Have the Webhook react to pod creation/update only

chart/templates/proxy_injector.yaml

@@ -80,7 +80,13 @@ rules:
   verbs: ["create", "get", "delete"]
 - apiGroups: [""]
   resources: ["namespaces"]
-  verbs: ["get"]
+  verbs: ["list", "get", "watch"]
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["list"]
+- apiGroups: ["apps"]
+  resources: ["replicasets"]
+  verbs: ["list", "get", "watch"]
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1

cli/cmd/inject.go

@@ -142,7 +142,11 @@ func (rt resourceTransformerInject) transform(bytes []byte) ([]byte, []inject.Re
 	if patchJSON == nil {
 		return bytes, reports, nil
 	}
-	log.Infof("patch generated for: %s", conf)
+	// TODO: refactor GetPatch() for it to return just one report item
+	if len(reports) > 0 {
+		r := reports[0]
+		log.Infof("patch generated for: %s", r.ResName())
+	}
 	log.Debugf("patch: %s", patchJSON)
 	patch, err := jsonpatch.DecodePatch(patchJSON)
 	if err != nil {

cli/cmd/testdata/install_no_init_container_auto_inject.golden

@@ -1491,7 +1491,13 @@ rules:
   verbs: ["create", "get", "delete"]
 - apiGroups: [""]
   resources: ["namespaces"]
-  verbs: ["get"]
+  verbs: ["list", "get", "watch"]
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["list"]
+- apiGroups: ["apps"]
+  resources: ["replicasets"]
+  verbs: ["list", "get", "watch"]
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1

cli/cmd/testdata/install_output.golden

@@ -1424,7 +1424,13 @@ rules:
   verbs: ["create", "get", "delete"]
 - apiGroups: [""]
   resources: ["namespaces"]
-  verbs: ["get"]
+  verbs: ["list", "get", "watch"]
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["list"]
+- apiGroups: ["apps"]
+  resources: ["replicasets"]
+  verbs: ["list", "get", "watch"]
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1

controller/cmd/proxy-injector/main.go

@@ -27,17 +27,17 @@ func main() {
 	defer close(stop)
 	signal.Notify(stop, os.Interrupt, os.Kill)
 
-	k8sClient, err := k8s.NewClientSet(*kubeconfig)
+	k8sAPI, err := k8s.InitializeAPI(*kubeconfig, k8s.NS, k8s.RS)
 	if err != nil {
-		log.Fatalf("failed to initialize Kubernetes client: %s", err)
+		log.Fatalf("failed to initialize Kubernetes API: %s", err)
 	}
 
 	rootCA, err := tls.GenerateRootCAWithDefaults("Proxy Injector Mutating Webhook Admission Controller CA")
 	if err != nil {
 		log.Fatalf("failed to create root CA: %s", err)
 	}
 
-	webhookConfig, err := injector.NewWebhookConfig(k8sClient, *controllerNamespace, *webhookServiceName, rootCA)
+	webhookConfig, err := injector.NewWebhookConfig(k8sAPI, *controllerNamespace, *webhookServiceName, rootCA)
 	if err != nil {
 		log.Fatalf("failed to read the trust anchor file: %s", err)
 	}
@@ -48,11 +48,13 @@ func main() {
 	}
 	log.Infof("created mutating webhook configuration: %s", mwc.ObjectMeta.SelfLink)
 
-	s, err := injector.NewWebhookServer(k8sClient, *addr, *controllerNamespace, *noInitContainer, rootCA)
+	s, err := injector.NewWebhookServer(k8sAPI, *addr, *controllerNamespace, *noInitContainer, rootCA)
 	if err != nil {
 		log.Fatalf("failed to initialize the webhook server: %s", err)
 	}
 
+	k8sAPI.Sync()
+
 	go func() {
 		log.Infof("listening at %s", *addr)
 		if err := s.ListenAndServeTLS("", ""); err != nil {

controller/proxy-injector/fake/data/inject-linkerd-secrets-volume-spec.yaml

@@ -0,0 +1,4 @@
+name: linkerd-secrets
+secret:
+  secretName: nginx-deployment-tls-linkerd-io
+  optional: true

controller/proxy-injector/server.go

@@ -8,9 +8,9 @@ import (
 	"io/ioutil"
 	"net/http"
 
+	"github.com/linkerd/linkerd2/controller/k8s"
 	pkgTls "github.com/linkerd/linkerd2/pkg/tls"
 	log "github.com/sirupsen/logrus"
-	"k8s.io/client-go/kubernetes"
 )
 
