|
| 1 | +// Copyright Istio Authors |
| 2 | +// |
| 3 | +// Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +// you may not use this file except in compliance with the License. |
| 5 | +// You may obtain a copy of the License at |
| 6 | +// |
| 7 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +// |
| 9 | +// Unless required by applicable law or agreed to in writing, software |
| 10 | +// distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +// See the License for the specific language governing permissions and |
| 13 | +// limitations under the License. |
| 14 | + |
| 15 | +package fieldignore |
| 16 | + |
| 17 | +import ( |
| 18 | + "fmt" |
| 19 | + "reflect" |
| 20 | + "regexp" |
| 21 | + "strings" |
| 22 | + |
| 23 | + "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" |
| 24 | + "k8s.io/apimachinery/pkg/runtime" |
| 25 | + "k8s.io/apimachinery/pkg/runtime/schema" |
| 26 | + "sigs.k8s.io/controller-runtime/pkg/client" |
| 27 | + "sigs.k8s.io/controller-runtime/pkg/event" |
| 28 | + "sigs.k8s.io/controller-runtime/pkg/predicate" |
| 29 | +) |
| 30 | + |
| 31 | +// FieldIgnoreRule defines a set of fields to ignore for resources matching |
| 32 | +// a specific Group/Version/Kind and optional name pattern. |
| 33 | +// |
| 34 | +// Field paths use dot notation with [*] for array wildcards: |
| 35 | +// - "webhooks[*].failurePolicy" → deletes failurePolicy from each webhook |
| 36 | +// - "webhooks[*].clientConfig.caBundle" → deletes caBundle nested inside each webhook |
| 37 | +// - "spec.template.metadata.annotations" → deletes a deeply nested field |
| 38 | +// |
| 39 | +// This type is designed to be easily exposed through a CRD in the future. |
| 40 | +type FieldIgnoreRule struct { |
| 41 | + // Group is the API group (e.g. "admissionregistration.k8s.io"). Empty matches the core group. |
| 42 | + Group string `json:"group"` |
| 43 | + |
| 44 | + // Version is the API version (e.g. "v1"). |
| 45 | + Version string `json:"version"` |
| 46 | + |
| 47 | + // Kind is the resource kind (e.g. "ValidatingWebhookConfiguration"). |
| 48 | + Kind string `json:"kind"` |
| 49 | + |
| 50 | + // NameRegex is an optional regex to match resource names. Empty matches all names. |
| 51 | + NameRegex string `json:"nameRegex,omitempty"` |
| 52 | + |
| 53 | + // Fields is the list of field paths to ignore. |
| 54 | + Fields []string `json:"fields"` |
| 55 | + |
| 56 | + // OnlyOnUpdate when true means these fields are only stripped during Helm |
| 57 | + // upgrades (post-render), not on initial installs. This is useful when you |
| 58 | + // want Helm to set the initial value but let another controller manage it |
| 59 | + // afterward. |
| 60 | + OnlyOnUpdate bool `json:"onlyOnUpdate,omitempty"` |
| 61 | + |
| 62 | + // compiledNameRegex is the pre-compiled form of NameRegex, populated by |
| 63 | + // CompileRules/MustCompileRules. If nil and NameRegex is non-empty, |
| 64 | + // Matches will compile on every call (slower). |
| 65 | + compiledNameRegex *regexp.Regexp |
| 66 | +} |
| 67 | + |
| 68 | +// CompileRules validates and pre-compiles the NameRegex in each rule. |
| 69 | +// Returns an error if any NameRegex is invalid. The returned slice should be |
| 70 | +// used in place of the input; the originals are not modified. |
| 71 | +func CompileRules(rules []FieldIgnoreRule) ([]FieldIgnoreRule, error) { |
| 72 | + compiled := make([]FieldIgnoreRule, len(rules)) |
| 73 | + for i, r := range rules { |
| 74 | + if r.NameRegex != "" { |
| 75 | + re, err := regexp.Compile("^(?:" + r.NameRegex + ")$") |
| 76 | + if err != nil { |
| 77 | + return nil, fmt.Errorf("invalid NameRegex %q in rule %d: %w", r.NameRegex, i, err) |
| 78 | + } |
