Skip to content

Commit

Permalink
[release-v1.12] Containersource use OIDC identity of corresponding Si…
Browse files Browse the repository at this point in the history
…nkBinding (#603)

* Revert "feat: support auto generation of ContainerSource identity service account and expose in AuthStatus (knative#7461)"

This reverts commit 116abe2.

* Containersource use OIDC identity of corresponding SinkBinding
  • Loading branch information
creydr committed May 6, 2024
1 parent 8899d6a commit e3f50bb
Show file tree
Hide file tree
Showing 7 changed files with 46 additions and 258 deletions.
24 changes: 4 additions & 20 deletions pkg/apis/sources/v1/container_lifecycle.go
Original file line number Diff line number Diff line change
Expand Up @@ -31,14 +31,11 @@ const (

// ContainerSourceConditionReceiveAdapterReady has status True when the ContainerSource's ReceiveAdapter is ready.
ContainerSourceConditionReceiveAdapterReady apis.ConditionType = "ReceiveAdapterReady"

ContainerConditionOIDCIdentityCreated apis.ConditionType = "OIDCIdentityCreated"
)

var containerCondSet = apis.NewLivingConditionSet(
ContainerSourceConditionSinkBindingReady,
ContainerSourceConditionReceiveAdapterReady,
ContainerConditionOIDCIdentityCreated,
)

// GetConditionSet retrieves the condition set for this resource. Implements the KRShaped interface.
Expand Down Expand Up @@ -66,23 +63,7 @@ func (s *ContainerSourceStatus) InitializeConditions() {
containerCondSet.Manage(s).InitializeConditions()
}

func (s *ContainerSourceStatus) MarkOIDCIdentityCreatedSucceeded() {
containerCondSet.Manage(s).MarkTrue(ContainerConditionOIDCIdentityCreated)
}

func (s *ContainerSourceStatus) MarkOIDCIdentityCreatedSucceededWithReason(reason, messageFormat string, messageA ...interface{}) {
containerCondSet.Manage(s).MarkTrueWithReason(ContainerConditionOIDCIdentityCreated, reason, messageFormat, messageA...)
}

func (s *ContainerSourceStatus) MarkOIDCIdentityCreatedFailed(reason, messageFormat string, messageA ...interface{}) {
containerCondSet.Manage(s).MarkFalse(ContainerConditionOIDCIdentityCreated, reason, messageFormat, messageA...)
}

func (s *ContainerSourceStatus) MarkOIDCIdentityCreatedUnknown(reason, messageFormat string, messageA ...interface{}) {
containerCondSet.Manage(s).MarkUnknown(ContainerConditionOIDCIdentityCreated, reason, messageFormat, messageA...)
}

// PropagateSinkBindingStatus uses the availability of the provided Deployment to determine if
// PropagateSinkBindingStatus uses the SinkBinding to determine if
// ContainerSourceConditionSinkBindingReady should be marked as true, false or unknown.
func (s *ContainerSourceStatus) PropagateSinkBindingStatus(status *SinkBindingStatus) {
// Do not copy conditions nor observedGeneration
Expand All @@ -105,6 +86,9 @@ func (s *ContainerSourceStatus) PropagateSinkBindingStatus(status *SinkBindingSt
default:
containerCondSet.Manage(s).MarkUnknown(ContainerSourceConditionSinkBindingReady, cond.Reason, cond.Message)
}

// Propagate SinkBindings AuthStatus to containersources AuthStatus
s.Auth = status.Auth
}