 // WebhookServer is the webhook's HTTP server. It has an embedded webhook which
@@ -21,7 +21,7 @@ type WebhookServer struct {
 }
 
 // NewWebhookServer returns a new instance of the WebhookServer.
-func NewWebhookServer(client kubernetes.Interface, addr, controllerNamespace string, noInitContainer bool, rootCA *pkgTls.CA) (*WebhookServer, error) {
+func NewWebhookServer(api *k8s.API, addr, controllerNamespace string, noInitContainer bool, rootCA *pkgTls.CA) (*WebhookServer, error) {
 	c, err := tlsConfig(rootCA, controllerNamespace)
 	if err != nil {
 		return nil, err
@@ -32,7 +32,7 @@ func NewWebhookServer(client kubernetes.Interface, addr, controllerNamespace str
 		TLSConfig: c,
 	}
 
-	webhook, err := NewWebhook(client, controllerNamespace, noInitContainer)
+	webhook, err := NewWebhook(api, controllerNamespace, noInitContainer)
 	if err != nil {
 		return nil, err
 	}

controller/proxy-injector/server_test.go

@@ -9,6 +9,7 @@ import (
 	"reflect"
 	"testing"
 
+	"github.com/linkerd/linkerd2/controller/k8s"
 	"github.com/linkerd/linkerd2/controller/proxy-injector/fake"
 	"github.com/linkerd/linkerd2/pkg/tls"
 	log "github.com/sirupsen/logrus"
@@ -20,9 +21,12 @@ var (
 
 func init() {
 	// create a webhook which uses its fake client to seed the sidecar configmap
-	fakeClient := fake.NewClient("")
+	k8sAPI, err := k8s.NewFakeAPI()
+	if err != nil {
+		panic(err)
+	}
 
-	webhook, err := NewWebhook(fakeClient, fake.DefaultControllerNamespace, false)
+	webhook, err := NewWebhook(k8sAPI, fake.DefaultControllerNamespace, false)
 	if err != nil {
 		panic(err)
 	}
@@ -73,13 +77,12 @@ func TestNewWebhookServer(t *testing.T) {
 		log.Fatalf("failed to create root CA: %s", err)
 	}
 
-	var (
-		addr       = ":7070"
-		kubeconfig = ""
-	)
-	fakeClient := fake.NewClient(kubeconfig)
-
-	server, err := NewWebhookServer(fakeClient, addr, fake.DefaultControllerNamespace, false, rootCA)
+	addr := ":7070"
+	k8sAPI, err := k8s.NewFakeAPI()
+	if err != nil {
+		t.Fatalf("NewFakeAPI returned an error: %s", err)
+	}
+	server, err := NewWebhookServer(k8sAPI, addr, fake.DefaultControllerNamespace, false, rootCA)
 	if err != nil {
 		t.Fatal("Unexpected error: ", err)
 	}

controller/proxy-injector/tmpl/mutating_webhook_configuration.go

@@ -17,6 +17,6 @@ webhooks:
     caBundle: {{ .CABundle }}
   rules:
   - operations: [ "CREATE" , "UPDATE" ]
-    apiGroups: ["apps", "extensions"]
-    apiVersions: ["v1", "v1beta1", "v1beta2"]
-    resources: ["deployments"]`
+    apiGroups: [""]
+    apiVersions: ["v1"]
+    resources: ["pods"]`

controller/proxy-injector/webhook.go

@@ -4,38 +4,39 @@ import (
 	"fmt"
 
 	pb "github.com/linkerd/linkerd2/controller/gen/config"
+	"github.com/linkerd/linkerd2/controller/k8s"
 	"github.com/linkerd/linkerd2/pkg/config"
 	"github.com/linkerd/linkerd2/pkg/inject"
-	"github.com/linkerd/linkerd2/pkg/k8s"
+	pkgK8s "github.com/linkerd/linkerd2/pkg/k8s"
 	"github.com/linkerd/linkerd2/pkg/version"
 	log "github.com/sirupsen/logrus"
 	admissionv1beta1 "k8s.io/api/admission/v1beta1"
+	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/serializer"
-	"k8s.io/client-go/kubernetes"
 	"sigs.k8s.io/yaml"
 )
 
