Skip to content

Commit 45cfc21

Browse files
joelanfordjoelanford
committed
helm: use chunking release driver in systemNamespace
Signed-off-by: Joe Lanford <[email protected]>
1 parent ff0ce68 commit 45cfc21

File tree

10 files changed

+287
-49
lines changed

10 files changed

+287
-49
lines changed

‎cmd/manager/main.go

Lines changed: 8 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,8 @@ import (
3030
apiextensionsv1client "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1"
3131
k8slabels "k8s.io/apimachinery/pkg/labels"
3232
"k8s.io/apimachinery/pkg/selection"
33-
"k8s.io/apimachinery/pkg/types"
3433
corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
3534
_ "k8s.io/client-go/plugin/pkg/client/auth"
36-
"k8s.io/client-go/rest"
3735
ctrl "sigs.k8s.io/controller-runtime"
3836
crcache "sigs.k8s.io/controller-runtime/pkg/cache"
3937
"sigs.k8s.io/controller-runtime/pkg/client"
@@ -161,40 +159,21 @@ func main() {
161159
os.Exit(1)
162160
}
163161

164-
installNamespaceMapper := helmclient.ObjectToStringMapper(func(obj client.Object) (string, error) {
165-
ext := obj.(*ocv1alpha1.ClusterExtension)
166-
return ext.Spec.InstallNamespace, nil
167-
})
168162
coreClient, err := corev1client.NewForConfig(mgr.GetConfig())
169163
if err != nil {
170164
setupLog.Error(err, "unable to create core client")
171165
os.Exit(1)
172166
}
173167
tokenGetter := authentication.NewTokenGetter(coreClient, authentication.WithExpirationDuration(1*time.Hour))
168+
clientRestConfigMapper := action.ServiceAccountRestConfigMapper(tokenGetter)
174169

175-
restConfigMapper := func(ctx context.Context, o client.Object, c *rest.Config) (*rest.Config, error) {
176-
cExt, ok := o.(*ocv1alpha1.ClusterExtension)
177-
if !ok {
178-
return c, nil
179-
}
180-
namespacedName := types.NamespacedName{
181-
Name: cExt.Spec.ServiceAccount.Name,
182-
Namespace: cExt.Spec.InstallNamespace,
183-
}
184-
tempConfig := rest.AnonymousClientConfig(c)
185-
tempConfig.WrapTransport = func(rt http.RoundTripper) http.RoundTripper {
186-
return &authentication.TokenInjectingRoundTripper{
187-
Tripper: rt,
188-
TokenGetter: tokenGetter,
189-
Key: namespacedName,
190-
}
191-
}
192-
return tempConfig, nil
193-
}
194170
cfgGetter, err := helmclient.NewActionConfigGetter(mgr.GetConfig(), mgr.GetRESTMapper(),
195-
helmclient.StorageNamespaceMapper(installNamespaceMapper),
196-
helmclient.ClientNamespaceMapper(installNamespaceMapper),
197-
helmclient.RestConfigMapper(restConfigMapper),
171+
helmclient.StorageDriverMapper(action.ChunkedStorageDriverMapper(coreClient, mgr.GetAPIReader(), systemNamespace)),
172+
helmclient.ClientNamespaceMapper(func(obj client.Object) (string, error) {
173+
ext := obj.(*ocv1alpha1.ClusterExtension)
174+
return ext.Spec.InstallNamespace, nil
175+
}),
176+
helmclient.ClientRestConfigMapper(clientRestConfigMapper),
198177
)
199178
if err != nil {
200179
setupLog.Error(err, "unable to config for creating helm client")
@@ -274,7 +253,7 @@ func main() {
274253
InstalledBundleGetter: &controllers.DefaultInstalledBundleGetter{ActionClientGetter: acg},
275254
Finalizers: clusterExtensionFinalizers,
276255
Preflights: preflights,
277-
Watcher: contentmanager.New(restConfigMapper, mgr.GetConfig(), mgr.GetRESTMapper()),
256+
Watcher: contentmanager.New(clientRestConfigMapper, mgr.GetConfig(), mgr.GetRESTMapper()),
278257
}).SetupWithManager(mgr); err != nil {
279258
setupLog.Error(err, "unable to create controller", "controller", "ClusterExtension")
280259
os.Exit(1)

‎config/base/rbac/role.yaml

Lines changed: 20 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -24,18 +24,6 @@ rules:
2424
verbs:
2525
- list
2626
- watch
27-
- apiGroups:
28-
- ""
29-
resources:
30-
- secrets
31-
verbs:
32-
- create
33-
- delete
34-
- get
35-
- list
36-
- patch
37-
- update
38-
- watch
3927
- apiGroups:
4028
- ""
4129
resources:
@@ -65,3 +53,23 @@ rules:
6553
verbs:
6654
- patch
6755
- update
56+
---
57+
apiVersion: rbac.authorization.k8s.io/v1
58+
kind: Role
59+
metadata:
60+
name: manager-role
61+
namespace: system
62+
rules:
63+
- apiGroups:
64+
- ""
65+
resources:
66+
- secrets
67+
verbs:
68+
- create
69+
- delete
70+
- deletecollection
71+
- get
72+
- list
73+
- patch
74+
- update
75+
- watch

