diff --git a/pkg/apis/sources/v1/container_lifecycle.go b/pkg/apis/sources/v1/container_lifecycle.go index 68a4c829c52..0f47a4e9746 100644 --- a/pkg/apis/sources/v1/container_lifecycle.go +++ b/pkg/apis/sources/v1/container_lifecycle.go @@ -31,14 +31,11 @@ const ( // ContainerSourceConditionReceiveAdapterReady has status True when the ContainerSource's ReceiveAdapter is ready. ContainerSourceConditionReceiveAdapterReady apis.ConditionType = "ReceiveAdapterReady" - - ContainerConditionOIDCIdentityCreated apis.ConditionType = "OIDCIdentityCreated" ) var containerCondSet = apis.NewLivingConditionSet( ContainerSourceConditionSinkBindingReady, ContainerSourceConditionReceiveAdapterReady, - ContainerConditionOIDCIdentityCreated, ) // GetConditionSet retrieves the condition set for this resource. Implements the KRShaped interface. @@ -66,23 +63,7 @@ func (s *ContainerSourceStatus) InitializeConditions() { containerCondSet.Manage(s).InitializeConditions() } -func (s *ContainerSourceStatus) MarkOIDCIdentityCreatedSucceeded() { - containerCondSet.Manage(s).MarkTrue(ContainerConditionOIDCIdentityCreated) -} - -func (s *ContainerSourceStatus) MarkOIDCIdentityCreatedSucceededWithReason(reason, messageFormat string, messageA ...interface{}) { - containerCondSet.Manage(s).MarkTrueWithReason(ContainerConditionOIDCIdentityCreated, reason, messageFormat, messageA...) -} - -func (s *ContainerSourceStatus) MarkOIDCIdentityCreatedFailed(reason, messageFormat string, messageA ...interface{}) { - containerCondSet.Manage(s).MarkFalse(ContainerConditionOIDCIdentityCreated, reason, messageFormat, messageA...) -} - -func (s *ContainerSourceStatus) MarkOIDCIdentityCreatedUnknown(reason, messageFormat string, messageA ...interface{}) { - containerCondSet.Manage(s).MarkUnknown(ContainerConditionOIDCIdentityCreated, reason, messageFormat, messageA...) -} - -// PropagateSinkBindingStatus uses the availability of the provided Deployment to determine if +// PropagateSinkBindingStatus uses the SinkBinding to determine if // ContainerSourceConditionSinkBindingReady should be marked as true, false or unknown. func (s *ContainerSourceStatus) PropagateSinkBindingStatus(status *SinkBindingStatus) { // Do not copy conditions nor observedGeneration @@ -105,6 +86,9 @@ func (s *ContainerSourceStatus) PropagateSinkBindingStatus(status *SinkBindingSt default: containerCondSet.Manage(s).MarkUnknown(ContainerSourceConditionSinkBindingReady, cond.Reason, cond.Message) } + + // Propagate SinkBindings AuthStatus to containersources AuthStatus + s.Auth = status.Auth } // PropagateReceiveAdapterStatus uses the availability of the provided Deployment to determine if diff --git a/pkg/apis/sources/v1/container_lifecycle_test.go b/pkg/apis/sources/v1/container_lifecycle_test.go index 3423ef9f8f7..6ed2c87668e 100644 --- a/pkg/apis/sources/v1/container_lifecycle_test.go +++ b/pkg/apis/sources/v1/container_lifecycle_test.go @@ -104,16 +104,6 @@ func TestContainerSourceStatusIsReady(t *testing.T) { }(), wantConditionStatus: corev1.ConditionUnknown, want: false, - }, { - name: "mark ready sa", - s: func() *ContainerSourceStatus { - s := &ContainerSourceStatus{} - s.InitializeConditions() - s.MarkOIDCIdentityCreatedSucceeded() - return s - }(), - wantConditionStatus: corev1.ConditionUnknown, - want: false, }, { name: "mark ready sb and ra", s: func() *ContainerSourceStatus { @@ -121,19 +111,17 @@ func TestContainerSourceStatusIsReady(t *testing.T) { s.InitializeConditions() s.PropagateSinkBindingStatus(&readySinkBinding.Status) s.PropagateReceiveAdapterStatus(availableDeployment) - s.MarkOIDCIdentityCreatedSucceeded() return s }(), wantConditionStatus: corev1.ConditionTrue, want: true, }, { - name: "mark ready sb and unavailable ra ", + name: "mark ready sb and unavailable ra", s: func() *ContainerSourceStatus { s := &ContainerSourceStatus{} s.InitializeConditions() s.PropagateSinkBindingStatus(&readySinkBinding.Status) s.PropagateReceiveAdapterStatus(unavailableDeployment) - s.MarkOIDCIdentityCreatedSucceeded() return s }(), wantConditionStatus: corev1.ConditionFalse, @@ -145,47 +133,10 @@ func TestContainerSourceStatusIsReady(t *testing.T) { s.InitializeConditions() s.PropagateSinkBindingStatus(&readySinkBinding.Status) s.PropagateReceiveAdapterStatus(unknownDeployment) - s.MarkOIDCIdentityCreatedSucceeded() return s }(), wantConditionStatus: corev1.ConditionUnknown, want: false, - }, { - name: "mark ready sb and ra no sa", - s: func() *ContainerSourceStatus { - s := &ContainerSourceStatus{} - s.InitializeConditions() - s.PropagateSinkBindingStatus(&readySinkBinding.Status) - s.PropagateReceiveAdapterStatus(availableDeployment) - s.MarkOIDCIdentityCreatedFailed("", "") - return s - }(), - wantConditionStatus: corev1.ConditionFalse, - want: false, - }, { - name: "mark ready sb, ra and sa unknown", - s: func() *ContainerSourceStatus { - s := &ContainerSourceStatus{} - s.InitializeConditions() - s.PropagateSinkBindingStatus(&readySinkBinding.Status) - s.PropagateReceiveAdapterStatus(availableDeployment) - s.MarkOIDCIdentityCreatedUnknown("Unknown", "") - return s - }(), - wantConditionStatus: corev1.ConditionUnknown, - want: false, - }, { - name: "mark ready sb, ra and sa with reason", - s: func() *ContainerSourceStatus { - s := &ContainerSourceStatus{} - s.InitializeConditions() - s.PropagateSinkBindingStatus(&readySinkBinding.Status) - s.PropagateReceiveAdapterStatus(availableDeployment) - s.MarkOIDCIdentityCreatedSucceededWithReason("Created", "") - return s - }(), - wantConditionStatus: corev1.ConditionTrue, - want: true, }, { name: "mark ready sb and not deployed ra", s: func() *ContainerSourceStatus { @@ -193,7 +144,6 @@ func TestContainerSourceStatusIsReady(t *testing.T) { s.InitializeConditions() s.PropagateSinkBindingStatus(&readySinkBinding.Status) s.PropagateReceiveAdapterStatus(&appsv1.Deployment{}) - s.MarkOIDCIdentityCreatedSucceeded() return s }(), wantConditionStatus: corev1.ConditionUnknown, @@ -206,7 +156,6 @@ func TestContainerSourceStatusIsReady(t *testing.T) { s.PropagateSinkBindingStatus(&readySinkBinding.Status) s.PropagateReceiveAdapterStatus(availableDeployment) s.PropagateSinkBindingStatus(¬ReadySinkBinding.Status) - s.MarkOIDCIdentityCreatedSucceeded() return s }(), wantConditionStatus: corev1.ConditionFalse, @@ -219,7 +168,6 @@ func TestContainerSourceStatusIsReady(t *testing.T) { s.PropagateReceiveAdapterStatus(availableDeployment) s.PropagateSinkBindingStatus(¬ReadySinkBinding.Status) s.PropagateReceiveAdapterStatus(unavailableDeployment) - s.MarkOIDCIdentityCreatedSucceeded() return s }(), wantConditionStatus: corev1.ConditionFalse, @@ -231,7 +179,6 @@ func TestContainerSourceStatusIsReady(t *testing.T) { s.InitializeConditions() s.PropagateSinkBindingStatus(¬ReadySinkBinding.Status) s.PropagateReceiveAdapterStatus(availableDeployment) - s.MarkOIDCIdentityCreatedSucceeded() return s }(), wantConditionStatus: corev1.ConditionFalse, @@ -244,7 +191,6 @@ func TestContainerSourceStatusIsReady(t *testing.T) { s.PropagateSinkBindingStatus(¬ReadySinkBinding.Status) s.PropagateReceiveAdapterStatus(availableDeployment) s.PropagateSinkBindingStatus(&readySinkBinding.Status) - s.MarkOIDCIdentityCreatedSucceeded() return s }(), wantConditionStatus: corev1.ConditionTrue, @@ -258,7 +204,6 @@ func TestContainerSourceStatusIsReady(t *testing.T) { if gotConditionStatus != test.wantConditionStatus { t.Errorf("unexpected condition status: want %v, got %v", test.wantConditionStatus, gotConditionStatus) } - } got := test.s.IsReady() if got != test.want { @@ -317,19 +262,6 @@ func TestContainerSourceStatusGetCondition(t *testing.T) { Type: ContainerSourceConditionReady, Status: corev1.ConditionUnknown, }, - }, { - name: "mark ready sa", - s: func() *ContainerSourceStatus { - s := &ContainerSourceStatus{} - s.InitializeConditions() - s.MarkOIDCIdentityCreatedSucceeded() - return s - }(), - condQuery: ContainerSourceConditionReady, - want: &apis.Condition{ - Type: ContainerSourceConditionReady, - Status: corev1.ConditionUnknown, - }, }, { name: "mark ready sb and ra", s: func() *ContainerSourceStatus { @@ -337,7 +269,6 @@ func TestContainerSourceStatusGetCondition(t *testing.T) { s.InitializeConditions() s.PropagateSinkBindingStatus(&readySinkBinding.Status) s.PropagateReceiveAdapterStatus(availableDeployment) - s.MarkOIDCIdentityCreatedSucceeded() return s }(), condQuery: ContainerSourceConditionReady, @@ -353,7 +284,6 @@ func TestContainerSourceStatusGetCondition(t *testing.T) { s.PropagateSinkBindingStatus(&readySinkBinding.Status) s.PropagateReceiveAdapterStatus(availableDeployment) s.PropagateSinkBindingStatus(¬ReadySinkBinding.Status) - s.MarkOIDCIdentityCreatedSucceeded() return s }(), condQuery: ContainerSourceConditionReady, @@ -363,22 +293,6 @@ func TestContainerSourceStatusGetCondition(t *testing.T) { Reason: "Testing", Message: "hi", }, - }, { - name: "mark ready sb, ra and sa unknown", - s: func() *ContainerSourceStatus { - s := &ContainerSourceStatus{} - s.InitializeConditions() - s.PropagateSinkBindingStatus(&readySinkBinding.Status) - s.PropagateReceiveAdapterStatus(availableDeployment) - s.MarkOIDCIdentityCreatedUnknown("Unknown", "") - return s - }(), - condQuery: ContainerSourceConditionReady, - want: &apis.Condition{ - Type: ContainerSourceConditionReady, - Status: corev1.ConditionUnknown, - Reason: "Unknown", - }, }, { name: "mark ready sb and ra then no ra", s: func() *ContainerSourceStatus { @@ -387,23 +301,6 @@ func TestContainerSourceStatusGetCondition(t *testing.T) { s.PropagateSinkBindingStatus(&readySinkBinding.Status) s.PropagateReceiveAdapterStatus(availableDeployment) s.PropagateReceiveAdapterStatus(unavailableDeployment) - s.MarkOIDCIdentityCreatedSucceeded() - return s - }(), - condQuery: ContainerSourceConditionReady, - want: &apis.Condition{ - Type: ContainerSourceConditionReady, - Status: corev1.ConditionFalse, - }, - }, { - name: "mark ready sb, sa and ra then no sa", - s: func() *ContainerSourceStatus { - s := &ContainerSourceStatus{} - s.InitializeConditions() - s.PropagateSinkBindingStatus(&readySinkBinding.Status) - s.PropagateReceiveAdapterStatus(availableDeployment) - s.MarkOIDCIdentityCreatedSucceeded() - s.MarkOIDCIdentityCreatedFailed("", "") return s }(), condQuery: ContainerSourceConditionReady, @@ -411,21 +308,6 @@ func TestContainerSourceStatusGetCondition(t *testing.T) { Type: ContainerSourceConditionReady, Status: corev1.ConditionFalse, }, - }, { - name: "mark ready sb, ra and sa with reason", - s: func() *ContainerSourceStatus { - s := &ContainerSourceStatus{} - s.InitializeConditions() - s.PropagateSinkBindingStatus(&readySinkBinding.Status) - s.PropagateReceiveAdapterStatus(availableDeployment) - s.MarkOIDCIdentityCreatedSucceededWithReason("Created", "") - return s - }(), - condQuery: ContainerSourceConditionReady, - want: &apis.Condition{ - Type: ContainerSourceConditionReady, - Status: corev1.ConditionTrue, - }, }, { name: "mark not ready sb and ready ra then ready sb", s: func() *ContainerSourceStatus { @@ -434,7 +316,6 @@ func TestContainerSourceStatusGetCondition(t *testing.T) { s.PropagateSinkBindingStatus(¬ReadySinkBinding.Status) s.PropagateReceiveAdapterStatus(availableDeployment) s.PropagateSinkBindingStatus(&readySinkBinding.Status) - s.MarkOIDCIdentityCreatedSucceeded() return s }(), condQuery: ContainerSourceConditionReady, diff --git a/pkg/reconciler/containersource/containersource.go b/pkg/reconciler/containersource/containersource.go index 1524e06dbfd..fb1052c270b 100644 --- a/pkg/reconciler/containersource/containersource.go +++ b/pkg/reconciler/containersource/containersource.go @@ -29,14 +29,11 @@ import ( "k8s.io/client-go/kubernetes" appsv1listers "k8s.io/client-go/listers/apps/v1" corev1listers "k8s.io/client-go/listers/core/v1" - duckv1 "knative.dev/pkg/apis/duck/v1" "knative.dev/pkg/controller" "knative.dev/pkg/logging" pkgreconciler "knative.dev/pkg/reconciler" - "knative.dev/eventing/pkg/apis/feature" v1 "knative.dev/eventing/pkg/apis/sources/v1" - "knative.dev/eventing/pkg/auth" clientset "knative.dev/eventing/pkg/client/clientset/versioned" "knative.dev/eventing/pkg/client/injection/reconciler/sources/v1/containersource" listers "knative.dev/eventing/pkg/client/listers/sources/v1" @@ -68,7 +65,6 @@ type Reconciler struct { containerSourceLister listers.ContainerSourceLister sinkBindingLister listers.SinkBindingLister deploymentLister appsv1listers.DeploymentLister - serviceAccountLister corev1listers.ServiceAccountLister trustBundleConfigMapLister corev1listers.ConfigMapLister } @@ -83,23 +79,6 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, source *v1.ContainerSour return err } - featureFlags := feature.FromContext(ctx) - if featureFlags.IsOIDCAuthentication() { - saName := auth.GetOIDCServiceAccountNameForResource(v1.SchemeGroupVersion.WithKind("ContainerSource"), source.ObjectMeta) - source.Status.Auth = &duckv1.AuthStatus{ - ServiceAccountName: &saName, - } - - if err := auth.EnsureOIDCServiceAccountExistsForResource(ctx, r.serviceAccountLister, r.kubeClientSet, v1.SchemeGroupVersion.WithKind("ContainerSource"), source.ObjectMeta); err != nil { - source.Status.MarkOIDCIdentityCreatedFailed("Unable to resolve service account for OIDC authentication", "%v", err) - return err - } - source.Status.MarkOIDCIdentityCreatedSucceeded() - } else { - source.Status.Auth = nil - source.Status.MarkOIDCIdentityCreatedSucceededWithReason(fmt.Sprintf("%s feature disabled", feature.OIDCAuthentication), "") - } - _, err = r.reconcileReceiveAdapter(ctx, source) if err != nil { logging.FromContext(ctx).Errorw("Error reconciling ReceiveAdapter", zap.Error(err)) diff --git a/pkg/reconciler/containersource/containersource_test.go b/pkg/reconciler/containersource/containersource_test.go index ea30e68c44f..8ab104ac2e6 100644 --- a/pkg/reconciler/containersource/containersource_test.go +++ b/pkg/reconciler/containersource/containersource_test.go @@ -19,6 +19,9 @@ package containersource import ( "context" "fmt" + "knative.dev/eventing/pkg/apis/feature" + "knative.dev/eventing/pkg/auth" + "knative.dev/pkg/ptr" "testing" "knative.dev/pkg/kmeta" @@ -29,24 +32,20 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/runtime" clientgotesting "k8s.io/client-go/testing" + fakeeventingclient "knative.dev/eventing/pkg/client/injection/client/fake" "knative.dev/pkg/apis" fakekubeclient "knative.dev/pkg/client/injection/kube/client/fake" "knative.dev/pkg/logging" - "knative.dev/eventing/pkg/auth" - fakeeventingclient "knative.dev/eventing/pkg/client/injection/client/fake" - + sourcesv1 "knative.dev/eventing/pkg/apis/sources/v1" + "knative.dev/eventing/pkg/client/injection/reconciler/sources/v1/containersource" + "knative.dev/eventing/pkg/reconciler/containersource/resources" duckv1 "knative.dev/pkg/apis/duck/v1" "knative.dev/pkg/client/injection/ducks/duck/v1/addressable" _ "knative.dev/pkg/client/injection/ducks/duck/v1/addressable/fake" "knative.dev/pkg/configmap" "knative.dev/pkg/controller" - "knative.dev/eventing/pkg/apis/feature" - sourcesv1 "knative.dev/eventing/pkg/apis/sources/v1" - "knative.dev/eventing/pkg/client/injection/reconciler/sources/v1/containersource" - "knative.dev/eventing/pkg/reconciler/containersource/resources" - logtesting "knative.dev/pkg/logging/testing" . "knative.dev/pkg/reconciler/testing" @@ -146,7 +145,6 @@ func TestAllCases(t *testing.T) { WithContainerSourceSpec(makeContainerSourceSpec(sinkDest)), WithContainerSourceObjectMetaGeneration(generation), WithInitContainerSourceConditions, - WithContainerSourceOIDCIdentityCreatedSucceededBecauseOIDCFeatureDisabled(), WithContainerSourceStatusObservedGeneration(generation), ), }}, @@ -181,7 +179,6 @@ func TestAllCases(t *testing.T) { WithContainerSourceSpec(makeContainerSourceSpec(sinkDest)), WithContainerSourceObjectMetaGeneration(generation), WithInitContainerSourceConditions, - WithContainerSourceOIDCIdentityCreatedSucceededBecauseOIDCFeatureDisabled(), WithContainerSourceStatusObservedGeneration(generation), WithContainerSourcePropagateReceiveAdapterStatus(makeDeployment(NewContainerSource(sourceName, testNS, WithContainerSourceSpec(makeContainerSourceSpec(sinkDest)), @@ -224,7 +221,6 @@ func TestAllCases(t *testing.T) { Object: NewContainerSource(sourceName, testNS, WithContainerSourceUID(sourceUID), WithContainerSourceSpec(makeContainerSourceSpec(sinkDest)), - WithContainerSourceOIDCIdentityCreatedSucceededBecauseOIDCFeatureDisabled(), WithContainerSourceObjectMetaGeneration(generation), WithInitContainerSourceConditions, WithContainerSourceStatusObservedGeneration(generation), @@ -236,7 +232,7 @@ func TestAllCases(t *testing.T) { ), }}, }, { - Name: "OIDC: creates OIDC service account", + Name: "OIDC: Containersource uses OIDC service account of sinkbinding", Key: testNS + "/" + sourceName, Ctx: feature.ToContext(context.Background(), feature.Flags{ feature.OIDCAuthentication: feature.Enabled, @@ -247,7 +243,7 @@ func TestAllCases(t *testing.T) { WithContainerSourceSpec(makeContainerSourceSpec(sinkDest)), WithContainerSourceObjectMetaGeneration(generation), ), - makeSinkBinding(NewContainerSource(sourceName, testNS, + makeSinkBindingOIDC(NewContainerSource(sourceName, testNS, WithContainerSourceSpec(makeContainerSourceSpec(sinkDest)), WithContainerSourceUID(sourceUID), ), &conditionTrue), @@ -264,53 +260,17 @@ func TestAllCases(t *testing.T) { WithContainerSourceObjectMetaGeneration(generation), WithInitContainerSourceConditions, WithContainerSourceStatusObservedGeneration(generation), - WithContainerSourcePropagateSinkbindingStatus(makeSinkBindingStatus(&conditionTrue)), + WithContainerSourcePropagateSinkbindingStatus(makeSinkBindingStatusOIDC(&conditionTrue)), WithContainerSourcePropagateReceiveAdapterStatus(makeDeployment(NewContainerSource(sourceName, testNS, WithContainerSourceSpec(makeContainerSourceSpec(sinkDest)), WithContainerSourceUID(sourceUID), ), &conditionTrue)), - WithContainerSourceOIDCIdentityCreatedSucceeded(), - WithContainerSourceOIDCServiceAccountName(makeContainerSourceOIDCServiceAccount().Name), - ), - }}, - WantEvents: []string{ - Eventf(corev1.EventTypeNormal, sourceReconciled, `ContainerSource reconciled: "%s/%s"`, testNS, sourceName), - }, - WantCreates: []runtime.Object{ - makeContainerSourceOIDCServiceAccount(), - }, - }, { - Name: "OIDC: Containersource not ready on invalid OIDC service account", - Key: testNS + "/" + sourceName, - Ctx: feature.ToContext(context.Background(), feature.Flags{ - feature.OIDCAuthentication: feature.Enabled, - }), - Objects: []runtime.Object{ - makeContainerSourceOIDCServiceAccountWithoutOwnerRef(), - makeSinkBinding(NewContainerSource(sourceName, testNS, - WithContainerSourceSpec(makeContainerSourceSpec(sinkDest)), - WithContainerSourceUID(sourceUID), - ), nil), - NewContainerSource(sourceName, testNS, - WithContainerSourceUID(sourceUID), - WithContainerSourceSpec(makeContainerSourceSpec(sinkDest)), - WithContainerSourceObjectMetaGeneration(generation), - ), - }, - WantErr: true, - WantStatusUpdates: []clientgotesting.UpdateActionImpl{{ - Object: NewContainerSource(sourceName, testNS, - WithContainerSourceStatusObservedGeneration(generation), - WithContainerSourceObjectMetaGeneration(generation), - WithContainerSourceUID(sourceUID), - WithContainerSourceSpec(makeContainerSourceSpec(sinkDest)), WithInitContainerSourceConditions, - WithContainerSourceOIDCIdentityCreatedFailed("Unable to resolve service account for OIDC authentication", fmt.Sprintf("service account %s not owned by ContainerSource %s", makeContainerSourceOIDCServiceAccountWithoutOwnerRef().Name, sourceName)), - WithContainerSourceOIDCServiceAccountName(makeContainerSourceOIDCServiceAccountWithoutOwnerRef().Name), + WithContainerSourceOIDCServiceAccountName(getOIDCServiceAccountNameForSinkbinding()), ), }}, WantEvents: []string{ - Eventf(corev1.EventTypeWarning, "InternalError", fmt.Sprintf("service account %s not owned by ContainerSource %s", makeContainerSourceOIDCServiceAccountWithoutOwnerRef().Name, sourceName)), + Eventf(corev1.EventTypeNormal, sourceReconciled, `ContainerSource reconciled: "%s/%s"`, testNS, sourceName), }, }, } @@ -324,7 +284,6 @@ func TestAllCases(t *testing.T) { containerSourceLister: listers.GetContainerSourceLister(), deploymentLister: listers.GetDeploymentLister(), sinkBindingLister: listers.GetSinkBindingLister(), - serviceAccountLister: listers.GetServiceAccountLister(), trustBundleConfigMapLister: listers.GetConfigMapLister(), } return containersource.NewReconciler(ctx, logging.FromContext(ctx), fakeeventingclient.Get(ctx), listers.GetContainerSourceLister(), controller.GetEventRecorder(ctx), r) @@ -361,6 +320,13 @@ func makeSinkBinding(source *sourcesv1.ContainerSource, ready *corev1.ConditionS