From 77ce3eb872e9f3ef150cf3966f65a11f315e06e6 Mon Sep 17 00:00:00 2001 From: Thomas Way Date: Mon, 13 May 2024 00:14:00 +0100 Subject: [PATCH] chore: remove unused wireguard-manager-config Fixes: #169 --- ...wireguard-manager-config_v1_configmap.yaml | 17 - internal/it/suite_test.go | 1 - release.yaml | 851 +++++++++--------- 3 files changed, 416 insertions(+), 453 deletions(-) delete mode 100644 bundle/manifests/wireguard-manager-config_v1_configmap.yaml diff --git a/bundle/manifests/wireguard-manager-config_v1_configmap.yaml b/bundle/manifests/wireguard-manager-config_v1_configmap.yaml deleted file mode 100644 index bb29640c..00000000 --- a/bundle/manifests/wireguard-manager-config_v1_configmap.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: v1 -data: - controller_manager_config.yaml: | - apiVersion: controller-runtime.sigs.k8s.io/v1alpha1 - kind: ControllerManagerConfig - health: - healthProbeBindAddress: :8081 - metrics: - bindAddress: 127.0.0.1:8080 - webhook: - port: 9443 - leaderElection: - leaderElect: true - resourceName: a6d3bffc.wireguard-operator.io -kind: ConfigMap -metadata: - name: wireguard-manager-config diff --git a/internal/it/suite_test.go b/internal/it/suite_test.go index 50986808..253991ef 100644 --- a/internal/it/suite_test.go +++ b/internal/it/suite_test.go @@ -207,7 +207,6 @@ var _ = BeforeSuite(func() { "rolebinding.rbac.authorization.k8s.io/wireguard-leader-election-rolebinding", "clusterrolebinding.rbac.authorization.k8s.io/wireguard-manager-rolebinding", "clusterrolebinding.rbac.authorization.k8s.io/wireguard-proxy-rolebinding", - "configmap/wireguard-manager-config", "service/wireguard-controller-manager-metrics-service", "deployment.apps/wireguard-controller-manager", } diff --git a/release.yaml b/release.yaml index 3667cf0f..795bbc52 100644 --- a/release.yaml +++ b/release.yaml @@ -21,132 +21,132 @@ spec: singular: wireguardpeer scope: Namespaced versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: WireguardPeer is the Schema for the wireguardpeers API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: The desired state of the peer. - properties: - PrivateKeyRef: - description: The private key of the peer - properties: - secretKeyRef: - description: SecretKeySelector selects a key of a Secret. + - name: v1alpha1 + schema: + openAPIV3Schema: + description: WireguardPeer is the Schema for the wireguardpeers API + properties: + apiVersion: + description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + description: The desired state of the peer. + properties: + PrivateKeyRef: + description: The private key of the peer + properties: + secretKeyRef: + description: SecretKeySelector selects a key of a Secret. + properties: + key: + description: The key of the secret to select from. Must be a valid secret key. + type: string + name: + description: "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?" + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + required: + - secretKeyRef + type: object + address: + description: 'INSERT ADDITIONAL SPEC FIELDS - desired state of cluster Important: Run "make" to regenerate code after modifying this file The address of the peer.' + type: string + disabled: + description: Set to true to temporarily disable the peer. + type: boolean + dns: + description: The DNS configuration for the peer. + type: string + downloadSpeed: + properties: + config: + type: integer + unit: + enum: + - mbps + - kbps + type: string + type: object + egressNetworkPolicies: + description: Egress network policies for the peer. + items: properties: - key: - description: The key of the secret to select from. Must be a valid secret key. + action: + description: Specifies the action to take when outgoing traffic from a Wireguard peer matches the policy. This could be 'Accept' or 'Reject'. + enum: + - ACCEPT + - REJECT + - Accept + - Reject type: string - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + protocol: + description: Specifies the protocol to match for this policy. This could be TCP, UDP, or ICMP. + enum: + - TCP + - UDP + - ICMP type: string - optional: - description: Specify whether the Secret or its key must be defined - type: boolean - required: - - key + to: + description: A struct that specifies the destination address and port for the traffic. This could include IP addresses or hostnames, as well as specific port numbers or port ranges. + properties: + ip: + description: A string field that specifies the destination IP address for traffic that matches the policy. + type: string + port: + description: An integer field that specifies the destination port number for traffic that matches the policy. + format: int32 + type: integer + type: object type: object - required: - - secretKeyRef - type: object - address: - description: 'INSERT ADDITIONAL SPEC FIELDS - desired state of cluster Important: Run "make" to regenerate code after modifying