Skip to content

Commit 78580fa

Browse files
author
mgianluc
committed
(feat) field exclusion for configuration drift
When creating a Profile/ClusterProfile with syncMode set to `ContinuosWithDriftDetection`, adds ability to specify a set of fields, for certain resources, to be ignored when evaluation configuration drift. For example, consider a Deployment managed by an autoscaler. The autoscaler dynamically adjusts replica count based on workload. In this scenario, it's crucial to distinguish between intentional deployment changes (e.g., deletion) and expected replica fluctuations. By ignoring replica count changes, Sveltos can accurately detect meaningful configuration drifts. This PR allows user to set new field `DriftExclusions`. This PR also adds necessary code for addon-controller to transform each DriftExclusion to a Patch (op always set to remove) and pass it down to drift-detection-manager as part of ResourceSummary. Drift-detection-manager will finally consume those Patches before evaluating configuration drift.
1 parent 226a352 commit 78580fa

16 files changed

+862
-47
lines changed

‎api/v1alpha1/zz_generated.conversion.go

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/v1beta1/spec.go

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -495,6 +495,16 @@ type PolicyRef struct {
495495
DeploymentType DeploymentType `json:"deploymentType,omitempty"`
496496
}
497497

498+
type DriftExclusion struct {
499+
// Paths is a slice of JSON6902 paths to exclude from configuration drift evaluation.
500+
// +required
501+
Paths []string `json:"paths"`
502+
503+
// Target points to the resources that the paths refers to.
504+
// +optional
505+
Target *libsveltosv1beta1.PatchSelector `json:"target,omitempty"`
506+
}
507+
498508
type Clusters struct {
499509
// Hash represents of a unique value for ClusterProfile Spec at
500510
// a fixed point in time
@@ -626,6 +636,12 @@ type Spec struct {
626636
// +optional
627637
Patches []libsveltosv1beta1.Patch `json:"patches,omitempty"`
628638

639+
// DriftExclusions is a list of configuration drift exclusions to be applied when syncMode is
640+
// set to ContinuousWithDriftDetection. Each exclusion specifies JSON6902 paths to ignore
641+
// when evaluating drift, optionally targeting specific resources and features.
642+
// +optional
643+
DriftExclusions []DriftExclusion `json:"driftExclusions,omitempty"`
644+
629645
// ExtraLabels: These labels will be added by Sveltos to all Kubernetes resources deployed in
630646
// a managed cluster based on this ClusterProfile/Profile instance.
631647
// **Important:** If a resource deployed by Sveltos already has a label with a key present in

‎api/v1beta1/zz_generated.deepcopy.go

Lines changed: 32 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/config.projectsveltos.io_clusterprofiles.yaml

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1153,6 +1153,65 @@ spec:
11531153
items:
11541154
type: string
11551155
type: array
1156+
driftExclusions:
1157+
description: |-
1158+
DriftExclusions is a list of configuration drift exclusions to be applied when syncMode is
1159+
set to ContinuousWithDriftDetection. Each exclusion specifies JSON6902 paths to ignore
1160+
when evaluating drift, optionally targeting specific resources and features.
1161+
items:
1162+
properties:
1163+
paths:
1164+
description: Paths is a slice of JSON6902 paths to exclude from
1165+
configuration drift evaluation.
1166+
items:
1167+
type: string
1168+
type: array
1169+
target:
1170+
description: Target points to the resources that the paths refers
1171+
to.
1172+
properties:
1173+
annotationSelector:
1174+
description: |-
1175+
AnnotationSelector is a string that follows the label selection expression
1176+
https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
1177+
It matches with the resource annotations.
1178+
type: string
1179+
group:
1180+
description: |-
1181+
Group is the API group to select resources from.
1182+
Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.
1183+
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
1184+
type: string
1185+
kind:
1186+
description: |-
1187+
Kind of the API Group to select resources from.
1188+
Together with Group and Version it is capable of unambiguously
1189+
identifying and/or selecting resources.
1190+
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
1191+
type: string
1192+
labelSelector:
1193+
description: |-
1194+
LabelSelector is a string that follows the label selection expression
1195+
https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
1196+
It matches with the resource labels.
1197+
type: string
1198+
name:
1199+
description: Name to match resources with.
1200+
type: string
1201+
namespace:
1202+
description: Namespace to select resources from.
1203+
type: string
1204+
version:
1205+
description: |-
1206+
Version of the API Group to select resources from.
1207+
Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.
1208+
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
1209+
type: string
1210+
type: object
1211+
required:
1212+
- paths
1213+
type: object
1214+
type: array
11561215
extraAnnotations:
11571216
additionalProperties:
11581217
type: string

