Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Changing secret propagation from manifests to policy #1471

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Changing secret propagation from manifests to policy #1471

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
074db0e
Change local secret implementation to k8s secret
abhijeet219 Jun 12, 2024
9743460
Remove clusterRoles and Rolebindings from drcluster MW
abhijeet219 Jun 19, 2024
e84937a
Updating unit-tests to accomodate drcluster MW changes
abhijeet219 Jun 27, 2024
574441d
Deploying clusterRoles and Rolebindings through drpolicy
abhijeet219 Jul 29, 2024
b4b478f
Updating unit tests for drpolicy changes
abhijeet219 Oct 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions internal/controller/controllers_utils_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -265,9 +265,9 @@ func drclusterConditionExpect(
}

func validateClusterManifest(apiReader client.Reader, drcluster *ramen.DRCluster, disabled bool) {
expectedCount := 12
expectedCount := 8
if disabled {
expectedCount = 6
expectedCount = 0
}

clusterName := drcluster.Name
Expand Down
16 changes: 9 additions & 7 deletions internal/controller/drclusters.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,10 +130,19 @@ func objectsToDeploy(hubOperatorRamenConfig *rmn.RamenConfig) ([]interface{}, er
olmClusterRole,
olmRoleBinding(drClusterOperatorNamespaceName),
operatorGroup(drClusterOperatorNamespaceName),
drClusterConfigRole,
drClusterConfigRoleBinding,
drClusterOperatorConfigMap,
), nil
}

func operatorGroup(namespaceName string) *operatorsv1.OperatorGroup {
return &operatorsv1.OperatorGroup{
TypeMeta: metav1.TypeMeta{Kind: "OperatorGroup", APIVersion: "operators.coreos.com/v1"},
ObjectMeta: metav1.ObjectMeta{Name: "ramen-operator-group", Namespace: namespaceName},
}
}

func olmRoleBinding(namespaceName string) *rbacv1.RoleBinding {
return &rbacv1.RoleBinding{
TypeMeta: metav1.TypeMeta{Kind: "RoleBinding", APIVersion: "rbac.authorization.k8s.io/v1"},
Expand All @@ -156,13 +165,6 @@ func olmRoleBinding(namespaceName string) *rbacv1.RoleBinding {
}
}

func operatorGroup(namespaceName string) *operatorsv1.OperatorGroup {
return &operatorsv1.OperatorGroup{
TypeMeta: metav1.TypeMeta{Kind: "OperatorGroup", APIVersion: "operators.coreos.com/v1"},
ObjectMeta: metav1.ObjectMeta{Name: "ramen-operator-group", Namespace: namespaceName},
}
}

func subscription(
namespaceName string,
channelName string,
Expand Down
2 changes: 1 addition & 1 deletion internal/controller/drplacementcontrol_controller_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1226,7 +1226,7 @@ func verifyVRGManifestWorkCreatedAsPrimary(namespace, managedCluster string) {
return err == nil
}, timeout, interval).Should(BeTrue())

Expect(len(createdVRGRolesManifest.Spec.Workload.Manifests)).To(Equal(12))
Expect(len(createdVRGRolesManifest.Spec.Workload.Manifests)).To(Equal(8))

vrgClusterRoleManifest := createdVRGRolesManifest.Spec.Workload.Manifests[0]
Expect(vrgClusterRoleManifest).ToNot(BeNil())
Expand Down
120 changes: 120 additions & 0 deletions internal/controller/drpolicy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,11 @@ import (
"github.com/go-logr/logr"
rmn "github.com/ramendr/ramen/api/v1alpha1"
"github.com/ramendr/ramen/internal/controller/util"
rbacv1 "k8s.io/api/rbac/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
runtime "k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/util/sets"
cpcv1 "open-cluster-management.io/config-policy-controller/api/v1"
)

