Support localhost connection to k8s api server

cmd/main.go

@@ -304,9 +304,7 @@ func electMaster(mgr manager.Manager, nsxClient *nsx.Client) {
 
 func main() {
 	log.Info("Starting NSX Operator")
-	cfg := ctrl.GetConfigOrDie()
-	cfg.Timeout = pkgutil.TCPReadTimeout
-	mgr, err := ctrl.NewManager(cfg, ctrl.Options{
+	mgr, err := ctrl.NewManager(pkgutil.GetConfig(), ctrl.Options{
 		Scheme:                  scheme,
 		HealthProbeBindAddress:  config.ProbeAddr,
 		Metrics:                 metricsserver.Options{BindAddress: config.MetricsAddr},

pkg/util/cert.go

@@ -21,7 +21,6 @@ import (
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/util/retry"
-	ctrl "sigs.k8s.io/controller-runtime"
 
 	"github.com/vmware-tanzu/nsx-operator/pkg/config"
 )
@@ -146,9 +145,7 @@ func GenerateWebhookCerts() error {
 		Bytes: x509.MarshalPKCS1PrivateKey(serverKey),
 	})
 
-	cfg := ctrl.GetConfigOrDie()
-	cfg.Timeout = TCPReadTimeout
-	kubeClient := kubernetes.NewForConfigOrDie(cfg)
+	kubeClient := kubernetes.NewForConfigOrDie(GetConfig())
 	certSecret := &corev1.Secret{
 		TypeMeta: v1.TypeMeta{},
 		ObjectMeta: v1.ObjectMeta{

pkg/util/kubernetes.go

@@ -0,0 +1,55 @@
+package util
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"k8s.io/client-go/rest"
+	ctrl "sigs.k8s.io/controller-runtime"
+)
+
+const (
+	localhostIP   = "127.0.0.1"
+	localhostIPv6 = "::1"
+	localhostPort = "6443"
+)
+
+func GetConfig() *rest.Config {
+	cfg := ctrl.GetConfigOrDie()
+	cfg.Timeout = TCPReadTimeout
+	if !getHealth(cfg) {
+		hosts := strings.Split(cfg.Host, ":")
+		// cfg.Host is in the form of https://host:port
+		if len(hosts) > 3 {
+			cfg.Host = fmt.Sprintf("https://[%s]:%s", localhostIPv6, localhostPort)
+		} else {
+			cfg.Host = fmt.Sprintf("https://%s:%s", localhostIP, localhostPort)
+		}
+		log.Info("Failed to connect to configured kubernetes API server, set to loopback address", "host", cfg.Host)
+	}
+	return cfg
+}
+
+func getHealth(cfg *rest.Config) bool {
+	client, err := rest.HTTPClientFor(cfg)
+	if err != nil {
+		log.Error(err, "Failed to create client for config", "config", cfg)
+		return false
+	}
+
+	healthUrl := cfg.Host + "/healthz"
+	resp, err := client.Get(healthUrl)
+	if err != nil {
+		log.Error(err, "Failed to connect to Kubernetes API Server", "url", healthUrl)
+		return false
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		log.Error(nil, "Kubernetes healthz check failed", "status", resp.Status)
+		return false
+	}
+	log.Debug("Connection is health", "url", healthUrl)
+	return true
+}

pkg/util/kubernetes_test.go

@@ -0,0 +1,78 @@
+package util
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"net/http"
+	"testing"
+
+	"github.com/agiledragon/gomonkey/v2"
+	"github.com/stretchr/testify/assert"
+	"k8s.io/client-go/rest"
+	ctrl "sigs.k8s.io/controller-runtime"
+)
+
+func TestGetConfig(t *testing.T) {
+	patches := gomonkey.ApplyFunc(ctrl.GetConfigOrDie, func() *rest.Config {
+		return &rest.Config{
+			Host: "https://10.0.0.1:443",
+		}
+	})
+	defer patches.Reset()
+
+	tests := []struct {
+		name         string
+		preparedFunc func() *gomonkey.Patches
+		expectedHost string
+	}{
+		{
+			name: "healthyTraffic",
+			preparedFunc: func() *gomonkey.Patches {
+				return gomonkey.ApplyFunc((*http.Client).Get, func(c *http.Client, url string) (resp *http.Response, err error) {
+					return &http.Response{
+						StatusCode: http.StatusOK,
+						Body:       io.NopCloser(bytes.NewBufferString(`{"ok": true}`)),
+					}, nil
+				})
+			},
+			expectedHost: "https://10.0.0.1:443",
+		},
+		{
+			name: "unhealthyTrafficAndIPv4",
+			preparedFunc: func() *gomonkey.Patches {
+				return gomonkey.ApplyFunc((*http.Client).Get, func(c *http.Client, url string) (resp *http.Response, err error) {
+					return &http.Response{
+						StatusCode: http.StatusNotFound,
+						Body:       io.NopCloser(bytes.NewBufferString(`{"ok": false}`)),
+					}, nil
+				})
+			},
+			expectedHost: "https://127.0.0.1:6443",
+		},
+		{
+			name: "errorTrafficAndIPv6",
+			preparedFunc: func() *gomonkey.Patches {
+				patches := gomonkey.ApplyFunc(ctrl.GetConfigOrDie, func() *rest.Config {
+					return &rest.Config{
+						Host: "https://aa:bb:cc:dd:ee:ff:443",
+					}
+				})
+				patches.ApplyFunc((*http.Client).Get, func(c *http.Client, url string) (resp *http.Response, err error) {
+					return nil, errors.New("mock get failure")
+				})
+				return patches
+			},
+			expectedHost: "https://[::1]:6443",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			patches := tt.preparedFunc()
+			defer patches.Reset()
+			cfg := GetConfig()
+			assert.Equal(t, tt.expectedHost, cfg.Host)
+		})
+	}
+}