Skip to content

Commit 85f1cb1

Browse files
melnikalexmelnikalex
authored
Add custom authenticator support (#295)
* add custom authenticator support and example yaml * fix minor toolchain issues and update DEVELOPER_GUIDE.md
1 parent 3da75e9 commit 85f1cb1

File tree

9 files changed

+1943
-18
lines changed

9 files changed

+1943
-18
lines changed

‎operator/charts/kit-operator/crds/control-plane-crd.yaml

Lines changed: 1866 additions & 1 deletion
Large diffs are not rendered by default.

‎operator/docs/DEVELOPER_GUIDE.md

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,10 @@ If you are developing KIT operator, finish the installation steps listed in the
66

77
### Prerequisites
88

9-
- Go version (1.16 or higher)
10-
- [Ko version](https://github.com/google/ko#install) (v0.8.2 or higher)
9+
- Go version 1.16-1.17 (NOTE: 1.18+ fails to install pkg/operator toolchain). [instructions](https://gist.github.com/BigOokie/d5817e88f01e0d452ed585a1590f5aeb)
10+
- [Ko version](https://github.com/google/ko#install) (v0.8.2 - 0.11.2, the
11+
latest 0.12+ is broken right now)
12+
- Run `make toolchain`
1113

1214
### Create a [Private ECR repository](https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-create.html) to push controller and webhook image for kit-operator
1315