var drClustersMutex sync.Mutex
Expand Down Expand Up @@ -59,12 +63,15 @@ func drClusterSecretsDeploy(
log.Info("Received partial list", "err", err)
}

objectsToAppend := drClusterPolicyObjectsToDeploy()

for _, secretName := range drPolicySecrets.List() {
if err := secretsUtil.AddSecretToCluster(
secretName,
clusterName,
RamenOperatorNamespace(),
drClusterOperatorNamespaceNameOrDefault(rmnCfg),
objectsToAppend,
util.SecretFormatRamen,
"",
); err != nil {
Expand All @@ -77,6 +84,7 @@ func drClusterSecretsDeploy(
clusterName,
RamenOperatorNamespace(),
drClusterOperatorNamespaceNameOrDefault(rmnCfg),
objectsToAppend,
util.SecretFormatVelero,
rmnCfg.KubeObjectProtection.VeleroNamespaceName,
); err != nil {
Expand All @@ -89,6 +97,29 @@ func drClusterSecretsDeploy(
return nil
}

func drClusterPolicyObjectsToDeploy() []*cpcv1.ObjectTemplate {
objects := []*cpcv1.ObjectTemplate{
{
ComplianceType: cpcv1.MustHave,
ObjectDefinition: runtime.RawExtension{Object: vrgClusterRole},
},
{
ComplianceType: cpcv1.MustHave,
ObjectDefinition: runtime.RawExtension{Object: vrgClusterRoleBinding},
},
{
ComplianceType: cpcv1.MustHave,
ObjectDefinition: runtime.RawExtension{Object: mModeClusterRole},
},
{
ComplianceType: cpcv1.MustHave,
ObjectDefinition: runtime.RawExtension{Object: mModeClusterRoleBinding},
},
}

return objects
}

func drPolicyUndeploy(
drpolicy *rmn.DRPolicy,
drclusters *rmn.DRClusterList,
Expand Down Expand Up @@ -267,3 +298,92 @@ func deleteSecretFromCluster(

return nil
}

var (
vrgClusterRole = &rbacv1.ClusterRole{
TypeMeta: metav1.TypeMeta{Kind: "ClusterRole", APIVersion: "rbac.authorization.k8s.io/v1"},
ObjectMeta: metav1.ObjectMeta{Name: "open-cluster-management:klusterlet-work-sa:agent:volrepgroup-edit"},
Rules: []rbacv1.PolicyRule{
{
APIGroups: []string{"ramendr.openshift.io"},
Resources: []string{"volumereplicationgroups"},
Verbs: []string{"create", "get", "list", "update", "delete"},
},
},
}

vrgClusterRoleBinding = &rbacv1.ClusterRoleBinding{
TypeMeta: metav1.TypeMeta{Kind: "ClusterRoleBinding", APIVersion: "rbac.authorization.k8s.io/v1"},
ObjectMeta: metav1.ObjectMeta{Name: "open-cluster-management:klusterlet-work-sa:agent:volrepgroup-edit"},
Subjects: []rbacv1.Subject{
{
Kind: "ServiceAccount",
Name: "klusterlet-work-sa",
Namespace: "open-cluster-management-agent",
},
},
RoleRef: rbacv1.RoleRef{
APIGroup: "rbac.authorization.k8s.io",
Kind: "ClusterRole",
Name: "open-cluster-management:klusterlet-work-sa:agent:volrepgroup-edit",
},
}

mModeClusterRole = &rbacv1.ClusterRole{
TypeMeta: metav1.TypeMeta{Kind: "ClusterRole", APIVersion: "rbac.authorization.k8s.io/v1"},
ObjectMeta: metav1.ObjectMeta{Name: "open-cluster-management:klusterlet-work-sa:agent:mmode-edit"},
Rules: []rbacv1.PolicyRule{
{
APIGroups: []string{"ramendr.openshift.io"},
Resources: []string{"maintenancemodes"},
Verbs: []string{"create", "get", "list", "update", "delete"},
},
},
}

