Merge branch 'openyurtio:master' into 20230321-pr

Makefile

@@ -24,6 +24,7 @@ GIT_COMMIT = $(shell git rev-parse HEAD)
 ENABLE_AUTONOMY_TESTS ?=true
 CRD_OPTIONS ?= "crd:crdVersions=v1"
 BUILD_KUSTOMIZE ?= _output/manifest
+GOPROXY ?= $(shell go env GOPROXY)
 
 ifeq ($(shell git tag --points-at ${GIT_COMMIT}),)
 GIT_VERSION=$(IMAGE_TAG)-$(shell echo ${GIT_COMMIT} | cut -c 1-7)
@@ -38,7 +39,8 @@ endif
 DOCKER_BUILD_ARGS = --build-arg GIT_VERSION=${GIT_VERSION}
 
 ifeq (${REGION}, cn)
-DOCKER_BUILD_ARGS += --build-arg GOPROXY=https://goproxy.cn --build-arg MIRROR_REPO=mirrors.aliyun.com
+GOPROXY=https://goproxy.cn
+DOCKER_BUILD_ARGS += --build-arg GOPROXY=$(GOPROXY) --build-arg MIRROR_REPO=mirrors.aliyun.com
 endif
 
 ifneq (${http_proxy},)
@@ -55,7 +57,7 @@ all: test build
 
 # Build binaries in the host environment
 build:
-	bash hack/make-rules/build.sh $(WHAT)
+	GOPROXY=$(GOPROXY) bash hack/make-rules/build.sh $(WHAT)
 
 # Run test
 test:

charts/openyurt/templates/yurt-controller-manager.yaml

@@ -29,6 +29,7 @@ rules:
       - list
       - update
       - watch
+      - delete
   - apiGroups:
       - ""
     resources:

charts/openyurt/templates/yurt-manager-auto-generated.yaml

@@ -503,6 +503,24 @@ metadata:
   creationTimestamp: null
   name: yurt-manager-role
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - secret
+  verbs:
+  - create
+  - get
+  - list
+  - patch
+  - update
 - apiGroups:
   - admissionregistration.k8s.io
   resources:
@@ -558,6 +576,7 @@ rules:
   resources:
   - certificatesigningrequests
   verbs:
+  - create
   - get
   - list
   - watch

charts/openyurt/templates/yurt-manager.yaml

@@ -60,11 +60,11 @@ spec:
           command:
             - /usr/local/bin/yurt-manager
           image: {{ .Values.yurtManager.image.repository }}:{{ .Values.yurtManager.image.tag }}
-          imagePullPolicy: Always
+          imagePullPolicy: IfNotPresent
           name: yurt-manager
           env:
             - name: WEBHOOK_PORT
-              value: {{ .Values.yurtManager.webhook.port }}
+              value: {{ .Values.yurtManager.webhook.port | quote }}
           ports:
             - containerPort: {{ .Values.yurtManager.webhook.port }}
               name: webhook-server

charts/openyurt/values.yaml

@@ -1,4 +1,3 @@
-
 imagePullSecrets: []
 imagePullPolicy: IfNotPresent
 
@@ -57,12 +56,12 @@ yurtManager:
     requests:
       cpu: 100m
       memory: 256Mi
-  affinity: 
+  affinity:
     nodeAffinity:
       requiredDuringSchedulingIgnoredDuringExecution:
         nodeSelectorTerms:
-        - matchExpressions:
-          - key: openyurt.io/is-edge-worker
-            operator: In
-            values:
-            - "false"
+          - matchExpressions:
+              - key: openyurt.io/is-edge-worker
+                operator: In
+                values:
+                  - "false"

cmd/yurt-controller-manager/app/controllermanager.go

@@ -309,7 +309,6 @@ var ControllersDisabledByDefault = sets.NewString()
 // paired to their InitFunc.  This allows for structured downstream composition and subdivision.
 func NewControllerInitializers() map[string]InitFunc {
 	controllers := map[string]InitFunc{}
-	controllers["poolcoordinatorcertmanager"] = startPoolCoordinatorCertManager
 	controllers["poolcoordinator"] = startPoolCoordinatorController
 	controllers["daemonpodupdater"] = startDaemonPodUpdaterController
 	controllers["servicetopologycontroller"] = startServiceTopologyController

cmd/yurt-controller-manager/app/core.go

@@ -25,21 +25,11 @@ import (
 	"net/http"
 
 	daemonpodupdater "github.com/openyurtio/openyurt/pkg/controller/daemonpodupdater"
-	poolcoordinatorcertmanager "github.com/openyurtio/openyurt/pkg/controller/poolcoordinator/cert"
 	poolcoordinator "github.com/openyurtio/openyurt/pkg/controller/poolcoordinator/delegatelease"
 	"github.com/openyurtio/openyurt/pkg/controller/poolcoordinator/podbinding"
 	"github.com/openyurtio/openyurt/pkg/controller/servicetopology"
 )
 
