feat: kubesphere 4.0 (#6115)
* feat: kubesphere 4.0 Signed-off-by: ci-bot <ci-bot@kubesphere.io> * feat: kubesphere 4.0 Signed-off-by: ci-bot <ci-bot@kubesphere.io> --------- Signed-off-by: ci-bot <ci-bot@kubesphere.io> Co-authored-by: ks-ci-bot <ks-ci-bot@example.com> Co-authored-by: joyceliu <joyceliu@yunify.com>
This commit is contained in:
KubeSphere CI Bot
committed by
GitHub
GitHub
parent
b5015ec7b9
commit
447a51f08b
@@ -1,18 +1,7 @@
|
||||
/*
|
||||
Copyright 2020 The KubeSphere Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
* Please refer to the LICENSE file in the root directory of the project.
|
||||
* https://github.com/kubesphere/kubesphere/blob/master/LICENSE
|
||||
*/
|
||||
|
||||
package serviceaccount
|
||||
|
||||
@@ -20,47 +9,42 @@ import (
|
||||
"context"
|
||||
"fmt"
|
||||
|
||||
kscontroller "kubesphere.io/kubesphere/pkg/controller"
|
||||
|
||||
"github.com/go-logr/logr"
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
rbacv1 "k8s.io/api/rbac/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
"k8s.io/client-go/tools/record"
|
||||
ctrl "sigs.k8s.io/controller-runtime"
|
||||
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
|
||||
|
||||
iamv1alpha2 "kubesphere.io/api/iam/v1alpha2"
|
||||
|
||||
controllerutils "kubesphere.io/kubesphere/pkg/controller/utils/controller"
|
||||
iamv1beta1 "kubesphere.io/api/iam/v1beta1"
|
||||
)
|
||||
|
||||
const (
|
||||
controllerName = "serviceaccount-controller"
|
||||
controllerName = "serviceaccount"
|
||||
)
|
||||
|
||||
var _ kscontroller.Controller = &Reconciler{}
|
||||
|
||||
// Reconciler reconciles a ServiceAccount object
|
||||
type Reconciler struct {
|
||||
client.Client
|
||||
logger logr.Logger
|
||||
recorder record.EventRecorder
|
||||
scheme *runtime.Scheme
|
||||
}
|
||||
|
||||
func (r *Reconciler) SetupWithManager(mgr ctrl.Manager) error {
|
||||
if r.Client == nil {
|
||||
r.Client = mgr.GetClient()
|
||||
}
|
||||
if r.logger.GetSink() == nil {
|
||||
r.logger = ctrl.Log.WithName("controllers").WithName(controllerName)
|
||||
}
|
||||
if r.scheme == nil {
|
||||
r.scheme = mgr.GetScheme()
|
||||
}
|
||||
if r.recorder == nil {
|
||||
r.recorder = mgr.GetEventRecorderFor(controllerName)
|
||||
}
|
||||
func (r *Reconciler) Name() string {
|
||||
return controllerName
|
||||
}
|
||||
|
||||
func (r *Reconciler) SetupWithManager(mgr *kscontroller.Manager) error {
|
||||
r.Client = mgr.GetClient()
|
||||
r.logger = ctrl.Log.WithName("controllers").WithName(controllerName)
|
||||
r.recorder = mgr.GetEventRecorderFor(controllerName)
|
||||
return ctrl.NewControllerManagedBy(mgr).
|
||||
Named(controllerName).
|
||||
For(&corev1.ServiceAccount{}).