// PropagateReceiveAdapterStatus uses the availability of the provided Deployment to determine if
Expand Down
121 changes: 1 addition & 120 deletions pkg/apis/sources/v1/container_lifecycle_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -104,36 +104,24 @@ func TestContainerSourceStatusIsReady(t *testing.T) {
}(),
wantConditionStatus: corev1.ConditionUnknown,
want: false,
}, {
name: "mark ready sa",
s: func() *ContainerSourceStatus {
s := &ContainerSourceStatus{}
s.InitializeConditions()
s.MarkOIDCIdentityCreatedSucceeded()
return s
}(),
wantConditionStatus: corev1.ConditionUnknown,
want: false,
}, {
name: "mark ready sb and ra",
s: func() *ContainerSourceStatus {
s := &ContainerSourceStatus{}
s.InitializeConditions()
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
s.PropagateReceiveAdapterStatus(availableDeployment)
s.MarkOIDCIdentityCreatedSucceeded()
return s
}(),
wantConditionStatus: corev1.ConditionTrue,
want: true,
}, {
name: "mark ready sb and unavailable ra ",
name: "mark ready sb and unavailable ra",
s: func() *ContainerSourceStatus {
s := &ContainerSourceStatus{}
s.InitializeConditions()
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
s.PropagateReceiveAdapterStatus(unavailableDeployment)
s.MarkOIDCIdentityCreatedSucceeded()
return s
}(),
wantConditionStatus: corev1.ConditionFalse,
Expand All @@ -145,55 +133,17 @@ func TestContainerSourceStatusIsReady(t *testing.T) {
s.InitializeConditions()
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
s.PropagateReceiveAdapterStatus(unknownDeployment)
s.MarkOIDCIdentityCreatedSucceeded()
return s
}(),
wantConditionStatus: corev1.ConditionUnknown,
want: false,
}, {
name: "mark ready sb and ra no sa",
s: func() *ContainerSourceStatus {
s := &ContainerSourceStatus{}
s.InitializeConditions()
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
s.PropagateReceiveAdapterStatus(availableDeployment)
s.MarkOIDCIdentityCreatedFailed("", "")
return s
}(),
wantConditionStatus: corev1.ConditionFalse,
want: false,
}, {
name: "mark ready sb, ra and sa unknown",
s: func() *ContainerSourceStatus {
s := &ContainerSourceStatus{}
s.InitializeConditions()
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
s.PropagateReceiveAdapterStatus(availableDeployment)
s.MarkOIDCIdentityCreatedUnknown("Unknown", "")
return s
}(),
wantConditionStatus: corev1.ConditionUnknown,
want: false,
}, {
name: "mark ready sb, ra and sa with reason",
s: func() *ContainerSourceStatus {
s := &ContainerSourceStatus{}
s.InitializeConditions()
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
s.PropagateReceiveAdapterStatus(availableDeployment)
s.MarkOIDCIdentityCreatedSucceededWithReason("Created", "")
return s
}(),
wantConditionStatus: corev1.ConditionTrue,
want: true,
}, {
name: "mark ready sb and not deployed ra",
s: func() *ContainerSourceStatus {
s := &ContainerSourceStatus{}
s.InitializeConditions()
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
s.PropagateReceiveAdapterStatus(&appsv1.Deployment{})
s.MarkOIDCIdentityCreatedSucceeded()
return s
}(),
wantConditionStatus: corev1.ConditionUnknown,
Expand All @@ -206,7 +156,6 @@ func TestContainerSourceStatusIsReady(t *testing.T) {
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
s.PropagateReceiveAdapterStatus(availableDeployment)
s.PropagateSinkBindingStatus(&notReadySinkBinding.Status)
s.MarkOIDCIdentityCreatedSucceeded()
return s
}(),
wantConditionStatus: corev1.ConditionFalse,
Expand All @@ -219,7 +168,6 @@ func TestContainerSourceStatusIsReady(t *testing.T) {
s.PropagateReceiveAdapterStatus(availableDeployment)
s.PropagateSinkBindingStatus(&notReadySinkBinding.Status)
s.PropagateReceiveAdapterStatus(unavailableDeployment)
s.MarkOIDCIdentityCreatedSucceeded()
return s
}(),
wantConditionStatus: corev1.ConditionFalse,
Expand All @@ -231,7 +179,6 @@ func TestContainerSourceStatusIsReady(t *testing.T) {
s.InitializeConditions()
s.PropagateSinkBindingStatus(&notReadySinkBinding.Status)
s.PropagateReceiveAdapterStatus(availableDeployment)
s.MarkOIDCIdentityCreatedSucceeded()
return s
}(),
wantConditionStatus: corev1.ConditionFalse,
Expand All @@ -244,7 +191,6 @@ func TestContainerSourceStatusIsReady(t *testing.T) {
s.PropagateSinkBindingStatus(&notReadySinkBinding.Status)
s.PropagateReceiveAdapterStatus(availableDeployment)
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
s.MarkOIDCIdentityCreatedSucceeded()
return s
}(),
wantConditionStatus: corev1.ConditionTrue,
Expand All @@ -258,7 +204,6 @@ func TestContainerSourceStatusIsReady(t *testing.T) {
if gotConditionStatus != test.wantConditionStatus {
t.Errorf("unexpected condition status: want %v, got %v", test.wantConditionStatus, gotConditionStatus)
}

