// register a webhook to enable the java agent injectorsetupLog.Info("registering /mutate-v1-pod webhook")mgr.GetWebhookServer().Register("/mutate-v1-pod",&webhook.Admission{Handler: &injector.JavaagentInjector{Client: mgr.GetClient()}})setupLog.Info("/mutate-v1-pod webhook is registered")swck向k8s注冊了/mutate-v1-pod以及對應(yīng)的handler 。我們可以想到，當(dāng)create或update pod時，k8s將會調(diào)用path對應(yīng)的handler處理 。4. 查看Handler: injector.JavaagentInjector
// Handle will process every coming pod under the// specified namespace which labeled "swck-injection=enabled"func (r *JavaagentInjector) Handle(ctx context.Context, req admission.Request) admission.Response {pod := &corev1.Pod{}if err := r.decoder.Decode(req, pod); err != nil {return admission.Errored(http.StatusBadRequest, err)}// set Annotations to avoid repeated judgmentsif pod.Annotations == nil {pod.Annotations = map[string]string{}}// 查找所有匹配的swAgentswAgentL := r.findMatchedSwAgentL(ctx, req, pod)//初始化所有annotations(加載所有annotations)anno, err := NewAnnotations()if err != nil {javaagentInjectorLog.Error(err, "get NewAnnotations error")}//創(chuàng)建AnnotationOverlay對象,它是一個map，用于保存被overlaied的annotationao := NewAnnotationOverlay()//創(chuàng)建SidecarInjectField對象s := NewSidecarInjectField()//構(gòu)建inject鏈對象ip := NewInjectProcess(ctx, s, anno, ao, swAgentL, pod, req, javaagentInjectorLog, r.Client)//開始injectreturn ip.Run()}
- 創(chuàng)建inject chain對象Inject chain對象集合了此次有變更的Pod, webhook request, k8s client以及注解、swagent等對象
// NewInjectProcess create a new InjectProcessfunc NewInjectProcess(ctx context.Context, injectFileds *SidecarInjectField, annotation *Annotations,annotationOverlay *AnnotationOverlay, swAgentL *v1alpha1.SwAgentList, pod *corev1.Pod, req admission.Request, log logr.Logger,kubeclient client.Client) *InjectProcessData {return &InjectProcessData{ctx:ctx,injectFileds:injectFileds,annotation:annotation,annotationOverlay: annotationOverlay,swAgentL:swAgentL,pod:pod,req:req,log:log,kubeclient:kubeclient,}}- 看下ip.Run()方法經(jīng)過了前面鋪墊，終于到了主題了，run方法首先按照執(zhí)行順序倒序構(gòu)造了一個執(zhí)行鏈，然后執(zhí)行 。
// Run will connect the above six steps into a chain and start to execute the first stepfunc (ipd *InjectProcessData) Run() admission.Response {// set final steppodInject := &PodInject{}// set next step is PodInjectgetConfigmap := &GetConfigmap{}getConfigmap.setNext(podInject)// set next step is GetConfigmapoverlayPlugins := &OverlayPlugins{}overlayPlugins.setNext(getConfigmap)// set next step is OverlayPluginsoverlayAgent := &OverlayAgent{}overlayAgent.setNext(overlayPlugins)// set next step is OverlayAgentoverlaysidecar := &OverlaySidecar{}overlaysidecar.setNext(overlayAgent)// set next step is OverlaySwAgentCRoverlaySwAgentCR := &OverlaySwAgentCR{}overlaySwAgentCR.setNext(overlaysidecar)// set next step is OverlaySidecargetStrategy := &GetStrategy{}getStrategy.setNext(overlaySwAgentCR)// this is first step and do real injectionreturn getStrategy.execute(ipd)}- 首先執(zhí)行的是GetStrategy
func (gs *GetStrategy) execute(ipd *InjectProcessData) admission.Response {log.Info("=============== GetStrategy ================")ipd.injectFileds.GetInjectStrategy(*ipd.annotation, &ipd.pod.ObjectMeta.Labels, &ipd.pod.ObjectMeta.Annotations)if !ipd.injectFileds.NeedInject {log.Info("don't inject agent")return admission.Allowed("ok")}return gs.next.execute(ipd)}// GetInjectStrategy gets user's injection strategyfunc (s *SidecarInjectField) GetInjectStrategy(a Annotations, labels,annotation *map[string]string) {// set default values.NeedInject = false// set NeedInject's value , if the pod has the label "swck-java-agent-injected=true", means need injectif *labels == nil {return}if strings.EqualFold((*labels)[ActiveInjectorLabel], "true") {s.NeedInject = true}if *annotation == nil {return}// set injectContainer's valueif v, ok := (*annotation)[sidecarInjectContainerAnno]; ok {s.InjectContainer = v}}
經(jīng)驗總結(jié)擴展閱讀
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
