add inclusterconfig filter for commenting kube-proxy configmap

pkg/yurtctl/cmd/yurttest/kindinit/init.go

@@ -411,10 +411,6 @@ func (ki *Initializer) configureAddons() error {
 		return err
 	}
 
-	if err := ki.ConfigureKubeProxyAddon(); err != nil {
-		return err
-	}
-
 	// re-construct kube-proxy pods
 	podList, err := ki.kubeClient.CoreV1().Pods("kube-system").List(context.TODO(), metav1.ListOptions{})
 	if err != nil {
@@ -593,31 +589,6 @@ func (ki *Initializer) configureCoreDnsAddon() error {
 	return nil
 }
 
-func (ki *Initializer) ConfigureKubeProxyAddon() error {
-	// configure configmap kube-system/kube-proxy in order to make kube-proxy access kube-apiserver by going through yurthub
-	cm, err := ki.kubeClient.CoreV1().ConfigMaps("kube-system").Get(context.TODO(), "kube-proxy", metav1.GetOptions{})
-	if err != nil {
-		return err
-	}
-	if cm != nil && strings.Contains(cm.Data["config.conf"], "kubeconfig") {
-		lines := strings.Split(cm.Data["config.conf"], "\n")
-		for i := range lines {
-			if strings.Contains(lines[i], "kubeconfig:") {
-				lines = append(lines[:i], lines[i+1:]...)
-				break
-			}
-		}
-		cm.Data["config.conf"] = strings.Join(lines, "\n")
-
-		// update kube-proxy configmap
-		_, err = ki.kubeClient.CoreV1().ConfigMaps("kube-system").Update(context.TODO(), cm, metav1.UpdateOptions{})
-		if err != nil {
-			return fmt.Errorf("failed to configure kube-proxy configmap, %w", err)
-		}
-	}
-	return nil
-}
-
 func (ki *Initializer) deployOpenYurt() error {
 	converter := &ClusterConverter{
 		ClientSet:                  ki.kubeClient,

pkg/yurtctl/cmd/yurttest/kindinit/init_test.go

@@ -652,28 +652,6 @@ func TestInitializer_ConfigureCoreDnsAddon(t *testing.T) {
 		t.Errorf("failed to configure core dns addon")
 	}
 }
-func TestInitializer_ConfigureKubeProxyAddon(t *testing.T) {
-	var fakeOut io.Writer
-	initializer := newKindInitializer(fakeOut, newKindOptions().Config())
-
-	case1 := struct {
-		configObj *corev1.ConfigMap
-		want      interface{}
-	}{
-		configObj: &corev1.ConfigMap{
-			ObjectMeta: metav1.ObjectMeta{Namespace: "kube-system", Name: "kube-proxy"},
-			Data: map[string]string{
-				"config.conf": "{ cd .. \n kubeconfig:  \n  cluster",
-			},
-		},
-		want: nil,
-	}
-	initializer.kubeClient = clientsetfake.NewSimpleClientset(case1.configObj)
-	err := initializer.ConfigureKubeProxyAddon()
-	if err != case1.want {
-		t.Errorf("failed to configure core dns addon")
-	}
-}
 
 func TestInitializer_ConfigureAddons(t *testing.T) {
 
@@ -682,7 +660,6 @@ func TestInitializer_ConfigureAddons(t *testing.T) {
 
 	case1 := struct {
 		coreDnsConfigObj *corev1.ConfigMap
-		proxyConfigObj   *corev1.ConfigMap
 		serviceObj       *corev1.Service
 		podObj           *corev1.Pod
 		deploymentObj    *v1.Deployment
@@ -695,13 +672,6 @@ func TestInitializer_ConfigureAddons(t *testing.T) {
 				"Corefile": "{ cd .. \n hosts /etc/edge/tunnels-nodes \n  kubernetes cluster.local {",
 			},
 		},
-		proxyConfigObj: &corev1.ConfigMap{
-			ObjectMeta: metav1.ObjectMeta{Namespace: "kube-system", Name: "kube-proxy"},
-			Data: map[string]string{
-				"config.conf": "{ cd .. \n kubeconfig:  \n  cluster",
-			},
-		},
-
 		serviceObj: &corev1.Service{
 			ObjectMeta: metav1.ObjectMeta{
 				Namespace:   "kube-system",
@@ -763,7 +733,7 @@ func TestInitializer_ConfigureAddons(t *testing.T) {
 
 	var fakeOut io.Writer
 	initializer := newKindInitializer(fakeOut, newKindOptions().Config())
-	client := clientsetfake.NewSimpleClientset(case1.coreDnsConfigObj, case1.proxyConfigObj, case1.serviceObj, case1.podObj, case1.deploymentObj)
+	client := clientsetfake.NewSimpleClientset(case1.coreDnsConfigObj, case1.serviceObj, case1.podObj, case1.deploymentObj)
 	for i := range case1.nodeObjs {
 		client.Tracker().Add(case1.nodeObjs[i])
 	}

pkg/yurthub/filter/constant.go

@@ -29,6 +29,10 @@ const (
 	// on kube-proxy list/watch service request from edge nodes.
 	DiscardCloudServiceFilterName = "discardcloudservice"
 
