Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Migrate platform reference to Upbound official providers #22

Merged
merged 1 commit into from
Sep 27, 2022
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
21 changes: 12 additions & 9 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,8 @@ your internal teams.

It provides platform APIs to provision fully configured GKE clusters, with secure networking, and
stateful cloud services (Cloud SQL) designed to securely connect to the nodes in each GKE cluster --
all composed using cloud service primitives from the [Crossplane GCP
Provider](https://doc.crds.dev/github.com/crossplane/provider-gcp). App deployments can securely
all composed using cloud service primitives from the [Upbound Official GCP
Provider](https://marketplace.upbound.io/providers/upbound/provider-gcp). App deployments can securely
connect to the infrastructure they need using secrets distributed directly to the app namespace.

## Quick Start
Expand All @@ -19,7 +19,7 @@ There are two ways to run Universal Crossplane:
1. Hosted on Upbound Cloud
1. Self-hosted on any Kubernetes cluster.

To provision the GCP Reference platform, you can pick the option that is best for you.
To provision the GCP Reference platform, you can pick the option that is best for you.

We'll go through each option in the next sections.

Expand Down Expand Up @@ -95,13 +95,16 @@ kubectl get pkg
#### GCP Provider Setup

Set up your GCP account keyfile by following the instructions on:
https://crossplane.io/docs/v1.0/getting-started/install-configure.html#select-provider
https://crossplane.io/docs/v1.9/getting-started/install-configure.html#select-a-getting-started-configuration

Ensure that the following roles are added to your service account:

* `roles/compute.networkAdmin`
* `roles/container.admin`
* `roles/iam.serviceAccountUser`
* `roles/iam.securityAdmin`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what caused these extra roles/permissions to now be needed?

Copy link
Member Author

@ytsarev ytsarev Sep 27, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jbw976 it is required to create ProjectIAMMember

I mentioned here #22 (comment)

we need all that machinery to enable automated access in the form of

          identity:
            type: GoogleApplicationCredentials

for the helm ProviderConfig here

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

aha yes, thanks for clearing that up. So just to tie some loose ends together (for myself), this is the new approach for getting Auth to work with GKE clusters. This support was added to:

And that functionality generally address issues we've seen around this topic, like:

* `roles/iam.serviceAccountAdmin`
* `roles/iam.serviceAccountKeyAdmin`

Then create the secret using the given `creds.json` file:

Expand Down Expand Up @@ -162,7 +165,7 @@ kubectl -n upbound-system get cluster
1. Delete `Cluster` claim:

```console
kubectl -n upbound-system delete -f examples/cluster.yaml
kubectl -n upbound-system delete -f examples/cluster-claim.yaml
```

2. Verify all underlying resources have been cleanly deleted:
Expand Down Expand Up @@ -224,7 +227,7 @@ docker login ${REGISTRY} -u ${UPBOUND_ACCOUNT_EMAIL}
Build package.

```console
up xpkg build --name package.xpkg --ignore ".github/*,.github/*/*,examples/*,hack/*"
up xpkg build --name package.xpkg --ignore ".github/workflows/*,hack/*"
```