}
got := test.s.IsReady()
if got != test.want {
Expand Down Expand Up @@ -317,27 +262,13 @@ func TestContainerSourceStatusGetCondition(t *testing.T) {
Type: ContainerSourceConditionReady,
Status: corev1.ConditionUnknown,
},
}, {
name: "mark ready sa",
s: func() *ContainerSourceStatus {
s := &ContainerSourceStatus{}
s.InitializeConditions()
s.MarkOIDCIdentityCreatedSucceeded()
return s
}(),
condQuery: ContainerSourceConditionReady,
want: &apis.Condition{
Type: ContainerSourceConditionReady,
Status: corev1.ConditionUnknown,
},
}, {
name: "mark ready sb and ra",
s: func() *ContainerSourceStatus {
s := &ContainerSourceStatus{}
s.InitializeConditions()
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
s.PropagateReceiveAdapterStatus(availableDeployment)
s.MarkOIDCIdentityCreatedSucceeded()
return s
}(),
condQuery: ContainerSourceConditionReady,
Expand All @@ -353,7 +284,6 @@ func TestContainerSourceStatusGetCondition(t *testing.T) {
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
s.PropagateReceiveAdapterStatus(availableDeployment)
s.PropagateSinkBindingStatus(&notReadySinkBinding.Status)
s.MarkOIDCIdentityCreatedSucceeded()
return s
}(),
condQuery: ContainerSourceConditionReady,
Expand All @@ -363,22 +293,6 @@ func TestContainerSourceStatusGetCondition(t *testing.T) {
Reason: "Testing",
Message: "hi",
},
}, {
name: "mark ready sb, ra and sa unknown",
s: func() *ContainerSourceStatus {
s := &ContainerSourceStatus{}
s.InitializeConditions()
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
s.PropagateReceiveAdapterStatus(availableDeployment)
s.MarkOIDCIdentityCreatedUnknown("Unknown", "")
return s
}(),
condQuery: ContainerSourceConditionReady,
want: &apis.Condition{
Type: ContainerSourceConditionReady,
Status: corev1.ConditionUnknown,
Reason: "Unknown",
},
}, {
name: "mark ready sb and ra then no ra",
s: func() *ContainerSourceStatus {
Expand All @@ -387,45 +301,13 @@ func TestContainerSourceStatusGetCondition(t *testing.T) {
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
s.PropagateReceiveAdapterStatus(availableDeployment)
s.PropagateReceiveAdapterStatus(unavailableDeployment)
s.MarkOIDCIdentityCreatedSucceeded()
return s
}(),
condQuery: ContainerSourceConditionReady,
want: &apis.Condition{
Type: ContainerSourceConditionReady,
Status: corev1.ConditionFalse,
},
}, {
name: "mark ready sb, sa and ra then no sa",
s: func() *ContainerSourceStatus {
s := &ContainerSourceStatus{}
s.InitializeConditions()
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
s.PropagateReceiveAdapterStatus(availableDeployment)
s.MarkOIDCIdentityCreatedSucceeded()
s.MarkOIDCIdentityCreatedFailed("", "")
return s
}(),
condQuery: ContainerSourceConditionReady,
want: &apis.Condition{
Type: ContainerSourceConditionReady,
Status: corev1.ConditionFalse,
},
}, {
name: "mark ready sb, ra and sa with reason",
s: func() *ContainerSourceStatus {
s := &ContainerSourceStatus{}
s.InitializeConditions()
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
s.PropagateReceiveAdapterStatus(availableDeployment)
s.MarkOIDCIdentityCreatedSucceededWithReason("Created", "")
return s
}(),
condQuery: ContainerSourceConditionReady,
want: &apis.Condition{
Type: ContainerSourceConditionReady,
Status: corev1.ConditionTrue,
},
}, {
name: "mark not ready sb and ready ra then ready sb",
s: func() *ContainerSourceStatus {
Expand All @@ -434,7 +316,6 @@ func TestContainerSourceStatusGetCondition(t *testing.T) {
s.PropagateSinkBindingStatus(&notReadySinkBinding.Status)
s.PropagateReceiveAdapterStatus(availableDeployment)
s.PropagateSinkBindingStatus(&readySinkBinding.Status)
s.MarkOIDCIdentityCreatedSucceeded()
return s
}(),
condQuery: ContainerSourceConditionReady,
Expand Down
21 changes: 0 additions & 21 deletions pkg/reconciler/containersource/containersource.go
Original file line number Diff line number Diff line change
Expand Up @@ -29,14 +29,11 @@ import (
"k8s.io/client-go/kubernetes"
appsv1listers "k8s.io/client-go/listers/apps/v1"
corev1listers "k8s.io/client-go/listers/core/v1"
duckv1 "knative.dev/pkg/apis/duck/v1"
"knative.dev/pkg/controller"
"knative.dev/pkg/logging"
pkgreconciler "knative.dev/pkg/reconciler"

