-
Notifications
You must be signed in to change notification settings - Fork 4.7k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
migrate serviceaccount controllers to new initialization
- Loading branch information
Showing
9 changed files
with
375 additions
and
139 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,129 @@ | ||
| package controller | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "io/ioutil" | ||
|
|
||
| "github.com/golang/glog" | ||
|
|
||
| "k8s.io/client-go/util/cert" | ||
| kapiv1 "k8s.io/kubernetes/pkg/api/v1" | ||
| sacontroller "k8s.io/kubernetes/pkg/controller/serviceaccount" | ||
| "k8s.io/kubernetes/pkg/serviceaccount" | ||
|
|
||
| configapi "github.com/openshift/origin/pkg/cmd/server/api" | ||
| "github.com/openshift/origin/pkg/cmd/server/bootstrappolicy" | ||
| "github.com/openshift/origin/pkg/cmd/server/crypto" | ||
| serviceaccountcontrollers "github.com/openshift/origin/pkg/serviceaccounts/controllers" | ||
| ) | ||
|
|
||
| type ServiceAccountControllerOptions struct { | ||
| ManagedNames []string | ||
| } | ||
|
|
||
| func (c *ServiceAccountControllerOptions) RunController(ctx ControllerContext) (bool, error) { | ||
| if len(c.ManagedNames) == 0 { | ||
| return true, fmt.Errorf("skipped starting Service Account Manager, no managed names specified") | ||
| } | ||
|
|
||
| options := sacontroller.DefaultServiceAccountsControllerOptions() | ||
| options.ServiceAccounts = []kapiv1.ServiceAccount{} | ||
|
|
||
| for _, saName := range c.ManagedNames { | ||
| sa := kapiv1.ServiceAccount{} | ||
| sa.Name = saName | ||
|
|
||
| options.ServiceAccounts = append(options.ServiceAccounts, sa) | ||
| } | ||
|
|
||
| //REBASE: add new args to NewServiceAccountsController | ||
| go sacontroller.NewServiceAccountsController( | ||
| ctx.DeprecatedOpenshiftInformers.KubernetesInformers().Core().V1().ServiceAccounts(), | ||
| ctx.DeprecatedOpenshiftInformers.KubernetesInformers().Core().V1().Namespaces(), | ||
| ctx.ClientBuilder.ClientOrDie(bootstrappolicy.InfraServiceAccountControllerServiceAccountName), | ||
| options).Run(1, ctx.Stop) | ||
|
|
||
| return true, nil | ||
| } | ||
|
|
||
| type ServiceAccountTokensControllerOptions struct { | ||
| ServiceAccountConfig configapi.ServiceAccountConfig | ||
| ServiceServingCertConfig configapi.ServiceServingCert | ||
| } | ||
|
|
||
| func (c *ServiceAccountTokensControllerOptions) RunController(ctx ControllerContext) (bool, error) { | ||
| if len(c.ServiceAccountConfig.PrivateKeyFile) == 0 { | ||
| return true, fmt.Errorf("skipped starting Service Account Token Manager, no private key specified") | ||
| } | ||
|
|
||
| privateKey, err := serviceaccount.ReadPrivateKey(c.ServiceAccountConfig.PrivateKeyFile) | ||
| if err != nil { | ||
| return true, fmt.Errorf("error reading signing key for Service Account Token Manager: %v", err) | ||
| } | ||
|
|
||
| rootCA := []byte{} | ||
| if len(c.ServiceAccountConfig.MasterCA) > 0 { | ||
| rootCA, err = ioutil.ReadFile(c.ServiceAccountConfig.MasterCA) | ||
| if err != nil { | ||
| glog.Fatalf("error reading master ca file for Service Account Token Manager: %s: %v", c.ServiceAccountConfig.MasterCA, err) | ||
| } | ||
| if _, err := cert.ParseCertsPEM(rootCA); err != nil { | ||
