Skip to content

Commit 53caa07

Browse files
XudongLiuHaroldXudongLiuHarold
authored
fix cluster upgrade ako role doesn't update issue (#159)
Signed-off-by: Xudong Liu <[email protected]>
1 parent 1649072 commit 53caa07

File tree

6 files changed

+96
-6
lines changed

6 files changed

+96
-6
lines changed

‎Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ PUBLISH?=publish
1313
BUILD_VERSION ?= $(shell git describe --always --match "v*" | sed 's/v//')
1414

1515
# TKG Version
16-
TKG_VERSION ?= v1.10.0+vmware.1
16+
TKG_VERSION ?= v1.10.0+vmware.2
1717

1818
# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
1919
ifeq (,$(shell go env GOBIN))

‎controllers/akodeploymentconfig/akodeploymentconfig_controller_intg_test.go

+43-1
Original file line numberDiff line numberDiff line change
@@ -260,7 +260,32 @@ func intgTestAkoDeploymentConfigController() {
260260
})
261261
ctx.AviClient.Role.SetCreateRoleFunc(func(obj *models.Role, options ...session.ApiOptionsParams) (*models.Role, error) {
262262
userRoleCreateCalled = true
263-
return &models.Role{}, nil
263+
return &models.Role{
264+
Privileges: []*models.Permission{
265+
{
266+
Type: pointer.StringPtr("READ_ACCESS"),
267+
Resource: pointer.StringPtr("PERMISSION_SYSTEMCONFIGURATION"),
268+
},
269+
{
270+
Type: pointer.StringPtr("READ_ACCESS"),
271+
Resource: pointer.StringPtr("PERMISSION_CONTROLLER"),
272+
},
273+
},
274+
}, nil
275+
})
276+
ctx.AviClient.Role.SetUpdateRoleFunc(func(obj *models.Role, options ...session.ApiOptionsParams) (*models.Role, error) {
277+
return &models.Role{
278+
Privileges: []*models.Permission{
279+
{
280+
Type: pointer.StringPtr("READ_ACCESS"),
281+
Resource: pointer.StringPtr("PERMISSION_SYSTEMCONFIGURATION"),
282+
},
283+
{
284+
Type: pointer.StringPtr("READ_ACCESS"),
285+
Resource: pointer.StringPtr("PERMISSION_CONTROLLER"),
286+
},
287+
},
288+
}, nil
264289
})
265290
ctx.AviClient.Tenant.SetGetTenantFunc(func(uuid string, options ...session.ApiOptionsParams) (*models.Tenant, error) {
266291
return &models.Tenant{}, nil
@@ -525,6 +550,23 @@ func intgTestAkoDeploymentConfigController() {
525550
})
526551

527552
When("AVI user exists", func() {
553+
BeforeEach(func() {
554+
ctx.AviClient.Role.SetGetByNameRoleFunc(func(name string, options ...session.ApiOptionsParams) (*models.Role, error) {
555+
return &models.Role{
556+
Privileges: []*models.Permission{
557+
{
558+
Type: pointer.StringPtr("READ_ACCESS"),
559+
Resource: pointer.StringPtr("PERMISSION_SYSTEMCONFIGURATION"),
560+
},
561+
{
562+
Type: pointer.StringPtr("READ_ACCESS"),
563+
Resource: pointer.StringPtr("PERMISSION_CONTROLLER"),
564+
},
565+
},
566+
}, nil
567+
})
568+
})
569+
528570
It("should update AVI user", func() {
529571
Eventually(func() bool {
530572
return userUpdateCalled

‎controllers/akodeploymentconfig/user/user_controller.go

+33-4
Original file line numberDiff line numberDiff line change
@@ -288,10 +288,15 @@ func (r *AkoUserReconciler) createOrUpdateAviUser(aviUsername, aviPassword, tena
288288
}
289289
return r.aviClient.UserCreate(aviUser)
290290
}
291-
// Update the password when user found, this is needed when the AVI user was
292-
// created before the mc Secret. And this operation will sync
293-
// the User's password to be the same as mc Secret's
291+
294292
if err == nil {
293+
// ensure user's role align with latest essential permission when user found
294+
if _, err := r.ensureAkoUserRole(); err != nil {
295+
return nil, err
296+
}
297+
// Update the password when user found, this is needed when the AVI user was
298+
// created before the mc Secret. And this operation will sync
299+
// the User's password to be the same as mc Secret's
295300
aviUser.Password = &aviPassword
296301
return r.aviClient.UserUpdate(aviUser)
297302
}
@@ -310,10 +315,34 @@ func (r *AkoUserReconciler) getOrCreateAkoUserRole(roleTenantRef *string) (*mode
310315
}
311316
return r.aviClient.RoleCreate(role)
312317
}
313-
// else return role or error
318+
if err == nil {
319+
return r.ensureAkoUserRole()
320+
}
314321
return role, err
315322
}
316323

