Skip to content

Commit 73c5384

Browse files
MaxRinkCopilot
MaxRink
and
Copilot
committed
fix: define scanner scheduling precedence
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 938422b commit 73c5384

7 files changed

Lines changed: 53 additions & 95 deletions

File tree

‎api/v1alpha2/mondooauditconfig_types.go‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -149,16 +149,18 @@ type JobOverrides struct {
149149
Annotations map[string]string `json:"annotations,omitempty"`
150150

151151
// NodeSelector constrains the scan pods to nodes with matching labels. It is ignored for
152-
// node scan pods because those are pinned to a specific node.
152+
// node scan pods because those are pinned to a specific node. A NodeSelector configured
153+
// through the component's PodScheduling field takes precedence.
153154
// +optional
154155
NodeSelector map[string]string `json:"nodeSelector,omitempty"`
155156

156-
// Tolerations are appended to the tolerations of the scan pods.
157+
// Tolerations are merged with PodScheduling tolerations without duplicates.
157158
// +optional
158159
Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
159160
}
160161

161-
// PodScheduling defines pod placement settings for scanner workloads.
162+
// PodScheduling defines pod placement settings for scanner workloads. Its NodeSelector takes
163+
// precedence over JobOverrides.NodeSelector when both are configured.
162164
type PodScheduling struct {
163165
// NodeSelector selects nodes where scanner pods may run.
164166
// +optional

‎charts/mondoo-operator/crds/k8s.mondoo.com_mondooauditconfigs.yaml‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -314,11 +314,12 @@ spec:
314314
type: string
315315
description: |-
316316
NodeSelector constrains the scan pods to nodes with matching labels. It is ignored for
317-
node scan pods because those are pinned to a specific node.
317+
node scan pods because those are pinned to a specific node. A NodeSelector configured
318+
through the component's PodScheduling field takes precedence.
318319
type: object
319320
tolerations:
320-
description: Tolerations are appended to the tolerations of
321-
the scan pods.
321+
description: Tolerations are merged with PodScheduling tolerations
322+
without duplicates.
322323
items:
323324
description: |-
324325
The pod this Toleration is attached to tolerates any taint that matches
@@ -1190,11 +1191,12 @@ spec:
11901191
type: string
11911192
description: |-
11921193
NodeSelector constrains the scan pods to nodes with matching labels. It is ignored for
1193-
node scan pods because those are pinned to a specific node.
1194+
node scan pods because those are pinned to a specific node. A NodeSelector configured
1195+
through the component's PodScheduling field takes precedence.
11941196
type: object
11951197
tolerations:
1196-
description: Tolerations are appended to the tolerations of
1197-
the scan pods.
1198+
description: Tolerations are merged with PodScheduling tolerations
1199+
without duplicates.
11981200
items:
11991201
description: |-
12001202
The pod this Toleration is attached to tolerates any taint that matches
@@ -1523,11 +1525,12 @@ spec:
15231525
type: string
15241526
description: |-
15251527
NodeSelector constrains the scan pods to nodes with matching labels. It is ignored for
1526-
node scan pods because those are pinned to a specific node.
1528+
node scan pods because those are pinned to a specific node. A NodeSelector configured
1529+
through the component's PodScheduling field takes precedence.
15271530
type: object
15281531
tolerations:
1529-
description: Tolerations are appended to the tolerations of
1530-
the scan pods.
1532+
description: Tolerations are merged with PodScheduling tolerations
1533+
without duplicates.
15311534
items:
15321535
description: |-
15331536
The pod this Toleration is attached to tolerates any taint that matches

