Rename many of resources that are created in Kubernetes by Pinniped

New resource naming conventions:
- Do not repeat the Kind in the name,
  e.g. do not call it foo-cluster-role-binding, just call it foo
- Names will generally start with a prefix to identify our component,
  so when a user lists all objects of that kind, they can tell to which
  component it is related,
  e.g. `kubectl get configmaps` would list one named "pinniped-config"
- It should be possible for an operator to make the word "pinniped"
  mostly disappear if they choose, by specifying the app_name in
  values.yaml, to the extent that is practical (but not from APIService
  names because those are hardcoded in golang)
- Each role/clusterrole and its corresponding binding have the same name
- Pinniped resource names that must be known by the server golang code
  are passed to the code at run time via ConfigMap, rather than
  hardcoded in the golang code. This also allows them to be prepended
  with the app_name from values.yaml while creating the ConfigMap.
- Since the CLI `get-kubeconfig` command cannot guess the name of the
  CredentialIssuerConfig resource in advance anymore, it lists all
  CredentialIssuerConfig in the app's namespace and returns an error
  if there is not exactly one found, and then uses that one regardless
  of its name

pkg/config/api/types.go

@@ -3,10 +3,11 @@
 
 package api
 
-// Config contains knobs to setup an instance of pinniped.
+// Config contains knobs to setup an instance of Pinniped.
 type Config struct {
 	DiscoveryInfo DiscoveryInfoSpec `json:"discovery"`
 	APIConfig     APIConfigSpec     `json:"api"`
+	NamesConfig   NamesConfigSpec   `json:"names"`
 }
 
 // DiscoveryInfoSpec contains configuration knobs specific to
@@ -18,12 +19,19 @@ type DiscoveryInfoSpec struct {
 	URL *string `json:"url,omitempty"`
 }
 
-// APIConfigSpec contains configuration knobs for the pinniped API.
+// APIConfigSpec contains configuration knobs for the Pinniped API.
 //nolint: golint
 type APIConfigSpec struct {
 	ServingCertificateConfig ServingCertificateConfigSpec `json:"servingCertificate"`
 }
 
+// NamesConfigSpec configures the names of some Kubernetes resources for Pinniped.
+type NamesConfigSpec struct {
+	ServingCertificateSecret string `json:"servingCertificateSecret"`
+	CredentialIssuerConfig   string `json:"credentialIssuerConfig"`
+	APIService               string `json:"apiService"`
+}
+
 // ServingCertificateConfigSpec contains the configuration knobs for the API's
 // serving certificate, i.e., the x509 certificate that it uses for the server
 // certificate in inbound TLS connections.
@@ -34,10 +42,10 @@ type ServingCertificateConfigSpec struct {
 	// CA certificate.
 	DurationSeconds *int64 `json:"durationSeconds,omitempty"`
 
-	// RenewBeforeSeconds is the period of time, in seconds, that pinniped will
+	// RenewBeforeSeconds is the period of time, in seconds, that Pinniped will
 	// wait before rotating the serving certificate. This period of time starts
 	// upon issuance of the serving certificate. This must be less than
-	// DurationSeconds. By default, pinniped begins rotation after 23328000
+	// DurationSeconds. By default, Pinniped begins rotation after 23328000
 	// seconds (about 9 months).
 	RenewBeforeSeconds *int64 `json:"renewBeforeSeconds,omitempty"`
 }

pkg/config/config.go

@@ -8,6 +8,7 @@ package config
 import (
 	"fmt"
 	"io/ioutil"
+	"strings"
 
 	"sigs.k8s.io/yaml"
 
@@ -44,6 +45,10 @@ func FromPath(path string) (*api.Config, error) {
 		return nil, fmt.Errorf("validate api: %w", err)
 	}
 
+	if err := validateNames(&config.NamesConfig); err != nil {
+		return nil, fmt.Errorf("validate names: %w", err)
+	}
+
 	return &config, nil
 }
 
@@ -57,6 +62,27 @@ func maybeSetAPIDefaults(apiConfig *api.APIConfigSpec) {
 	}
 }
 
