[WIP] Support Network object

README.md

@@ -102,15 +102,15 @@ dep ensure
 # don't refresh, just download dependencies
 dep ensure --vendor-only
 
-# build admission binary locally
-CGO_ENABLED=0 GOOS=linux go build cmd/admission/main.go
+# build pod admission binary locally
+CGO_ENABLED=0 GOOS=linux go build cmd/pod-admission/main.go
 
 # build deviceplugin binary locally
 CGO_ENABLED=0 GOOS=linux go build cmd/deviceplugin/main.go
 
-# build and push admission image
-docker build -f cmd/admission/Dockerfile -t phoracek/kubetron-admission:latest .
-docker push phoracek/kubetron-admission:latest
+# build and push pod admission image
+docker build -f cmd/pod-admission/Dockerfile -t phoracek/kubetron-pod-admission:latest .
+docker push phoracek/kubetron-pod-admission:latest
 
 # build and push deviceplugin image
 docker build -f cmd/deviceplugin/Dockerfile -t phoracek/kubetron-deviceplugin:latest .

cmd/deviceplugin/Dockerfile

@@ -1,8 +1,6 @@
 FROM golang:1.9 AS builder
 WORKDIR /go/src/github.com/phoracek/kubetron/
-RUN curl https://raw.githubusercontent.com/golang/dep/master/install.sh | sh
 COPY . .
-RUN dep ensure --vendor-only
 RUN CGO_ENABLED=0 GOOS=linux go build -o /bin/kubetron-deviceplugin github.com/phoracek/kubetron/cmd/deviceplugin
 
 FROM fedora:27

cmd/network-admission/Dockerfile

@@ -0,0 +1,8 @@
+FROM golang:1.9 AS builder
+WORKDIR /go/src/github.com/phoracek/kubetron/
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux go build -o /bin/kubetron-network-admission github.com/phoracek/kubetron/cmd/network-admission
+
+FROM alpine
+COPY --from=builder /bin/kubetron-network-admission /bin/kubetron-network-admission
+ENTRYPOINT ["/bin/kubetron-network-admission"]

cmd/network-admission/main.go

@@ -0,0 +1,41 @@
+package main
+
+import (
+	"flag"
+	"os"
+
+	"github.com/golang/glog"
+	"github.com/openshift/generic-admission-server/pkg/cmd/server"
+	"github.com/spf13/pflag"
+	genericapiserver "k8s.io/apiserver/pkg/server"
+	"k8s.io/apiserver/pkg/util/logs"
+
+	admission "github.com/phoracek/kubetron/pkg/network-admission"
+)
+
+func main() {
+	flagset := pflag.NewFlagSet("kubetron-network-admission", pflag.ExitOnError)
+
+	ah := &admission.AdmissionHook{}
+
+	logs.InitLogs()
+	defer logs.FlushLogs()
+
+	stopCh := genericapiserver.SetupSignalHandler()
+
+	cmd := server.NewCommandStartAdmissionServer(os.Stdout, os.Stderr, stopCh, ah)
+	cmd.Short = "Launch Kubetron Network Admission Server"
+	cmd.Long = "Launch Kubetron Network Admission Server"
+
+	// Add admission hook flags
+	cmd.PersistentFlags().AddFlagSet(flagset)
+
+	// Flags for glog
+	cmd.PersistentFlags().AddGoFlagSet(flag.CommandLine)
+	// Fix glog printing "Error: logging before flag.Parse"
+	flag.CommandLine.Parse([]string{})
+
+	if err := cmd.Execute(); err != nil {
+		glog.Fatal(err)
+	}
+}

cmd/pod-admission/Dockerfile

@@ -0,0 +1,8 @@
+FROM golang:1.9 AS builder
+WORKDIR /go/src/github.com/phoracek/kubetron/
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux go build -o /bin/kubetron-pod-admission github.com/phoracek/kubetron/cmd/pod-admission
+
+FROM alpine
+COPY --from=builder /bin/kubetron-pod-admission /bin/kubetron-pod-admission
+ENTRYPOINT ["/bin/kubetron-pod-admission"]

cmd/admission/main.go → cmd/pod-admission/main.go

@@ -10,11 +10,11 @@ import (
 	genericapiserver "k8s.io/apiserver/pkg/server"
 	"k8s.io/apiserver/pkg/util/logs"
 