‎charts/mondoo-operator/files/crds/k8s.mondoo.com_mondooauditconfigs.yaml‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -314,11 +314,12 @@ spec:
314314
type: string
315315
description: |-
316316
NodeSelector constrains the scan pods to nodes with matching labels. It is ignored for
317-
node scan pods because those are pinned to a specific node.
317+
node scan pods because those are pinned to a specific node. A NodeSelector configured
318+
through the component's PodScheduling field takes precedence.
318319
type: object
319320
tolerations:
320-
description: Tolerations are appended to the tolerations of
321-
the scan pods.
321+
description: Tolerations are merged with PodScheduling tolerations
322+
without duplicates.
322323
items:
323324
description: |-
324325
The pod this Toleration is attached to tolerates any taint that matches
@@ -1190,11 +1191,12 @@ spec:
11901191
type: string
11911192
description: |-
11921193
NodeSelector constrains the scan pods to nodes with matching labels. It is ignored for
1193-
node scan pods because those are pinned to a specific node.
1194+
node scan pods because those are pinned to a specific node. A NodeSelector configured
1195+
through the component's PodScheduling field takes precedence.
11941196
type: object
11951197
tolerations:
1196-
description: Tolerations are appended to the tolerations of
1197-
the scan pods.
1198+
description: Tolerations are merged with PodScheduling tolerations
1199+
without duplicates.
11981200
items:
11991201
description: |-
12001202
The pod this Toleration is attached to tolerates any taint that matches
@@ -1523,11 +1525,12 @@ spec:
15231525
type: string
15241526
description: |-
15251527
NodeSelector constrains the scan pods to nodes with matching labels. It is ignored for
1526-
node scan pods because those are pinned to a specific node.
1528+
node scan pods because those are pinned to a specific node. A NodeSelector configured
1529+
through the component's PodScheduling field takes precedence.
15271530
type: object
15281531
tolerations:
1529-
description: Tolerations are appended to the tolerations of
1530-
the scan pods.
1532+
description: Tolerations are merged with PodScheduling tolerations
1533+
without duplicates.
15311534
items:
15321535
description: |-
15331536
The pod this Toleration is attached to tolerates any taint that matches

‎config/crd/bases/k8s.mondoo.com_mondooauditconfigs.yaml‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -314,11 +314,12 @@ spec:
314314
type: string
315315
description: |-
316316
NodeSelector constrains the scan pods to nodes with matching labels. It is ignored for
317-
node scan pods because those are pinned to a specific node.
317+
node scan pods because those are pinned to a specific node. A NodeSelector configured
318+
through the component's PodScheduling field takes precedence.
318319
type: object
319320
tolerations:
320-
description: Tolerations are appended to the tolerations of
321-
the scan pods.
321+
description: Tolerations are merged with PodScheduling tolerations
322+
without duplicates.
322323
items:
323324
description: |-
324325
The pod this Toleration is attached to tolerates any taint that matches
@@ -1190,11 +1191,12 @@ spec:
11901191
type: string
11911192
description: |-
11921193
NodeSelector constrains the scan pods to nodes with matching labels. It is ignored for
1193-
node scan pods because those are pinned to a specific node.
1194+
node scan pods because those are pinned to a specific node. A NodeSelector configured
1195+
through the component's PodScheduling field takes precedence.
11941196
type: object
11951197
tolerations:
1196-
description: Tolerations are appended to the tolerations of
1197-
the scan pods.
1198+
description: Tolerations are merged with PodScheduling tolerations
1199+
without duplicates.
11981200
items:
11991201
description: |-
12001202
The pod this Toleration is attached to tolerates any taint that matches
@@ -1523,11 +1525,12 @@ spec:
15231525
type: string
15241526
description: |-
15251527
NodeSelector constrains the scan pods to nodes with matching labels. It is ignored for
1526-
node scan pods because those are pinned to a specific node.
1528+
node scan pods because those are pinned to a specific node. A NodeSelector configured
1529+
through the component's PodScheduling field takes precedence.
15271530
type: object
15281531
tolerations:
1529-
description: Tolerations are appended to the tolerations of
1530-
the scan pods.
1532+
description: Tolerations are merged with PodScheduling tolerations
1533+
without duplicates.
15311534
items:
15321535
description: |-
15331536
The pod this Toleration is attached to tolerates any taint that matches

‎pkg/utils/k8s/job_overrides.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ func ApplyJobOverrides(cj *batchv1.CronJob, o v1alpha2.JobOverrides) {
111111
// Node scan pods are pinned via nodeName. The kubelet rejects pinned pods whose
112112
// nodeSelector doesn't match the node, so the selector is only applied to pods
113113
// that go through the scheduler.
114-
if len(o.NodeSelector) > 0 && podSpec.NodeName == "" {
114+
if len(o.NodeSelector) > 0 && podSpec.NodeName == "" && len(podSpec.NodeSelector) == 0 {
115115
podSpec.NodeSelector = o.NodeSelector
116116
}
117117

