refactor workspace controller

Signed-off-by: hongming <talonwan@yunify.com>

pkg/controller/workspacerole/workspacerole.go

@@ -1,412 +0,0 @@
-/*
-Copyright 2019 The KubeSphere Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package workspacerole
-
-import (
-	"encoding/json"
-	"fmt"
-	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-	"k8s.io/apimachinery/pkg/runtime"
-	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	"k8s.io/apimachinery/pkg/util/wait"
-	"k8s.io/client-go/kubernetes"
-	"k8s.io/client-go/kubernetes/scheme"
-	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
-	"k8s.io/client-go/tools/cache"
-	"k8s.io/client-go/tools/record"
-	"k8s.io/client-go/util/workqueue"
-	"k8s.io/klog"
-	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
-	kubesphere "kubesphere.io/kubesphere/pkg/client/clientset/versioned"
-	iamv1alpha2informers "kubesphere.io/kubesphere/pkg/client/informers/externalversions/iam/v1alpha2"
-	tenantv1alpha2informers "kubesphere.io/kubesphere/pkg/client/informers/externalversions/tenant/v1alpha2"
-	iamv1alpha2listers "kubesphere.io/kubesphere/pkg/client/listers/iam/v1alpha2"
-	tenantv1alpha2listers "kubesphere.io/kubesphere/pkg/client/listers/tenant/v1alpha2"
-	"kubesphere.io/kubesphere/pkg/constants"
-	"reflect"
-	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
-	"time"
-)
-
-const (
-	// SuccessSynced is used as part of the Event 'reason' when a Foo is synced
-	successSynced = "Synced"
-	// is synced successfully
-	messageResourceSynced = "WorkspaceRole synced successfully"
-	controllerName        = "workspacerole-controller"
-)
-
-type Controller struct {
-	scheme                          *runtime.Scheme
-	k8sClient                       kubernetes.Interface
-	ksClient                        kubesphere.Interface
-	workspaceRoleInformer           iamv1alpha2informers.WorkspaceRoleInformer
-	workspaceRoleLister             iamv1alpha2listers.WorkspaceRoleLister
-	workspaceRoleSynced             cache.InformerSynced
-	workspaceTemplateInformer       tenantv1alpha2informers.WorkspaceTemplateInformer
-	workspaceTemplateLister         tenantv1alpha2listers.WorkspaceTemplateLister
-	workspaceTemplateSynced         cache.InformerSynced
-	fedWorkspaceRoleCache           cache.Store
-	fedWorkspaceRoleCacheController cache.Controller
-	multiClusterEnabled             bool
-	// workqueue is a rate limited work queue. This is used to queue work to be
-	// processed instead of performing it as soon as a change happens. This
-	// means we can ensure we only process a fixed amount of resources at a
-	// time, and makes it easy to ensure we are never processing the same item
-	// simultaneously in two different workers.
-	workqueue workqueue.RateLimitingInterface
-	// recorder is an event recorder for recording Event resources to the
-	// Kubernetes API.
-	recorder record.EventRecorder
-}
-
-func NewController(k8sClient kubernetes.Interface, ksClient kubesphere.Interface, workspaceRoleInformer iamv1alpha2informers.WorkspaceRoleInformer,
-	fedWorkspaceRoleCache cache.Store, fedWorkspaceRoleCacheController cache.Controller, workspaceTemplateInformer tenantv1alpha2informers.WorkspaceTemplateInformer, multiClusterEnabled bool) *Controller {
-	// Create event broadcaster
-	// Add sample-controller types to the default Kubernetes Scheme so Events can be
-	// logged for sample-controller types.
