Skip to content

Commit 77c1f5e

Browse files
author
Joshua Reed
committed
Merge branch 'main' into feature/multi-endpoint-failure-domains
2 parents aa3786a + 99cda28 commit 77c1f5e

File tree

8 files changed

+217
-1
lines changed

8 files changed

+217
-1
lines changed

‎Makefile

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,11 +63,16 @@ config/.flag.mk: bin/controller-gen $(MANIFEST_GEN_INPUTS)
6363
.PHONY: release-manifests
6464
RELEASE_MANIFEST_TARGETS=$(RELEASE_DIR)/infrastructure-components.yaml $(RELEASE_DIR)/metadata.yaml
6565
RELEASE_MANIFEST_INPUTS=bin/kustomize config/.flag.mk $(shell find config)
66+
RELEASE_MANIFEST_SOURCE_BASE ?= config/default
6667
release-manifests: $(RELEASE_MANIFEST_TARGETS) ## Create kustomized release manifest in $RELEASE_DIR (defaults to out).
6768
$(RELEASE_DIR)/%: $(RELEASE_MANIFEST_INPUTS)
6869
@mkdir -p $(RELEASE_DIR)
6970
cp metadata.yaml $(RELEASE_DIR)/metadata.yaml
70-
kustomize build config/default > $(RELEASE_DIR)/infrastructure-components.yaml
71+
kustomize build $(RELEASE_MANIFEST_SOURCE_BASE) > $(RELEASE_DIR)/infrastructure-components.yaml
72+
73+
.PHONY: release-manifests-metrics-port
74+
release-manifests-metrics-port:
75+
make release-manifests RELEASE_MANIFEST_SOURCE_BASE=config/default-with-metrics-port
7176

7277
DEEPCOPY_GEN_TARGETS=$(shell find api -type d -name "v*" -exec echo {}\/zz_generated.deepcopy.go \;)
7378
DEEPCOPY_GEN_INPUTS=$(shell find ./api -name "*test*" -prune -o -name "*zz_generated*" -prune -o -type f -print)

‎config/default-with-metrics-port/auth_proxy_client_clusterrole.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: metrics-reader
5+
rules:
6+
- nonResourceURLs:
7+
- "/metrics"
8+
verbs:
9+
- get

‎config/default-with-metrics-port/auth_proxy_role.yaml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: proxy-role
5+
rules:
6+
- apiGroups:
7+
- authentication.k8s.io
8+
resources:
9+
- tokenreviews
10+
verbs:
11+
- create
12+
- apiGroups:
13+
- authorization.k8s.io
14+
resources:
15+
- subjectaccessreviews
16+
verbs:
17+
- create

‎config/default-with-metrics-port/auth_proxy_role_binding.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
name: proxy-rolebinding
5+
roleRef:
6+
apiGroup: rbac.authorization.k8s.io
7+
kind: ClusterRole
8+
name: proxy-role
9+
subjects:
10+
- kind: ServiceAccount
11+
name: controller-manager
12+
namespace: system

‎config/default-with-metrics-port/auth_proxy_service.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
labels:
5+
control-plane: controller-manager
6+
name: controller-manager-metrics-service
7+
namespace: system
8+
spec:
9+
ports:
10+
- name: https
11+
port: 8443
12+
protocol: TCP
13+
targetPort: https
14+
selector:
15+
control-plane: capc-controller-manager

‎config/default-with-metrics-port/kustomization.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
4+
bases:
5+
- ../default
6+
7+
resources:
8+
- auth_proxy_client_clusterrole.yaml
9+
- auth_proxy_role.yaml
10+
- auth_proxy_role_binding.yaml
11+
- auth_proxy_service.yaml
12+
13+
patchesStrategicMerge:
14+
- manager_auth_proxy_patch.yaml

‎config/default-with-metrics-port/manager_auth_proxy_patch.yaml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# This patch inject a sidecar container which is a HTTP proxy for the
2+
# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
3+
apiVersion: apps/v1
4+
kind: Deployment
5+
metadata:
6+
name: controller-manager
7+
namespace: system
8+
spec:
9+
template:
10+
spec:
11+
containers:
12+
- name: kube-rbac-proxy
13+
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0
14+
args:
15+
- "--secure-listen-address=0.0.0.0:8443"
16+
- "--upstream=http://127.0.0.1:8080/"
17+
- "--logtostderr=true"
18+
- "--v=10"
19+
ports:
20+
- containerPort: 8443
21+
protocol: TCP
22+
name: https

