fix: update projected

Signed-off-by: renxiangyu <[email protected]>
rxy0210 · Feb 1, 2024 · f78d534 · f78d534
1 parent b592590
commit f78d534
Showing 1 changed file with 102 additions and 58 deletions.
diff --git a/pkg/clustertree/cluster-manager/controllers/pod/root_pod_controller.go b/pkg/clustertree/cluster-manager/controllers/pod/root_pod_controller.go
@@ -559,73 +559,117 @@ func (r *RootPodReconciler) changeToMasterCoreDNS(ctx context.Context, pod *core
 	}
 }
 
-// projectedHandler Process the project volume, creating and mounting secret, configmap, DownwardAPI,
+// createProjectedHandler Process the project volume, creating and mounting secret, configmap, DownwardAPI,
 // and ServiceAccountToken from the project volume in the member cluster to the pod of the host cluster
-func (r *RootPodReconciler) projectedHandler(ctx context.Context, lr *leafUtils.LeafResource, pod *corev1.Pod) {
+func (r *RootPodReconciler) createProjectedHandler(ctx context.Context, lr *leafUtils.LeafResource, pod *corev1.Pod) {
 	if pod.Spec.Volumes == nil {
 		return
 	}
 
 	for _, volume := range pod.Spec.Volumes {
 		if volume.Projected != nil {
-			falseValue := false
-			pod.Spec.AutomountServiceAccountToken = &falseValue
-
-			saName := pod.Spec.ServiceAccountName
-			var sources []corev1.VolumeProjection
-
-			for _, projectedVolumeSource := range volume.Projected.Sources {
-				// Process all resources for the rootpod
-				if projectedVolumeSource.ServiceAccountToken != nil {
-					tokenSecretName, err := r.createSATokenInLeafCluster(ctx, lr, saName, pod)
-					if err != nil {
-						klog.Errorf("[convertAuth] create sa secret failed, ns: %s, pod: %s, err: %s", pod.Namespace, pod.Name, err)
-						return
-					}
-					secretProjection := corev1.VolumeProjection{
-						Secret: &corev1.SecretProjection{
-							Items: []corev1.KeyToPath{
-								{
-									Key:  "token",
-									Path: projectedVolumeSource.ServiceAccountToken.Path,
-								},
-							},
-						},
-					}
-					secretProjection.Secret.Name = tokenSecretName
-					sources = append(sources, secretProjection)
-				}
-				if projectedVolumeSource.ConfigMap != nil {
-					cmName, err := r.createConfigMapInLeafCluster(ctx, lr, projectedVolumeSource.ConfigMap.Name, pod)
-					if err != nil {
-						klog.Errorf("[convertAuth] create configmap failed, ns: %s, cm: %s, err: %s", pod.Namespace, cmName, err)
-						return
-					}
-					cmDeepCopy := projectedVolumeSource.DeepCopy()
-					cmDeepCopy.ConfigMap.Name = cmName
-					sources = append(sources, *cmDeepCopy)
-				}
-				if projectedVolumeSource.Secret != nil {
-					Secret := projectedVolumeSource.Secret
-					seName, err := r.createSecretInLeafCluster(ctx, lr, Secret.Name, pod)
-					if err != nil {
-						klog.Errorf("[convertAuth] create secret failed, ns: %s, cm: %s, err: %s", pod.Namespace, seName, err)
-						return
-					}
-					secretDeepCopy := projectedVolumeSource.DeepCopy()
-					secretDeepCopy.Secret.Name = seName
-					sources = append(sources, *secretDeepCopy)
-				}
-				if projectedVolumeSource.DownwardAPI != nil {
-					DownwardAPIProjection := corev1.VolumeProjection{
-						DownwardAPI: projectedVolumeSource.DownwardAPI,
-					}
-					sources = append(sources, DownwardAPIProjection)
+			if sources := r.projectedHandler(ctx, lr, &volume, pod); sources != nil {
+				volume.Projected.Sources = sources
+			}
+		}
+	}
+}
+
+// updateProjectedHandler update projected volume
+func (r *RootPodReconciler) updateProjectedHandler(ctx context.Context, lr *leafUtils.LeafResource, rootPod, podCopy *corev1.Pod) {
+	if rootPod.Spec.Volumes == nil {
+		return
+	}
+	if podCopy.Spec.Volumes == nil {
+		return
+	}
+
+	leafPodVolumes := podCopy.Spec.Volumes
+
+	var volumeCopy []corev1.Volume