-	"github.com/phoracek/kubetron/pkg/admission"
+	admission "github.com/phoracek/kubetron/pkg/pod-admission"
 )
 
 func main() {
-	flagset := pflag.NewFlagSet("kubetron-admission", pflag.ExitOnError)
+	flagset := pflag.NewFlagSet("kubetron-network-admission", pflag.ExitOnError)
 
 	ah := &admission.AdmissionHook{}
 
@@ -29,8 +29,8 @@ func main() {
 	stopCh := genericapiserver.SetupSignalHandler()
 
 	cmd := server.NewCommandStartAdmissionServer(os.Stdout, os.Stderr, stopCh, ah)
-	cmd.Short = "Launch Kubetron Admission Server"
-	cmd.Long = "Launch Kubetron Admission Server"
+	cmd.Short = "Launch Kubetron Pod Admission Server"
+	cmd.Long = "Launch Kubetron Pod Admission Server"
 
 	// Add admission hook flags
 	cmd.PersistentFlags().AddFlagSet(flagset)

deploy/addon.yaml.in

@@ -161,40 +161,40 @@ items:
 - apiVersion: v1
   kind: Service
   metadata:
-    name: admission
+    name: pod-admission
     namespace: kubetron
     labels:
-      app: admission
+      app: pod-admission
   spec:
     ports:
     - name: https-webhook
       port: 443
     selector:
-      app: admission
+      app: pod-admission
 
 - apiVersion: apps/v1
   kind: DaemonSet
   metadata:
-    name: admission
+    name: pod-admission
     namespace: kubetron
     labels:
-      app: admission
+      app: pod-admission
   spec:
     selector:
       matchLabels:
-        app: admission
+        app: pod-admission
     updateStrategy:
       type: RollingUpdate
     template:
       metadata:
-        name: admission
+        name: pod-admission
         labels:
-          app: admission
+          app: pod-admission
       spec:
         serviceAccountName: kubetron
         containers:
-        - name: admission
-          image: $ADMISSION_IMAGE
+        - name: pod-admission
+          image: $POD_ADMISSION_IMAGE
           imagePullPolicy: Always
           args:
           - --tls-cert-file=/etc/certs/cert.pem
@@ -263,14 +263,14 @@ items:
 - apiVersion: admissionregistration.k8s.io/v1beta1
   kind: MutatingWebhookConfiguration
   metadata:
-    name: kubetron
+    name: kubetron-pod
   webhooks:
   - name: kubetron.network.kubevirt.io
     clientConfig:
       service:
-        name: admission
+        name: pod-admission
         namespace: kubetron
-        path: /apis/kubetron.network.kubevirt.io/v1alpha1/admission
+        path: /apis/kubetron.network.kubevirt.io/v1alpha1/pod-admission
       caBundle: $KUBERNETES_CA
     rules:
       - operations: ["CREATE", "DELETE"]
@@ -284,6 +284,103 @@ items:
       - key: kubetron.network.kubevirt.io/ignoreAdmission
         operator: DoesNotExist
 
