Skip to content

Commit 303547a

Browse files
oliverbaehleroliverbaehler
authored
feat(controller): add generic cluster scoped resources to proxysettings (#421)
* chore(make): local development corrections Signed-off-by: Oliver Bähler <[email protected]> * chore(mod): bump relevant versions Signed-off-by: Oliver Bähler <[email protected]> * feat(proxy): add module for generic cluster-scoped resources Signed-off-by: Oliver Bähler <[email protected]> * feat(generated): add module for generic cluster-scoped resources Signed-off-by: Oliver Bähler <[email protected]> * feat(chart): introduce new crd lifecycle Signed-off-by: Oliver Bähler <[email protected]> --------- Signed-off-by: Oliver Bähler <[email protected]>
1 parent d09ff5f commit 303547a

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+955
-169
lines changed

‎Makefile

+11-6
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
# Version
22
GIT_HEAD_COMMIT ?= $(shell git rev-parse --short HEAD)
33
VERSION ?= $(or $(shell git describe --abbrev=0 --tags --match "v*" 2>/dev/null),$(GIT_HEAD_COMMIT))
4+
GO_OS ?= $(shell go env GOOS)
5+
GO_ARCH ?= $(shell go env GOARCH)
46

57
# Defaults
68
REGISTRY ?= ghcr.io
@@ -39,6 +41,7 @@ dlv-build:
3941
docker build . --build-arg "GCFLAGS=all=-N -l" --tag projectcapsule/capsule-proxy:dlv --target dlv
4042

4143

44+
KO_PLATFORM ?= $(GOOS)/$(GO_ARCH)
4245
KOCACHE ?= /tmp/ko-cache
4346
KO_TAGS ?= "latest"
4447

@@ -60,9 +63,9 @@ LD_FLAGS := "-X main.Version=$(VERSION) \
6063

6164
.PHONY: ko-build-capsule-proxy
6265
ko-build-capsule-proxy: ko
63-
@echo Building Capsule Proxy $(KO_TAGS) >&2
66+
echo Building Capsule Proxy $(KO_TAGS) for $(KO_PLATFORM) >&2
6467
@LD_FLAGS=$(LD_FLAGS) KOCACHE=$(KOCACHE) KO_DOCKER_REPO=$(CAPSULE_PROXY_IMG) \
65-
$(KO) build ./ --bare --tags=$(KO_TAGS) --local --push=false
68+
$(KO) build ./ --bare --tags=$(KO_TAGS) --local --push=false --platform=$(KO_PLATFORM)
6669

6770
.PHONY: ko-build-all
6871
ko-build-all: ko-build-capsule-proxy
@@ -132,8 +135,8 @@ e2e-exec:
132135

133136
.PHONY: e2e-build
134137
e2e-build:
135-
@echo "Building kubernetes env using Kind $${KIND_K8S_VERSION:-v1.22.0}..."
136-
@kind create cluster --name capsule --image kindest/node:$${KIND_K8S_VERSION:-v1.22.0} --config ./e2e/kind.yaml --wait=120s \
138+
@echo "Building kubernetes env using Kind $${KIND_K8S_VERSION:-v1.27.0}..."
139+
@kind create cluster --name capsule --image kindest/node:$${KIND_K8S_VERSION:-v1.27.0} --config ./e2e/kind.yaml --wait=120s \
137140
&& kubectl taint nodes capsule-worker2 key1=value1:NoSchedule
138141
@helm repo add bitnami https://charts.bitnami.com/bitnami
139142
@helm repo update
@@ -176,6 +179,7 @@ ifeq ($(CAPSULE_PROXY_MODE),http)
176179
--set "image.pullPolicy=Never" \
177180
--set "image.tag=$(VERSION)" \
178181
--set "options.enableSSL=false" \
182+
--set "options.logLevel=10" \
179183
--set "service.type=NodePort" \
180184
--set "service.nodePort=" \
181185
--set "kind=DaemonSet" \
@@ -186,7 +190,7 @@ else
186190
@echo "Running in HTTPS mode"
187191
@echo "capsule proxy certificates..."
188192
cd hack && $(MKCERT) -install && $(MKCERT) 127.0.0.1 \
189-
&& kubectl --namespace capsule-systemdelete secret capsule-proxy \
193+
&& kubectl --namespace capsule-system delete secret capsule-proxy || true \
190194
&& kubectl --namespace capsule-system create secret generic capsule-proxy --from-file=tls.key=./127.0.0.1-key.pem --from-file=tls.crt=./127.0.0.1.pem --from-literal=ca=$$(cat $(ROOTCA) | base64 |tr -d '\n')
191195
@echo "kubeconfig configurations..."
192196
@cd hack \
@@ -210,6 +214,7 @@ else
210214
@helm upgrade --install capsule-proxy ./charts/capsule-proxy -n capsule-system \
211215
--set "image.pullPolicy=Never" \
212216
--set "image.tag=$(VERSION)" \
217+
--set "options.logLevel=10" \
213218
--set "service.type=NodePort" \
214219
--set "service.nodePort=" \
215220
--set "kind=DaemonSet" \
@@ -227,7 +232,7 @@ rbac-fix:
227232

