Skip to content

Commit 047fb4d

Browse files
mfojtikmfojtik
committed
migrate serviceaccount and rest of build controllers to new controller initialization
1 parent 5ef63e6 commit 047fb4d

File tree

12 files changed

+623
-205
lines changed

12 files changed

+623
-205
lines changed

‎pkg/authorization/authorizer/subjects_test.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,9 @@ func TestSubjects(t *testing.T) {
4949
"system:serviceaccount:openshift-infra:build-controller",
5050
"system:serviceaccount:openshift-infra:deployer-controller",
5151
"system:serviceaccount:openshift-infra:template-instance-controller",
52+
"system:serviceaccount:openshift-infra:template-instance-controller",
53+
"system:serviceaccount:openshift-infra:build-pod-controller",
54+
"system:serviceaccount:openshift-infra:build-controller",
5255
),
5356
expectedGroups: sets.NewString("RootUsers", "system:cluster-admins", "system:cluster-readers", "system:masters", "system:nodes"),
5457
}

‎pkg/cmd/server/bootstrappolicy/controller_policy.go‎

Lines changed: 56 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,10 +51,33 @@ func init() {
5151
Rules: []rbac.PolicyRule{
5252
rbac.NewRule("get", "list", "watch", "update", "delete").Groups(buildGroup, legacyBuildGroup).Resources("builds").RuleOrDie(),
5353
rbac.NewRule("get").Groups(buildGroup, legacyBuildGroup).Resources("buildconfigs").RuleOrDie(),
54-
rbac.NewRule("create").Groups(buildGroup, legacyBuildGroup).Resources("builds/docker", "builds/source", "builds/custom", "builds/jenkinspipeline").RuleOrDie(),
54+
rbac.NewRule("create").Groups(buildGroup, legacyBuildGroup).Resources("builds/optimizeddocker", "builds/docker", "builds/source", "builds/custom", "builds/jenkinspipeline").RuleOrDie(),
5555
rbac.NewRule("get").Groups(imageGroup, legacyImageGroup).Resources("imagestreams").RuleOrDie(),
5656
rbac.NewRule("get", "list", "create", "delete").Groups(kapiGroup).Resources("pods").RuleOrDie(),
57-
rbac.NewRule("get").Groups(kapiGroup).Resources("namespaces").RuleOrDie(),
57+
eventsRule(),
58+
},
59+
})
60+
61+
// build-pod-controller
62+
addControllerRole(rbac.ClusterRole{
63+
ObjectMeta: metav1.ObjectMeta{Name: saRolePrefix + InfraBuildPodControllerServiceAccountName},
64+
Rules: []rbac.PolicyRule{
65+
rbac.NewRule("create", "get", "list", "watch", "update", "delete").Groups(buildGroup, legacyBuildGroup).Resources("builds").RuleOrDie(),
66+
rbac.NewRule("get", "list", "create", "delete").Groups(kapiGroup).Resources("pods").RuleOrDie(),
67+
rbac.NewRule("get").Groups(kapiGroup).Resources("secrets").RuleOrDie(),
68+
rbac.NewRule("get").Groups(buildGroup, legacyBuildGroup).Resources("buildconfigs").RuleOrDie(),
69+
// Needed for strategyrestriction admission
70+
rbac.NewRule("create").Groups(buildGroup, legacyBuildGroup).Resources("builds/optimizeddocker", "builds/docker", "builds/source", "builds/custom", "builds/jenkinspipeline").RuleOrDie(),
71+
eventsRule(),
72+
},
73+
})
74+
75+
// build-config-change-controller
76+
addControllerRole(rbac.ClusterRole{
77+
ObjectMeta: metav1.ObjectMeta{Name: saRolePrefix + InfraBuildConfigChangeControllerServiceAccountName},
78+
Rules: []rbac.PolicyRule{
79+
rbac.NewRule("get", "list", "watch").Groups(buildGroup, legacyBuildGroup).Resources("buildconfigs").RuleOrDie(),
80+
rbac.NewRule("create").Groups(buildGroup, legacyBuildGroup).Resources("buildconfigs/instantiate").RuleOrDie(),
5881
eventsRule(),
5982
},
6083
})
@@ -103,8 +126,39 @@ func init() {
103126
},
104127
})
105128

