forked from kubernetes/kubernetes
-
Notifications
You must be signed in to change notification settings - Fork 111
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
UPSTREAM: <carry>: kube-controller-manager: allow running bare kube-c…
…ontroller-manager UPSTREAM: <carry>: (squash) kube-controller-manager: allow running bare kube-controller-manager UPSTREAM: <carry>: kube-controller-manager: allow running bare kube-controller-manager UPSTREAM: <carry>: (squash) remove egressnetworkpolicies from gc ignored resources egressnetworkpolicies should not be in garbage collector ignored resources, so users can delete them using "--cascade=foreground" flag. Signed-off-by: Flavio Fernandes <[email protected]> OpenShift-Rebase-Source: 6c1dee4 UPSTREAM: <carry>: (squash) kube-controller-manager: allow running bare kube-controller-manager UPSTREAM: <carry>: kube-controller-manager: allow running bare kube-controller-manager UPSTREAM: <carry>: kube-controller-manager: allow running bare kube-controller-manager Fix garbage-collection for CRDs. These types are backed by a CRD and not by openshift-apiserver anymore. DefaultGarbageCollectionPolicy (Unsupported) does not work with CRDs. The `foregroundDeletion` finalizer was set on these CRD objects which blocks deletion indifinetelly as GC will ignore these resources.
- Loading branch information
1 parent
a4e2c7f
commit 6b63144
Showing
12 changed files
with
850 additions
and
11 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| package config | ||
|
|
||
| // OpenShiftContext is additional context that we need to launch the kube-controller-manager for openshift. | ||
| // Basically, this holds our additional config information. | ||
| type OpenShiftContext struct { | ||
| OpenShiftConfig string | ||
| OpenShiftDefaultProjectNodeSelector string | ||
| KubeDefaultProjectNodeSelector string | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,84 @@ | ||
| package app | ||
|
|
||
| import ( | ||
| "io/ioutil" | ||
| "path" | ||
|
|
||
| "k8s.io/apimachinery/pkg/util/json" | ||
| kyaml "k8s.io/apimachinery/pkg/util/yaml" | ||
| "k8s.io/client-go/informers" | ||
| "k8s.io/kubernetes/cmd/kube-controller-manager/app/config" | ||
| "k8s.io/kubernetes/cmd/kube-controller-manager/app/options" | ||
| ) | ||
|
|
||
| var InformerFactoryOverride informers.SharedInformerFactory | ||
|
|
||
| func ShimForOpenShift(controllerManagerOptions *options.KubeControllerManagerOptions, controllerManager *config.Config) error { | ||
| if len(controllerManager.OpenShiftContext.OpenShiftConfig) == 0 { | ||
| return nil | ||
| } | ||
|
|
||
| // TODO this gets removed when no longer take flags and no longer build a recycler template | ||
| openshiftConfig, err := getOpenShiftConfig(controllerManager.OpenShiftContext.OpenShiftConfig) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| // TODO this should be replaced by using a flex volume to inject service serving cert CAs into pods instead of adding it to the sa token | ||
| if err := applyOpenShiftServiceServingCertCAFunc(path.Dir(controllerManager.OpenShiftContext.OpenShiftConfig), openshiftConfig); err != nil { | ||
| return err | ||
| } | ||
|
|
||
| // skip GC on some openshift resources | ||
| // TODO this should be replaced by discovery information in some way | ||
| if err := applyOpenShiftGCConfig(controllerManager); err != nil { | ||
| return err | ||
| } | ||
|
|
||
| if err := applyOpenShiftConfigDefaultProjectSelector(controllerManagerOptions, openshiftConfig); err != nil { | ||
| return err | ||
| } | ||
|
|
||
| // Overwrite the informers, because we have our custom generic informers for quota. | ||
| // TODO update quota to create its own informer like garbage collection | ||
