You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Message: fmt.Sprintf(`The label "%s" is immutable, it cannot be added after creation and is not allowed to be changed or removed once set.`, corev2alpha1.MCPPurposeOverrideLabel),
The *ManagedControlPlane v2 Controller* is a platform service that is responsible for reconciling `ManagedControlPlaneV2` (MCP) resources.
4
+
5
+
Out of an MCP resource, it generates a `ClusterRequest` and multiple `AccessReqests`, thereby handling cluster management and authentication/authorization for MCPs.
6
+
7
+
## Configuration
8
+
9
+
The MCP controller takes the following configuration:
10
+
```yaml
11
+
managedControlPlane:
12
+
mcpClusterPurpose: mcp # defaults to 'mcp'
13
+
reconcileMCPEveryXDays: 7# defaults to 0
14
+
defaultOIDCProvider:
15
+
name: default # must be 'default' or omitted for the default oidc provider
16
+
issuer: https://oidc.example.com
17
+
clientID: my-client-id
18
+
usernamePrefix: "my-user:"
19
+
groupsPrefix: "my-group:"
20
+
extraScopes:
21
+
- foo
22
+
```
23
+
24
+
The configuration is optional.
25
+
26
+
## ManagedControlPlaneV2
27
+
28
+
This is an example MCP resource:
29
+
```yaml
30
+
apiVersion: core.openmcp.cloud/v2alpha1
31
+
kind: ManagedControlPlaneV2
32
+
metadata:
33
+
name: mcp-01
34
+
namespace: foo
35
+
spec:
36
+
iam:
37
+
roleBindings: # this sets the role bindings for the default OIDC provider (no effect if none is configured)
38
+
- subjects:
39
+
- kind: User
40
+
name: john.doe@example.com
41
+
roleRefs:
42
+
- kind: ClusterRole
43
+
name: cluster-admin
44
+
oidcProviders: # here, additional OIDC providers can be configured
45
+
- name: my-oidc-provider
46
+
issuer: https://oidc.example.com
47
+
clientID: my-client-id
48
+
usernamePrefix: "my-user:"
49
+
groupsPrefix: "my-group:"
50
+
extraScopes:
51
+
- foo
52
+
roleBindings:
53
+
- subjects:
54
+
- kind: User
55
+
name: foo
56
+
- kind: Group
57
+
name: bar
58
+
roleRefs:
59
+
- kind: ClusterRole
60
+
name: my-cluster-role
61
+
- kind: Role
62
+
name: my-role
63
+
namespace: default
64
+
```
65
+
66
+
### Purpose Overriding
67
+
68
+
Usually, an MCP resource results in a `ClusterRequest` with its `spec.purpose` set to whatever is configured in the MCP controller configuration (defaults to `mcp` if not specified). The `core.openmcp.cloud/purpose` label allows to override this setting and specify a different purpose for a single MCP.
69
+
70
+
Note that the purpose cannot be changed anymore after creation of the `ClusterRequest`, therefore the label has to be present already during creation of the MCP resource, it cannot be added afterwards.
71
+
72
+
Also, it is not verified whether the chosen purpose actually is known to the scheduler. Specifying a unknown purpose will result in the MCP resource never becoming ready.
73
+
74
+
#### Validation
75
+
76
+
During setup, the MCP controller deploys a `ValidatingAdmissionPolicy` for the aforementioned label. It has the following effects:
77
+
- The label cannot be added or removed to/from an existing MCP resource.
78
+
- The label's value cannot be changed.
79
+
- The label's value must contain the substring `mcp`.
80
+
- This is meant to prevent customers (who have access to this label) from hijacking cluster purposes that are not meant for MCP clusters.
81
+
82
+
This validation is currently not configurable in any way.
rr.ReconcileError=errutils.WithReason(fmt.Errorf("unable to get ClusterRequest '%s/%s': %w", cr.Namespace, cr.Name, err), cconst.ReasonPlatformClusterInteractionProblem)
0 commit comments