Support labelSelectors to filter out services before syncing to the host cluster

chart/values.schema.json

@@ -1114,6 +1114,10 @@
           "type": "boolean",
           "description": "Enabled defines if this option should be enabled."
         },
+        "selector": {
+          "$ref": "#/$defs/SyncSelector",
+          "description": "Selector defines the labelSelector based filtering for syncing the resources to the host cluster."
+        },
         "patches": {
           "items": {
             "$ref": "#/$defs/TranslatePatch"
@@ -2035,6 +2039,24 @@
       "additionalProperties": false,
       "type": "object"
     },
+    "LabelSelectorRequirement": {
+      "properties": {
+        "key": {
+          "type": "string"
+        },
+        "operator": {
+          "type": "string"
+        },
+        "values": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
     "LabelsAndAnnotations": {
       "properties": {
         "annotations": {
@@ -3288,6 +3310,24 @@
       "additionalProperties": false,
       "type": "object"
     },
+    "SyncSelector": {
+      "properties": {
+        "matchLabels": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "type": "object"
+        },
+        "matchExpressions": {
+          "items": {
+            "$ref": "#/$defs/LabelSelectorRequirement"
+          },
+          "type": "array"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
     "SyncToHost": {
       "properties": {
         "pods": {

chart/values.yaml

@@ -6,6 +6,8 @@ sync:
     services:
       # Enabled defines if this option should be enabled.
       enabled: true
+      # Selector defines the labelSelector based filtering for syncing the resources to the host cluster.
+      selector: {}
     # Endpoints defines if endpoints created within the virtual cluster should get synced to the host cluster.
     endpoints:
       # Enabled defines if this option should be enabled.

config/config.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/invopop/jsonschema"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/yaml"
 )
 
@@ -500,10 +501,21 @@ type EnableSwitchWithPatches struct {
 	// Enabled defines if this option should be enabled.
 	Enabled bool `json:"enabled,omitempty"`
 
+	// Selector defines the labelSelector based filtering for syncing the resources to the host cluster.
+	Selector *SyncSelector `json:"selector,omitempty"`
+
 	// Patches patch the resource according to the provided specification.
 	Patches []TranslatePatch `json:"patches,omitempty"`
 }
 
+type SyncSelector struct {
+	// MatchLabels are the labels to select the object from.
+	MatchLabels map[string]string `json:"matchLabels,omitempty"`
+
+	// MatchExpressions is a list of label selector requirements which supports operators such as In, NotIn, Exists and DoesNotExist.
+	MatchExpressions []metav1.LabelSelectorRequirement `json:"matchExpressions,omitempty"`
+}
+
 type SyncFromHost struct {
 	// Nodes defines if nodes should get synced from the host cluster to the virtual cluster, but not back.
 	Nodes SyncNodes `json:"nodes,omitempty"`

config/values.yaml

@@ -5,6 +5,8 @@ sync:
   toHost:
     services:
       enabled: true
+      # selector defines the label and expression based filtering before syncing the services to the host cluster.
+      selector: {}
     endpoints:
       enabled: true
     persistentVolumeClaims:

pkg/controllers/resources/services/syncer.go

@@ -76,8 +76,20 @@ func (s *serviceSyncer) SyncToHost(ctx *synccontext.SyncContext, event *synccont
 		return patcher.DeleteVirtualObject(ctx, event.Virtual, event.HostOld, "host object was deleted")
 	}
 
+	// check whether the service labels match with the label selector provided in the vcluster config.
+	validated, err := ValidateServiceBeforeSync(ctx, event.Virtual.GetLabels())
+	if err != nil {
+		return ctrl.Result{}, fmt.Errorf("failed to validate the service labels: %w", err)
+	}
+	// cancel sync operation if the validation fails i.e. there is a mismatch in the labels.
+	if !validated {
+		ctx.Log.Debugf("The labels of the service %s don't match against the selector provided in the config", event.Virtual.Name)
+		return ctrl.Result{}, nil
+	}
+
 	pObj := s.translate(ctx, event.Virtual)
-	err := pro.ApplyPatchesHostObject(ctx, nil, pObj, event.Virtual, ctx.Config.Sync.ToHost.Services.Patches, false)
+
+	err = pro.ApplyPatchesHostObject(ctx, nil, pObj, event.Virtual, ctx.Config.Sync.ToHost.Services.Patches, false)
 	if err != nil {
 		return ctrl.Result{}, err
 	}

pkg/controllers/resources/services/syncer_test.go

@@ -3,6 +3,7 @@ package services
 import (
 	"testing"
 