228233
.PHONY: manifests
229234
manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
230-
$(CONTROLLER_GEN) rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=charts/capsule-proxy/crds
235+
$(CONTROLLER_GEN) rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=charts/capsule-proxy/crd
231236

232237
.PHONY: generate
233238
generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.

‎api/v1beta1/clusterresoure.go

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
package v1beta1
2+
3+
import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
4+
5+
// +kubebuilder:validation:Enum=List;Update;Delete
6+
type ClusterResourceOperation string
7+
8+
func (p ClusterResourceOperation) String() string {
9+
return string(p)
10+
}
11+
12+
const (
13+
ClusterResourceOperationList ClusterResourceOperation = "List"
14+
)
15+
16+
// +kubebuilder:object:generate=true
17+
type ClusterResource struct {
18+
// APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against any resource listed will be allowed. '*' represents all resources. Empty string represents v1 api resources.
19+
APIGroups []string `json:"apiGroups"`
20+
21+
// Resources is a list of resources this rule applies to. '*' represents all resources.
22+
Resources []string `json:"resources"`
23+
24+
// Operations which can be executed on the selected resources.
25+
// +kubebuilder:default={List}
26+
Operations []ClusterResourceOperation `json:"operations"`
27+
28+
// Select all cluster scoped resources with the given label selector.
29+
Selector *metav1.LabelSelector `json:"selector"`
30+
}

‎api/v1beta1/proxysettings_types.go

+2
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ type OwnerSpec struct {
1515
Name string `json:"name"`
1616
// Proxy settings for tenant owner.
1717
ProxyOperations []v1beta2.ProxySettings `json:"proxySettings,omitempty"`
18+
// Cluster Resources for tenant Owner.
19+
ClusterResources []ClusterResource `json:"clusterResources,omitempty"`
1820
}
1921

2022
// ProxySettingSpec defines the additional Capsule Proxy settings for additional users of the Tenant.

‎api/v1beta1/zz_generated.deepcopy.go

+43
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/capsule-proxy/Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -34,4 +34,4 @@ annotations:
3434
url: https://capsule.clastix.io/
3535
artifacthub.io/changes: |
3636
- kind: added
37-
description: add subjects for cert-manager certificate
37+
description: crd lifecycle

‎charts/capsule-proxy/README.md

+28
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,25 @@ The Capsule-proxy Chart can be used to instantly deploy the Capsule-proxy on you
4040

4141
$ helm uninstall capsule-proxy -n capsule-system
4242

43+
## Upgrading the Chart
44+
45+
Intsructions to upgrade the chart the versions, which may remove features or introduce breaking changes.
46+
47+
### 0.7.x
48+
49+
Introduces a new methode to manage all capsule-proxy CRDs and their lifecycle. We are no longer relying on the [native CRD hook with the Helm Chart](https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#some-caveats-and-explanations). The hook only allows to manage CRDs on install and uninstall but we can't deliver updates to the CRDs.
50+
When you newly install the chart we recommend to set `crds.install` to `true`. This will manage the CRDs with the Helm Chart.
51+
52+
If you are upgrading to this release, you can choose to set `global.crds.install` to `true` (by default `false`). However you need to add metadata to the existing CRDs so they can be correctly managed with the new flow. Run the following commands:
53+
54+
```bash
55+
kubectl label crd proxysettings.capsule.clastix.io app.kubernetes.io/managed-by=Helm
56+
kubectl annotate crd proxysettings.capsule.clastix.io meta.helm.sh/release-namespace=capsule-system # might be different
57+
kubectl annotate crd proxysettings.capsule.clastix.io meta.helm.sh/release-name=capsule-proxy # might be different
58+
```
59+
60+
With the new CRD management we can release update CRDs bundled with the chart. The Chart can be uninstalled and the CRDs are still kept.
61+
4362
## Customize the installation
4463

4564
There are two methods for specifying overrides of values during chart installation: `--values` and `--set`.
@@ -56,6 +75,13 @@ If you only need to make minor customizations, you can specify them on the comma
5675

5776
$ helm install capsule-proxy projectcapsule/capsule-proxy --set "kind=DaemonSet" -n capsule-system
5877

