/
mcagent_secret.go
105 lines (92 loc) · 4.35 KB
/
mcagent_secret.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
// Copyright (c) 2021, 2022, Oracle and/or its affiliates.
// Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
package mcagent
import (
"fmt"
apierrors "k8s.io/apimachinery/pkg/api/errors"
clustersv1alpha1 "github.com/verrazzano/verrazzano/application-operator/apis/clusters/v1alpha1"
"github.com/verrazzano/verrazzano/application-operator/controllers/clusters"
"k8s.io/apimachinery/pkg/types"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
)
// Synchronize MultiClusterSecret objects to the local cluster
func (s *Syncer) syncMCSecretObjects(namespace string) error {
// Get all the MultiClusterSecret objects from the admin cluster
allAdminMCSecrets := clustersv1alpha1.MultiClusterSecretList{}
listOptions := &client.ListOptions{Namespace: namespace}
err := s.AdminClient.List(s.Context, &allAdminMCSecrets, listOptions)
// When placements are changed a forbidden error can be returned. In this case,
// we want to fall through and delete orphaned resources.
if err != nil && !apierrors.IsNotFound(err) && !apierrors.IsForbidden(err) {
return err
}
// Write each of the records that are targeted to this cluster
for _, mcSecret := range allAdminMCSecrets.Items {
if s.isThisCluster(mcSecret.Spec.Placement) {
_, err := s.createOrUpdateMCSecret(mcSecret)
if err != nil {
s.Log.Errorw(fmt.Sprintf("Failed syncing object: %v", err),
"MultiClusterSecret",
types.NamespacedName{Namespace: mcSecret.Namespace, Name: mcSecret.Name})
}
}
}
// Delete orphaned or no longer placed MultiClusterSecret resources.
// Get the list of MultiClusterSecret resources on the
// local cluster and compare to the list received from the admin cluster.
// The admin cluster is the source of truth.
allLocalMCSecrets := clustersv1alpha1.MultiClusterSecretList{}
err = s.LocalClient.List(s.Context, &allLocalMCSecrets, listOptions)
if err != nil {
s.Log.Errorf("Failed to list MultiClusterSecret on local cluster: %v", err)
return nil
}
for si, mcSecret := range allLocalMCSecrets.Items {
// Delete each MultiClusterSecret object that is not on the admin cluster or no longer placed on this cluster
if !s.secretPlacedOnCluster(&allAdminMCSecrets, mcSecret.Name, mcSecret.Namespace) {
err := s.LocalClient.Delete(s.Context, &allLocalMCSecrets.Items[si])
if err != nil {
s.Log.Errorf("Failed to delete MultiClusterSecret with name %q and namespace %q: %v", mcSecret.Name, mcSecret.Namespace, err)
}
}
}
return nil
}
// Create or update a MultiClusterSecret
func (s *Syncer) createOrUpdateMCSecret(mcSecret clustersv1alpha1.MultiClusterSecret) (controllerutil.OperationResult, error) {
var mcSecretNew clustersv1alpha1.MultiClusterSecret
mcSecretNew.Namespace = mcSecret.Namespace
mcSecretNew.Name = mcSecret.Name
// Create or update on the local cluster
return controllerutil.CreateOrUpdate(s.Context, s.LocalClient, &mcSecretNew, func() error {
mutateMCSecret(mcSecret, &mcSecretNew)
return nil
})
}
func (s *Syncer) updateMultiClusterSecretStatus(name types.NamespacedName, newCond clustersv1alpha1.Condition, newClusterStatus clustersv1alpha1.ClusterLevelStatus) error {
fetched := clustersv1alpha1.MultiClusterSecret{}
err := s.AdminClient.Get(s.Context, name, &fetched)
if err != nil {
return err
}
fetched.Status.Conditions = append(fetched.Status.Conditions, newCond)
clusters.SetClusterLevelStatus(&fetched.Status, newClusterStatus)
return s.AdminClient.Status().Update(s.Context, &fetched)
}
// mutateMCSecret mutates the MultiClusterSecret to reflect the contents of the parent MultiClusterSecret
func mutateMCSecret(mcSecret clustersv1alpha1.MultiClusterSecret, mcSecretNew *clustersv1alpha1.MultiClusterSecret) {
mcSecretNew.Spec.Placement = mcSecret.Spec.Placement
mcSecretNew.Spec.Template = mcSecret.Spec.Template
mcSecretNew.Labels = mcSecret.Labels
}
// secretPlacedOnCluster returns boolean indicating if the list contains the object with the specified name and namespace
// and indicates the object is placed on the local cluster
func (s *Syncer) secretPlacedOnCluster(mcAdminList *clustersv1alpha1.MultiClusterSecretList, name string, namespace string) bool {
for _, item := range mcAdminList.Items {
if item.Name == name && item.Namespace == namespace {
return s.isThisCluster(item.Spec.Placement)
}
}
return false
}