@@ -51,6 +51,13 @@ import (
5151 "sigs.k8s.io/yaml"
5252
5353 nfdclientset "sigs.k8s.io/node-feature-discovery/api/generated/clientset/versioned"
54+ klogutils "sigs.k8s.io/node-feature-discovery/pkg/utils/klog"
55+ spiffe "sigs.k8s.io/node-feature-discovery/pkg/utils/spiffe"
56+
57+ taintutils "k8s.io/kubernetes/pkg/util/taints"
58+ "sigs.k8s.io/yaml"
59+
60+ "sigs.k8s.io/node-feature-discovery/api/nfd/v1alpha1"
5461 nfdv1alpha1 "sigs.k8s.io/node-feature-discovery/api/nfd/v1alpha1"
5562 "sigs.k8s.io/node-feature-discovery/pkg/apis/nfd/nodefeaturerule"
5663 "sigs.k8s.io/node-feature-discovery/pkg/apis/nfd/validate"
@@ -60,6 +67,9 @@ import (
6067 "sigs.k8s.io/node-feature-discovery/pkg/version"
6168)
6269
70+ // SocketPath specifies Spiffe Socket Path
71+ const SocketPath = "unix:///run/spire/sockets/agent.sock"
72+
6373// Labels are a Kubernetes representation of discovered features.
6474type Labels map [string ]string
6575
@@ -92,6 +102,7 @@ type NFDConfig struct {
92102 NfdApiParallelism int
93103 Klog klogutils.KlogConfigOpts
94104 Restrictions Restrictions
105+ EnableSpiffe bool
95106}
96107
97108// LeaderElectionConfig contains the configuration for leader election
@@ -110,6 +121,7 @@ type ConfigOverrideArgs struct {
110121 NoPublish * bool
111122 ResyncPeriod * utils.DurationVal
112123 NfdApiParallelism * int
124+ EnableSpiffe * bool
113125}
114126
115127// Args holds command line arguments
@@ -149,7 +161,8 @@ type nfdMaster struct {
149161 nfdClient nfdclientset.Interface
150162 updaterPool * updaterPool
151163 deniedNs
152- config * NFDConfig
164+ config * NFDConfig
165+ spiffeClient * spiffe.SpiffeClient
153166}
154167
155168// NewNfdMaster creates a new NfdMaster server instance.
@@ -206,6 +219,12 @@ func NewNfdMaster(opts ...NfdMasterOption) (NfdMaster, error) {
206219
207220 nfd .updaterPool = newUpdaterPool (nfd )
208221
222+ spiffeClient , err := spiffe .NewSpiffeClient (SocketPath )
223+ if err != nil {
224+ return nfd , err
225+ }
226+ nfd .spiffeClient = spiffeClient
227+
209228 return nfd , nil
210229}
211230
@@ -247,14 +266,15 @@ func newDefaultConfig() *NFDConfig {
247266 RetryPeriod : utils.DurationVal {Duration : time .Duration (2 ) * time .Second },
248267 RenewDeadline : utils.DurationVal {Duration : time .Duration (10 ) * time .Second },
249268 },
250- Klog : make (map [string ]string ),
251269 Restrictions : Restrictions {
252270 DisableLabels : false ,
253271 DisableExtendedResources : false ,
254272 DisableAnnotations : false ,
255273 AllowOverwrite : true ,
256274 DenyNodeFeatureLabels : false ,
257275 },
276+ Klog : make (map [string ]string ),
277+ EnableSpiffe : false ,
258278 }
259279}
260280
@@ -677,6 +697,55 @@ func (m *nfdMaster) nfdAPIUpdateOneNode(cli k8sclient.Interface, node *corev1.No
677697 return fmt .Errorf ("failed to merge NodeFeature objects for node %q: %w" , node .Name , err )
678698 }
679699
700+ // Sort our objects
701+ sort .Slice (objs , func (i , j int ) bool {
702+ // Objects in our nfd namespace gets into the beginning of the list
703+ if objs [i ].Namespace == m .namespace && objs [j ].Namespace != m .namespace {
704+ return true
705+ }
706+ if objs [i ].Namespace != m .namespace && objs [j ].Namespace == m .namespace {
707+ return false
708+ }
709+ // After the nfd namespace, sort objects by their name
710+ if objs [i ].Name != objs [j ].Name {
711+ return objs [i ].Name < objs [j ].Name
712+ }
713+ // Objects with the same name are sorted by their namespace
714+ return objs [i ].Namespace < objs [j ].Namespace
715+ })
716+
717+ // If spiffe is enabled, we should filter out the non verified NFD objects
718+ if m .config .EnableSpiffe {
719+ objs , err = m .getVerifiedNFDObjects (objs )
720+ if err != nil {
721+ return err
722+ }
723+ }
724+
725+ klog .V (1 ).InfoS ("processing of node initiated by NodeFeature API" , "nodeName" , node .Name )
726+
727+ features := nfdv1alpha1 .NewNodeFeatureSpec ()
728+
729+ if len (objs ) > 0 {
730+ // Merge in features
731+ //
732+ // NOTE: changing the rule api to support handle multiple objects instead
733+ // of merging would probably perform better with lot less data to copy.