"knative.dev/eventing/pkg/apis/feature"
v1 "knative.dev/eventing/pkg/apis/sources/v1"
"knative.dev/eventing/pkg/auth"
clientset "knative.dev/eventing/pkg/client/clientset/versioned"
"knative.dev/eventing/pkg/client/injection/reconciler/sources/v1/containersource"
listers "knative.dev/eventing/pkg/client/listers/sources/v1"
Expand Down Expand Up @@ -68,7 +65,6 @@ type Reconciler struct {
containerSourceLister listers.ContainerSourceLister
sinkBindingLister listers.SinkBindingLister
deploymentLister appsv1listers.DeploymentLister
serviceAccountLister corev1listers.ServiceAccountLister
trustBundleConfigMapLister corev1listers.ConfigMapLister
}

Expand All @@ -83,23 +79,6 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, source *v1.ContainerSour
return err
}

featureFlags := feature.FromContext(ctx)
if featureFlags.IsOIDCAuthentication() {
saName := auth.GetOIDCServiceAccountNameForResource(v1.SchemeGroupVersion.WithKind("ContainerSource"), source.ObjectMeta)
source.Status.Auth = &duckv1.AuthStatus{
ServiceAccountName: &saName,
}

if err := auth.EnsureOIDCServiceAccountExistsForResource(ctx, r.serviceAccountLister, r.kubeClientSet, v1.SchemeGroupVersion.WithKind("ContainerSource"), source.ObjectMeta); err != nil {
source.Status.MarkOIDCIdentityCreatedFailed("Unable to resolve service account for OIDC authentication", "%v", err)
return err
}
source.Status.MarkOIDCIdentityCreatedSucceeded()
} else {
source.Status.Auth = nil
source.Status.MarkOIDCIdentityCreatedSucceededWithReason(fmt.Sprintf("%s feature disabled", feature.OIDCAuthentication), "")
}

_, err = r.reconcileReceiveAdapter(ctx, source)
if err != nil {
logging.FromContext(ctx).Errorw("Error reconciling ReceiveAdapter", zap.Error(err))
Expand Down
Loading

0 comments on commit e3f50bb

Please sign in to comment.