Istio注入SideCar原理

apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  name: istio-sidecar-injector
webhooks:
  - name: sidecar-injector.istio.io
    clientConfig:
      service:
        name: istio-sidecar-injector
        namespace: istio-system
        path: "/inject"
      caBundle: ${CA_BUNDLE}
    rules:
      - operations: [ "CREATE" ]
        apiGroups: [""]
        apiVersions: ["v1"]
        resources: ["pods"]
    namespaceSelector:
      matchLabels:
        istio-injection: enabled

// NewWebhook creates a new instance of a mutating webhook for automatic sidecar injection.
func NewWebhook(p WebhookParameters) (*Webhook, error) {
   if p.Mux == nil {
      return nil, errors.New("expected mux to be passed, but was not passed")
   }

   wh := &Webhook{
      watcher: p.Watcher,
      meshConfig: p.Env.Mesh(),
      env: p.Env,
      revision: p.Revision,
   }

   p.Watcher.SetHandler(wh.updateConfig)
   sidecarConfig, valuesConfig, err := p.Watcher.Get()
   if err != nil {
      return nil, err
   }
   if err := wh.updateConfig(sidecarConfig, valuesConfig); err != nil {
      log.Errorf("failed to process webhook config: %v", err)
   }

   p.Mux.HandleFunc("/inject", wh.serveInject)
   p.Mux.HandleFunc("/inject/", wh.serveInject)

   p.Env.Watcher.AddMeshHandler(func() {
      wh.mu.Lock()
      wh.meshConfig = p.Env.Mesh()
      wh.mu.Unlock()
   })

   return wh, nil
}

func (wh *Webhook) serveInject(w http.ResponseWriter, r *http.Request) {
  // ...省略一万字...

  var reviewResponse *kube.AdmissionResponse
  var obj runtime.Object
  var ar *kube.AdmissionReview
  if out, _, err := deserializer.Decode(body, nil, obj); err != nil {
    handleError(fmt.Sprintf("Could not decode body: %v", err))
    reviewResponse = toAdmissionResponse(err)
  } else {
    log.Debugf("AdmissionRequest for path=%s\n", path)
    ar, err = kube.AdmissionReviewKubeToAdapter(out)
    if err != nil {
      handleError(fmt.Sprintf("Could not decode object: %v", err))
      reviewResponse = toAdmissionResponse(err)
    } else {
      reviewResponse = wh.inject(ar, path)
    }
  }

  // ...省略一万字...
}

func (wh *Webhook) inject(ar *v1beta1.AdmissionReview, path string) *v1beta1.AdmissionResponse {
  // ...省略一万字...
  
   wh.mu.RLock()
  if !injectRequired(IgnoredNamespaces.UnsortedList(), wh.Config, &pod.Spec, pod.ObjectMeta) {
    log.Infof("Skipping %s/%s due to policy check", pod.ObjectMeta.Namespace, podName)
    totalSkippedInjections.Increment()
    wh.mu.RUnlock()
    return &kube.AdmissionResponse{
      Allowed: true,
    }
  }

  proxyConfig := mesh.DefaultProxyConfig()
  if wh.env.PushContext != nil && wh.env.PushContext.ProxyConfigs != nil {
    if generatedProxyConfig := wh.env.PushContext.ProxyConfigs.EffectiveProxyConfig(
      &model.NodeMetadata{
        Namespace: pod.Namespace,
        Labels: pod.Labels,
        Annotations: pod.Annotations,
      }, wh.meshConfig); generatedProxyConfig != nil {
      proxyConfig = generatedProxyConfig
    }
  }
  deploy, typeMeta := kube.GetDeployMetaFromPod(&pod)
  params := InjectionParameters{
    pod: &pod,
    deployMeta: deploy,
    typeMeta: typeMeta,
    templates: wh.Config.Templates,
    defaultTemplate: wh.Config.DefaultTemplates,
    aliases: wh.Config.Aliases,
    meshConfig: wh.meshConfig,
    proxyConfig: proxyConfig,
    valuesConfig: wh.valuesConfig,
    revision: wh.revision,
    injectedAnnotations: wh.Config.InjectedAnnotations,
    proxyEnvs: parseInjectEnvs(path),
  }
  wh.mu.RUnlock()

  patchBytes, err := injectPod(params)
  if err != nil {
    handleError(fmt.Sprintf("Pod injection failed: %v", err))
    return toAdmissionResponse(err)
  }
  // ...省略一万字...
}

func injectRequired(ignored []string, config *Config, podSpec *corev1.PodSpec, metadata *metav1.ObjectMeta) bool { 
    // Skip injection when host networking is enabled. The problem is
  // that the iptables changes are assumed to be within the pod when,
  // in fact, they are changing the routing at the host level. This
  // often results in routing failures within a node which can
  // affect the network provider within the cluster causing
  // additional pod failures.
  if podSpec.HostNetwork {
    return false
  }

