Skip to content

Commit f026ccc

Browse files
evghen1evghen1
authored
Merge pull request #225 from web-seven/224-bugprovider-loaded-provider-package-do-not-pulled-by-kubelet
local registry kyverno policy and auto creation
2 parents 9b525ab + 975ec23 commit f026ccc

File tree

10 files changed

+289
-324
lines changed

10 files changed

+289
-324
lines changed

‎go.mod

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ go 1.21.4
55
require (
66
github.com/Masterminds/semver/v3 v3.2.1
77
github.com/docker/docker v24.0.7+incompatible
8+
github.com/go-logr/logr v1.4.1
89
github.com/pkg/errors v0.9.1
910
go.uber.org/zap v1.26.0
1011
gopkg.in/yaml.v3 v3.0.1
@@ -63,7 +64,6 @@ require (
6364
github.com/gabriel-vasile/mimetype v1.4.3 // indirect
6465
github.com/go-errors/errors v1.4.2 // indirect
6566
github.com/go-gorp/gorp/v3 v3.1.0 // indirect
66-
github.com/go-logr/logr v1.4.1 // indirect
6767
github.com/go-logr/stdr v1.2.2 // indirect
6868
github.com/go-openapi/jsonpointer v0.19.6 // indirect
6969
github.com/go-openapi/jsonreference v0.20.2 // indirect

‎internal/engine/engine.go

+6-283
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ package engine
22

33
import (
44
"context"
5-
b64 "encoding/base64"
65
"fmt"
76
"net/url"
87
"strings"
@@ -13,43 +12,18 @@ import (
1312
"github.com/web-seven/overlock/internal/install"
1413
"github.com/web-seven/overlock/internal/install/helm"
1514
"github.com/web-seven/overlock/internal/namespace"
16-
"gopkg.in/yaml.v3"
17-
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
18-
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
19-
"k8s.io/apimachinery/pkg/runtime"
20-
"k8s.io/apimachinery/pkg/types"
2115
"k8s.io/client-go/rest"
2216

2317
"go.uber.org/zap"
24-
corev1 "k8s.io/api/core/v1"
25-
rbacv1 "k8s.io/api/rbac/v1"
26-
extv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
27-
"sigs.k8s.io/controller-runtime/pkg/builder"
28-
"sigs.k8s.io/controller-runtime/pkg/client"
29-
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
30-
"sigs.k8s.io/controller-runtime/pkg/event"
31-
"sigs.k8s.io/controller-runtime/pkg/manager"
32-
"sigs.k8s.io/controller-runtime/pkg/predicate"
33-
"sigs.k8s.io/controller-runtime/pkg/reconcile"
3418
)
3519

36-
type SecretReconciler struct {
37-
serverIP string
38-
client.Client
39-
context.CancelFunc
40-
}
41-
4220
const (
43-
RepoUrl = "https://charts.crossplane.io/stable"
44-
ChartName = "crossplane"
45-
ReleaseName = "overlock-crossplane"
46-
Version = "1.15.2"
47-
kindClusterRole = "ClusterRole"
48-
ProviderConfigName = "overlock-kubernetes-provider-config"
49-
helmProviderConfigName = "overlock-helm-provider-config"
50-
aggregateToAdmin = "rbac.crossplane.io/aggregate-to-admin"
51-
trueVal = "true"
52-
errParsePackageName = "package name is not valid"
21+
RepoUrl = "https://charts.crossplane.io/stable"
22+
ChartName = "crossplane"
23+
ReleaseName = "overlock-crossplane"
24+
Version = "1.17.1"
25+
trueVal = "true"
26+
errParsePackageName = "package name is not valid"
5327
)
5428

5529
var (
@@ -148,257 +122,6 @@ func ManagedSelector(m map[string]string) string {
148122
return strings.Join(selectors, ",")
149123
}
150124