this file The address of the peer.' - type: string - disabled: - description: Set to true to temporarily disable the peer. - type: boolean - dns: - description: The DNS configuration for the peer. - type: string - downloadSpeed: - properties: - config: - type: integer - unit: - enum: - - mbps - - kbps - type: string - type: object - egressNetworkPolicies: - description: Egress network policies for the peer. - items: + type: array + publicKey: + description: The key used by the peer to authenticate with the wg server. + type: string + uploadSpeed: properties: - action: - description: Specifies the action to take when outgoing traffic from a Wireguard peer matches the policy. This could be 'Accept' or 'Reject'. + config: + type: integer + unit: enum: - - ACCEPT - - REJECT - - Accept - - Reject + - mbps + - kbps type: string - protocol: - description: Specifies the protocol to match for this policy. This could be TCP, UDP, or ICMP. - enum: - - TCP - - UDP - - ICMP - type: string - to: - description: A struct that specifies the destination address and port for the traffic. This could include IP addresses or hostnames, as well as specific port numbers or port ranges. - properties: - ip: - description: A string field that specifies the destination IP address for traffic that matches the policy. - type: string - port: - description: An integer field that specifies the destination port number for traffic that matches the policy. - format: int32 - type: integer - type: object type: object - type: array - publicKey: - description: The key used by the peer to authenticate with the wg server. - type: string - uploadSpeed: - properties: - config: - type: integer - unit: - enum: - - mbps - - kbps - type: string - type: object - wireguardRef: - description: The name of the Wireguard instance in k8s that the peer belongs to. The wg instance should be in the same namespace as the peer. - minLength: 1 - type: string - required: - - wireguardRef - type: object - status: - description: A field that defines the observed state of the Wireguard peer. This includes fields like the current configuration and status of the peer. - properties: - config: - description: 'INSERT ADDITIONAL STATUS FIELD - define observed state of cluster Important: Run "make" to regenerate code after modifying this file A string field that contains the current configuration for the Wireguard peer.' - type: string - message: - description: A string field that provides additional information about the status of the Wireguard peer. This could include error messages or other information that helps to diagnose issues with the peer. - type: string - status: - description: A string field that represents the current status of the Wireguard peer. This could include values like ready, pending, or error. - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} + wireguardRef: + description: The name of the Wireguard instance in k8s that the peer belongs to. The wg instance should be in the same namespace as the peer. + minLength: 1 + type: string + required: + - wireguardRef + type: object + status: + description: A field that defines the observed state of the Wireguard peer. This includes fields like the current configuration and status of the peer. + properties: + config: + description: 'INSERT ADDITIONAL STATUS FIELD - define observed state of cluster Important: Run "make" to regenerate code after modifying this file A string field that contains the current configuration for the Wireguard peer.' + type: string + message: + description: A string field that provides additional information about the status of the Wireguard peer. This could include error messages or other information that helps to diagnose issues with the peer. + type: string + status: + description: A string field that represents the current status of the Wireguard peer. This could include values like ready, pending, or error. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} status: acceptedNames: kind: "" @@ -170,66 +170,66 @@ spec: singular: wireguard scope: Namespaced versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: Wireguard is the Schema for the wireguards API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: WireguardSpec defines the desired state of Wireguard - properties: - address: - description: A string field that specifies the address for the Wireguard VPN server. This is the public IP address or hostname that peers will use to connect to the VPN. - type: string - dns: - description: A string field that specifies the DNS server(s) to be used by the peers. - type: string - enableIpForwardOnPodInit: - description: A boolean field that specifies whether IP forwarding should be enabled on the Wireguard VPN pod at startup. This can be useful to enable if the peers are having problems with sending traffic to the internet. - type: boolean - mtu: - description: A string field that specifies