129+
// template-instance-controller
106130
controllerRoleBindings = append(controllerRoleBindings,
107131
rbac.NewClusterBinding(EditRoleName).SAs(DefaultOpenShiftInfraNamespace, InfraTemplateInstanceControllerServiceAccountName).BindingOrDie())
132+
133+
// origin-namespace-controller
134+
addControllerRole(rbac.ClusterRole{
135+
ObjectMeta: metav1.ObjectMeta{Name: saRolePrefix + InfraOriginNamespaceServiceAccountName},
136+
Rules: []rbac.PolicyRule{
137+
rbac.NewRule("get", "list", "watch").Groups(kapiGroup).Resources("namespaces").RuleOrDie(),
138+
rbac.NewRule("update").Groups(kapiGroup).Resources("namespaces/finalize", "namespaces/status").RuleOrDie(),
139+
eventsRule(),
140+
},
141+
})
142+
143+
// serviceaccount-controller
144+
addControllerRole(rbac.ClusterRole{
145+
ObjectMeta: metav1.ObjectMeta{Name: saRolePrefix + InfraServiceAccountControllerServiceAccountName},
146+
Rules: []rbac.PolicyRule{
147+
rbac.NewRule("get", "list", "watch", "create", "update", "patch", "delete").Groups(kapiGroup).Resources("serviceaccounts").RuleOrDie(),
148+
eventsRule(),
149+
},
150+
})
151+
152+
// serviceaccount-pull-secrets-controller
153+
addControllerRole(rbac.ClusterRole{
154+
ObjectMeta: metav1.ObjectMeta{Name: saRolePrefix + InfraServiceAccountPullSecretsControllerServiceAccountName},
155+
Rules: []rbac.PolicyRule{
156+
rbac.NewRule("get", "list", "watch", "create", "update").Groups(kapiGroup).Resources("serviceaccounts").RuleOrDie(),
157+
rbac.NewRule("get", "list", "watch", "create", "update", "patch", "delete").Groups(kapiGroup).Resources("secrets").RuleOrDie(),
158+
rbac.NewRule("get", "list", "watch").Groups(kapiGroup).Resources("services").RuleOrDie(),
159+
eventsRule(),
160+
},
161+
})
108162
}
109163

110164
// ControllerRoles returns the cluster roles used by controllers

‎pkg/cmd/server/bootstrappolicy/infra_sa_policy.go‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,18 @@ import (
2323
)
2424

2525
const (
26-
InfraBuildControllerServiceAccountName = "build-controller"
27-
InfraImageTriggerControllerServiceAccountName = "imagetrigger-controller"
28-
ImageTriggerControllerRoleName = "system:imagetrigger-controller"
29-
InfraDeploymentConfigControllerServiceAccountName = "deploymentconfig-controller"
30-
InfraDeploymentTriggerControllerServiceAccountName = "deployment-trigger-controller"
31-
InfraDeployerControllerServiceAccountName = "deployer-controller"
26+
InfraBuildControllerServiceAccountName = "build-controller"
27+
InfraImageTriggerControllerServiceAccountName = "imagetrigger-controller"
28+
ImageTriggerControllerRoleName = "system:imagetrigger-controller"
29+
InfraDeploymentConfigControllerServiceAccountName = "deploymentconfig-controller"
30+
InfraDeploymentTriggerControllerServiceAccountName = "deployment-trigger-controller"
31+
InfraDeployerControllerServiceAccountName = "deployer-controller"
32+
InfraOriginNamespaceServiceAccountName = "origin-namespace-controller"
33+
InfraServiceAccountControllerServiceAccountName = "serviceaccount-controller"
34+
InfraServiceAccountPullSecretsControllerServiceAccountName = "serviceaccount-pull-secrets-controller"
35+
InfraServiceAccountTokensControllerServiceAccountName = "serviceaccount-tokens-controller"
36+
InfraBuildPodControllerServiceAccountName = "build-pod-controller"
37+
InfraBuildConfigChangeControllerServiceAccountName = "build-config-change-controller"
3238

3339
InfraPersistentVolumeBinderControllerServiceAccountName = "pv-binder-controller"
3440
PersistentVolumeBinderControllerRoleName = "system:pv-binder-controller"

‎pkg/cmd/server/origin/controller.go‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,90 @@
11
package origin
22

33
import (
4+
"fmt"
5+
"io/ioutil"
6+
47
"k8s.io/apimachinery/pkg/runtime/schema"
8+
"k8s.io/client-go/util/cert"
59
kapi "k8s.io/kubernetes/pkg/api"
10+
kubecontroller "k8s.io/kubernetes/pkg/controller"
11+
"k8s.io/kubernetes/pkg/serviceaccount"
612

