Automated cherry pick of #3691: Reduce permission of antrea-agent service account

build/yamls/antrea-aks.yml

@@ -3429,6 +3429,7 @@ rules:
   - /ovstracing
   - /podinterfaces
   - /featuregates
+  - /serviceexternalip
   verbs:
   - get
 ---
@@ -3477,12 +3478,6 @@ rules:
   - get
   - watch
   - list
-- apiGroups:
-  - ""
-  resources:
-  - services/status
-  verbs:
-  - update
 - apiGroups:
   - discovery.k8s.io
   resources:

build/yamls/antrea-eks.yml

@@ -3429,6 +3429,7 @@ rules:
   - /ovstracing
   - /podinterfaces
   - /featuregates
+  - /serviceexternalip
   verbs:
   - get
 ---
@@ -3477,12 +3478,6 @@ rules:
   - get
   - watch
   - list
-- apiGroups:
-  - ""
-  resources:
-  - services/status
-  verbs:
-  - update
 - apiGroups:
   - discovery.k8s.io
   resources:

build/yamls/antrea-gke.yml

@@ -3429,6 +3429,7 @@ rules:
   - /ovstracing
   - /podinterfaces
   - /featuregates
+  - /serviceexternalip
   verbs:
   - get
 ---
@@ -3477,12 +3478,6 @@ rules:
   - get
   - watch
   - list
-- apiGroups:
-  - ""
-  resources:
-  - services/status
-  verbs:
-  - update
 - apiGroups:
   - discovery.k8s.io
   resources:

build/yamls/antrea-ipsec.yml

@@ -3429,6 +3429,7 @@ rules:
   - /ovstracing
   - /podinterfaces
   - /featuregates
+  - /serviceexternalip
   verbs:
   - get
 ---
@@ -3477,12 +3478,6 @@ rules:
   - get
   - watch
   - list
-- apiGroups:
-  - ""
-  resources:
-  - services/status
-  verbs:
-  - update
 - apiGroups:
   - discovery.k8s.io
   resources:

build/yamls/antrea-kind.yml

@@ -3429,6 +3429,7 @@ rules:
   - /ovstracing
   - /podinterfaces
   - /featuregates
+  - /serviceexternalip
   verbs:
   - get
 ---
@@ -3477,12 +3478,6 @@ rules:
   - get
   - watch
   - list
-- apiGroups:
-  - ""
-  resources:
-  - services/status
-  verbs:
-  - update
 - apiGroups:
   - discovery.k8s.io
   resources:

build/yamls/antrea.yml

@@ -3429,6 +3429,7 @@ rules:
   - /ovstracing
   - /podinterfaces
   - /featuregates
+  - /serviceexternalip
   verbs:
   - get
 ---
@@ -3477,12 +3478,6 @@ rules:
   - get
   - watch
   - list
-- apiGroups:
-  - ""
-  resources:
-  - services/status
-  verbs:
-  - update
 - apiGroups:
   - discovery.k8s.io
   resources:

build/yamls/base/agent-rbac.yml

@@ -47,13 +47,7 @@ rules:
     verbs:
       - get
       - watch
-      - list  
-  - apiGroups:
-      - ""
-    resources:
-      - services/status
-    verbs:
-      - update
+      - list
   - apiGroups:
       - discovery.k8s.io
     resources:

build/yamls/base/antctl.yml

@@ -63,6 +63,7 @@ rules:
       - /ovstracing
       - /podinterfaces
       - /featuregates
+      - /serviceexternalip
     verbs:
       - get
 ---

cmd/antrea-agent/agent.go

@@ -609,6 +609,7 @@ func run(o *Options) error {
 	apiServer, err := apiserver.New(
 		agentQuerier,
 		networkPolicyController,
+		externalIPController,
 		o.config.APIPort,
 		*o.config.EnablePrometheusMetrics,
 		o.config.ClientConnection.Kubeconfig,

pkg/agent/apiserver/apiserver.go

@@ -40,6 +40,7 @@ import (
 	"antrea.io/antrea/pkg/agent/apiserver/handlers/ovsflows"
 	"antrea.io/antrea/pkg/agent/apiserver/handlers/ovstracing"
 	"antrea.io/antrea/pkg/agent/apiserver/handlers/podinterface"
+	"antrea.io/antrea/pkg/agent/apiserver/handlers/serviceexternalip"
 	agentquerier "antrea.io/antrea/pkg/agent/querier"
 	systeminstall "antrea.io/antrea/pkg/apis/system/install"
 	systemv1beta1 "antrea.io/antrea/pkg/apis/system/v1beta1"
@@ -72,7 +73,7 @@ func (s *agentAPIServer) Run(stopCh <-chan struct{}) error {
 	return s.GenericAPIServer.PrepareRun().Run(stopCh)
 }
 
