📖 Document multi-tenancy contract #4074

fabriziopandini · 2021-01-14T10:57:18Z

What this PR does / why we need it:
As per discussion on January 13th office hour meeting, this PR updates the cluster API book by:

Removing outdated definitions/related paragraphs in the clusterctl documentation
Documenting the new definition of multi tenancy, as per Adapt clusterctl move to the new multi-tenancy model #3042, and the impact of such definition on the contract (including e.g. and Run webhooks as part of the main manager #3822)
Documenting the lesson learned in running multiple instances of the same providers in v1alpha3, and the intent to preserve the possibility to go down this path if someone wants (make it possible)

Please note that the last point most probably does not represent yet the final state and it should be intended as a hook for the follow-up work for #4004.

/area clusterctl

/cc @wfernandes @vincepri @CecileRobertMichon @detiber @MarcelMue @yastij @randomvariable

k8s-ci-robot · 2021-01-14T10:57:24Z

@fabriziopandini: GitHub didn't allow me to request PR reviews from the following users: MarcelMue.

Note that only kubernetes-sigs members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

What this PR does / why we need it:
As per discussion on January 13th office hour meeting, this PR updates the cluster API book by:

Removing outdated definitions/related paragraphs in the clusterctl documentation

Documenting the new definition of multi tenancy, as per Adapt clusterctl move to the new multi-tenancy model #3042, and the impact of such definition on the contract (including e.g. and Run webhooks as part of the main manager #3822)

Documenting the lesson learned in running multiple instances of the same providers in v1alpha3, and the intent to preserve the possibility to go down this path if someone wants (make it possible)

Please note that the last point most probably does not represent yet the final state and it should be intended as a hook for the follow-up work for #4004.

/area clusterctl

/cc @wfernandes @vincepri @CecileRobertMichon @detiber @MarcelMue @yastij @randomvariable

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

fabriziopandini · 2021-01-14T10:58:36Z

docs/book/src/clusterctl/provider-contract.md

@@ -283,8 +283,6 @@ Provider authors should be aware of the following transformations that `clusterc
 * Enforcement of target namespace:
    * The name of the namespace object is set;
    * The namespace field of all the objects is set (with exception of cluster wide objects like e.g. ClusterRoles);
-    * ClusterRole and ClusterRoleBinding are renamed by adding a “${namespace}-“ prefix to the name; this change reduces the risks


@wfernandes this is a clusterctl internal; we should probably re-consider this during the implementation phase of the CAPI provider operator

fabriziopandini · 2021-01-14T10:59:42Z

docs/book/src/developer/architecture/controllers/multi-tenancy.md

+- All the infrastructure provider are required to manage different credentials.
+- All the provider should deploy and run web-hook and with managers;
+  please note this is the default in controllers generated with kubebuilder. 
+- All the provider are required to create a `component.yaml` accordingly.


My intent is to link documentation from #3985 here, depending on which PR is going to merge first

docs/book/src/developer/architecture/controllers/multi-tenancy.md

docs/book/src/developer/architecture/controllers/support-multiple-instances.md

vincepri · 2021-01-14T15:45:34Z

docs/book/src/developer/architecture/controllers/support-multiple-instances.md

+
+- In the Cluster API project, we are not going to include release a `component.yaml` file supporting this scenario; 
+  however it will be possible to create such file starting from the content of the `/config` folder.
+- clusterctl and the CAPI provider operator are not going to support deploying/managing multiple instances of the same provider.


Suggested change

- clusterctl and the CAPI provider operator are not going to support deploying/managing multiple instances of the same provider.

I think we should state this in order to set clear expectations, unless you think this is clear from the previous statement

docs/book/src/developer/architecture/controllers/support-multiple-instances.md

CecileRobertMichon

looks great

CecileRobertMichon · 2021-01-14T17:25:35Z

docs/book/src/developer/architecture/controllers/support-multiple-instances.md

@@ -0,0 +1,41 @@
+# Support running multiple instances of the same provider
+
+Up until v1alpha3, the need of supporting multiple credentials was addressed by running multiple


Might make sense to also add a note to https://github.com/kubernetes-sigs/cluster-api/blob/master/docs/book/src/developer/providers/v1alpha3-to-v1alpha4.md

docs/book/src/developer/architecture/controllers/support-multiple-instances.md

MarcelMue · 2021-01-15T13:35:22Z

LGTM after reading through it closely.

fabriziopandini · 2021-01-19T11:16:12Z

/milestone v0.4.0

vincepri

/lgtm
/assign @detiber @CecileRobertMichon

wfernandes

No blockers. LGTM.