151-
// Setup Kubernetes provider which has crossplane admin aggregation role assigned
152-
func SetupPrivilegedKubernetesProvider(ctx context.Context, configClient *rest.Config, logger *zap.SugaredLogger) error {
153-
154-
pcn := ProviderConfigName
155-
156-
sa := &corev1.ServiceAccount{
157-
ObjectMeta: metav1.ObjectMeta{
158-
Name: pcn,
159-
Namespace: namespace.Namespace,
160-
},
161-
}
162-
163-
saSec := &corev1.Secret{
164-
ObjectMeta: metav1.ObjectMeta{
165-
Name: pcn,
166-
Namespace: namespace.Namespace,
167-
Annotations: map[string]string{
168-
"kubernetes.io/service-account.name": sa.Name,
169-
},
170-
},
171-
Type: corev1.SecretTypeServiceAccountToken,
172-
}
173-
174-
cr := &rbacv1.ClusterRole{
175-
ObjectMeta: metav1.ObjectMeta{
176-
Name: pcn,
177-
},
178-
Rules: []rbacv1.PolicyRule{
179-
{
180-
APIGroups: []string{"*", ""},
181-
Verbs: []string{"*"},
182-
Resources: []string{"*"},
183-
},
184-
},
185-
}
186-
187-
crb := &rbacv1.ClusterRoleBinding{
188-
ObjectMeta: metav1.ObjectMeta{
189-
Name: pcn,
190-
},
191-
Subjects: []rbacv1.Subject{
192-
{
193-
Kind: rbacv1.ServiceAccountKind,
194-
Name: sa.Name,
195-
Namespace: namespace.Namespace,
196-
},
197-
},
198-
RoleRef: rbacv1.RoleRef{
199-
APIGroup: rbacv1.GroupName,
200-
Kind: kindClusterRole,
201-
Name: cr.Name,
202-
},
203-
}
204-
205-
scheme := runtime.NewScheme()
206-
rbacv1.AddToScheme(scheme)
207-
corev1.AddToScheme(scheme)
208-
extv1.AddToScheme(scheme)
209-
ctrl, _ := client.New(configClient, client.Options{Scheme: scheme})
210-
for _, res := range []client.Object{sa, saSec, cr, crb} {
211-
_, err := controllerutil.CreateOrUpdate(ctx, ctrl, res, func() error {
212-
return nil
213-
})
214-
if err != nil {
215-
return err
216-
}
217-
}
218-
219-
svc := &corev1.Service{}
220-
err := ctrl.Get(ctx, types.NamespacedName{Namespace: "default", Name: "kubernetes"}, svc)
221-
if err != nil {
222-
return err
223-
}
224-
225-
mgr, err := manager.New(configClient, manager.Options{})
226-
if err != nil {
227-
return err
228-
}
229-
mgrContext, cancel := context.WithCancel(context.Background())
230-
if err = builder.
231-
ControllerManagedBy(mgr).
232-
For(&corev1.ServiceAccount{}).
233-
WithEventFilter(predicate.Funcs{
234-
UpdateFunc: func(e event.UpdateEvent) bool {
235-
return e.ObjectNew.GetName() == ProviderConfigName
236-
},
237-
DeleteFunc: func(e event.DeleteEvent) bool {
238-
return e.Object.GetName() == ProviderConfigName
239-
},
240-
CreateFunc: func(e event.CreateEvent) bool {
241-
return e.Object.GetName() == ProviderConfigName
242-
},
243-
GenericFunc: func(e event.GenericEvent) bool {
244-
return e.Object.GetName() == ProviderConfigName
245-
},
246-
},
247-
).
248-
Complete(&SecretReconciler{
249-
Client: ctrl,
250-
CancelFunc: cancel,
251-
serverIP: "https://" + svc.Spec.ClusterIP + ":443",
252-
}); err != nil {
253-
return err
254-
}
255-
logger.Debug("Starting reconciliation of Kubernetes Provider")
256-
mgr.Start(mgrContext)
257-
return nil
258-
}
259-
260-
// Reconcile SvcAcc secret for make kubeconfig
261-
func (a *SecretReconciler) Reconcile(ctx context.Context, req reconcile.Request) (reconcile.Result, error) {
262-
sec := &corev1.Secret{}
263-
err := a.Get(ctx, req.NamespacedName, sec)
264-
if err != nil {
265-
return reconcile.Result{}, err
266-
} else if sec.GetName() != ProviderConfigName {
267-
return reconcile.Result{Requeue: true}, nil
268-
}
269-
270-
if _, err = controllerutil.CreateOrUpdate(ctx, a.Client, sec, func() error {
271-
kubeconfig, _ := yaml.Marshal(&map[string]interface{}{
272-
"apiVersion": "v1",
273-
"kind": "Config",
274-
"current-context": "in-cluster",
275-
"clusters": []map[string]interface{}{
276-
{
277-
"cluster": map[string]interface{}{
278-
"certificate-authority-data": b64.StdEncoding.EncodeToString(sec.Data["ca.crt"]),
279-
"server": a.serverIP,
280-
},
281-
"name": "in-cluster",
282-
},
283-
},
284-
"contexts": []map[string]interface{}{
285-
{
286-
"context": map[string]interface{}{
287-
"cluster": "in-cluster",
288-
"user": "in-cluster",
289-
"namespace": "overlock-system",
290-
},
291-
"name": "in-cluster",
292-
},
293-
},
294-
"preferences": map[string]interface{}{},
295-
"users": []map[string]interface{}{
296-
{
297-
"name": "in-cluster",
298-
"user": map[string]interface{}{
299-
"token": string(sec.Data["token"]),
300-
},
301-
},
302-
},
303-
})
304-
305-
sec.Data["kubeconfig"] = []byte(kubeconfig)
306-
return nil
307-
}); err != nil {
308-
return reconcile.Result{}, err
309-
}
310-
311-
crd := &extv1.CustomResourceDefinition{}
312-
err = a.Get(ctx, types.NamespacedName{Name: "providerconfigs.kubernetes.crossplane.io"}, crd)
313-
if err != nil {
314-
return reconcile.Result{Requeue: true}, err
315-
}
316-
317-
pc := &unstructured.Unstructured{
318-
Object: map[string]interface{}{
319-
"apiVersion": "kubernetes.crossplane.io/v1alpha1",
320-
"kind": "ProviderConfig",
321-
"metadata": map[string]interface{}{
322-
"name": ProviderConfigName,
323-
},
324-
},
325-
}
326-
327-
hpc := &unstructured.Unstructured{
328-
Object: map[string]interface{}{
329-
"apiVersion": "helm.crossplane.io/v1beta1",
330-
"kind": "ProviderConfig",
331-
"metadata": map[string]interface{}{
332-
"name": helmProviderConfigName,
333-
},
334-
},
335-
}
336-
337-
envObj := &unstructured.Unstructured{
338-
Object: map[string]interface{}{
339-
"apiVersion": "overlock.io/v1alpha1",
340-
"kind": "Environment",
341-
"metadata": map[string]interface{}{
342-
"name": "environment",
343-
},
344-
"spec": map[string]interface{}{
345-
"crossplane:": map[string]interface{}{},
346-
"kyverno:": map[string]interface{}{},
347-
"name": ReleaseName,
348-
"namespace": namespace.Namespace,
349-
"configuration": map[string]interface{}{
350-
"packages": []interface{}{},
351-
},
352-
"provider": map[string]interface{}{
353-
"packages": []interface{}{},
354-
},
355-
"helmProviderCfgRef": helmProviderConfigName,
356-
"kubernetesProviderCfgRef": ProviderConfigName,
357-
},
358-
},
359-
}
360-
361-
if _, err = controllerutil.CreateOrUpdate(ctx, a.Client, pc, func() error {
362-
pc.Object["spec"] = map[string]interface{}{
363-
"credentials": map[string]interface{}{
364-
"secretRef": map[string]interface{}{
365-
"key": "kubeconfig",
366-
"name": ProviderConfigName,
367-
"namespace": namespace.Namespace,
368-
},
369-
"source": "Secret",
370-
},
371-
}
372-
return nil
373-
}); err != nil {
374-
return reconcile.Result{}, err
375-
}
376-
377-
if _, err = controllerutil.CreateOrUpdate(ctx, a.Client, hpc, func() error {
378-
hpc.Object["spec"] = map[string]interface{}{
379-
"credentials": map[string]interface{}{
380-
"secretRef": map[string]interface{}{
381-
"key": "kubeconfig",
382-
"name": ProviderConfigName,
383-
"namespace": namespace.Namespace,
384-
},
385-
"source": "Secret",
386-
},
387-
}
388-
return nil
389-
}); err != nil {
390-
return reconcile.Result{}, err
391-
}
392-
393-
if _, err = controllerutil.CreateOrUpdate(ctx, a.Client, envObj, func() error { return nil }); err != nil {
394-
return reconcile.Result{}, err
395-
}
396-
397-
a.CancelFunc()
398-
399-
return reconcile.Result{}, nil
400-
}
401-
402125
func BuildPack(pack v1.Package, img string, pkgMap map[string]string) error {
403126
ref, err := name.ParseReference(img, name.WithDefaultRegistry(""))
404127
if err != nil {