-func installHandlers(aq agentquerier.AgentQuerier, npq querier.AgentNetworkPolicyInfoQuerier, s *genericapiserver.GenericAPIServer) {
+func installHandlers(aq agentquerier.AgentQuerier, npq querier.AgentNetworkPolicyInfoQuerier, seipq querier.ServiceExternalIPStatusQuerier, s *genericapiserver.GenericAPIServer) {
 	s.Handler.NonGoRestfulMux.HandleFunc("/loglevel", loglevel.HandleFunc())
 	s.Handler.NonGoRestfulMux.HandleFunc("/featuregates", featuregates.HandleFunc())
 	s.Handler.NonGoRestfulMux.HandleFunc("/agentinfo", agentinfo.HandleFunc(aq))
@@ -82,6 +83,7 @@ func installHandlers(aq agentquerier.AgentQuerier, npq querier.AgentNetworkPolic
 	s.Handler.NonGoRestfulMux.HandleFunc("/addressgroups", addressgroup.HandleFunc(npq))
 	s.Handler.NonGoRestfulMux.HandleFunc("/ovsflows", ovsflows.HandleFunc(aq))
 	s.Handler.NonGoRestfulMux.HandleFunc("/ovstracing", ovstracing.HandleFunc(aq))
+	s.Handler.NonGoRestfulMux.HandleFunc("/serviceexternalip", serviceexternalip.HandleFunc(seipq))
 }
 
 func installAPIGroup(s *genericapiserver.GenericAPIServer, aq agentquerier.AgentQuerier, npq querier.AgentNetworkPolicyInfoQuerier) error {
@@ -95,7 +97,7 @@ func installAPIGroup(s *genericapiserver.GenericAPIServer, aq agentquerier.Agent
 }
 
 // New creates an APIServer for running in antrea agent.
-func New(aq agentquerier.AgentQuerier, npq querier.AgentNetworkPolicyInfoQuerier, bindPort int,
+func New(aq agentquerier.AgentQuerier, npq querier.AgentNetworkPolicyInfoQuerier, seipq querier.ServiceExternalIPStatusQuerier, bindPort int,
 	enableMetrics bool, kubeconfig string, cipherSuites []uint16, tlsMinVersion uint16) (*agentAPIServer, error) {
 	cfg, err := newConfig(npq, bindPort, enableMetrics, kubeconfig)
 	if err != nil {
@@ -110,7 +112,7 @@ func New(aq agentquerier.AgentQuerier, npq querier.AgentNetworkPolicyInfoQuerier
 	if err := installAPIGroup(s, aq, npq); err != nil {
 		return nil, err
 	}
-	installHandlers(aq, npq, s)
+	installHandlers(aq, npq, seipq, s)
 	return &agentAPIServer{GenericAPIServer: s}, nil
 }
 

pkg/agent/apiserver/handlers/serviceexternalip/handler.go

@@ -0,0 +1,70 @@
+// Copyright 2022 Antrea Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package serviceexternalip
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"antrea.io/antrea/pkg/antctl/transform/common"
+	"antrea.io/antrea/pkg/features"
+	"antrea.io/antrea/pkg/querier"
+)
+
+// HandleFunc creates a http.HandlerFunc which uses an ServiceExternalIPStatusQuerier
+// to query Service external IP status.
+func HandleFunc(sq querier.ServiceExternalIPStatusQuerier) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		name := r.URL.Query().Get("name")
+		ns := r.URL.Query().Get("namespace")
+		if !features.DefaultFeatureGate.Enabled(features.ServiceExternalIP) {
+			http.Error(w, "ServiceExternalIP is not enabled", http.StatusServiceUnavailable)
+			return
+		}
+		result := sq.GetServiceExternalIPStatus()
+		var response []Response
+		for _, r := range result {
+			if (len(name) == 0 || name == r.ServiceName) && (len(ns) == 0 || ns == r.Namespace) {
+				response = append(response, Response{r})
+			}
+		}
+		if len(name) > 0 && len(response) == 0 {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		if err := json.NewEncoder(w).Encode(response); err != nil {
+			http.Error(w, "Failed to encode response: "+err.Error(), http.StatusInternalServerError)
+		}
+	}
+}
+
+// Response describes the response struct of serviceexternalip command.
+type Response struct {
+	querier.ServiceExternalIPInfo
+}
+
+var _ common.TableOutput = (*Response)(nil)
+
+func (r Response) GetTableHeader() []string {
+	return []string{"NAMESPACE", "NAME", "EXTERNAL-IP-POOL", "EXTERNAL-IP", "ASSIGNED-NODE"}
+}
+
+func (r Response) GetTableRow(_ int) []string {
+	return []string{r.Namespace, r.ServiceName, r.ExternalIPPool, r.ExternalIP, r.AssignedNode}
+}
+
+func (r Response) SortRows() bool {
+	return true
+}