@@ -17,154 +17,10 @@ limitations under the License.
1717package main
1818
1919import (
20- "crypto/tls"
21- "flag"
22- "os"
23-
24- // Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
25- // to ensure that exec-entrypoint and run can make use of them.
26- _ "k8s.io/client-go/plugin/pkg/client/auth"
27-
28- "k8s.io/apimachinery/pkg/runtime"
29- utilruntime "k8s.io/apimachinery/pkg/util/runtime"
30- clientgoscheme "k8s.io/client-go/kubernetes/scheme"
31- ctrl "sigs.k8s.io/controller-runtime"
32- "sigs.k8s.io/controller-runtime/pkg/healthz"
33- "sigs.k8s.io/controller-runtime/pkg/log/zap"
34- "sigs.k8s.io/controller-runtime/pkg/metrics/filters"
35- metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
36- "sigs.k8s.io/controller-runtime/pkg/webhook"
37-
38- gatewayapisixiov1alpha1 "github.com/api7/api7-ingress-controller/api/v1alpha1"
39- "github.com/api7/api7-ingress-controller/internal/controller"
40- // +kubebuilder:scaffold:imports
41- )
42-
43- var (
44- scheme = runtime .NewScheme ()
45- setupLog = ctrl .Log .WithName ("setup" )
20+ "github.com/api7/api7-ingress-controller/cmd/root"
21+ "github.com/spf13/cobra"
4622)
4723
48- func init () {
49- utilruntime .Must (clientgoscheme .AddToScheme (scheme ))
50-
51- utilruntime .Must (gatewayapisixiov1alpha1 .AddToScheme (scheme ))
52- // +kubebuilder:scaffold:scheme
53- }
54-
5524func main () {
56- var metricsAddr string
57- var enableLeaderElection bool
58- var probeAddr string
59- var secureMetrics bool
60- var enableHTTP2 bool
61- var tlsOpts []func (* tls.Config )
62- flag .StringVar (& metricsAddr , "metrics-bind-address" , "0" , "The address the metrics endpoint binds to. " +
63- "Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service." )
64- flag .StringVar (& probeAddr , "health-probe-bind-address" , ":8081" , "The address the probe endpoint binds to." )
65- flag .BoolVar (& enableLeaderElection , "leader-elect" , false ,
66- "Enable leader election for controller manager. " +
67- "Enabling this will ensure there is only one active controller manager." )
68- flag .BoolVar (& secureMetrics , "metrics-secure" , true ,
69- "If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead." )
70- flag .BoolVar (& enableHTTP2 , "enable-http2" , false ,
71- "If set, HTTP/2 will be enabled for the metrics and webhook servers" )
72- opts := zap.Options {
73- Development : true ,
74- }
75- opts .BindFlags (flag .CommandLine )
76- flag .Parse ()
77-
78- ctrl .SetLogger (zap .New (zap .UseFlagOptions (& opts )))
79-
80- // if the enable-http2 flag is false (the default), http/2 should be disabled
81- // due to its vulnerabilities. More specifically, disabling http/2 will
82- // prevent from being vulnerable to the HTTP/2 Stream Cancellation and
83- // Rapid Reset CVEs. For more information see:
84- // - https://github.com/advisories/GHSA-qppj-fm5r-hxr3
85- // - https://github.com/advisories/GHSA-4374-p667-p6c8
86- disableHTTP2 := func (c * tls.Config ) {
87- setupLog .Info ("disabling http/2" )
88- c .NextProtos = []string {"http/1.1" }
89- }
90-
91- if ! enableHTTP2 {
92- tlsOpts = append (tlsOpts , disableHTTP2 )
93- }
94-
95- webhookServer := webhook .NewServer (webhook.Options {
96- TLSOpts : tlsOpts ,
97- })
98-
99- // Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server.
100- // More info:
101- // - https://pkg.go.dev/sigs.k8s.io/[email protected] /pkg/metrics/server 102- // - https://book.kubebuilder.io/reference/metrics.html
103- metricsServerOptions := metricsserver.Options {
104- BindAddress : metricsAddr ,
105- SecureServing : secureMetrics ,
106- // TODO(user): TLSOpts is used to allow configuring the TLS config used for the server. If certificates are
107- // not provided, self-signed certificates will be generated by default. This option is not recommended for
108- // production environments as self-signed certificates do not offer the same level of trust and security
109- // as certificates issued by a trusted Certificate Authority (CA). The primary risk is potentially allowing
110- // unauthorized access to sensitive metrics data. Consider replacing with CertDir, CertName, and KeyName
111- // to provide certificates, ensuring the server communicates using trusted and secure certificates.
112- TLSOpts : tlsOpts ,
113- }
114-
115- if secureMetrics {
116- // FilterProvider is used to protect the metrics endpoint with authn/authz.
117- // These configurations ensure that only authorized users and service accounts
118- // can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
119- // https://pkg.go.dev/sigs.k8s.io/[email protected] /pkg/metrics/filters#WithAuthenticationAndAuthorization 120- metricsServerOptions .FilterProvider = filters .WithAuthenticationAndAuthorization
121- }
122-
123- mgr , err := ctrl .NewManager (ctrl .GetConfigOrDie (), ctrl.Options {
124- Scheme : scheme ,
125- Metrics : metricsServerOptions ,
126- WebhookServer : webhookServer ,
127- HealthProbeBindAddress : probeAddr ,
128- LeaderElection : enableLeaderElection ,
129- LeaderElectionID : "b2fc8523.github.com" ,
130- // LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily
131- // when the Manager ends. This requires the binary to immediately end when the
132- // Manager is stopped, otherwise, this setting is unsafe. Setting this significantly
133- // speeds up voluntary leader transitions as the new leader don't have to wait
134- // LeaseDuration time first.
135- //
136- // In the default scaffold provided, the program ends immediately after
137- // the manager stops, so would be fine to enable this option. However,
138- // if you are doing or is intended to do any operation such as perform cleanups
139- // after the manager stops then its usage might be unsafe.
140- // LeaderElectionReleaseOnCancel: true,
141- })
142- if err != nil {
143- setupLog .Error (err , "unable to start manager" )
144- os .Exit (1 )
145- }
146-
147- if err = (& controller.GuestbookReconciler {
148- Client : mgr .GetClient (),
149- Scheme : mgr .GetScheme (),
150- }).SetupWithManager (mgr ); err != nil {
151- setupLog .Error (err , "unable to create controller" , "controller" , "Guestbook" )
152- os .Exit (1 )
153- }
154- // +kubebuilder:scaffold:builder
155-
156- if err := mgr .AddHealthzCheck ("healthz" , healthz .Ping ); err != nil {
157- setupLog .Error (err , "unable to set up health check" )
158- os .Exit (1 )
159- }
160- if err := mgr .AddReadyzCheck ("readyz" , healthz .Ping ); err != nil {
161- setupLog .Error (err , "unable to set up ready check" )
162- os .Exit (1 )
163- }
164-
165- setupLog .Info ("starting manager" )
166- if err := mgr .Start (ctrl .SetupSignalHandler ()); err != nil {
167- setupLog .Error (err , "problem running manager" )
168- os .Exit (1 )
169- }
25+ cobra .CheckErr (root .NewRootCmd ().Execute ())
17026}
0 commit comments