510 lines
17 KiB
Go
510 lines
17 KiB
Go
/*
|
|
Copyright 2023.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package controllers
|
|
|
|
import (
|
|
"fmt"
|
|
appsv1 "k8s.io/api/apps/v1"
|
|
batchv1 "k8s.io/api/batch/v1"
|
|
corev1 "k8s.io/api/core/v1"
|
|
rbacv1 "k8s.io/api/rbac/v1"
|
|
"k8s.io/apimachinery/pkg/api/errors"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"os"
|
|
"path/filepath"
|
|
ctrl "sigs.k8s.io/controller-runtime"
|
|
"sigs.k8s.io/controller-runtime/pkg/client"
|
|
"strings"
|
|
|
|
formolv1alpha1 "github.com/desmo999r/formol/api/v1alpha1"
|
|
)
|
|
|
|
const (
|
|
FORMOL_SA = "formol-controller"
|
|
FORMOL_SIDECAR_ROLE = "formol:sidecar-role"
|
|
)
|
|
|
|
func (r *BackupConfigurationReconciler) DeleteCronJob(backupConf formolv1alpha1.BackupConfiguration) error {
|
|
cronjob := &batchv1.CronJob{}
|
|
if err := r.Get(r.Context, client.ObjectKey{
|
|
Namespace: backupConf.Namespace,
|
|
Name: "backup-" + backupConf.Name,
|
|
}, cronjob); err == nil {
|
|
r.Log.V(0).Info("Deleting cronjob", "cronjob", cronjob.Name)
|
|
return r.Delete(r.Context, cronjob)
|
|
} else {
|
|
return err
|
|
}
|
|
}
|
|
|
|
func (r *BackupConfigurationReconciler) AddCronJob(backupConf formolv1alpha1.BackupConfiguration) error {
|
|
cronjob := &batchv1.CronJob{}
|
|
if err := r.Get(r.Context, client.ObjectKey{
|
|
Namespace: backupConf.Namespace,
|
|
Name: "backup-" + backupConf.Name,
|
|
}, cronjob); err == nil {
|
|
r.Log.V(0).Info("there is already a cronjob")
|
|
var changed bool
|
|
if backupConf.Spec.Schedule != cronjob.Spec.Schedule {
|
|
r.Log.V(0).Info("cronjob schedule has changed", "old schedule", cronjob.Spec.Schedule, "new schedule", backupConf.Spec.Schedule)
|
|
cronjob.Spec.Schedule = backupConf.Spec.Schedule
|
|
changed = true
|
|
}
|
|
if backupConf.Spec.Suspend != nil && backupConf.Spec.Suspend != cronjob.Spec.Suspend {
|
|
r.Log.V(0).Info("cronjob suspend has changed", "before", cronjob.Spec.Suspend, "new", backupConf.Spec.Suspend)
|
|
cronjob.Spec.Suspend = backupConf.Spec.Suspend
|
|
changed = true
|
|
}
|
|
if changed == true {
|
|
if err := r.Update(r.Context, cronjob); err != nil {
|
|
r.Log.Error(err, "unable to update cronjob definition")
|
|
return err
|
|
}
|
|
backupConf.Status.Suspended = *backupConf.Spec.Suspend
|
|
}
|
|
return nil
|
|
} else if errors.IsNotFound(err) == false {
|
|
r.Log.Error(err, "something went wrong")
|
|
return err
|
|
}
|
|
|
|
cronjob = &batchv1.CronJob{
|
|
ObjectMeta: metav1.ObjectMeta{
|
|
Name: "backup-" + backupConf.Name,
|
|
Namespace: backupConf.Namespace,
|
|
},
|
|
Spec: batchv1.CronJobSpec{
|
|
Suspend: backupConf.Spec.Suspend,
|
|
Schedule: backupConf.Spec.Schedule,
|
|
JobTemplate: batchv1.JobTemplateSpec{
|
|
Spec: batchv1.JobSpec{
|
|
Template: corev1.PodTemplateSpec{
|
|
Spec: corev1.PodSpec{
|
|
RestartPolicy: corev1.RestartPolicyOnFailure,
|
|
ServiceAccountName: "backupsession-creator",
|
|
Containers: []corev1.Container{
|
|
corev1.Container{
|
|
Name: "job-createbackupsession-" + backupConf.Name,
|
|
Image: backupConf.Spec.Image,
|
|
Args: []string{
|
|
"backupsession",
|
|
"create",
|
|
"--namespace",
|
|
backupConf.Namespace,
|
|
"--name",
|
|
backupConf.Name,
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
if err := ctrl.SetControllerReference(&backupConf, cronjob, r.Scheme); err != nil {
|
|
r.Log.Error(err, "unable to set controller on job", "cronjob", cronjob, "backupconf", backupConf)
|
|
return err
|
|
}
|
|
r.Log.V(0).Info("creating the cronjob")
|
|
if err := r.Create(r.Context, cronjob); err != nil {
|
|
r.Log.Error(err, "unable to create the cronjob", "cronjob", cronjob)
