Skip to content

Commit 1c0eda1

Browse files
DEiseltjschooneMalte Münch
authored
93 cluster stack scs catch up with alpha (#97)
* changed: v1alpha7 to v1beta1 Signed-off-by: Danny Eiselt <eiselt@b1-systems.de> * added: oidc to new version + v1beta1 Signed-off-by: Danny Eiselt <eiselt@b1-systems.de> * chore(node-images): update to 1.27.14 Signed-off-by: Jan Schoone <6106846+jschoone@users.noreply.github.com> * chore(node-images): update to 1.27.14 Signed-off-by: Jan Schoone <6106846+jschoone@users.noreply.github.com> * fix: change cluster stack name Signed-off-by: Jan Schoone <6106846+jschoone@users.noreply.github.com> * Dummy commit to trigger DCO See dcoapp/app#211 (comment) Signed-off-by: Danny Eiselt <eiselt@b1-systems.de> * Dummy commit to retrigger DCO see dcoapp/app#211 (comment) Signed-off-by: Danny Eiselt <eiselt@b1-systems.de> --------- Signed-off-by: Danny Eiselt <eiselt@b1-systems.de> Signed-off-by: Jan Schoone <6106846+jschoone@users.noreply.github.com> Co-authored-by: Jan Schoone <6106846+jschoone@users.noreply.github.com> Co-authored-by: Malte Münch <muench@b1-systems.de>
1 parent cabd6d4 commit 1c0eda1

File tree

9 files changed

+170
-68
lines changed

9 files changed

+170
-68
lines changed

‎providers/openstack/scs/1-27/cluster-addon/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,6 @@ dependencies:
2121
repository: https://stackitcloud.github.io/yawol
2222
version: 0.21.3
2323
condition: yawol-controller.enabled
24-
name: openstack-wooctavia-1-27-cluster-addon
24+
name: openstack-scs-1-27-cluster-addon
2525
type: application
26-
version: v3
26+
version: v1

‎providers/openstack/scs/1-27/cluster-class/Chart.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v2
22
description: |
33
This chart installs and configures:
4-
* Openstack Wooctavia Cluster Class
5-
name: openstack-wooctavia-1-27-cluster-class
4+
* Openstack scs Cluster Class
5+
name: openstack-scs-1-27-cluster-class
66
type: application
7-
version: v3
7+
version: v1

