refine tenant api

Signed-off-by: hongming <talonwan@yunify.com>

pkg/controller/namespace/namespace_controller.go

@@ -0,0 +1,436 @@
+/*
+
+ Copyright 2019 The KubeSphere Authors.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/
+
+package namespace
+
+import (
+	"context"
+	"fmt"
+	"github.com/golang/glog"
+	corev1 "k8s.io/api/core/v1"
+	rbac "k8s.io/api/rbac/v1"
+	"k8s.io/api/storage/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/kubernetes/pkg/apis/core"
+	"kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha1"
+	"kubesphere.io/kubesphere/pkg/constants"
+	"kubesphere.io/kubesphere/pkg/simple/client/openpitrix"
+	"kubesphere.io/kubesphere/pkg/utils/k8sutil"
+	"reflect"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+	logf "sigs.k8s.io/controller-runtime/pkg/runtime/log"
+	"sigs.k8s.io/controller-runtime/pkg/source"
+)
+
+var (
+	log          = logf.Log.WithName("controller")
+	defaultRoles = []rbac.Role{
+		{ObjectMeta: metav1.ObjectMeta{Name: "admin"}, Rules: []rbac.PolicyRule{{Verbs: []string{"*"}, APIGroups: []string{"*"}, Resources: []string{"*"}}}},
+		{ObjectMeta: metav1.ObjectMeta{Name: "operator"}, Rules: []rbac.PolicyRule{{Verbs: []string{"get", "list", "watch"}, APIGroups: []string{"*"}, Resources: []string{"*"}},
+			{Verbs: []string{"*"}, APIGroups: []string{"", "apps", "extensions", "batch", "logging.kubesphere.io", "monitoring.kubesphere.io", "iam.kubesphere.io", "resources.kubesphere.io", "autoscaling"}, Resources: []string{"*"}}}},
+		{ObjectMeta: metav1.ObjectMeta{Name: "viewer"}, Rules: []rbac.PolicyRule{{Verbs: []string{"get", "list", "watch"}, APIGroups: []string{"*"}, Resources: []string{"*"}}}},
+	}
+)
+
+/**
+* USER ACTION REQUIRED: This is a scaffold file intended for the user to modify with their own Controller
+* business logic.  Delete these comments after modifying this file.*
+ */
+
+// Add creates a new Namespace Controller and adds it to the Manager with default RBAC. The Manager will set fields on the Controller
+// and Start it when the Manager is Started.
+func Add(mgr manager.Manager) error {
+	return add(mgr, newReconciler(mgr))
+}
+
+// newReconciler returns a new reconcile.Reconciler
+func newReconciler(mgr manager.Manager) reconcile.Reconciler {
+	return &ReconcileNamespace{Client: mgr.GetClient(), scheme: mgr.GetScheme()}
+}
+
+// add adds a new Controller to mgr with r as the reconcile.Reconciler
+func add(mgr manager.Manager, r reconcile.Reconciler) error {
+	// Create a new controller
+	c, err := controller.New("namespace-controller", mgr, controller.Options{Reconciler: r})
+	if err != nil {
+		return err
+	}
+
+	// Watch for changes to Namespace
+	err = c.Watch(&source.Kind{Type: &corev1.Namespace{}}, &handler.EnqueueRequestForObject{})
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+var _ reconcile.Reconciler = &ReconcileNamespace{}
+
+// ReconcileNamespace reconciles a Namespace object
+type ReconcileNamespace struct {
+	client.Client
+	scheme *runtime.Scheme
+}
+
+// Reconcile reads that state of the cluster for a Namespace object and makes changes based on the state read
+// and what is in the Namespace.Spec
+// +kubebuilder:rbac:groups=core.kubesphere.io,resources=namespaces,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=core.kubesphere.io,resources=namespaces/status,verbs=get;update;patch
+func (r *ReconcileNamespace) Reconcile(request reconcile.Request) (reconcile.Result, error) {
+	// Fetch the Namespace instance
+	instance := &corev1.Namespace{}
+	err := r.Get(context.TODO(), request.NamespacedName, instance)
+	if err != nil {
+		if errors.IsNotFound(err) {
+			// Object not found, return.  Created objects are automatically garbage collected.
+			// For additional cleanup logic use finalizers.
+			return reconcile.Result{}, nil
+		}
+		// Error reading the object - requeue the request.
+		return reconcile.Result{}, err
+	}
+
+	if !instance.ObjectMeta.DeletionTimestamp.IsZero() {
+		// The object is being deleted
+		if err := r.deleteRuntime(instance); err != nil {
+			// if fail to delete the external dependency here, return with error
+			// so that it can be retried
+			return reconcile.Result{}, err
+		}
+
+		return reconcile.Result{}, nil
+	}
+
+	workspaceName := instance.Labels[constants.WorkspaceLabelKey]
+
+	// delete default role bindings
+	if workspaceName == "" {
+		adminBinding := &rbac.RoleBinding{}
+		adminBinding.Name = "admin"
+		adminBinding.Namespace = instance.Name
+		log.Info("Deleting default role binding", "namespace", instance.Name, "name", adminBinding.Name)
+		err := r.Delete(context.TODO(), adminBinding)
+		if err != nil && !errors.IsNotFound(err) {
+			return reconcile.Result{}, err
+		}
+		viewerBinding := &rbac.RoleBinding{}
+		viewerBinding.Name = "viewer"
