Reconcile pod spec for cloudflared

api/v1alpha1/tunnel_types.go

@@ -17,6 +17,7 @@ limitations under the License.
 package v1alpha1
 
 import (
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
@@ -90,10 +91,9 @@ type TunnelSpec struct {
 	// Size defines the number of Daemon pods to run for this tunnel
 	Size int32 `json:"size,omitempty"`
 
-	//+kubebuilder:default:="cloudflare/cloudflared:2022.12.1"
 	//+kubebuilder:validation:Optional
-	// Image sets the Cloudflared Image to use. Defaults to the image set during the release of the operator.
-	Image string `json:"image,omitempty"`
+	// PodSpec specifies the override spec for the cloudflared pod. Override the first container.
+	PodSpec corev1.PodSpec `json:"podSpec,omitempty"`
 
 	//+kubebuilder:default:=false
 	//+kubebuilder:validation:Optional

controllers/adapter.go

@@ -8,7 +8,8 @@ import (
 
 // TunnelAdapater implementation
 type TunnelAdapter struct {
-	Tunnel *networkingv1alpha1.Tunnel
+	Tunnel       *networkingv1alpha1.Tunnel
+	DefaultImage string
 }
 
 func (o TunnelAdapter) GetObject() client.Object {
@@ -19,6 +20,10 @@ func (o TunnelAdapter) GetNamespace() string {
 	return o.Tunnel.Namespace
 }
 
+func (o TunnelAdapter) GetDefaultImage() string {
+	return o.DefaultImage
+}
+
 func (o TunnelAdapter) GetName() string {
 	return o.Tunnel.Name
 }
@@ -58,13 +63,15 @@ func (o TunnelAdapter) SetStatus(in networkingv1alpha1.TunnelStatus) {
 func (o TunnelAdapter) DeepCopyTunnel() Tunnel {
 	return TunnelAdapter{
 		o.Tunnel.DeepCopy(),
+		o.DefaultImage,
 	}
 }
 
 // ClusterTunnelAdapter implementation
 type ClusterTunnelAdapter struct {
-	Tunnel    *networkingv1alpha1.ClusterTunnel
-	Namespace string
+	Tunnel       *networkingv1alpha1.ClusterTunnel
+	Namespace    string
+	DefaultImage string
 }
 
 func (o ClusterTunnelAdapter) GetObject() client.Object {
@@ -75,6 +82,10 @@ func (o ClusterTunnelAdapter) GetNamespace() string {
 	return o.Namespace
 }
 
+func (o ClusterTunnelAdapter) GetDefaultImage() string {
+	return o.DefaultImage
+}
+
 func (o ClusterTunnelAdapter) GetName() string {
 	return o.Tunnel.Name
 }
@@ -115,5 +126,6 @@ func (o ClusterTunnelAdapter) DeepCopyTunnel() Tunnel {
 	return ClusterTunnelAdapter{
 		o.Tunnel.DeepCopy(),
 		o.Namespace,
+		o.DefaultImage,
 	}
 }

controllers/clustertunnel_controller.go

@@ -35,9 +35,10 @@ import (
 // ClusterTunnelReconciler reconciles a ClusterTunnel object
 type ClusterTunnelReconciler struct {
 	client.Client
-	Scheme    *runtime.Scheme
-	Recorder  record.EventRecorder
-	Namespace string
+	Scheme       *runtime.Scheme
+	Recorder     record.EventRecorder
+	Namespace    string
+	DefaultImage string
 
 	// Custom data for ease of (re)use
 
@@ -61,6 +62,10 @@ func (r *ClusterTunnelReconciler) GetScheme() *runtime.Scheme {
 	return r.Scheme
 }
 
+func (r *ClusterTunnelReconciler) GetDefaultImage() string {
+	return r.DefaultImage
+}
+
 func (r *ClusterTunnelReconciler) GetContext() context.Context {
 	return r.ctx
 }
@@ -142,7 +147,7 @@ func (r *ClusterTunnelReconciler) Reconcile(ctx context.Context, req ctrl.Reques
 		return ctrl.Result{}, err
 	}
 
