mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-09-27 10:24:39 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge branch 'main' into rename_stuff

Browse Source
This commit is contained in:
Ryan Richard
2020-09-18 16:39:58 -07:00
parent a2365b1cce 86e1c99dcd
commit 6989e5da63
318 changed files with 1156 additions and 7087 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/apiserver/apiserver.go
+14 -22
View File
@@ -18,11 +18,9 @@ import (
"k8s.io/client-go/pkg/version"
"k8s.io/klog/v2"
loginapi "github.com/vmware-tanzu/pinniped/generated/1.19/apis/login"
loginv1alpha1 "github.com/vmware-tanzu/pinniped/generated/1.19/apis/login/v1alpha1"
pinnipedapi "github.com/vmware-tanzu/pinniped/generated/1.19/apis/pinniped"
pinnipedv1alpha1 "github.com/vmware-tanzu/pinniped/generated/1.19/apis/pinniped/v1alpha1"
"github.com/vmware-tanzu/pinniped/internal/registry/credentialrequest"
loginapi "go.pinniped.dev/generated/1.19/apis/login"
loginv1alpha1 "go.pinniped.dev/generated/1.19/apis/login/v1alpha1"
"go.pinniped.dev/internal/registry/credentialrequest"
)
var (
@@ -34,8 +32,6 @@ var (
//nolint: gochecknoinits
func init() {
utilruntime.Must(pinnipedv1alpha1.AddToScheme(scheme))
utilruntime.Must(pinnipedapi.AddToScheme(scheme))
utilruntime.Must(loginv1alpha1.AddToScheme(scheme))
utilruntime.Must(loginapi.AddToScheme(scheme))
@@ -101,21 +97,17 @@ func (c completedConfig) New() (*PinnipedServer, error) {
GenericAPIServer: genericServer,
}
restHandler := credentialrequest.NewREST(c.ExtraConfig.TokenAuthenticator, c.ExtraConfig.Issuer)
for gvr, storage := range map[schema.GroupVersionResource]rest.Storage{
pinnipedv1alpha1.SchemeGroupVersion.WithResource("credentialrequests"): restHandler.PinnipedV1alpha1Storage(),
loginv1alpha1.SchemeGroupVersion.WithResource("tokencredentialrequests"): restHandler.LoginV1alpha1Storage(),
} {
if err := s.GenericAPIServer.InstallAPIGroup(&genericapiserver.APIGroupInfo{
PrioritizedVersions: []schema.GroupVersion{gvr.GroupVersion()},
VersionedResourcesStorageMap: map[string]map[string]rest.Storage{gvr.Version: {gvr.Resource: storage}},
OptionsExternalVersion: &schema.GroupVersion{Version: "v1"},
Scheme: scheme,
ParameterCodec: metav1.ParameterCodec,
NegotiatedSerializer: Codecs,
}); err != nil {
return nil, fmt.Errorf("could not install API group %s: %w", gvr.String(), err)
}
gvr := loginv1alpha1.SchemeGroupVersion.WithResource("tokencredentialrequests")
storage := credentialrequest.NewREST(c.ExtraConfig.TokenAuthenticator, c.ExtraConfig.Issuer)
if err := s.GenericAPIServer.InstallAPIGroup(&genericapiserver.APIGroupInfo{
PrioritizedVersions: []schema.GroupVersion{gvr.GroupVersion()},
VersionedResourcesStorageMap: map[string]map[string]rest.Storage{gvr.Version: {gvr.Resource: storage}},
OptionsExternalVersion: &schema.GroupVersion{Version: "v1"},
Scheme: scheme,
ParameterCodec: metav1.ParameterCodec,
NegotiatedSerializer: Codecs,
}); err != nil {
return nil, fmt.Errorf("could not install API group %s: %w", gvr.String(), err)
}
s.GenericAPIServer.AddPostStartHookOrDie("start-controllers",
internal/certauthority/kubecertauthority/kubecertauthority.go
+2 -2
View File
@@ -22,8 +22,8 @@ import (
"k8s.io/client-go/tools/remotecommand"
"k8s.io/klog/v2"
"github.com/vmware-tanzu/pinniped/internal/certauthority"
"github.com/vmware-tanzu/pinniped/internal/constable"
"go.pinniped.dev/internal/certauthority"
"go.pinniped.dev/internal/constable"
)
// ErrNoKubeControllerManagerPod is returned when no kube-controller-manager pod is found on the cluster.
internal/certauthority/kubecertauthority/kubecertauthority_test.go
+1 -1
View File
@@ -21,7 +21,7 @@ import (
kubernetesfake "k8s.io/client-go/kubernetes/fake"
"k8s.io/klog/v2"
"github.com/vmware-tanzu/pinniped/internal/testutil"
"go.pinniped.dev/internal/testutil"
)
type fakePodExecutor struct {
internal/client/client.go
+2 -2
View File
@@ -14,8 +14,8 @@ import (
"k8s.io/client-go/tools/clientcmd"
clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
"github.com/vmware-tanzu/pinniped/generated/1.19/apis/login/v1alpha1"
"github.com/vmware-tanzu/pinniped/generated/1.19/client/clientset/versioned"
"go.pinniped.dev/generated/1.19/apis/login/v1alpha1"
"go.pinniped.dev/generated/1.19/client/clientset/versioned"
)
// ErrLoginFailed is returned by ExchangeToken when the server rejects the login request.
internal/client/client_test.go
+2 -2
View File
@@ -15,8 +15,8 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
clientauthenticationv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
"github.com/vmware-tanzu/pinniped/generated/1.19/apis/login/v1alpha1"
"github.com/vmware-tanzu/pinniped/internal/testutil"
"go.pinniped.dev/generated/1.19/apis/login/v1alpha1"
"go.pinniped.dev/internal/testutil"
)
func TestExchangeToken(t *testing.T) {
internal/controller/apicerts/apiservice_updater.go
+2 -2
View File
@@ -11,8 +11,8 @@ import (
"k8s.io/klog/v2"
aggregatorclient "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset"
pinnipedcontroller "github.com/vmware-tanzu/pinniped/internal/controller"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
pinnipedcontroller "go.pinniped.dev/internal/controller"
"go.pinniped.dev/internal/controllerlib"
)
type apiServiceUpdaterController struct {
internal/controller/apicerts/apiservice_updater_test.go
+7 -7
View File
@@ -22,9 +22,9 @@ import (
apiregistrationv1 "k8s.io/kube-aggregator/pkg/apis/apiregistration/v1"
aggregatorfake "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/fake"
pinnipedv1alpha1 "github.com/vmware-tanzu/pinniped/generated/1.19/apis/pinniped/v1alpha1"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
"github.com/vmware-tanzu/pinniped/internal/testutil"
loginv1alpha1 "go.pinniped.dev/generated/1.19/apis/login/v1alpha1"
"go.pinniped.dev/internal/controllerlib"
"go.pinniped.dev/internal/testutil"
)
func TestAPIServiceUpdaterControllerOptions(t *testing.T) {
@@ -43,7 +43,7 @@ func TestAPIServiceUpdaterControllerOptions(t *testing.T) {
_ = NewAPIServiceUpdaterController(
installedInNamespace,
certsSecretResourceName,
pinnipedv1alpha1.SchemeGroupVersion.Version+"."+pinnipedv1alpha1.GroupName,
loginv1alpha1.SchemeGroupVersion.Version+"."+loginv1alpha1.GroupName,
nil,
secretsInformer,
observableWithInformerOption.WithInformer, // make it possible to observe the behavior of the Filters
@@ -123,7 +123,7 @@ func TestAPIServiceUpdaterControllerSync(t *testing.T) {
subject = NewAPIServiceUpdaterController(
installedInNamespace,
certsSecretResourceName,
pinnipedv1alpha1.SchemeGroupVersion.Version+"."+pinnipedv1alpha1.GroupName,
loginv1alpha1.SchemeGroupVersion.Version+"."+loginv1alpha1.GroupName,
aggregatorAPIClient,
kubeInformers.Core().V1().Secrets(),
controllerlib.WithInformer,
@@ -199,7 +199,7 @@ func TestAPIServiceUpdaterControllerSync(t *testing.T) {
it.Before(func() {
apiService := &apiregistrationv1.APIService{
ObjectMeta: metav1.ObjectMeta{
Name: pinnipedv1alpha1.SchemeGroupVersion.Version + "." + pinnipedv1alpha1.GroupName,
Name: loginv1alpha1.SchemeGroupVersion.Version + "." + loginv1alpha1.GroupName,
},
Spec: apiregistrationv1.APIServiceSpec{
CABundle: nil,
@@ -218,7 +218,7 @@ func TestAPIServiceUpdaterControllerSync(t *testing.T) {
// Make sure we updated the APIService caBundle and left it otherwise unchanged
r.Len(aggregatorAPIClient.Actions(), 2)
r.Equal("get", aggregatorAPIClient.Actions()[0].GetVerb())
expectedAPIServiceName := pinnipedv1alpha1.SchemeGroupVersion.Version + "." + pinnipedv1alpha1.GroupName
expectedAPIServiceName := loginv1alpha1.SchemeGroupVersion.Version + "." + loginv1alpha1.GroupName
expectedUpdateAction := coretesting.NewUpdateAction(
