Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: add fleet networking rules #203

Merged
merged 5 commits into from
Jul 29, 2022
Merged

chore: add fleet networking rules #203

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
4d12829
add rbac rule for fleet-networking
Jul 28, 2022
3fc20b5
use commit hash as the default image version
Jul 28, 2022
24d9666
minor fix
Jul 28, 2022
2d0d91c
use fake tag v0.1..0.ci for ci
Jul 29, 2022
380b311
use image version main for images built from main branch
Jul 29, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions .github/workflows/publish-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,11 +15,11 @@ permissions:
env:
REGISTRY: ghcr.io
HUB_AGENT_IMAGE_NAME : hub-agent
HUB_AGENT_IMAGE_VERSION: v0.1.0
HUB_AGENT_IMAGE_VERSION: main
MEMBER_AGENT_IMAGE_NAME: member-agent
MEMBER_AGENT_IMAGE_VERSION: v0.1.0
MEMBER_AGENT_IMAGE_VERSION: main
REFRESH_TOKEN_IMAGE_NAME: refresh-token
REFRESH_TOKEN_IMAGE_VERSION: v0.1.0
REFRESH_TOKEN_IMAGE_VERSION: main

jobs:
export-registry:
Expand All @@ -41,6 +41,12 @@ jobs:
with:
submodules: true
fetch-depth: 0
- name: Set image version for a new release
if: startsWith(github.ref, 'refs/tags/')
run: |
echo "HUB_AGENT_IMAGE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
echo "MEMBER_AGENT_IMAGE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
echo "REFRESH_TOKEN_IMAGE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
- name: Login to ${{ env.REGISTRY }}
uses: docker/login-action@49ed152c8eca782a232dede0303416e8f356c37b
with:
Expand Down
15 changes: 11 additions & 4 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,15 @@
REGISTRY ?= ghcr.io
KIND_IMAGE ?= kindest/node:v1.23.3
ifndef TAG
TAG ?= $(shell git rev-parse --short=7 HEAD)
endif
HUB_AGENT_IMAGE_VERSION ?= $(TAG)
MEMBER_AGENT_IMAGE_VERSION ?= $(TAG)
REFRESH_TOKEN_IMAGE_VERSION ?= $(TAG)

HUB_AGENT_IMAGE_NAME ?= hub-agent
HUB_AGENT_IMAGE_VERSION ?= v0.1.0
MEMBER_AGENT_IMAGE_NAME ?= member-agent
MEMBER_AGENT_IMAGE_VERSION ?= v0.1.0
REFRESH_TOKEN_IMAGE_NAME := refresh-token
REFRESH_TOKEN_IMAGE_VERSION ?= v0.1.0

KUBECONFIG ?= $(HOME)/.kube/config
HUB_SERVER_URL ?= https://172.19.0.2:6443
Expand Down Expand Up @@ -128,7 +132,8 @@ install-hub-agent-helm:
kind export kubeconfig --name $(HUB_KIND_CLUSTER_NAME)
helm install hub-agent ./charts/hub-agent/ \
--set image.pullPolicy=Never \
--set image.repository=$(REGISTRY)/$(HUB_AGENT_IMAGE_NAME)
--set image.repository=$(REGISTRY)/$(HUB_AGENT_IMAGE_NAME) \
--set image.tag=$(HUB_AGENT_IMAGE_VERSION)