13+
"github.com/golang/glog"
14+
"github.com/openshift/origin/pkg/cmd/server/crypto"
715
"github.com/openshift/origin/pkg/cmd/server/origin/controller"
816
)
917

18+
// NewOpenShiftControllerPreStartInitializers returns list of initializers for controllers
19+
// that needed to be run before any other controller is started.
20+
// Typically this has to done for the serviceaccount-tokens controller as it provides
21+
// tokens to other controllers.
22+
func (c *MasterConfig) NewOpenShiftControllerPreStartInitializers() (map[string]controller.InitFunc, error) {
23+
ret := map[string]controller.InitFunc{}
24+
25+
saTokens := controller.ServiceAccountTokensControllerOptions{
26+
RootClientBuilder: kubecontroller.SimpleControllerClientBuilder{
27+
ClientConfig: &c.PrivilegedLoopbackClientConfig,
28+
},
29+
}
30+
31+
if len(c.Options.ServiceAccountConfig.PrivateKeyFile) == 0 {
32+
glog.Infof("Skipped starting Service Account Token Manager, no private key specified")
33+
return nil, nil
34+
}
35+
36+
var err error
37+
38+
saTokens.PrivateKey, err = serviceaccount.ReadPrivateKey(c.Options.ServiceAccountConfig.PrivateKeyFile)
39+
if err != nil {
40+
return nil, fmt.Errorf("error reading signing key for Service Account Token Manager: %v", err)
41+
}
42+
43+
if len(c.Options.ServiceAccountConfig.MasterCA) > 0 {
44+
saTokens.RootCA, err = ioutil.ReadFile(c.Options.ServiceAccountConfig.MasterCA)
45+
if err != nil {
46+
return nil, fmt.Errorf("error reading master ca file for Service Account Token Manager: %s: %v", c.Options.ServiceAccountConfig.MasterCA, err)
47+
}
48+
if _, err := cert.ParseCertsPEM(saTokens.RootCA); err != nil {
49+
return nil, fmt.Errorf("error parsing master ca file for Service Account Token Manager: %s: %v", c.Options.ServiceAccountConfig.MasterCA, err)
50+
}
51+
}
52+
53+
if c.Options.ControllerConfig.ServiceServingCert.Signer != nil && len(c.Options.ControllerConfig.ServiceServingCert.Signer.CertFile) > 0 {
54+
certFile := c.Options.ControllerConfig.ServiceServingCert.Signer.CertFile
55+
serviceServingCA, err := ioutil.ReadFile(certFile)
56+
if err != nil {
57+
return nil, fmt.Errorf("error reading ca file for Service Serving Certificate Signer: %s: %v", certFile, err)
58+
}
59+
if _, err := crypto.CertsFromPEM(serviceServingCA); err != nil {
60+
return nil, fmt.Errorf("error parsing ca file for Service Serving Certificate Signer: %s: %v", certFile, err)
61+
}
62+
63+
// if we have a rootCA bundle add that too. The rootCA will be used when hitting the default master service, since those are signed
64+
// using a different CA by default. The rootCA's key is more closely guarded than ours and if it is compromised, that power could
65+
// be used to change the trusted signers for every pod anyway, so we're already effectively trusting it.
66+
if len(saTokens.RootCA) > 0 {
67+
saTokens.ServiceServingCA = append(saTokens.ServiceServingCA, saTokens.RootCA...)
68+
saTokens.ServiceServingCA = append(saTokens.ServiceServingCA, []byte("\n")...)
69+
}
70+
saTokens.ServiceServingCA = append(saTokens.ServiceServingCA, serviceServingCA...)
71+
}
72+
ret["serviceaccount-tokens"] = saTokens.RunController
73+
74+
return ret, nil
75+
}
76+
1077
func (c *MasterConfig) NewOpenshiftControllerInitializers() (map[string]controller.InitFunc, error) {
1178
ret := map[string]controller.InitFunc{}
1279

80+
serviceAccount := controller.ServiceAccountControllerOptions{
81+
ManagedNames: c.Options.ServiceAccountConfig.ManagedNames,
82+
}
83+
ret["serviceaccount"] = serviceAccount.RunController
84+
85+
ret["serviceaccount-pull-secrets"] = controller.RunServiceAccountPullSecretsController
86+
ret["origin-namespace"] = controller.RunOriginNamespaceController
87+
1388
// initialize build controller
1489
storageVersion := c.Options.EtcdStorageConfig.OpenShiftStorageVersion
1590
groupVersion := schema.GroupVersion{Group: "", Version: storageVersion}
@@ -23,6 +98,8 @@ func (c *MasterConfig) NewOpenshiftControllerInitializers() (map[string]controll
2398
Codec: codec,
2499
}
25100
ret["build"] = buildControllerConfig.RunController
101+
ret["build-pod"] = controller.RunBuildPodController
102+
ret["build-config-change"] = controller.RunBuildConfigChangeController
26103

