Skip to content

Commit 907c570

Browse files
tamalsahatamalsaha
authored
Unset runAsUser and fsGroup for openshift spokes (#47)
Signed-off-by: Tamal Saha <tamal@appscode.com>
1 parent 30bbac6 commit 907c570

File tree

9 files changed

+66
-635
lines changed

9 files changed

+66
-635
lines changed

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ require (
2525
k8s.io/kube-aggregator v0.32.3
2626
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff
2727
k8s.io/utils v0.0.0-20241210054802-24370beab758
28-
kmodules.xyz/client-go v0.32.2
28+
kmodules.xyz/client-go v0.32.4
2929
open-cluster-management.io/addon-framework v0.11.0
3030
open-cluster-management.io/api v0.15.0
3131
sigs.k8s.io/controller-runtime v0.20.4

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -871,8 +871,8 @@ k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUy
871871
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
872872
k8s.io/utils v0.0.0-20241210054802-24370beab758 h1:sdbE21q2nlQtFh65saZY+rRM6x6aJJI8IUa1AmH/qa0=
873873
k8s.io/utils v0.0.0-20241210054802-24370beab758/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
874-
kmodules.xyz/client-go v0.32.2 h1:Y0B/26wa8HVL7Vn0HrlALwuuUSqZuj99qkjXWINdous=
875-
kmodules.xyz/client-go v0.32.2/go.mod h1:ZwLnc7UqEXUNSe43n/SnER6+7YAQCu38L2te6YefoHU=
874+
kmodules.xyz/client-go v0.32.4 h1:eB5I18rLptkx0vsDcqIr62I23sX16K3BBs29RoOxrFk=
875+
kmodules.xyz/client-go v0.32.4/go.mod h1:ZwLnc7UqEXUNSe43n/SnER6+7YAQCu38L2te6YefoHU=
876876
moul.io/http2curl/v2 v2.3.1-0.20221024080105-10c404f653f7 h1:NykkTlRB+X40z86cLHdEmuoTxhNKhQebLT379b1EumA=
877877
moul.io/http2curl/v2 v2.3.1-0.20221024080105-10c404f653f7/go.mod h1:RW4hyBjTWSYDOxapodpNEtX0g5Eb16sxklBqmd2RHcE=
878878
open-cluster-management.io/api v0.15.0 h1:lRee1KOlGHZb2scTA7ff9E9Fxt2hJc7jpkHnaCbvkOU=

‎pkg/manager/agent-manifests/license-proxyserver/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
apiVersion: v1
22
description: Kubernetes license-proxyserver by AppsCode
33
name: license-proxyserver
4-
version: v2025.4.30
5-
appVersion: v0.0.22
4+
version: v2025.5.16
5+
appVersion: v0.0.23
66
home: https://github.com/appscode-cloud/license-proxyserver
77
icon: https://cdn.appscode.com/images/products/searchlight/icons/android-icon-192x192.png
88
sources:

‎pkg/manager/agent-manifests/license-proxyserver/README.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
```bash
88
$ helm repo add appscode https://charts.appscode.com/stable/
99
$ helm repo update
10-
$ helm search repo appscode/license-proxyserver --version=v2025.4.30
11-
$ helm upgrade -i license-proxyserver appscode/license-proxyserver -n kubeops --create-namespace --version=v2025.4.30
10+
$ helm search repo appscode/license-proxyserver --version=v2025.5.16
11+
$ helm upgrade -i license-proxyserver appscode/license-proxyserver -n kubeops --create-namespace --version=v2025.5.16
1212
```
1313

1414
## Introduction
@@ -24,7 +24,7 @@ This chart deploys a Kubernetes license proxyserver on a [Kubernetes](http://kub
2424
To install/upgrade the chart with the release name `license-proxyserver`:
2525

2626
```bash
27-
$ helm upgrade -i license-proxyserver appscode/license-proxyserver -n kubeops --create-namespace --version=v2025.4.30
27+
$ helm upgrade -i license-proxyserver appscode/license-proxyserver -n kubeops --create-namespace --version=v2025.5.16
2828
```
2929

3030
The command deploys a Kubernetes license proxyserver on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation.
@@ -95,12 +95,12 @@ The following table lists the configurable parameters of the `license-proxyserve
9595
Specify each parameter using the `--set key=value[,key=value]` argument to `helm upgrade -i`. For example:
9696

9797
```bash
98-
$ helm upgrade -i license-proxyserver appscode/license-proxyserver -n kubeops --create-namespace --version=v2025.4.30 --set replicaCount=1
98+
$ helm upgrade -i license-proxyserver appscode/license-proxyserver -n kubeops --create-namespace --version=v2025.5.16 --set replicaCount=1
9999
```
100100