+		viewerBinding.Namespace = instance.Name
+		log.Info("Deleting default role binding", "namespace", instance.Name, "name", viewerBinding.Name)
+		err = r.Delete(context.TODO(), viewerBinding)
+		if err != nil && !errors.IsNotFound(err) {
+			return reconcile.Result{}, err
+		}
+		return reconcile.Result{}, nil
+	}
+
+	if err = r.checkAndBindWorkspace(instance); err != nil {
+		return reconcile.Result{}, err
+	}
+
+	if err = r.checkAndCreateRoles(instance); err != nil {
+		return reconcile.Result{}, err
+	}
+
+	if err = r.checkAndCreateRoleBindings(instance); err != nil {
+		return reconcile.Result{}, err
+	}
+
+	if err = r.checkAndCreateCephSecret(instance); err != nil {
+		return reconcile.Result{}, err
+	}
+
+	if err := r.checkAndCreateRuntime(instance); err != nil {
+		return reconcile.Result{}, err
+	}
+
+	return reconcile.Result{}, nil
+}
+
+// Create default roles
+func (r *ReconcileNamespace) checkAndCreateRoles(namespace *corev1.Namespace) error {
+	for _, role := range defaultRoles {
+		found := &rbac.Role{}
+		err := r.Get(context.TODO(), types.NamespacedName{Namespace: namespace.Name, Name: role.Name}, found)
+		if err != nil {
+			if errors.IsNotFound(err) {
+				role := role.DeepCopy()
+				role.Namespace = namespace.Name
+				log.Info("Creating default role", "namespace", namespace.Name, "role", role.Name)
+				err = r.Create(context.TODO(), role)
+				if err != nil {
+					return err
+				}
+			}
+			return err
+		}
+	}
+	return nil
+}
+
+func (r *ReconcileNamespace) checkAndCreateRoleBindings(namespace *corev1.Namespace) error {
+
+	workspaceName := namespace.Labels[constants.WorkspaceLabelKey]
+	creatorName := namespace.Labels[constants.CreatorLabelKey]
+
+	creator := rbac.Subject{APIGroup: "rbac.authorization.k8s.io", Kind: "User", Name: creatorName}
+
+	workspaceAdminBinding := &rbac.ClusterRoleBinding{}
+
+	err := r.Get(context.TODO(), types.NamespacedName{Name: fmt.Sprintf("workspace:%s:admin", workspaceName)}, workspaceAdminBinding)
+
+	if err != nil {
+		return err
+	}
+
+	adminBinding := &rbac.RoleBinding{}
+	adminBinding.Name = "admin"
+	adminBinding.Namespace = namespace.Name
+	adminBinding.RoleRef = rbac.RoleRef{Name: "admin", APIGroup: "rbac.authorization.k8s.io", Kind: "Role"}
+	adminBinding.Subjects = workspaceAdminBinding.Subjects
+
+	if creator.Name != "" {
+		if adminBinding.Subjects == nil {
+			adminBinding.Subjects = make([]rbac.Subject, 0)
+		}
+		if !k8sutil.ContainsUser(adminBinding.Subjects, creatorName) {
+			adminBinding.Subjects = append(adminBinding.Subjects, creator)
+		}
+	}
+
+	found := &rbac.RoleBinding{}
+
+	err = r.Get(context.TODO(), types.NamespacedName{Namespace: namespace.Name, Name: adminBinding.Name}, found)
+
+	if errors.IsNotFound(err) {
+		log.Info("Creating default role binding", "namespace", namespace.Name, "name", adminBinding.Name)
+		err = r.Create(context.TODO(), adminBinding)
+		if err != nil {
+			return err
+		}
+	} else if err != nil {
+		return err
+	}
+
+	if !reflect.DeepEqual(found.RoleRef, adminBinding.RoleRef) {
+		log.Info("Deleting conflict role binding", "namespace", namespace.Name, "name", adminBinding.Name)
+		err = r.Delete(context.TODO(), found)
+		if err != nil {
+			return err
+		}
+		return fmt.Errorf("conflict role binding %s.%s, waiting for recreate", namespace.Name, adminBinding.Name)
+	}
+
+	if !reflect.DeepEqual(found.Subjects, adminBinding.Subjects) {
+		found.Subjects = adminBinding.Subjects
+		log.Info("Updating role binding", "namespace", namespace.Name, "name", adminBinding.Name)
+		err = r.Update(context.TODO(), found)
+		if err != nil {
+			return err
+		}
+	}
+
+	workspaceViewerBinding := &rbac.ClusterRoleBinding{}
+
+	err = r.Get(context.TODO(), types.NamespacedName{Name: fmt.Sprintf("workspace:%s:viewer", workspaceName)}, workspaceViewerBinding)
+
+	if err != nil {
+		return err
+	}
+
+	viewerBinding := &rbac.RoleBinding{}
+	viewerBinding.Name = "viewer"
+	viewerBinding.Namespace = namespace.Name
+	viewerBinding.RoleRef = rbac.RoleRef{Name: "viewer", APIGroup: "rbac.authorization.k8s.io", Kind: "Role"}
+	viewerBinding.Subjects = workspaceViewerBinding.Subjects
+
+	err = r.Get(context.TODO(), types.NamespacedName{Namespace: namespace.Name, Name: viewerBinding.Name}, found)
+
+	if errors.IsNotFound(err) {
+		log.Info("Creating default role binding", "namespace", namespace.Name, "name", viewerBinding.Name)
+		err = r.Create(context.TODO(), viewerBinding)
+		if err != nil {
+			return err
+		}
+	} else if err != nil {
+		return err
+	}
+
+	if !reflect.DeepEqual(found.RoleRef, viewerBinding.RoleRef) {
+		log.Info("Deleting conflict role binding", "namespace", namespace.Name, "name", viewerBinding.Name)
+		err = r.Delete(context.TODO(), found)
+		if err != nil {
+			return err
+		}