-	if err := r.initStruct(ctx, ClusterTunnelAdapter{tunnel, r.Namespace}); err != nil {
+	if err := r.initStruct(ctx, ClusterTunnelAdapter{tunnel, r.Namespace, r.DefaultImage}); err != nil {
 		return ctrl.Result{}, err
 	}
 

controllers/interface.go

@@ -9,6 +9,7 @@ type Tunnel interface {
 	GetObject() client.Object
 	GetNamespace() string
 	GetName() string
+	GetDefaultImage() string
 	GetLabels() map[string]string
 	SetLabels(map[string]string)
 	GetAnnotations() map[string]string

controllers/reconciler.go

@@ -2,6 +2,7 @@ package controllers
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"time"
 
@@ -401,11 +402,25 @@ func secretForTunnel(r GenericTunnelReconciler) *corev1.Secret {
 	return sec
 }
 
+func mergeContainerSpec(containerSpec corev1.Container, required *corev1.Container) error {
+	var bytes []byte
+	var err error
+	if bytes, err = json.Marshal(containerSpec); err != nil {
+		return err
+	}
+	if err := json.Unmarshal(bytes, required); err != nil {
+		return err
+	}
+	return nil
+}
+
 // deploymentForTunnel returns a tunnel Deployment object
 func deploymentForTunnel(r GenericTunnelReconciler) *appsv1.Deployment {
 	ls := labelsForTunnel(r.GetTunnel())
 	replicas := r.GetTunnel().GetSpec().Size
 
+	podSpec := r.GetTunnel().GetSpec().PodSpec
+
 	args := []string{"tunnel", "--config", "/etc/cloudflared/config/config.yaml", "--metrics", "0.0.0.0:2000", "run"}
 	volumes := []corev1.Volume{{
 		Name: "creds",
@@ -447,6 +462,54 @@ func deploymentForTunnel(r GenericTunnelReconciler) *appsv1.Deployment {
 		})
 	}
 
+	defaultContainerSpec := corev1.Container{
+		Image: r.GetTunnel().GetDefaultImage(),
+		Name:  "cloudflared",
+		Args:  args,
+		LivenessProbe: &corev1.Probe{
+			ProbeHandler: corev1.ProbeHandler{
+				HTTPGet: &corev1.HTTPGetAction{
+					Path: "/ready",
+					Port: intstr.IntOrString{IntVal: 2000},
+				},
+			},
+			FailureThreshold:    1,
+			InitialDelaySeconds: 10,
+			PeriodSeconds:       10,
+		},
+		Ports: []corev1.ContainerPort{
+			{
+				Name:          "metrics",
+				ContainerPort: 2000,
+				Protocol:      corev1.ProtocolTCP,
+			},
+		},
+		Resources: corev1.ResourceRequirements{
+			Requests: corev1.ResourceList{"memory": resource.MustParse("30Mi"), "cpu": resource.MustParse("10m")},
+			Limits:   corev1.ResourceList{"memory": resource.MustParse("256Mi"), "cpu": resource.MustParse("500m")},
+		},
+	}
+
+	requiredContainerSpec := defaultContainerSpec
+	if len(podSpec.Containers) != 0 {
+		// Merge input onto required
+		if err := mergeContainerSpec(podSpec.Containers[0], &requiredContainerSpec); err != nil {
+			r.GetLog().Error(err, "error using podSpec input")
+			requiredContainerSpec = defaultContainerSpec
+		}
+	} else {
+		podSpec.Containers = make([]corev1.Container, 1)
+	}
+
+	// Overwrite some important fields
+	requiredContainerSpec.Name = defaultContainerSpec.Name
+	requiredContainerSpec.Args = defaultContainerSpec.Args
+	requiredContainerSpec.VolumeMounts = append(requiredContainerSpec.VolumeMounts, volumeMounts...)
+	podSpec.Volumes = append(podSpec.Volumes, volumes...)
+	podSpec.Containers[0] = requiredContainerSpec
+
+	// TODO: Set podSpec.Affinity
+
 	dep := &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      r.GetTunnel().GetName(),
@@ -462,37 +525,7 @@ func deploymentForTunnel(r GenericTunnelReconciler) *appsv1.Deployment {
 				ObjectMeta: metav1.ObjectMeta{
 					Labels: ls,
 				},
-				Spec: corev1.PodSpec{
-					Containers: []corev1.Container{{
-						Image: r.GetTunnel().GetSpec().Image,
-						Name:  "cloudflared",
-						Args:  args,
-						LivenessProbe: &corev1.Probe{
-							ProbeHandler: corev1.ProbeHandler{
-								HTTPGet: &corev1.HTTPGetAction{
-									Path: "/ready",
-									Port: intstr.IntOrString{IntVal: 2000},
-								},
-							},
-							FailureThreshold:    1,
-							InitialDelaySeconds: 10,
-							PeriodSeconds:       10,
-						},
-						Ports: []corev1.ContainerPort{
-							{
-								Name:          "metrics",
-								ContainerPort: 2000,
-								Protocol:      corev1.ProtocolTCP,
-							},
-						},
-						VolumeMounts: volumeMounts,
-						Resources: corev1.ResourceRequirements{
-							Requests: corev1.ResourceList{"memory": resource.MustParse("30Mi"), "cpu": resource.MustParse("10m")},
-							Limits:   corev1.ResourceList{"memory": resource.MustParse("256Mi"), "cpu": resource.MustParse("500m")},
-						},
-					}},
-					Volumes: volumes,
-				},
+				Spec: podSpec,
 			},
 		},
 	}