docs/book/src/developer/architecture/controllers/support-multiple-instances.md

fabriziopandini · 2021-01-20T12:54:57Z

Latest comments addressed + squash

wfernandes · 2021-01-20T16:16:21Z

/lgtm

CecileRobertMichon

/approve

k8s-ci-robot · 2021-01-20T17:48:54Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: CecileRobertMichon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [CecileRobertMichon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added the area/clusterctl Issues or PRs related to clusterctl label Jan 14, 2021

k8s-ci-robot requested review from yastij, randomvariable and wfernandes January 14, 2021 10:57

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jan 14, 2021

k8s-ci-robot requested review from vincepri, CecileRobertMichon and detiber January 14, 2021 10:57

k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jan 14, 2021

fabriziopandini commented Jan 14, 2021

View reviewed changes

vincepri reviewed Jan 14, 2021

View reviewed changes

CecileRobertMichon reviewed Jan 14, 2021

View reviewed changes

k8s-ci-robot added this to the v0.4.0 milestone Jan 19, 2021

vincepri approved these changes Jan 19, 2021

View reviewed changes

k8s-ci-robot assigned CecileRobertMichon, detiber and vincepri Jan 19, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jan 19, 2021

wfernandes reviewed Jan 19, 2021

View reviewed changes

docs/book/src/developer/architecture/controllers/support-multiple-instances.md Outdated Show resolved Hide resolved

docs/book/src/developer/architecture/controllers/support-multiple-instances.md Outdated Show resolved Hide resolved

Document multi-tenancy contract

bb54134

fabriziopandini force-pushed the document-multi-tenancy-contract branch from 7e6ed1f to bb54134 Compare January 20, 2021 12:54

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jan 20, 2021

k8s-ci-robot assigned wfernandes Jan 20, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jan 20, 2021

CecileRobertMichon approved these changes Jan 20, 2021

View reviewed changes

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 20, 2021

k8s-ci-robot merged commit c615219 into kubernetes-sigs:master Jan 20, 2021

fabriziopandini deleted the document-multi-tenancy-contract branch January 21, 2021 22:20

MarcelMue mentioned this pull request Jan 26, 2021

⚠️ Add watch label to allow multiple manager instances #4119

Merged

randomvariable mentioned this pull request Feb 3, 2021

📖 CAEP: Add support for infrastructure cluster resources to be managed externally #4135

Merged

enxebre mentioned this pull request Feb 3, 2021

Document a guide to management cluster security #4139

Closed

fabriziopandini mentioned this pull request Mar 11, 2021

Adapt clusterctl move to the new multi-tenancy model #3042

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

📖 Document multi-tenancy contract #4074

📖 Document multi-tenancy contract #4074

fabriziopandini commented Jan 14, 2021

k8s-ci-robot commented Jan 14, 2021

fabriziopandini Jan 14, 2021

fabriziopandini Jan 14, 2021

vincepri Jan 14, 2021

fabriziopandini Jan 14, 2021

CecileRobertMichon left a comment

CecileRobertMichon Jan 14, 2021

fabriziopandini Jan 15, 2021

MarcelMue commented Jan 15, 2021

fabriziopandini commented Jan 19, 2021

vincepri left a comment

wfernandes left a comment

fabriziopandini commented Jan 20, 2021

wfernandes commented Jan 20, 2021

CecileRobertMichon left a comment

k8s-ci-robot commented Jan 20, 2021

		@@ -0,0 +1,41 @@
		# Support running multiple instances of the same provider

		Up until v1alpha3, the need of supporting multiple credentials was addressed by running multiple

📖 Document multi-tenancy contract #4074

📖 Document multi-tenancy contract #4074

Conversation

fabriziopandini commented Jan 14, 2021

k8s-ci-robot commented Jan 14, 2021

fabriziopandini Jan 14, 2021

Choose a reason for hiding this comment

fabriziopandini Jan 14, 2021

Choose a reason for hiding this comment

vincepri Jan 14, 2021

Choose a reason for hiding this comment

fabriziopandini Jan 14, 2021

Choose a reason for hiding this comment

CecileRobertMichon left a comment

Choose a reason for hiding this comment

CecileRobertMichon Jan 14, 2021

Choose a reason for hiding this comment

fabriziopandini Jan 15, 2021

Choose a reason for hiding this comment

MarcelMue commented Jan 15, 2021

fabriziopandini commented Jan 19, 2021

vincepri left a comment

Choose a reason for hiding this comment

wfernandes left a comment

Choose a reason for hiding this comment

fabriziopandini commented Jan 20, 2021

wfernandes commented Jan 20, 2021

CecileRobertMichon left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Jan 20, 2021