.PHONY: e2e-hub-kubeconfig-secret
e2e-hub-kubeconfig-secret: install-hub-agent-helm
Expand All @@ -146,7 +151,9 @@ install-member-agent-helm: e2e-hub-kubeconfig-secret
helm install member-agent ./charts/member-agent/ \
--set config.hubURL=$$HUB_SERVER_URL \
--set image.repository=$(REGISTRY)/$(MEMBER_AGENT_IMAGE_NAME) \
--set image.tag=$(MEMBER_AGENT_IMAGE_VERSION) \
--set refreshtoken.repository=$(REGISTRY)/$(REFRESH_TOKEN_IMAGE_NAME) \
--set refreshtoken.tag=$(REFRESH_TOKEN_IMAGE_VERSION) \
--set image.pullPolicy=Never --set refreshtoken.pullPolicy=Never \
--set config.memberClusterName="kind-$(MEMBER_KIND_CLUSTER_NAME)"
# to make sure member-agent reads the token file.
Expand Down
7 changes: 5 additions & 2 deletions charts/hub-agent/templates/rbac.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,11 @@ rules:
resources: ["memberclusters", "memberclusters/status"]
verbs: ["get", "list", "watch", "update", "patch"]
- apiGroups: ["fleet.azure.com"]
resources: ["internalmemberclusters","internalmemberclusters/status"]
verbs: ["get", "list", "watch", "create", "update", "patch"]
resources: ["*"]
verbs: ["*"]
- apiGroups: ["networking.fleet.azure.com"]
resources: ["*"]
verbs: ["*"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
Expand Down
12 changes: 1 addition & 11 deletions pkg/controllers/membercluster/membercluster_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -425,22 +425,12 @@ func markMemberClusterLeft(recorder record.EventRecorder, mc apis.ConditionedObj
// createRole creates role for member cluster.
func createRole(roleName, namespaceName string) rbacv1.Role {
// TODO: More API groups and verbs will be added as new member agents are added apart from the Join agent.
fleetRule := rbacv1.PolicyRule{
Verbs: []string{"get", "list", "update", "patch", "watch"},
APIGroups: []string{fleetv1alpha1.GroupVersion.Group},
Resources: []string{"*"},
}
eventRule := rbacv1.PolicyRule{
Verbs: []string{"get", "list", "update", "patch", "watch", "create"},
APIGroups: []string{""},
Resources: []string{"events"},
}
role := rbacv1.Role{
ObjectMeta: metav1.ObjectMeta{
Name: roleName,
Namespace: namespaceName,
},
Rules: []rbacv1.PolicyRule{fleetRule, eventRule},
Rules: []rbacv1.PolicyRule{utils.FleetRule, utils.EventRule, utils.FleetNetworkRule},
}
return role
}
Expand Down
12 changes: 1 addition & 11 deletions pkg/controllers/membercluster/membercluster_controller_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,16 +158,6 @@ func TestReconcilerCheckAndCreateRole(t *testing.T) {
Client: &test.MockClient{
MockGet: func(ctx context.Context, key client.ObjectKey, obj client.Object) error {
o := obj.(*rbacv1.Role)
fleetRule := rbacv1.PolicyRule{
Verbs: []string{"get", "list", "update", "patch", "watch"},
APIGroups: []string{fleetv1alpha1.GroupVersion.Group},
Resources: []string{"*"},
}
eventRule := rbacv1.PolicyRule{
Verbs: []string{"get", "list", "update", "patch", "watch", "create"},
APIGroups: []string{""},
Resources: []string{"events"},
}
*o = rbacv1.Role{
TypeMeta: metav1.TypeMeta{
Kind: "Role",
Expand All @@ -177,7 +167,7 @@ func TestReconcilerCheckAndCreateRole(t *testing.T) {
Name: "fleet-role-mc1",
Namespace: namespace1,
},
Rules: []rbacv1.PolicyRule{fleetRule, eventRule},
Rules: []rbacv1.PolicyRule{utils.FleetRule, utils.EventRule, utils.FleetNetworkRule},
}
return nil
},
Expand Down
19 changes: 19 additions & 0 deletions pkg/utils/common.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ import (
"time"

corev1 "k8s.io/api/core/v1"
rbacv1 "k8s.io/api/rbac/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime/schema"
"k8s.io/client-go/discovery"
Expand Down Expand Up @@ -72,6 +73,24 @@ var (
}
)

var (
FleetRule = rbacv1.PolicyRule{
Verbs: []string{"*"},
APIGroups: []string{fleetv1alpha1.GroupVersion.Group},
Resources: []string{"*"},
}
EventRule = rbacv1.PolicyRule{
Verbs: []string{"get", "list", "update", "patch", "watch", "create"},
APIGroups: []string{""},
Resources: []string{"events"},
}
FleetNetworkRule = rbacv1.PolicyRule{
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ryanzhang-oss , I did not add work api here because we are reusing module path the origin upstream sigs.k8s.io/work-api instead of like go.goms.io/work-api?

https://github.com/Azure/k8s-work-api/blob/v0.1.0/go.mod

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sure, I will add that later.

Verbs: []string{"*"},
APIGroups: []string{"networking.fleet.azure.com"},
Resources: []string{"*"},
}
)

// ReconcileErrorCondition returns a condition indicating that we encountered an
// error while reconciling the resource.
func ReconcileErrorCondition(err error) metav1.Condition {
Expand Down