+func validateNames(names *api.NamesConfigSpec) error {
+	missingNames := []string{}
+	if names == nil {
+		missingNames = append(missingNames, "servingCertificateSecret", "credentialIssuerConfig", "apiService")
+	} else {
+		if names.ServingCertificateSecret == "" {
+			missingNames = append(missingNames, "servingCertificateSecret")
+		}
+		if names.CredentialIssuerConfig == "" {
+			missingNames = append(missingNames, "credentialIssuerConfig")
+		}
+		if names.APIService == "" {
+			missingNames = append(missingNames, "apiService")
+		}
+	}
+	if len(missingNames) > 0 {
+		return constable.Error("missing required names: " + strings.Join(missingNames, ", "))
+	}
+	return nil
+}
+
 func validateAPI(apiConfig *api.APIConfigSpec) error {
 	if *apiConfig.ServingCertificateConfig.DurationSeconds < *apiConfig.ServingCertificateConfig.RenewBeforeSeconds {
 		return constable.Error("durationSeconds cannot be smaller than renewBeforeSeconds")

pkg/config/config_test.go

@@ -4,23 +4,38 @@
 package config
 
 import (
+	"io/ioutil"
+	"os"
 	"testing"
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/vmware-tanzu/pinniped/internal/here"
 	"github.com/vmware-tanzu/pinniped/pkg/config/api"
 )
 
