Skip to content

Commit 625daf0

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #1360 from nader-ziada/ci-identity
Use AzureClusterIdentity when running ci e2e tests
2 parents d6a8184 + c85e4df commit 625daf0

File tree

94 files changed

+7410
-1041
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

94 files changed

+7410
-1041
lines changed

‎Makefile‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -472,6 +472,9 @@ create-management-cluster: $(KUSTOMIZE) $(ENVSUBST)
472472
# Install cert manager and wait for availability
473473
./hack/install-cert-manager.sh
474474

475+
# Create secret for AzureClusterIdentity
476+
./hack/create-identity-secret.sh
477+
475478
# Deploy CAPI
476479
curl --retry $(CURL_RETRIES) -sSL https://github.com/kubernetes-sigs/cluster-api/releases/download/v0.4.0/cluster-api-components.yaml | $(ENVSUBST) | kubectl apply -f -
477480

‎Tiltfile‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,19 @@ def capz():
169169

170170
k8s_yaml(blob(yaml))
171171

172+
def create_identity_secret():
173+
#create secret for identity password
174+
local("kubectl delete secret cluster-identity-secret --ignore-not-found=true")
175+
176+
os.putenv('AZURE_CLUSTER_IDENTITY_SECRET_NAME', 'cluster-identity-secret')
177+
os.putenv('AZURE_CLUSTER_IDENTITY_SECRET_NAMESPACE', 'default')
178+
os.putenv('CLUSTER_IDENTITY_NAME', 'cluster-identity')
179+
180+
substitutions = settings.get("kustomize_substitutions", {})
181+
os.putenv('AZURE_CLIENT_SECRET_B64', substitutions.get("AZURE_CLIENT_SECRET_B64"))
182+
183+
local("cat templates/azure-cluster-identity/secret.yaml | " + envsubst_cmd + " | kubectl apply -f -", quiet=True)
184+
172185
def create_crs():
173186
# create config maps
174187
local("kubectl delete configmaps calico-addon --ignore-not-found=true")
@@ -324,6 +337,8 @@ if settings.get("deploy_cert_manager"):
324337

325338
deploy_capi()
326339

340+
create_identity_secret()
341+
327342
capz()
328343

329344
waitforsystem()

‎azure/scope/identity.go‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,12 @@ func (p *AzureCredentialsProvider) GetAuthorizer(ctx context.Context, resourceMa
142142
if err != nil {
143143
return nil, err
144144
}
145+
146+
// AzureIdentity and AzureIdentityBinding will no longer have an OwnerRef starting from capz release v0.5.0 because of the following:
147+
// In Kubenetes v1.20+, if the garbage collector detects an invalid cross-namespace ownerReference, or a cluster-scoped dependent with
148+
// an ownerReference referencing a namespaced kind, a warning Event with a reason of OwnerRefInvalidNamespace and an involvedObject
149+
// of the invalid dependent is reported. You can check for that kind of Event by running kubectl get events -A --field-selector=reason=OwnerRefInvalidNamespace.
150+
145151
copiedIdentity := &aadpodv1.AzureIdentity{
146152
TypeMeta: metav1.TypeMeta{
147153
Kind: "AzureIdentity",
@@ -154,11 +160,10 @@ func (p *AzureCredentialsProvider) GetAuthorizer(ctx context.Context, resourceMa
154160
aadpodv1.BehaviorKey: "namespaced",
155161
},
156162
Labels: map[string]string{
157-
clusterv1.ClusterLabelName: clusterMeta.Name,
158-
infrav1.ClusterLabelNamespace: clusterMeta.Namespace,
159-
clusterctl.ClusterctlMoveLabelName: "true",
163+
clusterv1.ClusterLabelName: clusterMeta.Name,
164+
infrav1.ClusterLabelNamespace: clusterMeta.Namespace,
165+
clusterctl.ClusterctlMoveHierarchyLabelName: "true",
160166
},
161-
OwnerReferences: clusterMeta.OwnerReferences,
162167
},
163168
Spec: aadpodv1.AzureIdentitySpec{
164169
Type: azureIdentityType,
@@ -182,11 +187,10 @@ func (p *AzureCredentialsProvider) GetAuthorizer(ctx context.Context, resourceMa
182187
Name: fmt.Sprintf("%s-binding", copiedIdentity.Name),
183188
Namespace: copiedIdentity.Namespace,
184189
Labels: map[string]string{
185-
clusterv1.ClusterLabelName: clusterMeta.Name,
186-
infrav1.ClusterLabelNamespace: clusterMeta.Namespace,
187-
clusterctl.ClusterctlMoveLabelName: "true",
190+
clusterv1.ClusterLabelName: clusterMeta.Name,
191+
infrav1.ClusterLabelNamespace: clusterMeta.Namespace,
192+
clusterctl.ClusterctlMoveHierarchyLabelName: "true",
188193
},
189-
OwnerReferences: clusterMeta.OwnerReferences,
190194
},
191195
Spec: aadpodv1.AzureIdentityBindingSpec{
192196
AzureIdentity: copiedIdentity.Name,