schema.GroupVersionResource{
Group: apiregistrationv1.GroupName,
internal/controller/apicerts/certs_expirer.go
+3 -3
View File
@@ -16,9 +16,9 @@ import (
"k8s.io/client-go/kubernetes"
"k8s.io/klog/v2"
"github.com/vmware-tanzu/pinniped/internal/constable"
pinnipedcontroller "github.com/vmware-tanzu/pinniped/internal/controller"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
"go.pinniped.dev/internal/constable"
pinnipedcontroller "go.pinniped.dev/internal/controller"
"go.pinniped.dev/internal/controllerlib"
)
type certsExpirerController struct {
internal/controller/apicerts/certs_expirer_test.go
+2 -2
View File
@@ -22,8 +22,8 @@ import (
kubernetesfake "k8s.io/client-go/kubernetes/fake"
kubetesting "k8s.io/client-go/testing"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
"github.com/vmware-tanzu/pinniped/internal/testutil"
"go.pinniped.dev/internal/controllerlib"
"go.pinniped.dev/internal/testutil"
)
func TestExpirerControllerFilters(t *testing.T) {
internal/controller/apicerts/certs_manager.go
+3 -3
View File
@@ -15,9 +15,9 @@ import (
"k8s.io/client-go/kubernetes"
"k8s.io/klog/v2"
"github.com/vmware-tanzu/pinniped/internal/certauthority"
pinnipedcontroller "github.com/vmware-tanzu/pinniped/internal/controller"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
"go.pinniped.dev/internal/certauthority"
pinnipedcontroller "go.pinniped.dev/internal/controller"
"go.pinniped.dev/internal/controllerlib"
)
const (
internal/controller/apicerts/certs_manager_test.go
+2 -2
View File
@@ -20,8 +20,8 @@ import (
kubernetesfake "k8s.io/client-go/kubernetes/fake"
coretesting "k8s.io/client-go/testing"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
"github.com/vmware-tanzu/pinniped/internal/testutil"
"go.pinniped.dev/internal/controllerlib"
"go.pinniped.dev/internal/testutil"
)
func TestManagerControllerOptions(t *testing.T) {
internal/controller/apicerts/certs_observer.go
+3 -3
View File
@@ -10,9 +10,9 @@ import (
corev1informers "k8s.io/client-go/informers/core/v1"
"k8s.io/klog/v2"
pinnipedcontroller "github.com/vmware-tanzu/pinniped/internal/controller"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
"github.com/vmware-tanzu/pinniped/internal/provider"
pinnipedcontroller "go.pinniped.dev/internal/controller"
"go.pinniped.dev/internal/controllerlib"
"go.pinniped.dev/internal/provider"
)
type certsObserverController struct {
internal/controller/apicerts/certs_observer_test.go
+3 -3
View File
@@ -16,9 +16,9 @@ import (
kubeinformers "k8s.io/client-go/informers"
kubernetesfake "k8s.io/client-go/kubernetes/fake"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
"github.com/vmware-tanzu/pinniped/internal/provider"
"github.com/vmware-tanzu/pinniped/internal/testutil"
"go.pinniped.dev/internal/controllerlib"
"go.pinniped.dev/internal/provider"
"go.pinniped.dev/internal/testutil"
)
func TestObserverControllerInformerFilters(t *testing.T) {
internal/controller/apicerts/update_api_service_test.go
+3 -3
View File
@@ -17,11 +17,11 @@ import (
apiregistrationv1 "k8s.io/kube-aggregator/pkg/apis/apiregistration/v1"
aggregatorv1fake "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/fake"
pinnipedv1alpha1 "github.com/vmware-tanzu/pinniped/generated/1.19/apis/pinniped/v1alpha1"
loginv1alpha1 "go.pinniped.dev/generated/1.19/apis/login/v1alpha1"
)
func TestUpdateAPIService(t *testing.T) {
const apiServiceName = "v1alpha1.pinniped.dev"
const apiServiceName = "v1alpha1.login.pinniped.dev"
tests := []struct {
name string
@@ -181,7 +181,7 @@ func TestUpdateAPIService(t *testing.T) {
tt.mocks(client)
}
err := UpdateAPIService(ctx, client, pinnipedv1alpha1.SchemeGroupVersion.Version+"."+pinnipedv1alpha1.GroupName, tt.caInput)
err := UpdateAPIService(ctx, client, loginv1alpha1.SchemeGroupVersion.Version+"."+loginv1alpha1.GroupName, tt.caInput)
if tt.wantErr != "" {
require.EqualError(t, err, tt.wantErr)
return
internal/controller/identityprovider/idpcache/cache.go
+1 -1
View File
@@ -11,7 +11,7 @@ import (
"k8s.io/apiserver/pkg/authentication/authenticator"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
"go.pinniped.dev/internal/controllerlib"
)
var (
internal/controller/identityprovider/idpcache/cache_test.go
+2 -2
View File
@@ -12,8 +12,8 @@ import (
"k8s.io/apiserver/pkg/authentication/authenticator"
"k8s.io/apiserver/pkg/authentication/user"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
"github.com/vmware-tanzu/pinniped/internal/mocks/mocktokenauthenticator"
"go.pinniped.dev/internal/controllerlib"
"go.pinniped.dev/internal/mocks/mocktokenauthenticator"
)
func TestCache(t *testing.T) {
internal/controller/identityprovider/webhookcachecleaner/webhookcachecleaner.go
+5 -5
View File
@@ -11,11 +11,11 @@ import (
"k8s.io/apimachinery/pkg/labels"
"k8s.io/klog/v2"
idpv1alpha1 "github.com/vmware-tanzu/pinniped/generated/1.19/apis/idp/v1alpha1"
idpinformers "github.com/vmware-tanzu/pinniped/generated/1.19/client/informers/externalversions/idp/v1alpha1"
pinnipedcontroller "github.com/vmware-tanzu/pinniped/internal/controller"
"github.com/vmware-tanzu/pinniped/internal/controller/identityprovider/idpcache"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
idpinformers "go.pinniped.dev/generated/1.19/client/informers/externalversions/idp/v1alpha1"
pinnipedcontroller "go.pinniped.dev/internal/controller"
"go.pinniped.dev/internal/controller/identityprovider/idpcache"
"go.pinniped.dev/internal/controllerlib"
)
// New instantiates a new controllerlib.Controller which will garbage collect webhooks from the provided Cache.
internal/controller/identityprovider/webhookcachecleaner/webhookcachecleaner_test.go
+6 -6
View File
@@ -13,12 +13,12 @@ import (
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apiserver/pkg/authentication/authenticator"
idpv1alpha "github.com/vmware-tanzu/pinniped/generated/1.19/apis/idp/v1alpha1"
pinnipedfake "github.com/vmware-tanzu/pinniped/generated/1.19/client/clientset/versioned/fake"
pinnipedinformers "github.com/vmware-tanzu/pinniped/generated/1.19/client/informers/externalversions"
"github.com/vmware-tanzu/pinniped/internal/controller/identityprovider/idpcache"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
"github.com/vmware-tanzu/pinniped/internal/testutil/testlogger"
idpv1alpha "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
pinnipedfake "go.pinniped.dev/generated/1.19/client/clientset/versioned/fake"
pinnipedinformers "go.pinniped.dev/generated/1.19/client/informers/externalversions"
"go.pinniped.dev/internal/controller/identityprovider/idpcache"
"go.pinniped.dev/internal/controllerlib"
"go.pinniped.dev/internal/testutil/testlogger"
)
func TestController(t *testing.T) {
internal/controller/identityprovider/webhookcachefiller/webhookcachefiller.go
+5 -5
View File
@@ -20,11 +20,11 @@ import (
clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
"k8s.io/klog/v2"
idpv1alpha1 "github.com/vmware-tanzu/pinniped/generated/1.19/apis/idp/v1alpha1"
idpinformers "github.com/vmware-tanzu/pinniped/generated/1.19/client/informers/externalversions/idp/v1alpha1"
pinnipedcontroller "github.com/vmware-tanzu/pinniped/internal/controller"
"github.com/vmware-tanzu/pinniped/internal/controller/identityprovider/idpcache"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
idpinformers "go.pinniped.dev/generated/1.19/client/informers/externalversions/idp/v1alpha1"
pinnipedcontroller "go.pinniped.dev/internal/controller"
"go.pinniped.dev/internal/controller/identityprovider/idpcache"
"go.pinniped.dev/internal/controllerlib"
)
// New instantiates a new controllerlib.Controller which will populate the provided idpcache.Cache.
