forked from kubernetes/kubernetes
-
Notifications
You must be signed in to change notification settings - Fork 99
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
UPSTREAM: <carry>: kube-controller-manager: allow running bare kube-c…
…ontroller-manager UPSTREAM: <carry>: (squash) kube-controller-manager: allow running bare kube-controller-manager UPSTREAM: <carry>: kube-controller-manager: allow running bare kube-controller-manager openshift-rebase(v1.24):source=18bbb151dd9 openshift-rebase(v1.24):source=18bbb151dd9 openshift-rebase(v1.24):source=18bbb151dd9 UPSTREAM: <carry>: (squash) remove egressnetworkpolicies from gc ignored resources egressnetworkpolicies should not be in garbage collector ignored resources, so users can delete them using "--cascade=foreground" flag. Signed-off-by: Flavio Fernandes <flaviof@redhat.com> openshift-rebase(v1.24):source=771b4b56597
- Loading branch information
Showing
12 changed files
with
843 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| package config | ||
|
|
||
| // OpenShiftContext is additional context that we need to launch the kube-controller-manager for openshift. | ||
| // Basically, this holds our additional config information. | ||
| type OpenShiftContext struct { | ||
| OpenShiftConfig string | ||
| OpenShiftDefaultProjectNodeSelector string | ||
| KubeDefaultProjectNodeSelector string | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,84 @@ | ||
| package app | ||
|
|
||
| import ( | ||
| "io/ioutil" | ||
| "path" | ||
|
|
||
| "k8s.io/apimachinery/pkg/util/json" | ||
| kyaml "k8s.io/apimachinery/pkg/util/yaml" | ||
| "k8s.io/client-go/informers" | ||
| "k8s.io/kubernetes/cmd/kube-controller-manager/app/config" | ||
| "k8s.io/kubernetes/cmd/kube-controller-manager/app/options" | ||
| ) | ||
|
|
||
| var InformerFactoryOverride informers.SharedInformerFactory | ||
|
|
||
| func ShimForOpenShift(controllerManagerOptions *options.KubeControllerManagerOptions, controllerManager *config.Config) error { | ||
| if len(controllerManager.OpenShiftContext.OpenShiftConfig) == 0 { | ||
| return nil | ||
| } | ||
|
|
||
| // TODO this gets removed when no longer take flags and no longer build a recycler template | ||
| openshiftConfig, err := getOpenShiftConfig(controllerManager.OpenShiftContext.OpenShiftConfig) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| // TODO this should be replaced by using a flex volume to inject service serving cert CAs into pods instead of adding it to the sa token | ||
| if err := applyOpenShiftServiceServingCertCAFunc(path.Dir(controllerManager.OpenShiftContext.OpenShiftConfig), openshiftConfig); err != nil { | ||
| return err | ||
| } | ||
|
|
||
| // skip GC on some openshift resources | ||
| // TODO this should be replaced by discovery information in some way | ||
| if err := applyOpenShiftGCConfig(controllerManager); err != nil { | ||
| return err | ||
| } | ||
|
|
||
| if err := applyOpenShiftConfigDefaultProjectSelector(controllerManagerOptions, openshiftConfig); err != nil { | ||
| return err | ||
| } | ||
|
|
||
| // Overwrite the informers, because we have our custom generic informers for quota. | ||
| // TODO update quota to create its own informer like garbage collection | ||
| if informers, err := newInformerFactory(controllerManager.Kubeconfig); err != nil { | ||
| return err | ||
| } else { | ||
| InformerFactoryOverride = informers | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func getOpenShiftConfig(configFile string) (map[string]interface{}, error) { | ||