|
|
return err
|
|
} else {
|
|
backupConf.Status.Suspended = *backupConf.Spec.Suspend
|
|
return nil
|
|
}
|
|
}
|
|
|
|
func (r *BackupConfigurationReconciler) getTargetObjects(kind formolv1alpha1.TargetKind, namespace string, name string) (targetObject client.Object, targetPodSpec *corev1.PodSpec, err error) {
|
|
switch kind {
|
|
case formolv1alpha1.Deployment:
|
|
deployment := appsv1.Deployment{}
|
|
if err = r.Get(r.Context, client.ObjectKey{
|
|
Namespace: namespace,
|
|
Name: name,
|
|
}, &deployment); err != nil {
|
|
r.Log.Error(err, "cannot get deployment", "Deployment", name)
|
|
return
|
|
}
|
|
targetObject = &deployment
|
|
targetPodSpec = &deployment.Spec.Template.Spec
|
|
|
|
case formolv1alpha1.StatefulSet:
|
|
statefulSet := appsv1.StatefulSet{}
|
|
if err = r.Get(r.Context, client.ObjectKey{
|
|
Namespace: namespace,
|
|
Name: name,
|
|
}, &statefulSet); err != nil {
|
|
r.Log.Error(err, "cannot get StatefulSet", "StatefulSet", name)
|
|
return
|
|
}
|
|
targetObject = &statefulSet
|
|
targetPodSpec = &statefulSet.Spec.Template.Spec
|
|
|
|
}
|
|
return
|
|
}
|
|
|
|
func (r *BackupConfigurationReconciler) DeleteSidecar(backupConf formolv1alpha1.BackupConfiguration) error {
|
|
removeTags := func(podSpec *corev1.PodSpec, target formolv1alpha1.Target) {
|
|
for i, container := range podSpec.Containers {
|
|
for _, targetContainer := range target.Containers {
|
|
if targetContainer.Name == container.Name {
|
|
if len(container.Env) > 1 && container.Env[len(container.Env)-1].Name == formolv1alpha1.TARGETCONTAINER_TAG {
|
|
podSpec.Containers[i].Env = container.Env[:len(container.Env)-1]
|
|
} else {
|
|
for j, e := range container.Env {
|
|
if e.Name == formolv1alpha1.TARGETCONTAINER_TAG {
|
|
container.Env[j] = container.Env[len(container.Env)-1]
|
|
podSpec.Containers[i].Env = container.Env[:len(container.Env)-1]
|
|
break
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
repo := formolv1alpha1.Repo{}
|
|
if err := r.Get(r.Context, client.ObjectKey{
|
|
Namespace: backupConf.Namespace,
|
|
Name: backupConf.Spec.Repository,
|
|
}, &repo); err != nil {
|
|
r.Log.Error(err, "unable to get Repo")
|
|
return err
|
|
}
|
|
r.Log.V(1).Info("Got Repository", "repo", repo)
|
|
for _, target := range backupConf.Spec.Targets {
|
|
targetObject, targetPodSpec, err := r.getTargetObjects(target.TargetKind, backupConf.Namespace, target.TargetName)
|
|
if err != nil {
|
|
r.Log.Error(err, "unable to get target objects")
|
|
return err
|
|
}
|
|
restoreContainers := []corev1.Container{}
|
|
for _, container := range targetPodSpec.Containers {
|
|
if container.Name == formolv1alpha1.SIDECARCONTAINER_NAME {
|
|
continue
|
|
}
|
|
restoreVms := []corev1.VolumeMount{}
|
|
for _, vm := range container.VolumeMounts {
|
|
if vm.Name == formolv1alpha1.FORMOL_SHARED_VOLUME {
|
|
r.Log.V(0).Info("cleanup VolumeMounts", "container", container.Name, "VolumeMount", vm.Name)
|
|
continue
|
|
}
|
|
restoreVms = append(restoreVms, vm)
|
|
}
|
|
r.Log.V(0).Info("cleanup VolumeMounts", "container", container.Name, "restoreVms", restoreVms)
|
|
container.VolumeMounts = restoreVms
|
|
restoreContainers = append(restoreContainers, container)
|
|
}
|
|
targetPodSpec.Containers = restoreContainers
|
|
restoreVolumes := []corev1.Volume{}
|
|
for _, volume := range targetPodSpec.Volumes {
|
|
if volume.Name == formolv1alpha1.RESTIC_REPO_VOLUME {
|
|
continue
|
|
}
|
|
if volume.Name == formolv1alpha1.FORMOL_SHARED_VOLUME {
|
|
continue
|
|
}
|
|
restoreVolumes = append(restoreVolumes, volume)
|
|
}
|
|
targetPodSpec.Volumes = restoreVolumes