‎pkg/utils/k8s/job_overrides_test.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,17 @@ func TestApplyJobOverrides_NodeSelectorSkippedForPinnedPods(t *testing.T) {
116116
assert.Nil(t, cj.Spec.JobTemplate.Spec.Template.Spec.NodeSelector)
117117
}
118118

119+
func TestApplyJobOverrides_PreservesPodSchedulingNodeSelector(t *testing.T) {
120+
cj := &batchv1.CronJob{}
121+
cj.Spec.JobTemplate.Spec.Template.Spec.NodeSelector = map[string]string{"nodepool": "scanner"}
122+
123+
ApplyJobOverrides(cj, v1alpha2.JobOverrides{
124+
NodeSelector: map[string]string{"nodepool": "job-override"},
125+
})
126+
127+
assert.Equal(t, map[string]string{"nodepool": "scanner"}, cj.Spec.JobTemplate.Spec.Template.Spec.NodeSelector)
128+
}
129+
119130
func TestApplyJobOverrides_Tolerations(t *testing.T) {
120131
existing := corev1.Toleration{Key: "node.kubernetes.io/unreachable", Operator: corev1.TolerationOpExists}
121132
user := corev1.Toleration{Key: "workload-type", Operator: corev1.TolerationOpEqual, Value: "mondoo-scan", Effect: corev1.TaintEffectNoSchedule}

‎pkg/utils/k8s/scheduling.go‎

Lines changed: 0 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -18,67 +18,3 @@ func AddPodSchedulingToSpec(podSpec *corev1.PodSpec, nodeSelector map[string]str
1818
podSpec.Tolerations = MergeTolerations(podSpec.Tolerations, tolerations)
1919
}
2020
}
21-
22-
// MergeTolerations returns base and extra tolerations without duplicating identical tolerations.
23-
// The returned slice is a deep copy: pointer fields such as Toleration.TolerationSeconds are
24-
// cloned so that mutating the result never corrupts the input slices.
25-
func MergeTolerations(base, extra []corev1.Toleration) []corev1.Toleration {
26-
if len(base) == 0 {
27-
return cloneTolerations(extra)
28-
}
29-
if len(extra) == 0 {
30-
return cloneTolerations(base)
31-
}
32-
33-
tolerations := cloneTolerations(base)
34-
seen := make(map[tolerationKey]struct{}, len(base)+len(extra))
35-
for _, toleration := range base {
36-
seen[newTolerationKey(toleration)] = struct{}{}
37-
}
38-
39-
for _, toleration := range extra {
40-
key := newTolerationKey(toleration)
41-
if _, ok := seen[key]; ok {
42-
continue
43-
}
44-
tolerations = append(tolerations, *toleration.DeepCopy())
45-
seen[key] = struct{}{}
46-
}
47-
48-
return tolerations
49-
}
50-
51-
// cloneTolerations returns a deep copy of the given tolerations, including pointer fields.
52-
func cloneTolerations(tolerations []corev1.Toleration) []corev1.Toleration {
53-
if tolerations == nil {
54-
return nil
55-
}
56-
cloned := make([]corev1.Toleration, len(tolerations))
57-
for i := range tolerations {
58-
tolerations[i].DeepCopyInto(&cloned[i])
59-
}
60-
return cloned
61-
}
62-
63-
type tolerationKey struct {
64-
Key string
65-
Operator corev1.TolerationOperator
66-
Value string
67-
Effect corev1.TaintEffect
68-
HasTolerationSeconds bool
69-
TolerationSeconds int64
70-
}
71-
72-
func newTolerationKey(toleration corev1.Toleration) tolerationKey {
73-
key := tolerationKey{
74-
Key: toleration.Key,
75-
Operator: toleration.Operator,
76-
Value: toleration.Value,
77-
Effect: toleration.Effect,
78-
}
79-
if toleration.TolerationSeconds != nil {
80-
key.HasTolerationSeconds = true
81-
key.TolerationSeconds = *toleration.TolerationSeconds
82-
}
83-
return key
84-
}

0 commit comments

Comments
 (0)