return sb } +func makeSinkBindingOIDC(source *sourcesv1.ContainerSource, ready *corev1.ConditionStatus) *sourcesv1.SinkBinding { + sb := makeSinkBinding(source, ready) + sb.Status = *makeSinkBindingStatusOIDC(ready) + + return sb +} + func makeDeployment(source *sourcesv1.ContainerSource, available *corev1.ConditionStatus) *appsv1.Deployment { template := source.Spec.Template @@ -448,16 +414,18 @@ func makeSinkBindingStatus(ready *corev1.ConditionStatus) *sourcesv1.SinkBinding } } -func makeContainerSourceOIDCServiceAccount() *corev1.ServiceAccount { - return auth.GetOIDCServiceAccountForResource(sourcesv1.SchemeGroupVersion.WithKind("ContainerSource"), metav1.ObjectMeta{ - Name: sourceName, - Namespace: testNS, - UID: sourceUID, - }) +func makeSinkBindingStatusOIDC(ready *corev1.ConditionStatus) *sourcesv1.SinkBindingStatus { + sbs := makeSinkBindingStatus(ready) + sbs.Auth = &duckv1.AuthStatus{ + ServiceAccountName: ptr.String(getOIDCServiceAccountNameForSinkbinding()), + } + + return sbs } -func makeContainerSourceOIDCServiceAccountWithoutOwnerRef() *corev1.ServiceAccount { - sa := makeContainerSourceOIDCServiceAccount() - sa.OwnerReferences = nil - return sa +func getOIDCServiceAccountNameForSinkbinding() string { + return auth.GetOIDCServiceAccountNameForResource(sourcesv1.SchemeGroupVersion.WithKind("SinkBinding"), metav1.ObjectMeta{ + Name: sinkBindingName, + Namespace: testNS, + }) } diff --git a/pkg/reconciler/containersource/controller.go b/pkg/reconciler/containersource/controller.go index 49ff5a6e5c1..9d53f92f9a3 100644 --- a/pkg/reconciler/containersource/controller.go +++ b/pkg/reconciler/containersource/controller.go @@ -23,22 +23,20 @@ import ( configmapinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/configmap/filtered" "knative.dev/pkg/system" + kubeclient "knative.dev/pkg/client/injection/kube/client" + deploymentinformer "knative.dev/pkg/client/injection/kube/informers/apps/v1/deployment" + "knative.dev/pkg/configmap" + "knative.dev/pkg/controller" + "knative.dev/pkg/logging" + "knative.dev/eventing/pkg/apis/feature" v1 "knative.dev/eventing/pkg/apis/sources/v1" - "knative.dev/eventing/pkg/auth" eventingclient "knative.dev/eventing/pkg/client/injection/client" containersourceinformer "knative.dev/eventing/pkg/client/injection/informers/sources/v1/containersource" sinkbindinginformer "knative.dev/eventing/pkg/client/injection/informers/sources/v1/sinkbinding" v1containersource "knative.dev/eventing/pkg/client/injection/reconciler/sources/v1/containersource" "knative.dev/eventing/pkg/eventingtls" eventingreconciler "knative.dev/eventing/pkg/reconciler" - - kubeclient "knative.dev/pkg/client/injection/kube/client" - deploymentinformer "knative.dev/pkg/client/injection/kube/informers/apps/v1/deployment" - serviceaccountinformer "knative.dev/pkg/client/injection/kube/informers/core/v1/serviceaccount/filtered" - "knative.dev/pkg/configmap" - "knative.dev/pkg/controller" - "knative.dev/pkg/logging" ) // NewController creates a Reconciler for ContainerSource and returns the result of NewImpl. @@ -52,7 +50,6 @@ func NewController( containersourceInformer := containersourceinformer.Get(ctx) sinkbindingInformer := sinkbindinginformer.Get(ctx) deploymentInformer := deploymentinformer.Get(ctx) - oidcServiceaccountInformer := serviceaccountinformer.Get(ctx, auth.OIDCLabelSelector) trustBundleConfigMapInformer := configmapinformer.Get(ctx, eventingtls.TrustBundleLabelSelector) var