| configBytes, err := ioutil.ReadFile(configFile) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| jsonBytes, err := kyaml.ToJSON(configBytes) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| config := map[string]interface{}{} | ||
| if err := json.Unmarshal(jsonBytes, &config); err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return config, nil | ||
| } | ||
|
|
||
| func applyOpenShiftConfigDefaultProjectSelector(controllerManagerOptions *options.KubeControllerManagerOptions, openshiftConfig map[string]interface{}) error { | ||
| projectConfig, ok := openshiftConfig["projectConfig"] | ||
| if !ok { | ||
| return nil | ||
| } | ||
|
|
||
| castProjectConfig := projectConfig.(map[string]interface{}) | ||
| defaultNodeSelector, ok := castProjectConfig["defaultNodeSelector"] | ||
| if !ok { | ||
| return nil | ||
| } | ||
| controllerManagerOptions.OpenShiftContext.OpenShiftDefaultProjectNodeSelector = defaultNodeSelector.(string) | ||
|
|
||
| return nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| package app | ||
|
|
||
| import ( | ||
| gcconfig "k8s.io/kubernetes/pkg/controller/garbagecollector/config" | ||
|
|
||
| "k8s.io/kubernetes/cmd/kube-controller-manager/app/config" | ||
| ) | ||
|
|
||
| func applyOpenShiftGCConfig(controllerManager *config.Config) error { | ||
| // TODO make this configurable or discoverable. This is going to prevent us from running the stock GC controller | ||
| // IF YOU ADD ANYTHING TO THIS LIST, MAKE SURE THAT YOU UPDATE THEIR STRATEGIES TO PREVENT GC FINALIZERS | ||
| controllerManager.ComponentConfig.GarbageCollectorController.GCIgnoredResources = append(controllerManager.ComponentConfig.GarbageCollectorController.GCIgnoredResources, | ||
| // explicitly disabled from GC for now - not enough value to track them | ||
| gcconfig.GroupResource{Group: "authorization.openshift.io", Resource: "rolebindingrestrictions"}, | ||
| gcconfig.GroupResource{Group: "network.openshift.io", Resource: "clusternetworks"}, | ||
| gcconfig.GroupResource{Group: "network.openshift.io", Resource: "hostsubnets"}, | ||
| gcconfig.GroupResource{Group: "network.openshift.io", Resource: "netnamespaces"}, | ||
| gcconfig.GroupResource{Group: "oauth.openshift.io", Resource: "oauthclientauthorizations"}, | ||
| gcconfig.GroupResource{Group: "oauth.openshift.io", Resource: "oauthclients"}, | ||
| gcconfig.GroupResource{Group: "quota.openshift.io", Resource: "clusterresourcequotas"}, | ||
| gcconfig.GroupResource{Group: "user.openshift.io", Resource: "groups"}, | ||
| gcconfig.GroupResource{Group: "user.openshift.io", Resource: "identities"}, | ||
| gcconfig.GroupResource{Group: "user.openshift.io", Resource: "users"}, | ||
| gcconfig.GroupResource{Group: "image.openshift.io", Resource: "images"}, | ||
|
|
||
| // virtual resource | ||
| gcconfig.GroupResource{Group: "project.openshift.io", Resource: "projects"}, | ||
| // virtual and unwatchable resource, surfaced via rbac.authorization.k8s.io objects | ||
| gcconfig.GroupResource{Group: "authorization.openshift.io", Resource: "clusterroles"}, | ||
| gcconfig.GroupResource{Group: "authorization.openshift.io", Resource: "clusterrolebindings"}, | ||
| gcconfig.GroupResource{Group: "authorization.openshift.io", Resource: "roles"}, | ||
| gcconfig.GroupResource{Group: "authorization.openshift.io", Resource: "rolebindings"}, | ||
| // these resources contain security information in their names, and we don't need to track them | ||
| gcconfig.GroupResource{Group: "oauth.openshift.io", Resource: "oauthaccesstokens"}, | ||
| gcconfig.GroupResource{Group: "oauth.openshift.io", Resource: "oauthauthorizetokens"}, | ||
| ) | ||
|
|
||
| return nil | ||
| } |
Oops, something went wrong.