velero/pkg/restore/actions/pod_volume_restore_action.go

329 lines
11 KiB
Go

/*
Copyright the Velero contributors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package actions
import (
"context"
"fmt"
"strings"
"github.com/vmware-tanzu/velero/pkg/util/boolptr"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
appsv1api "k8s.io/api/apps/v1"
corev1api "k8s.io/api/core/v1"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/types"
corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
ctrlclient "sigs.k8s.io/controller-runtime/pkg/client"
veleroimage "github.com/vmware-tanzu/velero/internal/velero"
velerov1api "github.com/vmware-tanzu/velero/pkg/apis/velero/v1"
"github.com/vmware-tanzu/velero/pkg/builder"
"github.com/vmware-tanzu/velero/pkg/label"
"github.com/vmware-tanzu/velero/pkg/plugin/framework/common"
"github.com/vmware-tanzu/velero/pkg/plugin/velero"
"github.com/vmware-tanzu/velero/pkg/podvolume"
"github.com/vmware-tanzu/velero/pkg/restorehelper"
"github.com/vmware-tanzu/velero/pkg/util/kube"
veleroutil "github.com/vmware-tanzu/velero/pkg/util/velero"
)
const (
defaultCPURequestLimit = "100m"
defaultMemRequestLimit = "128Mi"
defaultCommand = "/velero-restore-helper"
restoreHelperUID = 1000
)
type PodVolumeRestoreAction struct {
logger logrus.FieldLogger
client corev1client.ConfigMapInterface
crClient ctrlclient.Client
veleroImage string
}
func NewPodVolumeRestoreAction(logger logrus.FieldLogger, client corev1client.ConfigMapInterface, crClient ctrlclient.Client, namespace string) (*PodVolumeRestoreAction, error) {
deployment := &appsv1api.Deployment{}
if err := crClient.Get(context.TODO(), types.NamespacedName{Name: "velero", Namespace: namespace}, deployment); err != nil {
return nil, err
}
image := veleroutil.GetVeleroServerImage(deployment)
return &PodVolumeRestoreAction{
logger: logger,
client: client,
crClient: crClient,
veleroImage: image,
}, nil
}
func (a *PodVolumeRestoreAction) AppliesTo() (velero.ResourceSelector, error) {
return velero.ResourceSelector{
IncludedResources: []string{"pods"},
}, nil
}
func (a *PodVolumeRestoreAction) Execute(input *velero.RestoreItemActionExecuteInput) (*velero.RestoreItemActionExecuteOutput, error) {
a.logger.Info("Executing PodVolumeRestoreAction")
defer a.logger.Info("Done executing PodVolumeRestoreAction")
var pod corev1api.Pod
if err := runtime.DefaultUnstructuredConverter.FromUnstructured(input.Item.UnstructuredContent(), &pod); err != nil {
return nil, errors.Wrap(err, "unable to convert pod from runtime.Unstructured")
}
// At the point when this function is called, the namespace mapping for the restore
// has not yet been applied to `input.Item` so we can't perform a reverse-lookup in
// the namespace mapping in the restore spec. Instead, use the pod from the backup
// so that if the mapping is applied earlier, we still use the correct namespace.
var podFromBackup corev1api.Pod
if err := runtime.DefaultUnstructuredConverter.FromUnstructured(input.ItemFromBackup.UnstructuredContent(), &podFromBackup); err != nil {
return nil, errors.Wrap(err, "unable to convert source pod from runtime.Unstructured")
}
log := a.logger.WithField("pod", kube.NamespaceAndName(&pod))
opts := &ctrlclient.ListOptions{
LabelSelector: label.NewSelectorForBackup(input.Restore.Spec.BackupName),
}
podVolumeBackupList := new(velerov1api.PodVolumeBackupList)
if err := a.crClient.List(context.TODO(), podVolumeBackupList, opts); err != nil {
return nil, errors.WithStack(err)
}
var podVolumeBackups []*velerov1api.PodVolumeBackup
for i := range podVolumeBackupList.Items {
podVolumeBackups = append(podVolumeBackups, &podVolumeBackupList.Items[i])
}
volumeSnapshots := podvolume.GetVolumeBackupsForPod(podVolumeBackups, &pod, podFromBackup.Namespace)
if len(volumeSnapshots) == 0 {
log.Debug("No pod volume backups found for pod")
return velero.NewRestoreItemActionExecuteOutput(input.Item), nil
}
log.Info("Pod volume backups for pod found")
// TODO we might want/need to get plugin config at the top of this method at some point; for now, wait
// until we know we're doing a restore before getting config.
