mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-09-21 07:24:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Rename many of resources that are created in Kubernetes by Pinniped

Browse Source 
New resource naming conventions:
- Do not repeat the Kind in the name,
  e.g. do not call it foo-cluster-role-binding, just call it foo
- Names will generally start with a prefix to identify our component,
  so when a user lists all objects of that kind, they can tell to which
  component it is related,
  e.g. `kubectl get configmaps` would list one named "pinniped-config"
- It should be possible for an operator to make the word "pinniped"
  mostly disappear if they choose, by specifying the app_name in
  values.yaml, to the extent that is practical (but not from APIService
  names because those are hardcoded in golang)
- Each role/clusterrole and its corresponding binding have the same name
- Pinniped resource names that must be known by the server golang code
  are passed to the code at run time via ConfigMap, rather than
  hardcoded in the golang code. This also allows them to be prepended
  with the app_name from values.yaml while creating the ConfigMap.
- Since the CLI `get-kubeconfig` command cannot guess the name of the
  CredentialIssuerConfig resource in advance anymore, it lists all
  CredentialIssuerConfig in the app's namespace and returns an error
  if there is not exactly one found, and then uses that one regardless
  of its name
This commit is contained in:
Ryan Richard
2020-09-18 15:56:50 -07:00
parent 24f962f1b8
commit 80a520390b
35 changed files with 493 additions and 247 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/local-user-authenticator/main.go
+5 -1
View File
@@ -301,12 +301,15 @@ func startControllers(
) {
aVeryLongTime := time.Hour * 24 * 365 * 100
const certsSecretResourceName = "local-user-authenticator-tls-serving-certificate"
// Create controller manager.
controllerManager := controllerlib.
NewManager().
WithController(
apicerts.NewCertsManagerController(
namespace,
certsSecretResourceName,
kubeClient,
kubeInformers.Core().V1().Secrets(),
controllerlib.WithInformer,
@@ -320,6 +323,7 @@ func startControllers(
WithController(
apicerts.NewCertsObserverController(
namespace,
certsSecretResourceName,
dynamicCertProvider,
kubeInformers.Core().V1().Secrets(),
controllerlib.WithInformer,
@@ -367,7 +371,7 @@ func run() error {
startControllers(ctx, dynamicCertProvider, kubeClient, kubeInformers)
klog.InfoS("controllers are ready")
//nolint: gosec
//nolint: gosec // Intentionally binding to all network interfaces.
l, err := net.Listen("tcp", ":443")
if err != nil {
return fmt.Errorf("cannot create listener: %w", err)
cmd/pinniped/cmd/get_kubeconfig.go
+17 -12
View File
@@ -14,7 +14,6 @@ import (
"github.com/ghodss/yaml"
"github.com/spf13/cobra"
apierrors "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
clientauthenticationv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
"k8s.io/client-go/rest"
@@ -25,7 +24,6 @@ import (
"github.com/vmware-tanzu/pinniped/generated/1.19/apis/crdpinniped/v1alpha1"
pinnipedclientset "github.com/vmware-tanzu/pinniped/generated/1.19/client/clientset/versioned"
"github.com/vmware-tanzu/pinniped/internal/constable"
"github.com/vmware-tanzu/pinniped/internal/controller/issuerconfig"
"github.com/vmware-tanzu/pinniped/internal/here"
)
@@ -239,20 +237,27 @@ func fetchPinnipedCredentialIssuerConfig(clientConfig clientcmd.ClientConfig, ku
ctx, cancelFunc := context.WithTimeout(context.Background(), time.Second*20)
defer cancelFunc()
credentialIssuerConfig, err := clientset.CrdV1alpha1().CredentialIssuerConfigs(pinnipedInstallationNamespace).Get(ctx, issuerconfig.ConfigName, metav1.GetOptions{})
credentialIssuerConfigs, err := clientset.CrdV1alpha1().CredentialIssuerConfigs(pinnipedInstallationNamespace).List(ctx, metav1.ListOptions{})