‎internal/environment/environment.go

+9
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ import (
1616
"github.com/web-seven/overlock/internal/engine"
1717
"github.com/web-seven/overlock/internal/kube"
1818
"github.com/web-seven/overlock/internal/namespace"
19+
"github.com/web-seven/overlock/internal/policy"
1920
"github.com/web-seven/overlock/internal/registry"
2021
"github.com/web-seven/overlock/internal/resources"
2122
"k8s.io/client-go/tools/clientcmd"
@@ -148,11 +149,19 @@ func (e *Environment) Setup(ctx context.Context, logger *zap.SugaredLogger) erro
148149
return err
149150
}
150151

152+
logger.Debug("Installing policy controller")
153+
err = policy.AddPolicyConroller(ctx, configClient, "kyverno")
154+
if err != nil {
155+
return err
156+
}
157+
logger.Debug("Done")
158+
151159
logger.Debug("Preparing engine")
152160
installer, err := engine.GetEngine(configClient)
153161
if err != nil {
154162
return err
155163
}
164+
logger.Debug("Done")
156165

157166
var params map[string]any
158167
release, err := installer.GetRelease()

‎internal/environment/kind.go

-4
Original file line numberDiff line numberDiff line change
@@ -102,10 +102,6 @@ func (e *Environment) configYaml(logger *zap.SugaredLogger) string {
102102
Kind: "Cluster",
103103
APIVersion: "kind.x-k8s.io/v1alpha4",
104104
Nodes: []KindNode{
105-
{
106-
Role: "worker",
107-
ExtraMounts: []KindMount{},
108-
},
109105
{
110106
Role: "control-plane",
111107
KubeadmConfigPatches: []string{

‎internal/namespace/namespace.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ import (
1111

1212
const OVERLOCK_ENGINE_NAMESPACE = "OVERLOCK_ENGINE_NAMESPACE"
1313

14-
var Namespace = "kube-system"
14+
var Namespace = "overlock"
1515

1616
// Creates system namespace
1717
func CreateNamespace(ctx context.Context, config *rest.Config) error {

0 commit comments

Comments
 (0)