| if informers, err := newInformerFactory(controllerManager.Kubeconfig); err != nil { | ||
| return err | ||
| } else { | ||
| InformerFactoryOverride = informers | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func getOpenShiftConfig(configFile string) (map[string]interface{}, error) { | ||
| configBytes, err := ioutil.ReadFile(configFile) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| jsonBytes, err := kyaml.ToJSON(configBytes) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| config := map[string]interface{}{} | ||
| if err := json.Unmarshal(jsonBytes, &config); err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return config, nil | ||
| } | ||
|
|
||
| func applyOpenShiftConfigDefaultProjectSelector(controllerManagerOptions *options.KubeControllerManagerOptions, openshiftConfig map[string]interface{}) error { | ||
| projectConfig, ok := openshiftConfig["projectConfig"] | ||
| if !ok { | ||
| return nil | ||
| } | ||
|
|
||
| castProjectConfig := projectConfig.(map[string]interface{}) | ||
| defaultNodeSelector, ok := castProjectConfig["defaultNodeSelector"] | ||
| if !ok { | ||
| return nil | ||
| } | ||
| controllerManagerOptions.OpenShiftContext.OpenShiftDefaultProjectNodeSelector = defaultNodeSelector.(string) | ||
|
|
||
| return nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| package app | ||
|
|
||
| import ( | ||
| gcconfig "k8s.io/kubernetes/pkg/controller/garbagecollector/config" | ||
|
|
||
| "k8s.io/kubernetes/cmd/kube-controller-manager/app/config" | ||
| ) | ||
|
|
||
| func applyOpenShiftGCConfig(controllerManager *config.Config) error { | ||
| // TODO make this configurable or discoverable. This is going to prevent us from running the stock GC controller | ||
| // IF YOU ADD ANYTHING TO THIS LIST, MAKE SURE THAT YOU UPDATE THEIR STRATEGIES TO PREVENT GC FINALIZERS | ||
| // | ||
| // DO NOT PUT CRDs into the list. apiexstension-apiserver does not implement GarbageCollectionPolicy | ||
| // so the deletion of these will be blocked because of foregroundDeletion finalizer when foreground deletion strategy is specified. | ||
| controllerManager.ComponentConfig.GarbageCollectorController.GCIgnoredResources = append(controllerManager.ComponentConfig.GarbageCollectorController.GCIgnoredResources, | ||
| // explicitly disabled from GC for now - not enough value to track them | ||
| gcconfig.GroupResource{Group: "oauth.openshift.io", Resource: "oauthclientauthorizations"}, | ||
| gcconfig.GroupResource{Group: "oauth.openshift.io", Resource: "oauthclients"}, | ||
| gcconfig.GroupResource{Group: "user.openshift.io", Resource: "groups"}, | ||
| gcconfig.GroupResource{Group: "user.openshift.io", Resource: "identities"}, | ||
| gcconfig.GroupResource{Group: "user.openshift.io", Resource: "users"}, | ||
| gcconfig.GroupResource{Group: "image.openshift.io", Resource: "images"}, | ||
|
|
||
| // virtual resource | ||
| gcconfig.GroupResource{Group: "project.openshift.io", Resource: "projects"}, | ||
| // virtual and unwatchable resource, surfaced via rbac.authorization.k8s.io objects | ||
| gcconfig.GroupResource{Group: "authorization.openshift.io", Resource: "clusterroles"}, | ||
| gcconfig.GroupResource{Group: "authorization.openshift.io", Resource: "clusterrolebindings"}, | ||
| gcconfig.GroupResource{Group: "authorization.openshift.io", Resource: "roles"}, | ||
| gcconfig.GroupResource{Group: "authorization.openshift.io", Resource: "rolebindings"}, | ||
| // these resources contain security information in their names, and we don't need to track them | ||
| gcconfig.GroupResource{Group: "oauth.openshift.io", Resource: "oauthaccesstokens"}, | ||
| gcconfig.GroupResource{Group: "oauth.openshift.io", Resource: "oauthauthorizetokens"}, | ||
| ) | ||
|
|
||
| return nil | ||
| } |
Oops, something went wrong.