101101
Alternatively, a YAML file that specifies the values for the parameters can be provided while
102102
installing the chart. For example:
103103

104104
```bash
105-
$ helm upgrade -i license-proxyserver appscode/license-proxyserver -n kubeops --create-namespace --version=v2025.4.30 --values values.yaml
105+
$ helm upgrade -i license-proxyserver appscode/license-proxyserver -n kubeops --create-namespace --version=v2025.5.16 --values values.yaml
106106
```

‎pkg/manager/agent-manifests/license-proxyserver/crds/monitoring.coreos.com_servicemonitors.yaml‎

Lines changed: 0 additions & 602 deletions
Large diffs are not rendered by default.

‎pkg/manager/config.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
"encoding/base64"
2222
"fmt"
2323
"os"
24+
"slices"
2425

2526
"go.bytebuilders.dev/license-proxyserver/pkg/common"
2627

@@ -34,6 +35,7 @@ import (
3435
"k8s.io/apimachinery/pkg/types"
3536
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
3637
apiregistrationv1 "k8s.io/kube-aggregator/pkg/apis/apiregistration/v1"
38+
kmapi "kmodules.xyz/client-go/api/v1"
3739
"open-cluster-management.io/addon-framework/pkg/addonfactory"
3840
agentapi "open-cluster-management.io/addon-framework/pkg/agent"
3941
"open-cluster-management.io/api/addon/v1alpha1"
@@ -156,6 +158,20 @@ func GetConfigValues(kc client.Client, opts *ManagerOptions, cs *certstore.CertS
156158
}
157159
}
158160

161+
for _, cc := range cluster.Status.ClusterClaims {
162+
if cc.Name == kmapi.ClusterClaimKeyInfo {
163+
var info kmapi.ClusterInfo
164+
if err := yaml.Unmarshal([]byte(cc.Value), &info); err != nil {
165+
return nil, err
166+
}
167+
if slices.Contains(info.ClusterManagers, kmapi.ClusterManagerOpenShift.Name()) {
168+
unstructured.RemoveNestedField(values, "image", "securityContext", "runAsUser")
169+
unstructured.RemoveNestedField(values, "podSecurityContext", "fsGroup")
170+
}
171+
break
172+
}
173+
}
174+
159175
return vals, nil
160176
}
161177
}

‎vendor/kmodules.xyz/client-go/api/v1/cluster.go‎

Lines changed: 29 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
"crypto/sha256"
2222
"encoding/base64"
2323
"fmt"
24+
"math/bits"
2425
"strings"
2526
)
2627

@@ -59,27 +60,29 @@ const (
5960
ClusterProviderNameKey string = "cluster.appscode.com/provider"
6061
ClusterProfileLabel string = "cluster.appscode.com/profile"
6162

62-
AceOrgIDKey string = "ace.appscode.com/org-id"
63-
ClientOrgKey string = "ace.appscode.com/client-org"
64-
ClientOrgMonitoringKey string = "ace.appscode.com/client-org-monitoring"
65-
ClientKeyPrefix string = "client.ace.appscode.com/"
63+
AceOrgIDKey string = "ace.appscode.com/org-id"
64+
AceEnableResourceTrialKey string = "ace.appscode.com/enable-resource-trial"
65+
ClientOrgKey string = "ace.appscode.com/client-org"
66+
ClientOrgMonitoringKey string = "ace.appscode.com/client-org-monitoring"
67+
ClientKeyPrefix string = "client.ace.appscode.com/"
6668

6769
ClusterClaimKeyID string = "id.k8s.io"
6870
ClusterClaimKeyInfo string = "cluster.ace.info"
6971
ClusterClaimKeyFeatures string = "features.ace.info"
7072
)
7173