 func TestFromPath(t *testing.T) {
 	tests := []struct {
 		name       string
-		path       string
+		yaml       string
 		wantConfig *api.Config
 		wantError  string
 	}{
 		{
 			name: "Happy",
-			path: "testdata/happy.yaml",
+			yaml: here.Doc(`
+				---
+				discovery:
+				  url: https://some.discovery/url
+				api:
+				  servingCertificate:
+					durationSeconds: 3600
+					renewBeforeSeconds: 2400
+				names:
+				  servingCertificateSecret: pinniped-api-tls-serving-certificate
+				  credentialIssuerConfig: pinniped-config
+				  apiService: pinniped-api
+			`),
 			wantConfig: &api.Config{
 				DiscoveryInfo: api.DiscoveryInfoSpec{
 					URL: stringPtr("https://some.discovery/url"),
@@ -31,11 +46,22 @@ func TestFromPath(t *testing.T) {
 						RenewBeforeSeconds: int64Ptr(2400),
 					},
 				},
+				NamesConfig: api.NamesConfigSpec{
+					ServingCertificateSecret: "pinniped-api-tls-serving-certificate",
+					CredentialIssuerConfig:   "pinniped-config",
+					APIService:               "pinniped-api",
+				},
 			},
 		},
 		{
-			name: "Default",
-			path: "testdata/default.yaml",
+			name: "When only the required fields are present, causes other fields to be defaulted",
+			yaml: here.Doc(`
+				---
+				names:
+				  servingCertificateSecret: pinniped-api-tls-serving-certificate
+				  credentialIssuerConfig: pinniped-config
+				  apiService: pinniped-api
+			`),
 			wantConfig: &api.Config{
 				DiscoveryInfo: api.DiscoveryInfoSpec{
 					URL: nil,
@@ -46,28 +72,112 @@ func TestFromPath(t *testing.T) {
 						RenewBeforeSeconds: int64Ptr(60 * 60 * 24 * 30 * 9), // about 9 months
 					},
 				},
+				NamesConfig: api.NamesConfigSpec{
+					ServingCertificateSecret: "pinniped-api-tls-serving-certificate",
+					CredentialIssuerConfig:   "pinniped-config",
+					APIService:               "pinniped-api",
+				},
 			},
 		},
 		{
-			name:      "InvalidDurationRenewBefore",
-			path:      "testdata/invalid-duration-renew-before.yaml",
+			name:      "Empty",
+			yaml:      here.Doc(``),
+			wantError: "validate names: missing required names: servingCertificateSecret, credentialIssuerConfig, apiService",
+		},
+		{
+			name: "Missing apiService name",
+			yaml: here.Doc(`
+				---
+				names:
+				  servingCertificateSecret: pinniped-api-tls-serving-certificate
+				  credentialIssuerConfig: pinniped-config
+			`),
+			wantError: "validate names: missing required names: apiService",
+		},
+		{
+			name: "Missing credentialIssuerConfig name",
+			yaml: here.Doc(`
+				---
+				names:
+				  servingCertificateSecret: pinniped-api-tls-serving-certificate
+				  apiService: pinniped-api
+			`),
+			wantError: "validate names: missing required names: credentialIssuerConfig",
+		},
+		{
+			name: "Missing servingCertificateSecret name",
+			yaml: here.Doc(`
+				---
+				names:
+				  credentialIssuerConfig: pinniped-config
+				  apiService: pinniped-api
+			`),
+			wantError: "validate names: missing required names: servingCertificateSecret",
+		},
+		{
+			name: "InvalidDurationRenewBefore",
+			yaml: here.Doc(`
+				---
+				api:
+				  servingCertificate:
+					durationSeconds: 2400
+					renewBeforeSeconds: 3600
+				names:
+				  servingCertificateSecret: pinniped-api-tls-serving-certificate
+				  credentialIssuerConfig: pinniped-config
+				  apiService: pinniped-api
+			`),
 			wantError: "validate api: durationSeconds cannot be smaller than renewBeforeSeconds",
 		},
 		{
-			name:      "NegativeRenewBefore",
-			path:      "testdata/negative-renew-before.yaml",
+			name: "NegativeRenewBefore",
+			yaml: here.Doc(`
+				---
+				api:
+				  servingCertificate:
+					durationSeconds: 2400
+					renewBeforeSeconds: -10
+				names:
+				  servingCertificateSecret: pinniped-api-tls-serving-certificate
+				  credentialIssuerConfig: pinniped-config
+				  apiService: pinniped-api
+			`),
 			wantError: "validate api: renewBefore must be positive",
 		},
 		{
-			name:      "ZeroRenewBefore",
-			path:      "testdata/zero-renew-before.yaml",
+			name: "ZeroRenewBefore",
+			yaml: here.Doc(`
+				---
+				api:
+				  servingCertificate:
+					durationSeconds: 2400
+					renewBeforeSeconds: -10
+				names:
+				  servingCertificateSecret: pinniped-api-tls-serving-certificate
+				  credentialIssuerConfig: pinniped-config
+				  apiService: pinniped-api
+			`),
 			wantError: "validate api: renewBefore must be positive",
 		},
 	}
 	for _, test := range tests {
 		test := test
 		t.Run(test.name, func(t *testing.T) {
-			config, err := FromPath(test.path)
+			// Write yaml to temp file
+			f, err := ioutil.TempFile("", "pinniped-test-config-yaml-*")
+			require.NoError(t, err)
+			defer func() {
+				err := os.Remove(f.Name())
+				require.NoError(t, err)
+			}()
+			_, err = f.WriteString(test.yaml)
+			require.NoError(t, err)
+			err = f.Close()
+			require.NoError(t, err)
+
+			// Test FromPath()
+			config, err := FromPath(f.Name())
+
 			if test.wantError != "" {
 				require.EqualError(t, err, test.wantError)
 			} else {

pkg/config/testdata/default.yaml

@@ -1 +0,0 @@
----

pkg/config/testdata/happy.yaml

@@ -1,7 +0,0 @@
----
-discovery:
-  url: https://some.discovery/url
-api:
-  servingCertificate:
-    durationSeconds: 3600
-    renewBeforeSeconds: 2400

pkg/config/testdata/invalid-duration-renew-before.yaml

@@ -1,5 +0,0 @@
----
-api:
-  servingCertificate:
-    durationSeconds: 2400
-    renewBeforeSeconds: 3600

pkg/config/testdata/negative-renew-before.yaml

@@ -1,5 +0,0 @@
----
-api:
-  servingCertificate:
-    durationSeconds: 2400
-    renewBeforeSeconds: -10

pkg/config/testdata/zero-renew-before.yaml

@@ -1,5 +0,0 @@
----
-api:
-  servingCertificate:
-    durationSeconds: 2400
-    renewBeforeSeconds: -10