mirror of
https://github.com/siderolabs/talos.git
synced 2025-10-27 22:41:34 +01:00
80fed31940
These endpoints are used for workers to find the addresses of the controlplane nodes to connect to `trustd` to issue certificates of `apid`. These endpoints today come from two sources: * discovery service data * Kubernetes API server endpoints This PR adds to the list static entry based on the Kubernetes control plane endpoint in the machine config. E.g. if the loadbalancer is used for the controlplane endpoint, and that loadbalancer also proxies requests for port 50001 (trustd), this static endpoint will provide workers with connectivity to trustd even if the discovery service is disabled, and Kubernetes API is not up. If this endpoint doesn't provide any trustd API, Talos will still try other endpoints. Talos does server certificate validation when calling trustd, so including malicious endpoints doesn't cause any harm, as malicious endpoint can't provider proper server certificate. Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
93 lines
2.6 KiB
Go
93 lines
2.6 KiB
Go
// This Source Code Form is subject to the terms of the Mozilla Public
|
|
// License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
|
|
package k8s
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"net"
|
|
"net/netip"
|
|
|
|
"github.com/cosi-project/runtime/pkg/controller"
|
|
"github.com/cosi-project/runtime/pkg/resource"
|
|
"github.com/cosi-project/runtime/pkg/safe"
|
|
"github.com/cosi-project/runtime/pkg/state"
|
|
"github.com/siderolabs/gen/slices"
|
|
"github.com/siderolabs/go-pointer"
|
|
"go.uber.org/zap"
|
|
|
|
"github.com/siderolabs/talos/pkg/machinery/resources/config"
|
|
"github.com/siderolabs/talos/pkg/machinery/resources/k8s"
|
|
)
|
|
|
|
// StaticEndpointController injects endpoints based on machine configuration.
|
|
type StaticEndpointController struct{}
|
|
|
|
// Name implements controller.Controller interface.
|
|
func (ctrl *StaticEndpointController) Name() string {
|
|
return "k8s.StaticEndpointController"
|
|
}
|
|
|
|
// Inputs implements controller.Controller interface.
|
|
func (ctrl *StaticEndpointController) Inputs() []controller.Input {
|
|
return []controller.Input{
|
|
{
|
|
Namespace: config.NamespaceName,
|
|
Type: config.MachineConfigType,
|
|
ID: pointer.To(config.V1Alpha1ID),
|
|
Kind: controller.InputWeak,
|
|
},
|
|
}
|
|
}
|
|
|
|
// Outputs implements controller.Controller interface.
|
|
func (ctrl *StaticEndpointController) Outputs() []controller.Output {
|
|
return []controller.Output{
|
|
{
|
|
Type: k8s.EndpointType,
|
|
Kind: controller.OutputShared,
|
|
},
|
|
}
|
|
}
|
|
|
|
// Run implements controller.Controller interface.
|
|
func (ctrl *StaticEndpointController) Run(ctx context.Context, r controller.Runtime, logger *zap.Logger) error {
|
|
for {
|
|
select {
|
|
case <-ctx.Done():
|
|
return nil
|
|
case <-r.EventCh():
|
|
}
|
|
|
|
machineConfig, err := safe.ReaderGet[*config.MachineConfig](ctx, r, resource.NewMetadata(config.NamespaceName, config.MachineConfigType, config.V1Alpha1ID, resource.VersionUndefined))
|
|
if err != nil {
|
|
if state.IsNotFoundError(err) {
|
|
continue
|
|
}
|
|
|
|
return fmt.Errorf("error getting machine config: %w", err)
|
|
}
|
|
|
|
cpHostname := machineConfig.Config().Cluster().Endpoint().Hostname()
|
|
|
|
var resolver net.Resolver
|
|
|
|
addrs, err := resolver.LookupNetIP(ctx, "ip", cpHostname)
|
|
if err != nil {
|
|
return fmt.Errorf("error resolving %q: %w", cpHostname, err)
|
|
}
|
|
|
|
addrs = slices.Map(addrs, netip.Addr.Unmap)
|
|
|
|
if err = safe.WriterModify(ctx, r, k8s.NewEndpoint(k8s.ControlPlaneNamespaceName, k8s.ControlPlaneKubernetesEndpointsID), func(endpoint *k8s.Endpoint) error {
|
|
endpoint.TypedSpec().Addresses = addrs
|
|
|
|
return nil
|
|
}); err != nil {
|
|
return fmt.Errorf("error modifying endpoint: %w", err)
|
|
}
|
|
}
|
|
}
|