‎providers/openstack/scs/1-27/cluster-class/templates/cluster-class.yaml‎

Lines changed: 112 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,11 @@ spec:
1111
machineInfrastructure:
1212
ref:
1313
kind: OpenStackMachineTemplate
14-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
14+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
1515
name: {{ .Release.Name }}-{{ .Chart.Version }}-control-plane
1616
infrastructure:
1717
ref:
18-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
18+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
1919
kind: OpenStackClusterTemplate
2020
name: {{ .Release.Name }}-{{ .Chart.Version }}-cluster
2121
workers:
@@ -29,7 +29,7 @@ spec:
2929
name: {{ .Release.Name }}-{{ .Chart.Version }}
3030
infrastructure:
3131
ref:
32-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
32+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
3333
kind: OpenStackMachineTemplate
3434
name: {{ .Release.Name }}-{{ .Chart.Version }}
3535
variables:
@@ -257,12 +257,61 @@ spec:
257257
description: "CertSANs sets extra Subject Alternative Names for the API Server signing cert."
258258
items:
259259
type: string
260+
- name: oidc_config
261+
required: false
262+
schema:
263+
openAPIV3Schema:
264+
type: object
265+
properties:
266+
client_id:
267+
type: string
268+
example: "kubectl"
269+
description: "A client id that all tokens must be issued for."
270+
issuer_url:
271+
type: string
272+
example: "https://dex.k8s.scs.community"
273+
description: "URL of the provider that allows the API server to
274+
discover public signing keys. Only URLs that use the https:// scheme are
275+
accepted. This is typically the provider's discovery URL, changed to have an
276+
empty path"
277+
username_claim:
278+
type: string
279+
example: "preferred_username"
280+
default: "sub"
281+
description: "JWT claim to use as the user name. By default sub,
282+
which is expected to be a unique identifier of the end user. Admins can choose
283+
other claims, such as email or name, depending on their provider. However,
284+
claims other than email will be prefixed with the issuer URL to prevent naming
285+
clashes with other plugins."
286+
groups_claim:
287+
type: string
288+
example: "groups"
289+
default: "groups"
290+
description: "JWT claim to use as the user's group. If the claim
291+
is present it must be an array of strings."
292+
username_prefix:
293+
type: string
294+
example: "oidc:"
295+
default: "oidc:"
296+
description: "Prefix prepended to username claims to prevent
297+
clashes with existing names (such as system: users). For example, the value
298+
oidc: will create usernames like oidc:jane.doe. If this flag isn't provided and
299+
--oidc-username-claim is a value other than email the prefix defaults to (
300+
Issuer URL )# where ( Issuer URL ) is the value of --oidc-issuer-url. The value
301+
- can be used to disable all prefixing."
302+
groups_prefix:
303+
type: string
304+
example: "oidc:"
305+
default: "oidc:"
306+
description: "Prefix prepended to group claims to prevent clashes
307+
with existing names (such as system: groups). For example, the value oidc: will
308+
create group names like oidc:engineering and oidc:infra."
260309
patches:
261310
- name: k8s_version
262311
description: "Sets the openstack node image for workers and the controlplane to the cluster-api image with the version mentioned in spec.topology.version."
263312
definitions:
264313
- selector:
265-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
314+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
266315
kind: OpenStackMachineTemplate
267316
matchResources:
268317
controlPlane: true
@@ -271,15 +320,15 @@ spec:
271320
- {{ .Release.Name }}-{{ .Chart.Version }}
272321
jsonPatches:
273322
- op: add
274-
path: "/spec/template/spec/image"
323+
path: "/spec/template/spec/image/filter/name"
275324
valueFrom:
276325
template: ubuntu-capi-image-{{ `{{ .builtin.cluster.topology.version }}` }}
277326
- name: apiserver_loadbalancer_octavia-amphora
278327
description: "Takes care of the patches that should be applied when variable apiserver_loadbalancer is set to octavia-amphora."
279328
enabledIf: {{ `'{{ eq .apiserver_loadbalancer "octavia-amphora" }}'` }}
280329
definitions:
281330
- selector:
282-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
331+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
283332
kind: OpenStackClusterTemplate
284333
matchResources:
285334
infrastructureCluster: true
@@ -295,7 +344,7 @@ spec:
295344
enabledIf: {{ `'{{ eq .apiserver_loadbalancer "octavia-ovn" }}'` }}
296345
definitions:
297346
- selector:
298-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
347+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
299348
kind: OpenStackClusterTemplate
300349
matchResources:
301350
infrastructureCluster: true
@@ -311,7 +360,7 @@ spec:
311360
enabledIf: {{ `'{{ eq .apiserver_loadbalancer "kube-vip" }}'` }}
312361
definitions:
313362
- selector:
314-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
363+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
315364
kind: OpenStackClusterTemplate
316365
matchResources:
317366
infrastructureCluster: true
@@ -329,7 +378,7 @@ spec:
329378
valueFrom:
330379
template: {{ `"{{ if .kube_vip_apiserver_public_ip }}{{.kube_vip_apiserver_public_ip}}{{else}}{{.kube_vip_apiserver_virtual_ip}}{{end}}"` }}
331380
- selector:
332-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
381+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
333382
kind: OpenStackMachineTemplate
334383
matchResources:
335384
controlPlane: true
@@ -443,7 +492,7 @@ spec:
443492
enabledIf: {{ `'{{ ne .controller_flavor "" }}'` }}
444493
definitions:
445494
- selector:
446-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
495+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
447496
kind: OpenStackMachineTemplate
448497
matchResources:
449498
controlPlane: true
@@ -457,7 +506,7 @@ spec:
457506
enabledIf: {{ `'{{ ne .worker_flavor "" }}'` }}
458507
definitions:
459508
- selector:
460-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
509+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
461510
kind: OpenStackMachineTemplate
462511
matchResources:
463512
controlPlane: false
@@ -474,7 +523,7 @@ spec:
474523
enabledIf: {{ `"{{ if .controller_root_disk }}true{{end}}"` }}
475524
definitions:
476525
- selector:
477-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
526+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
478527
kind: OpenStackMachineTemplate
479528
matchResources:
480529
controlPlane: true
@@ -489,7 +538,7 @@ spec:
489538
enabledIf: {{ `"{{ if .worker_root_disk }}true{{end}}"` }}
490539
definitions:
491540
- selector:
492-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
541+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
493542
kind: OpenStackMachineTemplate
494543
matchResources:
495544
controlPlane: false
@@ -507,21 +556,21 @@ spec:
507556
enabledIf: {{ `'{{ ne .external_id "" }}'` }}
508557
definitions:
509558
- selector:
510-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
559+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
511560
kind: OpenStackClusterTemplate
512561
matchResources:
513562
infrastructureCluster: true
514563
jsonPatches:
515564
- op: replace
516-
path: "/spec/template/spec/externalNetworkId"
565+
path: "/spec/template/spec/externalNetwork/id"
517566
valueFrom:
518567
variable: external_id
519568
- name: openstack_security_groups
520569
description: "Sets the list of the openstack security groups for the worker and the controlplane instances."
521570
enabledIf: {{ `"{{ if .openstack_security_groups }}true{{end}}"` }}
522571
definitions:
523572
- selector:
524-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
573+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
525574
kind: OpenStackMachineTemplate
526575
matchResources:
527576
controlPlane: true
@@ -534,7 +583,7 @@ spec:
534583
valueFrom:
535584
template: {{ `"[ {{ range .openstack_security_groups }} { name: {{ . }}}, {{ end }} ]"` }}
536585
- selector:
537-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
586+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
538587
kind: OpenStackClusterTemplate
539588
matchResources:
540589
infrastructureCluster: true
@@ -547,17 +596,17 @@ spec:
547596
enabledIf: {{ `'{{ ne .cloud_name "" }}'` }}
548597
definitions:
549598
- selector:
550-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
599+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
551600
kind: OpenStackClusterTemplate
552601
matchResources:
553602
infrastructureCluster: true
554603
jsonPatches:
555604
- op: replace
556-
path: "/spec/template/spec/cloudName"
605+
path: "/spec/template/spec/identityRef/cloudName"
557606
valueFrom:
558607
variable: cloud_name
559608
- selector:
560-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
609+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
561610
kind: OpenStackMachineTemplate
562611
matchResources:
563612
controlPlane: true
@@ -566,15 +615,15 @@ spec:
566615
- {{ .Release.Name }}-{{ .Chart.Version }}
567616
jsonPatches:
568617
- op: replace
569-
path: "/spec/template/spec/cloudName"
618+
path: "/spec/template/spec/identityRef/cloudName"
570619
valueFrom:
571620
variable: cloud_name
572621
- name: secret_name
573622
description: "Sets the name of the clouds secret."
574623
enabledIf: {{ `'{{ ne .secret_name "" }}'` }}
575624
definitions:
576625
- selector:
577-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
626+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
578627
kind: OpenStackClusterTemplate
579628
matchResources:
580629
infrastructureCluster: true
@@ -584,7 +633,7 @@ spec:
584633
valueFrom:
585634
variable: secret_name
586635
- selector:
587-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
636+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
588637
kind: OpenStackMachineTemplate
589638
matchResources:
590639
controlPlane: true
@@ -601,7 +650,7 @@ spec:
601650
enabledIf: {{ `'{{ ne .controller_server_group_id "" }}'` }}
602651
definitions:
603652
- selector:
604-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
653+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
605654
kind: OpenStackMachineTemplate
606655
matchResources:
607656
controlPlane: true
@@ -615,7 +664,7 @@ spec:
615664
enabledIf: {{ `'{{ ne .worker_server_group_id "" }}'` }}
616665
definitions:
617666
- selector:
618-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
667+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
619668
kind: OpenStackMachineTemplate
620669
matchResources:
621670
controlPlane: false
@@ -632,7 +681,7 @@ spec:
632681
enabledIf: {{ `'{{ ne .ssh_key "" }}'` }}
633682
definitions:
634683
- selector:
635-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
684+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
636685
kind: OpenStackMachineTemplate
637686
matchResources:
638687
controlPlane: true
@@ -658,31 +707,56 @@ spec:
658707
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/certSANs"
659708
valueFrom:
660709
variable: certSANs
661-
- name: dns_nameservers
662-
description: "Sets the list of nameservers for the OpenStack Subnet being created."
663-
enabledIf: {{ `"{{ if and .dns_nameservers (ne .apiserver_loadbalancer \"kube-vip\")}}true{{end}}"` }}
710+
- name: oidc_config
711+
description: "Configure API Server to use external authentication service."
712+
enabledIf: {{ `"{{ if and .oidc_config .oidc_config.client_id .oidc_config.issuer_url }}true{{end}}"` }}
664713
definitions:
665714
- selector:
666-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
667-
kind: OpenStackClusterTemplate
715+
apiVersion: controlplane.cluster.x-k8s.io/v1beta1
716+
kind: KubeadmControlPlaneTemplate
668717
matchResources:
669-
infrastructureCluster: true
718+
controlPlane: true
670719
jsonPatches:
671720
- op: add
672-
path: "/spec/template/spec/dnsNameservers"
721+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-client-id"
722+
valueFrom:
723+
variable: oidc_config.client_id
724+
- op: add
725+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-issuer-url"
673726
valueFrom:
674-
variable: dns_nameservers
675-
- name: node_cidr
727+
variable: oidc_config.issuer_url
728+
- op: add
729+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-username-claim"
730+
valueFrom:
731+
variable: oidc_config.username_claim
732+
- op: add
733+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-groups-claim"
734+
valueFrom:
735+
variable: oidc_config.groups_claim
736+
- op: add
737+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-username-prefix"
738+
valueFrom:
739+
variable: oidc_config.username_prefix
740+
- op: add
741+
path: "/spec/template/spec/kubeadmConfigSpec/clusterConfiguration/apiServer/extraArgs/oidc-groups-prefix"
742+
valueFrom:
743+
variable: oidc_config.groups_prefix
744+
- name: subnet
676745
description: "Sets the NodeCIDR for the OpenStack Subnet to be created. Cluster actuator will create a network, a subnet with NodeCIDR, and a router connected to this subnet."
677746
enabledIf: {{ `"{{ if and .node_cidr (ne .apiserver_loadbalancer \"kube-vip\")}}true{{end}}"` }}
678747
definitions:
679748
- selector:
680-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
749+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
681750
kind: OpenStackClusterTemplate
682751
matchResources:
683752
infrastructureCluster: true
684753
jsonPatches:
685754
- op: add
686-
path: "/spec/template/spec/nodeCidr"
755+
path: "/spec/template/spec/managedSubnets"
687756
valueFrom:
688-
variable: node_cidr
757+
template: |
758+
- cidr: '{{"{{"}} .node_cidr {{"}}"}}'
759+
dnsNameservers:
760+
{{`{{- range .dns_nameservers }}`}}
761+
- {{`{{ . }}`}}
762+
{{`{{- end }}`}}