| 79 | + r.compiledNameRegex = re |
| 80 | + } |
| 81 | + compiled[i] = r |
| 82 | + } |
| 83 | + return compiled, nil |
| 84 | +} |
| 85 | + |
| 86 | +// MustCompileRules is like CompileRules but panics on error. |
| 87 | +// Use this for hardcoded rules that are known to be valid. |
| 88 | +func MustCompileRules(rules []FieldIgnoreRule) []FieldIgnoreRule { |
| 89 | + compiled, err := CompileRules(rules) |
| 90 | + if err != nil { |
| 91 | + panic(err) |
| 92 | + } |
| 93 | + return compiled |
| 94 | +} |
| 95 | + |
| 96 | +// Matches returns true if the rule applies to a resource with the given GVK and name. |
| 97 | +func (r FieldIgnoreRule) Matches(gvk schema.GroupVersionKind, name string) bool { |
| 98 | + if r.Group != gvk.Group || r.Version != gvk.Version || r.Kind != gvk.Kind { |
| 99 | + return false |
| 100 | + } |
| 101 | + if r.compiledNameRegex != nil { |
| 102 | + return r.compiledNameRegex.MatchString(name) |
| 103 | + } |
| 104 | + if r.NameRegex != "" { |
| 105 | + matched, err := regexp.MatchString("^(?:"+r.NameRegex+")$", name) |
| 106 | + if err != nil || !matched { |
| 107 | + return false |
| 108 | + } |
| 109 | + } |
| 110 | + return true |
| 111 | +} |
| 112 | + |
| 113 | +// MatchesManifest returns true if the rule applies to an unstructured manifest map. |
| 114 | +func (r FieldIgnoreRule) MatchesManifest(manifest map[string]any) bool { |
| 115 | + apiVersion, _, _ := unstructured.NestedString(manifest, "apiVersion") |
| 116 | + kind, _, _ := unstructured.NestedString(manifest, "kind") |
| 117 | + name, _, _ := unstructured.NestedString(manifest, "metadata", "name") |
| 118 | + |
| 119 | + gv, err := schema.ParseGroupVersion(apiVersion) |
| 120 | + if err != nil { |
| 121 | + return false |
| 122 | + } |
| 123 | + return r.Matches(schema.GroupVersionKind{Group: gv.Group, Version: gv.Version, Kind: kind}, name) |
| 124 | +} |
| 125 | + |
| 126 | +// RemoveFieldsFromManifest removes ignored fields from an unstructured manifest map. |
| 127 | +// Rules with OnlyOnUpdate=true are skipped when isUpdate is false. |
| 128 | +func RemoveFieldsFromManifest(manifest map[string]any, rules []FieldIgnoreRule, isUpdate bool) { |
| 129 | + for _, rule := range rules { |
| 130 | + if rule.OnlyOnUpdate && !isUpdate { |
| 131 | + continue |
| 132 | + } |
| 133 | + if !rule.MatchesManifest(manifest) { |
| 134 | + continue |
| 135 | + } |
| 136 | + for _, field := range rule.Fields { |
| 137 | + removeFieldPath(manifest, field) |
| 138 | + } |
| 139 | + } |
| 140 | +} |
| 141 | + |
| 142 | +// NewPredicate returns a predicate that ignores changes to fields specified by |
| 143 | +// the given rules. On update events it converts both old and new objects to |
| 144 | +// unstructured maps, removes the ignored fields (plus standard metadata noise |
| 145 | +// like resourceVersion, generation, managedFields), and only triggers |
| 146 | +// reconciliation when the remaining content differs. |
| 147 | +func NewPredicate(scheme *runtime.Scheme, rules []FieldIgnoreRule) predicate.Funcs { |
| 148 | + return predicate.Funcs{ |
| 149 | + UpdateFunc: func(e event.UpdateEvent) bool { |
| 150 | + if e.ObjectOld == nil || e.ObjectNew == nil { |
| 151 | + return false |
| 152 | + } |
| 153 | + return objectsChangedIgnoringFields(scheme, e.ObjectOld, e.ObjectNew, rules) |
| 154 | + }, |
| 155 | + } |
| 156 | +} |
| 157 | + |
| 158 | +func objectsChangedIgnoringFields(scheme *runtime.Scheme, oldObj, newObj client.Object, rules []FieldIgnoreRule) bool { |
| 159 | + gvk, err := gvkForObject(scheme, newObj) |
| 160 | + if err != nil { |
| 161 | + return true |
| 162 | + } |
| 163 | + |
| 164 | + name := newObj.GetName() |
| 165 | + |