+		return fmt.Errorf("conflict role binding %s.%s, waiting for recreate", namespace.Name, viewerBinding.Name)
+	}
+
+	if !reflect.DeepEqual(found.Subjects, viewerBinding.Subjects) {
+		found.Subjects = viewerBinding.Subjects
+		log.Info("Updating role binding", "namespace", namespace.Name, "name", viewerBinding.Name)
+		err = r.Update(context.TODO(), found)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// Create openpitrix runtime
+func (r *ReconcileNamespace) checkAndCreateRuntime(namespace *corev1.Namespace) error {
+
+	if runtimeId := namespace.Annotations[constants.OpenPitrixRuntimeAnnotationKey]; runtimeId != "" {
+		return nil
+	}
+
+	cm := &corev1.ConfigMap{}
+	err := r.Get(context.TODO(), types.NamespacedName{Namespace: constants.KubeSphereControlNamespace, Name: constants.AdminUserName}, cm)
+
+	if err != nil {
+		return err
+	}
+
+	runtime := &openpitrix.RunTime{Name: namespace.Name, Zone: namespace.Name, Provider: "kubernetes", RuntimeCredential: cm.Data["config"]}
+
+	log.Info("Creating openpitrix runtime", "namespace", namespace.Name)
+	if err := openpitrix.Client().CreateRuntime(runtime); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// Delete openpitrix runtime
+func (r *ReconcileNamespace) deleteRuntime(namespace *corev1.Namespace) error {
+
+	if runtimeId := namespace.Annotations[constants.OpenPitrixRuntimeAnnotationKey]; runtimeId != "" {
+		log.Info("Deleting openpitrix runtime", "namespace", namespace.Name, "runtime", runtimeId)
+		if err := openpitrix.Client().DeleteRuntime(runtimeId); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// Create openpitrix runtime
+func (r *ReconcileNamespace) checkAndBindWorkspace(namespace *corev1.Namespace) error {
+
+	workspaceName := namespace.Labels[constants.WorkspaceLabelKey]
+
+	if workspaceName == "" {
+		return nil
+	}
+
+	workspace := &v1alpha1.Workspace{}
+
+	err := r.Get(context.TODO(), types.NamespacedName{Name: workspaceName}, workspace)
+
+	if err != nil {
+		if errors.IsNotFound(err) {
+			log.Error(err, "namespace", namespace.Name)
+			delete(namespace.Labels, constants.WorkspaceLabelKey)
+			err = r.Update(context.TODO(), namespace)
+			if err != nil {
+				return err
+			}
+		}
+		return err
+	}
+
+	if !metav1.IsControlledBy(namespace, workspace) {
+		if err := controllerutil.SetControllerReference(workspace, namespace, r.scheme); err != nil {
+			return err
+		}
+		log.Info("Bind workspace", "namespace", namespace.Name, "workspace", workspaceName)
+		err = r.Update(context.TODO(), namespace)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+//Create Ceph secret in the new namespace
+func (r *ReconcileNamespace) checkAndCreateCephSecret(namespace *corev1.Namespace) error {
+
+	newNsName := namespace.Name
+	scList := &v1.StorageClassList{}
+	err := r.List(context.TODO(), &client.ListOptions{}, scList)
+	if err != nil {
+		return err
+	}
+	for _, sc := range scList.Items {
+		if sc.Provisioner == "kubernetes.io/rbd" {
+			log.Info("would create Ceph user secret in storage class %s at namespace %s", sc.GetName(), newNsName)
+			if secretName, ok := sc.Parameters["userSecretName"]; ok {
+				secret := &corev1.Secret{}
+				r.Get(context.TODO(), types.NamespacedName{Namespace: core.NamespaceSystem, Name: secretName}, secret)
+				if err != nil {
+					if errors.IsNotFound(err) {
+						log.Error(err, "cannot find secret in namespace %s, error: %s", core.NamespaceSystem, secretName)
+						continue
+					}
+					log.Error(err, fmt.Sprintf("failed to find secret in namespace %s", core.NamespaceSystem))
+					continue
+				}
+				glog.Infof("succeed to find secret %s in namespace %s", secret.GetName(), secret.GetNamespace())
+
+				newSecret := &corev1.Secret{
+					TypeMeta: metav1.TypeMeta{
+						Kind:       secret.Kind,
+						APIVersion: secret.APIVersion,
+					},
+					ObjectMeta: metav1.ObjectMeta{
+						Name:                       secret.GetName(),
+						Namespace:                  newNsName,
+						Labels:                     secret.GetLabels(),
+						Annotations:                secret.GetAnnotations(),
+						DeletionGracePeriodSeconds: secret.GetDeletionGracePeriodSeconds(),
+						ClusterName:                secret.GetClusterName(),
+					},
+					Data:       secret.Data,
+					StringData: secret.StringData,
+					Type:       secret.Type,
+				}
+				log.Info(fmt.Sprintf("creating secret %s in namespace %s...", newSecret.GetName(), newSecret.GetNamespace()))
+
+				err = r.Create(context.TODO(), newSecret)
+				if err != nil {
+					log.Error(err, fmt.Sprintf("failed to create secret in namespace %s", newSecret.GetNamespace()))
+					continue
+				}
+			} else {
+				log.Error(err, fmt.Sprintf("failed to find user secret name in storage class %s", sc.GetName()))
+			}
+		}
+	}
+
+	return nil
+}