mModeClusterRoleBinding = &rbacv1.ClusterRoleBinding{
TypeMeta: metav1.TypeMeta{Kind: "ClusterRoleBinding", APIVersion: "rbac.authorization.k8s.io/v1"},
ObjectMeta: metav1.ObjectMeta{Name: "open-cluster-management:klusterlet-work-sa:agent:mmode-edit"},
Subjects: []rbacv1.Subject{
{
Kind: "ServiceAccount",
Name: "klusterlet-work-sa",
Namespace: "open-cluster-management-agent",
},
},
RoleRef: rbacv1.RoleRef{
APIGroup: "rbac.authorization.k8s.io",
Kind: "ClusterRole",
Name: "open-cluster-management:klusterlet-work-sa:agent:mmode-edit",
},
}

drClusterConfigRole = &rbacv1.ClusterRole{
TypeMeta: metav1.TypeMeta{Kind: "ClusterRole", APIVersion: "rbac.authorization.k8s.io/v1"},
ObjectMeta: metav1.ObjectMeta{Name: "open-cluster-management:klusterlet-work-sa:agent:drclusterconfig-edit"},
Rules: []rbacv1.PolicyRule{
{
APIGroups: []string{"ramendr.openshift.io"},
Resources: []string{"drclusterconfigs"},
Verbs: []string{"create", "get", "list", "update", "delete"},
},
},
}

drClusterConfigRoleBinding = &rbacv1.ClusterRoleBinding{
TypeMeta: metav1.TypeMeta{Kind: "ClusterRoleBinding", APIVersion: "rbac.authorization.k8s.io/v1"},
ObjectMeta: metav1.ObjectMeta{Name: "open-cluster-management:klusterlet-work-sa:agent:drclusterconfig-edit"},
Subjects: []rbacv1.Subject{
{
Kind: "ServiceAccount",
Name: "klusterlet-work-sa",
Namespace: "open-cluster-management-agent",
},
},
RoleRef: rbacv1.RoleRef{
APIGroup: "rbac.authorization.k8s.io",
Kind: "ClusterRole",
Name: "open-cluster-management:klusterlet-work-sa:agent:drclusterconfig-edit",
},
}
)
105 changes: 2 additions & 103 deletions internal/controller/util/mw_util.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,6 @@ import (
"github.com/go-logr/logr"
errorswrapper "github.com/pkg/errors"
corev1 "k8s.io/api/core/v1"
rbacv1 "k8s.io/api/rbac/v1"
"k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
Expand Down Expand Up @@ -438,20 +437,9 @@ func (mwu *MWUtil) GetDrClusterManifestWork(clusterName string) (*ocmworkv1.Mani

func (mwu *MWUtil) CreateOrUpdateDrClusterManifestWork(
clusterName string,
objectsToAppend []interface{}, annotations map[string]string,
objects []interface{},
annotations map[string]string,
) error {
objects := append(
[]interface{}{
vrgClusterRole,
vrgClusterRoleBinding,
mModeClusterRole,
mModeClusterRoleBinding,
drClusterConfigRole,
drClusterConfigRoleBinding,
},
objectsToAppend...,
)

manifests := make([]ocmworkv1.Manifest, len(objects))

for i, object := range objects {
Expand All @@ -478,95 +466,6 @@ func (mwu *MWUtil) CreateOrUpdateDrClusterManifestWork(
return err
}

var (
vrgClusterRole = &rbacv1.ClusterRole{
TypeMeta: metav1.TypeMeta{Kind: "ClusterRole", APIVersion: "rbac.authorization.k8s.io/v1"},
ObjectMeta: metav1.ObjectMeta{Name: "open-cluster-management:klusterlet-work-sa:agent:volrepgroup-edit"},
Rules: []rbacv1.PolicyRule{
{
APIGroups: []string{"ramendr.openshift.io"},
Resources: []string{"volumereplicationgroups"},
Verbs: []string{"create", "get", "list", "update", "delete"},
},
},
}