‎config/default/aad-pod-identity-deployment.yaml‎

Lines changed: 196 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,212 @@
11
---
2-
apiVersion: apiextensions.k8s.io/v1beta1
2+
apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
5-
name: azureidentitybindings.aadpodidentity.k8s.io
5+
annotations:
6+
api-approved.kubernetes.io: unapproved
7+
controller-gen.kubebuilder.io/version: v0.5.0
8+
name: azureidentities.aadpodidentity.k8s.io
69
spec:
710
group: aadpodidentity.k8s.io
8-
version: v1
911
names:
10-
kind: AzureIdentityBinding
11-
plural: azureidentitybindings
12+
kind: AzureIdentity
13+
listKind: AzureIdentityList
14+
plural: azureidentities
15+
singular: azureidentity
1216
scope: Namespaced
17+
versions:
18+
- name: v1
19+
schema:
20+
openAPIV3Schema:
21+
description: AzureIdentity is the specification of the identity data structure.
22+
properties:
23+
apiVersion:
24+
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
25+
type: string
26+
kind:
27+
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
28+
type: string
29+
metadata:
30+
type: object
31+
spec:
32+
description: AzureIdentitySpec describes the credential specifications of an identity on Azure.
33+
properties:
34+
adEndpoint:
35+
type: string
36+
adResourceID:
37+
description: For service principal. Option param for specifying the AD details.
38+
type: string
39+
auxiliaryTenantIDs:
40+
description: Service principal auxiliary tenant ids
41+
items:
42+
type: string
43+
nullable: true
44+
type: array
45+
clientID:
46+
description: Both User Assigned MSI and SP can use this field.
47+
type: string
48+
clientPassword:
49+
description: Used for service principal
50+
properties:
51+
name:
52+
description: Name is unique within a namespace to reference a secret resource.
53+
type: string
54+
namespace:
55+
description: Namespace defines the space within which the secret name must be unique.
56+
type: string
57+
type: object
58+
metadata:
59+
type: object
60+
replicas:
61+
format: int32
62+
nullable: true
63+
type: integer
64+
resourceID:
65+
description: User assigned MSI resource id.
66+
type: string
67+
tenantID:
68+
description: Service principal primary tenant id.
69+
type: string
70+
type:
71+
description: UserAssignedMSI or Service Principal
72+
type: integer
73+
type: object
74+
status:
75+
description: AzureIdentityStatus contains the replica status of the resource.
76+
properties:
77+
availableReplicas:
78+
format: int32
79+
type: integer
80+
metadata:
81+
type: object
82+
type: object
83+
type: object
84+
served: true
85+
storage: true
86+
status:
87+
acceptedNames:
88+
kind: ""
89+
plural: ""
90+
conditions: []
91+
storedVersions: []
1392
---
14-
apiVersion: apiextensions.k8s.io/v1beta1
93+
apiVersion: apiextensions.k8s.io/v1
1594
kind: CustomResourceDefinition
1695
metadata:
17-
name: azureidentities.aadpodidentity.k8s.io
96+
annotations:
97+
api-approved.kubernetes.io: unapproved
98+
controller-gen.kubebuilder.io/version: v0.5.0
99+
name: azureidentitybindings.aadpodidentity.k8s.io
18100
spec:
19101
group: aadpodidentity.k8s.io
20-
version: v1
21102
names:
22-
kind: AzureIdentity
23-
singular: azureidentity
24-
plural: azureidentities
103+
kind: AzureIdentityBinding
104+
listKind: AzureIdentityBindingList
105+
plural: azureidentitybindings
106+
singular: azureidentitybinding
25107
scope: Namespaced
108+
versions:
109+
- name: v1
110+
schema:
111+
openAPIV3Schema:
112+
description: AzureIdentityBinding brings together the spec of matching pods and the identity which they can use.
113+
properties:
114+
apiVersion:
115+
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
116+
type: string
117+
kind:
118+
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
119+
type: string
120+
metadata:
121+
type: object
122+
spec:
123+
description: AzureIdentityBindingSpec matches the pod with the Identity. Used to indicate the potential matches to look for between the pod/deployment and the identities present.
124+
properties:
125+
azureIdentity:
126+
type: string
127+
metadata:
128+
type: object
129+
selector:
130+
type: string
131+
weight:
132+
description: Weight is used to figure out which of the matching identities would be selected.
