/
controller.go
117 lines (98 loc) · 3.63 KB
/
controller.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
/*
Copyright 2020 The Kubermatic Kubernetes Platform contributors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package rbacusercluster
import (
"context"
"errors"
"fmt"
"sync"
"github.com/heptiolabs/healthcheck"
"k8s.io/apimachinery/pkg/types"
rbacv1 "k8s.io/api/rbac/v1"
"k8s.io/klog"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/controller"
"sigs.k8s.io/controller-runtime/pkg/handler"
"sigs.k8s.io/controller-runtime/pkg/manager"
"sigs.k8s.io/controller-runtime/pkg/reconcile"
"sigs.k8s.io/controller-runtime/pkg/source"
)
const (
controllerName = "rbac-user-cluster-controller"
ResourceOwnerName = "system:kubermatic:owners"
ResourceEditorName = "system:kubermatic:editors"
ResourceViewerName = "system:kubermatic:viewers"
)
var mapFn = handler.ToRequestsFunc(func(o handler.MapObject) []reconcile.Request {
return []reconcile.Request{
{NamespacedName: types.NamespacedName{
Name: ResourceOwnerName,
Namespace: "",
}},
{NamespacedName: types.NamespacedName{
Name: ResourceEditorName,
Namespace: "",
}},
{NamespacedName: types.NamespacedName{
Name: ResourceViewerName,
Namespace: "",
}},
}
})
// Add creates a new RBAC generator controller that is responsible for creating Cluster Roles and Cluster Role Bindings
// for groups: `owners`, `editors` and `viewers``
func Add(mgr manager.Manager, registerReconciledCheck func(name string, check healthcheck.Check)) error {
reconcile := &reconcileRBAC{Client: mgr.GetClient(), ctx: context.TODO(), rLock: &sync.Mutex{}}
// Create a new controller
c, err := controller.New(controllerName, mgr, controller.Options{Reconciler: reconcile})
if err != nil {
return err
}
// Watch for changes to ClusterRoles
if err = c.Watch(&source.Kind{Type: &rbacv1.ClusterRole{}}, &handler.EnqueueRequestsFromMapFunc{ToRequests: mapFn}); err != nil {
return err
}
// Watch for changes to ClusterRoleBindings
if err = c.Watch(&source.Kind{Type: &rbacv1.ClusterRoleBinding{}}, &handler.EnqueueRequestsFromMapFunc{ToRequests: mapFn}); err != nil {
return err
}
// A very simple but limited way to express the first successful reconciling to the seed cluster
registerReconciledCheck(fmt.Sprintf("%s-%s", controllerName, "reconciled_successfully_once"), func() error {
reconcile.rLock.Lock()
defer reconcile.rLock.Unlock()
if !reconcile.reconciledSuccessfullyOnce {
return errors.New("no successful reconciliation so far")
}
return nil
})
return nil
}
// reconcileRBAC reconciles Cluster Role and Cluster Role Binding objects
type reconcileRBAC struct {
ctx context.Context
client.Client
rLock *sync.Mutex
reconciledSuccessfullyOnce bool
}
// Reconcile makes changes in response to Cluster Role and Cluster Role Binding related changes
func (r *reconcileRBAC) Reconcile(request reconcile.Request) (reconcile.Result, error) {
rdr := reconciler{client: r.Client, ctx: r.ctx}
if err := rdr.Reconcile(request.Name); err != nil {
klog.Errorf("RBAC reconciliation failed: %v", err)
return reconcile.Result{}, err
}
r.rLock.Lock()
defer r.rLock.Unlock()
r.reconciledSuccessfullyOnce = true
return reconcile.Result{}, nil
}