 // Webhook is a Kubernetes mutating admission webhook that mutates pods admission
 // requests by injecting sidecar container spec into the pod spec during pod
 // creation.
 type Webhook struct {
-	client              kubernetes.Interface
+	k8sAPI              *k8s.API
 	deserializer        runtime.Decoder
 	controllerNamespace string
 	noInitContainer     bool
 }
 
 // NewWebhook returns a new instance of Webhook.
-func NewWebhook(client kubernetes.Interface, controllerNamespace string, noInitContainer bool) (*Webhook, error) {
+func NewWebhook(api *k8s.API, controllerNamespace string, noInitContainer bool) (*Webhook, error) {
 	var (
 		scheme = runtime.NewScheme()
 		codecs = serializer.NewCodecFactory(scheme)
 	)
 
 	return &Webhook{
-		client:              client,
+		k8sAPI:              api,
 		deserializer:        codecs.UniversalDeserializer(),
 		controllerNamespace: controllerNamespace,
 		noInitContainer:     noInitContainer,
@@ -87,24 +88,25 @@ func (w *Webhook) decode(data []byte) (*admissionv1beta1.AdmissionReview, error)
 func (w *Webhook) inject(request *admissionv1beta1.AdmissionRequest) (*admissionv1beta1.AdmissionResponse, error) {
 	log.Debugf("request object bytes: %s", request.Object.Raw)
 
-	globalConfig, err := config.Global(k8s.MountPathGlobalConfig)
+	globalConfig, err := config.Global(pkgK8s.MountPathGlobalConfig)
 	if err != nil {
 		return nil, err
 	}
 
-	proxyConfig, err := config.Proxy(k8s.MountPathProxyConfig)
+	proxyConfig, err := config.Proxy(pkgK8s.MountPathProxyConfig)
 	if err != nil {
 		return nil, err
 	}
 
-	namespace, err := w.client.CoreV1().Namespaces().Get(request.Namespace, metav1.GetOptions{})
+	namespace, err := w.k8sAPI.NS().Lister().Get(request.Namespace)
 	if err != nil {
 		return nil, err
 	}
 	nsAnnotations := namespace.GetAnnotations()
 
 	configs := &pb.All{Global: globalConfig, Proxy: proxyConfig}
 	conf := inject.NewResourceConfig(configs).
+		WithOwnerRetriever(w.ownerRetriever(request.Namespace)).
 		WithNsAnnotations(nsAnnotations).
 		WithKind(request.Kind.Kind)
 	nonEmpty, err := conf.ParseMeta(request.Object.Raw)
@@ -120,7 +122,7 @@ func (w *Webhook) inject(request *admissionv1beta1.AdmissionRequest) (*admission
 		return admissionResponse, nil
 	}
 
-	p, _, err := conf.GetPatch(request.Object.Raw, inject.ShouldInjectWebhook)
+	p, reports, err := conf.GetPatch(request.Object.Raw, inject.ShouldInjectWebhook)
 	if err != nil {
 		return nil, err
 	}
@@ -131,17 +133,15 @@ func (w *Webhook) inject(request *admissionv1beta1.AdmissionRequest) (*admission
 
 	p.AddCreatedByPodAnnotation(fmt.Sprintf("linkerd/proxy-injector %s", version.Version))
 
-	// When adding workloads through `kubectl apply` the spec template labels are
-	// automatically copied to the workload's main metadata section.
-	// This doesn't happen when adding labels through the webhook. So we manually
-	// add them to remain consistent.
-	conf.AddRootLabels(p)
-
 	patchJSON, err := p.Marshal()
 	if err != nil {
 		return nil, err
 	}
-	log.Infof("patch generated for: %s", conf)
+	// TODO: refactor GetPatch() so it only returns one report item
+	if len(reports) > 0 {
+		r := reports[0]
+		log.Infof("patch generated for: %s", r.ResName())
+	}
 	log.Debugf("patch: %s", patchJSON)
 
 	patchType := admissionv1beta1.PatchTypeJSONPatch
@@ -150,3 +150,10 @@ func (w *Webhook) inject(request *admissionv1beta1.AdmissionRequest) (*admission
 
 	return admissionResponse, nil
 }
+
+func (w *Webhook) ownerRetriever(ns string) inject.OwnerRetrieverFunc {
+	return func(p *v1.Pod) (string, string) {
+		p.SetNamespace(ns)
+		return w.k8sAPI.GetOwnerKindAndName(p)
+	}
+}

controller/proxy-injector/webhook_config.go

@@ -5,14 +5,14 @@ import (
 	"encoding/base64"
 	"text/template"
 