133+
type: integer
134+
type: object
135+
status:
136+
description: AzureIdentityBindingStatus contains the status of an AzureIdentityBinding.
137+
properties:
138+
availableReplicas:
139+
format: int32
140+
type: integer
141+
metadata:
142+
type: object
143+
type: object
144+
type: object
145+
served: true
146+
storage: true
147+
status:
148+
acceptedNames:
149+
kind: ""
150+
plural: ""
151+
conditions: []
152+
storedVersions: []
26153
---
27-
apiVersion: apiextensions.k8s.io/v1beta1
154+
apiVersion: apiextensions.k8s.io/v1
28155
kind: CustomResourceDefinition
29156
metadata:
157+
annotations:
158+
api-approved.kubernetes.io: unapproved
159+
controller-gen.kubebuilder.io/version: v0.5.0
30160
name: azurepodidentityexceptions.aadpodidentity.k8s.io
31161
spec:
32162
group: aadpodidentity.k8s.io
33-
version: v1
34163
names:
35164
kind: AzurePodIdentityException
36-
singular: azurepodidentityexception
165+
listKind: AzurePodIdentityExceptionList
37166
plural: azurepodidentityexceptions
167+
singular: azurepodidentityexception
38168
scope: Namespaced
169+
versions:
170+
- name: v1
171+
schema:
172+
openAPIV3Schema:
173+
description: AzurePodIdentityException contains the pod selectors for all pods that don't require NMI to process and request token on their behalf.
174+
properties:
175+
apiVersion:
176+
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
177+
type: string
178+
kind:
179+
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
180+
type: string
181+
metadata:
182+
type: object
183+
spec:
184+
description: AzurePodIdentityExceptionSpec matches pods with the selector defined. If request originates from a pod that matches the selector, nmi will proxy the request and send response back without any validation.
185+
properties:
186+
metadata:
187+
type: object
188+
podLabels:
189+
additionalProperties:
190+
type: string
191+
type: object
192+
type: object
193+
status:
194+
description: AzurePodIdentityExceptionStatus contains the status of an AzurePodIdentityException.
195+
properties:
196+
metadata:
197+
type: object
198+
status:
199+
type: string
200+
type: object
201+
type: object
202+
served: true
203+
storage: true
204+
status:
205+
acceptedNames:
206+
kind: ""
207+
plural: ""
208+
conditions: []
209+
storedVersions: []
39210
---
40211
apiVersion: rbac.authorization.k8s.io/v1
41212
kind: ClusterRole
@@ -76,7 +247,7 @@ metadata:
76247
labels:
77248
component: nmi
78249
tier: node
79-
k8s-app: aad-pod-id
250+
k8s-app: aad-pod-id
80251
name: nmi
81252
namespace: capz-system
82253
spec:
@@ -106,13 +277,13 @@ spec:
106277
type: FileOrCreate
107278
containers:
108279
- name: nmi
109-
image: "mcr.microsoft.com/oss/azure/aad-pod-identity/nmi:v1.7.1"
280+
image: "mcr.microsoft.com/oss/azure/aad-pod-identity/nmi:v1.8.0"
110281
imagePullPolicy: IfNotPresent
111282
args:
112283
- "--node=$(NODE_NAME)"
113-
- "--forceNamespaced"
114-
- "--http-probe-port=8085"
115284
- "--operation-mode=managed"
285+
- "--forceNamespaced"
286+
- "--http-probe-port=8085"
116287
env:
117288
- name: FORCENAMESPACED
118289
value: "true"
@@ -124,6 +295,8 @@ spec:
124295
valueFrom:
125296
fieldRef:
126297
fieldPath: spec.nodeName
298+
- name: LOG_LEVEL
299+
value: DEBUG
127300
resources:
128301
limits:
129302
cpu: 200m
@@ -134,14 +307,18 @@ spec:
134307
securityContext:
135308
runAsUser: 0
136309
capabilities:
310+
drop:
311+
- ALL
137312
add:
313+
- DAC_READ_SEARCH
138314
- NET_ADMIN
315+
- NET_RAW
139316
volumeMounts:
140317
- mountPath: /run/xtables.lock
141318
name: iptableslock
142319
- name: kubelet-config
143320
mountPath: /etc/default/kubelet
144-
readOnly: true
321+
readOnly: true
145322
livenessProbe:
146323
httpGet:
147324
path: /healthz

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ module sigs.k8s.io/cluster-api-provider-azure
33
go 1.16
44

55
require (
6-
github.com/Azure/aad-pod-identity v1.7.1
6+
github.com/Azure/aad-pod-identity v1.8.0
77
github.com/Azure/azure-sdk-for-go v55.2.0+incompatible
88
github.com/Azure/go-autorest/autorest v0.11.18
99
github.com/Azure/go-autorest/autorest/adal v0.9.13

0 commit comments

Comments
 (0)