324+
// ensureAkoUserRole ensure ako-essential-role has the latest permission
325+
func (r *AkoUserReconciler) ensureAkoUserRole() (*models.Role, error) {
326+
role, err := r.aviClient.RoleGetByName(akoov1alpha1.AkoUserRoleName)
327+
if err != nil {
328+
return role, err
329+
}
330+
// check if role needs to be sync
331+
needSync := false
332+
for i, permission := range role.Privileges {
333+
if *permission.Resource == "PERMISSION_CONTROLLER" || *permission.Resource == "PERMISSION_SYSTEMCONFIGURATION" {
334+
if *permission.Type != "READ_ACCESS" {
335+
needSync = true
336+
role.Privileges[i].Type = pointer.StringPtr("READ_ACCESS")
337+
}
338+
}
339+
}
340+
if needSync {
341+
return r.aviClient.RoleUpdate(role)
342+
}
343+
return role, nil
344+
}
345+
317346
// mcAVISecretNameNameSpace get avi user secret name/namespace in management cluster. There is no need to
318347
// encode the cluster namespace as the secret is deployed in the same namespace as
319348
// the cluster

‎pkg/aviclient/client.go

+4
Original file line numberDiff line numberDiff line change
@@ -276,6 +276,10 @@ func (r *realAviClient) RoleCreate(obj *models.Role, options ...session.ApiOptio
276276
return r.Role.Create(obj)
277277
}
278278

279+
func (r *realAviClient) RoleUpdate(obj *models.Role, options ...session.ApiOptionsParams) (*models.Role, error) {
280+
return r.Role.Update(obj)
281+
}
282+
279283
func (r *realAviClient) VirtualServiceGetByName(name string, options ...session.ApiOptionsParams) (*models.VirtualService, error) {
280284
return r.VirtualService.GetByName(name)
281285
}

‎pkg/aviclient/fake_avi_client.go

+14
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,10 @@ func (r *FakeAviClient) RoleCreate(obj *models.Role, options ...session.ApiOptio
116116
return r.Role.Create(obj)
117117
}
118118

119+
func (r *FakeAviClient) RoleUpdate(obj *models.Role, options ...session.ApiOptionsParams) (*models.Role, error) {
120+
return r.Role.Update(obj)
121+
}
122+
119123
func (r *FakeAviClient) VirtualServiceGetByName(name string, options ...session.ApiOptionsParams) (*models.VirtualService, error) {
120124
return r.VirtualService.GetByName(name)
121125
}
@@ -276,10 +280,12 @@ func (client *TenantClient) Get(uuid string, options ...session.ApiOptionsParams
276280
type RoleClient struct {
277281
getByNameRoleFn GetByNameRoleFunc
278282
createRoleFunc CreateRoleFunc
283+
updateRoleFunc UpdateRoleFunc
279284
}
280285

281286
type GetByNameRoleFunc func(name string, options ...session.ApiOptionsParams) (*models.Role, error)
282287
type CreateRoleFunc func(obj *models.Role, options ...session.ApiOptionsParams) (*models.Role, error)
288+
type UpdateRoleFunc func(obj *models.Role, options ...session.ApiOptionsParams) (*models.Role, error)
283289

284290
func (client *RoleClient) SetGetByNameRoleFunc(fn GetByNameRoleFunc) {
285291
client.getByNameRoleFn = fn
@@ -289,6 +295,10 @@ func (client *RoleClient) SetCreateRoleFunc(fn CreateRoleFunc) {
289295
client.createRoleFunc = fn
290296
}
291297

298+
func (client *RoleClient) SetUpdateRoleFunc(fn UpdateRoleFunc) {
299+
client.updateRoleFunc = fn
300+
}
301+
292302
func (client *RoleClient) GetByName(name string, options ...session.ApiOptionsParams) (*models.Role, error) {
293303
return client.getByNameRoleFn(name)
294304
}
@@ -297,6 +307,10 @@ func (client *RoleClient) Create(obj *models.Role, options ...session.ApiOptions
297307
return client.createRoleFunc(obj)
298308
}
299309

310+
func (client *RoleClient) Update(obj *models.Role, options ...session.ApiOptionsParams) (*models.Role, error) {
311+
return client.updateRoleFunc(obj)
312+
}
313+
300314
// Pool Client
301315
type PoolClient struct {
302316
getByNameFn GetByNamePoolFunc

‎pkg/aviclient/interface.go

+1
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ type Client interface {
2727

2828
RoleGetByName(name string, options ...session.ApiOptionsParams) (*models.Role, error)
2929
RoleCreate(obj *models.Role, options ...session.ApiOptionsParams) (*models.Role, error)
30+
RoleUpdate(obj *models.Role, options ...session.ApiOptionsParams) (*models.Role, error)
3031

3132
IPAMDNSProviderProfileGet(uuid string, options ...session.ApiOptionsParams) (*models.IPAMDNSProviderProfile, error)
3233
IPAMDNSProviderProfileUpdate(obj *models.IPAMDNSProviderProfile, options ...session.ApiOptionsParams) (*models.IPAMDNSProviderProfile, error)

0 commit comments

Comments
 (0)