log.Debugf("Getting plugin config")
config, err := common.GetPluginConfig(common.PluginKindRestoreItemAction, "velero.io/pod-volume-restore", a.client)
if err != nil {
return nil, err
}
image := getImage(log, config, a.veleroImage)
log.Infof("Using image %q", image)
cpuRequest, memRequest := getResourceRequests(log, config)
cpuLimit, memLimit := getResourceLimits(log, config)
if cpuRequest == "" {
cpuRequest = defaultCPURequestLimit
}
if cpuLimit == "" {
cpuLimit = defaultCPURequestLimit
}
if memRequest == "" {
memRequest = defaultMemRequestLimit
}
if memLimit == "" {
memLimit = defaultMemRequestLimit
}
resourceReqs, err := kube.ParseResourceRequirements(cpuRequest, memRequest, cpuLimit, memLimit)
if err != nil {
log.Errorf("couldn't parse resource requirements: %s.", err)
resourceReqs, _ = kube.ParseResourceRequirements(
defaultCPURequestLimit, defaultMemRequestLimit, // requests
defaultCPURequestLimit, defaultMemRequestLimit, // limits
)
}
runAsUser, runAsGroup, allowPrivilegeEscalation, secCtx := getSecurityContext(log, config)
var securityContext corev1api.SecurityContext
securityContextSet := false
// Use securityContext settings from configmap if available
if runAsUser != "" || runAsGroup != "" || allowPrivilegeEscalation != "" || secCtx != "" {
securityContext, err = kube.ParseSecurityContext(runAsUser, runAsGroup, allowPrivilegeEscalation, secCtx)
if err != nil {
log.Errorf("Using default securityContext values, couldn't parse securityContext requirements: %s.", err)
} else {
securityContextSet = true
}
}
// if first container in pod has a SecurityContext set, then copy this security context
if len(pod.Spec.Containers) != 0 && pod.Spec.Containers[0].SecurityContext != nil {
securityContext = *pod.Spec.Containers[0].SecurityContext.DeepCopy()
securityContextSet = true
}
if !securityContextSet {
securityContext = defaultSecurityCtx()
}
initContainerBuilder := newRestoreInitContainerBuilder(image, string(input.Restore.UID))
initContainerBuilder.Resources(&resourceReqs)
initContainerBuilder.SecurityContext(&securityContext)
for volumeName := range volumeSnapshots {
mount := &corev1api.VolumeMount{
Name: volumeName,
MountPath: "/restores/" + volumeName,
}
initContainerBuilder.VolumeMounts(mount)
}
initContainerBuilder.Command(getCommand(log, config))
initContainer := *initContainerBuilder.Result()
if len(pod.Spec.InitContainers) == 0 || (pod.Spec.InitContainers[0].Name != restorehelper.WaitInitContainer && pod.Spec.InitContainers[0].Name != restorehelper.WaitInitContainerLegacy) {
pod.Spec.InitContainers = append([]corev1api.Container{initContainer}, pod.Spec.InitContainers...)