‎config/base/rbac/role_binding.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,17 @@ subjects:
1010
- kind: ServiceAccount
1111
name: controller-manager
1212
namespace: system
13+
---
14+
apiVersion: rbac.authorization.k8s.io/v1
15+
kind: RoleBinding
16+
metadata:
17+
name: manager-rolebinding
18+
namespace: system
19+
roleRef:
20+
apiGroup: rbac.authorization.k8s.io
21+
kind: Role
22+
name: manager-role
23+
subjects:
24+
- kind: ServiceAccount
25+
name: controller-manager
26+
namespace: system

‎config/samples/olm_v1alpha1_clusterextension.yaml

Lines changed: 97 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,104 @@
1+
---
2+
apiVersion: v1
3+
kind: Namespace
4+
metadata:
5+
name: argocd
6+
---
7+
apiVersion: v1
8+
kind: ServiceAccount
9+
metadata:
10+
name: argocd-installer
11+
namespace: argocd
12+
---
13+
apiVersion: rbac.authorization.k8s.io/v1
14+
kind: ClusterRoleBinding
15+
metadata:
16+
name: argocd-installer-binding
17+
roleRef:
18+
apiGroup: rbac.authorization.k8s.io
19+
kind: ClusterRole
20+
name: argocd-installer-clusterrole
21+
subjects:
22+
- kind: ServiceAccount
23+
name: argocd-installer
24+
namespace: argocd
25+
---
26+
apiVersion: rbac.authorization.k8s.io/v1
27+
kind: ClusterRole
28+
metadata:
29+
name: argocd-installer-clusterrole
30+
rules:
31+
- apiGroups: ["*"]
32+
resources: ["*"]
33+
verbs: ["*"]
34+
- apiGroups: [apiextensions.k8s.io]
35+
resources: [customresourcedefinitions]
36+
verbs: [get, list, watch, create, update, patch, delete]
37+
resourceNames:
38+
- appprojects.argoproj.io
39+
- argocds.argoproj.io
40+
- applications.argoproj.io
41+
- argocdexports.argoproj.io
42+
- applicationsets.argoproj.io
43+
- apiGroups: [rbac.authorization.k8s.io]
44+
resources: [clusterroles]
45+
verbs: [get, list, watch, create, update, patch, delete]
46+
resourceNames:
47+
- argocd-operator.v0-1dhiybrldl1gyksid1dk2dqjsc72psdybc7iyvse5gpx
48+
- argocd-operator-metrics-reader
49+
- argocd-operator.v0-22gmilmgp91wu25is5i2ec598hni8owq3l71bbkl7iz3
50+
- apiGroups: [rbac.authorization.k8s.io]
51+
resources: [clusterrolebindings]
52+
verbs: [get, list, watch, create, update, patch, delete]
53+
resourceNames:
54+
- argocd-operator.v0-1dhiybrldl1gyksid1dk2dqjsc72psdybc7iyvse5gpx
55+
- argocd-operator.v0-22gmilmgp91wu25is5i2ec598hni8owq3l71bbkl7iz3
56+
---
57+
apiVersion: rbac.authorization.k8s.io/v1
58+
kind: Role
59+
metadata:
60+
name: argocd-installer-role
61+
namespace: argocd
62+
rules:
63+
- apiGroups: [""]
64+
resources: [serviceaccounts]
65+
verbs: [get, list, watch, create, update, patch, delete]
66+
resourceNames: [argocd-operator-controller-manager]
67+
- apiGroups: [""]
68+
resources: [configmaps]
69+
verbs: [get, list, watch, create, update, patch, delete]
70+
resourceNames: [argocd-operator-manager-config]
71+
- apiGroups: [""]
72+
resources: [services]
73+
verbs: [get, list, watch, create, update, patch, delete]
74+
resourceNames: [argocd-operator-controller-manager-metrics-service]
75+
- apiGroups: [apps]
76+
resources: [deployments]
77+
verbs: [get, list, watch, create, update, patch, delete]
78+
resourceNames: [argocd-operator-controller-manager]
79+
---
80+
apiVersion: rbac.authorization.k8s.io/v1
81+
kind: RoleBinding
82+
metadata:
83+
name: argocd-installer-binding
84+
namespace: argocd
85+
roleRef:
86+
apiGroup: rbac.authorization.k8s.io
87+
kind: Role
88+
name: argocd-installer-role
89+
subjects:
90+
- kind: ServiceAccount
91+
name: argocd-installer
92+
namespace: argocd
93+
---
194
apiVersion: olm.operatorframework.io/v1alpha1
295
kind: ClusterExtension
396
metadata:
4-
name: clusterextension-sample
97+
name: argocd
598
spec:
6-
installNamespace: default
99+
installNamespace: argocd
7100
packageName: argocd-operator
8101
version: 0.6.0
9102
serviceAccount:
10-
name: default
103+
name: argocd-installer
104+
---

