-
Notifications
You must be signed in to change notification settings - Fork 13
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add csrsigning controller for worker node certificate refreshes (#548)
* Add controllers/csrsigning controller * add csrsigning controller in k8sd
- Loading branch information
1 parent
3d30ad9
commit 2994b87
Showing
14 changed files
with
580 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| package csrsigning | ||
|
|
||
| import "github.com/canonical/k8s/pkg/k8sd/types" | ||
|
|
||
| type internalConfig struct { | ||
| autoApprove bool | ||
| } | ||
|
|
||
| func internalConfigFromAnnotations(annotations types.Annotations) internalConfig { | ||
| var cfg internalConfig | ||
| if v, ok := annotations.Get("k8sd/v1alpha1/csrsigning/auto-approve"); ok && v == "true" { | ||
| cfg.autoApprove = true | ||
| } | ||
| return cfg | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| package csrsigning | ||
|
|
||
| import "time" | ||
|
|
||
| const ( | ||
| // requeueAfterSigningFailure is the time to requeue requests when any step of the signing process failed | ||
| requeueAfterSigningFailure = 3 * time.Second | ||
|
|
||
| // requeueAfterWaitingForApproved is the amount of time to requeue requests if waiting for CSR to be approved | ||
| requeueAfterWaitingForApproved = 10 * time.Second | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,105 @@ | ||
| package csrsigning | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| "time" | ||
|
|
||
| "github.com/canonical/k8s/pkg/k8sd/types" | ||
| "github.com/canonical/k8s/pkg/log" | ||
| "github.com/canonical/k8s/pkg/snap" | ||
| "github.com/canonical/k8s/pkg/utils" | ||
| "k8s.io/client-go/rest" | ||
|
|
||
| "sigs.k8s.io/controller-runtime/pkg/cache" | ||
| ctrllog "sigs.k8s.io/controller-runtime/pkg/log" | ||
| "sigs.k8s.io/controller-runtime/pkg/manager" | ||
| "sigs.k8s.io/controller-runtime/pkg/metrics/server" | ||
| ) | ||
|
|
||
| type Controller struct { | ||
| snap snap.Snap | ||
| waitReady func() | ||
|
|
||
| leaderElection bool | ||
| } | ||
|
|
||
| type Options struct { | ||
| Snap snap.Snap | ||
| WaitReady func() | ||
|
|
||
| LeaderElection bool | ||
| } | ||
|
|
||
| func New(opts Options) *Controller { | ||
| return &Controller{ | ||
| snap: opts.Snap, | ||
| waitReady: opts.WaitReady, | ||
|
|
||
| leaderElection: opts.LeaderElection, | ||
| } | ||
| } | ||
|
|
||
| func (c *Controller) getRESTConfig(ctx context.Context) (*rest.Config, error) { | ||
| for { | ||
| client, err := c.snap.KubernetesClient("") | ||
| if err == nil { | ||
| return client.RESTConfig(), nil | ||
| } | ||
|
|
||
| select { | ||
| case <-ctx.Done(): | ||
| return nil, ctx.Err() | ||
| case <-time.After(3 * time.Second): | ||
| } | ||
| } | ||
| } | ||
|
|
||
| func (c *Controller) Run(ctx context.Context, getClusterConfig func(context.Context) (types.ClusterConfig, error)) error { | ||
| ctx = log.NewContext(ctx, log.FromContext(ctx).WithName("csrsigning")) | ||
|
|
||
| // TODO(neoaggelos): This should be moved to init() or some other initialization step | ||
| ctrllog.SetLogger(log.FromContext(ctx)) | ||
|
|
||
| c.waitReady() | ||
|
|
||
| config, err := c.getRESTConfig(ctx) | ||
| if err != nil { | ||
| return fmt.Errorf("failed to get Kubernetes REST config: %w", err) | ||
| } | ||
|
|
||
| // TODO(neoaggelos): In case of more controllers, a single manager object should be created | ||
| // and passed here as configuration. | ||
| mgr, err := manager.New(config, manager.Options{ | ||
| Logger: log.FromContext(ctx), | ||
| LeaderElection: c.leaderElection, | ||
| LeaderElectionID: "a27980c4.k8sd-csrsigning-controller", | ||
| LeaderElectionNamespace: "kube-system", | ||
| BaseContext: func() context.Context { return ctx }, | ||
| Cache: cache.Options{ | ||
| SyncPeriod: utils.Pointer(10 * time.Minute), | ||
| }, | ||
| Metrics: server.Options{ | ||
| BindAddress: "0", | ||
| }, | ||
| }) | ||
| if err != nil { | ||
| return fmt.Errorf("failed to create controller manager: %w", err) | ||
| } | ||
|
|
||
| if err := (&csrSigningReconciler{ | ||
| Manager: mgr, | ||
| Logger: mgr.GetLogger(), | ||
| Client: mgr.GetClient(), | ||
|
|
||
| getClusterConfig: getClusterConfig, | ||
| }).SetupWithManager(mgr); err != nil { | ||
| return fmt.Errorf("failed to setup csrsigning controller: %w", err) | ||
| } | ||
|
|
||
| if err := mgr.Start(ctx); err != nil { | ||
| return fmt.Errorf("controller manager failed: %w", err) | ||
| } | ||
|
|
||
| return nil | ||
| } |
Oops, something went wrong.