chore(volume): add reserved name patterns

Author: duanhongyi

charts/controller/templates/_helpers.tpl

@@ -320,28 +320,20 @@ kubelet_volume_stats_inodes_free: [namespace, persistentvolumeclaim, job]
 kubelet_volume_stats_inodes_used: [namespace, persistentvolumeclaim, job]
 {{- end }}
 
-{{/* Generate controller config default reserved names */}}
-{{ define "controller.config.defaultReservedNames" }}
-backup
-catalog
-cert-manager
-default
-drycc
-drycc-manager
-drycc-helmbroker
-drycc-builder
-drycc-grafana
-drycc-passport
-istio-gateway
-istio-system
-kube-node-lease
-kube-public
-kube-system
-longhorn-system
-metallb
-mount-s3
-topolvm
-rook-ceph
+{{/* Generate controller config default reserved name patterns */}}
+{{ define "controller.config.defaultReservedNamePatterns" }}
+^backup$
+^catalog$
+^cert-manager$
+^default$
+^drycc(?:-[\w-]+)?$
+^istio(?:-[\w-]+)?$
+^kube(?:-[\w-]+)?$
+^longhorn-system$
+^metallb$
+^mount-s3$
+^topolvm$
+^rook-ceph$
 {{- end }}
 
 {{/* Generate controller config default secrets template */}}

charts/controller/templates/controller-configmap.yaml

@@ -23,12 +23,6 @@ data:
     {{- else}}
     {{- include "controller.config.defaultLimitPlans" . | fromYamlArray | toPrettyJson | nindent 4 }}
     {{- end }}
-  reserved-names.txt: |-
-    {{- if .Values.config.reservedNames }}
-    {{- (tpl .Values.config.reservedNames $)  | nindent 4 }}
-    {{- else}}
-    {{- include "controller.config.defaultReservedNames" . | nindent 4 }}
-    {{- end }}
   secret-template.json: |
     {{- if .Values.config.secretTemplate }}
     {{- (tpl .Values.config.secretTemplate $)  | nindent 4 }}
@@ -41,6 +35,12 @@ data:
     {{- else}}
     {{- include "controller.config.defaultVolumeTemplate" . | fromYaml | toPrettyJson | nindent 4 }}
     {{- end }}
+  reserved-name-patterns.txt: |-
+    {{- if .Values.config.reservedNames }}
+    {{- (tpl .Values.config.reservedNames $)  | nindent 4 }}
+    {{- else}}
+    {{- include "controller.config.defaultReservedNamePatterns" . | nindent 4 }}
+    {{- end }}
   volume-claim-template.json: |
     {{- if .Values.config.volumeClaimTemplate }}
     {{- (tpl .Values.config.volumeClaimTemplate $)  | nindent 4 }}

rootfs/api/models/app.py

@@ -22,7 +22,8 @@
 
 from api.utils import get_session, dict_diff
 from api.exceptions import AlreadyExists, DryccException, ServiceUnavailable
-from api.utils import CacheLock, DeployLock, generate_app_name, apply_tasks
+from api.utils import (
+    CacheLock, DeployLock, generate_app_name, apply_tasks, validate_reserved_names)
 from scheduler import KubeHTTPException, KubeException
 from .gateway import Gateway, Route
 from .limit import LimitPlan
@@ -88,32 +89,28 @@ def validate_app_id(value):
     if not match:
         raise ValidationError("App name must start with an alphabetic character, cannot end with a"
                               + " hyphen and can only contain a-z (lowercase), 0-9 and hyphens.")
+    validate_reserved_names(value)
 
 
 def validate_app_structure(value):
     """Error if the dict values aren't ints >= 0"""
     try:
-        if any(int(v) < 0 for v in value.values()):
-            raise ValueError("Must be greater than or equal to zero")
+        for k, v in value.items():
+            if int(v) < 0:
+                raise ValueError("Must be greater than or equal to zero")
+            validate_reserved_names(k)
     except ValueError as err:
         raise ValidationError(str(err))
 
 
-def validate_reserved_names(value):
-    """A value cannot use some reserved names."""
-    if value in settings.RESERVED_NAMES:
-        raise ValidationError('{} is a reserved name.'.format(value))
-
-
 class App(UuidAuditedModel):
     """
     Application used to service requests on behalf of end-users
     """
 
     owner = models.ForeignKey(User, on_delete=models.PROTECT)
     id = models.SlugField(max_length=63, unique=True, null=True,
-                          validators=[validate_app_id,
-                                      validate_reserved_names])
+                          validators=[validate_app_id])
     structure = models.JSONField(
         default=dict, blank=True, validators=[validate_app_structure])
 

rootfs/api/models/gateway.py

@@ -6,6 +6,7 @@
 from django.db.models import Q
 from django.http import Http404
 
+from api.utils import validate_label
 from api.exceptions import ServiceUnavailable
 from scheduler import KubeException
 
