Skip to content

Commit

Permalink
Add annotation filter to Ambassador Host Source
Browse files Browse the repository at this point in the history 
This change makes the Ambassador Host source respect the External-DNS annotationFilter allowing for an Ambassador Host resource to specify what External-DNS deployment to use when there are multiple External-DNS deployments within the same cluster. Before this change if you had two External-DNS deployments within the cluster and used the Ambassador Host source the first External-DNS to process the resource will create the record and not the one that was specified in the filter annotation.

I added the `filterByAnnotations` function so that it matched the same way the other sources have implemented annotation filtering. I didn't add the controller check only because I wanted to keep this change to implementing the annotationFilter.

Example: Create two External-DNS deployments 1 public and 1 private and set the Ambassador Host to use the public External-DNS using the annotation filter.

```
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: external-dns-private
spec:
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: external-dns-private
  template:
    metadata:
      labels:
        app: external-dns-private
      annotations:
        iam.amazonaws.com/role: {ARN} # AWS ARN role
    spec:
      serviceAccountName: external-dns
      containers:
      - name: external-dns
        image: k8s.gcr.io/external-dns/external-dns:latest
        args:
        - --source=ambassador-host
        - --domain-filter=example.net # will make ExternalDNS see only the hosted zones matching provided domain, omit to process all available hosted zones
        - --provider=aws
        - --policy=upsert-only # would prevent ExternalDNS from deleting any records, omit to enable full synchronization
        - --aws-zone-type=private # only look at public hosted zones (valid values are public, private or no value for both)
        - --registry=txt
        - --txt-owner-id= {Hosted Zone ID} # Insert Route53 Hosted Zone ID here
        - --annotation-filter=kubernetes.io/ingress.class in (private)
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: external-dns-public
spec:
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: external-dns-public
  template:
    metadata:
      labels:
        app: external-dns-public
      annotations:
        iam.amazonaws.com/role: {ARN} # AWS ARN role
    spec:
      serviceAccountName: external-dns
      containers:
      - name: external-dns
        image: k8s.gcr.io/external-dns/external-dns:latest
        args:
        - --source=ambassador-host
        - --domain-filter=example.net # will make ExternalDNS see only the hosted zones matching provided domain, omit to process all available hosted zones
        - --provider=aws
        - --policy=upsert-only # would prevent ExternalDNS from deleting any records, omit to enable full synchronization
        - --aws-zone-type= # only look at public hosted zones (valid values are public, private or no value for both)
        - --registry=txt
        - --txt-owner-id= {Hosted Zone ID} # Insert Route53 Hosted Zone ID here
        - --annotation-filter=kubernetes.io/ingress.class in (public)
---
apiVersion: getambassador.io/v3alpha1
  kind: Host
  metadata:
    name: your-hostname
    annotations:
      external-dns.ambassador-service: emissary-ingress/emissary
      kubernetes.io/ingress.class: public
  spec:
		acmeProvider:
      authority: none
		hostname: your-hostname.example.com
```

Fixes #2632
  • Loading branch information
@KyleMartin901
KyleMartin901 committed Aug 28, 2024
1 parent cb89c0e commit f0f718a
Show file tree
Hide file tree
Showing 3 changed files with 150 additions and 8 deletions.
50 changes: 49 additions & 1 deletion source/ambassador_host.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,7 @@ type ambassadorHostSource struct {
dynamicKubeClient dynamic.Interface
kubeClient kubernetes.Interface
namespace string
annotationFilter string
ambassadorHostInformer informers.GenericInformer
unstructuredConverter *unstructuredConverter
}
Expand All @@ -67,6 +68,7 @@ func NewAmbassadorHostSource(
dynamicKubeClient dynamic.Interface,
kubeClient kubernetes.Interface,
namespace string,
annotationFilter string,
) (Source, error) {
var err error

Expand All @@ -85,6 +87,7 @@ func NewAmbassadorHostSource(

informerFactory.Start(ctx.Done())