| 166 | + // Collect fields from all matching rules regardless of OnlyOnUpdate. |
| 167 | + // OnlyOnUpdate only controls post-renderer behavior (whether Helm strips |
| 168 | + // the field on install vs upgrade). In the predicate we always want to |
| 169 | + // ignore these fields to avoid unnecessary reconciliation. |
| 170 | + var matchingFields []string |
| 171 | + for _, rule := range rules { |
| 172 | + if rule.Matches(gvk, name) { |
| 173 | + matchingFields = append(matchingFields, rule.Fields...) |
| 174 | + } |
| 175 | + } |
| 176 | + if len(matchingFields) == 0 { |
| 177 | + return true |
| 178 | + } |
| 179 | + |
| 180 | + oldMap, err := runtime.DefaultUnstructuredConverter.ToUnstructured(oldObj) |
| 181 | + if err != nil { |
| 182 | + return true |
| 183 | + } |
| 184 | + newMap, err := runtime.DefaultUnstructuredConverter.ToUnstructured(newObj) |
| 185 | + if err != nil { |
| 186 | + return true |
| 187 | + } |
| 188 | + |
| 189 | + clearMetadataFields(oldMap) |
| 190 | + clearMetadataFields(newMap) |
| 191 | + |
| 192 | + for _, field := range matchingFields { |
| 193 | + removeFieldPath(oldMap, field) |
| 194 | + removeFieldPath(newMap, field) |
| 195 | + } |
| 196 | + |
| 197 | + return !reflect.DeepEqual(oldMap, newMap) |
| 198 | +} |
| 199 | + |
| 200 | +func gvkForObject(scheme *runtime.Scheme, obj client.Object) (schema.GroupVersionKind, error) { |
| 201 | + gvks, _, err := scheme.ObjectKinds(obj) |
| 202 | + if err != nil { |
| 203 | + return schema.GroupVersionKind{}, err |
| 204 | + } |
| 205 | + if len(gvks) == 0 { |
| 206 | + return schema.GroupVersionKind{}, fmt.Errorf("no GVK found for object %T", obj) |
| 207 | + } |
| 208 | + return gvks[0], nil |
| 209 | +} |
| 210 | + |
| 211 | +// clearMetadataFields removes standard metadata fields that change on every |
| 212 | +// update and should never trigger reconciliation. |
| 213 | +func clearMetadataFields(obj map[string]any) { |
| 214 | + if metadata, ok := obj["metadata"].(map[string]any); ok { |
| 215 | + delete(metadata, "resourceVersion") |
| 216 | + delete(metadata, "generation") |
| 217 | + delete(metadata, "managedFields") |
| 218 | + } |
| 219 | +} |
| 220 | + |
| 221 | +// removeFieldPath removes a field from a nested map using dot-separated path |
| 222 | +// notation. Array wildcards ([*]) cause the operation to be applied to every |
| 223 | +// element of the array. |
| 224 | +func removeFieldPath(obj map[string]any, path string) { |
| 225 | + segments := strings.Split(path, ".") |
| 226 | + removeFieldSegments(obj, segments) |
| 227 | +} |
| 228 | + |
| 229 | +func removeFieldSegments(obj map[string]any, segments []string) { |
| 230 | + if len(segments) == 0 || obj == nil { |
| 231 | + return |
| 232 | + } |
| 233 | + |
| 234 | + seg := segments[0] |
| 235 | + remaining := segments[1:] |
| 236 | + |
| 237 | + if strings.HasSuffix(seg, "[*]") { |
| 238 | + key := strings.TrimSuffix(seg, "[*]") |
| 239 | + if len(remaining) == 0 { |
| 240 | + // Bare [*] with no remaining segments (e.g. "items[*]") removes |
| 241 | + // the entire array field. |
| 242 | + delete(obj, key) |
| 243 | + return |
| 244 | + } |
| 245 | + arr, ok := obj[key].([]any) |
| 246 | + if !ok { |
| 247 | + return |
| 248 | + } |
| 249 | + for _, item := range arr { |
| 250 | + if m, ok := item.(map[string]any); ok { |
| 251 | + removeFieldSegments(m, remaining) |
| 252 | + } |
| 253 | + } |
| 254 | + return |
| 255 | + } |
| 256 | + |
| 257 | + if len(remaining) == 0 { |
| 258 | + delete(obj, seg) |
| 259 | + return |
| 260 | + } |
| 261 | + |
| 262 | + child, ok := obj[seg].(map[string]any) |
| 263 | + if !ok { |
| 264 | + return |
| 265 | + } |
| 266 | + removeFieldSegments(child, remaining) |
| 267 | +} |
0 commit comments