globalResync func(obj interface{}) @@ -70,7 +67,6 @@ func NewController( containerSourceLister: containersourceInformer.Lister(), deploymentLister: deploymentInformer.Lister(), sinkBindingLister: sinkbindingInformer.Lister(), - serviceAccountLister: oidcServiceaccountInformer.Lister(), trustBundleConfigMapLister: trustBundleConfigMapInformer.Lister(), } impl := v1containersource.NewImpl(ctx, r, func(impl *controller.Impl) controller.Options { diff --git a/pkg/reconciler/containersource/controller_test.go b/pkg/reconciler/containersource/controller_test.go index 21d4d9b7149..8b51e93dd87 100644 --- a/pkg/reconciler/containersource/controller_test.go +++ b/pkg/reconciler/containersource/controller_test.go @@ -22,19 +22,18 @@ import ( corev1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "knative.dev/eventing/pkg/auth" filteredFactory "knative.dev/pkg/client/injection/kube/informers/factory/filtered" "knative.dev/pkg/configmap" . "knative.dev/pkg/reconciler/testing" // Fake injection informers + "knative.dev/eventing/pkg/apis/feature" _ "knative.dev/pkg/client/injection/kube/informers/apps/v1/deployment/fake" _ "knative.dev/pkg/client/injection/kube/informers/core/v1/configmap/filtered/fake" _ "knative.dev/pkg/client/injection/kube/informers/core/v1/serviceaccount/filtered/fake" _ "knative.dev/pkg/client/injection/kube/informers/factory/filtered/fake" _ "knative.dev/pkg/injection/clients/dynamicclient/fake" - "knative.dev/eventing/pkg/apis/feature" _ "knative.dev/eventing/pkg/client/injection/informers/sources/v1/containersource/fake" _ "knative.dev/eventing/pkg/client/injection/informers/sources/v1/sinkbinding/fake" "knative.dev/eventing/pkg/eventingtls" @@ -57,6 +56,6 @@ func TestNew(t *testing.T) { } func SetUpInformerSelector(ctx context.Context) context.Context { - ctx = filteredFactory.WithSelectors(ctx, auth.OIDCLabelSelector, eventingtls.TrustBundleLabelSelector) + ctx = filteredFactory.WithSelectors(ctx, eventingtls.TrustBundleLabelSelector) return ctx } diff --git a/pkg/reconciler/testing/v1/containersource.go b/pkg/reconciler/testing/v1/containersource.go index d02a7917503..99729da1701 100644 --- a/pkg/reconciler/testing/v1/containersource.go +++ b/pkg/reconciler/testing/v1/containersource.go @@ -18,12 +18,11 @@ package testing import ( "context" - "fmt" - "knative.dev/eventing/pkg/apis/feature" - v1 "knative.dev/eventing/pkg/apis/sources/v1" duckv1 "knative.dev/pkg/apis/duck/v1" + v1 "knative.dev/eventing/pkg/apis/sources/v1" + appsv1 "k8s.io/api/apps/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/types" @@ -96,24 +95,6 @@ func WithContainerUnobservedGeneration() ContainerSourceOption { } } -func WithContainerSourceOIDCIdentityCreatedSucceeded() ContainerSourceOption { - return func(c *v1.ContainerSource) { - c.Status.MarkOIDCIdentityCreatedSucceeded() - } -} - -func WithContainerSourceOIDCIdentityCreatedSucceededBecauseOIDCFeatureDisabled() ContainerSourceOption { - return func(c *v1.ContainerSource) { - c.Status.MarkOIDCIdentityCreatedSucceededWithReason(fmt.Sprintf("%s feature disabled", feature.OIDCAuthentication), "") - } -} - -func WithContainerSourceOIDCIdentityCreatedFailed(reason, message string) ContainerSourceOption { - return func(c *v1.ContainerSource) { - c.Status.MarkOIDCIdentityCreatedFailed(reason, message) - } -} - func WithContainerSourceOIDCServiceAccountName(name string) ContainerSourceOption { return func(c *v1.ContainerSource) { if c.Status.Auth == nil {