|
|
removeTags(targetPodSpec, target)
|
|
if err = r.Update(r.Context, targetObject); err != nil {
|
|
r.Log.Error(err, "unable to remove sidecar", "targetObject", targetObject)
|
|
return err
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func hasSidecar(podSpec *corev1.PodSpec) bool {
|
|
for _, container := range podSpec.Containers {
|
|
if container.Name == formolv1alpha1.SIDECARCONTAINER_NAME {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func (r *BackupConfigurationReconciler) addSidecar(backupConf formolv1alpha1.BackupConfiguration, target formolv1alpha1.Target) (err error) {
|
|
repo := formolv1alpha1.Repo{}
|
|
if err = r.Get(r.Context, client.ObjectKey{
|
|
Namespace: backupConf.Namespace,
|
|
Name: backupConf.Spec.Repository,
|
|
}, &repo); err != nil {
|
|
r.Log.Error(err, "unable to get Repo")
|
|
return err
|
|
}
|
|
r.Log.V(1).Info("Got Repository", "repo", repo)
|
|
sidecar := corev1.Container{
|
|
Name: formolv1alpha1.SIDECARCONTAINER_NAME,
|
|
Image: backupConf.Spec.Image,
|
|
Args: []string{"server"},
|
|
Env: []corev1.EnvVar{
|
|
corev1.EnvVar{
|
|
Name: formolv1alpha1.TARGET_NAME,
|
|
Value: target.TargetName,
|
|
},
|
|
corev1.EnvVar{
|
|
Name: formolv1alpha1.POD_NAMESPACE,
|
|
ValueFrom: &corev1.EnvVarSource{
|
|
FieldRef: &corev1.ObjectFieldSelector{
|
|
FieldPath: "metadata.namespace",
|
|
},
|
|
},
|
|
}},
|
|
VolumeMounts: []corev1.VolumeMount{},
|
|
SecurityContext: &corev1.SecurityContext{
|
|
Privileged: func() *bool { b := true; return &b }(),
|
|
},
|
|
}
|
|
targetObject, targetPodSpec, err := r.getTargetObjects(target.TargetKind, backupConf.Namespace, target.TargetName)
|
|
if err != nil {
|
|
r.Log.Error(err, "unable to get target objects")
|
|
return err
|
|
}
|
|
if !hasSidecar(targetPodSpec) {
|
|
if err = r.createRBACSidecar(corev1.ServiceAccount{
|
|
ObjectMeta: metav1.ObjectMeta{
|
|
Namespace: backupConf.Namespace,
|
|
Name: targetPodSpec.ServiceAccountName,
|
|
},
|
|
}); err != nil {
|
|
r.Log.Error(err, "unable to create RBAC for the sidecar container")
|
|
return
|
|
}
|
|
switch target.BackupType {
|
|
case formolv1alpha1.OnlineKind:
|
|
sidecarPaths, vms := addOnlineSidecarTags(targetPodSpec, target)
|
|
sidecar.Env = append(sidecar.Env, corev1.EnvVar{
|
|
Name: formolv1alpha1.BACKUP_PATHS,
|
|
Value: strings.Join(sidecarPaths, string(os.PathListSeparator)),
|
|
})
|
|
sidecar.VolumeMounts = vms
|
|
case formolv1alpha1.JobKind:
|
|
sidecar.VolumeMounts = addJobSidecarTags(targetPodSpec, target)
|
|
}
|
|
if repo.Spec.Backend.Local != nil {
|
|
sidecar.VolumeMounts = append(sidecar.VolumeMounts, corev1.VolumeMount{
|
|
Name: formolv1alpha1.RESTIC_REPO_VOLUME,
|
|
MountPath: formolv1alpha1.RESTIC_REPO_PATH,
|
|
})
|
|
targetPodSpec.Volumes = append(targetPodSpec.Volumes, corev1.Volume{
|
|
Name: formolv1alpha1.RESTIC_REPO_VOLUME,
|
|
VolumeSource: repo.Spec.Backend.Local.VolumeSource,
|
|
})
|
|
}
|
|
|
|
// The sidecar definition is complete. Add it to the targetObject
|
|
targetPodSpec.Containers = append(targetPodSpec.Containers, sidecar)
|
|
targetPodSpec.ShareProcessNamespace = func() *bool { b := true; return &b }()
|
|
r.Log.V(1).Info("Adding sidecar", "targetObject", targetObject, "sidecar", sidecar)
|
|
if err = r.Update(r.Context, targetObject); err != nil {
|
|
r.Log.Error(err, "unable to add sidecar", "targetObject", targetObject)
|
|
return
|
|
}
|
|
}
|
|
|
|
return
|
|
}
|
|
|
|
// Delete the sidecar role is there is no more sidecar container in the namespace
|
|
func (r *BackupConfigurationReconciler) deleteRBACSidecar(namespace string) error {
|
|
podList := corev1.PodList{}
