DO NOT APPROVE/MERGE - adding dsnexec as a sidecar [OLD]

.github/workflows/build-main.yml

@@ -32,13 +32,15 @@ jobs:
         echo 'db-controller-namespace' > .id
         make docker-build
         make docker-build-dbproxy
+        make docker-build-dsnexec
 
     - name: Push to GHCR
       env:
         REGISTRY: ghcr.io/${{ github.repository_owner }}
       run: |
         make docker-push
         make docker-push-dbproxy
+        make docker-push-dsnexec
     - uses: act10ns/slack@v1
       with:
         status: ${{ job.status }}

Makefile

@@ -3,13 +3,15 @@ REGISTRY ?= ghcr.io/infobloxopen
 # image name
 IMAGE_NAME ?= db-controller
 DBPROXY_IMAGE_NAME ?= dbproxy
+DSNEXEC_IMAGE_NAME ?= dsnexec
 # commit tag info from git repo
 GIT_COMMIT	   := $(shell git describe --always || echo pre-commit)
 # image tag
 TAG ?= ${GIT_COMMIT}
 # Image Path to use all building/pushing image targets
 IMG_PATH ?= ${REGISTRY}/${IMAGE_NAME}
 DBPROXY_IMG_PATH ?= ${REGISTRY}/${DBPROXY_IMAGE_NAME}
+DSNEXEC_IMG_PATH ?= ${REGISTRY}/${DSNEXEC_IMAGE_NAME}
 GOBIN := ~/go/bin
 K8S_VERSION := 1.24
 # ACK_GINKGO_DEPRECATIONS := 1.16.5
@@ -143,6 +145,8 @@ test: manifests generate fmt vet envtest ## Run tests.
 build: generate fmt vet ## Build manager binary.
 	cd cmd/manager && go build -o ../../bin/manager main.go
 	cd dbproxy && go build -o ../bin/dbproxy
+	cd dsnexec && go build -o ../bin/dsnexec
+
 
 .PHONY: run
 run: manifests generate fmt vet ## Run a controller from your host.
@@ -160,6 +164,10 @@ docker-buildx: generate fmt vet manifests ## Build and optionally push a multi-a
 docker-build-dbproxy:
 	cd dbproxy && docker build -t ${DBPROXY_IMG_PATH}:${TAG} .
 
+docker-build-dsnexec:
+	cd dsnexec && docker build -t ${DSNEXEC_IMG_PATH}:${TAG} .
+
+
 .PHONY: docker-build
 docker-build: .image-${TAG} #test ## Build docker image with the manager.
 
@@ -171,6 +179,9 @@ docker-build: .image-${TAG} #test ## Build docker image with the manager.
 docker-push-dbproxy: docker-build-dbproxy
 	docker push ${DBPROXY_IMG_PATH}:${TAG}
 
+docker-push-dsnexec: docker-build-dsnexec
+	docker push ${DSNEXEC_IMG_PATH}:${TAG}
+
 .push-${TAG}: docker-build
 	docker push ${IMG_PATH}:${TAG}
 	@touch $@

cmd/manager/main.go

@@ -82,10 +82,12 @@ func main() {
 	var metricsPort int
 	var enableLeaderElection bool
 	var configFile string
-	var sidecarConfigPath string
+	var dBProxySidecarConfigPath string
+	var dsnExecSidecarConfigPath string
 	var probeAddr string
 	var probePort int
 	var enableDBProxyWebhook bool
+	var enableDsnExecWebhook bool
 	var dbIdentifierPrefix string
 	var class string
 	var metricsDepYamlPath string
@@ -101,13 +103,18 @@ func main() {
 		"Enable leader election for controller manager. "+
 			"Enabling this will ensure there is only one active controller manager.")
 	flag.StringVar(&configFile, "config-file", "/etc/config/config.yaml", "Database connection string to with root credentials.")
-	flag.StringVar(&sidecarConfigPath, "sidecar-config-path", "/etc/config/sidecar.yaml", "Mutating webhook sidecar configuration.")
+	flag.StringVar(&dBProxySidecarConfigPath, "db-proxy-sidecar-config-path", "/etc/config/sidecar.yaml", "Mutating webhook sidecar configuration.")
+	flag.StringVar(&dsnExecSidecarConfigPath, "dsnexec-sidecar-config-path", "/etc/config/sidecar.yaml", "Mutating webhook sidecar configuration.")
 	flag.StringVar(&metricsDepYamlPath, "metrics-dep-yaml", "/config/postgres-exporter/deployment.yaml", "path to the metrics deployment yaml")
 	flag.StringVar(&metricsConfigYamlPath, "metrics-config-yaml", "/config/postgres-exporter/config.yaml", "path to the metrics config yaml")
 	flag.BoolVar(&enableDBProxyWebhook, "enable-db-proxy", false,
 		"Enable DB Proxy webhook. "+
 			"Enabling this option will cause the db-controller to inject db proxy pod into pods "+
 			"with the infoblox.com/db-secret-path annotation set.")
+	flag.BoolVar(&enableDsnExecWebhook, "enable-dsnexec", false,
+		"Enable Dsnexec webhook. "+
+			"Enabling this option will cause the db-controller to inject dsnexec container into pods "+
+			"with the infoblox.com/remote-db-dsn-secret and infoblox.com/dsnexec-config-secret annotations set.")
 	opts := zap.Options{
 		Development: false,
 		TimeEncoder: zapcore.RFC3339NanoTimeEncoder,
@@ -166,28 +173,48 @@ func main() {
 		os.Exit(1)
 	}
 