|
||||
@@ -70,6 +54,7 @@ func (r *Reconciler) SetupWithManager(mgr ctrl.Manager) error {
|
||||
// +kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch;create;update;patch;delete
|
||||
// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles,verbs=get;list;watch
|
||||
// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=rolebindings,verbs=get;list;watch;create;update;patch;delete
|
||||
|
||||
func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
|
||||
logger := r.logger.WithValues("serivceaccount", req.NamespacedName)
|
||||
// ctx := context.Background()
|
||||
@@ -78,18 +63,18 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
|
||||
return ctrl.Result{}, client.IgnoreNotFound(err)
|
||||
}
|
||||
|
||||
if _, ok := sa.Annotations[iamv1alpha2.RoleAnnotation]; ok && sa.ObjectMeta.DeletionTimestamp.IsZero() {
|
||||
if _, ok := sa.Annotations[iamv1beta1.RoleAnnotation]; ok && sa.ObjectMeta.DeletionTimestamp.IsZero() {
|
||||
if err := r.CreateOrUpdateRoleBinding(ctx, logger, sa); err != nil {
|
||||
r.recorder.Event(sa, corev1.EventTypeWarning, controllerutils.FailedSynced, err.Error())
|
||||
r.recorder.Event(sa, corev1.EventTypeWarning, kscontroller.Synced, err.Error())
|
||||
return ctrl.Result{}, err
|
||||
}
|
||||
r.recorder.Event(sa, corev1.EventTypeNormal, controllerutils.SuccessSynced, controllerutils.MessageResourceSynced)
|
||||
r.recorder.Event(sa, corev1.EventTypeNormal, kscontroller.Synced, kscontroller.MessageResourceSynced)
|
||||
}
|
||||
return ctrl.Result{}, nil
|
||||
}
|
||||
|
||||
func (r *Reconciler) CreateOrUpdateRoleBinding(ctx context.Context, logger logr.Logger, sa *corev1.ServiceAccount) error {
|
||||
roleName := sa.Annotations[iamv1alpha2.RoleAnnotation]
|
||||
roleName := sa.Annotations[iamv1beta1.RoleAnnotation]
|
||||
if roleName == "" {
|
||||
return nil
|
||||
}
|
||||
@@ -100,17 +85,17 @@ func (r *Reconciler) CreateOrUpdateRoleBinding(ctx context.Context, logger logr.
|
||||
|
||||
// Delete existing rolebindings.
|
||||
saRoleBinding := &rbacv1.RoleBinding{}
|
||||
_ = r.Client.DeleteAllOf(ctx, saRoleBinding, client.InNamespace(sa.Namespace), client.MatchingLabels{iamv1alpha2.ServiceAccountReferenceLabel: sa.Name})
|
||||
_ = r.Client.DeleteAllOf(ctx, saRoleBinding, client.InNamespace(sa.Namespace), client.MatchingLabels{iamv1beta1.ServiceAccountReferenceLabel: sa.Name})
|
||||
|
||||
saRoleBinding = &rbacv1.RoleBinding{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
GenerateName: fmt.Sprintf("%s-%s-", sa.Name, roleName),
|
||||
Labels: map[string]string{iamv1alpha2.ServiceAccountReferenceLabel: sa.Name},
|
||||
Labels: map[string]string{iamv1beta1.ServiceAccountReferenceLabel: sa.Name},
|
||||
Namespace: sa.Namespace,
|
||||
},
|
||||
RoleRef: rbacv1.RoleRef{
|
||||
APIGroup: rbacv1.GroupName,
|
||||
Kind: iamv1alpha2.ResourceKindRole,
|
||||
Kind: iamv1beta1.ResourceKindRole,
|
||||
Name: roleName,
|
||||
},
|
||||
Subjects: []rbacv1.Subject{
|
||||
@@ -122,7 +107,7 @@ func (r *Reconciler) CreateOrUpdateRoleBinding(ctx context.Context, logger logr.
|
||||
},
|
||||
}
|
||||
|
||||
if err := controllerutil.SetControllerReference(sa, saRoleBinding, r.scheme); err != nil {
|
||||
if err := controllerutil.SetControllerReference(sa, saRoleBinding, r.Scheme()); err != nil {
|
||||
logger.Error(err, "set controller reference failed")
|
||||
return err
|
||||
}
|
||||
|
||||
@@ -1,18 +1,7 @@
|
||||
/*
|
||||
Copyright 2019 The KubeSphere Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
* Please refer to the LICENSE file in the root directory of the project.