-func startPoolCoordinatorCertManager(ctx ControllerContext) (http.Handler, bool, error) {
-	poolcoordinatorCertManager := poolcoordinatorcertmanager.NewPoolCoordinatorCertManager(
-		ctx.ClientBuilder.ClientOrDie("poolcoordinator-cert-manager"),
-		ctx.InformerFactory.Core().V1().Pods(),
-	)
-	go poolcoordinatorCertManager.Run(1, ctx.Stop)
-	return nil, true, nil
-}
-
 func startPoolCoordinatorController(ctx ControllerContext) (http.Handler, bool, error) {
 	poolcoordinatorController := poolcoordinator.NewController(
 		ctx.ClientBuilder.ClientOrDie("poolcoordinator-delegate-lease"),

cmd/yurthub/app/config/config.go

@@ -343,6 +343,7 @@ func createCertManager(options *options.YurtHubOptions, remoteServers []*url.URL
 		RootDir:                  options.RootDir,
 		NodeName:                 options.NodeName,
 		JoinToken:                options.JoinToken,
+		BootstrapFile:            options.BootstrapFile,
 		CaCertHashes:             options.CACertHashes,
 		YurtHubCertOrganizations: options.YurtHubCertOrganizations,
 		CertIPs:                  certIPs,

cmd/yurthub/app/options/options.go

@@ -61,6 +61,7 @@ type YurtHubOptions struct {
 	HeartbeatIntervalSeconds  int
 	MaxRequestInFlight        int
 	JoinToken                 string
+	BootstrapFile             string
 	RootDir                   string
 	Version                   bool
 	EnableProfiling           bool
@@ -143,8 +144,8 @@ func (options *YurtHubOptions) Validate() error {
 		return fmt.Errorf("server-address is empty")
 	}
 
-	if len(options.JoinToken) == 0 {
-		return fmt.Errorf("bootstrap token is empty")
+	if len(options.JoinToken) == 0 && len(options.BootstrapFile) == 0 {
+		return fmt.Errorf("bootstrap token and bootstrap file are empty, one of them must be set")
 	}
 
 	if !util.IsSupportedLBMode(options.LBMode) {
@@ -183,7 +184,9 @@ func (o *YurtHubOptions) AddFlags(fs *pflag.FlagSet) {
 	fs.IntVar(&o.HeartbeatTimeoutSeconds, "heartbeat-timeout-seconds", o.HeartbeatTimeoutSeconds, " number of seconds after which the heartbeat times out.")
 	fs.IntVar(&o.HeartbeatIntervalSeconds, "heartbeat-interval-seconds", o.HeartbeatIntervalSeconds, " number of seconds for omitting one time heartbeat to remote server.")
 	fs.IntVar(&o.MaxRequestInFlight, "max-requests-in-flight", o.MaxRequestInFlight, "the maximum number of parallel requests.")
-	fs.StringVar(&o.JoinToken, "join-token", o.JoinToken, "the Join token for bootstrapping hub agent when --cert-mgr-mode=hubself.")
+	fs.StringVar(&o.JoinToken, "join-token", o.JoinToken, "the Join token for bootstrapping hub agent.")
+	fs.MarkDeprecated("join-token", "It is planned to be removed from OpenYurt in the version v1.5. Please use --bootstrap-file to bootstrap hub agent.")
+	fs.StringVar(&o.BootstrapFile, "bootstrap-file", o.BootstrapFile, "the bootstrap file for bootstrapping hub agent.")
 	fs.StringVar(&o.RootDir, "root-dir", o.RootDir, "directory path for managing hub agent files(pki, cache etc).")
 	fs.BoolVar(&o.Version, "version", o.Version, "print the version information.")
 	fs.BoolVar(&o.EnableProfiling, "profiling", o.EnableProfiling, "enable profiling via web interface host:port/debug/pprof/")

go.mod

@@ -26,7 +26,7 @@ require (
 	go.etcd.io/etcd/client/pkg/v3 v3.5.0
 	go.etcd.io/etcd/client/v3 v3.5.0
 	golang.org/x/sys v0.6.0
-	google.golang.org/grpc v1.40.0
+	google.golang.org/grpc v1.54.0
 	gopkg.in/cheggaaa/pb.v1 v1.0.28
 	gopkg.in/square/go-jose.v2 v2.6.0
 	k8s.io/api v0.22.3
@@ -64,15 +64,16 @@ require (
 )
 
 require (
-	cloud.google.com/go v0.81.0 // indirect
+	cloud.google.com/go/compute v1.15.1 // indirect
+	cloud.google.com/go/compute/metadata v0.2.3 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
 	github.com/BurntSushi/toml v0.4.1 // indirect
 	github.com/NYTimes/gziphandler v1.1.1 // indirect
 	github.com/PuerkitoBio/purell v1.1.1 // indirect
 	github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blang/semver v3.5.1+incompatible // indirect
-	github.com/cespare/xxhash/v2 v2.1.2 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/chai2010/gettext-go v0.0.0-20160711120539-c6fed771bfd5 // indirect
 	github.com/coreos/go-semver v0.3.0 // indirect
 	github.com/coreos/go-systemd/v22 v22.3.2 // indirect
@@ -89,7 +90,7 @@ require (
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/go-cmp v0.5.8 // indirect
+	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/googleapis/gnostic v0.5.5 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
@@ -114,6 +115,7 @@ require (
 	github.com/prometheus/common v0.37.0 // indirect
 	github.com/prometheus/procfs v0.8.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/spf13/afero v1.6.0 // indirect
 	github.com/stretchr/objx v0.5.0 // indirect
 	github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae // indirect
 	go.opentelemetry.io/contrib v0.20.0 // indirect
@@ -131,15 +133,15 @@ require (
 	go.uber.org/multierr v1.6.0 // indirect
 	go.uber.org/zap v1.24.0 // indirect
 	golang.org/x/crypto v0.5.0 // indirect
-	golang.org/x/net v0.7.0 // indirect
+	golang.org/x/net v0.8.0 // indirect
 	golang.org/x/oauth2 v0.5.0 // indirect
 	golang.org/x/sync v0.1.0 // indirect
-	golang.org/x/term v0.5.0 // indirect
-	golang.org/x/text v0.7.0 // indirect
+	golang.org/x/term v0.6.0 // indirect
+	golang.org/x/text v0.8.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c // indirect
+	google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f // indirect
 	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.66.2 // indirect