27104
// initialize apps.openshift.io controllers
28105
vars, err := c.GetOpenShiftClientEnvVars()

‎pkg/cmd/server/origin/controller/build.go‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
builddefaults "github.com/openshift/origin/pkg/build/admission/defaults"
99
buildoverrides "github.com/openshift/origin/pkg/build/admission/overrides"
1010
buildclient "github.com/openshift/origin/pkg/build/client"
11+
buildpodcontroller "github.com/openshift/origin/pkg/build/controller/buildpod"
1112
buildcontrollerfactory "github.com/openshift/origin/pkg/build/controller/factory"
1213
buildstrategy "github.com/openshift/origin/pkg/build/controller/strategy"
1314
configapi "github.com/openshift/origin/pkg/cmd/server/api"
@@ -82,3 +83,30 @@ func (c *BuildControllerConfig) RunController(ctx ControllerContext) (bool, erro
8283
deleteController.Run()
8384
return true, nil
8485
}
86+
87+
func RunBuildPodController(ctx ControllerContext) (bool, error) {
88+
go buildpodcontroller.NewBuildPodController(
89+
ctx.DeprecatedOpenshiftInformers.Builds().Informer(),
90+
ctx.DeprecatedOpenshiftInformers.InternalKubernetesInformers().Core().InternalVersion().Pods(),
91+
ctx.ClientBuilder.KubeInternalClientOrDie(bootstrappolicy.InfraBuildPodControllerServiceAccountName),
92+
ctx.ClientBuilder.ClientOrDie(bootstrappolicy.InfraBuildPodControllerServiceAccountName),
93+
ctx.ClientBuilder.DeprecatedOpenshiftClientOrDie(bootstrappolicy.InfraBuildPodControllerServiceAccountName),
94+
).Run(5, ctx.Stop)
95+
return true, nil
96+
}
97+
98+
func RunBuildConfigChangeController(ctx ControllerContext) (bool, error) {
99+
clientName := bootstrappolicy.InfraBuildConfigChangeControllerServiceAccountName
100+
bcInstantiator := buildclient.NewOSClientBuildConfigInstantiatorClient(ctx.ClientBuilder.DeprecatedOpenshiftClientOrDie(clientName))
101+
factory := buildcontrollerfactory.BuildConfigControllerFactory{
102+
Client: ctx.ClientBuilder.DeprecatedOpenshiftClientOrDie(clientName),
103+
KubeClient: ctx.ClientBuilder.KubeInternalClientOrDie(clientName),
104+
ExternalKubeClient: ctx.ClientBuilder.ClientOrDie(clientName),
105+
BuildConfigInstantiator: bcInstantiator,
106+
BuildLister: buildclient.NewOSClientBuildClient(ctx.ClientBuilder.DeprecatedOpenshiftClientOrDie(clientName)),
107+
BuildConfigGetter: buildclient.NewOSClientBuildConfigClient(ctx.ClientBuilder.DeprecatedOpenshiftClientOrDie(clientName)),
108+
BuildDeleter: buildclient.NewBuildDeleter(ctx.ClientBuilder.DeprecatedOpenshiftClientOrDie(clientName)),
109+
}
110+
go factory.Create().Run()
111+
return true, nil
112+
}

‎pkg/cmd/server/origin/controller/project.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
package controller
2+
3+
import (
4+
"github.com/openshift/origin/pkg/cmd/server/bootstrappolicy"
5+
projectcontroller "github.com/openshift/origin/pkg/project/controller"
6+
)
7+
8+
func RunOriginNamespaceController(ctx ControllerContext) (bool, error) {
9+
factory := projectcontroller.NamespaceControllerFactory{}
10+
factory.KubeClient = ctx.ClientBuilder.KubeInternalClientOrDie(bootstrappolicy.InfraOriginNamespaceServiceAccountName)
11+
go factory.Create().Run()
12+
return true, nil
13+
}