|
||||
* https://github.com/kubesphere/kubesphere/blob/master/LICENSE
|
||||
*/
|
||||
|
||||
package serviceaccount
|
||||
|
||||
@@ -20,7 +9,7 @@ import (
|
||||
"context"
|
||||
"testing"
|
||||
|
||||
. "github.com/onsi/ginkgo"
|
||||
. "github.com/onsi/ginkgo/v2"
|
||||
. "github.com/onsi/gomega"
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
rbacv1 "k8s.io/api/rbac/v1"
|
||||
@@ -33,7 +22,7 @@ import (
|
||||
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||
"sigs.k8s.io/controller-runtime/pkg/client/fake"
|
||||
|
||||
iamv1alpha2 "kubesphere.io/api/iam/v1alpha2"
|
||||
iamv1beta1 "kubesphere.io/api/iam/v1beta1"
|
||||
|
||||
"kubesphere.io/kubesphere/pkg/utils/k8sutil"
|
||||
)
|
||||
@@ -65,7 +54,7 @@ var _ = Describe("ServiceAccount", func() {
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: saName,
|
||||
Namespace: saNamespace,
|
||||
Annotations: map[string]string{iamv1alpha2.RoleAnnotation: saRole},
|
||||
Annotations: map[string]string{iamv1beta1.RoleAnnotation: saRole},
|
||||
},
|
||||
}
|
||||
req = ctrl.Request{
|
||||
@@ -86,9 +75,8 @@ var _ = Describe("ServiceAccount", func() {
|
||||
|
||||
reconciler := &Reconciler{
|
||||
//nolint:staticcheck
|
||||
Client: fake.NewFakeClientWithScheme(scheme.Scheme),
|
||||
logger: ctrl.Log.WithName("controllers").WithName("acrpullbinding-controller"),
|
||||
scheme: scheme.Scheme,
|
||||
Client: fake.NewClientBuilder().WithScheme(scheme.Scheme).Build(),
|
||||
logger: ctrl.Log.WithName("controllers").WithName("serviceaccount"),
|
||||
recorder: record.NewFakeRecorder(5),
|
||||
}
|
||||
|
||||
@@ -101,7 +89,7 @@ var _ = Describe("ServiceAccount", func() {
|
||||
By("Expecting to bind role successfully")
|
||||
rolebindings := &rbacv1.RoleBindingList{}
|
||||
Expect(func() bool {
|
||||
reconciler.List(ctx, rolebindings, client.InNamespace(sa.Namespace), client.MatchingLabels{iamv1alpha2.ServiceAccountReferenceLabel: sa.Name})
|
||||
reconciler.List(ctx, rolebindings, client.InNamespace(sa.Namespace), client.MatchingLabels{iamv1beta1.ServiceAccountReferenceLabel: sa.Name})
|
||||
return len(rolebindings.Items) == 1 && k8sutil.IsControlledBy(rolebindings.Items[0].OwnerReferences, "ServiceAccount", saName)
|
||||
}()).Should(BeTrue())
|
||||
})
|
||||
@@ -111,9 +99,8 @@ var _ = Describe("ServiceAccount", func() {
|
||||
|
||||
reconciler := &Reconciler{
|
||||
//nolint:staticcheck
|
||||
Client: fake.NewFakeClientWithScheme(scheme.Scheme),
|
||||
logger: ctrl.Log.WithName("controllers").WithName("acrpullbinding-controller"),
|
||||
scheme: scheme.Scheme,
|
||||
Client: fake.NewClientBuilder().WithScheme(scheme.Scheme).Build(),
|
||||
logger: ctrl.Log.WithName("controllers").WithName("serviceaccount"),
|
||||
recorder: record.NewFakeRecorder(5),
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user