-
-	klog.V(4).Info("Creating event broadcaster")
-	eventBroadcaster := record.NewBroadcaster()
-	eventBroadcaster.StartLogging(klog.Infof)
-	eventBroadcaster.StartRecordingToSink(&typedcorev1.EventSinkImpl{Interface: k8sClient.CoreV1().Events("")})
-	recorder := eventBroadcaster.NewRecorder(scheme.Scheme, corev1.EventSource{Component: controllerName})
-	ctl := &Controller{
-		k8sClient:                       k8sClient,
-		ksClient:                        ksClient,
-		workspaceRoleInformer:           workspaceRoleInformer,
-		workspaceRoleLister:             workspaceRoleInformer.Lister(),
-		workspaceRoleSynced:             workspaceRoleInformer.Informer().HasSynced,
-		fedWorkspaceRoleCache:           fedWorkspaceRoleCache,
-		fedWorkspaceRoleCacheController: fedWorkspaceRoleCacheController,
-		workspaceTemplateInformer:       workspaceTemplateInformer,
-		workspaceTemplateLister:         workspaceTemplateInformer.Lister(),
-		workspaceTemplateSynced:         workspaceTemplateInformer.Informer().HasSynced,
-		multiClusterEnabled:             multiClusterEnabled,
-		workqueue:                       workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "WorkspaceRole"),
-		recorder:                        recorder,
-	}
-	klog.Info("Setting up event handlers")
-	workspaceRoleInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
-		AddFunc: ctl.enqueueWorkspaceRole,
-		UpdateFunc: func(old, new interface{}) {
-			ctl.enqueueWorkspaceRole(new)
-		},
-		DeleteFunc: ctl.enqueueWorkspaceRole,
-	})
-	return ctl
-}
-
-func (c *Controller) Run(threadiness int, stopCh <-chan struct{}) error {
-	defer utilruntime.HandleCrash()
-	defer c.workqueue.ShutDown()
-
-	// Start the informer factories to begin populating the informer caches
-	klog.Info("Starting WorkspaceRole controller")
-
-	// Wait for the caches to be synced before starting workers
-	klog.Info("Waiting for informer caches to sync")
-
-	synced := make([]cache.InformerSynced, 0)
-	synced = append(synced, c.workspaceRoleSynced, c.workspaceTemplateSynced)
-	if c.multiClusterEnabled {
-		synced = append(synced, c.fedWorkspaceRoleCacheController.HasSynced)
-	}
-
-	if ok := cache.WaitForCacheSync(stopCh, synced...); !ok {
-		return fmt.Errorf("failed to wait for caches to sync")
-	}
-
-	klog.Info("Starting workers")
-	// Launch two workers to process Foo resources
-	for i := 0; i < threadiness; i++ {
-		go wait.Until(c.runWorker, time.Second, stopCh)
-	}
-
-	klog.Info("Started workers")
-	<-stopCh
-	klog.Info("Shutting down workers")
-	return nil
-}
-
-func (c *Controller) enqueueWorkspaceRole(obj interface{}) {
-	var key string
-	var err error
-	if key, err = cache.MetaNamespaceKeyFunc(obj); err != nil {
-		utilruntime.HandleError(err)
-		return
-	}
-	c.workqueue.Add(key)
-}
-
-func (c *Controller) runWorker() {
-	for c.processNextWorkItem() {
-	}
-}
-
-func (c *Controller) processNextWorkItem() bool {
-	obj, shutdown := c.workqueue.Get()
-
-	if shutdown {
-		return false
-	}
-
-	// We wrap this block in a func so we can defer c.workqueue.Done.
-	err := func(obj interface{}) error {
-		// We call Done here so the workqueue knows we have finished
-		// processing this item. We also must remember to call Forget if we
-		// do not want this work item being re-queued. For example, we do
-		// not call Forget if a transient error occurs, instead the item is
-		// put back on the workqueue and attempted again after a back-off
-		// period.
-		defer c.workqueue.Done(obj)
-		var key string
-		var ok bool
-		// We expect strings to come off the workqueue. These are of the
-		// form namespace/name. We do this as the delayed nature of the
-		// workqueue means the items in the informer cache may actually be
-		// more up to date that when the item was initially put onto the
-		// workqueue.
-		if key, ok = obj.(string); !ok {
-			// As the item in the workqueue is actually invalid, we call
-			// Forget here else we'd go into a loop of attempting to
-			// process a work item that is invalid.
-			c.workqueue.Forget(obj)
-			utilruntime.HandleError(fmt.Errorf("expected string in workqueue but got %#v", obj))
-			return nil
-		}
-		// Run the reconcile, passing it the namespace/name string of the
-		// Foo resource to be synced.
-		if err := c.reconcile(key); err != nil {
-			// Put the item back on the workqueue to handle any transient errors.
-			c.workqueue.AddRateLimited(key)
-			return fmt.Errorf("error syncing '%s': %s, requeuing", key, err.Error())
-		}
-		// Finally, if no error occurs we Forget this item so it does not
-		// get queued again until another change happens.