} else {
pod.Spec.InitContainers[0] = initContainer
}
res, err := runtime.DefaultUnstructuredConverter.ToUnstructured(&pod)
if err != nil {
return nil, errors.Wrap(err, "unable to convert pod to runtime.Unstructured")
}
return velero.NewRestoreItemActionExecuteOutput(&unstructured.Unstructured{Object: res}), nil
}
func getCommand(log logrus.FieldLogger, config *corev1api.ConfigMap) []string {
if config == nil {
log.Debug("No config found for plugin")
return []string{defaultCommand}
}
if config.Data["command"] == "" {
log.Debugf("No custom command configured")
return []string{defaultCommand}
}
log.Debugf("Using custom command %s", config.Data["command"])
return []string{config.Data["command"]}
}
func getImage(log logrus.FieldLogger, config *corev1api.ConfigMap, defaultImage string) string {
if config == nil {
log.Debug("No config found for plugin")
return defaultImage
}
image := config.Data["image"]
if image == "" {
log.Debugf("No custom image configured")
return defaultImage
}
log = log.WithField("image", image)
parts := strings.Split(image, "/")
if len(parts) == 1 {
// Image supplied without registry part
log.Infof("Plugin config contains image name without registry name. Using default init container image: %q", defaultImage)
return defaultImage
}
if !(strings.Contains(parts[len(parts)-1], ":")) {
tag := veleroimage.ImageTag()
// tag-less image name: add default image tag for this version of Velero
log.Infof("Plugin config contains image name without tag. Adding tag: %q", tag)
return fmt.Sprintf("%s:%s", image, tag)
}
// tagged image name
log.Debugf("Plugin config contains image name with tag")
return image
}
// getResourceRequests extracts the CPU and memory requests from a ConfigMap.
// The 0 values are valid if the keys are not present
func getResourceRequests(log logrus.FieldLogger, config *corev1api.ConfigMap) (string, string) {
if config == nil {
log.Debug("No config found for plugin")
return "", ""
}
return config.Data["cpuRequest"], config.Data["memRequest"]
}
// getResourceLimits extracts the CPU and memory limits from a ConfigMap.
// The 0 values are valid if the keys are not present
func getResourceLimits(log logrus.FieldLogger, config *corev1api.ConfigMap) (string, string) {
if config == nil {
log.Debug("No config found for plugin")
return "", ""
}
return config.Data["cpuLimit"], config.Data["memLimit"]
}
// getSecurityContext extracts securityContext runAsUser, runAsGroup, allowPrivilegeEscalation, and securityContext from a ConfigMap.
func getSecurityContext(log logrus.FieldLogger, config *corev1api.ConfigMap) (string, string, string, string) {
if config == nil {
log.Debug("No config found for plugin")
return "", "", "", ""
}
return config.Data["secCtxRunAsUser"],
config.Data["secCtxRunAsGroup"],
config.Data["secCtxAllowPrivilegeEscalation"],
config.Data["secCtx"]
}
func newRestoreInitContainerBuilder(image, restoreUID string) *builder.ContainerBuilder {
return builder.ForContainer(restorehelper.WaitInitContainer, image).
Args(restoreUID).
Env([]*corev1api.EnvVar{
{
Name: "POD_NAMESPACE",
ValueFrom: &corev1api.EnvVarSource{
FieldRef: &corev1api.ObjectFieldSelector{
FieldPath: "metadata.namespace",
},
},
},
{
Name: "POD_NAME",
ValueFrom: &corev1api.EnvVarSource{
FieldRef: &corev1api.ObjectFieldSelector{
FieldPath: "metadata.name",
},
},
},
}...)
}
// defaultSecurityCtx returns a default security context for the init container, which has the level "restricted" per
// Pod Security Standards.
func defaultSecurityCtx() corev1api.SecurityContext {
uid := int64(restoreHelperUID)
return corev1api.SecurityContext{
AllowPrivilegeEscalation: boolptr.False(),
Capabilities: &corev1api.Capabilities{
Drop: []corev1api.Capability{"ALL"},
},
SeccompProfile: &corev1api.SeccompProfile{
Type: corev1api.SeccompProfileTypeRuntimeDefault,
},
RunAsUser: &uid,
RunAsNonRoot: boolptr.True(),
}
}