  // skip special kubernetes system namespaces
  for _, namespace := range ignored {
    if metadata.Namespace == namespace {
      return false
    }
  }

  annos := metadata.GetAnnotations()

  var useDefault bool
  var inject bool

  objectSelector := annos[annotation.SidecarInject.Name]
  if lbl, labelPresent := metadata.GetLabels()[label.SidecarInject.Name]; labelPresent {
    // The label is the new API; if both are present we prefer the label
    objectSelector = lbl
  }
  switch strings.ToLower(objectSelector) {
  // http://yaml.org/type/bool.html
  case "y", "yes", "true", "on":
    inject = true
  case "":
    useDefault = true
  }

  // If an annotation is not explicitly given, check the LabelSelectors, starting with NeverInject
  if useDefault {
    for _, neverSelector := range config.NeverInjectSelector {
      selector, err := metav1.LabelSelectorAsSelector(&neverSelector)
      if err != nil {
        log.Warnf("Invalid selector for NeverInjectSelector: %v (%v)", neverSelector, err)
      } else if !selector.Empty() && selector.Matches(labels.Set(metadata.Labels)) {
        log.Debugf("Explicitly disabling injection for pod %s/%s due to pod labels matching NeverInjectSelector config map entry.",
          metadata.Namespace, potentialPodName(metadata))
        inject = false
        useDefault = false
        break
      }
    }
  }

  // If there's no annotation nor a NeverInjectSelector, check the AlwaysInject one
  if useDefault {
    for _, alwaysSelector := range config.AlwaysInjectSelector {
      selector, err := metav1.LabelSelectorAsSelector(&alwaysSelector)
      if err != nil {
        log.Warnf("Invalid selector for AlwaysInjectSelector: %v (%v)", alwaysSelector, err)
      } else if !selector.Empty() && selector.Matches(labels.Set(metadata.Labels)) {
        log.Debugf("Explicitly enabling injection for pod %s/%s due to pod labels matching AlwaysInjectSelector config map entry.",
          metadata.Namespace, potentialPodName(metadata))
        inject = true
        useDefault = false
        break
      }
    }
  }

  var required bool
  switch config.Policy {
  default: // InjectionPolicyOff
    log.Errorf("Illegal value for autoInject:%s, must be one of [%s,%s]. Auto injection disabled!",
      config.Policy, InjectionPolicyDisabled, InjectionPolicyEnabled)
    required = false
  case InjectionPolicyDisabled:
    if useDefault {
      required = false
    } else {
      required = inject
    }
  case InjectionPolicyEnabled:
    if useDefault {
      required = true
    } else {
      required = inject
    }
  }

  if log.DebugEnabled() {
    // Build a log message for the annotations.
    annotationStr := ""
    for name := range AnnotationValidation {
      value, ok := annos[name]
      if !ok {
        value = "(unset)"
      }
      annotationStr += fmt.Sprintf("%s:%s ", name, value)
    }

    log.Debugf("Sidecar injection policy for %v/%v: namespacePolicy:%v useDefault:%v inject:%v required:%v %s",
      metadata.Namespace,
      potentialPodName(metadata),
      config.Policy,
      useDefault,
      inject,
      required,
      annotationStr)
  }

  return required
}

func injectPod(req InjectionParameters) ([]byte, error) {
   checkPreconditions(req)

   // The patch will be built relative to the initial pod, capture its current state
   originalPodSpec, err := json.Marshal(req.pod)
   if err != nil {
      return nil, err
   }

   // Run the injection template, giving us a partial pod spec
   mergedPod, injectedPodData, err := RunTemplate(req)
   if err != nil {
      return nil, fmt.Errorf("failed to run injection template: %v", err)
   }

   mergedPod, err = reapplyOverwrittenContainers(mergedPod, req.pod, injectedPodData)
   if err != nil {
      return nil, fmt.Errorf("failed to re apply container: %v", err)
   }

   // Apply some additional transformations to the pod
   if err := postProcessPod(mergedPod, *injectedPodData, req); err != nil {
      return nil, fmt.Errorf("failed to process pod: %v", err)
   }

   patch, err := createPatch(mergedPod, originalPodSpec)
   if err != nil {
      return nil, fmt.Errorf("failed to create patch: %v", err)
   }

   log.Debugf("AdmissionResponse: patch=%v\n", string(patch))
   return patch, nil
}

func createPatch(pod *corev1.Pod, original []byte) ([]byte, error) {
  reinjected, err := json.Marshal(pod)
  if err != nil {
    return nil, err
  }
  p, err := jsonpatch.CreatePatch(original, reinjected)
  if err != nil {
    return nil, err
  }
  return json.Marshal(p)
}