Skip to content

Commit c77252b

Browse files
horis233bitscuit
horis233
and
bitscuit
authored
feat: make namespace scope operator being able to watch multiple namespace (#79)
* feat: make namespace scope operator being able to watch multiple namespaces * Update bundle-restricted/manifests/ibm-namespace-scope-operator-restricted.clusterserviceversion.yaml Co-authored-by: Henry Li <[email protected]> Co-authored-by: Henry Li <[email protected]>
1 parent 4498458 commit c77252b

File tree

5 files changed

+90
-104
lines changed

5 files changed

+90
-104
lines changed

‎bundle-restricted/manifests/ibm-namespace-scope-operator-restricted.clusterserviceversion.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,33 @@ spec:
4747
mediatype: image/png
4848
install:
4949
spec:
50+
clusterPermissions:
51+
- rules:
52+
- apiGroups:
53+
- rbac.authorization.k8s.io
54+
resources:
55+
- roles
56+
- rolebindings
57+
verbs:
58+
- get
59+
- list
60+
- apiGroups:
61+
- ''
62+
resources:
63+
- configmaps
64+
- pods
65+
verbs:
66+
- get
67+
- list
68+
- apiGroups:
69+
- operator.ibm.com
70+
resources:
71+
- namespacescopes
72+
verbs:
73+
- get
74+
- list
75+
- watch
76+
serviceAccountName: ibm-namespace-scope-operator
5077
deployments:
5178
- name: ibm-namespace-scope-operator
5279
spec:

‎config/crd/bases/operator.ibm.com_namespacescopes.yaml

Lines changed: 51 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11

22
---
3-
apiVersion: apiextensions.k8s.io/v1beta1
3+
apiVersion: apiextensions.k8s.io/v1
44
kind: CustomResourceDefinition
55
metadata:
66
annotations:
7-
controller-gen.kubebuilder.io/version: v0.3.0
7+
controller-gen.kubebuilder.io/version: v0.4.0
88
creationTimestamp: null
99
name: namespacescopes.operator.ibm.com
1010
spec:
@@ -17,73 +17,59 @@ spec:
1717
- nss
1818
singular: namespacescope
1919
scope: Namespaced
20-
subresources:
21-
status: {}
22-
validation:
23-
openAPIV3Schema:
24-
description: NamespaceScope is the Schema for the namespacescopes API
25-
properties:
26-
apiVersion:
27-
description: 'APIVersion defines the versioned schema of this representation
28-
of an object. Servers should convert recognized schemas to the latest
29-
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
30-
type: string
31-
kind:
32-
description: 'Kind is a string value representing the REST resource this
33-
object represents. Servers may infer this from the endpoint the client
34-
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
35-
type: string
36-
metadata:
37-
type: object
38-
spec:
39-
description: NamespaceScopeSpec defines the desired state of NamespaceScope
40-
properties:
41-
configmapName:
42-
description: ConfigMap name that will contain the list of namespaces
43-
to be watched
44-
type: string
45-
manualManagement:
46-
description: Set the following to true to manaually manage permissions
47-
for the NamespaceScope operator to extend control over other namespaces
48-
The operator may fail when trying to extend permissions to other namespaces,
49-
but the cluster administrator can correct this using the authorize-namespace
50-
command.
51-
type: boolean
52-
namespaceMembers:
53-
description: Namespaces that are part of this scope
54-
items:
55-
type: string
56-
type: array
57-
restartLabels:
58-
additionalProperties:
59-
type: string
60-
description: Restart pods with the following labels when the namspace
61-
list changes
62-
type: object
63-
serviceAccountMembers:
64-
description: ServiceAccountMembers are extra service accounts will be
65-
bond the roles from other namespaces
66-
items:
67-
type: string
68-
type: array
69-
type: object
70-
status:
71-
description: NamespaceScopeStatus defines the observed state of NamespaceScope
72-
properties:
73-
validatedMembers:
74-
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
75-
of cluster Important: Run "make" to regenerate code after modifying
76-
this file'
77-
items:
78-
type: string
79-
type: array
80-
type: object
81-
type: object
82-
version: v1
8320
versions:
8421
- name: v1
22+
schema:
23+
openAPIV3Schema:
24+
description: NamespaceScope is the Schema for the namespacescopes API
25+
properties:
26+
apiVersion:
27+
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
28+
type: string
29+
kind:
30+
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
31+
type: string
32+
metadata:
33+
type: object
34+
spec:
35+
description: NamespaceScopeSpec defines the desired state of NamespaceScope
36+
properties:
37+
configmapName:
38+
description: ConfigMap name that will contain the list of namespaces to be watched
39+
type: string
40+
manualManagement:
41+
description: Set the following to true to manaually manage permissions for the NamespaceScope operator to extend control over other namespaces The operator may fail when trying to extend permissions to other namespaces, but the cluster administrator can correct this using the authorize-namespace command.
42+
type: boolean
43+
namespaceMembers:
44+
description: Namespaces that are part of this scope
45+
items:
46+
type: string
47+
type: array
48+
restartLabels:
49+
additionalProperties:
50+
type: string
51+
description: Restart pods with the following labels when the namspace list changes
52+
type: object
53+
serviceAccountMembers:
54+
description: ServiceAccountMembers are extra service accounts will be bond the roles from other namespaces
55+
items:
56+
type: string
57+
type: array
58+
type: object
59+
status:
60+
description: NamespaceScopeStatus defines the observed state of NamespaceScope
61+
properties:
62+
validatedMembers:
63+
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state of cluster Important: Run "make" to regenerate code after modifying this file'
64+
items:
65+
type: string
66+
type: array
67+
type: object
68+
type: object
8569
served: true
8670
storage: true
71+
subresources:
72+
status: {}
8773
status:
8874
acceptedNames:
8975
kind: ""

