Skip to content

Commit 122c740

Browse files
J12934J12934
committed
Rename property to make it's effect more clear.
Would potentially be confusing otherwise as the operator doesn't inject the istio sidecars, it's just allowing/preventing it. Signed-off-by: Jannik Hollenbach <jannik.hollenbach@iteratec.com>
1 parent 3c83809 commit 122c740

9 files changed

Lines changed: 19 additions & 29 deletions

File tree

‎operator/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,7 @@ helm install securecodebox-operator oci://ghcr.io/securecodebox/helm/operator
7373

7474
| Key | Type | Default | Description |
7575
|-----|------|---------|-------------|
76+
| allowIstioSidecarInjectionInJobs | bool | `false` | Sets the value of the istio sidecar annotation ("sidecar.istio.io/inject") for jobs started by the operator (scans, parser and hooks). defaults to false to prevent jobs hanging indefinitely due to the sidecar never terminating. If you aren't using istio this setting/annotation has no effect. |
7677
| customCACertificate | object | `{"certificate":"public.crt","existingCertificate":null}` | Setup for Custom CA certificates. These are automatically mounted into every secureCodeBox component (lurker, parser & hooks). Requires that every namespace has a configmap with the CA certificate(s) |
7778
| customCACertificate.certificate | string | `"public.crt"` | key in the configmap holding the certificate(s) |
7879
| customCACertificate.existingCertificate | string | `nil` | name of the configMap holding the ca certificate(s), needs to be the same across all namespaces |

‎operator/controllers/execution/scans/hook_reconciler.go‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ package scancontrollers
77
import (
88
"context"
99
"fmt"
10-
"os"
1110

1211
"k8s.io/apimachinery/pkg/labels"
1312

@@ -380,12 +379,6 @@ func (r *ScanReconciler) createJobForHook(hookName string, hookSpec *executionv1
380379
resources = hookSpec.Resources
381380
}
382381

383-
istioInjectJobs := "false"
384-
385-
if configuredIstioInjectJobs, ok := os.LookupEnv("ISTIO_INJECT_JOBS"); ok {
386-
istioInjectJobs = configuredIstioInjectJobs
387-
}
388-
389382
job := &batch.Job{
390383
ObjectMeta: metav1.ObjectMeta{
391384
Annotations: make(map[string]string),
@@ -403,7 +396,7 @@ func (r *ScanReconciler) createJobForHook(hookName string, hookSpec *executionv1
403396
},
404397
Annotations: map[string]string{
405398
"auto-discovery.securecodebox.io/ignore": "true",
406-
"sidecar.istio.io/inject": istioInjectJobs,
399+
"sidecar.istio.io/inject": allowIstioSidecarInjectionInJobs,
407400
},
408401
},
409402
Spec: corev1.PodSpec{

‎operator/controllers/execution/scans/init.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
package scancontrollers
66

77
import (
8+
"os"
9+
810
"github.com/prometheus/client_golang/prometheus"
911
"sigs.k8s.io/controller-runtime/pkg/metrics"
1012
)
@@ -37,7 +39,13 @@ var (
3739
)
3840
)
3941

42+
var allowIstioSidecarInjectionInJobs = "false"
43+
4044
func init() {
4145
// Register custom metrics with the global prometheus registry
4246
metrics.Registry.MustRegister(scansStartedMetric, scansDoneMetric, scansErroredMetric)
47+
48+
if allowIstioSidecarInjectionInJobsEnv, ok := os.LookupEnv("ALLOW_ISTIO_SIDECAR_INJECTION_IN_JOBS"); ok && (allowIstioSidecarInjectionInJobsEnv == "true" || allowIstioSidecarInjectionInJobsEnv == "false") {
49+
allowIstioSidecarInjectionInJobs = allowIstioSidecarInjectionInJobsEnv
50+
}
4351
}

‎operator/controllers/execution/scans/parse_reconciler.go‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ package scancontrollers
77
import (
88
"context"
99
"fmt"
10-
"os"
1110
"strings"
1211

1312
executionv1 "github.com/secureCodeBox/secureCodeBox/operator/apis/execution/v1"
@@ -138,12 +137,6 @@ func (r *ScanReconciler) startParser(scan *executionv1.Scan) error {
138137
resources = parseDefinitionSpec.Resources
139138
}
140139

141-
istioInjectJobs := "false"
142-
143-
if configuredIstioInjectJobs, ok := os.LookupEnv("ISTIO_INJECT_JOBS"); ok {
144-
istioInjectJobs = configuredIstioInjectJobs
145-
}
146-
147140
job := &batch.Job{
148141
ObjectMeta: metav1.ObjectMeta{
149142
Annotations: make(map[string]string),
@@ -161,7 +154,7 @@ func (r *ScanReconciler) startParser(scan *executionv1.Scan) error {
161154
},
162155
Annotations: map[string]string{
163156
"auto-discovery.securecodebox.io/ignore": "true",
164-
"sidecar.istio.io/inject": istioInjectJobs,
157+
"sidecar.istio.io/inject": allowIstioSidecarInjectionInJobs,
165158
},
166159
},
167160
Spec: corev1.PodSpec{

