Support exclude list

Author: bhaskaramVaranasi

main.go

@@ -125,6 +125,7 @@ func main() {
 	secretName := flag.String("secret-name", "k8s-athenz-syncer", "secret name that contains private key")
 	header := flag.String("auth-header", "", "Authentication header field")
 	nTokenExpireTime := flag.String("ntoken-expiry", "1h0m0s", "Custom nToken expiration duration")
+	excludeNamespaces := flag.String("exclude-namespaces", "", "Namespaces to exclude from processing")
 
 	klog.InitFlags(nil)
 	flag.Set("logtostderr", "false")
@@ -190,7 +191,16 @@ func main() {
 			processList = append(processList, item)
 		}
 	}
-	util := util.NewUtil(*adminDomain, processList)
+
+	// process skip namespaces input string
+	excludeNSList := strings.Split(*excludeNamespaces, ",")
+	exclusionList := []string{}
+	for _, item := range excludeNSList {
+		if item != "" {
+			exclusionList = append(exclusionList, item)
+		}
+	}
+	util := util.NewUtil(*adminDomain, processList, exclusionList)
 
 	// construct the Controller object which has all of the necessary components to
 	// handle logging, connections, informing (listing and watching), the queue,

pkg/controller/controller.go

@@ -5,7 +5,7 @@ Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
-    http://www.apache.org/licenses/LICENSE-2.0
+	http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
@@ -122,6 +122,10 @@ func (c *Controller) nsinformerhandler(fn cache.KeyFunc, obj interface{}) string
 		log.Errorf("Error returned from Key Func in nsInformerHandler. Error: %v", err)
 		return ""
 	}
+	if c.util.IsNamespaceExcluded(key) {
+		log.Infof("Skip processing excluded namespace: %s", key)
+		return key
+	}
 	domain := c.util.NamespaceToDomain(key)
 	c.queue.AddRateLimited(domain)
 	return key

pkg/controller/controller_test.go

@@ -5,7 +5,7 @@ Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
-    http://www.apache.org/licenses/LICENSE-2.0
+	http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
@@ -45,7 +45,7 @@ func newController() *Controller {
 	athenzclientset := fake.NewSimpleClientset()
 	clientset := k8sfake.NewSimpleClientset()
 	zmsclient := zms.NewClient("https://zms.athenz.com", &http.Transport{})
-	util := util.NewUtil("admin.domain", []string{"kube-system", "kube-public", "kube-test"})
+	util := util.NewUtil("admin.domain", []string{"kube-system", "kube-public", "kube-test"}, []string{"acceptance-test"})
 	cm := &cron.AthenzContactTimeConfigMap{
 		Namespace: "kube-yahoo",
 		Name:      "athenzcall-config",
@@ -161,7 +161,7 @@ func TestDeepCopy(t *testing.T) {
 	}
 }
 
-//TestZmsGetSignedDomains - test zms API call to get signed domains
+// TestZmsGetSignedDomains - test zms API call to get signed domains
 func TestZmsGetSignedDomains(t *testing.T) {
 	d := getFakeDomain()
 	signedDomain := zms.SignedDomains{

pkg/cron/cron.go

@@ -5,7 +5,7 @@ Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
-    http://www.apache.org/licenses/LICENSE-2.0
+	http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
@@ -150,6 +150,10 @@ func (c *Cron) FullResync(stopCh <-chan struct{}) {
 					log.Error("Error occurred when casting namespace into string")
 					continue
 				}
+				if c.util.IsNamespaceExcluded(namespace.ObjectMeta.Name) {
+					log.Infof("Skip processing excluded namespace: %s", namespace.ObjectMeta.Name)
+					continue
+				}
 				domainName := c.util.NamespaceToDomain(namespace.ObjectMeta.Name)
 				c.queue.AddRateLimited(domainName)
 			}

pkg/cron/cron_test.go

@@ -5,7 +5,7 @@ Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
-    http://www.apache.org/licenses/LICENSE-2.0
+	http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
@@ -48,7 +48,7 @@ func newCron() *Cron {
 	clientset := k8sfake.NewSimpleClientset()
 	rateLimiter := ratelimiter.NewRateLimiter(250 * time.Millisecond)
 	queue := workqueue.NewRateLimitingQueue(rateLimiter)
-	util := util.NewUtil("test.domain", []string{"kube-system"})
+	util := util.NewUtil("test.domain", []string{"kube-system"}, []string{"acceptance-test"})
 	athenzclientset := fake.NewSimpleClientset()
 	informer := athenzInformer.NewAthenzDomainInformer(athenzclientset, 0, cache.Indexers{
 		"trustDomain": cr.TrustDomainIndexFunc,

pkg/util/util.go

@@ -5,7 +5,7 @@ Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
-    http://www.apache.org/licenses/LICENSE-2.0
+	http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
@@ -23,15 +23,22 @@ import (
 
 // Util - struct with 2 fields adminDomain and list of system namespaces
 type Util struct {
-	adminDomain      string
-	systemNamespaces []string
+	adminDomain       string
+	systemNamespaces  []string
+	excludeNamespaces map[string]bool
 }
 
 // NewUtil - create new Util object
-func NewUtil(adminDomain string, systemNamespaces []string) *Util {
+func NewUtil(adminDomain string, systemNamespaces []string, excludeNamespaces []string) *Util {
+	excludedNamespaceMap := make(map[string]bool)
+	for _, ns := range excludeNamespaces {
+		excludedNamespaceMap[ns] = true
+	}
+
 	return &Util{
-		adminDomain:      adminDomain,
-		systemNamespaces: systemNamespaces,
+		adminDomain:       adminDomain,
+		systemNamespaces:  systemNamespaces,
+		excludeNamespaces: excludedNamespaceMap,
 	}
 }
 
@@ -78,6 +85,14 @@ func (u *Util) IsSystemDomain(domain string) bool {
 	return false
 }
 
+// IsNamespaceExcluded - check if the current namespace is in the skip namespaces list
+func (u *Util) IsNamespaceExcluded(ns string) bool {
+	if _, ok := u.excludeNamespaces[ns]; ok {
+		return true
+	}
+	return false
+}
+
 // IsAdminDomain - check if domain is admin domain
 func (u *Util) IsAdminDomain(domain string) bool {
 	if domain == u.adminDomain {

pkg/util/util_test.go

@@ -5,7 +5,7 @@ Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 
-    http://www.apache.org/licenses/LICENSE-2.0
+	http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
@@ -20,7 +20,7 @@ import (
 )
 
 func newUtil() *Util {
-	return NewUtil("admin.domain", []string{"kube-system", "kube-public", "kube-test"})
+	return NewUtil("admin.domain", []string{"kube-system", "kube-public", "kube-test"}, []string{"acceptance-test"})
 }
 
 // TestNamespaceConversion - test conversion function
@@ -113,3 +113,18 @@ func TestGetSystemNSDomains(t *testing.T) {
 		}
 	}
 }
+
+// TestIsNamespaceExcluded - test whether certain namespace is in the skip namespaces list
+func TestIsNamespaceExcluded(t *testing.T) {
+	u := newUtil()
+	test1 := "acceptance-test"
+	result1 := u.IsNamespaceExcluded(test1)
+	if !result1 {
+		t.Error("test1 failed. acceptance-test is in the skip namespaces list!")
+	}
+	test2 := "kube-system"
+	result2 := u.IsNamespaceExcluded(test2)
+	if result2 {
+		t.Error("test2 failed. kube-system is not in the skip namespaces list!")
+	}
+}