Skip to content

Handle csr and token based addon registration #57

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tamalsaha merged 2 commits into from
Feb 26, 2026
Merged

Handle csr and token based addon registration #57

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ac568dd
Handle csr and token based addon registration
RokibulHasan7 Feb 24, 2026
f9abbbc
Update appversion
tamalsaha Feb 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions apis/proxyserver/v1alpha1/openapi_generated.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 4 additions & 0 deletions pkg/apiserver/apiserver.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,8 @@ import (
"k8s.io/klog/v2"
cu "kmodules.xyz/client-go/client"
clustermeta "kmodules.xyz/client-go/cluster"
addonv1alpha1 "open-cluster-management.io/api/addon/v1alpha1"
addonv1beta1 "open-cluster-management.io/api/addon/v1beta1"
clusterv1alpha1 "open-cluster-management.io/api/cluster/v1alpha1"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/cache"
Expand All @@ -70,6 +72,8 @@ func init() {
utilruntime.Must(clientgoscheme.AddToScheme(Scheme))
utilruntime.Must(clusterv1alpha1.Install(Scheme))
utilruntime.Must(core.AddToScheme(Scheme))
utilruntime.Must(addonv1alpha1.Install(Scheme))
utilruntime.Must(addonv1beta1.Install(Scheme))

// we need to add the options to empty v1
// TODO fix the server code to avoid this
Expand Down
2 changes: 1 addition & 1 deletion pkg/manager/agent-manifests/license-proxyserver/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: v1
description: Kubernetes license-proxyserver by AppsCode
name: license-proxyserver
version: v2026.1.15
appVersion: v0.0.26
appVersion: v0.1.0
home: https://github.com/appscode-cloud/license-proxyserver
icon: https://cdn.appscode.com/images/products/searchlight/icons/android-icon-192x192.png
sources:
Expand Down
7 changes: 4 additions & 3 deletions pkg/manager/manager.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@ import (
"open-cluster-management.io/api/addon/v1alpha1"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/cache"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/log"
"sigs.k8s.io/controller-runtime/pkg/manager"
metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
Expand All @@ -52,11 +53,11 @@ import (
//go:embed all:agent-manifests
var FS embed.FS

func NewRegistrationOption(kubeConfig *rest.Config, addonName, agentName string) *agent.RegistrationOption {
func NewRegistrationOption(restConfig *rest.Config, kc client.Client, addonName, agentName string) *agent.RegistrationOption {
return &agent.RegistrationOption{
CSRConfigurations: agent.KubeClientSignerConfigurations(addonName, agentName),
CSRApproveCheck: agent.ApprovalAllCSRs,
PermissionConfig: rbac.SetupPermission(kubeConfig, agentName),
PermissionConfig: rbac.SetupPermission(restConfig, kc, agentName),
AgentInstallNamespace: func(addon *v1alpha1.ManagedClusterAddOn) (string, error) {
return common.AddonInstallationNamespace, nil
},
Expand Down Expand Up @@ -140,7 +141,7 @@ func runManagerController(ctx context.Context, cfg *rest.Config, opts *ManagerOp
os.Exit(1)
}

registrationOption := NewRegistrationOption(cfg, common.AddonName, common.AgentName)
registrationOption := NewRegistrationOption(cfg, hubManager.GetClient(), common.AddonName, common.AgentName)

addonManager, err := addonmanager.New(cfg)
if err != nil {
Expand Down
28 changes: 24 additions & 4 deletions pkg/manager/rbac/rbac.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@ package rbac
import (
"context"

"go.bytebuilders.dev/license-proxyserver/pkg/common"

rbacv1 "k8s.io/api/rbac/v1"
apierrors "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
Expand All @@ -27,12 +29,14 @@ import (
"k8s.io/utils/ptr"
"open-cluster-management.io/addon-framework/pkg/agent"
addonv1alpha1 "open-cluster-management.io/api/addon/v1alpha1"
addonv1beta1 "open-cluster-management.io/api/addon/v1beta1"
clusterv1 "open-cluster-management.io/api/cluster/v1"
"sigs.k8s.io/controller-runtime/pkg/client"
)

func SetupPermission(kubeConfig *rest.Config, agentName string) agent.PermissionConfigFunc {
func SetupPermission(restConfig *rest.Config, kc client.Client, agentName string) agent.PermissionConfigFunc {
return func(cluster *clusterv1.ManagedCluster, addon *addonv1alpha1.ManagedClusterAddOn) error {
nativeClient, err := kubernetes.NewForConfig(kubeConfig)
nativeClient, err := kubernetes.NewForConfig(restConfig)
if err != nil {
return err
}
Expand Down Expand Up @@ -81,12 +85,28 @@ func SetupPermission(kubeConfig *rest.Config, agentName string) agent.Permission
},
Subjects: []rbacv1.Subject{
{
Kind: rbacv1.UserKind,
Name: agentUser,
Kind: "ServiceAccount",
Name: common.AddonName + "-agent",
},
},
}

managedClusterAddon := &addonv1beta1.ManagedClusterAddOn{}
if err := kc.Get(context.TODO(), client.ObjectKey{Namespace: namespace, Name: addon.Name}, managedClusterAddon); err != nil {
return err
}

for _, reg := range managedClusterAddon.Status.Registrations {
if reg.Type == addonv1beta1.KubeClient && reg.KubeClient.Driver == "csr" {
roleBinding.Subjects = []rbacv1.Subject{
{
Kind: "User",
Name: agentUser,
},
}
}
}

_, err = nativeClient.RbacV1().Roles(cluster.Name).Get(context.TODO(), role.Name, metav1.GetOptions{})
switch {
case apierrors.IsNotFound(err):
Expand Down
Loading