if err != nil {
if apierrors.IsNotFound(err) {
return nil, constable.Error(fmt.Sprintf(
`CredentialIssuerConfig "%s" was not found in namespace "%s". Is Pinniped installed on this cluster in namespace "%s"?`,
issuerconfig.ConfigName,
pinnipedInstallationNamespace,
pinnipedInstallationNamespace,
))
}
return nil, err
}
return credentialIssuerConfig, nil
if len(credentialIssuerConfigs.Items) == 0 {
return nil, constable.Error(fmt.Sprintf(
`No CredentialIssuerConfig was found in namespace "%s". Is Pinniped installed on this cluster in namespace "%s"?`,
pinnipedInstallationNamespace,
pinnipedInstallationNamespace,
))
}
if len(credentialIssuerConfigs.Items) > 1 {
return nil, constable.Error(fmt.Sprintf(
`More than one CredentialIssuerConfig was found in namespace "%s"`,
pinnipedInstallationNamespace,
))
}
return &credentialIssuerConfigs.Items[0], nil
}
func newClientConfig(kubeconfigPathOverride string, currentContextName string) clientcmd.ClientConfig {
cmd/pinniped/cmd/get_kubeconfig_test.go
+93 -28
View File
@@ -200,8 +200,17 @@ func TestNewGetKubeConfigCmd(t *testing.T) {
}, spec.Parallel(), spec.Report(report.Terminal{}))
}
//nolint: unparam
func expectedKubeconfigYAML(clusterCAData, clusterServer, command, token, pinnipedEndpoint, pinnipedCABundle, namespace string) string {
func expectedKubeconfigYAML(
clusterCAData,
clusterServer,
command,
// nolint: unparam // Pass in the token even if it is always the same in practice
token,
pinnipedEndpoint,
pinnipedCABundle,
// nolint: unparam // Pass in the namespace even if it is always the same in practice
namespace string,
) string {
return here.Docf(`
apiVersion: v1
clusters:
@@ -240,15 +249,21 @@ func expectedKubeconfigYAML(clusterCAData, clusterServer, command, token, pinnip
`, clusterCAData, clusterServer, command, pinnipedEndpoint, pinnipedCABundle, namespace, token)
}
func newCredentialIssuerConfig(server, certificateAuthorityData string) *crdpinnipedv1alpha1.CredentialIssuerConfig {
func newCredentialIssuerConfig(
name,
//nolint: unparam // Pass in the namespace even if it is always the same in practice
namespace,
server,
certificateAuthorityData string,
) *crdpinnipedv1alpha1.CredentialIssuerConfig {
return &crdpinnipedv1alpha1.CredentialIssuerConfig{
TypeMeta: metav1.TypeMeta{
Kind: "CredentialIssuerConfig",
APIVersion: crdpinnipedv1alpha1.SchemeGroupVersion.String(),
},
ObjectMeta: metav1.ObjectMeta{
Name: "pinniped-config",
Namespace: "some-namespace",
Name: name,
Namespace: namespace,
},
Status: crdpinnipedv1alpha1.CredentialIssuerConfigStatus{
KubeConfigInfo: &crdpinnipedv1alpha1.CredentialIssuerConfigKubeConfigInfo{
@@ -266,6 +281,7 @@ func TestGetKubeConfig(t *testing.T) {
var warningsBuffer *bytes.Buffer
var fullPathToSelf string
var pinnipedClient *pinnipedfake.Clientset
const installationNamespace = "some-namespace"
it.Before(func() {
r = require.New(t)
@@ -283,7 +299,12 @@ func TestGetKubeConfig(t *testing.T) {
when("the CredentialIssuerConfig is found on the cluster with a configuration that matches the existing kubeconfig", func() {
it.Before(func() {
r.NoError(pinnipedClient.Tracker().Add(
newCredentialIssuerConfig("https://fake-server-url-value", "fake-certificate-authority-data-value"),
newCredentialIssuerConfig(
"some-cic-name",
installationNamespace,
"https://fake-server-url-value",
"fake-certificate-authority-data-value",
),
))
})
@@ -294,7 +315,7 @@ func TestGetKubeConfig(t *testing.T) {
"some-token",
"./testdata/kubeconfig.yaml",
"",
"some-namespace",
installationNamespace,
func(restConfig *rest.Config) (pinnipedclientset.Interface, error) {
kubeClientCreatorFuncWasCalled = true
r.Equal("https://fake-server-url-value", restConfig.Host)
@@ -313,7 +334,7 @@ func TestGetKubeConfig(t *testing.T) {
"some-token",