|
|
if err := r.List(r.Context, &podList, &client.ListOptions{
|
|
Namespace: namespace,
|
|
}); err != nil {
|
|
r.Log.Error(err, "unable to get the list of pods", "namespace", namespace)
|
|
return err
|
|
}
|
|
for _, pod := range podList.Items {
|
|
for _, container := range pod.Spec.Containers {
|
|
for _, env := range container.Env {
|
|
if env.Name == formolv1alpha1.SIDECARCONTAINER_NAME {
|
|
// There is still a sidecar in the namespace.
|
|
// cannot delete the sidecar role
|
|
return nil
|
|
}
|
|
}
|
|
}
|
|
}
|
|
role := rbacv1.Role{
|
|
ObjectMeta: metav1.ObjectMeta{
|
|
Namespace: namespace,
|
|
Name: FORMOL_SIDECAR_ROLE,
|
|
},
|
|
}
|
|
if err := r.Delete(r.Context, &role); err != nil {
|
|
r.Log.Error(err, "unable to delete sidecar role")
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Creates a role to allow the BackupSession controller in the sidecar to have access to resources
|
|
// like Repo, Functions, ...
|
|
func (r *BackupConfigurationReconciler) createRBACSidecar(sa corev1.ServiceAccount) error {
|
|
if sa.Name == "" {
|
|
sa.Name = "default"
|
|
}
|
|
role := rbacv1.Role{}
|
|
if err := r.Get(r.Context, client.ObjectKey{
|
|
Namespace: sa.Namespace,
|
|
Name: FORMOL_SIDECAR_ROLE,
|
|
}, &role); err != nil && errors.IsNotFound(err) {
|
|
role = rbacv1.Role{
|
|
ObjectMeta: metav1.ObjectMeta{
|
|
Namespace: sa.Namespace,
|
|
Name: FORMOL_SIDECAR_ROLE,
|
|
},
|
|
Rules: []rbacv1.PolicyRule{
|
|
rbacv1.PolicyRule{
|
|
Verbs: []string{"get", "list", "watch"},
|
|
APIGroups: []string{"formol.desmojim.fr"},
|
|
Resources: []string{"restoresessions", "backupsessions", "backupconfigurations", "functions", "repoes"},
|
|
},
|
|
rbacv1.PolicyRule{
|
|
Verbs: []string{"get", "list", "watch"},
|
|
APIGroups: []string{""},
|
|
Resources: []string{"secrets"},
|
|
},
|
|
rbacv1.PolicyRule{
|
|
Verbs: []string{"get", "list", "watch", "create", "update", "patch", "delete"},
|
|
APIGroups: []string{"formol.desmojim.fr"},
|
|
Resources: []string{"backupsessions/status"},
|
|
},
|
|
rbacv1.PolicyRule{
|
|
Verbs: []string{"get", "list", "watch", "create", "update", "patch", "delete"},
|
|
APIGroups: []string{"formol.desmojim.fr"},
|
|
Resources: []string{"restoresessions/status"},
|
|
},
|
|
},
|
|
}
|
|
r.Log.V(0).Info("Creating formol sidecar role", "role", role)
|
|
if err = r.Create(r.Context, &role); err != nil {
|
|
r.Log.Error(err, "unable to create sidecar role")
|
|
return err
|
|
}
|
|
}
|
|
rolebinding := rbacv1.RoleBinding{}
|
|
if err := r.Get(r.Context, client.ObjectKey{
|
|
Namespace: sa.Namespace,
|
|
Name: FORMOL_SIDECAR_ROLE,
|
|
}, &rolebinding); err != nil && errors.IsNotFound(err) {
|
|
rolebinding = rbacv1.RoleBinding{
|
|
ObjectMeta: metav1.ObjectMeta{
|
|
Namespace: sa.Namespace,
|
|
Name: FORMOL_SIDECAR_ROLE,
|
|
},
|
|
Subjects: []rbacv1.Subject{
|
|
rbacv1.Subject{
|
|
Kind: "ServiceAccount",
|
|
Name: sa.Name,
|
|
},
|
|
},
|
|
RoleRef: rbacv1.RoleRef{
|
|
APIGroup: "rbac.authorization.k8s.io",
|
|
Kind: "Role",
|
|
Name: FORMOL_SIDECAR_ROLE,
|
|
},
|
|
}
|
|
r.Log.V(0).Info("Creating formol sidecar rolebinding", "rolebinding", rolebinding)
|
|
if err = r.Create(r.Context, &rolebinding); err != nil {
|
|
r.Log.Error(err, "unable to create sidecar rolebinding")
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func addJobSidecarTags(podSpec *corev1.PodSpec, target formolv1alpha1.Target) (vms []corev1.VolumeMount) {
|
|
for i, container := range podSpec.Containers {
|
|
for _, targetContainer := range target.Containers {
|
|
if targetContainer.Name == container.Name {
|
|
// Found a target container. Tag it.