@@ -35,4 +37,4 @@ To delete KIT from Kubernetes cluster
3537
```bash
3638
make delete
3739
kubectl delete namespace kit
38-
```
40+
```

‎operator/docs/examples/custom-authenticator.yaml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# To create this cluster, run:
2+
# * export KUBECONFIG=<management-cluster>
3+
# * export GUEST_CLUSTER_NAME="foobar"
4+
# * envsubst < custom-authenticator.yaml | kubectl --kubeconfig $KUBECONFIG apply -f -
5+
# * k certificate approve $(k get csr | grep "Pending" | awk '{print $1}')
6+
7+
apiVersion: kit.k8s.sh/v1alpha1
8+
kind: ControlPlane
9+
metadata:
10+
name: $GUEST_CLUSTER_NAME
11+
spec:
12+
master:
13+
apiServer:
14+
replicas: 3
15+
authenticator:
16+
spec:
17+
containers:
18+
- name: aws-iam-authenticator
19+
image: public.ecr.aws/eks-distro/kubernetes-sigs/aws-iam-authenticator:v0.5.9-eks-1-19-22
20+
securityContext:
21+
runAsUser: 10000
22+
runAsGroup: 10000
23+
args:
24+
- --backend-mode=MountedFile,EKSConfigMap
25+
# TODO: scope down permissions
26+
# There are 3 kubeconfigish flags for the authenticator:
27+
# * --kubeconfig -> this is configuring one direction communication from authenticator to kube-apiserver
28+
# * --generate-kubeconfig -> this is configuring communication from kube-apiserver to authenticator (this is the token file passed to kube-apiserver).
29+
# * --kubeconfig-pregenerated -> a boolean flag if we don't want the --kubeconfig flag to generate a new kubeconfig.
30+
- --kubeconfig=/var/aws-iam-authenticator/auth-to-k8s-kubeconfig/config
31+
volumeMounts:
32+
- mountPath: /var/aws-iam-authenticator/auth-to-k8s-kubeconfig/
33+
name: auth-to-k8s-kubeconfig
34+
volumes:
35+
- secret:
36+
secretName: $GUEST_CLUSTER_NAME-kube-admin-config
37+
name: auth-to-k8s-kubeconfig

‎operator/hack/codegen.sh

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
#!/bin/bash
2+
set -ex
23

34
controller-gen crd \
45
object:headerFile="hack/boilerplate.go.txt" \
@@ -21,4 +22,4 @@ yq eval 'del(.. | select(has("initContainers")).initContainers)' -i config/kit.k
2122

2223

2324
mv config/kit.k8s.sh_controlplanes.yaml charts/kit-operator/crds/control-plane-crd.yaml
24-
mv config/kit.k8s.sh_dataplanes.yaml charts/kit-operator/crds/data-plane-crd.yaml
25+
mv config/kit.k8s.sh_dataplanes.yaml charts/kit-operator/crds/data-plane-crd.yaml

‎operator/hack/toolchain.sh

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/bash
22

3-
set -eu -o pipefail
3+
set -eux -o pipefail
44

55
main() {
66
tools
@@ -11,7 +11,7 @@ tools() {
1111
go install github.com/ahmetb/[email protected]
1212
go install github.com/fzipp/gocyclo/cmd/[email protected]
1313
go install github.com/golangci/golangci-lint/cmd/[email protected]
14-
go install github.com/google/ko@v0.10.0
14+
go install github.com/google/ko@v0.11.2
1515
go install github.com/mikefarah/yq/[email protected]
1616
go install github.com/mitchellh/[email protected]
1717
go install github.com/onsi/ginkgo/[email protected]
@@ -32,4 +32,4 @@ kubebuilder() {
3232
find $KUBEBUILDER_ASSETS
3333
}
3434

35-
main "$@"
35+
main "$@"

‎operator/pkg/apis/controlplane/v1alpha1/controlplane.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ import (
1919
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2020
)
2121

22+
// NOTE: if you make changes to this file, run `make codegen` to update the
23+
// appropriate crds and yamls.
24+
2225
// ControlPlane is the Schema for the ControlPlanes API
2326
// +kubebuilder:object:root=true
2427
// +kubebuilder:resource:shortName=cp
@@ -61,6 +64,7 @@ type MasterSpec struct {
6164
Scheduler *Component `json:"scheduler,omitempty"`
6265
ControllerManager *Component `json:"controllerManager,omitempty"`
6366
APIServer *Component `json:"apiServer,omitempty"`
67+
Authenticator *Component `json:"authenticator,omitempty"`
6468
}
6569

6670
// Component provides a generic way to pass in args and images to master and etcd

‎operator/pkg/apis/controlplane/v1alpha1/zz_generated.deepcopy.go

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎operator/pkg/controllers/master/authenticator.go

Lines changed: 20 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222
"github.com/awslabs/kubernetes-iteration-toolkit/operator/pkg/awsprovider/iam"
2323
"github.com/awslabs/kubernetes-iteration-toolkit/operator/pkg/components/iamauthenticator"
2424
"github.com/awslabs/kubernetes-iteration-toolkit/operator/pkg/utils/object"
25+
"github.com/awslabs/kubernetes-iteration-toolkit/operator/pkg/utils/patch"
2526
appsv1 "k8s.io/api/apps/v1"
2627
v1 "k8s.io/api/core/v1"
2728
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -45,6 +46,24 @@ func (c *Controller) reconcileAuthenticator(ctx context.Context, controlPlane *v
4546
}
4647

4748
func (c *Controller) ensureDaemonSet(ctx context.Context, controlPlane *v1alpha1.ControlPlane) error {
49+
authenticatorPodTemplateSpec := iamauthenticator.PodSpec(controlPlane.ClusterName(), func(template v1.PodTemplateSpec) v1.PodTemplateSpec {
50+
template.Spec.NodeSelector = APIServerLabels(controlPlane.ClusterName())
51+
template.Spec.Volumes = append(template.Spec.Volumes, v1.Volume{Name: "config",
52+
VolumeSource: v1.VolumeSource{ConfigMap: &v1.ConfigMapVolumeSource{
53+
LocalObjectReference: v1.LocalObjectReference{Name: iamauthenticator.AuthenticatorConfigMapName(controlPlane.ClusterName())},
54+
}},
55+
})
56+
return template
57+
})
58+
59+
if controlPlane.Spec.Master.Authenticator != nil {
60+
var err error
61+
authenticatorPodTemplateSpec.Spec, err = patch.PodSpec(&authenticatorPodTemplateSpec.Spec, controlPlane.Spec.Master.Authenticator.Spec)
62+
if err != nil {
63+
return fmt.Errorf("patch authenticator pod spec, %w", err)
64+
}
65+
}
66+
4867
return c.kubeClient.EnsurePatch(ctx, &appsv1.DaemonSet{}, object.WithOwner(controlPlane, &appsv1.DaemonSet{
4968
ObjectMeta: metav1.ObjectMeta{
5069
Name: fmt.Sprintf("%s-authenticator", controlPlane.ClusterName()),
@@ -54,15 +73,7 @@ func (c *Controller) ensureDaemonSet(ctx context.Context, controlPlane *v1alpha1
5473
Spec: appsv1.DaemonSetSpec{
5574
UpdateStrategy: appsv1.DaemonSetUpdateStrategy{Type: appsv1.RollingUpdateDaemonSetStrategyType},
5675
Selector: &metav1.LabelSelector{MatchLabels: iamauthenticator.Labels(controlPlane.ClusterName())},
57-
Template: iamauthenticator.PodSpec(controlPlane.ClusterName(), func(template v1.PodTemplateSpec) v1.PodTemplateSpec {
58-
template.Spec.NodeSelector = APIServerLabels(controlPlane.ClusterName())
59-
template.Spec.Volumes = append(template.Spec.Volumes, v1.Volume{Name: "config",
60-
VolumeSource: v1.VolumeSource{ConfigMap: &v1.ConfigMapVolumeSource{
61-
LocalObjectReference: v1.LocalObjectReference{Name: iamauthenticator.AuthenticatorConfigMapName(controlPlane.ClusterName())},
62-
}},
63-
})
64-
return template
65-
}),
76+
Template: authenticatorPodTemplateSpec,
6677
},
6778
}))
6879
}

‎operator/pkg/errors/errors.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ func IsDNSLookUpNoSuchHost(err error) bool {
4343

4444
func IsNetIOTimeOut(err error) bool {
4545
netErr := net.Error(nil)
46-
return errors.As(err, &netErr) && netErr.Temporary() && netErr.Timeout()
46+
return errors.As(err, &netErr) && netErr.Timeout()
4747
}
4848

4949
func IsConnectionRefused(err error) bool {

0 commit comments

Comments
 (0)