Skip to content
This repository was archived by the owner on Nov 7, 2023. It is now read-only.

Commit e6c0197

Browse files
mattalbertsmattalberts
authored
Merge pull request #125 from cloudflare/issue-indexer-bypasses-ingress-class
Only index ingress objects matching ingress.class
2 parents da48c85 + cbf474f commit e6c0197

File tree

2 files changed

+107
-26
lines changed

2 files changed

+107
-26
lines changed

‎internal/argotunnel/informer.go‎

Lines changed: 28 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -58,8 +58,8 @@ func newEndpointInformer(client kubernetes.Interface, opts options, rs ...cache.
5858
func newIngressInformer(client kubernetes.Interface, opts options, rs ...cache.ResourceEventHandler) cache.SharedIndexInformer {
5959
i := newInformer(client.ExtensionsV1beta1().RESTClient(), "ingresses", new(v1beta1.Ingress), opts.resyncPeriod, rs...)
6060
i.AddIndexers(cache.Indexers{
61-
secretKind: ingressSecretIndexFunc(opts.secret),
62-
serviceKind: ingressServiceIndexFunc(),
61+
secretKind: ingressSecretIndexFunc(opts.ingressClass, opts.secret),
62+
serviceKind: ingressServiceIndexFunc(opts.ingressClass),
6363
})
6464
return i
6565
}
@@ -83,27 +83,29 @@ func newInformer(c cache.Getter, resource string, objType runtime.Object, resync
8383
return sw
8484
}
8585

86-
func ingressSecretIndexFunc(secret *resource) func(obj interface{}) ([]string, error) {
86+
func ingressSecretIndexFunc(ingressClass string, secret *resource) func(obj interface{}) ([]string, error) {
8787
return func(obj interface{}) ([]string, error) {
8888
if ing, ok := obj.(*v1beta1.Ingress); ok {
89-
hostsecret := make(map[string]*resource)
90-
for _, tls := range ing.Spec.TLS {
91-
for _, host := range tls.Hosts {
92-
if len(tls.SecretName) > 0 {
93-
hostsecret[host] = &resource{
94-
name: tls.SecretName,
95-
namespace: ing.Namespace,
89+
var idx []string
90+
if objIngClass, ok := parseIngressClass(ing); ok && ingressClass == objIngClass {
91+
hostsecret := make(map[string]*resource)
92+
for _, tls := range ing.Spec.TLS {
93+
for _, host := range tls.Hosts {
94+
if len(tls.SecretName) > 0 {
95+
hostsecret[host] = &resource{
96+
name: tls.SecretName,
97+
namespace: ing.Namespace,
98+
}
9699
}
97100
}
98101
}
99-
}
100-
var idx []string
101-
for _, rule := range ing.Spec.Rules {
102-
if rule.HTTP != nil && len(rule.Host) > 0 {
103-
if r, ok := hostsecret[rule.Host]; ok {
104-
idx = append(idx, itemKeyFunc(r.namespace, r.name))
105-
} else if secret != nil {
106-
idx = append(idx, itemKeyFunc(secret.namespace, secret.name))
102+
for _, rule := range ing.Spec.Rules {
103+
if rule.HTTP != nil && len(rule.Host) > 0 {
104+
if r, ok := hostsecret[rule.Host]; ok {
105+
idx = append(idx, itemKeyFunc(r.namespace, r.name))
106+
} else if secret != nil {
107+
idx = append(idx, itemKeyFunc(secret.namespace, secret.name))
108+
}
107109
}
108110
}
109111
}
@@ -113,15 +115,17 @@ func ingressSecretIndexFunc(secret *resource) func(obj interface{}) ([]string, e
113115
}
114116
}
115117

116-
func ingressServiceIndexFunc() func(obj interface{}) ([]string, error) {
118+
func ingressServiceIndexFunc(ingressClass string) func(obj interface{}) ([]string, error) {
117119
return func(obj interface{}) ([]string, error) {
118120
if ing, ok := obj.(*v1beta1.Ingress); ok {
119121
var idx []string
120-
for _, rule := range ing.Spec.Rules {
121-
if rule.HTTP != nil && len(rule.Host) > 0 {
122-
for _, path := range rule.HTTP.Paths {
123-
if len(path.Backend.ServiceName) > 0 {
124-
idx = append(idx, itemKeyFunc(ing.Namespace, path.Backend.ServiceName))
122+
if objIngClass, ok := parseIngressClass(ing); ok && ingressClass == objIngClass {
123+
for _, rule := range ing.Spec.Rules {
124+
if rule.HTTP != nil && len(rule.Host) > 0 {
125+
for _, path := range rule.HTTP.Paths {
126+
if len(path.Backend.ServiceName) > 0 {
127+
idx = append(idx, itemKeyFunc(ing.Namespace, path.Backend.ServiceName))
128+
}
125129
}
126130
}
127131
}

