fix: correctly escape extra args in kube-proxy manifest

JSON is a subset of YAML, so we can use JSON to escape whole YAML value to handle any kind of symbols. Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
siderolabs · Feb 19, 2021 · 7a6e0cd · 7a6e0cd
1 parent 41b9f13
commit 7a6e0cd
Show file tree

Hide file tree

Showing 4 changed files with 59 additions and 6 deletions.
diff --git a/internal/app/machined/pkg/controllers/k8s/manifest.go b/internal/app/machined/pkg/controllers/k8s/manifest.go
@@ -7,9 +7,10 @@ package k8s
 import (
 	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
-	"html/template"
 	"log"
+	"text/template"
 
 	"github.com/AlekSi/pointer"
 	"github.com/talos-systems/os-runtime/pkg/controller"
@@ -137,6 +138,12 @@ type renderedManifest struct {
 	data []byte
 }
 
+func jsonify(input string) (string, error) {
+	out, err := json.Marshal(input)
+
+	return string(out), err
+}
+
 func (ctrl *ManifestController) render(cfg config.K8sManifestsSpec, scrt *secrets.RootKubernetesSpec) ([]renderedManifest, error) {
 	templateConfig := struct {
 		config.K8sManifestsSpec
@@ -191,7 +198,11 @@ func (ctrl *ManifestController) render(cfg config.K8sManifestsSpec, scrt *secret
 	manifests := make([]renderedManifest, len(defaultManifests))
 
 	for i := range defaultManifests {
-		tmpl, err := template.New(defaultManifests[i].name).Parse(string(defaultManifests[i].template))
+		tmpl, err := template.New(defaultManifests[i].name).
+			Funcs(template.FuncMap{
+				"json": jsonify,
+			}).
+			Parse(string(defaultManifests[i].template))
 		if err != nil {
 			return nil, fmt.Errorf("error parsing manifest template %q: %w", defaultManifests[i].name, err)
 		}

diff --git a/internal/app/machined/pkg/controllers/k8s/manifest_test.go b/internal/app/machined/pkg/controllers/k8s/manifest_test.go
@@ -160,6 +160,51 @@ func (suite *ManifestSuite) TestReconcileDisableKubeProxy() {
 	))
 }
 
+func (suite *ManifestSuite) TestReconcileKubeProxyExtraArgs() {
+	rootSecrets := secrets.NewRoot(secrets.RootKubernetesID)
+	manifestConfig := config.NewK8sManifests()
+	spec := defaultManifestSpec
+	spec.ProxyExtraArgs = map[string]string{
+		"bind-address": "\"::\"",
+	}
+	manifestConfig.SetManifests(spec)
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, rootSecrets))
+	suite.Require().NoError(suite.state.Create(suite.ctx, manifestConfig))
+
+	suite.Assert().NoError(retry.Constant(10*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
+		func() error {
+			return suite.assertManifests(
+				[]string{
+					"00-kubelet-bootstrapping-token",
+					"01-csr-approver-role-binding",
+					"01-csr-node-bootstrap",
+					"01-csr-renewal-role-binding",
+					"02-kube-system-sa-role-binding", "03-default-pod-security-policy", "05-flannel",
+					"10-kube-proxy",
+					"11-core-dns",
+					"11-core-dns-svc",
+					"11-kube-config-in-cluster",
+				},
+			)
+		},
+	))
+
+	r, err := suite.state.Get(suite.ctx, resource.NewMetadata(k8s.ControlPlaneNamespaceName, k8s.ManifestType, "10-kube-proxy", resource.VersionUndefined))
+	suite.Require().NoError(err)
+
+	manifest := r.(*k8s.Manifest) //nolint: errcheck
+	suite.Assert().Len(manifest.Objects(), 3)
+
+	suite.Assert().Equal("DaemonSet", manifest.Objects()[0].GetKind())
+
+	ds := manifest.Objects()[0].Object
+	containerSpec := ds["spec"].(map[string]interface{})["template"].(map[string]interface{})["spec"].(map[string]interface{})["containers"].([]interface{})[0]
+	args := containerSpec.(map[string]interface{})["command"].([]interface{}) //nolint: errcheck
+
+	suite.Assert().Equal("--bind-address=\"::\"", args[len(args)-1])
+}
+
 func (suite *ManifestSuite) TearDownTest() {
 	suite.T().Log("tear down")
 

diff --git a/internal/app/machined/pkg/controllers/k8s/templates.go b/internal/app/machined/pkg/controllers/k8s/templates.go
@@ -141,7 +141,7 @@ spec:
         - --proxy-mode={{ .ProxyMode }}
         - --conntrack-max-per-core=0
         {{- range $k, $v := .ProxyExtraArgs }}
-        - --{{ $k }}={{ $v }}
+        - {{ printf "--%s=%s" $k $v | json }}
         {{- end }}
         env:
           - name: NODE_NAME

diff --git a/pkg/resources/k8s/manifest.go b/pkg/resources/k8s/manifest.go
@@ -10,7 +10,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"log"
 
 	"github.com/talos-systems/os-runtime/pkg/resource"
 	"github.com/talos-systems/os-runtime/pkg/resource/core"
@@ -122,8 +121,6 @@ func (r *Manifest) SetYAML(yamlBytes []byte) error {
 			continue
 		}
 
-		log.Printf("jsonManifest = %v", string(jsonManifest))
-
 		obj := new(unstructured.Unstructured)
 
 		if err = json.Unmarshal(jsonManifest, obj); err != nil {