Add new CRDs for KIC 1.7

* Additionally, fix a bug with SCC API Checks
nginxinc · Mar 31, 2020 · a72cdb0 · a72cdb0
1 parent 5a4aff8
commit a72cdb0
Show file tree

Hide file tree

Showing 10 changed files with 185 additions and 16 deletions.
diff --git a/deploy/crds/k8s.nginx.org_nginxingresscontrollers_crd.yaml b/deploy/crds/k8s.nginx.org_nginxingresscontrollers_crd.yaml
@@ -55,6 +55,15 @@ spec:
                 controller reporting the status of Ingress resources – only one replica
                 will report status.
               type: boolean
+            enableTLSPassthrough:
+              description: Enable TLS Passthrough on port 443. Requires enableCRDs
+                set to true.
+              type: boolean
+            globalConfiguration:
+              description: The GlobalConfiguration resource for global configuration
+                of the Ingress Controller. Format is namespace/name. Requires enableCRDs
+                set to true.
+              type: string
             healthStatus:
               description: Adds a new location to the default server. The location
                 responds with the 200 status code for any request. Useful for external
@@ -123,7 +132,7 @@ spec:
                     commas. (default “127.0.0.1”)
                   type: string
                 enable:
-                  description: Enable the NginxStatus. Default is true.
+                  description: Enable the NginxStatus.
                   type: boolean
                 port:
                   description: Set the port where the NGINX stub_status or the NGINX
@@ -152,7 +161,7 @@ spec:
               type: object
             replicas:
               description: The number of replicas of the Ingress Controller pod. The
-                default is 1. Only applies if the Kind is set to deployment.
+                default is 1. Only applies if the type is set to deployment.
               format: int32
               type: integer
             reportIngressStatus:

diff --git a/examples/deployment-oss-min/nginx-ingress-controller.yaml b/examples/deployment-oss-min/nginx-ingress-controller.yaml
@@ -9,7 +9,7 @@ spec:
   image:
     repository: nginx/nginx-ingress
     tag: edge
-    pullPolicy: Always
+    pullPolicy: IfNotPresent
   replicas: 1
   serviceType: NodePort
   enableCRDs: true

diff --git a/examples/deployment-plus-min/nginx-ingress-controller.yaml b/examples/deployment-plus-min/nginx-ingress-controller.yaml
@@ -9,9 +9,7 @@ spec:
   image:
     repository: nginx-plus-ingress
     tag: edge
-    pullPolicy: Always
+    pullPolicy: IfNotPresent
   replicas: 1
   serviceType: NodePort
-  enableCRDs: true
-  nginxStatus:
-    enable: true
+  enableCRDs: true
diff --git a/pkg/apis/k8s/v1alpha1/nginxingresscontroller_types.go b/pkg/apis/k8s/v1alpha1/nginxingresscontroller_types.go
@@ -80,6 +80,15 @@ type NginxIngressControllerSpec struct {
 	// +kubebuilder:validation:Optional
 	// +nullable
 	ConfigMapData map[string]string `json:"configMapData"`
+	// The GlobalConfiguration resource for global configuration of the Ingress Controller.
+	// Format is namespace/name.
+	// Requires enableCRDs set to true.
+	// +kubebuilder:validation:Optional
+	GlobalConfiguration string `json:"globalConfiguration"`
+	// Enable TLS Passthrough on port 443.
+	// Requires enableCRDs set to true.
+	// +kubebuilder:validation:Optional
+	EnableTSLPassthrough bool `json:"enableTLSPassthrough"`
 }
 
 // Image defines the Repository, Tag and ImagePullPolicy of the Ingress Controller Image.