-		c.workqueue.Forget(obj)
-		klog.Infof("Successfully synced %s:%s", "key", key)
-		return nil
-	}(obj)
-
-	if err != nil {
-		utilruntime.HandleError(err)
-		return true
-	}
-
-	return true
-}
-
-// syncHandler compares the actual state with the desired, and attempts to
-// converge the two. It then updates the Status block of the Foo resource
-// with the current status of the resource.
-func (c *Controller) reconcile(key string) error {
-
-	workspaceRole, err := c.workspaceRoleLister.Get(key)
-	if err != nil {
-		// The user may no longer exist, in which case we stop
-		// processing.
-		if errors.IsNotFound(err) {
-			utilruntime.HandleError(fmt.Errorf("workspacerole '%s' in work queue no longer exists", key))
-			return nil
-		}
-		klog.Error(err)
-		return err
-	}
-
-	if err = c.bindWorkspace(workspaceRole); err != nil {
-		klog.Error(err)
-		return err
-	}
-
-	if c.multiClusterEnabled {
-		if err = c.multiClusterSync(workspaceRole); err != nil {
-			klog.Error(err)
-			return err
-		}
-	}
-
-	c.recorder.Event(workspaceRole, corev1.EventTypeNormal, successSynced, messageResourceSynced)
-	return nil
-}
-
-func (c *Controller) Start(stopCh <-chan struct{}) error {
-	return c.Run(4, stopCh)
-}
-
-func (c *Controller) bindWorkspace(workspaceRole *iamv1alpha2.WorkspaceRole) error {
-
-	workspaceName := workspaceRole.Labels[constants.WorkspaceLabelKey]
-
-	if workspaceName == "" {
-		return nil
-	}
-
-	workspace, err := c.workspaceTemplateLister.Get(workspaceName)
-
-	if err != nil {
-		// skip if workspace not found
-		if errors.IsNotFound(err) {
-			return nil
-		}
-		klog.Error(err)
-		return err
-	}
-
-	if !metav1.IsControlledBy(workspaceRole, workspace) {
-		workspaceRole.OwnerReferences = nil
-		if err := controllerutil.SetControllerReference(workspace, workspaceRole, scheme.Scheme); err != nil {
-			klog.Error(err)
-			return err
-		}
-		_, err = c.ksClient.IamV1alpha2().WorkspaceRoles().Update(workspaceRole)
-		if err != nil {
-			klog.Error(err)
-			return err
-		}
-	}
-	return nil
-}
-
-func (c *Controller) multiClusterSync(workspaceRole *iamv1alpha2.WorkspaceRole) error {
-
-	if err := c.ensureNotControlledByKubefed(workspaceRole); err != nil {
-		klog.Error(err)
-		return err
-	}
-
-	obj, exist, err := c.fedWorkspaceRoleCache.GetByKey(workspaceRole.Name)
-	if !exist {
-		return c.createFederatedWorkspaceRole(workspaceRole)
-	}
-	if err != nil {
-		klog.Error(err)
-		return err
-	}
-
-	var federatedWorkspaceRole iamv1alpha2.FederatedRole
-	if err = runtime.DefaultUnstructuredConverter.FromUnstructured(obj.(*unstructured.Unstructured).Object, &federatedWorkspaceRole); err != nil {
-		klog.Error(err)
-		return err
-	}
-
-	if !reflect.DeepEqual(federatedWorkspaceRole.Spec.Template.Rules, workspaceRole.Rules) ||
-		!reflect.DeepEqual(federatedWorkspaceRole.Spec.Template.Labels, workspaceRole.Labels) ||
-		!reflect.DeepEqual(federatedWorkspaceRole.Spec.Template.Annotations, workspaceRole.Annotations) {
-
-		federatedWorkspaceRole.Spec.Template.Rules = workspaceRole.Rules
-		federatedWorkspaceRole.Spec.Template.Annotations = workspaceRole.Annotations
-		federatedWorkspaceRole.Spec.Template.Labels = workspaceRole.Labels
-
-		return c.updateFederatedGlobalRole(&federatedWorkspaceRole)
-	}
-
-	return nil
-}
-
-func (c *Controller) createFederatedWorkspaceRole(workspaceRole *iamv1alpha2.WorkspaceRole) error {
-	federatedWorkspaceRole := &iamv1alpha2.FederatedRole{
-		TypeMeta: metav1.TypeMeta{
-			Kind:       iamv1alpha2.FedWorkspaceRoleKind,
-			APIVersion: iamv1alpha2.FedWorkspaceRoleResource.Group + "/" + iamv1alpha2.FedWorkspaceRoleResource.Version,
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			Name: workspaceRole.Name,