internal/controller/identityprovider/webhookcachefiller/webhookcachefiller_test.go
+7 -7
View File
@@ -19,13 +19,13 @@ import (
"k8s.io/client-go/tools/clientcmd"
clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
idpv1alpha1 "github.com/vmware-tanzu/pinniped/generated/1.19/apis/idp/v1alpha1"
pinnipedfake "github.com/vmware-tanzu/pinniped/generated/1.19/client/clientset/versioned/fake"
pinnipedinformers "github.com/vmware-tanzu/pinniped/generated/1.19/client/informers/externalversions"
"github.com/vmware-tanzu/pinniped/internal/controller/identityprovider/idpcache"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
"github.com/vmware-tanzu/pinniped/internal/testutil"
"github.com/vmware-tanzu/pinniped/internal/testutil/testlogger"
idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
pinnipedfake "go.pinniped.dev/generated/1.19/client/clientset/versioned/fake"
pinnipedinformers "go.pinniped.dev/generated/1.19/client/informers/externalversions"
"go.pinniped.dev/internal/controller/identityprovider/idpcache"
"go.pinniped.dev/internal/controllerlib"
"go.pinniped.dev/internal/testutil"
"go.pinniped.dev/internal/testutil/testlogger"
)
func TestController(t *testing.T) {
internal/controller/issuerconfig/create_or_update_credential_issuer_config.go
+11 -11
View File
@@ -12,8 +12,8 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/client-go/util/retry"
crdpinnipedv1alpha1 "github.com/vmware-tanzu/pinniped/generated/1.19/apis/crdpinniped/v1alpha1"
pinnipedclientset "github.com/vmware-tanzu/pinniped/generated/1.19/client/clientset/versioned"
configv1alpha1 "go.pinniped.dev/generated/1.19/apis/config/v1alpha1"
pinnipedclientset "go.pinniped.dev/generated/1.19/client/clientset/versioned"
)
func CreateOrUpdateCredentialIssuerConfig(
@@ -21,11 +21,11 @@ func CreateOrUpdateCredentialIssuerConfig(
credentialIssuerConfigNamespace string,
credentialIssuerConfigResourceName string,
pinnipedClient pinnipedclientset.Interface,
applyUpdatesToCredentialIssuerConfigFunc func(configToUpdate *crdpinnipedv1alpha1.CredentialIssuerConfig),
applyUpdatesToCredentialIssuerConfigFunc func(configToUpdate *configv1alpha1.CredentialIssuerConfig),
) error {
err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
existingCredentialIssuerConfig, err := pinnipedClient.
CrdV1alpha1().
ConfigV1alpha1().
CredentialIssuerConfigs(credentialIssuerConfigNamespace).
Get(ctx, credentialIssuerConfigResourceName, metav1.GetOptions{})
@@ -52,14 +52,14 @@ func CreateOrUpdateCredentialIssuerConfig(
func createOrUpdateCredentialIssuerConfig(
ctx context.Context,
existingCredentialIssuerConfig *crdpinnipedv1alpha1.CredentialIssuerConfig,
existingCredentialIssuerConfig *configv1alpha1.CredentialIssuerConfig,
notFound bool,
credentialIssuerConfigName string,
credentialIssuerConfigNamespace string,
pinnipedClient pinnipedclientset.Interface,
applyUpdatesToCredentialIssuerConfigFunc func(configToUpdate *crdpinnipedv1alpha1.CredentialIssuerConfig),
applyUpdatesToCredentialIssuerConfigFunc func(configToUpdate *configv1alpha1.CredentialIssuerConfig),
) error {
credentialIssuerConfigsClient := pinnipedClient.CrdV1alpha1().CredentialIssuerConfigs(credentialIssuerConfigNamespace)
credentialIssuerConfigsClient := pinnipedClient.ConfigV1alpha1().CredentialIssuerConfigs(credentialIssuerConfigNamespace)
if notFound {
// Create it
@@ -90,15 +90,15 @@ func createOrUpdateCredentialIssuerConfig(
func minimalValidCredentialIssuerConfig(
credentialIssuerConfigName string,
credentialIssuerConfigNamespace string,
) *crdpinnipedv1alpha1.CredentialIssuerConfig {
return &crdpinnipedv1alpha1.CredentialIssuerConfig{
) *configv1alpha1.CredentialIssuerConfig {
return &configv1alpha1.CredentialIssuerConfig{
TypeMeta: metav1.TypeMeta{},
ObjectMeta: metav1.ObjectMeta{
Name: credentialIssuerConfigName,
Namespace: credentialIssuerConfigNamespace,
},
Status: crdpinnipedv1alpha1.CredentialIssuerConfigStatus{
Strategies: []crdpinnipedv1alpha1.CredentialIssuerConfigStrategy{},
Status: configv1alpha1.CredentialIssuerConfigStatus{
Strategies: []configv1alpha1.CredentialIssuerConfigStrategy{},
KubeConfigInfo: nil,
},
}
internal/controller/issuerconfig/create_or_update_credential_issuer_config_test.go
+25 -26
View File
@@ -19,9 +19,8 @@ import (
coretesting "k8s.io/client-go/testing"
apiregistrationv1 "k8s.io/kube-aggregator/pkg/apis/apiregistration/v1"
"github.com/vmware-tanzu/pinniped/generated/1.19/apis/crdpinniped/v1alpha1"
crdpinnipedv1alpha1 "github.com/vmware-tanzu/pinniped/generated/1.19/apis/crdpinniped/v1alpha1"
pinnipedfake "github.com/vmware-tanzu/pinniped/generated/1.19/client/clientset/versioned/fake"
configv1alpha1 "go.pinniped.dev/generated/1.19/apis/config/v1alpha1"
pinnipedfake "go.pinniped.dev/generated/1.19/client/clientset/versioned/fake"
)
func TestCreateOrUpdateCredentialIssuerConfig(t *testing.T) {
@@ -38,8 +37,8 @@ func TestCreateOrUpdateCredentialIssuerConfig(t *testing.T) {
ctx = context.Background()
pinnipedAPIClient = pinnipedfake.NewSimpleClientset()
credentialIssuerConfigGVR = schema.GroupVersionResource{
Group: crdpinnipedv1alpha1.GroupName,
Version: crdpinnipedv1alpha1.SchemeGroupVersion.Version,
Group: configv1alpha1.GroupName,
Version: configv1alpha1.SchemeGroupVersion.Version,
Resource: "credentialissuerconfigs",
}
})
@@ -47,8 +46,8 @@ func TestCreateOrUpdateCredentialIssuerConfig(t *testing.T) {
when("the config does not exist", func() {
it("creates a new config which includes only the updates made by the func parameter", func() {
err := CreateOrUpdateCredentialIssuerConfig(ctx, installationNamespace, credentialIssuerConfigResourceName, pinnipedAPIClient,
func(configToUpdate *v1alpha1.CredentialIssuerConfig) {
configToUpdate.Status.KubeConfigInfo = &crdpinnipedv1alpha1.CredentialIssuerConfigKubeConfigInfo{
func(configToUpdate *configv1alpha1.CredentialIssuerConfig) {
configToUpdate.Status.KubeConfigInfo = &configv1alpha1.CredentialIssuerConfigKubeConfigInfo{
CertificateAuthorityData: "some-ca-value",
}
},
@@ -60,15 +59,15 @@ func TestCreateOrUpdateCredentialIssuerConfig(t *testing.T) {
expectedCreateAction := coretesting.NewCreateAction(
credentialIssuerConfigGVR,
installationNamespace,
&crdpinnipedv1alpha1.CredentialIssuerConfig{
&configv1alpha1.CredentialIssuerConfig{
TypeMeta: metav1.TypeMeta{},
ObjectMeta: metav1.ObjectMeta{
Name: credentialIssuerConfigResourceName,
Namespace: installationNamespace,
},
Status: crdpinnipedv1alpha1.CredentialIssuerConfigStatus{
Strategies: []crdpinnipedv1alpha1.CredentialIssuerConfigStrategy{},
KubeConfigInfo: &crdpinnipedv1alpha1.CredentialIssuerConfigKubeConfigInfo{
Status: configv1alpha1.CredentialIssuerConfigStatus{
Strategies: []configv1alpha1.CredentialIssuerConfigStrategy{},
KubeConfigInfo: &configv1alpha1.CredentialIssuerConfigKubeConfigInfo{
Server: "",
CertificateAuthorityData: "some-ca-value",
},
@@ -88,7 +87,7 @@ func TestCreateOrUpdateCredentialIssuerConfig(t *testing.T) {
it("returns an error", func() {
err := CreateOrUpdateCredentialIssuerConfig(ctx, installationNamespace, credentialIssuerConfigResourceName, pinnipedAPIClient,
func(configToUpdate *v1alpha1.CredentialIssuerConfig) {},
func(configToUpdate *configv1alpha1.CredentialIssuerConfig) {},
)
r.EqualError(err, "could not create or update credentialissuerconfig: create failed: error on create")
})
@@ -96,26 +95,26 @@ func TestCreateOrUpdateCredentialIssuerConfig(t *testing.T) {
})
when("the config already exists", func() {
var existingConfig *crdpinnipedv1alpha1.CredentialIssuerConfig
var existingConfig *configv1alpha1.CredentialIssuerConfig
it.Before(func() {
existingConfig = &crdpinnipedv1alpha1.CredentialIssuerConfig{
existingConfig = &configv1alpha1.CredentialIssuerConfig{
TypeMeta: metav1.TypeMeta{},
ObjectMeta: metav1.ObjectMeta{
Name: credentialIssuerConfigResourceName,
Namespace: installationNamespace,
},
Status: crdpinnipedv1alpha1.CredentialIssuerConfigStatus{
Strategies: []crdpinnipedv1alpha1.CredentialIssuerConfigStrategy{
Status: configv1alpha1.CredentialIssuerConfigStatus{
Strategies: []configv1alpha1.CredentialIssuerConfigStrategy{
{
Type: crdpinnipedv1alpha1.KubeClusterSigningCertificateStrategyType,
Status: crdpinnipedv1alpha1.SuccessStrategyStatus,