"https://fake-server-url-value",
"fake-certificate-authority-data-value",
"some-namespace",
installationNamespace,
), outputBuffer.String())
})
@@ -327,10 +348,12 @@ func TestGetKubeConfig(t *testing.T) {
Resource: "credentialissuerconfigs",
},
newCredentialIssuerConfig(
"some-cic-name",
installationNamespace,
"https://some-other-fake-server-url-value",
"some-other-fake-certificate-authority-data-value",
),
"some-namespace",
installationNamespace,
))
})
@@ -342,7 +365,7 @@ func TestGetKubeConfig(t *testing.T) {
"some-token",
"./testdata/kubeconfig.yaml",
"some-other-context",
"some-namespace",
installationNamespace,
func(restConfig *rest.Config) (pinnipedclientset.Interface, error) {
kubeClientCreatorFuncWasCalled = true
r.Equal("https://some-other-fake-server-url-value", restConfig.Host)
@@ -361,7 +384,7 @@ func TestGetKubeConfig(t *testing.T) {
"some-token",
"https://some-other-fake-server-url-value",
"some-other-fake-certificate-authority-data-value",
"some-namespace",
installationNamespace,
), outputBuffer.String())
})
})
@@ -373,7 +396,7 @@ func TestGetKubeConfig(t *testing.T) {
"some-token",
"./testdata/kubeconfig.yaml",
"this-context-name-does-not-exist-in-kubeconfig.yaml",
"some-namespace",
installationNamespace,
func(restConfig *rest.Config) (pinnipedclientset.Interface, error) { return pinnipedClient, nil },
)
r.EqualError(err, `context "this-context-name-does-not-exist-in-kubeconfig.yaml" does not exist`)
@@ -390,7 +413,7 @@ func TestGetKubeConfig(t *testing.T) {
"",
"./testdata/kubeconfig.yaml",
"",
"some-namespace",
installationNamespace,
func(restConfig *rest.Config) (pinnipedclientset.Interface, error) { return pinnipedClient, nil },
)
r.EqualError(err, "--token flag value cannot be empty")
@@ -406,7 +429,7 @@ func TestGetKubeConfig(t *testing.T) {
"some-token",
"./testdata/this-file-does-not-exist.yaml",
"",
"some-namespace",
installationNamespace,
func(restConfig *rest.Config) (pinnipedclientset.Interface, error) { return pinnipedClient, nil },
)
r.EqualError(err, "stat ./testdata/this-file-does-not-exist.yaml: no such file or directory")
@@ -434,7 +457,7 @@ func TestGetKubeConfig(t *testing.T) {
"some-token",
"",
"",
"some-namespace",
installationNamespace,
func(restConfig *rest.Config) (pinnipedclientset.Interface, error) {
kubeClientCreatorFuncWasCalled = true
r.Equal("https://fake-server-url-value", restConfig.Host)
@@ -453,7 +476,7 @@ func TestGetKubeConfig(t *testing.T) {
"some-token",
"https://fake-server-url-value",
"fake-certificate-authority-data-value",
"some-namespace",
installationNamespace,
), outputBuffer.String())
})
})
@@ -474,7 +497,39 @@ func TestGetKubeConfig(t *testing.T) {
return pinnipedClient, nil
},
)
r.EqualError(err, `CredentialIssuerConfig "pinniped-config" was not found in namespace "this-is-the-wrong-namespace". Is Pinniped installed on this cluster in namespace "this-is-the-wrong-namespace"?`)
r.EqualError(err, `No CredentialIssuerConfig was found in namespace "this-is-the-wrong-namespace". Is Pinniped installed on this cluster in namespace "this-is-the-wrong-namespace"?`)
r.True(kubeClientCreatorFuncWasCalled)
})
})
when("there is more than one CredentialIssuerConfig is found on the cluster", func() {
it.Before(func() {
r.NoError(pinnipedClient.Tracker().Add(
newCredentialIssuerConfig(
"another-cic-name",
installationNamespace,
"https://fake-server-url-value",
"fake-certificate-authority-data-value",
),
))
})
it("returns an error", func() {
kubeClientCreatorFuncWasCalled := false
err := getKubeConfig(outputBuffer,
warningsBuffer,
"some-token",
"./testdata/kubeconfig.yaml",
"",
installationNamespace,
func(restConfig *rest.Config) (pinnipedclientset.Interface, error) {
kubeClientCreatorFuncWasCalled = true
r.Equal("https://fake-server-url-value", restConfig.Host)