‎config/crd/bases/config.projectsveltos.io_clustersummaries.yaml

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1124,6 +1124,65 @@ spec:
11241124
items:
11251125
type: string
11261126
type: array
1127+
driftExclusions:
1128+
description: |-
1129+
DriftExclusions is a list of configuration drift exclusions to be applied when syncMode is
1130+
set to ContinuousWithDriftDetection. Each exclusion specifies JSON6902 paths to ignore
1131+
when evaluating drift, optionally targeting specific resources and features.
1132+
items:
1133+
properties:
1134+
paths:
1135+
description: Paths is a slice of JSON6902 paths to exclude
1136+
from configuration drift evaluation.
1137+
items:
1138+
type: string
1139+
type: array
1140+
target:
1141+
description: Target points to the resources that the paths
1142+
refers to.
1143+
properties:
1144+
annotationSelector:
1145+
description: |-
1146+
AnnotationSelector is a string that follows the label selection expression
1147+
https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
1148+
It matches with the resource annotations.
1149+
type: string
1150+
group:
1151+
description: |-
1152+
Group is the API group to select resources from.
1153+
Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.
1154+
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
1155+
type: string
1156+
kind:
1157+
description: |-
1158+
Kind of the API Group to select resources from.
1159+
Together with Group and Version it is capable of unambiguously
1160+
identifying and/or selecting resources.
1161+
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
1162+
type: string
1163+
labelSelector:
1164+
description: |-
1165+
LabelSelector is a string that follows the label selection expression
1166+
https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
1167+
It matches with the resource labels.
1168+
type: string
1169+
name:
1170+
description: Name to match resources with.
1171+
type: string
1172+
namespace:
1173+
description: Namespace to select resources from.
1174+
type: string
1175+
version:
1176+
description: |-
1177+
Version of the API Group to select resources from.
1178+
Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.
1179+
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
1180+
type: string
1181+
type: object
1182+
required:
1183+
- paths
1184+
type: object
1185+
type: array
11271186
extraAnnotations:
11281187
additionalProperties:
11291188
type: string

‎config/crd/bases/config.projectsveltos.io_profiles.yaml

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1153,6 +1153,65 @@ spec:
11531153
items:
11541154
type: string
11551155
type: array
1156+
driftExclusions:
1157+
description: |-
1158+
DriftExclusions is a list of configuration drift exclusions to be applied when syncMode is
1159+
set to ContinuousWithDriftDetection. Each exclusion specifies JSON6902 paths to ignore
1160+
when evaluating drift, optionally targeting specific resources and features.
1161+
items:
1162+
properties:
1163+
paths:
1164+
description: Paths is a slice of JSON6902 paths to exclude from
1165+
configuration drift evaluation.
1166+
items:
1167+
type: string
1168+
type: array
1169+
target:
1170+
description: Target points to the resources that the paths refers
1171+
to.
1172+
properties:
1173+
annotationSelector:
1174+
description: |-
1175+
AnnotationSelector is a string that follows the label selection expression
1176+
https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
1177+
It matches with the resource annotations.
1178+
type: string
1179+
group:
1180+
description: |-
1181+
Group is the API group to select resources from.
1182+
Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.
1183+
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
1184+
type: string
1185+
kind:
1186+
description: |-
1187+
Kind of the API Group to select resources from.
1188+
Together with Group and Version it is capable of unambiguously
1189+
identifying and/or selecting resources.
1190+
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
1191+
type: string
1192+
labelSelector:
1193+
description: |-
1194+
LabelSelector is a string that follows the label selection expression
1195+
https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
1196+
It matches with the resource labels.
1197+
type: string
1198+
name:
1199+
description: Name to match resources with.
1200+
type: string
1201+
namespace:
1202+
description: Namespace to select resources from.
1203+
type: string
1204+
version:
1205+
description: |-
1206+
Version of the API Group to select resources from.
1207+
Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.
1208+
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
1209+
type: string
1210+
type: object
1211+
required:
1212+
- paths
1213+
type: object
1214+
type: array
11561215
extraAnnotations:
11571216
additionalProperties:
11581217
type: string

‎controllers/export_test.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@ var (
7777

7878
GetClusterSummary = getClusterSummary
7979
AddLabel = addLabel
80+
UpdateResource = updateResource
8081
CreateNamespace = createNamespace
8182
GetEntryKey = getEntryKey
8283
DeployContentOfConfigMap = deployContentOfConfigMap
@@ -155,6 +156,7 @@ var (
155156
GetDriftDetectionManagerLabels = getDriftDetectionManagerLabels
156157
RemoveDriftDetectionManagerFromManagementCluster = removeDriftDetectionManagerFromManagementCluster
157158
GetDriftDetectionNamespaceInMgmtCluster = getDriftDetectionNamespaceInMgmtCluster
159+
TransformDriftExclusionsToPatches = transformDriftExclusionsToPatches
158160