‎controllers/namespacescope_controller.go

Lines changed: 12 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -231,14 +231,16 @@ func (r *NamespaceScopeReconciler) PushRbacToNamespace(instance *operatorv1.Name
231231
}
232232

233233
for _, toNs := range instance.Status.ValidatedMembers {
234-
if toNs == operatorNs {
235-
continue
236-
}
237-
if err := r.generateRBACForNSS(instance, fromNs, toNs); err != nil {
238-
return err
234+
if toNs != operatorNs {
235+
if err := r.generateRBACForNSS(instance, fromNs, toNs); err != nil {
236+
return err
237+
}
239238
}
240-
if err := r.generateRBACToNamespace(instance, saNames, fromNs, toNs); err != nil {
241-
return err
239+
240+
if toNs != instance.Namespace {
241+
if err := r.generateRBACToNamespace(instance, saNames, fromNs, toNs); err != nil {
242+
return err
243+
}
242244
}
243245
}
244246
return nil
@@ -269,14 +271,8 @@ func (r *NamespaceScopeReconciler) DeleteRbacFromUnmanagedNamespace(instance *op
269271
"namespace-scope-configmap": instance.Namespace + "-" + instance.Spec.ConfigmapName,
270272
}
271273

272-
operatorNs, err := util.GetOperatorNamespace()
273-
if err != nil {
274-
klog.Error("get operator namespace failed: ", err)
275-
return err
276-
}
277-
278274
for _, toNs := range unmanagedNss {
279-
if toNs == operatorNs {
275+
if toNs == instance.Namespace {
280276
continue
281277
}
282278

@@ -304,20 +300,14 @@ func (r *NamespaceScopeReconciler) DeleteAllRbac(instance *operatorv1.NamespaceS
304300
"namespace-scope-configmap": instance.Namespace + "-" + instance.Spec.ConfigmapName,
305301
}
306302