7274
type ClusterMetadata struct {
73-
UID string `json:"uid" protobuf:"bytes,1,opt,name=uid"`
74-
Name string `json:"name,omitempty" protobuf:"bytes,2,opt,name=name"`
75-
DisplayName string `json:"displayName,omitempty" protobuf:"bytes,3,opt,name=displayName"`
76-
Provider HostingProvider `json:"provider,omitempty" protobuf:"bytes,4,opt,name=provider,casttype=HostingProvider"`
77-
OwnerID string `json:"ownerID,omitempty" protobuf:"bytes,5,opt,name=ownerID"`
78-
OwnerType string `json:"ownerType,omitempty" protobuf:"bytes,6,opt,name=ownerType"`
79-
APIEndpoint string `json:"apiEndpoint,omitempty" protobuf:"bytes,7,opt,name=apiEndpoint"`
80-
CABundle string `json:"caBundle,omitempty" protobuf:"bytes,8,opt,name=caBundle"`
81-
ManagerID string `json:"managerID,omitempty" protobuf:"bytes,9,opt,name=managerID"`
82-
HubClusterID string `json:"hubClusterID,omitempty" protobuf:"bytes,10,opt,name=hubClusterID"`
75+
UID string `json:"uid" protobuf:"bytes,1,opt,name=uid"`
76+
Name string `json:"name,omitempty" protobuf:"bytes,2,opt,name=name"`
77+
DisplayName string `json:"displayName,omitempty" protobuf:"bytes,3,opt,name=displayName"`
78+
Provider HostingProvider `json:"provider,omitempty" protobuf:"bytes,4,opt,name=provider,casttype=HostingProvider"`
79+
OwnerID string `json:"ownerID,omitempty" protobuf:"bytes,5,opt,name=ownerID"`
80+
OwnerType string `json:"ownerType,omitempty" protobuf:"bytes,6,opt,name=ownerType"`
81+
APIEndpoint string `json:"apiEndpoint,omitempty" protobuf:"bytes,7,opt,name=apiEndpoint"`
82+
CABundle string `json:"caBundle,omitempty" protobuf:"bytes,8,opt,name=caBundle"`
83+
ManagerID string `json:"managerID,omitempty" protobuf:"bytes,9,opt,name=managerID"`
84+
HubClusterID string `json:"hubClusterID,omitempty" protobuf:"bytes,10,opt,name=hubClusterID"`
85+
CloudServiceAuthMode string `json:"cloudServiceAuthMode,omitempty" protobuf:"bytes,11,opt,name=cloudServiceAuthMode"`
8386
}
8487

8588
func (md ClusterMetadata) Manager() string {
@@ -175,6 +178,18 @@ func (cm ClusterManager) Strings() []string {
175178
return out
176179
}
177180

181+
func isPowerOfTwo(n int) bool {
182+
return n > 0 && (n&(n-1)) == 0
183+
}
184+
185+
func (cm ClusterManager) Name() string {
186+
if !isPowerOfTwo(int(cm)) {
187+
return cm.String()
188+
}
189+
idx := bits.TrailingZeros(uint(cm))
190+
return _ClusterManagerNames[idx]
191+
}
192+
178193
func (cm ClusterManager) String() string {
179194
return strings.Join(cm.Strings(), ",")
180195
}

‎vendor/kmodules.xyz/client-go/cluster/lib.go‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -90,14 +90,15 @@ func ClusterMetadataFromConfigMap(cm *core.ConfigMap, clusterUIDVerifier string)
9090
}
9191

9292
md := &kmapi.ClusterMetadata{
93-
UID: cm.Data["uid"],
94-
Name: cm.Data["name"],
95-
DisplayName: cm.Data["displayName"],
96-
Provider: kmapi.HostingProvider(cm.Data["provider"]),
97-
OwnerID: cm.Data["ownerID"],
98-
OwnerType: cm.Data["ownerType"],
99-
APIEndpoint: cm.Data["apiEndpoint"],
100-
CABundle: cm.Data["ca.crt"],
93+
UID: cm.Data["uid"],
94+
Name: cm.Data["name"],
95+
DisplayName: cm.Data["displayName"],
96+
Provider: kmapi.HostingProvider(cm.Data["provider"]),
97+
OwnerID: cm.Data["ownerID"],
98+
OwnerType: cm.Data["ownerType"],
99+
APIEndpoint: cm.Data["apiEndpoint"],
100+
CABundle: cm.Data["ca.crt"],
101+
CloudServiceAuthMode: cm.Data["cloudServiceAuthMode"],
101102
}
102103

103104
data, err := json.Marshal(md)
@@ -148,6 +149,7 @@ func UpsertClusterMetadata(kc client.Client, md *kmapi.ClusterMetadata) error {
148149
cm.Data["ownerType"] = md.OwnerType
149150
cm.Data["apiEndpoint"] = md.APIEndpoint
150151
cm.Data["ca.crt"] = md.CABundle
152+
cm.Data["cloudServiceAuthMode"] = md.CloudServiceAuthMode
151153

152154
cm.BinaryData = map[string][]byte{
153155
"mac": messageMAC,

‎vendor/modules.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1675,7 +1675,7 @@ k8s.io/utils/path
16751675
k8s.io/utils/pointer
16761676
k8s.io/utils/ptr
16771677
k8s.io/utils/trace
1678-
# kmodules.xyz/client-go v0.32.2
1678+
# kmodules.xyz/client-go v0.32.4
16791679
## explicit; go 1.23.0
16801680
kmodules.xyz/client-go
16811681
kmodules.xyz/client-go/api/v1

0 commit comments

Comments
 (0)