init exclude repo feature (#387)

Co-authored-by: Иван Старцев <ivan.startsev@mediascope.net>

Author: IvanTvardovsky

config.go

@@ -16,4 +16,5 @@ type flags struct {
 	ReplicateRoleBindings    bool
 	ReplicateServiceAccounts bool
 	SyncByContent            bool
+	ExcludeNamespaces        string
 }

main.go

@@ -37,6 +37,7 @@ func init() {
 	flag.BoolVar(&f.ReplicateRoleBindings, "replicate-role-bindings", true, "Enable replication of role bindings")
 	flag.BoolVar(&f.ReplicateServiceAccounts, "replicate-service-accounts", true, "Enable replication of service accounts")
 	flag.BoolVar(&f.SyncByContent, "sync-by-content", false, "Always compare the contents of source and target resources and force them to be the same")
+	flag.StringVar(&f.ExcludeNamespaces, "exclude-namespaces", "", "Comma-separated list of regex patterns for namespaces to exclude from replication")
 	flag.Parse()
 
 	switch strings.ToUpper(strings.TrimSpace(f.LogLevel)) {
@@ -88,14 +89,17 @@ func main() {
 
 	client = kubernetes.NewForConfigOrDie(config)
 
+	excludePatterns := strings.Split(f.ExcludeNamespaces, ",")
+	filter := common.NewNamespaceFilter(excludePatterns)
+
 	if f.ReplicateSecrets {
-		secretRepl := secret.NewReplicator(client, f.ResyncPeriod, f.AllowAll, f.SyncByContent)
+		secretRepl := secret.NewReplicator(client, f.ResyncPeriod, f.AllowAll, f.SyncByContent, filter)
 		go secretRepl.Run()
 		enabledReplicators = append(enabledReplicators, secretRepl)
 	}
 
 	if f.ReplicateConfigMaps {
-		configMapRepl := configmap.NewReplicator(client, f.ResyncPeriod, f.AllowAll, f.SyncByContent)
+		configMapRepl := configmap.NewReplicator(client, f.ResyncPeriod, f.AllowAll, f.SyncByContent, filter)
 		go configMapRepl.Run()
 		enabledReplicators = append(enabledReplicators, configMapRepl)
 	}

replicate/common/exclude.go

@@ -0,0 +1,36 @@
+package common
+
+import (
+	"regexp"
+)
+
+type NamespaceFilter struct {
+	ExcludePatterns []string
+	compiled        []*regexp.Regexp
+}
+
+func NewNamespaceFilter(patterns []string) *NamespaceFilter {
+	var compiled []*regexp.Regexp
+	for _, pat := range patterns {
+		if pat == "" {
+			continue
+		}
+		re, err := regexp.Compile(pat)
+		if err == nil {
+			compiled = append(compiled, re)
+		}
+	}
+	return &NamespaceFilter{
+		ExcludePatterns: patterns,
+		compiled:        compiled,
+	}
+}
+
+func (f *NamespaceFilter) ShouldExclude(namespace string) bool {
+	for _, re := range f.compiled {
+		if re.MatchString(namespace) {
+			return true
+		}
+	}
+	return false
+}

replicate/common/generic-replicator.go

@@ -23,14 +23,15 @@ import (
 )
 
 type ReplicatorConfig struct {
-	Kind          string
-	Client        kubernetes.Interface
-	ResyncPeriod  time.Duration
-	AllowAll      bool
-	SyncByContent bool
-	ListFunc      cache.ListFunc
-	WatchFunc     cache.WatchFunc
-	ObjType       runtime.Object
+	Kind            string
+	Client          kubernetes.Interface
+	ResyncPeriod    time.Duration
+	AllowAll        bool
+	SyncByContent   bool
+	ListFunc        cache.ListFunc
+	WatchFunc       cache.WatchFunc
+	ObjType         runtime.Object
+	NamespaceFilter *NamespaceFilter
 }
 
 type UpdateFuncs struct {
@@ -88,6 +89,8 @@ func NewGenericReplicator(config ReplicatorConfig) *GenericReplicator {
 	repl.Store = store
 	repl.Controller = controller
 
