-
Notifications
You must be signed in to change notification settings - Fork 23
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Include managed serviceaccount (#133)
* Start managed serviceaccount embedded Signed-off-by: clyang82 <chuyang@redhat.com> * Add e2e tests Signed-off-by: clyang82 <chuyang@redhat.com> * fix make check Signed-off-by: clyang82 <chuyang@redhat.com> --------- Signed-off-by: clyang82 <chuyang@redhat.com>
- Loading branch information
Showing
18 changed files
with
530 additions
and
28 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| // Copyright Contributors to the Open Cluster Management project | ||
|
|
||
| package addons | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
|
|
||
| corev1 "k8s.io/api/core/v1" | ||
| "k8s.io/apimachinery/pkg/labels" | ||
| "k8s.io/client-go/kubernetes" | ||
| "k8s.io/client-go/rest" | ||
|
|
||
| "sigs.k8s.io/controller-runtime/pkg/cache" | ||
| "sigs.k8s.io/controller-runtime/pkg/client" | ||
| "sigs.k8s.io/controller-runtime/pkg/manager" | ||
|
|
||
| "open-cluster-management.io/managed-serviceaccount/pkg/addon/agent/controller" | ||
| "open-cluster-management.io/managed-serviceaccount/pkg/common" | ||
| "open-cluster-management.io/multicluster-controlplane/pkg/util" | ||
| ) | ||
|
|
||
| func StartManagedServiceAccountAgent(ctx context.Context, hubMgr manager.Manager, clusterName string) error { | ||
| spokeNamespace := util.GetComponentNamespace() | ||
|
|
||
| hubNativeClient, err := kubernetes.NewForConfig(hubMgr.GetConfig()) | ||
| if err != nil { | ||
| return fmt.Errorf("unable to instantiate a kubernetes native client") | ||
| } | ||
|
|
||
| spokeCfg, err := rest.InClusterConfig() | ||
| if err != nil { | ||
| return fmt.Errorf("failed build a in-cluster spoke cluster client config") | ||
| } | ||
|
|
||
| spokeNativeClient, err := kubernetes.NewForConfig(spokeCfg) | ||
| if err != nil { | ||
| return fmt.Errorf("unable to build a spoke kubernetes client") | ||
| } | ||
|
|
||
| resources, err := spokeNativeClient.Discovery().ServerResourcesForGroupVersion("v1") | ||
| if err != nil { | ||
| return fmt.Errorf("failed api discovery in the spoke cluster: %v", err) | ||
| } | ||
| found := false | ||
| for _, r := range resources.APIResources { | ||
| if r.Kind == "TokenRequest" { | ||
| found = true | ||
| } | ||
| } | ||
| if !found { | ||
| return fmt.Errorf(`no "serviceaccounts/token" resource discovered in the managed cluster,` + | ||
| `is --service-account-signing-key-file configured for the kube-apiserver?`) | ||
| } | ||
|
|
||
| spokeCache, err := cache.New(spokeCfg, cache.Options{ | ||
| ByObject: map[client.Object]cache.ByObject{ | ||
| &corev1.ServiceAccount{}: { | ||
| Namespaces: map[string]cache.Config{ | ||
| spokeNamespace: { | ||
| LabelSelector: labels.SelectorFromSet( | ||
| labels.Set{ | ||
| common.LabelKeyIsManagedServiceAccount: "true", | ||
| }, | ||
| ), | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }) | ||
| if err != nil { | ||
| return fmt.Errorf("unable to instantiate a spoke serviceaccount cache") | ||
| } | ||
| if err = hubMgr.Add(spokeCache); err != nil { | ||
| return fmt.Errorf("unable to add spoke cache to manager") | ||
| } | ||
|
|
||
| ctrl := controller.TokenReconciler{ | ||
| ClusterName: clusterName, | ||
| Cache: hubMgr.GetCache(), | ||
| HubClient: hubMgr.GetClient(), | ||
| HubNativeClient: hubNativeClient, | ||
| SpokeNamespace: spokeNamespace, | ||
| SpokeNativeClient: spokeNativeClient, | ||
| SpokeClientConfig: spokeCfg, | ||
| SpokeCache: spokeCache, | ||
| } | ||
|
|
||
| return ctrl.SetupWithManager(hubMgr) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| // Copyright Contributors to the Open Cluster Management project | ||
|
|
||
| package addons | ||
|
|
||
| import ( | ||
| "context" | ||
|
|
||
| "open-cluster-management.io/managed-serviceaccount/pkg/addon/commoncontroller" | ||
|
|
||
| ctrl "sigs.k8s.io/controller-runtime" | ||
| ) | ||
|
|
||
| func SetupManagedServiceAccountWithManager(ctx context.Context, mgr ctrl.Manager) error { | ||
| ctrl := commoncontroller.NewEphemeralIdentityReconciler(mgr.GetCache(), mgr.GetClient()) | ||
| if err := ctrl.SetupWithManager(mgr); err != nil { | ||
| return err | ||
| } | ||
| return nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.