Skip to content

Commit e286d44

Browse files
eatwithforkseatwithforks
committed
use zap for logging, previous log never outputted to kubectl logs
1 parent fd8858e commit e286d44

File tree

4 files changed

+96
-67
lines changed

4 files changed

+96
-67
lines changed

‎go.mod

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,15 @@ module github.com/open-policy-agent/cert-controller
22

33
go 1.14
44

5-
require (
6-
github.com/onsi/gomega v1.10.1
7-
github.com/pkg/errors v0.9.1
8-
go.uber.org/atomic v1.4.0
9-
go.uber.org/zap v1.10.0
10-
k8s.io/api v0.18.6
11-
k8s.io/apimachinery v0.18.6
12-
k8s.io/client-go v0.18.6
13-
sigs.k8s.io/controller-runtime v0.6.3
14-
)
5+
require (
6+
github.com/go-logr/zapr v0.1.0
7+
github.com/onsi/gomega v1.10.1
8+
github.com/open-policy-agent/cert-controller v0.1.0
9+
github.com/pkg/errors v0.9.1
10+
go.uber.org/atomic v1.4.0
11+
go.uber.org/zap v1.10.0
12+
k8s.io/api v0.18.6
13+
k8s.io/apimachinery v0.18.6
14+
k8s.io/client-go v0.18.6
15+
sigs.k8s.io/controller-runtime v0.6.3
16+
)

‎main.go

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ import (
1212
"k8s.io/client-go/tools/clientcmd/api"
1313
"os"
1414
ctrl "sigs.k8s.io/controller-runtime"
15+
logf "sigs.k8s.io/controller-runtime/pkg/log"
16+
"github.com/go-logr/zapr"
1517
"sigs.k8s.io/controller-runtime/pkg/client/apiutil"
1618
"time"
1719
)
@@ -27,6 +29,21 @@ var (
2729
webhookName = flag.String("webhook-name", "", "Your webhook name")
2830
)
2931

32+
func buildLogger() (*zap.Logger, error) {
33+
// build a logger:
34+
// - without timestamps because docker already logs with timestamps
35+
// - use "message" instead of "msg" for consistency with other services / datadog parsing
36+
// - remove caller since it points to shared methods most of the time anyway
37+
loggerConfig := zap.NewProductionConfig()
38+
loggerConfig.EncoderConfig.TimeKey = ""
39+
loggerConfig.EncoderConfig.MessageKey = "message"
40+
loggerConfig.DisableCaller = true
41+
if os.Getenv("DEBUG") == "1" {
42+
loggerConfig.Level.SetLevel(zap.DebugLevel)
43+
}
44+
return loggerConfig.Build()
45+
}
46+
3047
func main() {
3148
flag.Parse()
3249

@@ -38,7 +55,9 @@ func main() {
3855
}
3956

4057
// configure logging.
41-
logger, _ := zap.NewDevelopment()
58+
logger, _ := buildLogger()
59+
defer logger.Sync() // flush buffer
60+
logf.SetLogger(zapr.NewLogger(logger)) // Set logger for cert-controller or it sends to /dev/null
4261

4362
logger.Info("sleeping to demonstrate restart behavior")
4463
time.Sleep(5 * time.Second)
@@ -63,6 +82,7 @@ func main() {
6382
}
6483

6584
// Make sure certs are generated and valid if cert rotation is enabled.
85+
setupFinished := make(chan struct{})
6686
if err := rotator.AddRotator(mgr, &rotator.CertRotator{
6787
SecretKey: types.NamespacedName{
6888
Namespace: *nameSpace,
@@ -72,10 +92,10 @@ func main() {
7292
CAName: *caName,
7393
CAOrganization: *caOrganization,
7494
DNSName: *dnsName,
95+
IsReady: setupFinished,
7596
Webhooks: webhooks,
7697
}); err != nil {
7798
logger.Error("unable to set up cert rotation", zap.Error(err))
78-
7999
os.Exit(1)
80100
}
81101

‎pkg/rotator/rotator.go

Lines changed: 14 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212
"encoding/pem"
1313
"flag"
1414
"fmt"
15+
"go.uber.org/zap"
1516
"math/big"
1617
"os"
1718
"time"
@@ -29,7 +30,6 @@ import (
2930
"sigs.k8s.io/controller-runtime/pkg/client"
3031
"sigs.k8s.io/controller-runtime/pkg/controller"
3132
"sigs.k8s.io/controller-runtime/pkg/handler"
32-
logf "sigs.k8s.io/controller-runtime/pkg/log"
3333
"sigs.k8s.io/controller-runtime/pkg/manager"
3434
"sigs.k8s.io/controller-runtime/pkg/reconcile"
3535
"sigs.k8s.io/controller-runtime/pkg/source"
@@ -44,7 +44,7 @@ const (
4444
lookaheadInterval = 90 * 24 * time.Hour
4545
)
4646