307-
operatorNs, err := util.GetOperatorNamespace()
308-
if err != nil {
309-
klog.Error("get operator namespace failed: ", err)
310-
return err
311-
}
312-
313303
usingMembers, err := r.getAllValidatedNamespaceMembers(instance)
314304
if err != nil {
315305
return err
316306
}
317307
deletedMembers := util.GetListDifference(instance.Spec.NamespaceMembers, usingMembers)
318308

319309
for _, toNs := range deletedMembers {
320-
if toNs == operatorNs {
310+
if toNs == instance.Namespace {
321311
continue
322312
}
323313
if err := r.DeleteRoleBinding(labels, toNs); err != nil {
@@ -700,13 +690,8 @@ func (r *NamespaceScopeReconciler) checkNamespaceAdminAuth(namespace string) boo
700690

701691
func (r *NamespaceScopeReconciler) getValidatedNamespaces(instance *operatorv1.NamespaceScope) ([]string, error) {
702692
var validatedNs []string
703-
operatorNs, err := util.GetOperatorNamespace()
704-
if err != nil {
705-
klog.Error("get operator namespace failed: ", err)
706-
return validatedNs, err
707-
}
708693
for _, nsMem := range instance.Spec.NamespaceMembers {
709-
if nsMem == operatorNs {
694+
if nsMem == instance.Namespace {
710695
validatedNs = append(validatedNs, nsMem)
711696
continue
712697
}

‎go.sum

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -318,7 +318,6 @@ golang.org/x/crypto v0.0.0-20190320223903-b7391e95e576/go.mod h1:djNgcEr1/C05ACk
318318
golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
319319
golang.org/x/crypto v0.0.0-20190617133340-57b3e21c3d56/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
320320
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
321-
golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975 h1:/Tl7pH94bvbAAHBdZJT947M/+gp0+CqQXDtMRC0fseo=
322321
golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
323322
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI=
324323
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -347,7 +346,6 @@ golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLL
347346
golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
348347
golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
349348
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
350-
golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7 h1:AeiKBIuRw3UomYXSbLy0Mc2dDLfdtbT/IVn4keq83P0=
351349
golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
352350
golang.org/x/net v0.0.0-20201021035429-f5854403a974 h1:IX6qOQeG5uLjB/hjjwjedwfjND0hgjPMMyO1RoIXQNI=
353351
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
@@ -381,7 +379,6 @@ golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7w
381379
golang.org/x/sys v0.0.0-20191022100944-742c48ecaeb7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
382380
golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
383381
golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
384-
golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd h1:xhmwyvizuTgC2qz7ZlMluP20uW+C3Rm0FD/WLDX8884=
385382
golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
386383
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f h1:+Nyd8tzPX9R7BWHguqsrbFdRx3WQ/1ib8I44HXV5yTA=
387384
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -411,7 +408,6 @@ golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roY
411408
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
412409
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
413410
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
414-
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
415411
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
416412
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
417413
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

‎main.go

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@ import (
3434

3535
operatorv1 "github.com/IBM/ibm-namespace-scope-operator/api/v1"
3636
"github.com/IBM/ibm-namespace-scope-operator/controllers"
37-
util "github.com/IBM/ibm-namespace-scope-operator/controllers/common"
3837
// +kubebuilder:scaffold:imports
3938
)
4039

@@ -66,16 +65,9 @@ func main() {
6665
rbacv1.SchemeGroupVersion.WithKind("RoleBinding"): {LabelSelector: "namespace-scope-configmap"},
6766
}
6867

69-
operatorNs, err := util.GetOperatorNamespace()
70-
if err != nil {
71-
klog.Error("Failed to get operator namespace: ", err)
72-
os.Exit(1)
73-
}
74-
7568
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
7669
Scheme: scheme,
7770
MetricsBindAddress: metricsAddr,
78-
Namespace: operatorNs,
7971
Port: 9443,
8072
LeaderElection: enableLeaderElection,
8173
LeaderElectionID: "6a4a72f9.ibm.com",

0 commit comments

Comments
 (0)