@@ -22,7 +23,7 @@
 class Gateway(AuditedModel):
     app = models.ForeignKey('App', on_delete=models.CASCADE)
     owner = models.ForeignKey(User, on_delete=models.PROTECT)
-    name = models.CharField(max_length=63, db_index=True)
+    name = models.CharField(max_length=63, db_index=True, validators=[validate_label])
     ports = models.JSONField(default=list)
 
     def log(self, message, level=logging.INFO):

rootfs/api/serializers/__init__.py

@@ -15,7 +15,7 @@
 
 
 from api import models
-from api.utils import validate_json
+from api.utils import validate_json, validate_reserved_names
 from api.exceptions import DryccException
 from api.models.volume import Volume
 from api.models.base import PTYPE_MIN_LENGTH, PTYPE_MAX_LENGTH
@@ -78,6 +78,7 @@ def validate_ptype(value):
         raise serializers.ValidationError(
             "The length of ptype must be between {} and {}".format(
                 PTYPE_MIN_LENGTH, PTYPE_MAX_LENGTH))
+    validate_reserved_names(value)
     return value
 
 
@@ -91,6 +92,7 @@ def validate_name(value):
         raise serializers.ValidationError(
             "The length of name must be between {} and {}".format(
                 PTYPE_MIN_LENGTH, PTYPE_MAX_LENGTH))
+    validate_reserved_names(value)
     return value
 
 

rootfs/api/settings/production.py

@@ -255,13 +255,13 @@ def randstr(k):
 TEMPDIR = tempfile.mkdtemp(prefix='drycc')
 
 # names which apps cannot reserve for routing
-RESERVED_NAMES_PATH = os.environ.get(
-    'RESERVED_NAMES_PATH', '/etc/controller/reserved-names.txt')
-if os.path.exists(RESERVED_NAMES_PATH):
-    with open(RESERVED_NAMES_PATH) as f:
-        RESERVED_NAMES = [line.strip() for line in f if line]
+RESERVED_NAME_PATTERNS_PATH = os.environ.get(
+    'RESERVED_NAME_PATTERNS_PATH', '/etc/controller/reserved-name-patterns.txt')
+if os.path.exists(RESERVED_NAME_PATTERNS_PATH):
+    with open(RESERVED_NAME_PATTERNS_PATH) as f:
+        RESERVED_NAME_PATTERNS = [line.strip() for line in f if line.strip()]
 else:
-    RESERVED_NAMES = ["drycc", "drycc-helmbroker", "drycc-manager", "kube-system", "default"]
+    RESERVED_NAME_PATTERNS = [r"^drycc(?:-[\w-]+)?$", r"^kube(?:-[\w-]+)?$", r"^default$"]
 
 # the k8s namespace in which the controller and workflow were installed.
 WORKFLOW_NAMESPACE = os.environ.get('WORKFLOW_NAMESPACE', 'drycc')

rootfs/api/tests/test_app.py

@@ -158,8 +158,8 @@ def test_app_errors(self, mock_requests):
 
     def test_app_reserved_names(self, mock_requests):
         """Nobody should be able to create applications with names which are reserved."""
-        reserved_names = ['foo', 'bar']
-        with self.settings(RESERVED_NAMES=reserved_names):
+        reserved_names = ['fooooo', 'barrrrrr']
+        with self.settings(RESERVED_NAME_PATTERNS=reserved_names):
             for name in reserved_names:
                 response = self.client.post('/v2/apps', {'id': name})
                 self.assertContains(

rootfs/api/utils.py

@@ -75,6 +75,14 @@ def validate_label(value):
     match = re.match(r'^[a-z0-9-]+$', value)
     if not match:
         raise ValidationError("Can only contain a-z (lowercase), 0-9 and hyphens")
+    validate_reserved_names(value)
+
+
+def validate_reserved_names(value):
+    """A value cannot use some reserved names."""
+    for reserved_name_pattern in settings.RESERVED_NAME_PATTERNS:
+        if re.match(reserved_name_pattern, value):
+            raise ValidationError('{} is a reserved name.'.format(value))
 
 
 def random_string(num):

rootfs/api/views.py

@@ -14,6 +14,7 @@
 
 from urllib.parse import urljoin
 from asgiref.sync import async_to_sync
+from django.db import transaction
 from django.db.models import Q
 from django.core.cache import cache
 from django.http import Http404, HttpResponse
@@ -348,6 +349,11 @@ def run(self, request, **kwargs):
                 timeout=timeout, expires=expires)
         return Response(status=status.HTTP_204_NO_CONTENT)
 
+    @transaction.atomic
+    def create(self, request, *args, **kwargs):
+        return super().create(request, *args, **kwargs)
+
+    @transaction.atomic
     def update(self, request, **kwargs):
         app = self.get_object()
         old_owner = app.owner
@@ -361,6 +367,10 @@ def update(self, request, **kwargs):
             downstream_model_owner.delay(app, old_owner, new_owner)
         return Response(status=status.HTTP_200_OK)
 
+    @transaction.atomic
+    def destroy(self, request, *args, **kwargs):
+        return super().destroy(request, *args, **kwargs)
+
 
 class BuildViewSet(ReleasableViewSet):
     """A viewset for interacting with Build objects."""
@@ -1353,7 +1363,7 @@ async def authenticate(self, request, username):
             return None, {'error': 'Unauthorized', "status_code": 401}
         if auth[0].username != username:
             return None, {'error': 'Access denied', "status_code": 403}
-        return auth[0].id, None        
+        return auth[0].id, None
 
 
 @method_decorator(csrf_exempt, name='dispatch')