-	if enableDBProxyWebhook {
+	if enableDBProxyWebhook || enableDsnExecWebhook {
 		webHookServer := mgr.GetWebhookServer()
-
 		webHookServer.Port = 7443
 		webHookServer.CertDir = "./certs/"
-
-		cfg, err := dbwebhook.ParseConfig(sidecarConfigPath)
-		if err != nil {
-			setupLog.Error(err, "could not parse db proxy sidecar configuration")
-			os.Exit(1)
+		if enableDBProxyWebhook {
+
+			cfg, err := dbwebhook.ParseConfig(dBProxySidecarConfigPath)
+
+			if err != nil {
+				setupLog.Error(err, "could not parse db proxy sidecar configuration")
+				os.Exit(1)
+			}
+			setupLog.Info("Parsed db proxy conig:", "dbproxysidecarconfig", cfg)
+
+			setupLog.Info("registering with webhook server for DbProxy")
+			webHookServer.Register("/mutate", &webhook.Admission{
+				Handler: &dbwebhook.DBProxyInjector{
+					Name:                 "DB Proxy",
+					Client:               mgr.GetClient(),
+					DBProxySidecarConfig: cfg,
+				},
+			})
+		}
+		if enableDsnExecWebhook {
+
+			cfg, err := dbwebhook.ParseConfig(dsnExecSidecarConfigPath)
+
+			if err != nil {
+				setupLog.Error(err, "could not parse dsnexec  sidecar configuration")
+				os.Exit(1)
+			}
+			setupLog.Info("Parsed dsnexec conig:", "dsnexecsidecarconfig", cfg)
+
+			setupLog.Info("registering with webhook server for DsnExec")
+			webHookServer.Register("/mutate-dsnexec", &webhook.Admission{
+				Handler: &dbwebhook.DsnExecInjector{
+					Name:                 "Dsnexec",
+					Client:               mgr.GetClient(),
+					DsnExecSidecarConfig: cfg,
+				},
+			})
 		}
-
-		setupLog.Info("Parsed db proxy config:", "dbproxysidecarconfig", cfg)
-
-		setupLog.Info("registering with webhook server")
-		webHookServer.Register("/mutate", &webhook.Admission{
-			Handler: &dbwebhook.DBProxyInjector{
-				Name:                 "DB Proxy",
-				Client:               mgr.GetClient(),
-				DBProxySidecarConfig: cfg,
-			},
-		})
 	}
 
 	setupLog.Info("starting manager")

config/dsnexec/dsnexecsidecar.json

@@ -0,0 +1,35 @@
+{
+  "containers": [
+    {
+      "imagePullPolicy": "IfNotPresent",
+      "args": ["run","-c","/var/run/dsn-exec/config.yaml"],
+      "name": "dsn-exec",
+      "volumeMounts": [
+        {
+          "mountPath": "/var/run/db-dsn",
+          "name": "remote-db-dsn-volume"
+        },
+        {
+          "mountPath": "/var/run/dsn-exec",
+          "name": "dsnexec-config-volume"
+        }
+      ]
+    }
+  ],
+  "volumes": [
+    {
+      "name": "remote-db-dsn-volume",
+      "secret": {
+        "optional": false,
+        "secretName": "..."
+      }
+    },
+    {
+      "name": "dsnexec-config-volume",
+      "secret": {
+        "optional": false,
+        "secretName": "..."
+      }
+    }
+  ]
+}