-		},
-		Spec: iamv1alpha2.FederatedRoleSpec{
-			Template: iamv1alpha2.RoleTemplate{
-				ObjectMeta: metav1.ObjectMeta{
-					Labels:      workspaceRole.Labels,
-					Annotations: workspaceRole.Annotations,
-				},
-				Rules: workspaceRole.Rules,
-			},
-			Placement: iamv1alpha2.Placement{
-				ClusterSelector: iamv1alpha2.ClusterSelector{},
-			},
-		},
-	}
-
-	err := controllerutil.SetControllerReference(workspaceRole, federatedWorkspaceRole, scheme.Scheme)
-	if err != nil {
-		return err
-	}
-
-	data, err := json.Marshal(federatedWorkspaceRole)
-	if err != nil {
-		return err
-	}
-
-	cli := c.k8sClient.(*kubernetes.Clientset)
-	err = cli.RESTClient().Post().
-		AbsPath(fmt.Sprintf("/apis/%s/%s/%s", iamv1alpha2.FedWorkspaceRoleResource.Group,
-			iamv1alpha2.FedWorkspaceRoleResource.Version, iamv1alpha2.FedWorkspaceRoleResource.Name)).
-		Body(data).
-		Do().Error()
-
-	if err != nil {
-		if errors.IsAlreadyExists(err) {
-			return nil
-		}
-		return err
-	}
-
-	return nil
-}
-
-func (c *Controller) updateFederatedGlobalRole(federatedWorkspaceRole *iamv1alpha2.FederatedRole) error {
-
-	data, err := json.Marshal(federatedWorkspaceRole)
-	if err != nil {
-		return err
-	}
-
-	cli := c.k8sClient.(*kubernetes.Clientset)
-
-	err = cli.RESTClient().Put().
-		AbsPath(fmt.Sprintf("/apis/%s/%s/%s/%s", iamv1alpha2.FedWorkspaceRoleResource.Group,
-			iamv1alpha2.FedWorkspaceRoleResource.Version, iamv1alpha2.FedWorkspaceRoleResource.Name,
-			federatedWorkspaceRole.Name)).
-		Body(data).
-		Do().Error()
-	if err != nil {
-		if errors.IsNotFound(err) {
-			return nil
-		}
-		return err
-	}
-
-	return nil
-}
-
-func (c *Controller) ensureNotControlledByKubefed(workspaceRole *iamv1alpha2.WorkspaceRole) error {
-	if workspaceRole.Labels[constants.KubefedManagedLabel] != "false" {
-		if workspaceRole.Labels == nil {
-			workspaceRole.Labels = make(map[string]string, 0)
-		}
-		workspaceRole = workspaceRole.DeepCopy()
-		workspaceRole.Labels[constants.KubefedManagedLabel] = "false"
-		_, err := c.ksClient.IamV1alpha2().WorkspaceRoles().Update(workspaceRole)
-		if err != nil {
-			klog.Error(err)
-		}
-	}
-	return nil
-}

pkg/controller/workspacerole/workspacerole_controller.go

@@ -0,0 +1,214 @@
+/*
+Copyright 2019 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package workspacerole
+
+import (
+	"context"
+	"github.com/go-logr/logr"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/client-go/tools/record"
+	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+	tenantv1alpha2 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha2"
+	typesv1beta1 "kubesphere.io/kubesphere/pkg/apis/types/v1beta1"
+	"kubesphere.io/kubesphere/pkg/constants"
+	controllerutils "kubesphere.io/kubesphere/pkg/controller/utils/controller"
+	"kubesphere.io/kubesphere/pkg/utils/k8sutil"
+	"reflect"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+)
+
+const (
+	controllerName = "workspacerole-controller"
+)
+
+// Reconciler reconciles a WorkspaceRole object
+type Reconciler struct {
+	client.Client
+	MultiClusterEnabled     bool
+	Logger                  logr.Logger
+	Scheme                  *runtime.Scheme
+	Recorder                record.EventRecorder
+	MaxConcurrentReconciles int
+}
+
+func (r *Reconciler) SetupWithManager(mgr ctrl.Manager) error {
+	if r.Client == nil {
+		r.Client = mgr.GetClient()
+	}
+	if r.Logger == nil {
+		r.Logger = ctrl.Log.WithName("controllers").WithName(controllerName)
+	}
+	if r.Scheme == nil {
+		r.Scheme = mgr.GetScheme()
+	}
+	if r.Recorder == nil {
+		r.Recorder = mgr.GetEventRecorderFor(controllerName)
+	}
+	if r.MaxConcurrentReconciles <= 0 {
+		r.MaxConcurrentReconciles = 1
+	}
+	return ctrl.NewControllerManagedBy(mgr).