Reason: crdpinnipedv1alpha1.FetchedKeyStrategyReason,
Type: configv1alpha1.KubeClusterSigningCertificateStrategyType,
Status: configv1alpha1.SuccessStrategyStatus,
Reason: configv1alpha1.FetchedKeyStrategyReason,
Message: "initial-message",
LastUpdateTime: metav1.Now(),
},
},
KubeConfigInfo: &crdpinnipedv1alpha1.CredentialIssuerConfigKubeConfigInfo{
KubeConfigInfo: &configv1alpha1.CredentialIssuerConfigKubeConfigInfo{
Server: "initial-server-value",
CertificateAuthorityData: "initial-ca-value",
},
@@ -126,7 +125,7 @@ func TestCreateOrUpdateCredentialIssuerConfig(t *testing.T) {
it("updates the existing config to only apply the updates made by the func parameter", func() {
err := CreateOrUpdateCredentialIssuerConfig(ctx, installationNamespace, credentialIssuerConfigResourceName, pinnipedAPIClient,
func(configToUpdate *v1alpha1.CredentialIssuerConfig) {
func(configToUpdate *configv1alpha1.CredentialIssuerConfig) {
configToUpdate.Status.KubeConfigInfo.CertificateAuthorityData = "new-ca-value"
},
)
@@ -144,7 +143,7 @@ func TestCreateOrUpdateCredentialIssuerConfig(t *testing.T) {
it("avoids the cost of an update if the local updates made by the func parameter did not actually change anything", func() {
err := CreateOrUpdateCredentialIssuerConfig(ctx, installationNamespace, credentialIssuerConfigResourceName, pinnipedAPIClient,
func(configToUpdate *v1alpha1.CredentialIssuerConfig) {
func(configToUpdate *configv1alpha1.CredentialIssuerConfig) {
configToUpdate.Status.KubeConfigInfo.CertificateAuthorityData = "initial-ca-value"
t := configToUpdate.Status.Strategies[0].LastUpdateTime
@@ -168,7 +167,7 @@ func TestCreateOrUpdateCredentialIssuerConfig(t *testing.T) {
it("returns an error", func() {
err := CreateOrUpdateCredentialIssuerConfig(ctx, installationNamespace, credentialIssuerConfigResourceName, pinnipedAPIClient,
func(configToUpdate *v1alpha1.CredentialIssuerConfig) {},
func(configToUpdate *configv1alpha1.CredentialIssuerConfig) {},
)
r.EqualError(err, "could not create or update credentialissuerconfig: get failed: error on get")
})
@@ -183,7 +182,7 @@ func TestCreateOrUpdateCredentialIssuerConfig(t *testing.T) {
it("returns an error", func() {
err := CreateOrUpdateCredentialIssuerConfig(ctx, installationNamespace, credentialIssuerConfigResourceName, pinnipedAPIClient,
func(configToUpdate *v1alpha1.CredentialIssuerConfig) {
func(configToUpdate *configv1alpha1.CredentialIssuerConfig) {
configToUpdate.Status.KubeConfigInfo.CertificateAuthorityData = "new-ca-value"
},
)
@@ -192,7 +191,7 @@ func TestCreateOrUpdateCredentialIssuerConfig(t *testing.T) {
})
when("there is a conflict error while updating the existing object on the first try and the next try succeeds", func() {
var slightlyDifferentExistingConfig *crdpinnipedv1alpha1.CredentialIssuerConfig
var slightlyDifferentExistingConfig *configv1alpha1.CredentialIssuerConfig
it.Before(func() {
hit := false
@@ -217,7 +216,7 @@ func TestCreateOrUpdateCredentialIssuerConfig(t *testing.T) {
it("retries updates on conflict", func() {
err := CreateOrUpdateCredentialIssuerConfig(ctx, installationNamespace, credentialIssuerConfigResourceName, pinnipedAPIClient,
func(configToUpdate *v1alpha1.CredentialIssuerConfig) {
func(configToUpdate *configv1alpha1.CredentialIssuerConfig) {
configToUpdate.Status.KubeConfigInfo.CertificateAuthorityData = "new-ca-value"
},
)
internal/controller/issuerconfig/publisher.go
+9 -9
View File
@@ -12,11 +12,11 @@ import (
"k8s.io/client-go/tools/clientcmd"
"k8s.io/klog/v2"
crdpinnipedv1alpha1 "github.com/vmware-tanzu/pinniped/generated/1.19/apis/crdpinniped/v1alpha1"
pinnipedclientset "github.com/vmware-tanzu/pinniped/generated/1.19/client/clientset/versioned"
crdpinnipedv1alpha1informers "github.com/vmware-tanzu/pinniped/generated/1.19/client/informers/externalversions/crdpinniped/v1alpha1"
pinnipedcontroller "github.com/vmware-tanzu/pinniped/internal/controller"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
configv1alpha1 "go.pinniped.dev/generated/1.19/apis/config/v1alpha1"
pinnipedclientset "go.pinniped.dev/generated/1.19/client/clientset/versioned"
configv1alpha1informers "go.pinniped.dev/generated/1.19/client/informers/externalversions/config/v1alpha1"
pinnipedcontroller "go.pinniped.dev/internal/controller"
"go.pinniped.dev/internal/controllerlib"
)
const (
@@ -31,7 +31,7 @@ type publisherController struct {
serverOverride *string
pinnipedClient pinnipedclientset.Interface
configMapInformer corev1informers.ConfigMapInformer
credentialIssuerConfigInformer crdpinnipedv1alpha1informers.CredentialIssuerConfigInformer
credentialIssuerConfigInformer configv1alpha1informers.CredentialIssuerConfigInformer
}
func NewPublisherController(namespace string,
@@ -39,7 +39,7 @@ func NewPublisherController(namespace string,
serverOverride *string,
pinnipedClient pinnipedclientset.Interface,
configMapInformer corev1informers.ConfigMapInformer,
credentialIssuerConfigInformer crdpinnipedv1alpha1informers.CredentialIssuerConfigInformer,
credentialIssuerConfigInformer configv1alpha1informers.CredentialIssuerConfigInformer,
withInformer pinnipedcontroller.WithInformerOptionFunc,
) controllerlib.Controller {
return controllerlib.New(
@@ -117,8 +117,8 @@ func (c *publisherController) Sync(ctx controllerlib.Context) error {
return fmt.Errorf("could not get credentialissuerconfig: %w", err)
}
updateServerAndCAFunc := func(c *crdpinnipedv1alpha1.CredentialIssuerConfig) {
c.Status.KubeConfigInfo = &crdpinnipedv1alpha1.CredentialIssuerConfigKubeConfigInfo{
updateServerAndCAFunc := func(c *configv1alpha1.CredentialIssuerConfig) {
c.Status.KubeConfigInfo = &configv1alpha1.CredentialIssuerConfigKubeConfigInfo{
Server: server,
CertificateAuthorityData: certificateAuthorityData,
}
internal/controller/issuerconfig/publisher_test.go
+28 -20
View File
@@ -20,12 +20,12 @@ import (
kubernetesfake "k8s.io/client-go/kubernetes/fake"
coretesting "k8s.io/client-go/testing"
crdpinnipedv1alpha1 "github.com/vmware-tanzu/pinniped/generated/1.19/apis/crdpinniped/v1alpha1"
pinnipedfake "github.com/vmware-tanzu/pinniped/generated/1.19/client/clientset/versioned/fake"
pinnipedinformers "github.com/vmware-tanzu/pinniped/generated/1.19/client/informers/externalversions"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
"github.com/vmware-tanzu/pinniped/internal/here"
"github.com/vmware-tanzu/pinniped/internal/testutil"
configv1alpha1 "go.pinniped.dev/generated/1.19/apis/config/v1alpha1"
pinnipedfake "go.pinniped.dev/generated/1.19/client/clientset/versioned/fake"
pinnipedinformers "go.pinniped.dev/generated/1.19/client/informers/externalversions"
"go.pinniped.dev/internal/controllerlib"
"go.pinniped.dev/internal/here"
"go.pinniped.dev/internal/testutil"
)
func TestInformerFilters(t *testing.T) {
@@ -42,8 +42,16 @@ func TestInformerFilters(t *testing.T) {
r = require.New(t)
observableWithInformerOption = testutil.NewObservableWithInformerOption()
configMapInformer := kubeinformers.NewSharedInformerFactory(nil, 0).Core().V1().ConfigMaps()
credentialIssuerConfigInformer := pinnipedinformers.NewSharedInformerFactory(nil, 0).Crd().V1alpha1().CredentialIssuerConfigs()
_ = NewPublisherController(installedInNamespace, credentialIssuerConfigResourceName, nil, nil, configMapInformer, credentialIssuerConfigInformer, observableWithInformerOption.WithInformer)
credentialIssuerConfigInformer := pinnipedinformers.NewSharedInformerFactory(nil, 0).Config().V1alpha1().CredentialIssuerConfigs()
_ = NewPublisherController(
installedInNamespace,
credentialIssuerConfigResourceName,
nil,
nil,
configMapInformer,
credentialIssuerConfigInformer,
observableWithInformerOption.WithInformer, // make it possible to observe the behavior of the Filters
)
configMapInformerFilter = observableWithInformerOption.GetFilterForInformer(configMapInformer)
credentialIssuerConfigInformerFilter = observableWithInformerOption.GetFilterForInformer(credentialIssuerConfigInformer)
})
@@ -98,20 +106,20 @@ func TestInformerFilters(t *testing.T) {
when("watching CredentialIssuerConfig objects", func() {
var subject controllerlib.Filter
var target, wrongNamespace, wrongName, unrelated *crdpinnipedv1alpha1.CredentialIssuerConfig
var target, wrongNamespace, wrongName, unrelated *configv1alpha1.CredentialIssuerConfig