‎internal/argotunnel/informer_test.go‎

Lines changed: 79 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,11 +35,49 @@ func TestIngressSecretIndexFunc(t *testing.T) {
3535
out: []string{},
3636
err: fmt.Errorf("index unexpected obj type: %T", &unit{}),
3737
},
38+
"obj-ing-class-mismatch": {
39+
obj: &v1beta1.Ingress{
40+
ObjectMeta: metav1.ObjectMeta{
41+
Name: "unit",
42+
Namespace: "unit",
43+
Annotations: map[string]string{
44+
"kubernetes.io/ingress.class": "not-unit",
45+
},
46+
},
47+
TypeMeta: metav1.TypeMeta{
48+
Kind: "Ingress",
49+
APIVersion: "v1beta1",
50+
},
51+
Spec: v1beta1.IngressSpec{
52+
TLS: []v1beta1.IngressTLS{
53+
{
54+
Hosts: []string{
55+
"a.unit.com",
56+
},
57+
SecretName: "sec-a",
58+
},
59+
},
60+
Rules: []v1beta1.IngressRule{
61+
{
62+
Host: "a.unit.com",
63+
IngressRuleValue: v1beta1.IngressRuleValue{
64+
HTTP: &v1beta1.HTTPIngressRuleValue{},
65+
},
66+
},
67+
},
68+
},
69+
},
70+
out: nil,
71+
err: nil,
72+
},
3873
"obj-ing-secs": {
3974
obj: &v1beta1.Ingress{
4075
ObjectMeta: metav1.ObjectMeta{
4176
Name: "unit",
4277
Namespace: "unit",
78+
Annotations: map[string]string{
79+
"kubernetes.io/ingress.class": "unit",
80+
},
4381
},
4482
TypeMeta: metav1.TypeMeta{
4583
Kind: "Ingress",
@@ -101,7 +139,7 @@ func TestIngressSecretIndexFunc(t *testing.T) {
101139
err: nil,
102140
},
103141
} {
104-
indexFunc := ingressSecretIndexFunc(nil)
142+
indexFunc := ingressSecretIndexFunc("unit", nil)
105143
out, err := indexFunc(test.obj)
106144
assert.Equalf(t, test.out, out, "test '%s' index mismatch", name)
107145
assert.Equalf(t, test.err, err, "test '%s' error mismatch", name)
@@ -130,11 +168,50 @@ func TestIngressServiceIndexFunc(t *testing.T) {
130168
out: []string{},
131169
err: fmt.Errorf("index unexpected obj type: %T", &unit{}),
132170
},
171+
"obj-ing-class-mismatch": {
172+
obj: &v1beta1.Ingress{
173+
ObjectMeta: metav1.ObjectMeta{
174+
Name: "unit",
175+
Namespace: "unit",
176+
Annotations: map[string]string{
177+
"kubernetes.io/ingress.class": "not-unit",
178+
},
179+
},
180+
TypeMeta: metav1.TypeMeta{
181+
Kind: "Ingress",
182+
APIVersion: "v1beta1",
183+
},
184+
Spec: v1beta1.IngressSpec{
185+
Rules: []v1beta1.IngressRule{
186+
{
187+
Host: "a.unit.com",
188+
IngressRuleValue: v1beta1.IngressRuleValue{
189+
HTTP: &v1beta1.HTTPIngressRuleValue{
190+
Paths: []v1beta1.HTTPIngressPath{
191+
{
192+
Backend: v1beta1.IngressBackend{
193+
ServiceName: "svc-a",
194+
ServicePort: intstr.FromString("http"),
195+
},
196+
},
197+
},
198+
},
199+
},
200+
},
201+
},
202+
},
203+
},
204+
out: nil,
205+
err: nil,
206+
},
133207
"obj-ing-svcs": {
134208
obj: &v1beta1.Ingress{
135209
ObjectMeta: metav1.ObjectMeta{
136210
Name: "unit",
137211
Namespace: "unit",
212+
Annotations: map[string]string{
213+
"kubernetes.io/ingress.class": "unit",
214+
},
138215
},
139216
TypeMeta: metav1.TypeMeta{
140217
Kind: "Ingress",
@@ -208,7 +285,7 @@ func TestIngressServiceIndexFunc(t *testing.T) {
208285
err: nil,
209286
},
210287
} {
211-
indexFunc := ingressServiceIndexFunc()
288+
indexFunc := ingressServiceIndexFunc("unit")
212289
out, err := indexFunc(test.obj)
213290
assert.Equalf(t, test.out, out, "test '%s' index mismatch", name)
214291
assert.Equalf(t, test.err, err, "test '%s' error mismatch", name)

0 commit comments

Comments
 (0)