Skip to content

Commit

Permalink
fix: update projected
Browse files Browse the repository at this point in the history 
Signed-off-by: renxiangyu <[email protected]>
  • Loading branch information
renxiangyu committed Feb 4, 2024
1 parent b592590 commit b151353
Showing 1 changed file with 107 additions and 58 deletions.
165 changes: 107 additions & 58 deletions pkg/clustertree/cluster-manager/controllers/pod/root_pod_controller.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -559,73 +559,122 @@ func (r *RootPodReconciler) changeToMasterCoreDNS(ctx context.Context, pod *core
}
}

// projectedHandler Process the project volume, creating and mounting secret, configmap, DownwardAPI,
// createProjectedHandler Process the project volume, creating and mounting secret, configmap, DownwardAPI,
// and ServiceAccountToken from the project volume in the member cluster to the pod of the host cluster
func (r *RootPodReconciler) projectedHandler(ctx context.Context, lr *leafUtils.LeafResource, pod *corev1.Pod) {
func (r *RootPodReconciler) createProjectedHandler(ctx context.Context, lr *leafUtils.LeafResource, pod *corev1.Pod) {
if pod.Spec.Volumes == nil {
return
}

for _, volume := range pod.Spec.Volumes {
if volume.Projected != nil {
falseValue := false
pod.Spec.AutomountServiceAccountToken = &falseValue

saName := pod.Spec.ServiceAccountName
var sources []corev1.VolumeProjection

for _, projectedVolumeSource := range volume.Projected.Sources {
// Process all resources for the rootpod
if projectedVolumeSource.ServiceAccountToken != nil {
tokenSecretName, err := r.createSATokenInLeafCluster(ctx, lr, saName, pod)
if err != nil {
klog.Errorf("[convertAuth] create sa secret failed, ns: %s, pod: %s, err: %s", pod.Namespace, pod.Name, err)
return
}
secretProjection := corev1.VolumeProjection{
Secret: &corev1.SecretProjection{
Items: []corev1.KeyToPath{
{
Key: "token",
Path: projectedVolumeSource.ServiceAccountToken.Path,
},
},
},
}
secretProjection.Secret.Name = tokenSecretName
sources = append(sources, secretProjection)
}
if projectedVolumeSource.ConfigMap != nil {
cmName, err := r.createConfigMapInLeafCluster(ctx, lr, projectedVolumeSource.ConfigMap.Name, pod)
if err != nil {
klog.Errorf("[convertAuth] create configmap failed, ns: %s, cm: %s, err: %s", pod.Namespace, cmName, err)
return
}
cmDeepCopy := projectedVolumeSource.DeepCopy()
cmDeepCopy.ConfigMap.Name = cmName
sources = append(sources, *cmDeepCopy)
}
if projectedVolumeSource.Secret != nil {
Secret := projectedVolumeSource.Secret
seName, err := r.createSecretInLeafCluster(ctx, lr, Secret.Name, pod)
if err != nil {
klog.Errorf("[convertAuth] create secret failed, ns: %s, cm: %s, err: %s", pod.Namespace, seName, err)
return
}
secretDeepCopy := projectedVolumeSource.DeepCopy()
secretDeepCopy.Secret.Name = seName
sources = append(sources, *secretDeepCopy)
}
if projectedVolumeSource.DownwardAPI != nil {
DownwardAPIProjection := corev1.VolumeProjection{
DownwardAPI: projectedVolumeSource.DownwardAPI,
}
sources = append(sources, DownwardAPIProjection)
if sources := r.projectedHandler(ctx, lr, volume, pod); sources != nil {
volume.Projected.Sources = sources
}
}
}
}

// updateProjectedHandler update projected volume
func (r *RootPodReconciler) updateProjectedHandler(ctx context.Context, lr *leafUtils.LeafResource, rootPod, podCopy *corev1.Pod) {
if rootPod.Spec.Volumes == nil {
return
}
var leafPodVolumes []corev1.Volume
if podCopy.Spec.Volumes == nil {
leafPodVolumes = nil
} else {
leafPodVolumes = podCopy.Spec.Volumes
}