controllers/tunnel_controller.go

@@ -35,8 +35,9 @@ import (
 // TunnelReconciler reconciles a Tunnel object
 type TunnelReconciler struct {
 	client.Client
-	Scheme   *runtime.Scheme
-	Recorder record.EventRecorder
+	Scheme       *runtime.Scheme
+	Recorder     record.EventRecorder
+	DefaultImage string
 
 	// Custom data for ease of (re)use
 
@@ -137,7 +138,7 @@ func (r *TunnelReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctr
 		return ctrl.Result{}, err
 	}
 
-	if err := r.initStruct(ctx, TunnelAdapter{tunnel}); err != nil {
+	if err := r.initStruct(ctx, TunnelAdapter{tunnel, r.DefaultImage}); err != nil {
 		return ctrl.Result{}, err
 	}
 

main.go

@@ -53,10 +53,12 @@ func main() {
 	var enableLeaderElection bool
 	var probeAddr string
 	var clusterResourceNamespace string
+	var defaultImage string
 	var overwriteUnmanaged bool
 	flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
 	flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
 	flag.StringVar(&clusterResourceNamespace, "cluster-resource-namespace", "cloudflare-operator-system", "The default namespace for cluster scoped resources.")
+	flag.StringVar(&defaultImage, "default-image", "cloudflared:2022.12.1", "The default cloudflared image to use for tunnels.")
 	flag.BoolVar(&overwriteUnmanaged, "overwrite-unmanaged-dns", false, "Overwrite DNS records that do not have a corresponding managed TXT record, defaults to false.")
 	flag.BoolVar(&enableLeaderElection, "leader-elect", true,
 		"Enable leader election for controller manager. "+
@@ -92,16 +94,18 @@ func main() {
 		os.Exit(1)
 	}
 	if err = (&controllers.TunnelReconciler{
-		Client: mgr.GetClient(),
-		Scheme: mgr.GetScheme(),
+		Client:       mgr.GetClient(),
+		Scheme:       mgr.GetScheme(),
+		DefaultImage: defaultImage,
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "Tunnel")
 		os.Exit(1)
 	}
 	if err = (&controllers.ClusterTunnelReconciler{
-		Client:    mgr.GetClient(),
-		Scheme:    mgr.GetScheme(),
-		Namespace: clusterResourceNamespace,
+		Client:       mgr.GetClient(),
+		Scheme:       mgr.GetScheme(),
+		Namespace:    clusterResourceNamespace,
+		DefaultImage: defaultImage,
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "ClusterTunnel")
 		os.Exit(1)