diff --git a/pkg/controller/nginxingresscontroller/crds.go b/pkg/controller/nginxingresscontroller/crds.go
@@ -54,3 +54,53 @@ func vsrForNginxIngressController() *v1beta1.CustomResourceDefinition {
 		},
 	}
 }
+
+func gcForNginxIngressController() *v1beta1.CustomResourceDefinition {
+	return &v1beta1.CustomResourceDefinition{
+		ObjectMeta: v1.ObjectMeta{
+			Name: "globalconfigurations.k8s.nginx.org",
+		},
+		Spec: v1beta1.CustomResourceDefinitionSpec{
+			Group: "k8s.nginx.org",
+			Names: v1beta1.CustomResourceDefinitionNames{
+				Plural:     "globalconfigurations",
+				Singular:   "globalconfiguration",
+				ShortNames: []string{"gc"},
+				Kind:       "GlobalConfiguration",
+			},
+			Scope: "Namespaced",
+			Versions: []v1beta1.CustomResourceDefinitionVersion{
+				{
+					Name:    "v1alpha1",
+					Served:  true,
+					Storage: true,
+				},
+			},
+		},
+	}
+}
+
+func tsForNginxIngressController() *v1beta1.CustomResourceDefinition {
+	return &v1beta1.CustomResourceDefinition{
+		ObjectMeta: v1.ObjectMeta{
+			Name: "transportservers.k8s.nginx.org",
+		},
+		Spec: v1beta1.CustomResourceDefinitionSpec{
+			Group: "k8s.nginx.org",
+			Names: v1beta1.CustomResourceDefinitionNames{
+				Plural:     "transportservers",
+				Singular:   "transportserver",
+				ShortNames: []string{"ts"},
+				Kind:       "TransportServer",
+			},
+			Scope: "Namespaced",
+			Versions: []v1beta1.CustomResourceDefinitionVersion{
+				{
+					Name:    "v1alpha1",
+					Served:  true,
+					Storage: true,
+				},
+			},
+		},
+	}
+}
diff --git a/pkg/controller/nginxingresscontroller/crds_test.go b/pkg/controller/nginxingresscontroller/crds_test.go
@@ -67,3 +67,63 @@ func TestVsrForNginxIngressController(t *testing.T) {
 		t.Errorf("vsrForNginxIngressController() returned %+v but expected %+v", result, expected)
 	}
 }
+
+func TestGcForNginxIngressController(t *testing.T) {
+	expected := &v1beta1.CustomResourceDefinition{
+		ObjectMeta: v1.ObjectMeta{
+			Name: "globalconfigurations.k8s.nginx.org",
+		},
+		Spec: v1beta1.CustomResourceDefinitionSpec{
+			Group: "k8s.nginx.org",
+			Names: v1beta1.CustomResourceDefinitionNames{
+				Plural:     "globalconfigurations",
+				Singular:   "globalconfiguration",
+				ShortNames: []string{"gc"},
+				Kind:       "GlobalConfiguration",
+			},
+			Scope: "Namespaced",
+			Versions: []v1beta1.CustomResourceDefinitionVersion{
+				{
+					Name:    "v1alpha1",
+					Served:  true,
+					Storage: true,
+				},
+			},
+		},
+	}
+
+	result := gcForNginxIngressController()
+	if !reflect.DeepEqual(result, expected) {
+		t.Errorf("gcForNginxIngressController() returned %+v but expected %+v", result, expected)
+	}
+}
+
+func TestTsForNginxIngressController(t *testing.T) {
+	expected := &v1beta1.CustomResourceDefinition{
+		ObjectMeta: v1.ObjectMeta{
+			Name: "transportservers.k8s.nginx.org",
+		},
+		Spec: v1beta1.CustomResourceDefinitionSpec{
+			Group: "k8s.nginx.org",
+			Names: v1beta1.CustomResourceDefinitionNames{
+				Plural:     "transportservers",
+				Singular:   "transportserver",
+				ShortNames: []string{"ts"},
+				Kind:       "TransportServer",
+			},
+			Scope: "Namespaced",
+			Versions: []v1beta1.CustomResourceDefinitionVersion{
+				{
+					Name:    "v1alpha1",
+					Served:  true,
+					Storage: true,
+				},
+			},
+		},
+	}
+
+	result := tsForNginxIngressController()
+	if !reflect.DeepEqual(result, expected) {
+		t.Errorf("tsForNginxIngressController() returned %+v but expected %+v", result, expected)
+	}
+}
diff --git a/pkg/controller/nginxingresscontroller/nginxingresscontroller_controller.go b/pkg/controller/nginxingresscontroller/nginxingresscontroller_controller.go
@@ -59,13 +59,24 @@ func createCommonResources(mgr manager.Manager, sccAPIExists bool) error {
 
 	err := clientReader.Get(context.TODO(), types.NamespacedName{Name: clusterRoleName, Namespace: v1.NamespaceAll}, cr)
 
-	if err != nil && errors.IsNotFound(err) {
-		reqLogger.Info("no previous ClusterRole found, creating a new one.")
-		err = clientWriter.Create(context.TODO(), cr)
-	}
-
 	if err != nil {
-		return fmt.Errorf("error creating ClusterRole: %v", err)
+		if errors.IsNotFound(err) {
+			reqLogger.Info("no previous ClusterRole found, creating a new one.")
+			err = clientWriter.Create(context.TODO(), cr)
+			if err != nil {
+				return fmt.Errorf("error creating ClusterRole: %v", err)
+			}
+		} else {
+			return fmt.Errorf("error getting ClusterRole: %v", err)
+		}
+	} else {
+		// For updates in the ClusterRole permissions (eg new CRDs of the Ingress Controller).
+		reqLogger.Info("previous ClusterRole found, updating.")
+		cr := clusterRoleForNginxIngressController(clusterRoleName)
+		err = clientWriter.Update(context.TODO(), cr)
+		if err != nil {
+			return fmt.Errorf("error updating ClusterRole: %v", err)
+		}
 	}
 
 	crb := clusterRoleBindingForNginxIngressController(clusterRoleName)
@@ -91,7 +102,6 @@ func createCommonResources(mgr manager.Manager, sccAPIExists bool) error {
 	vs := vsForNginxIngressController()
 