|
|
podSpec.Containers[i].Env = append(container.Env, corev1.EnvVar{
|
|
Name: formolv1alpha1.TARGETCONTAINER_TAG,
|
|
Value: container.Name,
|
|
})
|
|
// Create a shared mount between the target and sidecar container
|
|
// the output of the Job will be saved in the shared volume
|
|
// and restic will then backup the content of the volume
|
|
var addSharedVol bool = true
|
|
for _, vol := range podSpec.Volumes {
|
|
if vol.Name == formolv1alpha1.FORMOL_SHARED_VOLUME {
|
|
addSharedVol = false
|
|
}
|
|
}
|
|
if addSharedVol {
|
|
podSpec.Volumes = append(podSpec.Volumes,
|
|
corev1.Volume{
|
|
Name: formolv1alpha1.FORMOL_SHARED_VOLUME,
|
|
VolumeSource: corev1.VolumeSource{EmptyDir: &corev1.EmptyDirVolumeSource{}},
|
|
})
|
|
}
|
|
podSpec.Containers[i].VolumeMounts = append(podSpec.Containers[i].VolumeMounts, corev1.VolumeMount{
|
|
Name: formolv1alpha1.FORMOL_SHARED_VOLUME,
|
|
MountPath: targetContainer.SharePath,
|
|
})
|
|
vms = append(vms, corev1.VolumeMount{
|
|
Name: formolv1alpha1.FORMOL_SHARED_VOLUME,
|
|
MountPath: targetContainer.SharePath,
|
|
})
|
|
}
|
|
}
|
|
}
|
|
return
|
|
}
|
|
|
|
func addOnlineSidecarTags(podSpec *corev1.PodSpec, target formolv1alpha1.Target) (sidecarPaths []string, vms []corev1.VolumeMount) {
|
|
for i, container := range podSpec.Containers {
|
|
for _, targetContainer := range target.Containers {
|
|
if targetContainer.Name == container.Name {
|
|
// Found a target container. Tag it.
|
|
podSpec.Containers[i].Env = append(container.Env, corev1.EnvVar{
|
|
Name: formolv1alpha1.TARGETCONTAINER_TAG,
|
|
Value: container.Name,
|
|
})
|
|
// targetContainer.Paths are the paths to backup
|
|
// We have to find what volumes are mounted under those paths
|
|
// and mount them under a path that exists in the sidecar container
|
|
for i, path := range targetContainer.Paths {
|
|
vm := corev1.VolumeMount{ReadOnly: true}
|
|
var longest int = 0
|
|
var sidecarPath string
|
|
for _, volumeMount := range container.VolumeMounts {
|
|
// if strings.HasPrefix(path, volumeMount.MountPath) && len(volumeMount.MountPath) > longest {
|
|
if rel, err := filepath.Rel(volumeMount.MountPath, path); err == nil && len(volumeMount.MountPath) > longest {
|
|
longest = len(volumeMount.MountPath)
|
|
vm.Name = volumeMount.Name
|
|
vm.MountPath = fmt.Sprintf("/%s%d", formolv1alpha1.BACKUP_PREFIX_PATH, i)
|
|
vm.SubPath = volumeMount.SubPath
|
|
sidecarPath = filepath.Join(vm.MountPath, rel)
|
|
}
|
|
}
|
|
vms = append(vms, vm)
|
|
sidecarPaths = append(sidecarPaths, sidecarPath)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
return
|
|
}
|