| glog.Fatalf("error parsing master ca file for Service Account Token Manager: %s: %v", c.ServiceAccountConfig.MasterCA, err) | ||
| } | ||
| } | ||
| servingServingCABundle := []byte{} | ||
| if c.ServiceServingCertConfig.Signer != nil && len(c.ServiceServingCertConfig.Signer.CertFile) > 0 { | ||
| certFile := c.ServiceServingCertConfig.Signer.CertFile | ||
| servingServingCA, err := ioutil.ReadFile(certFile) | ||
| if err != nil { | ||
| return true, fmt.Errorf("error reading ca file for Service Serving Certificate Signer: %s: %v", certFile, err) | ||
| } | ||
| if _, err := crypto.CertsFromPEM(servingServingCA); err != nil { | ||
| return true, fmt.Errorf("error parsing ca file for Service Serving Certificate Signer: %s: %v", certFile, err) | ||
| } | ||
|
|
||
| // if we have a rootCA bundle add that too. The rootCA will be used when hitting the default master service, since those are signed | ||
| // using a different CA by default. The rootCA's key is more closely guarded than ours and if it is compromised, that power could | ||
| // be used to change the trusted signers for every pod anyway, so we're already effectively trusting it. | ||
| if len(rootCA) > 0 { | ||
| servingServingCABundle = append(servingServingCABundle, rootCA...) | ||
| servingServingCABundle = append(servingServingCABundle, []byte("\n")...) | ||
| } | ||
| servingServingCABundle = append(servingServingCABundle, servingServingCA...) | ||
| } | ||
|
|
||
| go sacontroller.NewTokensController( | ||
| ctx.RootClientBuilder.ClientOrDie(bootstrappolicy.InfraServiceAccountTokensControllerServiceAccountName), | ||
| sacontroller.TokensControllerOptions{ | ||
| TokenGenerator: serviceaccount.JWTTokenGenerator(privateKey), | ||
| RootCA: rootCA, | ||
| ServiceServingCA: servingServingCABundle, | ||
| }, | ||
| ).Run(int(ctx.KubeControllerContext.Options.ConcurrentSATokenSyncs), ctx.Stop) | ||
|
|
||
| return true, nil | ||
| } | ||
|
|
||
| type ServiceAccountPullSecretsControllerOptions struct { | ||
| } | ||
|
|
||
| func (c *ServiceAccountPullSecretsControllerOptions) RunController(ctx ControllerContext) (bool, error) { | ||
| kc := ctx.ClientBuilder.KubeInternalClientOrDie(bootstrappolicy.InfraServiceAccountPullSecretsControllerServiceAccountName) | ||
|
|
||
| serviceaccountcontrollers.NewDockercfgDeletedController(kc, serviceaccountcontrollers.DockercfgDeletedControllerOptions{}).Run() | ||
| serviceaccountcontrollers.NewDockercfgTokenDeletedController(kc, serviceaccountcontrollers.DockercfgTokenDeletedControllerOptions{}).Run() | ||
|
|
||
| dockerURLsIntialized := make(chan struct{}) | ||
| dockercfgController := serviceaccountcontrollers.NewDockercfgController(kc, serviceaccountcontrollers.DockercfgControllerOptions{DockerURLsIntialized: dockerURLsIntialized}) | ||
| go dockercfgController.Run(5, ctx.Stop) | ||
|
|
||
| dockerRegistryControllerOptions := serviceaccountcontrollers.DockerRegistryServiceControllerOptions{ | ||
| RegistryNamespace: "default", | ||
| RegistryServiceName: "docker-registry", | ||
| DockercfgController: dockercfgController, | ||
| DockerURLsIntialized: dockerURLsIntialized, | ||
| } | ||
| go serviceaccountcontrollers.NewDockerRegistryServiceController(kc, dockerRegistryControllerOptions).Run(10, ctx.Stop) | ||
|
|
||
| return true, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.