47-
var crLog = logf.Log.WithName("cert-rotation")
47+
var crLog, _ = zap.NewDevelopment()
4848

4949
//WebhookType it the type of webhook, either validating/mutating webhook or a CRD conversion webhook
5050
type WebhookType int
@@ -182,7 +182,7 @@ func (cr *CertRotator) Start(stop <-chan struct{}) error {
182182
crLog.Info("starting cert rotator controller")
183183
defer crLog.Info("stopping cert rotator controller")
184184
if err := cr.refreshCertIfNeeded(); err != nil {
185-
crLog.Error(err, "could not refresh cert on startup")
185+
crLog.Error("could not refresh cert on startup", zap.Error(err))
186186
return err
187187
}
188188

@@ -197,7 +197,7 @@ tickerLoop:
197197
select {
198198
case <-ticker.C:
199199
if err := cr.refreshCertIfNeeded(); err != nil {
200-
crLog.Error(err, "error rotating certs")
200+
crLog.Error("error rotating certs", zap.Error(err))
201201
}
202202
case <-stop:
203203
break tickerLoop
@@ -222,7 +222,7 @@ func (cr *CertRotator) refreshCertIfNeeded() error {
222222
if secret.Data == nil || !cr.validCACert(secret.Data[caCertName], secret.Data[caKeyName]) {
223223
crLog.Info("refreshing CA and server certs")
224224
if err := cr.refreshCerts(true, secret); err != nil {
225-
crLog.Error(err, "could not refresh CA and server certs")
225+
crLog.Error("could not refresh CA and server certs", zap.Error(err))
226226
return false, nil
227227
}
228228
crLog.Info("server certs refreshed")
@@ -236,7 +236,7 @@ func (cr *CertRotator) refreshCertIfNeeded() error {
236236
if !cr.validServerCert(secret.Data[caCertName], secret.Data[certName], secret.Data[keyName]) {
237237
crLog.Info("refreshing server certs")
238238
if err := cr.refreshCerts(false, secret); err != nil {
239-
crLog.Error(err, "could not refresh server certs")
239+
crLog.Error("could not refresh server certs", zap.Error(err))
240240
return false, nil
241241
}
242242
crLog.Info("server certs refreshed")
@@ -685,38 +685,34 @@ func (r *ReconcileWH) ensureCerts(certPem []byte) error {
685685

686686
for _, webhook := range r.webhooks {
687687
gvk := webhook.gvk()
688-
log := crLog.WithValues("name", webhook.Name, "gvk", gvk)
689688
updatedResource := &unstructured.Unstructured{}
690689
updatedResource.SetGroupVersionKind(gvk)
691690
if err := r.cache.Get(r.ctx, types.NamespacedName{Name: webhook.Name}, updatedResource); err != nil {
692691
if k8sErrors.IsNotFound(err) {
693-
fmt.Println("Webhook not found. Unable to update certificate.", err)
694-
log.Error(err, "Webhook not found. Unable to update certificate.")
692+
crLog.Error("Webhook not found. Unable to update certificate.", zap.Error(err))
695693
continue
696694
}
697695
anyError = err
698-
log.Error(err, "Error getting webhook for certificate update.")
699-
fmt.Println("Error getting webhook for certificate update.", err)
696+
crLog.Error("Error getting webhook for certificate update.", zap.Error(err))
700697

701698
continue
702699
}
703700
if !updatedResource.GetDeletionTimestamp().IsZero() {
704-
fmt.Println("Webhook is being deleted. Unable to update certificate")
705-
log.Info("Webhook is being deleted. Unable to update certificate")
701+
crLog.Info("Webhook is being deleted. Unable to update certificate")
706702
continue
707703
}
708704

709-
log.Info("Ensuring CA cert", "name", webhook.Name, "gvk", gvk)
705+
crLog.Info("Ensuring CA cert")
710706
if err := injectCert(updatedResource, certPem, webhook.Type); err != nil {
711707
fmt.Println("Unable to inject cert to webhook.:", err)
712-
log.Error(err, "Unable to inject cert to webhook.")
708+
crLog.Error("Unable to inject cert to webhook.", zap.Error(err))
713709
anyError = err
714710
continue
715711
}
716712
if err := r.writer.Update(r.ctx, updatedResource); err != nil {
717713
fmt.Println("Error updating webhook with certificate:", err)
718714