it.Before(func() {
subject = credentialIssuerConfigInformerFilter
target = &crdpinnipedv1alpha1.CredentialIssuerConfig{
target = &configv1alpha1.CredentialIssuerConfig{
ObjectMeta: metav1.ObjectMeta{Name: credentialIssuerConfigResourceName, Namespace: installedInNamespace},
}
wrongNamespace = &crdpinnipedv1alpha1.CredentialIssuerConfig{
wrongNamespace = &configv1alpha1.CredentialIssuerConfig{
ObjectMeta: metav1.ObjectMeta{Name: credentialIssuerConfigResourceName, Namespace: "wrong-namespace"},
}
wrongName = &crdpinnipedv1alpha1.CredentialIssuerConfig{
wrongName = &configv1alpha1.CredentialIssuerConfig{
ObjectMeta: metav1.ObjectMeta{Name: "wrong-name", Namespace: installedInNamespace},
}
unrelated = &crdpinnipedv1alpha1.CredentialIssuerConfig{
unrelated = &configv1alpha1.CredentialIssuerConfig{
ObjectMeta: metav1.ObjectMeta{Name: "wrong-name", Namespace: "wrong-namespace"},
}
})
@@ -172,20 +180,20 @@ func TestSync(t *testing.T) {
var timeoutContextCancel context.CancelFunc
var syncContext *controllerlib.Context
var expectedCredentialIssuerConfig = func(expectedNamespace, expectedServerURL, expectedCAData string) (schema.GroupVersionResource, *crdpinnipedv1alpha1.CredentialIssuerConfig) {
var expectedCredentialIssuerConfig = func(expectedNamespace, expectedServerURL, expectedCAData string) (schema.GroupVersionResource, *configv1alpha1.CredentialIssuerConfig) {
expectedCredentialIssuerConfigGVR := schema.GroupVersionResource{
Group: crdpinnipedv1alpha1.GroupName,
Group: configv1alpha1.GroupName,
Version: "v1alpha1",
Resource: "credentialissuerconfigs",
}
expectedCredentialIssuerConfig := &crdpinnipedv1alpha1.CredentialIssuerConfig{
expectedCredentialIssuerConfig := &configv1alpha1.CredentialIssuerConfig{
ObjectMeta: metav1.ObjectMeta{
Name: credentialIssuerConfigResourceName,
Namespace: expectedNamespace,
},
Status: crdpinnipedv1alpha1.CredentialIssuerConfigStatus{
Strategies: []crdpinnipedv1alpha1.CredentialIssuerConfigStrategy{},
KubeConfigInfo: &crdpinnipedv1alpha1.CredentialIssuerConfigKubeConfigInfo{
Status: configv1alpha1.CredentialIssuerConfigStatus{
Strategies: []configv1alpha1.CredentialIssuerConfigStrategy{},
KubeConfigInfo: &configv1alpha1.CredentialIssuerConfigKubeConfigInfo{
Server: expectedServerURL,
CertificateAuthorityData: expectedCAData,
},
@@ -204,7 +212,7 @@ func TestSync(t *testing.T) {
serverOverride,
pinnipedAPIClient,
kubeInformers.Core().V1().ConfigMaps(),
pinnipedInformers.Crd().V1alpha1().CredentialIssuerConfigs(),
pinnipedInformers.Config().V1alpha1().CredentialIssuerConfigs(),
controllerlib.WithInformer,
)
internal/controller/utils.go
+1 -1
View File
@@ -6,7 +6,7 @@ package controller
import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
"go.pinniped.dev/internal/controllerlib"
)
func NameAndNamespaceExactMatchFilterFactory(name, namespace string) controllerlib.Filter {
internal/controllerlib/test/integration/examplecontroller/controller/creating.go
+2 -2
View File
@@ -16,8 +16,8 @@ import (
"k8s.io/client-go/tools/events"
"k8s.io/klog/v2"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
"github.com/vmware-tanzu/pinniped/internal/controllerlib/test/integration/examplecontroller/api"
"go.pinniped.dev/internal/controllerlib"
"go.pinniped.dev/internal/controllerlib/test/integration/examplecontroller/api"
)
//nolint:funlen
internal/controllerlib/test/integration/examplecontroller/controller/creating_test.go
+2 -2
View File
@@ -17,8 +17,8 @@ import (
coretesting "k8s.io/client-go/testing"
"k8s.io/client-go/tools/events"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
"github.com/vmware-tanzu/pinniped/internal/controllerlib/test/integration/examplecontroller/api"
"go.pinniped.dev/internal/controllerlib"
"go.pinniped.dev/internal/controllerlib/test/integration/examplecontroller/api"
)
func TestNewExampleCreatingController(t *testing.T) {
internal/controllerlib/test/integration/examplecontroller/controller/updating.go
+2 -2
View File
@@ -16,8 +16,8 @@ import (
corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
"k8s.io/client-go/tools/events"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
"github.com/vmware-tanzu/pinniped/internal/controllerlib/test/integration/examplecontroller/api"
"go.pinniped.dev/internal/controllerlib"
"go.pinniped.dev/internal/controllerlib/test/integration/examplecontroller/api"
)
func NewExampleUpdatingController(
internal/controllerlib/test/integration/examplecontroller/starter/starter.go
+2 -2
View File
@@ -13,8 +13,8 @@ import (
"k8s.io/client-go/rest"
"k8s.io/client-go/tools/events"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
examplecontroller "github.com/vmware-tanzu/pinniped/internal/controllerlib/test/integration/examplecontroller/controller"
"go.pinniped.dev/internal/controllerlib"
examplecontroller "go.pinniped.dev/internal/controllerlib/test/integration/examplecontroller/controller"
)
func StartExampleController(ctx context.Context, config *rest.Config, secretData string) error {
internal/controllerlib/test/integration/examplecontroller_test.go
+3 -3
View File
@@ -13,9 +13,9 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/watch"
"github.com/vmware-tanzu/pinniped/internal/controllerlib/test/integration/examplecontroller/api"
examplestart "github.com/vmware-tanzu/pinniped/internal/controllerlib/test/integration/examplecontroller/starter"
"github.com/vmware-tanzu/pinniped/test/library"
"go.pinniped.dev/internal/controllerlib/test/integration/examplecontroller/api"
examplestart "go.pinniped.dev/internal/controllerlib/test/integration/examplecontroller/starter"
"go.pinniped.dev/test/library"
)
func TestExampleController(t *testing.T) {
internal/controllermanager/prepare_controllers.go
+12 -24
View File
@@ -15,18 +15,17 @@ import (
"k8s.io/klog/v2/klogr"
aggregatorclient "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset"
loginv1alpha1 "github.com/vmware-tanzu/pinniped/generated/1.19/apis/login/v1alpha1"
pinnipedv1alpha1 "github.com/vmware-tanzu/pinniped/generated/1.19/apis/pinniped/v1alpha1"
pinnipedclientset "github.com/vmware-tanzu/pinniped/generated/1.19/client/clientset/versioned"
pinnipedinformers "github.com/vmware-tanzu/pinniped/generated/1.19/client/informers/externalversions"
"github.com/vmware-tanzu/pinniped/internal/controller/apicerts"
"github.com/vmware-tanzu/pinniped/internal/controller/identityprovider/idpcache"
"github.com/vmware-tanzu/pinniped/internal/controller/identityprovider/webhookcachecleaner"
"github.com/vmware-tanzu/pinniped/internal/controller/identityprovider/webhookcachefiller"
"github.com/vmware-tanzu/pinniped/internal/controller/issuerconfig"
"github.com/vmware-tanzu/pinniped/internal/controllerlib"
"github.com/vmware-tanzu/pinniped/internal/provider"
"github.com/vmware-tanzu/pinniped/pkg/config/api"
loginv1alpha1 "go.pinniped.dev/generated/1.19/apis/login/v1alpha1"
pinnipedclientset "go.pinniped.dev/generated/1.19/client/clientset/versioned"
pinnipedinformers "go.pinniped.dev/generated/1.19/client/informers/externalversions"
"go.pinniped.dev/internal/controller/apicerts"
"go.pinniped.dev/internal/controller/identityprovider/idpcache"
"go.pinniped.dev/internal/controller/identityprovider/webhookcachecleaner"
"go.pinniped.dev/internal/controller/identityprovider/webhookcachefiller"
"go.pinniped.dev/internal/controller/issuerconfig"
"go.pinniped.dev/internal/controllerlib"
"go.pinniped.dev/internal/provider"
"go.pinniped.dev/pkg/config/api"
)
const (
@@ -63,7 +62,7 @@ func PrepareControllers(
discoveryURLOverride,
pinnipedClient,
kubePublicNamespaceK8sInformers.Core().V1().ConfigMaps(),
installationNamespacePinnipedInformers.Crd().V1alpha1().CredentialIssuerConfigs(),
installationNamespacePinnipedInformers.Config().V1alpha1().CredentialIssuerConfigs(),
controllerlib.WithInformer,
),
singletonWorker,
@@ -82,17 +81,6 @@ func PrepareControllers(
),
singletonWorker,
).
WithController(
apicerts.NewAPIServiceUpdaterController(
serverInstallationNamespace,
namesConfig.ServingCertificateSecret,
pinnipedv1alpha1.SchemeGroupVersion.Version+"."+pinnipedv1alpha1.GroupName,
aggregatorClient,
installationNamespaceK8sInformers.Core().V1().Secrets(),
controllerlib.WithInformer,
),
singletonWorker,
).