+
+	for _, volume := range rootPod.Spec.Volumes {
+		if volume.Projected != nil {
+			if _, flag := findVolumeInClient(volume, leafPodVolumes); !flag {
+				if sources := r.projectedHandler(ctx, lr, &volume, podCopy); sources != nil {
+					volume.Projected.Sources = sources
 				}
 			}
-			volume.Projected.Sources = sources
 		}
+		volumeCopy = append(volumeCopy, volume)
 	}
+	leafPodVolumes = volumeCopy
+}
+
+func (r *RootPodReconciler) projectedHandler(ctx context.Context, lr *leafUtils.LeafResource, volume *corev1.Volume, pod *corev1.Pod) []corev1.VolumeProjection {
+	falseValue := false
+	pod.Spec.AutomountServiceAccountToken = &falseValue
+
+	saName := pod.Spec.ServiceAccountName
+	var sources []corev1.VolumeProjection
+
+	for _, projectedVolumeSource := range volume.Projected.Sources {
+		// Process all resources for the rootpod
+		if projectedVolumeSource.ServiceAccountToken != nil {
+			tokenSecretName, err := r.createSATokenInLeafCluster(ctx, lr, saName, pod)
+			if err != nil {
+				klog.Errorf("[convertAuth] create sa secret failed, ns: %s, pod: %s, err: %s", pod.Namespace, pod.Name, err)
+				return nil
+			}
+			secretProjection := corev1.VolumeProjection{
+				Secret: &corev1.SecretProjection{
+					Items: []corev1.KeyToPath{
+						{
+							Key:  "token",
+							Path: projectedVolumeSource.ServiceAccountToken.Path,
+						},
+					},
+				},
+			}
+			secretProjection.Secret.Name = tokenSecretName
+			sources = append(sources, secretProjection)
+		}
+		if projectedVolumeSource.ConfigMap != nil {
+			cmName, err := r.createConfigMapInLeafCluster(ctx, lr, projectedVolumeSource.ConfigMap.Name, pod)
+			if err != nil {
+				klog.Errorf("[convertAuth] create configmap failed, ns: %s, cm: %s, err: %s", pod.Namespace, cmName, err)
+				return nil
+			}
+			cmDeepCopy := projectedVolumeSource.DeepCopy()
+			cmDeepCopy.ConfigMap.Name = cmName
+			sources = append(sources, *cmDeepCopy)
+		}
+		if projectedVolumeSource.Secret != nil {
+			Secret := projectedVolumeSource.Secret
+			seName, err := r.createSecretInLeafCluster(ctx, lr, Secret.Name, pod)
+			if err != nil {
+				klog.Errorf("[convertAuth] create secret failed, ns: %s, cm: %s, err: %s", pod.Namespace, seName, err)
+				return nil
+			}
+			secretDeepCopy := projectedVolumeSource.DeepCopy()
+			secretDeepCopy.Secret.Name = seName
+			sources = append(sources, *secretDeepCopy)
+		}
+		if projectedVolumeSource.DownwardAPI != nil {
+			DownwardAPIProjection := corev1.VolumeProjection{
+				DownwardAPI: projectedVolumeSource.DownwardAPI,
+			}
+			sources = append(sources, DownwardAPIProjection)
+		}
+	}
+	return sources
+}
+
+func findVolumeInClient(volumeInRoot corev1.Volume, volumes []corev1.Volume) (corev1.Volume, bool) {
+	for _, volume := range volumes {
+		if volume.Projected != nil && volume.Name == volumeInRoot.Name {
+			if reflect.DeepEqual(volume.Projected, volumeInRoot.Projected) {
+				return volume, true
+			}
+		}
+	}
+
+	return corev1.Volume{}, false
 }
 
 // createServiceAccountInLeafCluster Create an sa corresponding to token-secret in member cluster
@@ -881,7 +925,7 @@ func (r *RootPodReconciler) CreatePodInLeafCluster(ctx context.Context, lr *leaf
 		klog.V(4).Infof("Creating Volumes successed %+v", basicPod)
 	}
 
-	r.projectedHandler(ctx, lr, basicPod)
+	r.createProjectedHandler(ctx, lr, basicPod)
 
 	if !r.Options.MultiClusterService {
 		r.changeToMasterCoreDNS(ctx, basicPod, r.Options)
@@ -922,7 +966,7 @@ func (r *RootPodReconciler) UpdatePodInLeafCluster(ctx context.Context, lr *leaf
 		return nil
 	}
 
-	r.projectedHandler(ctx, lr, podCopy)
+	r.updateProjectedHandler(ctx, lr, rootPod, podCopy)
 
 	if !r.Options.MultiClusterService {
 		r.changeToMasterCoreDNS(ctx, podCopy, r.Options)