feat: add webhook for validating module config virtualization (#571)

Add a webhook for ModuleConfig Virtualization

Signed-off-by: yaroslavborbat <yaroslav.752@gmail.com>

hooks/module_config_validator.py

@@ -0,0 +1,104 @@
+#!/usr/bin/env python3
+#
+# Copyright 2024 Flant JSC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from typing import Callable
+from deckhouse import hook
+from lib.hooks.hook import Hook
+from ipaddress import ip_network,ip_address,IPv4Network,IPv4Address
+import common
+
+
+class ModuleConfigValidateHook(Hook):
+    KIND="ModuleConfig"
+    API_VERSION="deckhouse.io/v1alpha1"
+    SNAPSHOT_MODULE_CONFIG = "module-config"
+    SNAPSHOT_NODES = "nodes"
+
+    def __init__(self, module_name: str):
+        self.module_name = module_name
+        self.queue = f"/modules/{self.module_name}/{self.SNAPSHOT_MODULE_CONFIG}"
+
+    def generate_config(self) -> dict:
+        """executeHookOnEvent is empty because we need only execute at module start."""
+        return {
+            "configVersion": "v1",
+            "kubernetes": [
+                {
+                    "name": self.SNAPSHOT_MODULE_CONFIG,
+                    "executeHookOnSynchronization": True,
+                    "executeHookOnEvent": [],
+                    "apiVersion": self.API_VERSION,
+                    "kind": self.KIND,
+                    "nameSelector": {
+                        "matchNames": [self.module_name]
+                    },
+                    "group": "main",
+                    "jqFilter": '{"cidrs": .spec.settings.virtualMachineCIDRs}',
+                    "queue": self.queue,
+                    "keepFullObjectsInMemory": False
+                },
+                {
+                    "name": self.SNAPSHOT_NODES,
+                    "executeHookOnSynchronization": True,
+                    "executeHookOnEvent": [],
+                    "apiVersion": "v1",
+                    "kind": "Node",
+                    "group": "main",
+                    "jqFilter": '{"addresses": .status.addresses}',
+                    "queue": self.queue,
+                    "keepFullObjectsInMemory": False
+                }
+            ]
+        }
+
+    def check_overlaps_cidrs(networks: list[IPv4Network]) -> None:
+        """Check for overlapping CIDRs in a list of networks."""
+        for i, net1 in enumerate(networks):
+            for net2 in networks[i + 1:]:
+                if net1.overlaps(net2):
+                    raise ValueError(f"Overlapping CIDRs {net1} and {net2}")
+
+    def check_node_addresses_overlap(networks: list[IPv4Network], node_addresses: list[IPv4Address]) -> None:
+        """Check if node addresses overlap with any subnet."""
+        for addr in node_addresses:
+            for net in networks:
+                if addr in net:
+                    raise ValueError(f"Node address {addr} overlaps with subnet {net}")
+
+    def reconcile(self) -> Callable[[hook.Context], None]:
+        def r(ctx: hook.Context):
+            cidrs: list[IPv4Network] = [
+                ip_network(c)
+                for c in ctx.snapshots.get(self.SNAPSHOT_MODULE_CONFIG, [{}])[0]
+                .get("filterResult", {})
+                .get("cidrs", [])
+            ]
+            self.check_overlaps_cidrs(cidrs)
+
+            node_addresses: list[IPv4Address] = [
+                ip_address(addr["address"])
+                for snap in ctx.snapshots.get(self.SNAPSHOT_NODES, [])
+                for addr in (snap.get("filterResult", {}).get("addresses") or [])
+                if addr.get("type") in {"InternalIP", "ExternalIP"}
+            ]
+            self.check_node_addresses_overlap(cidrs, node_addresses)
+
+        return r
+
+
+if __name__ == "__main__":
+    h = ModuleConfigValidateHook(common.MODULE_NAME)
+    h.run()

images/virtualization-artifact/cmd/virtualization-controller/main.go

@@ -40,6 +40,8 @@ import (
 	appconfig "github.com/deckhouse/virtualization-controller/pkg/config"
 	"github.com/deckhouse/virtualization-controller/pkg/controller/cvi"
 	"github.com/deckhouse/virtualization-controller/pkg/controller/indexer"
+	mc "github.com/deckhouse/virtualization-controller/pkg/controller/moduleconfig"
+	mcapi "github.com/deckhouse/virtualization-controller/pkg/controller/moduleconfig/api"
 	"github.com/deckhouse/virtualization-controller/pkg/controller/vd"
 	"github.com/deckhouse/virtualization-controller/pkg/controller/vdsnapshot"
 	"github.com/deckhouse/virtualization-controller/pkg/controller/vi"
@@ -166,6 +168,7 @@ func main() {
 		cdiv1beta1.AddToScheme,
 		virtv1.AddToScheme,
 		vsv1.AddToScheme,
+		mcapi.AddToScheme,
 	} {
 		err = f(scheme)
 		if err != nil {
@@ -305,6 +308,11 @@ func main() {
 		os.Exit(1)
 	}
 