‎go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ require (
1717
github.com/onsi/gomega v1.34.0
1818
github.com/operator-framework/api v0.26.0
1919
github.com/operator-framework/catalogd v0.20.0
20-
github.com/operator-framework/helm-operator-plugins v0.3.1
20+
github.com/operator-framework/helm-operator-plugins v0.3.1-0.20240722173643-2e18c5b70f9c
2121
github.com/operator-framework/operator-registry v1.45.0
2222
github.com/spf13/pflag v1.0.5
2323
github.com/stretchr/testify v1.9.0

‎go.sum

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -590,8 +590,8 @@ github.com/operator-framework/api v0.26.0 h1:YVntU2NkVl5zSLLwK5kFcH6P3oSvN9QDgTs
590590
github.com/operator-framework/api v0.26.0/go.mod h1:3IxOwzVUeGxYlzfwKCcfCyS+q3EEhWA/4kv7UehbeyM=
591591
github.com/operator-framework/catalogd v0.20.0 h1:m5ugxf9fjEUaNHy81lSu6jFzTEt0XpEo44+T7g9On+U=
592592
github.com/operator-framework/catalogd v0.20.0/go.mod h1:F4KehkAI/bpDI4IVXNxQ7dlWtVBYvc2qkxSa7mIFGRk=
593-
github.com/operator-framework/helm-operator-plugins v0.3.1 h1:D8hF0ufF+2ZtuttYUu4yBlsmHvic/zENm6n9h83ITI0=
594-
github.com/operator-framework/helm-operator-plugins v0.3.1/go.mod h1:5Kx1PyLnRVPyQmLq+frv+HJgSZzXG+W6LavSCxzm8sI=
593+
github.com/operator-framework/helm-operator-plugins v0.3.1-0.20240722173643-2e18c5b70f9c h1:fIsZBZnJsyt3d63Q1VQ6jBQhb4Vw29RSHfxgXxirciM=
594+
github.com/operator-framework/helm-operator-plugins v0.3.1-0.20240722173643-2e18c5b70f9c/go.mod h1:5Kx1PyLnRVPyQmLq+frv+HJgSZzXG+W6LavSCxzm8sI=
595595
github.com/operator-framework/operator-lib v0.14.0 h1:er+BgZymZD1im2wytLJiPLZpGALAX6N0gXaHx3PKbO4=
596596
github.com/operator-framework/operator-lib v0.14.0/go.mod h1:wUu4Xb9xzXnIpglvaZ3yucTMSlqGXHIoUEH9+5gWiu0=
597597
github.com/operator-framework/operator-registry v1.45.0 h1:9c5NshWjPncdZtWEY0cfMnAjx3pShVnjw5UmZXp/xNE=

‎internal/action/restconfig.go

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
package action
2+
3+
import (
4+
"context"
5+
"net/http"
6+
7+
"k8s.io/apimachinery/pkg/types"
8+
"k8s.io/client-go/rest"
9+
"sigs.k8s.io/controller-runtime/pkg/client"
10+
11+
ocv1alpha1 "github.com/operator-framework/operator-controller/api/v1alpha1"
12+
"github.com/operator-framework/operator-controller/internal/authentication"
13+
)
14+
15+
func ServiceAccountRestConfigMapper(tokenGetter *authentication.TokenGetter) func(ctx context.Context, o client.Object, c *rest.Config) (*rest.Config, error) {
16+
return func(ctx context.Context, o client.Object, c *rest.Config) (*rest.Config, error) {
17+
cExt := o.(*ocv1alpha1.ClusterExtension)
18+
saKey := types.NamespacedName{
19+
Name: cExt.Spec.ServiceAccount.Name,
20+
Namespace: cExt.Spec.InstallNamespace,
21+
}
22+
saConfig := rest.AnonymousClientConfig(c)
23+
saConfig.Wrap(func(rt http.RoundTripper) http.RoundTripper {
24+
return &authentication.TokenInjectingRoundTripper{
25+
Tripper: rt,
26+
TokenGetter: tokenGetter,
27+
Key: saKey,
28+
}
29+
})
30+
return saConfig, nil
31+
}
32+
}

0 commit comments

Comments
 (0)