‎pkg/cmd/server/origin/controller/serviceaccount.go‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
package controller
2+
3+
import (
4+
"github.com/golang/glog"
5+
6+
kapiv1 "k8s.io/kubernetes/pkg/api/v1"
7+
"k8s.io/kubernetes/pkg/controller"
8+
sacontroller "k8s.io/kubernetes/pkg/controller/serviceaccount"
9+
"k8s.io/kubernetes/pkg/serviceaccount"
10+
11+
"github.com/openshift/origin/pkg/cmd/server/bootstrappolicy"
12+
serviceaccountcontrollers "github.com/openshift/origin/pkg/serviceaccounts/controllers"
13+
)
14+
15+
type ServiceAccountControllerOptions struct {
16+
ManagedNames []string
17+
}
18+
19+
func (c *ServiceAccountControllerOptions) RunController(ctx ControllerContext) (bool, error) {
20+
if len(c.ManagedNames) == 0 {
21+
glog.Infof("Skipped starting Service Account Manager, no managed names specified")
22+
return false, nil
23+
}
24+
25+
options := sacontroller.DefaultServiceAccountsControllerOptions()
26+
options.ServiceAccounts = []kapiv1.ServiceAccount{}
27+
28+
for _, saName := range c.ManagedNames {
29+
sa := kapiv1.ServiceAccount{}
30+
sa.Name = saName
31+
32+
options.ServiceAccounts = append(options.ServiceAccounts, sa)
33+
}
34+
35+
go sacontroller.NewServiceAccountsController(
36+
ctx.DeprecatedOpenshiftInformers.KubernetesInformers().Core().V1().ServiceAccounts(),
37+
ctx.DeprecatedOpenshiftInformers.KubernetesInformers().Core().V1().Namespaces(),
38+
ctx.ClientBuilder.ClientOrDie(bootstrappolicy.InfraServiceAccountControllerServiceAccountName),
39+
options).Run(3, ctx.Stop)
40+
41+
return true, nil
42+
}
43+
44+
type ServiceAccountTokensControllerOptions struct {
45+
RootCA []byte
46+
ServiceServingCA []byte
47+
PrivateKey interface{}
48+
49+
RootClientBuilder controller.SimpleControllerClientBuilder
50+
}
51+
52+
func (c *ServiceAccountTokensControllerOptions) RunController(ctx ControllerContext) (bool, error) {
53+
go sacontroller.NewTokensController(
54+
ctx.DeprecatedOpenshiftInformers.KubernetesInformers().Core().V1().ServiceAccounts(),
55+
ctx.DeprecatedOpenshiftInformers.KubernetesInformers().Core().V1().Secrets(),
56+
c.RootClientBuilder.ClientOrDie(bootstrappolicy.InfraServiceAccountTokensControllerServiceAccountName),
57+
sacontroller.TokensControllerOptions{
58+
TokenGenerator: serviceaccount.JWTTokenGenerator(c.PrivateKey),
59+
RootCA: c.RootCA,
60+
ServiceServingCA: c.ServiceServingCA,
61+
},
62+
).Run(int(ctx.KubeControllerContext.Options.ConcurrentSATokenSyncs), ctx.Stop)
63+
return true, nil
64+
}
65+
66+
func RunServiceAccountPullSecretsController(ctx ControllerContext) (bool, error) {
67+
kc := ctx.ClientBuilder.KubeInternalClientOrDie(bootstrappolicy.InfraServiceAccountPullSecretsControllerServiceAccountName)
68+
69+
serviceaccountcontrollers.NewDockercfgDeletedController(kc, serviceaccountcontrollers.DockercfgDeletedControllerOptions{}).Run()
70+
serviceaccountcontrollers.NewDockercfgTokenDeletedController(kc, serviceaccountcontrollers.DockercfgTokenDeletedControllerOptions{}).Run()
71+
72+
dockerURLsIntialized := make(chan struct{})
73+
dockercfgController := serviceaccountcontrollers.NewDockercfgController(kc, serviceaccountcontrollers.DockercfgControllerOptions{DockerURLsIntialized: dockerURLsIntialized})
74+
go dockercfgController.Run(5, ctx.Stop)
75+
76+
dockerRegistryControllerOptions := serviceaccountcontrollers.DockerRegistryServiceControllerOptions{
77+
RegistryNamespace: "default",
78+
RegistryServiceName: "docker-registry",
79+
DockercfgController: dockercfgController,
80+
DockerURLsIntialized: dockerURLsIntialized,
81+
}
82+
go serviceaccountcontrollers.NewDockerRegistryServiceController(kc, dockerRegistryControllerOptions).Run(10, ctx.Stop)
83+
84+
return true, nil
85+
}

0 commit comments

Comments
 (0)