+		Named(controllerName).
+		WithOptions(controller.Options{
+			MaxConcurrentReconciles: r.MaxConcurrentReconciles,
+		}).
+		For(&iamv1alpha2.WorkspaceRole{}).
+		Complete(r)
+}
+
+// +kubebuilder:rbac:groups=iam.kubesphere.io,resources=workspaceroles,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=types.kubefed.io,resources=federatedworkspaceroles,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=tenant.kubesphere.io,resources=workspaces,verbs=get;list;watch;
+func (r *Reconciler) Reconcile(req ctrl.Request) (ctrl.Result, error) {
+	logger := r.Logger.WithValues("workspacerole", req.NamespacedName)
+	rootCtx := context.Background()
+	workspaceRole := &iamv1alpha2.WorkspaceRole{}
+	err := r.Get(rootCtx, req.NamespacedName, workspaceRole)
+	if err != nil {
+		return ctrl.Result{}, client.IgnoreNotFound(err)
+	}
+
+	// controlled kubefed-controller-manager
+	if workspaceRole.Labels[constants.KubefedManagedLabel] == "true" {
+		return ctrl.Result{}, nil
+	}
+
+	if err := r.bindWorkspace(rootCtx, logger, workspaceRole); err != nil {
+		return ctrl.Result{}, err
+	}
+
+	if r.MultiClusterEnabled {
+		if err = r.multiClusterSync(rootCtx, logger, workspaceRole); err != nil {
+			return ctrl.Result{}, err
+		}
+	}
+
+	r.Recorder.Event(workspaceRole, corev1.EventTypeNormal, controllerutils.SuccessSynced, controllerutils.MessageResourceSynced)
+	return ctrl.Result{}, nil
+}
+
+func (r *Reconciler) bindWorkspace(ctx context.Context, logger logr.Logger, workspaceRole *iamv1alpha2.WorkspaceRole) error {
+	workspaceName := workspaceRole.Labels[constants.WorkspaceLabelKey]
+	if workspaceName == "" {
+		return nil
+	}
+	var workspace tenantv1alpha2.WorkspaceTemplate
+	if err := r.Get(ctx, types.NamespacedName{Name: workspaceName}, &workspace); err != nil {
+		return client.IgnoreNotFound(err)
+	}
+	if !metav1.IsControlledBy(workspaceRole, &workspace) {
+		workspaceRole = workspaceRole.DeepCopy()
+		workspaceRole.OwnerReferences = k8sutil.RemoveWorkspaceOwnerReference(workspaceRole.OwnerReferences)
+		if err := controllerutil.SetControllerReference(&workspace, workspaceRole, r.Scheme); err != nil {
+			logger.Error(err, "set controller reference failed")
+			return err
+		}
+		if err := r.Update(ctx, workspaceRole); err != nil {
+			logger.Error(err, "update workspace role failed")
+			return err
+		}
+	}
+	return nil
+}
+
+func (r *Reconciler) multiClusterSync(ctx context.Context, logger logr.Logger, workspaceRole *iamv1alpha2.WorkspaceRole) error {
+	if err := r.ensureNotControlledByKubefed(ctx, logger, workspaceRole); err != nil {
+		return err
+	}
+	federatedWorkspaceRole := &typesv1beta1.FederatedWorkspaceRole{}
+	if err := r.Client.Get(ctx, types.NamespacedName{Name: workspaceRole.Name}, federatedWorkspaceRole); err != nil {
+		if errors.IsNotFound(err) {
+			if federatedWorkspaceRole, err := newFederatedWorkspaceRole(workspaceRole); err != nil {
+				logger.Error(err, "create federated workspace role failed")
+				return err
+			} else {