+	if err = mc.SetupWebhookWithManager(mgr); err != nil {
+		log.Error(err.Error())
+		os.Exit(1)
+	}
+
 	log.Info("Starting the Manager.")
 
 	// Start the Manager

images/virtualization-artifact/pkg/controller/moduleconfig/api/deep_copy.go

@@ -0,0 +1,125 @@
+/*
+Copyright 2024 Flant JSC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package api
+
+import "k8s.io/apimachinery/pkg/runtime"
+
+func (in *ModuleConfig) DeepCopyInto(out *ModuleConfig) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	out.Status = in.Status
+}
+
+func (in *ModuleConfig) DeepCopy() *ModuleConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(ModuleConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+func (in *ModuleConfig) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+func (in *ModuleConfigList) DeepCopyInto(out *ModuleConfigList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ModuleConfig, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+func (in *ModuleConfigList) DeepCopy() *ModuleConfigList {
+	if in == nil {
+		return nil
+	}
+	out := new(ModuleConfigList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+func (in *ModuleConfigList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+func (in *ModuleConfigSpec) DeepCopyInto(out *ModuleConfigSpec) {
+	*out = *in
+	in.Settings.DeepCopyInto(&out.Settings)
+	if in.Enabled != nil {
+		in, out := &in.Enabled, &out.Enabled
+		*out = new(bool)
+		**out = **in
+	}
+}
+
+func (in *ModuleConfigSpec) DeepCopy() *ModuleConfigSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ModuleConfigSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+func (in *ModuleConfigStatus) DeepCopyInto(out *ModuleConfigStatus) {
+	*out = *in
+}
+
+func (in *ModuleConfigStatus) DeepCopy() *ModuleConfigStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(ModuleConfigStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+func (v *SettingsValues) DeepCopy() *SettingsValues {
+	nmap := make(map[string]interface{}, len(*v))
+
+	for key, value := range *v {
+		nmap[key] = value
+	}
+
+	vv := SettingsValues(nmap)
+
+	return &vv
+}
+
+func (v SettingsValues) DeepCopyInto(out *SettingsValues) {
+	{
+		v := &v
+		clone := v.DeepCopy()
+		*out = *clone
+		return
+	}
+}

images/virtualization-artifact/pkg/controller/moduleconfig/api/moduleconfig.go

@@ -0,0 +1,57 @@
+/*
+Copyright 2024 Flant JSC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package api
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+var _ runtime.Object = (*ModuleConfig)(nil)
+
+// ModuleConfig is a configuration for module or for global config values.
+type ModuleConfig struct {
+	metav1.TypeMeta `json:",inline"`
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec ModuleConfigSpec `json:"spec"`
+
+	Status ModuleConfigStatus `json:"status,omitempty"`
+}
+
+// SettingsValues empty interface in needed to handle DeepCopy generation. DeepCopy does not work with unnamed empty interfaces
+type SettingsValues map[string]interface{}
+
+type ModuleConfigSpec struct {
+	Version  int            `json:"version,omitempty"`
+	Settings SettingsValues `json:"settings,omitempty"`
+	Enabled  *bool          `json:"enabled,omitempty"`
+}
+
+type ModuleConfigStatus struct {
+	Version string `json:"version"`
+	Message string `json:"message"`
+}
+
+// ModuleConfigList is a list of ModuleConfig resources
+type ModuleConfigList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata"`
+
+	Items []ModuleConfig `json:"items"`
+}

images/virtualization-artifact/pkg/controller/moduleconfig/api/register.go

@@ -0,0 +1,54 @@
+/*
+Copyright 2024 Flant JSC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package api
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+const (
+	Version   = "v1alpha1"
+	GroupName = "deckhouse.io"
+)
+
+// SchemeGroupVersion is group version used to register these objects
+var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: Version}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	// SchemeBuilder tbd
+	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
+	// AddToScheme tbd
+	AddToScheme = SchemeBuilder.AddToScheme
+)
+
+// Adds the list of known types to api.Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&ModuleConfig{},
+		&ModuleConfigList{},
+	)
+
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}