the maximum transmission unit (MTU) size for Wireguard packets for all peers. - type: string - serviceAnnotations: - additionalProperties: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: Wireguard is the Schema for the wireguards API + properties: + apiVersion: + description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources" + type: string + kind: + description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + type: string + metadata: + type: object + spec: + description: WireguardSpec defines the desired state of Wireguard + properties: + address: + description: A string field that specifies the address for the Wireguard VPN server. This is the public IP address or hostname that peers will use to connect to the VPN. + type: string + dns: + description: A string field that specifies the DNS server(s) to be used by the peers. + type: string + enableIpForwardOnPodInit: + description: A boolean field that specifies whether IP forwarding should be enabled on the Wireguard VPN pod at startup. This can be useful to enable if the peers are having problems with sending traffic to the internet. + type: boolean + mtu: + description: A string field that specifies the maximum transmission unit (MTU) size for Wireguard packets for all peers. + type: string + serviceAnnotations: + additionalProperties: + type: string + description: A map of key value strings for service annotations + type: object + serviceType: + description: A field that specifies the type of Kubernetes service that should be used for the Wireguard VPN. This could be NodePort or LoadBalancer, depending on the needs of the deployment. + type: string + type: object + status: + description: WireguardStatus defines the observed state of Wireguard + properties: + address: + description: A string field that specifies the address for the Wireguard VPN server that is currently being used. + type: string + dns: + type: string + message: + description: A string field that provides additional information about the status of Wireguard. This could include error messages or other information that helps to diagnose issues with the wg instance. + type: string + port: + description: A string field that specifies the port for the Wireguard VPN server that is currently being used. type: string - description: A map of key value strings for service annotations - type: object - serviceType: - description: A field that specifies the type of Kubernetes service that should be used for the Wireguard VPN. This could be NodePort or LoadBalancer, depending on the needs of the deployment. - type: string - type: object - status: - description: WireguardStatus defines the observed state of Wireguard - properties: - address: - description: A string field that specifies the address for the Wireguard VPN server that is currently being used. - type: string - dns: - type: string - message: - description: A string field that provides additional information about the status of Wireguard. This could include error messages or other information that helps to diagnose issues with the wg instance. - type: string - port: - description: A string field that specifies the port for the Wireguard VPN server that is currently being used. - type: string - status: - description: A string field that represents the current status of Wireguard. This could include values like ready, pending, or error. - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} + status: + description: A string field that represents the current status of Wireguard. This could include values like ready, pending, or error. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} status: acceptedNames: kind: "" @@ -249,37 +249,37 @@ metadata: name: wireguard-leader-election-role namespace: wireguard-system rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -287,165 +287,165 @@ metadata: creationTimestamp: null name: wireguard-manager-role rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - nodes - verbs: - - list - - watch -- apiGroups: - - "" - resources: - - pods - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - secrets - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - services - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - apps - resources: - - deployments - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - apps - resources: - - pods - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - vpn.wireguard-operator.io - resources: - - wireguardpeers - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - vpn.wireguard-operator.io - resources: - - wireguardpeers/finalizers - verbs: - - update -- apiGroups: - - vpn.wireguard-operator.io - resources: - - wireguardpeers/status - verbs: - - get - - patch - - update -- apiGroups: - - vpn.wireguard-operator.io - resources: - - wireguards - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - vpn.wireguard-operator.io - resources: - - wireguards/finalizers - verbs: - - update -- apiGroups: - - vpn.wireguard-operator.io - resources: - - wireguards/status - verbs: - - get - - patch - - update + - apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + - list + - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - services + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - apps + resources: + - deployments + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - apps + resources: + - pods + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - vpn.wireguard-operator.io + resources: + - wireguardpeers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - vpn.wireguard-operator.io + resources: + - wireguardpeers/finalizers + verbs: + - update + - apiGroups: + - vpn.wireguard-operator.io + resources: + - wireguardpeers/status + verbs: + - get + - patch + - update + - apiGroups: + - vpn.wireguard-operator.io + resources: + - wireguards + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - vpn.wireguard-operator.io + resources: + - wireguards/finalizers + verbs: + - update + - apiGroups: + - vpn.wireguard-operator.io + resources: + - wireguards/status + verbs: + - get + - patch + - update --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: wireguard-metrics-reader rules: -- nonResourceURLs: - - /metrics - verbs: - - get + - nonResourceURLs: + - /metrics + verbs: + - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: wireguard-proxy-role rules: -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -457,9 +457,9 @@ roleRef: kind: Role name: wireguard-leader-election-role subjects: -- kind: ServiceAccount - name: wireguard-controller-manager - namespace: wireguard-system + - kind: ServiceAccount + name: wireguard-controller-manager + namespace: wireguard-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -470,9 +470,9 @@ roleRef: kind: ClusterRole name: wireguard-manager-role subjects: -- kind: ServiceAccount - name: wireguard-controller-manager - namespace: wireguard-system + - kind: ServiceAccount + name: wireguard-controller-manager + namespace: wireguard-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -483,28 +483,9 @@ roleRef: kind: ClusterRole name: wireguard-proxy-role subjects: -- kind: ServiceAccount - name: wireguard-controller-manager - namespace: wireguard-system ---- -apiVersion: v1 -data: - controller_manager_config.yaml: | - apiVersion: controller-runtime.sigs.k8s.io/v1alpha1 - kind: ControllerManagerConfig - health: - healthProbeBindAddress: :8081 - metrics: - bindAddress: 127.0.0.1:8080 - webhook: - port: 9443 - leaderElection: - leaderElect: true - resourceName: a6d3bffc.wireguard-operator.io -kind: ConfigMap -metadata: - name: wireguard-manager-config - namespace: wireguard-system + - kind: ServiceAccount + name: wireguard-controller-manager + namespace: wireguard-system --- apiVersion: v1 kind: Service @@ -515,10 +496,10 @@ metadata: namespace: wireguard-system spec: ports: - - name: https - port: 8443 - protocol: TCP - targetPort: https + - name: https + port: 8443 + protocol: TCP + targetPort: https selector: control-plane: controller-manager --- @@ -542,54 +523,54 @@ spec: control-plane: controller-manager spec: containers: - - args: - - --secure-listen-address=0.0.0.0:8443 - - --upstream=http://127.0.0.1:8080/ - - --logtostderr=true - - --v=0 - image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0 - name: kube-rbac-proxy - ports: - - containerPort: 8443 - name: https - protocol: TCP - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 5m - memory: 64Mi - - args: - - --health-probe-bind-address=:8081 - - --metrics-bind-address=127.0.0.1:8080 - - --leader-elect - - --agent-image=ghcr.io/jodevsa/wireguard-operator/agent:latest - command: - - /manager - image: ghcr.io/jodevsa/wireguard-operator/manager:latest - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 15 - periodSeconds: 20 - name: manager - readinessProbe: - httpGet: - path: /readyz - port: 8081 - initialDelaySeconds: 5 - periodSeconds: 10 - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 10m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false + - args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=0 + image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0 + name: kube-rbac-proxy + ports: + - containerPort: 8443 + name: https + protocol: TCP + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 5m + memory: 64Mi + - args: + - --health-probe-bind-address=:8081 + - --metrics-bind-address=127.0.0.1:8080 + - --leader-elect + - --agent-image=ghcr.io/jodevsa/wireguard-operator/agent:latest + command: + - /manager + image: ghcr.io/jodevsa/wireguard-operator/manager:latest + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + name: manager + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 10m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false securityContext: runAsNonRoot: true serviceAccountName: wireguard-controller-manager