node-policy-webhook/values.yaml -f chart/node-policy-webhook/secret.values.yaml chart/node-policy-webhook
+
+.PHONY: generate
+generate: controller-gen
+	$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..."
+
+# Run go fmt against code
+fmt:
+	go fmt ./...
+
+# Run go vet against code
+vet:
+	go vet ./...
+
+# find or download controller-gen
+# download controller-gen if necessary
+.PHONY: controller-gen
+controller-gen:
+ifeq (, $(shell which controller-gen))
+	@{ \
+	set -e ;\
+	CONTROLLER_GEN_TMP_DIR=$$(mktemp -d) ;\
+	cd $$CONTROLLER_GEN_TMP_DIR ;\
+	go mod init tmp ;\
+	go get sigs.k8s.io/controller-tools/cmd/[email protected] ;\
+	rm -rf $$CONTROLLER_GEN_TMP_DIR ;\
+	}
+CONTROLLER_GEN=$(GOBIN)/controller-gen
+else
+CONTROLLER_GEN=$(shell which controller-gen)
+endif

README.md

@@ -1,2 +1,89 @@
 # node-policy-webhook
 K8s webhook handling profiles for tolerations, nodeSelector and nodeAffinity
+
+
+## DEVEL ENVIRONMENT
+
+### Requirements
+
+Install kind
+
+```bash
+curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.8.1/kind-$\(uname\)-amd64
+mv kind-darwin-amd64 /usr/local/bin/kind
+```
+
+
+```bash
+
+make dev
+make deploy
+```
+
+Now you can run a pod to test it
+
+
+# Motivation
+
+
+The goal of Node Policy Webhook is to reduce Kubernetes manifests complexity by 
+moving the logic behind the scheduling ( when assigning pods to nodes ) 
+to a unique place where the cluster's operator/admin can handle it. 
+
+This is accomplished with a new mutating webhook and new CRD where you can place all the node scheduling intelligente 
+in the form of profiles.
+
+In this new CRD, you can set different "profiles" depending on the nodes or VMs provision on your cluster.
+
+When doing that, you can remove all the tolterations,nodeSelectors and nodeAffinities from your 
+manifests' workloads ( like Deployments, DaemonSets, StatefulSets ..)
+
+If you are running Knative in your cluster, this project can help you. At the time this is being writen, 
+there is no way you can schedule knative workloads ( in the form of ksvc ) to a desired node or vm 
+as it does not implement tolerations neither nodeSelectors.
+
+
+Example:
+
+You hace an specific deployment, but you'd like these pods to be scheduled in nodes  with label disk=ssd
+
+So first step is to create an object of type 
+
+```
+apiVersion: noodepolicies.softonic.io/v1alpha1
+kind: NodePolicyProfile
+metadata:
+  name: ssd
+spec:
+  nodeSelector:
+    disk: "ssd"
+```
+
+
+Now you just need to deploy these pods setting this annotation in your deployment
+
+```
+nodepolicy.softonic.io/profile: "ssd"
+```
+
+In deployment time, the mutating webhook will replace the nodeSelector with the nodeSelector above mentioned.
+
+
+### Caveats
+
+
+* If your workload already has a nodeSelector defined, mutating webhook will remove it.
+* If your workload already has tolerations defined, mutating webhook will keep them.
+* If your workload already has Affinities defined, it will keep the podAntiAffinities and podAffinities 
+and will remove the nodeAffinities 
+
+
+
+
+
+```
+Assigning pods to nodes:
+
+You can constrain a Pod to only be able to run on particular Node(s), or to prefer to run on particular nodes. There are several ways to do this, and the recommended approaches all use label selectors to make the selection. Generally such constraints are unnecessary, as the scheduler will automatically do a reasonable placement (e.g. spread your pods across nodes, not place the pod on a node with insufficient free resources, etc.) but there are some circumstances where you may want more control on a node where a pod lands, for example to ensure that a pod ends up on a machine with an SSD attached to it, or to co-locate pods from two different services that communicate a lot into the same availability zone.
+
+```

api/v1alpha1/groupversion_info.go

@@ -0,0 +1,36 @@
+/*
+
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package v1 contains API Schema definitions for the noodepolicies v1 API group
+// +kubebuilder:object:generate=true
+// +groupName=noodepolicies.softonic.io
+package v1alpha1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/scheme"
+)
+
+var (
+	// GroupVersion is group version used to register these objects
+	GroupVersion = schema.GroupVersion{Group: "noodepolicies.softonic.io", Version: "v1alpha1"}
+
+	// SchemeBuilder is used to add go types to the GroupVersionKind scheme
+	SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
+
+	// AddToScheme adds the types in this group-version to the given scheme.
+	AddToScheme = SchemeBuilder.AddToScheme
+)

api/v1alpha1/nodepolicyprofile_types.go

@@ -0,0 +1,63 @@
+/*
+
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
+// NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.
+
+// NodePolicyProfileSpec defines the desired state of NodePolicyProfile
+type NodePolicyProfileSpec struct {
+	Tolerations  []corev1.Toleration `json:"tolerations,omitempty"`
+	NodeAffinity corev1.NodeAffinity `json:"nodeAffinity,omitempty"`
+	NodeSelector map[string]string   `json:"nodeSelector,omitempty"`
+}
+
+// NodePolicyProfileStatus defines the observed state of NodePolicyProfile
+type NodePolicyProfileStatus struct {
+	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
+	// Important: Run "make" to regenerate code after modifying this file
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:resource:scope=Cluster
+
+// NodePolicyProfile is the Schema for the nodepolicyprofiles API
+type NodePolicyProfile struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   NodePolicyProfileSpec   `json:"spec,omitempty"`
+	Status NodePolicyProfileStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// NodePolicyProfileList contains a list of NodePolicyProfile
+type NodePolicyProfileList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []NodePolicyProfile `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&NodePolicyProfile{}, &NodePolicyProfileList{})
+}