+	// InClusterConfigFilterName filter is used to comment kubeconfig in kube-system/kube-proxy configmap
+	// in order to make kube-proxy to use InClusterConfig to access kube-apiserver.
+	InClusterConfigFilterName = "inclusterconfig"
+
 	// SkipDiscardServiceAnnotation is annotation used by LB service.
 	// If end users want to use specified LB service at the edge side,
 	// End users should add annotation["openyurt.io/skip-discard"]="true" for LB service.
@@ -44,5 +48,6 @@ var (
 		MasterServiceFilterName:       "kubelet",
 		DiscardCloudServiceFilterName: "kube-proxy",
 		ServiceTopologyFilterName:     "kube-proxy, coredns, nginx-ingress-controller",
+		InClusterConfigFilterName:     "kubelet",
 	}
 )

pkg/yurthub/filter/inclusterconfig/filter.go

@@ -0,0 +1,59 @@
+/*
+Copyright 2023 The OpenYurt Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package inclusterconfig
+
+import (
+	"io"
+	"net/http"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+
+	"github.com/openyurtio/openyurt/pkg/yurthub/filter"
+	"github.com/openyurtio/openyurt/pkg/yurthub/kubernetes/serializer"
+)
+
+// Register registers a filter
+func Register(filters *filter.Filters, sm *serializer.SerializerManager) {
+	filters.Register(filter.InClusterConfigFilterName, func() (filter.Runner, error) {
+		return NewFilter(sm), nil
+	})
+}
+
+func NewFilter(sm *serializer.SerializerManager) *inClusterConfigFilter {
+	return &inClusterConfigFilter{
+		serializerManager: sm,
+	}
+}
+
+type inClusterConfigFilter struct {
+	serializerManager *serializer.SerializerManager
+}
+
+func (iccf *inClusterConfigFilter) Name() string {
+	return filter.InClusterConfigFilterName
+}
+
+func (iccf *inClusterConfigFilter) SupportedResourceAndVerbs() map[string]sets.String {
+	return map[string]sets.String{
+		"configmaps": sets.NewString("get", "list", "watch"),
+	}
+}
+
+func (iccf *inClusterConfigFilter) Filter(req *http.Request, rc io.ReadCloser, stopCh <-chan struct{}) (int, io.ReadCloser, error) {
+	handler := NewInClusterConfigFilterHandler()
+	return filter.NewFilterReadCloser(req, iccf.serializerManager, rc, handler, iccf.Name(), stopCh)
+}

pkg/yurthub/filter/inclusterconfig/handler.go

@@ -0,0 +1,85 @@
+/*
+Copyright 2023 The OpenYurt Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package inclusterconfig
+
+import (
+	"fmt"
+	"strings"
+
+	v1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/klog/v2"
+
+	"github.com/openyurtio/openyurt/pkg/yurthub/filter"
+)
+
+const (
+	KubeProxyConfigMapNamespace = "kube-system"
+	KubeProxyConfigMapName      = "kube-proxy"
+	KubeProxyDataKey            = "config.conf"
+	KubeProxyKubeConfigStr      = "kubeconfig"
+)
+
+type inClusterConfigFilterHandler struct{}
+
+func NewInClusterConfigFilterHandler() filter.ObjectHandler {
+	return &inClusterConfigFilterHandler{}
+}
+
+// RuntimeObjectFilter comments kubeconfig in kube-system/kube-proxy configmap in the response object
+func (fh *inClusterConfigFilterHandler) RuntimeObjectFilter(obj runtime.Object) (runtime.Object, bool) {
+	switch v := obj.(type) {
+	case *v1.ConfigMapList:
+		for i := range v.Items {
+			newCM, mutated := mutateKubeProxyConfigMap(&v.Items[i])
+			if mutated {
+				v.Items[i] = *newCM
+				break
+			}
+		}
+		return v, false
+	case *v1.ConfigMap:
+		cm, _ := mutateKubeProxyConfigMap(v)
+		return cm, false
+	default:
+		return v, false
+	}
+}
+
+func mutateKubeProxyConfigMap(cm *v1.ConfigMap) (*v1.ConfigMap, bool) {
+	mutated := false
+	if cm.Namespace == KubeProxyConfigMapNamespace && cm.Name == KubeProxyConfigMapName {
+		if cm.Data != nil && len(cm.Data[KubeProxyDataKey]) != 0 {
+			parts := make([]string, 0)
+			for _, line := range strings.Split(cm.Data[KubeProxyDataKey], "\n") {
+				items := strings.Split(strings.Trim(line, " "), ":")
+				if len(items) == 2 && items[0] == KubeProxyKubeConfigStr {
+					parts = append(parts, strings.Replace(line, KubeProxyKubeConfigStr, fmt.Sprintf("#%s", KubeProxyKubeConfigStr), 1))
+					mutated = true
+				} else {
+					parts = append(parts, line)
+				}
+			}
+			if mutated {
+				cm.Data[KubeProxyDataKey] = strings.Join(parts, "\n")
+				klog.Infof("kubeconfig in configmap(%s/%s) has been commented, new config.conf: \n%s\n", cm.Namespace, cm.Name, cm.Data[KubeProxyDataKey])
+			}
+		}
+	}
+
+	return cm, mutated
+}