734+ features = objs [0 ].Spec .DeepCopy ()
735+ if m .config .AutoDefaultNs {
736+ features .Labels = addNsToMapKeys (features .Labels , nfdv1alpha1 .FeatureLabelNs )
737+ }
738+ for _ , o := range objs [1 :] {
739+ s := o .Spec .DeepCopy ()
740+ if m .config .AutoDefaultNs {
741+ s .Labels = addNsToMapKeys (s .Labels , nfdv1alpha1 .FeatureLabelNs )
742+ }
743+ s .MergeInto (features )
744+ }
745+
746+ klog .V (4 ).InfoS ("merged nodeFeatureSpecs" , "newNodeFeatureSpec" , utils .DelayedDumper (features ))
747+ }
748+
680749 // Update node labels et al. This may also mean removing all NFD-owned
681750 // labels (et al.), for example in the case no NodeFeature objects are
682751 // present.
@@ -1187,6 +1256,9 @@ func (m *nfdMaster) configure(filepath string, overrides string) error {
11871256 if m .args .Overrides .NfdApiParallelism != nil {
11881257 c .NfdApiParallelism = * m .args .Overrides .NfdApiParallelism
11891258 }
1259+ if m .args .Overrides .EnableSpiffe != nil {
1260+ c .EnableSpiffe = * m .args .Overrides .EnableSpiffe
1261+ }
11901262
11911263 if c .NfdApiParallelism <= 0 {
11921264 return fmt .Errorf ("the maximum number of concurrent labelers should be a non-zero positive number" )
@@ -1387,3 +1459,27 @@ func patchNode(cli k8sclient.Interface, nodeName string, patches []utils.JsonPat
13871459func patchNodeStatus (cli k8sclient.Interface , nodeName string , patches []utils.JsonPatch ) error {
13881460 return patchNode (cli , nodeName , patches , "status" )
13891461}
1462+
1463+ func (m * nfdMaster ) getVerifiedNFDObjects (objs []* v1alpha1.NodeFeature ) ([]* v1alpha1.NodeFeature , error ) {
1464+ verifiedObjects := []* v1alpha1.NodeFeature {}
1465+
1466+ workerPrivateKey , workerPublicKey , err := m .spiffeClient .GetWorkerKeys ()
1467+ if err != nil {
1468+ return verifiedObjects , err
1469+ }
1470+
1471+ for _ , obj := range objs {
1472+ isSignatureVerified , err := spiffe .VerifyDataSignature (obj .Spec , obj .Annotations ["signature" ], workerPrivateKey , workerPublicKey )
1473+ if err != nil {
1474+ return nil , fmt .Errorf ("failed to verify NodeFeature signature: %w" , err )
1475+ }
1476+
1477+ if isSignatureVerified {
1478+ klog .InfoS ("NodeFeature verified" , "NodeFeature name" , obj .Name )
1479+ verifiedObjects = append (verifiedObjects , obj )
1480+ } else {
1481+ klog .InfoS ("NodeFeature not verified, skipping..." , "NodeFeature name" , obj .Name )
1482+ }
1483+ }
1484+ return verifiedObjects , nil
1485+ }
0 commit comments