pkg/controller/namespace/namespace_controller_suite_test.go

@@ -0,0 +1,77 @@
+/*
+
+ Copyright 2019 The KubeSphere Authors.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/
+
+package namespace
+
+import (
+	stdlog "log"
+	"os"
+	"path/filepath"
+	"sync"
+	"testing"
+
+	"github.com/onsi/gomega"
+	"k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/client-go/rest"
+	"kubesphere.io/kubesphere/pkg/apis"
+	"sigs.k8s.io/controller-runtime/pkg/envtest"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+)
+
+var cfg *rest.Config
+
+func TestMain(m *testing.M) {
+	t := &envtest.Environment{
+		CRDDirectoryPaths: []string{filepath.Join("..", "..", "..", "config", "crds")},
+	}
+	apis.AddToScheme(scheme.Scheme)
+
+	var err error
+	if cfg, err = t.Start(); err != nil {
+		stdlog.Fatal(err)
+	}
+
+	code := m.Run()
+	t.Stop()
+	os.Exit(code)
+}
+
+// SetupTestReconcile returns a reconcile.Reconcile implementation that delegates to inner and
+// writes the request to requests after Reconcile is finished.
+func SetupTestReconcile(inner reconcile.Reconciler) (reconcile.Reconciler, chan reconcile.Request) {
+	requests := make(chan reconcile.Request)
+	fn := reconcile.Func(func(req reconcile.Request) (reconcile.Result, error) {
+		result, err := inner.Reconcile(req)
+		requests <- req
+		return result, err
+	})
+	return fn, requests
+}
+
+// StartTestManager adds recFn
+func StartTestManager(mgr manager.Manager, g *gomega.GomegaWithT) (chan struct{}, *sync.WaitGroup) {
+	stop := make(chan struct{})
+	wg := &sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		g.Expect(mgr.Start(stop)).NotTo(gomega.HaveOccurred())
+	}()
+	return stop, wg
+}

pkg/controller/namespace/namespace_controller_test.go

@@ -0,0 +1,19 @@
+/*
+
+ Copyright 2019 The KubeSphere Authors.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/
+
+package namespace