r.Equal("fake-certificate-authority-data-value", string(restConfig.CAData))
return pinnipedClient, nil
},
)
r.EqualError(err, `More than one CredentialIssuerConfig was found in namespace "some-namespace"`)
r.True(kubeClientCreatorFuncWasCalled)
})
})
@@ -484,7 +539,12 @@ func TestGetKubeConfig(t *testing.T) {
when("the Server doesn't match", func() {
it.Before(func() {
r.NoError(pinnipedClient.Tracker().Add(
newCredentialIssuerConfig("non-matching-pinniped-server-url", "fake-certificate-authority-data-value"),
newCredentialIssuerConfig(
"some-cic-name",
installationNamespace,
"non-matching-pinniped-server-url",
"fake-certificate-authority-data-value",
),
))
})
@@ -495,7 +555,7 @@ func TestGetKubeConfig(t *testing.T) {
"some-token",
"./testdata/kubeconfig.yaml",
"",
"some-namespace",
installationNamespace,
func(restConfig *rest.Config) (pinnipedclientset.Interface, error) {
kubeClientCreatorFuncWasCalled = true
r.Equal("https://fake-server-url-value", restConfig.Host)
@@ -517,7 +577,7 @@ func TestGetKubeConfig(t *testing.T) {
"some-token",
"https://fake-server-url-value",
"fake-certificate-authority-data-value",
"some-namespace",
installationNamespace,
), outputBuffer.String())
})
})
@@ -525,7 +585,12 @@ func TestGetKubeConfig(t *testing.T) {
when("the CA doesn't match", func() {
it.Before(func() {
r.NoError(pinnipedClient.Tracker().Add(
newCredentialIssuerConfig("https://fake-server-url-value", "non-matching-certificate-authority-data-value"),
newCredentialIssuerConfig(
"some-cic-name",
installationNamespace,
"https://fake-server-url-value",
"non-matching-certificate-authority-data-value",
),
))
})
@@ -536,7 +601,7 @@ func TestGetKubeConfig(t *testing.T) {
"some-token",
"./testdata/kubeconfig.yaml",
"",
"some-namespace",
installationNamespace,
func(restConfig *rest.Config) (pinnipedclientset.Interface, error) {
kubeClientCreatorFuncWasCalled = true
r.Equal("https://fake-server-url-value", restConfig.Host)
@@ -558,7 +623,7 @@ func TestGetKubeConfig(t *testing.T) {
"some-token",
"https://fake-server-url-value",
"fake-certificate-authority-data-value",
"some-namespace",
installationNamespace,
), outputBuffer.String())
})
})
@@ -574,7 +639,7 @@ func TestGetKubeConfig(t *testing.T) {
},
ObjectMeta: metav1.ObjectMeta{
Name: "pinniped-config",
Namespace: "some-namespace",
Namespace: installationNamespace,
},
Status: crdpinnipedv1alpha1.CredentialIssuerConfigStatus{},
},
@@ -588,7 +653,7 @@ func TestGetKubeConfig(t *testing.T) {
"some-token",
"./testdata/kubeconfig.yaml",
"",
"some-namespace",
installationNamespace,
func(restConfig *rest.Config) (pinnipedclientset.Interface, error) {
kubeClientCreatorFuncWasCalled = true
r.Equal("https://fake-server-url-value", restConfig.Host)
@@ -611,7 +676,7 @@ func TestGetKubeConfig(t *testing.T) {
"some-token",
"./testdata/kubeconfig.yaml",
"",
"some-namespace",
installationNamespace,
func(restConfig *rest.Config) (pinnipedclientset.Interface, error) {
kubeClientCreatorFuncWasCalled = true
r.Equal("https://fake-server-url-value", restConfig.Host)
@@ -620,7 +685,7 @@ func TestGetKubeConfig(t *testing.T) {
},
)
r.True(kubeClientCreatorFuncWasCalled)
r.EqualError(err, `CredentialIssuerConfig "pinniped-config" was not found in namespace "some-namespace". Is Pinniped installed on this cluster in namespace "some-namespace"?`)
r.EqualError(err, `No CredentialIssuerConfig was found in namespace "some-namespace". Is Pinniped installed on this cluster in namespace "some-namespace"?`)
r.Empty(warningsBuffer.String())
r.Empty(outputBuffer.String())
})
@@ -633,7 +698,7 @@ func TestGetKubeConfig(t *testing.T) {
"some-token",
"./testdata/kubeconfig.yaml",
"",
"some-namespace",
installationNamespace,
func(restConfig *rest.Config) (pinnipedclientset.Interface, error) {
return nil, fmt.Errorf("some error getting CredentialIssuerConfig")
},