 	_, err = crdsClient.Create(vs)
-	// if already exists, pass the error silently
 	if err != nil && errors.IsAlreadyExists(err) {
 		reqLogger.Info("VirtualServer CRD already present, skipping creation.")
 	} else if err != nil {
@@ -106,6 +116,22 @@ func createCommonResources(mgr manager.Manager, sccAPIExists bool) error {
 		return err
 	}
 
+	gc := gcForNginxIngressController()
+	_, err = crdsClient.Create(gc)
+	if err != nil && errors.IsAlreadyExists(err) {
+		reqLogger.Info("GlobalConfiguration CRD already present, skipping creation.")
+	} else if err != nil {
+		return err
+	}
+
+	ts := tsForNginxIngressController()
+	_, err = crdsClient.Create(ts)
+	if err != nil && errors.IsAlreadyExists(err) {
+		reqLogger.Info("TransportServer CRD already present, skipping creation.")
+	} else if err != nil {
+		return err
+	}
+
 	if sccAPIExists {
 		reqLogger.Info("OpenShift detected as platform.")
 

diff --git a/pkg/controller/nginxingresscontroller/rbac.go b/pkg/controller/nginxingresscontroller/rbac.go
@@ -45,7 +45,7 @@ func clusterRoleForNginxIngressController(name string) *rbacv1.ClusterRole {
 		{
 			Verbs:     []string{"get", "list", "watch"},
 			APIGroups: []string{"k8s.nginx.org"},
-			Resources: []string{"virtualservers", "virtualserverroutes"},
+			Resources: []string{"virtualservers", "virtualserverroutes", "globalconfiguration", "transportservers"},
 		},
 	}
 

diff --git a/pkg/controller/nginxingresscontroller/rbac_test.go b/pkg/controller/nginxingresscontroller/rbac_test.go
@@ -53,7 +53,7 @@ func TestClusterRoleForNginxIngressController(t *testing.T) {
 			{
 				Verbs:     []string{"get", "list", "watch"},
 				APIGroups: []string{"k8s.nginx.org"},
-				Resources: []string{"virtualservers", "virtualserverroutes"},
+				Resources: []string{"virtualservers", "virtualserverroutes", "globalconfiguration", "transportservers"},
 			},
 		},
 	}

diff --git a/pkg/controller/nginxingresscontroller/utils.go b/pkg/controller/nginxingresscontroller/utils.go
@@ -3,6 +3,7 @@ package nginxingresscontroller
 import (
 	"fmt"
 	"reflect"
+	"strings"
 
 	k8sv1alpha1 "github.com/nginxinc/nginx-ingress-operator/pkg/apis/k8s/v1alpha1"
 	secv1 "github.com/openshift/api/security/v1"
@@ -13,6 +14,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/config"
 )
 
+const apiVersionUnsupportedError = "server does not support API version"
+
 // generatePodArgs generate a list of arguments for the Ingress Controller pods based on the CRD.
 func generatePodArgs(instance *k8sv1alpha1.NginxIngressController) []string {
 	var args []string
@@ -98,6 +101,16 @@ func generatePodArgs(instance *k8sv1alpha1.NginxIngressController) []string {
 		}
 	}
 
+	if instance.Spec.EnableCRDs {
+		if instance.Spec.EnableTSLPassthrough {
+			args = append(args, "-enable-custom-resources")
+		}
+
+		if instance.Spec.GlobalConfiguration != "" {
+			args = append(args, fmt.Sprintf("-global-configuration=%v", instance.Spec.GlobalConfiguration))
+		}
+	}
+
 	return args
 }
 
@@ -143,6 +156,10 @@ func VerifySCCAPIExists() (bool, error) {
 
 	err = discovery.ServerSupportsVersion(clientSet, gv)
 	if err != nil {
+		// This error means the call could not find SCC in the API, but there was no API error.
+		if strings.Contains(fmt.Sprintf("%v", err), apiVersionUnsupportedError) {
+			return false, nil
+		}
 		return false, err
 	}