159161
GetResourceSummaryNamespace = getResourceSummaryNamespace
160162
GetResourceSummaryName = getResourceSummaryName

‎controllers/handlers_helm.go

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -115,8 +115,8 @@ func deployHelmCharts(ctx context.Context, c client.Client,
115115
// Since we are updating resources to watch for drift, remove helm section in ResourceSummary to eliminate
116116
// un-needed reconciliation (Sveltos is updating those resources so we don't want drift-detection to think
117117
// a configuration drift is happening)
118-
err = deployResourceSummaryInCluster(ctx, c, clusterNamespace, clusterName, clusterSummary.Name,
119-
clusterType, nil, nil, []libsveltosv1beta1.HelmResources{}, logger)
118+
err = deployResourceSummaryInCluster(ctx, c, clusterNamespace, clusterName, clusterSummary.Name, clusterType, nil, nil,
119+
[]libsveltosv1beta1.HelmResources{}, clusterSummary.Spec.ClusterProfileSpec.DriftExclusions, logger)
120120
if err != nil {
121121
logger.V(logs.LogInfo).Error(err, "failed to remove ResourceSummary.")
122122
return err
@@ -159,7 +159,7 @@ func deployHelmCharts(ctx context.Context, c client.Client,
159159
if clusterSummary.Spec.ClusterProfileSpec.SyncMode == configv1beta1.SyncModeContinuousWithDriftDetection {
160160
// Deploy resourceSummary
161161
err = deployResourceSummaryInCluster(ctx, c, clusterNamespace, clusterName, clusterSummary.Name,
162-
clusterType, nil, nil, helmResources, logger)
162+
clusterType, nil, nil, helmResources, clusterSummary.Spec.ClusterProfileSpec.DriftExclusions, logger)
163163
if err != nil {
164164
return err
165165
}
@@ -997,11 +997,15 @@ func upgradeRelease(ctx context.Context, clusterSummary *configv1beta1.ClusterSu
997997
return err
998998
}
999999

1000+
driftExclusionPatches := transformDriftExclusionsToPatches(clusterSummary.Spec.ClusterProfileSpec.DriftExclusions)
1001+
10001002
patches, err := initiatePatches(ctx, clusterSummary, requestedChart.ChartName, mgmtResources, logger)
10011003
if err != nil {
10021004
return err
10031005
}
10041006

1007+
patches = append(patches, driftExclusionPatches...)
1008+
10051009
upgradeClient, err := getHelmUpgradeClient(requestedChart, actionConfig, patches)
10061010
if err != nil {
10071011
logger.V(logs.LogInfo).Info(fmt.Sprintf("failed to get helm upgrade client: %v", err))

‎controllers/handlers_kustomize.go

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -783,7 +783,7 @@ func handleKustomizeResourceSummaryDeployment(ctx context.Context, clusterSummar
783783
if clusterSummary.Spec.ClusterProfileSpec.SyncMode == configv1beta1.SyncModeContinuousWithDriftDetection {
784784
// deploy ResourceSummary
785785
err := deployResourceSummaryWithKustomizeResources(ctx, getManagementClusterClient(),
786-
clusterNamespace, clusterName, clusterSummary.Name, clusterType, remoteDeployed, logger)
786+
clusterNamespace, clusterName, clusterSummary, clusterType, remoteDeployed, logger)
787787
if err != nil {
788788
return err
789789
}
@@ -793,7 +793,7 @@ func handleKustomizeResourceSummaryDeployment(ctx context.Context, clusterSummar
793793
}
794794

795795
func deployResourceSummaryWithKustomizeResources(ctx context.Context, c client.Client,
796-
clusterNamespace, clusterName, applicant string,
796+
clusterNamespace, clusterName string, clusterSummary *configv1beta1.ClusterSummary,
797797
clusterType libsveltosv1beta1.ClusterType,
798798
deployed []configv1beta1.Resource, logger logr.Logger) error {
799799

@@ -809,8 +809,8 @@ func deployResourceSummaryWithKustomizeResources(ctx context.Context, c client.C
809809
}
810810
}
811811

812-
return deployResourceSummaryInCluster(ctx, c, clusterNamespace, clusterName, applicant,
813-
clusterType, nil, resources, nil, logger)
812+
return deployResourceSummaryInCluster(ctx, c, clusterNamespace, clusterName, clusterSummary.Name,
813+
clusterType, nil, resources, nil, clusterSummary.Spec.ClusterProfileSpec.DriftExclusions, logger)
814814
}
815815

816816
// deployEachKustomizeRefs walks KustomizationRefs and deploys resources

0 commit comments

Comments
 (0)