+				if err := r.Create(ctx, federatedWorkspaceRole); err != nil {
+					logger.Error(err, "create federated workspace role failed")
+					return err
+				}
+			}
+		}
+		logger.Error(err, "get federated workspace role failed")
+		return err
+	}
+
+	if !reflect.DeepEqual(federatedWorkspaceRole.Spec.Template.Rules, workspaceRole.Rules) ||
+		!reflect.DeepEqual(federatedWorkspaceRole.Spec.Template.Labels, workspaceRole.Labels) {
+
+		federatedWorkspaceRole.Spec.Template.Rules = workspaceRole.Rules
+		federatedWorkspaceRole.Spec.Template.Labels = workspaceRole.Labels
+
+		if err := r.Update(ctx, federatedWorkspaceRole); err != nil {
+			logger.Error(err, "update federated workspace role failed")
+			return err
+		}
+	}
+
+	return nil
+}
+
+func newFederatedWorkspaceRole(workspaceRole *iamv1alpha2.WorkspaceRole) (*typesv1beta1.FederatedWorkspaceRole, error) {
+	federatedWorkspaceRole := &typesv1beta1.FederatedWorkspaceRole{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       typesv1beta1.FederatedWorkspaceRoleKind,
+			APIVersion: typesv1beta1.SchemeGroupVersion.String(),
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name: workspaceRole.Name,
+		},
+		Spec: typesv1beta1.FederatedWorkspaceRoleSpec{
+			Template: typesv1beta1.WorkspaceRoleTemplate{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: workspaceRole.Labels,
+				},
+				Rules: workspaceRole.Rules,
+			},
+			Placement: typesv1beta1.GenericPlacementFields{
+				ClusterSelector: &metav1.LabelSelector{},
+			},
+		},
+	}
+
+	if err := controllerutil.SetControllerReference(workspaceRole, federatedWorkspaceRole, scheme.Scheme); err != nil {
+		return nil, err
+	}
+
+	return federatedWorkspaceRole, nil
+}
+
+func (r *Reconciler) ensureNotControlledByKubefed(ctx context.Context, logger logr.Logger, workspaceRole *iamv1alpha2.WorkspaceRole) error {
+	if workspaceRole.Labels[constants.KubefedManagedLabel] != "false" {
+		if workspaceRole.Labels == nil {
+			workspaceRole.Labels = make(map[string]string)
+		}
+		workspaceRole = workspaceRole.DeepCopy()
+		workspaceRole.Labels[constants.KubefedManagedLabel] = "false"
+		if err := r.Update(ctx, workspaceRole); err != nil {
+			logger.Error(err, "update kubefed managed label failed")
+			return err
+		}
+	}
+	return nil
+}

pkg/controller/workspacerole/workspacerole_controller_suite_test.go

@@ -0,0 +1,100 @@
+/*
+Copyright 2019 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package workspacerole
+
+import (
+	"github.com/onsi/gomega/gexec"
+	"k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/klog/klogr"
+	"kubesphere.io/kubesphere/pkg/apis"
+	"os"
+	"path/filepath"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	logf "sigs.k8s.io/controller-runtime/pkg/log"
+	"testing"
+	"time"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+	"sigs.k8s.io/controller-runtime/pkg/envtest"
+	"sigs.k8s.io/controller-runtime/pkg/envtest/printer"
+)
+
+// These tests use Ginkgo (BDD-style Go testing framework). Refer to
+// http://onsi.github.io/ginkgo/ to learn more about Ginkgo.