// wait for the local cache to be populated.
if err := waitForDynamicCacheSync(context.Background(), informerFactory); err != nil {
return nil, err
}
Expand All @@ -98,6 +101,7 @@ func NewAmbassadorHostSource(
dynamicKubeClient: dynamicKubeClient,
kubeClient: kubeClient,
namespace: namespace,
annotationFilter: annotationFilter,
ambassadorHostInformer: ambassadorHostInformer,
unstructuredConverter: uc,
}, nil
Expand All @@ -111,7 +115,8 @@ func (sc *ambassadorHostSource) Endpoints(ctx context.Context) ([]*endpoint.Endp
return nil, err
}

endpoints := []*endpoint.Endpoint{}
// Get a list of Ambassador Host resources
ambassadorHosts := []*ambassador.Host{}
for _, hostObj := range hosts {
unstructuredHost, ok := hostObj.(*unstructured.Unstructured)
if !ok {
Expand All @@ -123,7 +128,18 @@ func (sc *ambassadorHostSource) Endpoints(ctx context.Context) ([]*endpoint.Endp
if err != nil {
return nil, err
}
ambassadorHosts = append(ambassadorHosts, host)
}

// Filter Ambassador Hosts
ambassadorHosts, err = sc.filterByAnnotations(ambassadorHosts)
if err != nil {
return nil, errors.Wrap(err, "failed to filter Ambassador Hosts by annotation")
}

endpoints := []*endpoint.Endpoint{}

for _, host := range ambassadorHosts {
fullname := fmt.Sprintf("%s/%s", host.Namespace, host.Name)

// look for the "exernal-dns.ambassador-service" annotation. If it is not there then just ignore this `Host`
Expand Down Expand Up @@ -269,3 +285,35 @@ func newUnstructuredConverter() (*unstructuredConverter, error) {

return uc, nil
}

// Filter a list of Ambassador Host Resources to only return the ones that
// contain the required External-DNS annotation filter
func (sc *ambassadorHostSource) filterByAnnotations(ambassadorHosts []*ambassador.Host) ([]*ambassador.Host, error) {
// External-DNS Annotation Filter
labelSelector, err := metav1.ParseToLabelSelector(sc.annotationFilter)
if err != nil {
return nil, err
}

selector, err := metav1.LabelSelectorAsSelector(labelSelector)
if err != nil {
return nil, err
}

// empty filter returns original list of Ambassador Hosts
if selector.Empty() {
return ambassadorHosts, nil
}

// Return a filtered list of Ambassador Hosts
filteredList := []*ambassador.Host{}
for _, host := range ambassadorHosts {
annotations := labels.Set(host.Annotations)
// include Ambassador Host if its annotations match the annotation filter
if selector.Matches(annotations) {
filteredList = append(filteredList, host)
}
}

return filteredList, nil
}
106 changes: 100 additions & 6 deletions source/ambassador_host_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,14 +17,14 @@ limitations under the License.
package source

import (
"context"
"fmt"
"testing"

ambassador "github.com/datawire/ambassador/pkg/api/getambassador.io/v2"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/stretchr/testify/suite"
"golang.org/x/net/context"
v1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
Expand All @@ -37,6 +37,9 @@ import (
const defaultAmbassadorNamespace = "ambassador"
const defaultAmbassadorServiceName = "ambassador"

// This is a compile-time validation that ambassadorHostSource is a Source.
var _ Source = &ambassadorHostSource{}

type AmbassadorSuite struct {
suite.Suite
}
Expand All @@ -57,10 +60,11 @@ func TestAmbassadorHostSource(t *testing.T) {
hostAnnotation := fmt.Sprintf("%s/%s", defaultAmbassadorNamespace, defaultAmbassadorServiceName)