+- apiVersion: v1
+  kind: Service
+  metadata:
+    name: network-admission
+    namespace: kubetron
+    labels:
+      app: network-admission
+  spec:
+    ports:
+    - name: https-webhook
+      port: 443
+    selector:
+      app: network-admission
+
+- apiVersion: apps/v1
+  kind: DaemonSet
+  metadata:
+    name: network-admission
+    namespace: kubetron
+    labels:
+      app: network-admission
+  spec:
+    selector:
+      matchLabels:
+        app: network-admission
+    updateStrategy:
+      type: RollingUpdate
+    template:
+      metadata:
+        name: network-admission
+        labels:
+          app: network-admission
+      spec:
+        serviceAccountName: kubetron
+        containers:
+        - name: network-admission
+          image: $NETWORK_ADMISSION_IMAGE
+          imagePullPolicy: Always
+          args:
+          - --tls-cert-file=/etc/certs/cert.pem
+          - --tls-private-key-file=/etc/certs/key.pem
+          - --audit-log-path=-
+          - --audit-policy-file=/etc/config/audit.yaml
+          - --v=6
+          livenessProbe:
+            httpGet:
+              scheme: HTTPS
+              path: /healthz
+              port: 443
+            initialDelaySeconds: 10
+          readinessProbe:
+            httpGet:
+              scheme: HTTPS
+              path: /healthz
+              port: 443
+            initialDelaySeconds: 10
+          volumeMounts:
+          - name: certs
+            mountPath: /etc/certs
+            readOnly: true
+          - name: audit-config
+            mountPath: /etc/config
+            readOnly: true
+        volumes:
+        - name: certs
+          secret:
+            secretName: admission-certs
+        - name: audit-config
+          configMap:
+            name: admission-audit-config
+        tolerations:
+        - key: node-role.kubernetes.io/master
+          operator: Exists
+          effect: NoSchedule
+        nodeSelector:
+          "kubernetes.io/hostname": "k8s-01"
+
+- apiVersion: admissionregistration.k8s.io/v1beta1
+  kind: MutatingWebhookConfiguration
+  metadata:
+    name: kubetron-network
+  webhooks:
+  - name: kubetron.network.kubevirt.io
+    clientConfig:
+      service:
+        name: network-admission
+        namespace: kubetron
+        path: /apis/kubetron.network.kubevirt.io/v1alpha1/network-admission
+      caBundle: $KUBERNETES_CA
+    rules:
+      - operations: ["CREATE", "DELETE"]
+        apiGroups: ["*"]
+        apiVersions: ["*"]
+        resources:
+        - networks
+    failurePolicy: Fail
+
 - apiVersion: apps/v1
   kind: DaemonSet
   metadata:

hack/install-addon

@@ -1,7 +1,8 @@
 #!/bin/bash -xe
 
 KUBECTL=./hack/kubectl
-ADMISSION_IMAGE=${ADMISSION_IMAGE:-phoracek/kubetron-admission:latest}
+POD_ADMISSION_IMAGE=${POD_ADMISSION_IMAGE:-phoracek/kubetron-pod-admission:latest}
+NETWORK_ADMISSION_IMAGE=${NETWORK_ADMISSION_IMAGE:-phoracek/kubetron-network-admission:latest}
 DEVICEPLUGIN_IMAGE=${DEVICEPLUGIN_IMAGE:-phoracek/kubetron-deviceplugin:latest}
 
 cat <<EOF | $KUBECTL create -f -
@@ -38,7 +39,8 @@ $KUBECTL create --save-config namespace kubetron
 sleep 2
 
 cat deploy/addon.yaml.in | \
-    sed "s#\$ADMISSION_IMAGE#$ADMISSION_IMAGE#g" | \
+    sed "s#\$POD_ADMISSION_IMAGE#$POD_ADMISSION_IMAGE#g" | \
+    sed "s#\$NETWORK_ADMISSION_IMAGE#$NETWORK_ADMISSION_IMAGE#g" | \
     sed "s#\$DEVICEPLUGIN_IMAGE#$DEVICEPLUGIN_IMAGE#g" | \
     sed "s/\$ADMISSION_CERT/$ADMISSION_CERT/g" | \
     sed "s/\$ADMISSION_KEY/$ADMISSION_KEY/g" | \

hack/reinstall-addon

@@ -1,7 +1,7 @@
 #!/bin/bash -x
 
 KUBECTL=./hack/kubectl
-ADMISSION_IMAGE=${ADMISSION_IMAGE:-phoracek/kubetron-admission:latest}
+POD_ADMISSION_IMAGE=${POD_ADMISSION_IMAGE:-phoracek/kubetron-pod-admission:latest}
 DEVICEPLUGIN_IMAGE=${DEVICEPLUGIN_IMAGE:-phoracek/kubetron-deviceplugin:latest}
 
 ADMISSION_CERT=$(cat server.crt | base64 -w 0)
@@ -15,7 +15,7 @@ $KUBECTL create --save-config namespace kubetron
 sleep 2
 
 cat deploy/addon.yaml.in | \
-    sed "s#\$ADMISSION_IMAGE#$ADMISSION_IMAGE#g" | \
+    sed "s#\$POD_ADMISSION_IMAGE#$POD_ADMISSION_IMAGE#g" | \
     sed "s#\$DEVICEPLUGIN_IMAGE#$DEVICEPLUGIN_IMAGE#g" | \
     sed "s/\$ADMISSION_CERT/$ADMISSION_CERT/g" | \
     sed "s/\$ADMISSION_KEY/$ADMISSION_KEY/g" | \