78+
### CustomResourceDefinition Lifecycle
79+
80+
| Key | Type | Default | Description |
81+
|-----|------|---------|-------------|
82+
| crds.install | bool | `false` | Install the CustomResourceDefinitions (This also manages the lifecycle of the CRDs for update operations) |
83+
| crds.keep | bool | `true` | Keep the CustomResourceDefinitions (when the chart is deleted) |
84+
5985
### General Parameters
6086

6187
| Key | Type | Default | Description |
@@ -70,6 +96,8 @@ If you only need to make minor customizations, you can specify them on the comma
7096
| certManager.generateCertificates | bool | `false` | Set if the cert manager will generate SSL certificates (self-signed or CA-signed) |
7197
| certManager.issuer.kind | string | `"Issuer"` | Set if the cert manager will generate either self-signed or CA signed SSL certificates. Its value will be either Issuer or ClusterIssuer |
7298
| certManager.issuer.name | string | `""` | Set the name of the ClusterIssuer if issuer kind is ClusterIssuer and if cert manager will generate CA signed SSL certificates |
99+
| crds.install | bool | `false` | Install the CustomResourceDefinitions (This also manages the lifecycle of the CRDs for update operations) |
100+
| crds.keep | bool | `true` | Keep the CustomResourceDefinitions (when the chart is deleted) |
73101
| daemonset.hostNetwork | bool | `false` | Use the host network namespace for capsule-proxy pod. |
74102
| daemonset.hostPort | bool | `false` | Binding the capsule-proxy listening port to the host port. |
75103
| hostNetwork | bool | `false` | When deployed as DaemonSet use |

‎charts/capsule-proxy/README.md.gotmpl

+30
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,25 @@ The Capsule-proxy Chart can be used to instantly deploy the Capsule-proxy on you
4040

4141
$ helm uninstall capsule-proxy -n capsule-system
4242

43+
## Upgrading the Chart
44+
45+
Intsructions to upgrade the chart the versions, which may remove features or introduce breaking changes.
46+
47+
### 0.7.x
48+
49+
Introduces a new methode to manage all capsule-proxy CRDs and their lifecycle. We are no longer relying on the [native CRD hook with the Helm Chart](https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#some-caveats-and-explanations). The hook only allows to manage CRDs on install and uninstall but we can't deliver updates to the CRDs.
50+
When you newly install the chart we recommend to set `crds.install` to `true`. This will manage the CRDs with the Helm Chart.
51+
52+
If you are upgrading to this release, you can choose to set `global.crds.install` to `true` (by default `false`). However you need to add metadata to the existing CRDs so they can be correctly managed with the new flow. Run the following commands:
53+
54+
```bash
55+
kubectl label crd proxysettings.capsule.clastix.io app.kubernetes.io/managed-by=Helm
56+
kubectl annotate crd proxysettings.capsule.clastix.io meta.helm.sh/release-namespace=capsule-system # might be different
57+
kubectl annotate crd proxysettings.capsule.clastix.io meta.helm.sh/release-name=capsule-proxy # might be different
58+
```
59+
60+
With the new CRD management we can release update CRDs bundled with the chart. The Chart can be uninstalled and the CRDs are still kept.
61+
4362
## Customize the installation
4463

4564
There are two methods for specifying overrides of values during chart installation: `--values` and `--set`.
@@ -56,6 +75,17 @@ If you only need to make minor customizations, you can specify them on the comma
5675

5776
$ helm install capsule-proxy projectcapsule/capsule-proxy --set "kind=DaemonSet" -n capsule-system
5877

78+
### CustomResourceDefinition Lifecycle
79+
80+
| Key | Type | Default | Description |
81+
|-----|------|---------|-------------|
82+
{{- range .Values }}
83+
{{- if (hasPrefix "crds" .Key) }}
84+
| {{ .Key }} | {{ .Type }} | {{ if .Default }}{{ .Default }}{{ else }}{{ .AutoDefault }}{{ end }} | {{ if .Description }}{{ .Description }}{{ else }}{{ .AutoDescription }}{{ end }} |
85+
{{- end }}
86+
{{- end }}
87+
88+
5989
### General Parameters
6090

6191
| Key | Type | Default | Description |

‎charts/capsule-proxy/ci/cert-manager-values.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
crds:
2+
install: true
3+
keep: false
14
options:
25
enableSSL: true
36
generateCertificates: false

‎charts/capsule-proxy/ci/deploy-values.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
crds:
2+
install: true
3+
keep: false
14
kind: DaemonSet
25
imagePullSecrets: []
36
certManager:

‎charts/capsule-proxy/ci/ds-values.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
crds:
2+
install: true
3+
keep: false
14
kind: DaemonSet
25
daemonset:
36
hostNetwork: true

0 commit comments

Comments
 (0)