helm/db-controller/templates/certs.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.dbproxy.enabled }}
+{{- if or ( .Values.dbproxy.enabled ) ( .Values.dsnexec.enabled ) }}
 apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:

helm/db-controller/templates/deployment.yaml

@@ -54,15 +54,19 @@ spec:
                   fieldPath: metadata.namespace
             - name: DBPROXY_IMAGE
               value: "{{ .Values.dbproxy.image.repository }}:{{ .Values.dbproxy.image.tag | default .Chart.AppVersion }}"
+            - name: DSNEXEC_IMAGE
+              value: "{{ .Values.dsnexec.image.repository }}:{{ .Values.dsnexec.image.tag | default .Chart.AppVersion }}"
           args:
             - --metrics-addr={{ .Values.metrics.address }}
             - --metrics-port={{ .Values.metrics.port }}
             - --health-probe-address={{ .Values.healthProbe.address }}
             - --health-probe-port={{ .Values.healthProbe.port }}
             - --enable-leader-election
             - --enable-db-proxy={{ .Values.dbproxy.enabled }}
+            - --enable-dsnexec={{ .Values.dsnexec.enabled }}
             - --config-file=/etc/config/config.yaml
-            - --sidecar-config-path=config/dbproxy/dbproxysidecar.json
+            - --db-proxy-sidecar-config-path=config/dbproxy/dbproxysidecar.json
+            - --dsnexec-sidecar-config-path=config/dsnexec/dsnexecsidecar.json
             - --db-identifier-prefix={{ tpl .Values.db.identifier.prefix . }}
             - --class={{ .Values.dbController.class }}
             {{ if .Values.zapLogger.develMode }}
@@ -96,7 +100,7 @@ spec:
               mountPath: /pg-temp
             - name: config-volume
               mountPath: /etc/config
-            {{- if .Values.dbproxy.enabled }}
+            {{- if or ( .Values.dbproxy.enabled ) ( .Values.dsnexec.enabled ) }}
             - name: dbproxycert
               mountPath: /certs
               readOnly: true
@@ -107,7 +111,7 @@ spec:
       - name: config-volume
         configMap:
           name: {{ include "db-controller.name" . }}-config
-      {{- if .Values.dbproxy.enabled }}
+      {{- if or ( .Values.dbproxy.enabled ) ( .Values.dsnexec.enabled ) }}
       - name: dbproxycert
         secret:
           secretName: {{ include "db-controller.fullname" . }}

helm/db-controller/templates/webhook.yaml

@@ -1,11 +1,12 @@
-{{- if .Values.dbproxy.enabled }}
+{{- if or ( .Values.dbproxy.enabled ) ( .Values.dsnexec.enabled ) }}
 apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
 metadata:
   name: {{ include "db-controller.fullname" . }}
   annotations:
     cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "db-controller.fullname" . }}
 webhooks:
+{{- if .Values.dbproxy.enabled }}
 - clientConfig:
     caBundle: Cg==
     service:
@@ -29,3 +30,28 @@ webhooks:
     - pods
     scope: "Namespaced"
 {{- end }}
+{{- if .Values.dsnexec.enabled }}
+- clientConfig:
+    caBundle: Cg==
+    service:
+      name: {{ include "db-controller.fullname" . }}-dsnexec
+      path: /mutate-dsnexec
+      port: 7443
+      namespace: {{ .Release.Namespace }}
+  sideEffects: None
+  admissionReviewVersions: ["v1"]
+  failurePolicy: Ignore
+  name: dsnexec-injector.infoblox.com
+  rules:
+  - apiGroups:
+    - ""
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - pods
+    scope: "Namespaced"
+{{- end }}
+{{- end }}

helm/db-controller/values.yaml

@@ -106,6 +106,12 @@ dbproxy:
     # Overrides the image tag whose default is the chart appVersion.
     tag: ""
 
+dsnexec:
+  enabled: true
+  image:
+    repository: "ghcr.io/infobloxopen/dsnexec"
+    tag: ""
+
 zapLogger:
   develMode: false
   level: info