feat: validation of required feature gate at start (#72)

.gitignore

@@ -22,3 +22,4 @@ go.work
 
 bin/
 demo-app/target
+.vscode

README.md

@@ -223,6 +223,7 @@ Kube Startup CPU Boost operator can be configured with environmental variables.
 | `ZAP_DEVELOPMENT` | `bool` | `false` | Enables development mode for ZAP logger |
 | `HTTP2` | `bool` | `false` | Determines if the HTTP/2 protocol is used for webhook and metrics servers|
 | `REMOVE_LIMITS` | `bool` | `true` | Enables operator to remove container CPU limits during the boost time |
+| `VALIDATE_FEATURE_ENABLED` | `bool` | `true` | Enables validation of required feature gate on operator's startup |
 
 ## Metrics
 

cmd/main.go

@@ -15,13 +15,16 @@
 package main
 
 import (
+ "context"
  "crypto/tls"
+ "fmt"
  "os"
 
  // Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
  // to ensure that exec-entrypoint and run can make use of them.
 
  _ "k8s.io/client-go/plugin/pkg/client/auth"
+ "k8s.io/client-go/rest"
 
  "k8s.io/apimachinery/pkg/runtime"
  utilruntime "k8s.io/apimachinery/pkg/util/runtime"
@@ -41,15 +44,20 @@ import (
  //+kubebuilder:scaffold:imports
 )
 
+const (
+ IN_PLACE_VERTICAL_POD_AUTOSCALING_FG_NAME = "InPlacePodVerticalScaling"
+)
+
 var (
  scheme = runtime.NewScheme()
  setupLog = ctrl.Log.WithName("setup")
  leaderElectionID = "8fd077db.x-k8s.io"
 )
 
+//+kubebuilder:rbac:urls="/metrics",verbs=get
+
 func init() {
  utilruntime.Must(clientgoscheme.AddToScheme(scheme))
-
  utilruntime.Must(autoscalingv1alpha1.AddToScheme(scheme))
  //+kubebuilder:scaffold:scheme
 }
@@ -62,6 +70,22 @@ func main() {
  }
  ctrl.SetLogger(config.Logger(cfg.ZapDevelopment, cfg.ZapLogLevel))
  metrics.Register()
+ restConfig := ctrl.GetConfigOrDie()
+
+ if cfg.ValidateFeatureEnabled {
+ setupLog.Info("validating required feature gates")
+ featureGates, err := getFeatureGatesFromMetrics(context.Background(), restConfig)
+ if err == nil {
+ if !featureGates.IsEnabledAnyStage(IN_PLACE_VERTICAL_POD_AUTOSCALING_FG_NAME) {
+ setupLog.Error(
+ fmt.Errorf("%s is not enabled at any stage", IN_PLACE_VERTICAL_POD_AUTOSCALING_FG_NAME),
+ "required feature gates are not enabled")
+ os.Exit(1)
+ }
+ } else {
+ setupLog.Error(err, "failed to validate required feature gates, continuing...")
+ }
+ }
 
  tlsOpts := []func(*tls.Config){}
  if !cfg.HTTP2 {
@@ -76,7 +100,7 @@ func main() {
  Port: 9443,
  })
 
- mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
+ mgr, err := ctrl.NewManager(restConfig, ctrl.Options{
  Scheme: scheme,
  Metrics: metricsserver.Options{
  BindAddress: cfg.MetricsProbeBindAddr,
@@ -144,3 +168,11 @@ func setupControllers(mgr ctrl.Manager, boostMgr boost.Manager, cfg *config.Conf
  }
  //+kubebuilder:scaffold:builder
 }
+
+func getFeatureGatesFromMetrics(ctx context.Context, cfg *rest.Config) (util.FeatureGates, error) {
+ fgValidator, err := util.NewMetricsFeatureGateValidatorFromConfig(ctx, cfg)
+ if err != nil {
+ return nil, err
+ }
+ return fgValidator.GetFeatureGates()
+}

config/rbac/role.yaml

@@ -4,6 +4,10 @@ kind: ClusterRole
 metadata:
  name: manager-role
 rules:
+- nonResourceURLs:
+ - /metrics
+ verbs:
+ - get
 - apiGroups:
  - ""
  resources:

go.mod

@@ -11,6 +11,7 @@ require (
  github.com/open-policy-agent/cert-controller v0.11.0
  github.com/prometheus/client_golang v1.20.4
  github.com/prometheus/client_model v0.6.1
+ github.com/prometheus/common v0.55.0
  go.uber.org/mock v0.4.0
  go.uber.org/zap v1.27.0
  gomodules.xyz/jsonpatch/v2 v2.4.0
@@ -52,7 +53,6 @@ require (
  github.com/modern-go/reflect2 v1.0.2 // indirect
  github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
  github.com/pkg/errors v0.9.1 // indirect
- github.com/prometheus/common v0.55.0 // indirect
  github.com/prometheus/procfs v0.15.1 // indirect
  github.com/spf13/pflag v1.0.5 // indirect
  github.com/x448/float16 v0.8.4 // indirect

go.sum

@@ -177,8 +177,6 @@ k8s.io/apiextensions-apiserver v0.31.0 h1:fZgCVhGwsclj3qCw1buVXCV6khjRzKC5eCFt24
 k8s.io/apiextensions-apiserver v0.31.0/go.mod h1:b9aMDEYaEe5sdK+1T0KU78ApR/5ZVp4i56VacZYEHxk=
 k8s.io/apimachinery v0.31.1 h1:mhcUBbj7KUjaVhyXILglcVjuS4nYXiwC+KKFBgIVy7U=
 k8s.io/apimachinery v0.31.1/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
-k8s.io/client-go v0.31.0 h1:QqEJzNjbN2Yv1H79SsS+SWnXkBgVu4Pj3CJQgbx0gI8=
-k8s.io/client-go v0.31.0/go.mod h1:Y9wvC76g4fLjmU0BA+rV+h2cncoadjvjjkkIGoTLcGU=
 k8s.io/client-go v0.31.1 h1:f0ugtWSbWpxHR7sjVpQwuvw9a3ZKLXX0u0itkFXufb0=
 k8s.io/client-go v0.31.1/go.mod h1:sKI8871MJN2OyeqRlmA4W4KM9KBdBUpDLu/43eGemCg=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=

internal/config/config.go

@@ -16,16 +16,17 @@
 package config
 
 const (
- PodNamespaceDefault = "kube-startup-cpu-boost-system"
- MgrCheckIntervalSecDefault = 5
- LeaderElectionDefault = false
- MetricsProbeBindAddrDefault = ":8080"
- HealthProbeBindAddrDefault = ":8081"
- SecureMetricsDefault = false
- ZapLogLevelDefault = 0 // zapcore.InfoLevel
- ZapDevelopmentDefault = false
- HTTP2Default = false
- RemoveLimitsDefault = true
+ PodNamespaceDefault = "kube-startup-cpu-boost-system"
+ MgrCheckIntervalSecDefault = 5
+ LeaderElectionDefault = false
+ MetricsProbeBindAddrDefault = ":8080"
+ HealthProbeBindAddrDefault = ":8081"
+ SecureMetricsDefault = false
+ ZapLogLevelDefault = 0 // zapcore.InfoLevel
+ ZapDevelopmentDefault = false
+ HTTP2Default = false
+ RemoveLimitsDefault = true
+ ValidateFeatureEnabledDefault = true
 )
 
 // ConfigProvider provides the Kube Startup CPU Boost configuration
@@ -57,6 +58,9 @@ type Config struct {
  HTTP2 bool
  // RemoveLimits determines if CPU resource limits should be removed during boost
  RemoveLimits bool
+ // ValidateFeatureEnabled determines if InPlacePodVerticalScaling feature state
+ // is validated at operator's start
+ ValidateFeatureEnabled bool
 }
 