for _, ti := range []struct {
title string
host ambassador.Host
service v1.Service
expected []*endpoint.Endpoint
title string
annotationFilter string
host ambassador.Host
service v1.Service
expected []*endpoint.Endpoint
}{
{
title: "Simple host",
Expand Down Expand Up @@ -288,6 +292,96 @@ func TestAmbassadorHostSource(t *testing.T) {
},
},
expected: []*endpoint.Endpoint{},
}, {
title: "valid matching annotation filter expression",
annotationFilter: "kubernetes.io/ingress.class in (external-ingress)",
host: ambassador.Host{
ObjectMeta: metav1.ObjectMeta{
Name: "basic-host",
Annotations: map[string]string{
ambHostAnnotation: hostAnnotation,
"kubernetes.io/ingress.class": "external-ingress",
},
},
Spec: &ambassador.HostSpec{
Hostname: "www.example.org",
},
},
service: v1.Service{
ObjectMeta: metav1.ObjectMeta{
Name: defaultAmbassadorServiceName,
},
Status: v1.ServiceStatus{
LoadBalancer: v1.LoadBalancerStatus{
Ingress: []v1.LoadBalancerIngress{{
IP: "1.1.1.1",
}},
},
},
},
expected: []*endpoint.Endpoint{
{
DNSName: "www.example.org",
RecordType: endpoint.RecordTypeA,
Targets: endpoint.Targets{"1.1.1.1"},
},
},
}, {
title: "valid non-matching annotation filter expression",
annotationFilter: "kubernetes.io/ingress.class in (external-ingress)",
host: ambassador.Host{
ObjectMeta: metav1.ObjectMeta{
Name: "basic-host",
Annotations: map[string]string{
ambHostAnnotation: hostAnnotation,
"kubernetes.io/ingress.class": "internal-ingress",
},
},
Spec: &ambassador.HostSpec{
Hostname: "www.example.org",
},
},
service: v1.Service{
ObjectMeta: metav1.ObjectMeta{
Name: defaultAmbassadorServiceName,
},
Status: v1.ServiceStatus{
LoadBalancer: v1.LoadBalancerStatus{
Ingress: []v1.LoadBalancerIngress{{
IP: "1.1.1.1",
}},
},
},
},
expected: []*endpoint.Endpoint{},
}, {
title: "invalid annotation filter expression",
annotationFilter: "kubernetes.io/ingress.class in (invalid-ingress)",
host: ambassador.Host{
ObjectMeta: metav1.ObjectMeta{
Name: "basic-host",
Annotations: map[string]string{
ambHostAnnotation: hostAnnotation,
"kubernetes.io/ingress.class": "external-ingress",
},
},
Spec: &ambassador.HostSpec{
Hostname: "www.example.org",
},
},
service: v1.Service{
ObjectMeta: metav1.ObjectMeta{
Name: defaultAmbassadorServiceName,
},
Status: v1.ServiceStatus{
LoadBalancer: v1.LoadBalancerStatus{
Ingress: []v1.LoadBalancerIngress{{
IP: "1.1.1.1",
}},
},
},
},
expected: []*endpoint.Endpoint{},
},
} {
ti := ti
Expand All @@ -312,7 +406,7 @@ func TestAmbassadorHostSource(t *testing.T) {
_, err = fakeDynamicClient.Resource(ambHostGVR).Namespace(namespace).Create(context.Background(), host, metav1.CreateOptions{})
assert.NoError(t, err)

source, err := NewAmbassadorHostSource(context.TODO(), fakeDynamicClient, fakeKubernetesClient, namespace)
source, err := NewAmbassadorHostSource(context.TODO(), fakeDynamicClient, fakeKubernetesClient, namespace, ti.annotationFilter)
assert.NoError(t, err)
assert.NotNil(t, source)

Expand Down
2 changes: 1 addition & 1 deletion source/store.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -276,7 +276,7 @@ func BuildWithConfig(ctx context.Context, source string, p ClientGenerator, cfg
if err != nil {
return nil, err
}
return NewAmbassadorHostSource(ctx, dynamicClient, kubernetesClient, cfg.Namespace)
return NewAmbassadorHostSource(ctx, dynamicClient, kubernetesClient, cfg.Namespace, cfg.AnnotationFilter)
case "contour-httpproxy":
dynamicClient, err := p.DynamicKubernetesClient()
if err != nil {
Expand Down

0 comments on commit f0f718a

Please sign in to comment.