‎hack/update_route_53.sh

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
#!/bin/bash
2+
set -eu
3+
4+
zone_name=
5+
profile="default"
6+
7+
export AWS_DEFAULT_OUTPUT="json"
8+
9+
help() {
10+
echo "Continually queries Kubernetes for control plane machines and adds their IP address to an Amazon Route 53"
11+
echo "recordset. The recordset name will be cp, and it will be created in the specified zone. If a recordset"
12+
echo "already exists with that name, it will first be deleted."
13+
echo
14+
echo "The Route 53 zone has to already exist. You can create one in the AWS console."
15+
echo
16+
echo "Before running this script, configure kubectl with the proper kubeconfig and namespace so it can get the"
17+
echo "cluster machines."
18+
echo
19+
echo "This script is not intended for production use."
20+
echo
21+
echo "USAGE: $0 -z <zone name> [-p <AWS profile name>]"
22+
}
23+
24+
if [[ $# -eq 0 ]]
25+
then
26+
help
27+
exit 2
28+
fi
29+
30+
short_opts='z:p:h'
31+
long_opts='zone:,profile:,help'
32+
parsed_opts=$(getopt 'z:p:h' $*)
33+
eval set -- $parsed_opts
34+
35+
while true
36+
do
37+
case "$1" in
38+
-z)
39+
zone_name="$2"
40+
shift 2
41+
;;
42+
-p)
43+
profile="$2"
44+
shift 2
45+
;;
46+
-h)
47+
shift
48+
help
49+
exit 0
50+
;;
51+
--)
52+
shift
53+
break
54+
;;
55+
*)
56+
echo "Impossible value found. This is a bug."
57+
exit 1
58+
;;
59+
esac
60+
done
61+
62+
if [[ -z $zone_name ]]
63+
then
64+
echo "Missing zone name"
65+
exit 1
66+
fi
67+
68+
# Zone name must end with a period, but the user doesn't need to know that. Add one if it's missing.
69+
if [[ ! $zone_name =~ [.]$ ]]
70+
then
71+
zone_name=$zone_name.
72+
fi
73+
74+
recordset_name="cp.$zone_name"
75+
76+
echo "Getting the zone ID from AWS"
77+
zone_id=$(aws route53 list-hosted-zones --profile "$profile" | jq -r '.HostedZones[] | select(.Name == "'"$zone_name"'").Id | split("/")[2]')
78+
if [[ -n $zone_id ]]
79+
then
80+
echo "Found zone $zone_name"
81+
else
82+
echo "Zone $zone_name not found. Please create it first."
83+
exit 1
84+
fi
85+
86+
get_recordset() {
87+
aws route53 list-resource-record-sets --profile "$profile" --hosted-zone-id "$zone_id" | jq -r '.ResourceRecordSets[] | select(.Name == "'"$recordset_name"'")'
88+
}
89+
90+
upsert_addresses() {
91+
local addresses=$1
92+
echo "Replacing old records"
93+
local recordset='{"Name":"'"$recordset_name"'","Type":"A","TTL":10,"ResourceRecords":[]}'
94+
for address in $addresses
95+
do
96+
echo "Adding $address"
97+
recordset=$(echo "$recordset" | jq -r --arg a "$address" '.ResourceRecords += [{"Value":$a}]')
98+
done
99+
local batch=$(jq -r -n --argjson rs "$recordset" '{"Changes":[{"Action":"UPSERT","ResourceRecordSet":$rs}]}')
100+
aws route53 change-resource-record-sets --profile "$profile" --hosted-zone-id "$zone_id" --change-batch "$batch" > /dev/null
101+
}
102+
103+
# If the recordset exists from a previous run, delete it.
104+
old_recordset=$(get_recordset)
105+
if [[ -n $old_recordset ]]
106+
then
107+
echo "Deleting recordset $recordset_name"
108+
aws route53 change-resource-record-sets --profile "$profile" --hosted-zone-id "$zone_id" --change-batch '{"Changes":[{"Action":"DELETE","ResourceRecordSet":'"$old_recordset"'}]}' > /dev/null
109+
fi
110+
111+
echo "Watching for control plane machines..."
112+
old_addresses=
113+
while true
114+
do
115+
addresses=$(kubectl get machines -A -o json | jq -r '.items[] | select(.metadata.labels."cluster.x-k8s.io/control-plane" != null) | .status | select(.addresses!=null) | .addresses[].address')
116+
if [[ $addresses != "$old_addresses" ]]
117+
then
118+
upsert_addresses "$addresses"
119+
fi
120+
old_addresses=$addresses
121+
sleep 5
122+
done

0 commit comments

Comments
 (0)