vrgClusterRoleBinding = &rbacv1.ClusterRoleBinding{
TypeMeta: metav1.TypeMeta{Kind: "ClusterRoleBinding", APIVersion: "rbac.authorization.k8s.io/v1"},
ObjectMeta: metav1.ObjectMeta{Name: "open-cluster-management:klusterlet-work-sa:agent:volrepgroup-edit"},
Subjects: []rbacv1.Subject{
{
Kind: "ServiceAccount",
Name: "klusterlet-work-sa",
Namespace: "open-cluster-management-agent",
},
},
RoleRef: rbacv1.RoleRef{
APIGroup: "rbac.authorization.k8s.io",
Kind: "ClusterRole",
Name: "open-cluster-management:klusterlet-work-sa:agent:volrepgroup-edit",
},
}

mModeClusterRole = &rbacv1.ClusterRole{
TypeMeta: metav1.TypeMeta{Kind: "ClusterRole", APIVersion: "rbac.authorization.k8s.io/v1"},
ObjectMeta: metav1.ObjectMeta{Name: "open-cluster-management:klusterlet-work-sa:agent:mmode-edit"},
Rules: []rbacv1.PolicyRule{
{
APIGroups: []string{"ramendr.openshift.io"},
Resources: []string{"maintenancemodes"},
Verbs: []string{"create", "get", "list", "update", "delete"},
},
},
}

mModeClusterRoleBinding = &rbacv1.ClusterRoleBinding{
TypeMeta: metav1.TypeMeta{Kind: "ClusterRoleBinding", APIVersion: "rbac.authorization.k8s.io/v1"},
ObjectMeta: metav1.ObjectMeta{Name: "open-cluster-management:klusterlet-work-sa:agent:mmode-edit"},
Subjects: []rbacv1.Subject{
{
Kind: "ServiceAccount",
Name: "klusterlet-work-sa",
Namespace: "open-cluster-management-agent",
},
},
RoleRef: rbacv1.RoleRef{
APIGroup: "rbac.authorization.k8s.io",
Kind: "ClusterRole",
Name: "open-cluster-management:klusterlet-work-sa:agent:mmode-edit",
},
}

drClusterConfigRole = &rbacv1.ClusterRole{
TypeMeta: metav1.TypeMeta{Kind: "ClusterRole", APIVersion: "rbac.authorization.k8s.io/v1"},
ObjectMeta: metav1.ObjectMeta{Name: "open-cluster-management:klusterlet-work-sa:agent:drclusterconfig-edit"},
Rules: []rbacv1.PolicyRule{
{
APIGroups: []string{"ramendr.openshift.io"},
Resources: []string{"drclusterconfigs"},
Verbs: []string{"create", "get", "list", "update", "delete"},
},
},
}

drClusterConfigRoleBinding = &rbacv1.ClusterRoleBinding{
TypeMeta: metav1.TypeMeta{Kind: "ClusterRoleBinding", APIVersion: "rbac.authorization.k8s.io/v1"},
ObjectMeta: metav1.ObjectMeta{Name: "open-cluster-management:klusterlet-work-sa:agent:drclusterconfig-edit"},
Subjects: []rbacv1.Subject{
{
Kind: "ServiceAccount",
Name: "klusterlet-work-sa",
Namespace: "open-cluster-management-agent",
},
},
RoleRef: rbacv1.RoleRef{
APIGroup: "rbac.authorization.k8s.io",
Kind: "ClusterRole",
Name: "open-cluster-management:klusterlet-work-sa:agent:drclusterconfig-edit",
},
}
)

func (mwu *MWUtil) GenerateManifest(obj interface{}) (*ocmworkv1.Manifest, error) {
objJSON, err := json.Marshal(obj)
if err != nil {
Expand Down
Loading
Loading