WithController(
apicerts.NewAPIServiceUpdaterController(
serverInstallationNamespace,
internal/mocks/mockcertissuer/generate.go
+1 -1
View File
@@ -3,4 +3,4 @@
package mockcertissuer
//go:generate go run -v github.com/golang/mock/mockgen -destination=mockcertissuer.go -package=mockcertissuer -copyright_file=../../../hack/header.txt github.com/vmware-tanzu/pinniped/internal/registry/credentialrequest CertIssuer
//go:generate go run -v github.com/golang/mock/mockgen -destination=mockcertissuer.go -package=mockcertissuer -copyright_file=../../../hack/header.txt go.pinniped.dev/internal/registry/credentialrequest CertIssuer
internal/mocks/mockcertissuer/mockcertissuer.go
+1 -1
View File
@@ -3,7 +3,7 @@
//
// Code generated by MockGen. DO NOT EDIT.
// Source: github.com/vmware-tanzu/pinniped/internal/registry/credentialrequest (interfaces: CertIssuer)
// Source: go.pinniped.dev/internal/registry/credentialrequest (interfaces: CertIssuer)
// Package mockcertissuer is a generated GoMock package.
package mockcertissuer
internal/registry/credentialrequest/conversions.go
-54
View File
@@ -1,54 +0,0 @@
// Copyright 2020 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package credentialrequest
import (
loginapi "github.com/vmware-tanzu/pinniped/generated/1.19/apis/login"
pinnipedapi "github.com/vmware-tanzu/pinniped/generated/1.19/apis/pinniped"
)
func convertToLoginAPI(input *pinnipedapi.CredentialRequest) *loginapi.TokenCredentialRequest {
if input == nil {
return nil
}
result := loginapi.TokenCredentialRequest{}
result.ObjectMeta = input.ObjectMeta
if input.Spec.Token != nil {
result.Spec.Token = input.Spec.Token.Value
}
result.Status.Message = input.Status.Message
if input.Status.Credential != nil {
result.Status.Credential = &loginapi.ClusterCredential{
ExpirationTimestamp: input.Status.Credential.ExpirationTimestamp,
Token: input.Status.Credential.Token,
ClientCertificateData: input.Status.Credential.ClientCertificateData,
ClientKeyData: input.Status.Credential.ClientKeyData,
}
}
return &result
}
func convertFromLoginAPI(input *loginapi.TokenCredentialRequest) *pinnipedapi.CredentialRequest {
if input == nil {
return nil
}
result := pinnipedapi.CredentialRequest{}
result.ObjectMeta = input.ObjectMeta
if input.Spec.Token != "" {
result.Spec.Type = pinnipedapi.TokenCredentialType
result.Spec.Token = &pinnipedapi.CredentialRequestTokenCredential{Value: input.Spec.Token}
}
result.Status.Message = input.Status.Message
if input.Status.Credential != nil {
result.Status.Credential = &pinnipedapi.CredentialRequestCredential{
ExpirationTimestamp: input.Status.Credential.ExpirationTimestamp,
Token: input.Status.Credential.Token,
ClientCertificateData: input.Status.Credential.ClientCertificateData,
ClientKeyData: input.Status.Credential.ClientKeyData,
}
}
return &result
}
internal/registry/credentialrequest/conversions_test.go
-111
View File
@@ -1,111 +0,0 @@
// Copyright 2020 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package credentialrequest
import (
"testing"
"time"
"github.com/stretchr/testify/require"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
loginapi "github.com/vmware-tanzu/pinniped/generated/1.19/apis/login"
pinnipedapi "github.com/vmware-tanzu/pinniped/generated/1.19/apis/pinniped"
)
func TestConversions(t *testing.T) {
now := time.Now()
errMsg := "some error message"
tests := []struct {
name string
new *loginapi.TokenCredentialRequest
old *pinnipedapi.CredentialRequest
}{
{
name: "nil input",
},
{
name: "usual request",
new: &loginapi.TokenCredentialRequest{
ObjectMeta: metav1.ObjectMeta{
Name: "test-object",
},
Spec: loginapi.TokenCredentialRequestSpec{Token: "test-token"},
},
old: &pinnipedapi.CredentialRequest{
ObjectMeta: metav1.ObjectMeta{
Name: "test-object",
},
Spec: pinnipedapi.CredentialRequestSpec{
Type: pinnipedapi.TokenCredentialType,
Token: &pinnipedapi.CredentialRequestTokenCredential{Value: "test-token"},
},
},
},
{
name: "usual response",
new: &loginapi.TokenCredentialRequest{
ObjectMeta: metav1.ObjectMeta{
Name: "test-object",
},
Status: loginapi.TokenCredentialRequestStatus{
Credential: &loginapi.ClusterCredential{
ExpirationTimestamp: metav1.NewTime(now),
Token: "test-cluster-token",
ClientCertificateData: "test-cluster-cert",
ClientKeyData: "test-cluster-key",
},
},
},
old: &pinnipedapi.CredentialRequest{
ObjectMeta: metav1.ObjectMeta{
Name: "test-object",
},
Status: pinnipedapi.CredentialRequestStatus{
Credential: &pinnipedapi.CredentialRequestCredential{
ExpirationTimestamp: metav1.NewTime(now),
Token: "test-cluster-token",
ClientCertificateData: "test-cluster-cert",
ClientKeyData: "test-cluster-key",
},
},
},
},
{
name: "error response",
new: &loginapi.TokenCredentialRequest{
ObjectMeta: metav1.ObjectMeta{
Name: "test-object",
},
Status: loginapi.TokenCredentialRequestStatus{
Message: &errMsg,
},
},
old: &pinnipedapi.CredentialRequest{
ObjectMeta: metav1.ObjectMeta{
Name: "test-object",
},
Status: pinnipedapi.CredentialRequestStatus{
Message: &errMsg,
},
},
},
}
for _, tt := range tests {
tt := tt
t.Run(tt.name, func(t *testing.T) {
t.Run("upgrade", func(t *testing.T) {
require.Equal(t, tt.new, convertToLoginAPI(tt.old))
})
t.Run("downgrade", func(t *testing.T) {
require.Equal(t, tt.old, convertFromLoginAPI(tt.new))
})
t.Run("roundtrip", func(t *testing.T) {
require.Equal(t, tt.old, convertFromLoginAPI(convertToLoginAPI(tt.old)))
require.Equal(t, tt.new, convertToLoginAPI(convertFromLoginAPI(tt.new)))
})
})
}
}
internal/registry/credentialrequest/rest.go
+23 -55
View File
@@ -18,8 +18,7 @@ import (
"k8s.io/apiserver/pkg/registry/rest"
"k8s.io/utils/trace"
loginapi "github.com/vmware-tanzu/pinniped/generated/1.19/apis/login"
pinnipedapi "github.com/vmware-tanzu/pinniped/generated/1.19/apis/pinniped"
loginapi "go.pinniped.dev/generated/1.19/apis/login"
)
// clientCertificateTTL is the TTL for short-lived client certificates returned by this API.
@@ -48,23 +47,13 @@ type REST struct {
issuer CertIssuer
}
// PinnipedV1alpha1Storage returns a wrapper of the REST which serves the pinniped.dev/v1alpha1 API.
func (r *REST) PinnipedV1alpha1Storage() Storage { return &oldAPIREST{r} }
func (*REST) New() runtime.Object {
return &loginapi.TokenCredentialRequest{}
}
type oldAPIREST struct{ *REST }
func (*oldAPIREST) New() runtime.Object { return &pinnipedapi.CredentialRequest{} }
func (*oldAPIREST) NamespaceScoped() bool { return false }
// LoginV1alpha1Storage returns a wrapper of the REST which serves the login.pinniped.dev/v1alpha1 API.
func (r *REST) LoginV1alpha1Storage() Storage { return &newAPIREST{r} }
type newAPIREST struct{ *REST }
func (*newAPIREST) New() runtime.Object { return &loginapi.TokenCredentialRequest{} }
func (*newAPIREST) NamespaceScoped() bool { return true }
func (*REST) NamespaceScoped() bool {
return true
}
func (r *REST) Create(ctx context.Context, obj runtime.Object, createValidation rest.ValidateObjectFunc, options *metav1.CreateOptions) (runtime.Object, error) {
t := trace.FromContext(ctx).Nest("create", trace.Field{
@@ -73,13 +62,6 @@ func (r *REST) Create(ctx context.Context, obj runtime.Object, createValidation
})
defer t.Log()
// If the incoming request is from the newer version of the API, convert it into the older API and map the result back later.