719-
log.Error(err, "Error updating webhook with certificate")
715+
crLog.Error("Error updating webhook with certificate", zap.Error(err))
720716
anyError = err
721717
continue
722718
}
@@ -740,7 +736,7 @@ func (cr *CertRotator) ensureCertsMounted() {
740736
Jitter: 1,
741737
Steps: 10,
742738
}, checkFn); err != nil {
743-
crLog.Error(err, "max retries for checking certs existence")
739+
crLog.Error("max retries for checking certs existence", zap.Error(err))
744740
close(cr.certsNotMounted)
745741
return
746742
}
@@ -760,7 +756,7 @@ func (cr *CertRotator) ensureReady() {
760756
Jitter: 1,
761757
Steps: 10,
762758
}, checkFn); err != nil {
763-
crLog.Error(err, "max retries for checking CA injection")
759+
crLog.Error("max retries for checking CA injection", zap.Error(err))
764760
close(cr.caNotInjected)
765761
return
766762
}

‎test.yaml

Lines changed: 48 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -18,29 +18,40 @@ spec:
1818
foo: bar4
1919
spec:
2020
containers:
21-
- name: busybox
22-
image: busybox
23-
command: ["sh", "-c", "watch ls /certs"]
24-
volumeMounts:
25-
- name: certs
26-
mountPath: "/certs"
27-
readOnly: true
28-
- name: cert-controller
29-
args:
30-
- -cert-dir=/certs
31-
- -ca-name=foocaname
32-
- -secret-name=vpa-admission-controller-secret
33-
- -service-name=fooservice
34-
- -ca-organization=fooorg
35-
- -namespace=default
36-
- -dns-name=foo.bar.svc
37-
- -webhook-name=vpa-webhook-config
38-
imagePullPolicy: Never
39-
image: cert-controller
21+
- name: busybox
22+
image: busybox
23+
command: ["sh", "-c", "watch ls /certs"]
24+
volumeMounts:
25+
- name: certs
26+
mountPath: "/certs"
27+
readOnly: true
28+
- name: cert-controller
29+
args:
30+
- -cert-dir=/certs
31+
- -ca-name=foocaname
32+
- -secret-name=vpa-admission-controller-secret
33+
- -service-name=fooservice
34+
- -ca-organization=fooorg
35+
- -namespace=default
36+
- -dns-name=foo.bar.svc
37+
- -webhook-name=vpa-webhook-config
38+
imagePullPolicy: Never
39+
image: cert-controller
40+
resources:
41+
limits:
42+
cpu: 200m
43+
memory: 500Mi
44+
requests:
45+
cpu: 50m
46+
memory: 200Mi
47+
volumeMounts:
48+
- name: certs
49+
mountPath: "/certs"
50+
readOnly: true
4051
volumes:
41-
- name: certs
42-
secret:
43-
secretName: vpa-admission-controller-secret
52+
- name: certs
53+
secret:
54+
secretName: vpa-admission-controller-secret
4455
---
4556
apiVersion: admissionregistration.k8s.io/v1
4657
kind: MutatingWebhookConfiguration
@@ -54,21 +65,21 @@ metadata:
5465
annotations:
5566
samson/server_side_apply: 'true'
5667
webhooks:
57-
- name: vpa.k8s.io
58-
failurePolicy: Ignore
59-
admissionReviewVersions: ["v1beta1"]
60-
rules:
61-
- apiGroups: [""]
62-
apiVersions: ["v1"]
63-
operations: ["CREATE"]
64-
resources: ["pods"]
65-
clientConfig:
66-
caBundle: Cg==
67-
service:
68-
namespace: default
69-
name: vpa-webhook
70-
sideEffects: None
71-
timeoutSeconds: 30
68+
- name: vpa.k8s.io
69+
failurePolicy: Ignore
70+
admissionReviewVersions: ["v1beta1"]
71+
rules:
72+
- apiGroups: [""]
73+
apiVersions: ["v1"]
74+
operations: ["CREATE"]
75+
resources: ["pods"]
76+
clientConfig:
77+
caBundle: Cg==
78+
service:
79+
namespace: default
80+
name: vpa-webhook
81+
sideEffects: None
82+
timeoutSeconds: 30
7283

7384
# We need to create a bogus secret for the updater to fill
7485
---

0 commit comments

Comments
 (0)