+	repl.NamespaceFilter = config.NamespaceFilter
+
 	return &repl
 }
 
@@ -427,6 +430,14 @@ func (r *GenericReplicator) replicateResourceToNamespaces(obj interface{}, targe
 	cacheKey := MustGetKey(obj)
 
 	for _, namespace := range targets {
+		if r.NamespaceFilter != nil && r.NamespaceFilter.ShouldExclude(namespace.Name) {
+			log.WithFields(log.Fields{
+				"kind":      r.Kind,
+				"namespace": namespace.Name,
+			}).Info("Skipping excluded namespace")
+			continue
+		}
+
 		if innerErr := r.UpdateFuncs.ReplicateObjectTo(obj, &namespace); innerErr != nil {
 			err = multierror.Append(err, errors.Wrapf(innerErr, "Failed to replicate %s %s -> %s: %v",
 				r.Kind, cacheKey, namespace.Name, innerErr,

replicate/configmap/configmaps.go

@@ -26,7 +26,7 @@ type Replicator struct {
 }
 
 // NewReplicator creates a new config map replicator
-func NewReplicator(client kubernetes.Interface, resyncPeriod time.Duration, allowAll, syncByContent bool) common.Replicator {
+func NewReplicator(client kubernetes.Interface, resyncPeriod time.Duration, allowAll, syncByContent bool, namespaceFilter *common.NamespaceFilter) common.Replicator {
 	repl := Replicator{
 		GenericReplicator: common.NewGenericReplicator(common.ReplicatorConfig{
 			Kind:          "ConfigMap",
@@ -41,6 +41,7 @@ func NewReplicator(client kubernetes.Interface, resyncPeriod time.Duration, allo
 			WatchFunc: func(lo metav1.ListOptions) (watch.Interface, error) {
 				return client.CoreV1().ConfigMaps("").Watch(context.TODO(), lo)
 			},
+			NamespaceFilter: namespaceFilter,
 		}),
 	}
 	repl.UpdateFuncs = common.UpdateFuncs{

replicate/secret/secrets.go

@@ -26,7 +26,7 @@ type Replicator struct {
 }
 
 // NewReplicator creates a new secret replicator
-func NewReplicator(client kubernetes.Interface, resyncPeriod time.Duration, allowAll, syncByContent bool) common.Replicator {
+func NewReplicator(client kubernetes.Interface, resyncPeriod time.Duration, allowAll, syncByContent bool, namespaceFilter *common.NamespaceFilter) common.Replicator {
 	repl := Replicator{
 		GenericReplicator: common.NewGenericReplicator(common.ReplicatorConfig{
 			Kind:          "Secret",
@@ -41,6 +41,7 @@ func NewReplicator(client kubernetes.Interface, resyncPeriod time.Duration, allo
 			WatchFunc: func(lo metav1.ListOptions) (watch.Interface, error) {
 				return client.CoreV1().Secrets("").Watch(context.TODO(), lo)
 			},
+			NamespaceFilter: namespaceFilter,
 		}),
 	}
 	repl.UpdateFuncs = common.UpdateFuncs{

replicate/secret/secrets_test.go

@@ -82,8 +82,9 @@ func TestSecretReplicator(t *testing.T) {
 	log.SetFormatter(&PlainFormatter{})
 
 	client := setupRealClientSet(t)
+	filter := common.NewNamespaceFilter([]string{})
 
-	repl := NewReplicator(client, 60*time.Second, false, false)
+	repl := NewReplicator(client, 60*time.Second, false, false, filter)
 	go repl.Run()
 
 	time.Sleep(200 * time.Millisecond)
@@ -1293,7 +1294,9 @@ func TestSecretReplicatorSyncByContent(t *testing.T) {
 	client := setupRealClientSet(t)
 	ctx := context.TODO()
 
-	repl := NewReplicator(client, 60*time.Second, false, true)
+	filter := common.NewNamespaceFilter([]string{})
+
+	repl := NewReplicator(client, 60*time.Second, false, true, filter)
 	go repl.Run()
 
 	time.Sleep(200 * time.Millisecond)