convertResponse := func(in *pinnipedapi.CredentialRequest) runtime.Object { return in }
if req, ok := obj.(*loginapi.TokenCredentialRequest); ok {
obj = convertFromLoginAPI(req)
convertResponse = func(in *pinnipedapi.CredentialRequest) runtime.Object { return convertToLoginAPI(in) }
}
credentialRequest, err := validateRequest(ctx, obj, createValidation, options, t)
if err != nil {
return nil, err
@@ -97,14 +79,14 @@ func (r *REST) Create(ctx context.Context, obj runtime.Object, createValidation
}
}()
authResponse, authenticated, err := r.tokenAuthenticator.AuthenticateToken(cancelCtx, credentialRequest.Spec.Token.Value)
authResponse, authenticated, err := r.tokenAuthenticator.AuthenticateToken(cancelCtx, credentialRequest.Spec.Token)
if err != nil {
traceFailureWithError(t, "webhook authentication", err)
return convertResponse(failureResponse()), nil
return failureResponse(), nil
}
if !authenticated || authResponse == nil || authResponse.User == nil || authResponse.User.GetName() == "" {
traceSuccess(t, authResponse, authenticated, false)
return convertResponse(failureResponse()), nil
return failureResponse(), nil
}
username := authResponse.User.GetName()
@@ -125,41 +107,28 @@ func (r *REST) Create(ctx context.Context, obj runtime.Object, createValidation
traceSuccess(t, authResponse, authenticated, true)
return convertResponse(&pinnipedapi.CredentialRequest{
Status: pinnipedapi.CredentialRequestStatus{
Credential: &pinnipedapi.CredentialRequestCredential{
return &loginapi.TokenCredentialRequest{
Status: loginapi.TokenCredentialRequestStatus{
Credential: &loginapi.ClusterCredential{
ExpirationTimestamp: metav1.NewTime(time.Now().UTC().Add(clientCertificateTTL)),
ClientCertificateData: string(certPEM),
ClientKeyData: string(keyPEM),
},
},
}), nil
}, nil
}
func validateRequest(ctx context.Context, obj runtime.Object, createValidation rest.ValidateObjectFunc, options *metav1.CreateOptions, t *trace.Trace) (*pinnipedapi.CredentialRequest, error) {
credentialRequest, ok := obj.(*pinnipedapi.CredentialRequest)
func validateRequest(ctx context.Context, obj runtime.Object, createValidation rest.ValidateObjectFunc, options *metav1.CreateOptions, t *trace.Trace) (*loginapi.TokenCredentialRequest, error) {
credentialRequest, ok := obj.(*loginapi.TokenCredentialRequest)
if !ok {
traceValidationFailure(t, "not a CredentialRequest")
return nil, apierrors.NewBadRequest(fmt.Sprintf("not a CredentialRequest: %#v", obj))
}
if len(credentialRequest.Spec.Type) == 0 {
traceValidationFailure(t, "type must be supplied")
errs := field.ErrorList{field.Required(field.NewPath("spec", "type"), "type must be supplied")}
return nil, apierrors.NewInvalid(pinnipedapi.Kind(credentialRequest.Kind), credentialRequest.Name, errs)
}
if credentialRequest.Spec.Type != pinnipedapi.TokenCredentialType {
traceValidationFailure(t, "unrecognized type")
errs := field.ErrorList{field.Invalid(field.NewPath("spec", "type"), credentialRequest.Spec.Type, "unrecognized type")}
return nil, apierrors.NewInvalid(pinnipedapi.Kind(credentialRequest.Kind), credentialRequest.Name, errs)
}
token := credentialRequest.Spec.Token
if token == nil || len(token.Value) == 0 {
if len(credentialRequest.Spec.Token) == 0 {
traceValidationFailure(t, "token must be supplied")
errs := field.ErrorList{field.Required(field.NewPath("spec", "token", "value"), "token must be supplied")}
return nil, apierrors.NewInvalid(pinnipedapi.Kind(credentialRequest.Kind), credentialRequest.Name, errs)
return nil, apierrors.NewInvalid(loginapi.Kind(credentialRequest.Kind), credentialRequest.Name, errs)
}
// just a sanity check, not sure how to honor a dry run on a virtual API
@@ -167,7 +136,7 @@ func validateRequest(ctx context.Context, obj runtime.Object, createValidation r
if len(options.DryRun) != 0 {
traceValidationFailure(t, "dryRun not supported")
errs := field.ErrorList{field.NotSupported(field.NewPath("dryRun"), options.DryRun, nil)}
return nil, apierrors.NewInvalid(pinnipedapi.Kind(credentialRequest.Kind), credentialRequest.Name, errs)
return nil, apierrors.NewInvalid(loginapi.Kind(credentialRequest.Kind), credentialRequest.Name, errs)
}
}
@@ -178,8 +147,7 @@ func validateRequest(ctx context.Context, obj runtime.Object, createValidation r
// they already got the token.
if createValidation != nil {
requestForValidation := obj.DeepCopyObject()
credentialRequestCopy, _ := requestForValidation.(*pinnipedapi.CredentialRequest)
credentialRequestCopy.Spec.Token.Value = ""
requestForValidation.(*loginapi.TokenCredentialRequest).Spec.Token = ""
if err := createValidation(ctx, requestForValidation); err != nil {
traceFailureWithError(t, "validation webhook", err)
return nil, err
@@ -215,10 +183,10 @@ func traceFailureWithError(t *trace.Trace, failureType string, err error) {
)
}
func failureResponse() *pinnipedapi.CredentialRequest {
func failureResponse() *loginapi.TokenCredentialRequest {
m := "authentication failed"
return &pinnipedapi.CredentialRequest{
Status: pinnipedapi.CredentialRequestStatus{
return &loginapi.TokenCredentialRequest{
Status: loginapi.TokenCredentialRequestStatus{
Credential: nil,
Message: &m,
},
internal/registry/credentialrequest/rest_test.go
+22 -63
View File
@@ -23,10 +23,9 @@ import (
"k8s.io/apiserver/pkg/registry/rest"
"k8s.io/klog/v2"
loginapi "github.com/vmware-tanzu/pinniped/generated/1.19/apis/login"
pinnipedapi "github.com/vmware-tanzu/pinniped/generated/1.19/apis/pinniped"
"github.com/vmware-tanzu/pinniped/internal/mocks/mockcertissuer"
"github.com/vmware-tanzu/pinniped/internal/testutil"
loginapi "go.pinniped.dev/generated/1.19/apis/login"
"go.pinniped.dev/internal/mocks/mockcertissuer"
"go.pinniped.dev/internal/testutil"
)
type contextKey struct{}
@@ -104,16 +103,16 @@ func TestCreate(t *testing.T) {
response, err := callCreate(context.Background(), storage, validCredentialRequestWithToken(requestToken))
r.NoError(err)
r.IsType(&pinnipedapi.CredentialRequest{}, response)
r.IsType(&loginapi.TokenCredentialRequest{}, response)
expires := response.(*pinnipedapi.CredentialRequest).Status.Credential.ExpirationTimestamp
expires := response.(*loginapi.TokenCredentialRequest).Status.Credential.ExpirationTimestamp
r.NotNil(expires)
r.InDelta(time.Now().Add(1*time.Hour).Unix(), expires.Unix(), 5)
response.(*pinnipedapi.CredentialRequest).Status.Credential.ExpirationTimestamp = metav1.Time{}
response.(*loginapi.TokenCredentialRequest).Status.Credential.ExpirationTimestamp = metav1.Time{}
r.Equal(response, &pinnipedapi.CredentialRequest{
Status: pinnipedapi.CredentialRequestStatus{
Credential: &pinnipedapi.CredentialRequestCredential{
r.Equal(response, &loginapi.TokenCredentialRequest{
Status: loginapi.TokenCredentialRequestStatus{
Credential: &loginapi.ClusterCredential{
ExpirationTimestamp: metav1.Time{},
ClientCertificateData: "test-cert",
ClientKeyData: "test-key",
@@ -315,47 +314,10 @@ func TestCreate(t *testing.T) {
requireOneLogStatement(r, logger, `"failure" failureType:request validation,msg:not a CredentialRequest`)
})
it("CreateFailsWhenTokenIsNilInRequest", func() {
storage := NewREST(&FakeToken{}, nil)
response, err := callCreate(context.Background(), storage, credentialRequest(pinnipedapi.CredentialRequestSpec{
Type: pinnipedapi.TokenCredentialType,
Token: nil,
}))
requireAPIError(t, response, err, apierrors.IsInvalid,
`.pinniped.dev "request name" is invalid: spec.token.value: Required value: token must be supplied`)
requireOneLogStatement(r, logger, `"failure" failureType:request validation,msg:token must be supplied`)
})
it("CreateFailsWhenTypeInRequestIsMissing", func() {
storage := NewREST(&FakeToken{}, nil)
response, err := callCreate(context.Background(), storage, credentialRequest(pinnipedapi.CredentialRequestSpec{
Type: "",
Token: &pinnipedapi.CredentialRequestTokenCredential{Value: "a token"},
}))
requireAPIError(t, response, err, apierrors.IsInvalid,
`.pinniped.dev "request name" is invalid: spec.type: Required value: type must be supplied`)
requireOneLogStatement(r, logger, `"failure" failureType:request validation,msg:type must be supplied`)
})
it("CreateFailsWhenTypeInRequestIsNotLegal", func() {
storage := NewREST(&FakeToken{}, nil)
response, err := callCreate(context.Background(), storage, credentialRequest(pinnipedapi.CredentialRequestSpec{
Type: "this in an invalid type",