‎operator/controllers/execution/scans/scan_reconciler.go‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -233,15 +233,9 @@ func (r *ScanReconciler) constructJobForScan(scan *executionv1.Scan, scanTypeSpe
233233
podAnnotations = make(map[string]string)
234234
}
235235

236-
istioInjectJobs := "false"
237-
238-
if configuredIstioInjectJobs, ok := os.LookupEnv("ISTIO_INJECT_JOBS"); ok {
239-
istioInjectJobs = configuredIstioInjectJobs
240-
}
241-
242236
podAnnotations["auto-discovery.securecodebox.io/ignore"] = "true"
243237
// Ensuring that istio doesn't inject a sidecar proxy.
244-
podAnnotations["sidecar.istio.io/inject"] = istioInjectJobs
238+
podAnnotations["sidecar.istio.io/inject"] = allowIstioSidecarInjectionInJobs
245239
job.Spec.Template.Annotations = podAnnotations
246240

247241
if job.Spec.Template.Spec.ServiceAccountName == "" {

‎operator/docs/README.ArtifactHub.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ helm install securecodebox-operator oci://ghcr.io/securecodebox/helm/operator
7878

7979
| Key | Type | Default | Description |
8080
|-----|------|---------|-------------|
81+
| allowIstioSidecarInjectionInJobs | bool | `false` | Sets the value of the istio sidecar annotation ("sidecar.istio.io/inject") for jobs started by the operator (scans, parser and hooks). defaults to false to prevent jobs hanging indefinitely due to the sidecar never terminating. If you aren't using istio this setting/annotation has no effect. |
8182
| customCACertificate | object | `{"certificate":"public.crt","existingCertificate":null}` | Setup for Custom CA certificates. These are automatically mounted into every secureCodeBox component (lurker, parser & hooks). Requires that every namespace has a configmap with the CA certificate(s) |
8283
| customCACertificate.certificate | string | `"public.crt"` | key in the configmap holding the certificate(s) |
8384
| customCACertificate.existingCertificate | string | `nil` | name of the configMap holding the ca certificate(s), needs to be the same across all namespaces |

‎operator/templates/manager/manager.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -139,8 +139,8 @@ spec:
139139
value: {{ .Values.presignedUrlExpirationTimes.parsers | quote }}
140140
- name: URL_EXPIRATION_HOOK
141141
value: {{ .Values.presignedUrlExpirationTimes.hooks | quote }}
142-
- name: ISTIO_INJECT_JOBS
143-
value: {{ .Values.istioInjectJobs | quote }}
142+
- name: ALLOW_ISTIO_SIDECAR_INJECTION_IN_JOBS
143+
value: {{ .Values.allowIstioSidecarInjectionInJobs | quote }}
144144
resources:
145145
{{- toYaml .Values.resources | nindent 12 }}
146146
securityContext:

‎operator/tests/__snapshot__/operator_test.yaml.snap‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ matches the snapshot:
7777
value: 1h
7878
- name: URL_EXPIRATION_HOOK
7979
value: 1h
80-
- name: ISTIO_INJECT_JOBS
80+
- name: ALLOW_ISTIO_SIDECAR_INJECTION_IN_JOBS
8181
value: "false"
8282
image: docker.io/securecodebox/operator:0.0.0
8383
imagePullPolicy: IfNotPresent
@@ -685,7 +685,7 @@ properly-renders-the-service-monitor-when-enabled:
685685
value: 1h
686686
- name: URL_EXPIRATION_HOOK
687687
value: 1h
688-
- name: ISTIO_INJECT_JOBS
688+
- name: ALLOW_ISTIO_SIDECAR_INJECTION_IN_JOBS
689689
value: "false"
690690
image: docker.io/securecodebox/operator:0.0.0
691691
imagePullPolicy: IfNotPresent

‎operator/values.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -129,5 +129,5 @@ presignedUrlExpirationTimes:
129129
parsers: "1h"
130130
hooks: "1h"
131131

132-
# Sets the value of the istio sidecar annotation for jobs: "sidecar.istio.io/inject"
133-
istioInjectJobs: false
132+
# -- Sets the value of the istio sidecar annotation ("sidecar.istio.io/inject") for jobs started by the operator (scans, parser and hooks). defaults to false to prevent jobs hanging indefinitely due to the sidecar never terminating. If you aren't using istio this setting/annotation has no effect.
133+
allowIstioSidecarInjectionInJobs: false

0 commit comments

Comments
 (0)