var volumeCopy []corev1.Volume

for _, volume := range rootPod.Spec.Volumes {
if volume.Projected != nil {
if _, flag := findVolumeInClient(volume, leafPodVolumes); !flag {
if sources := r.projectedHandler(ctx, lr, volume, podCopy); sources != nil {
volume.Projected.Sources = sources
}
}
volume.Projected.Sources = sources
}
volumeCopy = append(volumeCopy, volume)
}
podCopy.Spec.Volumes = volumeCopy
}

func (r *RootPodReconciler) projectedHandler(ctx context.Context, lr *leafUtils.LeafResource, volume corev1.Volume, pod *corev1.Pod) []corev1.VolumeProjection {
falseValue := false
pod.Spec.AutomountServiceAccountToken = &falseValue

saName := pod.Spec.ServiceAccountName
var sources []corev1.VolumeProjection

for _, projectedVolumeSource := range volume.Projected.Sources {
// Process all resources for the rootpod
if projectedVolumeSource.ServiceAccountToken != nil {
tokenSecretName, err := r.createSATokenInLeafCluster(ctx, lr, saName, pod)
if err != nil {
klog.Errorf("[convertAuth] create sa secret failed, ns: %s, pod: %s, err: %s", pod.Namespace, pod.Name, err)
return nil
}
secretProjection := corev1.VolumeProjection{
Secret: &corev1.SecretProjection{
Items: []corev1.KeyToPath{
{
Key: "token",
Path: projectedVolumeSource.ServiceAccountToken.Path,
},
},
},
}
secretProjection.Secret.Name = tokenSecretName
sources = append(sources, secretProjection)
}
if projectedVolumeSource.ConfigMap != nil {
cmName, err := r.createConfigMapInLeafCluster(ctx, lr, projectedVolumeSource.ConfigMap.Name, pod)
if err != nil {
klog.Errorf("[convertAuth] create configmap failed, ns: %s, cm: %s, err: %s", pod.Namespace, cmName, err)
return nil
}
cmDeepCopy := projectedVolumeSource.DeepCopy()
cmDeepCopy.ConfigMap.Name = cmName
sources = append(sources, *cmDeepCopy)
}
if projectedVolumeSource.Secret != nil {
Secret := projectedVolumeSource.Secret
seName, err := r.createSecretInLeafCluster(ctx, lr, Secret.Name, pod)
if err != nil {
klog.Errorf("[convertAuth] create secret failed, ns: %s, cm: %s, err: %s", pod.Namespace, seName, err)
return nil
}
secretDeepCopy := projectedVolumeSource.DeepCopy()
secretDeepCopy.Secret.Name = seName
sources = append(sources, *secretDeepCopy)
}
if projectedVolumeSource.DownwardAPI != nil {
DownwardAPIProjection := corev1.VolumeProjection{
DownwardAPI: projectedVolumeSource.DownwardAPI,
}
sources = append(sources, DownwardAPIProjection)
}
}
return sources
}

func findVolumeInClient(volumeInRoot corev1.Volume, volumes []corev1.Volume) (corev1.Volume, bool) {
if volumes == nil {
return corev1.Volume{}, false
}

for _, volume := range volumes {
if volume.Projected != nil && volume.Name == volumeInRoot.Name {
if reflect.DeepEqual(volume.Projected, volumeInRoot.Projected) {
return volume, true
}
}
}

return corev1.Volume{}, false
}

// createServiceAccountInLeafCluster Create an sa corresponding to token-secret in member cluster
Expand Down Expand Up @@ -881,7 +930,7 @@ func (r *RootPodReconciler) CreatePodInLeafCluster(ctx context.Context, lr *leaf
klog.V(4).Infof("Creating Volumes successed %+v", basicPod)
}

r.projectedHandler(ctx, lr, basicPod)
r.createProjectedHandler(ctx, lr, basicPod)

if !r.Options.MultiClusterService {
r.changeToMasterCoreDNS(ctx, basicPod, r.Options)
Expand Down Expand Up @@ -922,7 +971,7 @@ func (r *RootPodReconciler) UpdatePodInLeafCluster(ctx context.Context, lr *leaf
return nil
}

r.projectedHandler(ctx, lr, podCopy)
r.updateProjectedHandler(ctx, lr, rootPod, podCopy)

if !r.Options.MultiClusterService {
r.changeToMasterCoreDNS(ctx, podCopy, r.Options)
Expand Down

0 comments on commit b151353

Please sign in to comment.