-
Notifications
You must be signed in to change notification settings - Fork 432
/
controller.go
103 lines (90 loc) · 2.89 KB
/
controller.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
package controller
import (
"context"
"fmt"
"github.com/kubeovn/kube-ovn/pkg/util"
"net/http"
"net/http/pprof"
"os"
"time"
"github.com/prometheus/client_golang/prometheus/promhttp"
v1 "k8s.io/api/authorization/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/klog/v2"
"k8s.io/sample-controller/pkg/signals"
"github.com/kubeovn/kube-ovn/pkg/controller"
"github.com/kubeovn/kube-ovn/pkg/ovs"
"github.com/kubeovn/kube-ovn/versions"
)
func CmdMain() {
defer klog.Flush()
stopCh := signals.SetupSignalHandler()
klog.Infof(versions.String())
controller.InitClientGoMetrics()
controller.InitWorkQueueMetrics()
util.InitKlogMetrics()
config, err := controller.ParseFlags()
if err != nil {
klog.Fatalf("parse config failed %v", err)
}
if err := checkPermission(config); err != nil {
klog.Fatalf("failed to check permission %v", err)
}
go loopOvnNbctlDaemon(config)
go func() {
mux := http.NewServeMux()
mux.Handle("/metrics", promhttp.Handler())
if config.EnablePprof {
mux.HandleFunc("/debug/pprof/", pprof.Index)
mux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
}
klog.Fatal(http.ListenAndServe(fmt.Sprintf("0.0.0.0:%d", config.PprofPort), mux))
}()
ctl := controller.NewController(config)
ctl.Run(stopCh)
}
func loopOvnNbctlDaemon(config *controller.Configuration) {
for {
daemonSocket := os.Getenv("OVN_NB_DAEMON")
time.Sleep(5 * time.Second)
if _, err := os.Stat(daemonSocket); os.IsNotExist(err) || daemonSocket == "" {
if err := ovs.StartOvnNbctlDaemon(config.OvnNbAddr); err != nil {
klog.Errorf("failed to start ovn-nbctl daemon %v", err)
}
}
// ovn-nbctl daemon may hang and cannot process further request.
// In case of that, we need to start a new daemon.
if err := ovs.CheckAlive(); err != nil {
klog.Warningf("ovn-nbctl daemon doesn't return, start a new daemon")
if err := ovs.StartOvnNbctlDaemon(config.OvnNbAddr); err != nil {
klog.Errorf("failed to start ovn-nbctl daemon %v", err)
}
}
}
}
func checkPermission(config *controller.Configuration) error {
resources := []string{"vpcs", "subnets", "ips", "vlans", "vpc-nat-gateways"}
for _, res := range resources {
ssar := &v1.SelfSubjectAccessReview{
Spec: v1.SelfSubjectAccessReviewSpec{
ResourceAttributes: &v1.ResourceAttributes{
Verb: "watch",
Group: "kubeovn.io",
Resource: res,
},
},
}
ssar, err := config.KubeClient.AuthorizationV1().SelfSubjectAccessReviews().Create(context.Background(), ssar, metav1.CreateOptions{})
if err != nil {
klog.Errorf("failed to get permission for resource %s, %v", res, err)
return err
}
if !ssar.Status.Allowed {
return fmt.Errorf("no permission to watch resource %s, %s", res, ssar.Status.Reason)
}
}
return nil
}