Token: &pinnipedapi.CredentialRequestTokenCredential{Value: "a token"},
}))
requireAPIError(t, response, err, apierrors.IsInvalid,
`.pinniped.dev "request name" is invalid: spec.type: Invalid value: "this in an invalid type": unrecognized type`)
requireOneLogStatement(r, logger, `"failure" failureType:request validation,msg:unrecognized type`)
})
it("CreateFailsWhenTokenValueIsEmptyInRequest", func() {
storage := NewREST(&FakeToken{}, nil)
response, err := callCreate(context.Background(), storage, credentialRequest(pinnipedapi.CredentialRequestSpec{
Type: pinnipedapi.TokenCredentialType,
Token: &pinnipedapi.CredentialRequestTokenCredential{Value: ""},
response, err := callCreate(context.Background(), storage, credentialRequest(loginapi.TokenCredentialRequestSpec{
Token: "",
}))
requireAPIError(t, response, err, apierrors.IsInvalid,
@@ -387,8 +349,8 @@ func TestCreate(t *testing.T) {
context.Background(),
validCredentialRequestWithToken(requestToken),
func(ctx context.Context, obj runtime.Object) error {
credentialRequest, _ := obj.(*pinnipedapi.CredentialRequest)
credentialRequest.Spec.Token.Value = "foobaz"
credentialRequest, _ := obj.(*loginapi.TokenCredentialRequest)
credentialRequest.Spec.Token = "foobaz"
return nil
},
&metav1.CreateOptions{})
@@ -409,9 +371,9 @@ func TestCreate(t *testing.T) {
context.Background(),
validCredentialRequest(),
func(ctx context.Context, obj runtime.Object) error {
credentialRequest, _ := obj.(*pinnipedapi.CredentialRequest)
credentialRequest, _ := obj.(*loginapi.TokenCredentialRequest)
validationFunctionWasCalled = true
validationFunctionSawTokenValue = credentialRequest.Spec.Token.Value
validationFunctionSawTokenValue = credentialRequest.Spec.Token
return nil
},
&metav1.CreateOptions{})
@@ -508,19 +470,16 @@ func callCreate(ctx context.Context, storage *REST, obj runtime.Object) (runtime
})
}
func validCredentialRequest() *pinnipedapi.CredentialRequest {
func validCredentialRequest() *loginapi.TokenCredentialRequest {
return validCredentialRequestWithToken("some token")
}
func validCredentialRequestWithToken(token string) *pinnipedapi.CredentialRequest {
return credentialRequest(pinnipedapi.CredentialRequestSpec{
Type: pinnipedapi.TokenCredentialType,
Token: &pinnipedapi.CredentialRequestTokenCredential{Value: token},
})
func validCredentialRequestWithToken(token string) *loginapi.TokenCredentialRequest {
return credentialRequest(loginapi.TokenCredentialRequestSpec{Token: token})
}
func credentialRequest(spec pinnipedapi.CredentialRequestSpec) *pinnipedapi.CredentialRequest {
return &pinnipedapi.CredentialRequest{
func credentialRequest(spec loginapi.TokenCredentialRequestSpec) *loginapi.TokenCredentialRequest {
return &loginapi.TokenCredentialRequest{
TypeMeta: metav1.TypeMeta{},
ObjectMeta: metav1.ObjectMeta{
Name: "request name",
@@ -550,8 +509,8 @@ func requireAPIError(t *testing.T, response runtime.Object, err error, expectedE
func requireSuccessfulResponseWithAuthenticationFailureMessage(t *testing.T, err error, response runtime.Object) {
t.Helper()
require.NoError(t, err)
require.Equal(t, response, &pinnipedapi.CredentialRequest{
Status: pinnipedapi.CredentialRequestStatus{
require.Equal(t, response, &loginapi.TokenCredentialRequest{
Status: loginapi.TokenCredentialRequestStatus{
Credential: nil,
Message: stringPtr("authentication failed"),
},
internal/server/server.go
+25 -25
View File
@@ -19,19 +19,19 @@ import (
restclient "k8s.io/client-go/rest"
"k8s.io/klog/v2"
crdpinnipedv1alpha1 "github.com/vmware-tanzu/pinniped/generated/1.19/apis/crdpinniped/v1alpha1"
pinnipedv1alpha1 "github.com/vmware-tanzu/pinniped/generated/1.19/apis/pinniped/v1alpha1"
pinnipedclientset "github.com/vmware-tanzu/pinniped/generated/1.19/client/clientset/versioned"
"github.com/vmware-tanzu/pinniped/internal/apiserver"
"github.com/vmware-tanzu/pinniped/internal/certauthority/kubecertauthority"
"github.com/vmware-tanzu/pinniped/internal/controller/identityprovider/idpcache"
"github.com/vmware-tanzu/pinniped/internal/controller/issuerconfig"
"github.com/vmware-tanzu/pinniped/internal/controllermanager"
"github.com/vmware-tanzu/pinniped/internal/downward"
"github.com/vmware-tanzu/pinniped/internal/here"
"github.com/vmware-tanzu/pinniped/internal/provider"
"github.com/vmware-tanzu/pinniped/internal/registry/credentialrequest"
"github.com/vmware-tanzu/pinniped/pkg/config"
configv1alpha1 "go.pinniped.dev/generated/1.19/apis/config/v1alpha1"
loginv1alpha1 "go.pinniped.dev/generated/1.19/apis/login/v1alpha1"
pinnipedclientset "go.pinniped.dev/generated/1.19/client/clientset/versioned"
"go.pinniped.dev/internal/apiserver"
"go.pinniped.dev/internal/certauthority/kubecertauthority"
"go.pinniped.dev/internal/controller/identityprovider/idpcache"
"go.pinniped.dev/internal/controller/issuerconfig"
"go.pinniped.dev/internal/controllermanager"
"go.pinniped.dev/internal/downward"
"go.pinniped.dev/internal/here"
"go.pinniped.dev/internal/provider"
"go.pinniped.dev/internal/registry/credentialrequest"
"go.pinniped.dev/pkg/config"
)
// App is an object that represents the pinniped-server application.
@@ -45,7 +45,7 @@ type App struct {
// This is ignored for now because we turn off etcd storage below, but this is
// the right prefix in case we turn it back on.
const defaultEtcdPathPrefix = "/registry/" + pinnipedv1alpha1.GroupName
const defaultEtcdPathPrefix = "/registry/" + loginv1alpha1.GroupName
// New constructs a new App with command line args, stdout and stderr.
func New(ctx context.Context, args []string, stdout, stderr io.Writer) *App {
@@ -201,12 +201,12 @@ func getClusterCASigner(
serverInstallationNamespace,
credentialIssuerConfigResourceName,
pinnipedClient,
func(configToUpdate *crdpinnipedv1alpha1.CredentialIssuerConfig) {
configToUpdate.Status.Strategies = []crdpinnipedv1alpha1.CredentialIssuerConfigStrategy{
func(configToUpdate *configv1alpha1.CredentialIssuerConfig) {
configToUpdate.Status.Strategies = []configv1alpha1.CredentialIssuerConfigStrategy{
{
Type: crdpinnipedv1alpha1.KubeClusterSigningCertificateStrategyType,
Status: crdpinnipedv1alpha1.SuccessStrategyStatus,
Reason: crdpinnipedv1alpha1.FetchedKeyStrategyReason,
Type: configv1alpha1.KubeClusterSigningCertificateStrategyType,
Status: configv1alpha1.SuccessStrategyStatus,
Reason: configv1alpha1.FetchedKeyStrategyReason,
Message: "Key was fetched successfully",
LastUpdateTime: metav1.Now(),
},
@@ -223,12 +223,12 @@ func getClusterCASigner(
serverInstallationNamespace,
credentialIssuerConfigResourceName,
pinnipedClient,
func(configToUpdate *crdpinnipedv1alpha1.CredentialIssuerConfig) {
configToUpdate.Status.Strategies = []crdpinnipedv1alpha1.CredentialIssuerConfigStrategy{
func(configToUpdate *configv1alpha1.CredentialIssuerConfig) {
configToUpdate.Status.Strategies = []configv1alpha1.CredentialIssuerConfigStrategy{
{
Type: crdpinnipedv1alpha1.KubeClusterSigningCertificateStrategyType,
Status: crdpinnipedv1alpha1.ErrorStrategyStatus,
Reason: crdpinnipedv1alpha1.CouldNotFetchKeyStrategyReason,
Type: configv1alpha1.KubeClusterSigningCertificateStrategyType,
Status: configv1alpha1.ErrorStrategyStatus,
Reason: configv1alpha1.CouldNotFetchKeyStrategyReason,
Message: err.Error(),
LastUpdateTime: metav1.Now(),
},
@@ -252,7 +252,7 @@ func getAggregatedAPIServerConfig(
) (*apiserver.Config, error) {
recommendedOptions := genericoptions.NewRecommendedOptions(
defaultEtcdPathPrefix,
apiserver.Codecs.LegacyCodec(pinnipedv1alpha1.SchemeGroupVersion),
apiserver.Codecs.LegacyCodec(loginv1alpha1.SchemeGroupVersion),
// TODO we should check to see if all the other default settings are acceptable for us
)
recommendedOptions.Etcd = nil // turn off etcd storage because we don't need it yet
internal/testutil/observable_with_informer_option.go
+1 -1
View File
@@ -3,7 +3,7 @@
package testutil
import "github.com/vmware-tanzu/pinniped/internal/controllerlib"
import "go.pinniped.dev/internal/controllerlib"
type ObservableWithInformerOption struct {
informerToFilterMap map[controllerlib.InformerGetter]controllerlib.Filter
internal/testutil/observable_with_initial_event_option.go
+1 -1
View File
@@ -3,7 +3,7 @@
package testutil
import "github.com/vmware-tanzu/pinniped/internal/controllerlib"
import "go.pinniped.dev/internal/controllerlib"
type ObservableWithInitialEventOption struct {
key controllerlib.Key