‎providers/openstack/scs/1-27/cluster-class/templates/openstack-cluster-template.yaml‎

Lines changed: 18 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,25 @@
1-
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha7
1+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
22
kind: OpenStackClusterTemplate
33
metadata:
44
name: {{ .Release.Name }}-{{ .Chart.Version }}-cluster
55
spec:
66
template:
77
spec:
8-
allowAllInClusterTraffic: true
9-
cloudName: {{ default "openstack" .Values.cloud.name }}
108
identityRef:
11-
name: {{ default "openstack" .Values.secrets.clouds_yaml }}
12-
kind: Secret
13-
managedSecurityGroups: true
14-
externalNetworkId: {{ .Values.external_id }}
9+
cloudName: {{ default "openstack" .Values.identityRef.cloudName }}
10+
name: {{ default "openstack" .Values.identityRef.name }}
11+
apiServerLoadBalancer:
12+
enabled: {{ .Values.openstack_loadbalancer_apiserver }}
13+
{{- if .Values.restrict_kubeapi }}
14+
allowedCIDRs: {{ .Values.restrict_kubeapi }}
15+
{{- end }}
16+
managedSecurityGroups:
17+
allowAllInClusterTraffic: true
18+
managedSubnets:
19+
- cidr: {{ .Values.node_cidr }}
20+
dnsNameservers:
21+
{{- range .Values.dns_nameservers }}
22+
- {{ . }}
23+
{{- end }}
24+
externalNetwork:
25+
id: {{ .Values.external_id }}

0 commit comments

Comments
 (0)