+	virutalconfig "github.com/loft-sh/vcluster/config"
 	"github.com/loft-sh/vcluster/pkg/specialservices"
 	"github.com/loft-sh/vcluster/pkg/syncer/synccontext"
 	syncertesting "github.com/loft-sh/vcluster/pkg/syncer/testing"
@@ -52,6 +53,35 @@ func TestSync(t *testing.T) {
 	}
 	createdByServerService := createdService.DeepCopy()
 	createdByServerService.Annotations[ServiceBlockDeletion] = "true"
+
+	createForwardWithSelectorEnabled := &corev1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      vObjectMeta.Name,
+			Namespace: vObjectMeta.Namespace,
+			Labels: map[string]string{
+				"app":            "dev-testing",
+				"export-service": "true",
+			},
+		},
+	}
+	createdForwardWithSelectorEnabled := &corev1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:        pObjectMeta.Name,
+			Namespace:   pObjectMeta.Namespace,
+			Annotations: pObjectMeta.Annotations,
+			Labels: map[string]string{
+				translate.NamespaceLabel: vObjectMeta.Namespace,
+				translate.MarkerLabel:    translate.VClusterName,
+				"app":                    "dev-testing",
+				"export-service":         "true",
+			},
+		},
+	}
+	virtualConfigServiceSelector := metav1.LabelSelectorRequirement{
+		Key:      "export-service",
+		Operator: metav1.LabelSelectorOpNotIn,
+		Values:   []string{"false"},
+	}
 	updateForwardSpec := corev1.ServiceSpec{
 		Ports: []corev1.ServicePort{
 			{
@@ -325,6 +355,46 @@ func TestSync(t *testing.T) {
 				assert.NilError(t, err)
 			},
 		},
+		{
+			Name:                "Create Forward With Selector Enabled",
+			InitialVirtualState: []runtime.Object{createForwardWithSelectorEnabled.DeepCopy()},
+			ExpectedVirtualState: map[schema.GroupVersionKind][]runtime.Object{
+				corev1.SchemeGroupVersion.WithKind("Service"): {createForwardWithSelectorEnabled.DeepCopy()},
+			},
+			ExpectedPhysicalState: map[schema.GroupVersionKind][]runtime.Object{
+				corev1.SchemeGroupVersion.WithKind("Service"): {createdForwardWithSelectorEnabled.DeepCopy()},
+			},
+			Sync: func(ctx *synccontext.RegisterContext) {
+				syncCtx, syncer := syncertesting.FakeStartSyncer(t, ctx, New)
+				syncCtx.Config.Sync.ToHost.Services.Selector = &virutalconfig.SyncSelector{
+					MatchLabels:      map[string]string{"app": "dev-testing"},
+					MatchExpressions: []metav1.LabelSelectorRequirement{virtualConfigServiceSelector},
+				}
+				_, err := syncer.(*serviceSyncer).SyncToHost(syncCtx, synccontext.NewSyncToHostEvent(createForwardWithSelectorEnabled.DeepCopy()))
+				assert.NilError(t, err)
+			},
+		},
+		{
+			Name:                "Create Forward Rejected due to Selector Mismatch",
+			InitialVirtualState: []runtime.Object{createForwardWithSelectorEnabled.DeepCopy()},
+			ExpectedVirtualState: map[schema.GroupVersionKind][]runtime.Object{
+				corev1.SchemeGroupVersion.WithKind("Service"): {createForwardWithSelectorEnabled.DeepCopy()},
+			},
+			// Expect the service to NOT sync to the host cluster.
+			ExpectedPhysicalState: map[schema.GroupVersionKind][]runtime.Object{},
+			Sync: func(ctx *synccontext.RegisterContext) {
+				syncCtx, syncer := syncertesting.FakeStartSyncer(t, ctx, New)
+
+				// modify the selector in virtualConfig to cause mismatch with service labels
+				virtualConfigServiceSelector.Operator = metav1.LabelSelectorOpIn
+				syncCtx.Config.Sync.ToHost.Services.Selector = &virutalconfig.SyncSelector{
+					MatchLabels:      map[string]string{"app": "dev-testing"},
+					MatchExpressions: []metav1.LabelSelectorRequirement{virtualConfigServiceSelector},
+				}
+				_, err := syncer.(*serviceSyncer).SyncToHost(syncCtx, synccontext.NewSyncToHostEvent(createForwardWithSelectorEnabled.DeepCopy()))
+				assert.NilError(t, err)
+			},
+		},
 		{
 			Name:                 "Sync node ports physical -> virtual",
 			InitialVirtualState:  []runtime.Object{vServicePorts1.DeepCopy()},