Push package to registry.
Expand All @@ -240,12 +243,12 @@ kubectl crossplane install configuration ${PLATFORM_CONFIG}
```

The cloud service primitives that can be used in a `Composition` today are
listed in the Crossplane provider docs:
listed in the Upbound Marketplace provider docs:

* [Crossplane GCP Provider](https://doc.crds.dev/github.com/crossplane/provider-gcp)
* [Upbound Official GCP Provider](https://marketplace.upbound.io/providers/upbound/provider-gcp)

To learn more see [Configuration
Packages](https://crossplane.io/docs/v0.14/getting-started/package-infrastructure.html).
Packages](https://crossplane.io/docs/v1.9/concepts/packages.html).

## Learn More

Expand Down
20 changes: 12 additions & 8 deletions cluster/composition.yaml
Original file line number Diff line number Diff line change
@@ -1,25 +1,29 @@
apiVersion: apiextensions.crossplane.io/v1
kind: Composition
metadata:
name: gke.compositeclusters.gcp.platformref.crossplane.io
name: gke.compositeclusters.gcp.platformref.upbound.io
labels:
provider: GCP
spec:
writeConnectionSecretsToNamespace: upbound-system
compositeTypeRef:
apiVersion: gcp.platformref.crossplane.io/v1alpha1
apiVersion: gcp.platformref.upbound.io/v1alpha1
ytsarev marked this conversation as resolved.
Show resolved Hide resolved
kind: CompositeCluster
resources:
- base:
apiVersion: gcp.platformref.crossplane.io/v1alpha1
apiVersion: gcp.platformref.upbound.io/v1alpha1
kind: CompositeNetwork
patches:
- fromFieldPath: spec.id
toFieldPath: spec.id
- base:
apiVersion: gcp.platformref.upbound.io/v1alpha1
kind: GKE
connectionDetails:
- fromConnectionSecretKey: kubeconfig
patches:
- fromFieldPath: spec.id
toFieldPath: spec.id
- fromFieldPath: spec.id
toFieldPath: metadata.annotations[crossplane.io/external-name]
- fromFieldPath: metadata.uid
toFieldPath: spec.writeConnectionSecretToRef.name
transforms:
Expand All @@ -32,10 +36,10 @@ spec:
toFieldPath: spec.parameters.nodes.count
- fromFieldPath: spec.parameters.nodes.size
toFieldPath: spec.parameters.nodes.size
- fromFieldPath: spec.parameters.networkRef.id
toFieldPath: spec.parameters.networkRef.id
- fromFieldPath: spec.id
toFieldPath: spec.parameters.compositeNetworkSelector.matchLabels[networks.gcp.platformref.upbound.io/network-id]
- base:
apiVersion: gcp.platformref.crossplane.io/v1alpha1
apiVersion: gcp.platformref.upbound.io/v1alpha1
kind: Services
patches:
- fromFieldPath: spec.id
Expand Down
94 changes: 2 additions & 92 deletions cluster/definition.yaml
Original file line number Diff line number Diff line change
@@ -1,93 +1,14 @@
apiVersion: apiextensions.crossplane.io/v1
kind: CompositeResourceDefinition
metadata:
name: compositeclusters.gcp.platformref.crossplane.io
annotations:
upbound.io/ui-schema: |-
---
configSections:
- title: Cluster Info
description: Information about this cluster
items:
- name: id
controlType: singleInput
type: string
path: ".spec.id"
title: Cluster ID
description: Cluster ID that other objects will use to refer to this cluster
default: platform-ref-gcp-cluster
validation:
- required: true
customError: Cluster ID is required.
- name: writeSecretRef
controlType: singleInput
type: string
path: ".spec.writeConnectionSecretToRef.name"
title: Connection Secret Ref
description: name of the secret to write to this namespace
default: cluster-conn
validation:
- required: true
- title: Cluster Nodes
description: Enter information to size your cluster
items:
- name: clusterNodeCount
controlType: singleInput
type: integer
path: ".spec.parameters.nodes.count"
title: Node Count
description: Number of nodes in the cluster
default: 1
validation:
- minimum: 1
- maximum: 100
- required: true
customError: Node count is required.
- name: clusterNodeSize
controlType: singleSelect
path: ".spec.parameters.nodes.size"
title: Node Size
description: Size of cluster nodes
default: small
enum:
- small
- medium
- large
validation:
- required: true
customError: Node size is required.
- title: Cluster Networking
description: Select a network fabric for your cluster
items:
- name: networkRef
controlType: singleInput
type: string
path: ".spec.parameters.networkRef.id"
title: Network Ref
description: Network fabric to connect the database to
default: platform-ref-gcp-network
validation:
- required: true
customError: Network ref is required.
- title: Cluster Services
description: Configure cluster services and operators
items:
- name: promVersion
controlType: singleInput
type: string
path: ".spec.parameters.services.operators.prometheus.version"
title: Prometheus Chart Version
description: The version of kube-prometheus-stack chart to install
default: 10.1.0
validation:
- required: false
name: compositeclusters.gcp.platformref.upbound.io
spec:
claimNames:
kind: Cluster
plural: clusters
connectionSecretKeys:
- kubeconfig
group: gcp.platformref.crossplane.io
group: gcp.platformref.upbound.io
names:
kind: CompositeCluster
plural: compositeclusters
Expand Down Expand Up @@ -145,19 +66,8 @@ spec:
version:
type: string
description: Prometheus operator version to run.
networkRef:
type: object
description: "A reference to the Network object that this cluster should be
connected to."
properties:
id:
type: string
description: ID of the Network object this ref points to.
required:
- id
required:
- nodes
- networkRef
required:
- id
- parameters