 // LoadDefaults loads the default configuration values
@@ -71,4 +75,5 @@ func (c *Config) LoadDefaults() {
  c.ZapDevelopment = ZapDevelopmentDefault
  c.HTTP2 = HTTP2Default
  c.RemoveLimits = RemoveLimitsDefault
+ c.ValidateFeatureEnabled = ValidateFeatureEnabledDefault
 }

internal/config/config_test.go

@@ -59,5 +59,8 @@ var _ = Describe("Config", func() {
  It("has valid RemoveLimits", func() {
  Expect(cfg.RemoveLimits).To(Equal(config.RemoveLimitsDefault))
  })
+ It("has valid RemoveLimits", func() {
+ Expect(cfg.ValidateFeatureEnabled).To(Equal(config.ValidateFeatureEnabledDefault))
+ })
  })
 })

internal/config/env_provider.go

@@ -21,16 +21,17 @@ import (
 )
 
 const (
- PodNamespaceEnvVar = "POD_NAMESPACE"
- MgrCheckIntervalSecEnvVar = "MGR_CHECK_INTERVAL"
- LeaderElectionEnvVar = "LEADER_ELECTION"
- MetricsProbeBindAddrEnvVar = "METRICS_PROBE_BIND_ADDR"
- HealthProbeBindAddrEnvVar = "HEALTH_PROBE_BIND_ADDR"
- SecureMetricsEnvVar = "SECURE_METRICS"
- ZapLogLevelEnvVar = "ZAP_LOG_LEVEL"
- ZapDevelopmentEnvVar = "ZAP_DEVELOPMENT"
- HTTP2EnvVar = "HTTP2"
- RemoveLimitsEnvVar = "REMOVE_LIMITS"
+ PodNamespaceEnvVar = "POD_NAMESPACE"
+ MgrCheckIntervalSecEnvVar = "MGR_CHECK_INTERVAL"
+ LeaderElectionEnvVar = "LEADER_ELECTION"
+ MetricsProbeBindAddrEnvVar = "METRICS_PROBE_BIND_ADDR"
+ HealthProbeBindAddrEnvVar = "HEALTH_PROBE_BIND_ADDR"
+ SecureMetricsEnvVar = "SECURE_METRICS"
+ ZapLogLevelEnvVar = "ZAP_LOG_LEVEL"
+ ZapDevelopmentEnvVar = "ZAP_DEVELOPMENT"
+ HTTP2EnvVar = "HTTP2"
+ RemoveLimitsEnvVar = "REMOVE_LIMITS"
+ ValidateFeatureEnabledEnvVar = "VALIDATE_FEATURE_ENABLED"
 )
 
 type LookupEnvFunc func(key string) (string, bool)
@@ -59,6 +60,7 @@ func (p *EnvConfigProvider) LoadConfig() (*Config, error) {
  errs = p.loadZapDevelopment(&config, errs)
  errs = p.loadHTTP2(&config, errs)
  errs = p.loadRemoveLimits(&config, errs)
+ errs = p.loadValidateFeatureEnabled(&config, errs)
  var err error
  if len(errs) > 0 {
  err = errors.Join(errs...)
@@ -160,3 +162,14 @@ func (p *EnvConfigProvider) loadRemoveLimits(config *Config, curErrs []error) (e
  }
  return
 }
+
+func (p *EnvConfigProvider) loadValidateFeatureEnabled(config *Config, curErrs []error) (errs []error) {
+ if v, ok := p.lookupFunc(ValidateFeatureEnabledEnvVar); ok {
+ boolVal, err := strconv.ParseBool(v)
+ config.ValidateFeatureEnabled = boolVal
+ if err != nil {
+ errs = append(curErrs, fmt.Errorf("%s value is not a bool: %s", ValidateFeatureEnabledEnvVar, err))
+ }
+ }
+ return
+}

internal/config/env_provider_test.go

@@ -139,5 +139,13 @@ var _ = Describe("EnvProvider", func() {
  Expect(cfg.RemoveLimits).To(BeFalse())
  })
  })
+ When("validateFeatureEnabled variable is set", func() {
+ BeforeEach(func() {
+ lookupFuncMap[config.ValidateFeatureEnabledEnvVar] = "false"
+ })
+ It("has valid validateFeatureEnabled", func() {
+ Expect(cfg.ValidateFeatureEnabled).To(BeFalse())
+ })
+ })
  })
 })