pkg/controllers/resources/services/validate.go

@@ -0,0 +1,34 @@
+package services
+
+import (
+	"fmt"
+
+	"github.com/loft-sh/vcluster/pkg/syncer/synccontext"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+)
+
+// ValidateServiceBeforeSync checks whether service labels match with the label selector provided in the vcluster config.
+// These matchers provided in the config decide whether the services will be synced to host or not.
+func ValidateServiceBeforeSync(ctx *synccontext.SyncContext, serviceLabels map[string]string) (bool, error) {
+	// fetch the selector provided in the config.
+	configLabelSelector := ctx.Config.Sync.ToHost.Services.Selector
+	var selector labels.Selector
+	var err error
+	if configLabelSelector != nil {
+		// form metav1.LabelSelector object from selector provided in the config.
+		labelSelector := &metav1.LabelSelector{
+			MatchLabels:      configLabelSelector.MatchLabels,
+			MatchExpressions: configLabelSelector.MatchExpressions,
+		}
+		selector, err = metav1.LabelSelectorAsSelector(labelSelector)
+		if err != nil {
+			return false, fmt.Errorf("invalid label selector: %v", err)
+		}
+	}
+
+	if selector != nil && !selector.Matches(labels.Set(serviceLabels)) {
+		return false, nil
+	}
+	return true, nil
+}

pkg/server/filters/service.go

@@ -216,15 +216,25 @@ func createService(ctx *synccontext.SyncContext, req *http.Request, decoder enco
 	}
 	newService.Annotations[services.ServiceBlockDeletion] = "true"
 	newService.Spec.Selector = translate.HostLabelsMap(vService.Spec.Selector, nil, vService.Namespace, false)
-	err = ctx.PhysicalClient.Create(req.Context(), newService)
-	if err != nil {
-		klog.Infof("Error creating service in physical cluster: %v", err)
-		if kerrors.IsAlreadyExists(err) {
-			return nil, kerrors.NewAlreadyExists(corev1.Resource("services"), vService.Name)
-		}
 
+	// create the service on the host cluster if the labels successfully match with the config's label selector
+	validated, err := services.ValidateServiceBeforeSync(ctx, vService.GetLabels())
+	if err != nil {
+		klog.Errorf("Failed to validate the service labels: %v", err)
 		return nil, err
 	}
+	if validated {
+		err = ctx.PhysicalClient.Create(req.Context(), newService)
+		if err != nil {
+			klog.Infof("Error creating service in physical cluster: %v", err)
+			if kerrors.IsAlreadyExists(err) {
+				return nil, kerrors.NewAlreadyExists(corev1.Resource("services"), vService.Name)
+			}
+			return nil, err
+		}
+	} else {
+		klog.Infof("The labels of the service %s don't match against the selector provided in the config", vService.Name)
+	}
 
 	vService.Spec.ClusterIP = newService.Spec.ClusterIP
 	vService.Spec.ClusterIPs = newService.Spec.ClusterIPs