+	"github.com/linkerd/linkerd2/controller/k8s"
 	"github.com/linkerd/linkerd2/controller/proxy-injector/tmpl"
 	k8sPkg "github.com/linkerd/linkerd2/pkg/k8s"
 	"github.com/linkerd/linkerd2/pkg/tls"
 	log "github.com/sirupsen/logrus"
 	arv1beta1 "k8s.io/api/admissionregistration/v1beta1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/client-go/kubernetes"
 	"sigs.k8s.io/yaml"
 )
 
@@ -22,11 +22,11 @@ type WebhookConfig struct {
 	webhookServiceName  string
 	trustAnchor         []byte
 	configTemplate      *template.Template
-	k8sAPI              kubernetes.Interface
+	k8sAPI              *k8s.API
 }
 
 // NewWebhookConfig returns a new instance of initiator.
-func NewWebhookConfig(client kubernetes.Interface, controllerNamespace, webhookServiceName string, rootCA *tls.CA) (*WebhookConfig, error) {
+func NewWebhookConfig(api *k8s.API, controllerNamespace, webhookServiceName string, rootCA *tls.CA) (*WebhookConfig, error) {
 	trustAnchor := rootCA.Cred.EncodeCertificatePEM()
 
 	t := template.New(k8sPkg.ProxyInjectorWebhookConfig)
@@ -36,7 +36,7 @@ func NewWebhookConfig(client kubernetes.Interface, controllerNamespace, webhookS
 		webhookServiceName:  webhookServiceName,
 		trustAnchor:         []byte(trustAnchor),
 		configTemplate:      template.Must(t.Parse(tmpl.MutatingWebhookConfigurationSpec)),
-		k8sAPI:              client,
+		k8sAPI:              api,
 	}, nil
 }
 
@@ -97,15 +97,18 @@ func (w *WebhookConfig) create() (*arv1beta1.MutatingWebhookConfiguration, error
 		return nil, err
 	}
 
-	return w.k8sAPI.AdmissionregistrationV1beta1().MutatingWebhookConfigurations().Create(&config)
+	return w.k8sAPI.Client.
+		AdmissionregistrationV1beta1().MutatingWebhookConfigurations().Create(&config)
 }
 
 func (w *WebhookConfig) get() (*arv1beta1.MutatingWebhookConfiguration, error) {
-	return w.k8sAPI.AdmissionregistrationV1beta1().MutatingWebhookConfigurations().
+	return w.k8sAPI.Client.
+		AdmissionregistrationV1beta1().MutatingWebhookConfigurations().
 		Get(k8sPkg.ProxyInjectorWebhookConfig, metav1.GetOptions{})
 }
 
 func (w *WebhookConfig) delete() error {
-	return w.k8sAPI.AdmissionregistrationV1beta1().MutatingWebhookConfigurations().Delete(
-		k8sPkg.ProxyInjectorWebhookConfig, &metav1.DeleteOptions{})
+	return w.k8sAPI.Client.
+		AdmissionregistrationV1beta1().MutatingWebhookConfigurations().
+		Delete(k8sPkg.ProxyInjectorWebhookConfig, &metav1.DeleteOptions{})
 }

controller/proxy-injector/webhook_config_test.go

@@ -5,6 +5,7 @@ import (
 	"log"
 	"testing"
 
+	"github.com/linkerd/linkerd2/controller/k8s"
 	"github.com/linkerd/linkerd2/controller/proxy-injector/fake"
 	"github.com/linkerd/linkerd2/pkg/tls"
 )
@@ -16,14 +17,17 @@ func TestCreate(t *testing.T) {
 	)
 	log.SetOutput(ioutil.Discard)
 
-	client := fake.NewClient("")
+	k8sAPI, err := k8s.NewFakeAPI()
+	if err != nil {
+		t.Fatalf("NewFakeAPI returned an error: %s", err)
+	}
 
 	rootCA, err := tls.GenerateRootCAWithDefaults("Test CA")
 	if err != nil {
 		t.Fatalf("failed to create root CA: %s", err)
 	}
 
-	webhookConfig, err := NewWebhookConfig(client, namespace, webhookServiceName, rootCA)
+	webhookConfig, err := NewWebhookConfig(k8sAPI, namespace, webhookServiceName, rootCA)
 	if err != nil {
 		t.Fatal("Unexpected error: ", err)
 	}