+
+var k8sClient client.Client
+var k8sManager ctrl.Manager
+var testEnv *envtest.Environment
+
+func TestWorkspaceRoleController(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecsWithDefaultAndCustomReporters(t,
+		"WorkspaceRole Controller Test Suite",
+		[]Reporter{printer.NewlineReporter{}})
+}
+
+var _ = BeforeSuite(func(done Done) {
+	logf.SetLogger(klogr.New())
+
+	By("bootstrapping test environment")
+	t := true
+	if os.Getenv("TEST_USE_EXISTING_CLUSTER") == "true" {
+		testEnv = &envtest.Environment{
+			UseExistingCluster: &t,
+		}
+	} else {
+		testEnv = &envtest.Environment{
+			CRDDirectoryPaths:        []string{filepath.Join("..", "..", "..", "config", "crds")},
+			AttachControlPlaneOutput: false,
+		}
+	}
+
+	cfg, err := testEnv.Start()
+	Expect(err).ToNot(HaveOccurred())
+	Expect(cfg).ToNot(BeNil())
+
+	err = apis.AddToScheme(scheme.Scheme)
+	Expect(err).NotTo(HaveOccurred())
+
+	k8sManager, err = ctrl.NewManager(cfg, ctrl.Options{
+		Scheme:             scheme.Scheme,
+		MetricsBindAddress: "0",
+	})
+	Expect(err).ToNot(HaveOccurred())
+
+	err = (&Reconciler{}).SetupWithManager(k8sManager)
+	Expect(err).ToNot(HaveOccurred())
+
+	go func() {
+		err = k8sManager.Start(ctrl.SetupSignalHandler())
+		Expect(err).ToNot(HaveOccurred())
+	}()
+
+	k8sClient = k8sManager.GetClient()
+	Expect(k8sClient).ToNot(BeNil())
+
+	close(done)
+}, 60)
+
+var _ = AfterSuite(func() {
+	By("tearing down the test environment")
+	gexec.KillAndWait(5 * time.Second)
+	err := testEnv.Stop()
+	Expect(err).ToNot(HaveOccurred())
+})

pkg/controller/workspacerole/workspacerole_controller_test.go

@@ -0,0 +1,93 @@
+/*
+Copyright 2019 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package workspacerole
+
+import (
+	"context"
+	"fmt"
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+	rbacv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+	tenantv1alpha1 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha1"
+	tenantv1alpha2 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha2"
+	"time"
+)
+
+var _ = Describe("WorkspaceRole", func() {
+
+	const timeout = time.Second * 30
+	const interval = time.Second * 1
+
+	workspace := &tenantv1alpha2.WorkspaceTemplate{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "workspace1",
+		},
+	}
+	BeforeEach(func() {
+		// Create workspace
+		Expect(k8sClient.Create(context.Background(), workspace)).Should(Succeed())
+	})
+
+	// Add Tests for OpenAPI validation (or additonal CRD features) specified in
+	// your API definition.
+	// Avoid adding tests for vanilla CRUD operations because they would
+	// test Kubernetes API server, which isn't the goal here.
+	Context("WorkspaceRole Controller", func() {
+		It("Should create successfully", func() {
+			workspaceAdmin := &iamv1alpha2.WorkspaceRole{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   fmt.Sprintf("%s-admin", workspace.Name),
+					Labels: map[string]string{tenantv1alpha1.WorkspaceLabel: workspace.Name},
+				},
+				Rules: []rbacv1.PolicyRule{},
+			}
+
+			// Create workspace role
+			Expect(k8sClient.Create(context.Background(), workspaceAdmin)).Should(Succeed())
+
+			By("Expecting to create workspace role successfully")
+			Eventually(func() bool {
+				k8sClient.Get(context.Background(), types.NamespacedName{Name: workspaceAdmin.Name}, workspaceAdmin)
+				return !workspaceAdmin.CreationTimestamp.IsZero()
+			}, timeout, interval).Should(BeTrue())
+
+			By("Expecting to set owner reference successfully")
+			Eventually(func() bool {
+				k8sClient.Get(context.Background(), types.NamespacedName{Name: workspaceAdmin.Name}, workspaceAdmin)
+				return len(workspaceAdmin.OwnerReferences) > 0
+			}, timeout, interval).Should(BeTrue())
+
+			Expect(k8sClient.Get(context.Background(), types.NamespacedName{Name: workspace.Name}, workspace)).Should(Succeed())
+
+			controlled := true
+			expectedOwnerReference := metav1.OwnerReference{
+				Kind:               workspace.Kind,
+				APIVersion:         workspace.APIVersion,
+				UID:                workspace.UID,
+				Name:               workspace.Name,
+				Controller:         &controlled,
+				BlockOwnerDeletion: &controlled,
+			}
+
+			By("Expecting to bind workspace successfully")
+			Expect(workspaceAdmin.OwnerReferences).To(ContainElement(expectedOwnerReference))
+		})
+	})
+})