Skip to content

Commit 66e8901

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #730 from vinayakankugoyal/byebye
Remove all GKE specific code from gcp-controller-manager.
2 parents 0844bce + b7fd529 commit 66e8901

34 files changed

+27
-7282
lines changed

‎cloudbuild.yaml

Lines changed: 0 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -9,18 +9,6 @@ steps:
99
- IMAGE_REPO=${_IMAGE_REPO}
1010
- IMAGE_TAG=${_PULL_BASE_REF}
1111
entrypoint: tools/push-images
12-
# build gke-exec-auth-plugin binary
13-
- name: 'gcr.io/cloud-builders/bazel'
14-
args:
15-
- --output_user_root=/workspace/bazel-root
16-
- --output_base=/workspace/bazel-base-linux-amd64
17-
- build
18-
- //cmd/gke-exec-auth-plugin
19-
- name: 'gcr.io/cloud-builders/gsutil'
20-
args:
21-
- cp
22-
- /workspace/bazel-base-linux-amd64/execroot/io_k8s_cloud_provider_gcp/bazel-out/k8-fastbuild/bin/cmd/gke-exec-auth-plugin/gke-exec-auth-plugin_/gke-exec-auth-plugin
23-
- gs://k8s-staging-cloud-provider-gcp/gke-exec-auth-plugin/linux-amd64/${_GIT_TAG}
2412
# build gke-gcloud-auth-plugin binary
2513
- name: 'gcr.io/cloud-builders/bazel'
2614
args:
@@ -45,19 +33,6 @@ steps:
4533
- cp
4634
- /workspace/bazel-base-linux-amd64/execroot/io_k8s_cloud_provider_gcp/bazel-out/k8-fastbuild/bin/cmd/auth-provider-gcp/auth-provider-gcp_/auth-provider-gcp
4735
- gs://k8s-staging-cloud-provider-gcp/auth-provider-gcp/linux-amd64/${_GIT_TAG}
48-
# build gke-exec-auth-plugin binary
49-
- name: 'gcr.io/cloud-builders/bazel'
50-
args:
51-
- --output_user_root=/workspace/bazel-root
52-
- --output_base=/workspace/bazel-base-linux-arm64
53-
- build
54-
- --platforms=@io_bazel_rules_go//go/toolchain:linux_arm64
55-
- //cmd/gke-exec-auth-plugin
56-
- name: 'gcr.io/cloud-builders/gsutil'
57-
args:
58-
- cp
59-
- /workspace/bazel-base-linux-arm64/execroot/io_k8s_cloud_provider_gcp/bazel-out/k8-fastbuild/bin/cmd/gke-exec-auth-plugin/gke-exec-auth-plugin_/gke-exec-auth-plugin
60-
- gs://k8s-staging-cloud-provider-gcp/gke-exec-auth-plugin/linux-arm64/${_GIT_TAG}
6136
# build gke-gcloud-auth-plugin binary
6237
- name: 'gcr.io/cloud-builders/bazel'
6338
args:
@@ -84,19 +59,6 @@ steps:
8459
- cp
8560
- /workspace/bazel-base-linux-arm64/execroot/io_k8s_cloud_provider_gcp/bazel-out/k8-fastbuild/bin/cmd/auth-provider-gcp/auth-provider-gcp_/auth-provider-gcp
8661
- gs://k8s-staging-cloud-provider-gcp/auth-provider-gcp/linux-arm64/${_GIT_TAG}
87-
# build gke-exec-auth-plugin binary
88-
- name: 'gcr.io/cloud-builders/bazel'
89-
args:
90-
- --output_user_root=/workspace/bazel-root
91-
- --output_base=/workspace/bazel-base-windows-amd64
92-
- build
93-
- --platforms=@io_bazel_rules_go//go/toolchain:windows_amd64
94-
- //cmd/gke-exec-auth-plugin
95-
- name: 'gcr.io/cloud-builders/gsutil'
96-
args:
97-
- cp
98-
- /workspace/bazel-base-windows-amd64/execroot/io_k8s_cloud_provider_gcp/bazel-out/k8-fastbuild/bin/cmd/gke-exec-auth-plugin/gke-exec-auth-plugin_/gke-exec-auth-plugin.exe
99-
- gs://k8s-staging-cloud-provider-gcp/gke-exec-auth-plugin/windows-amd64/${_GIT_TAG}
10062
# build gke-gcloud-auth-plugin binary
10163
- name: 'gcr.io/cloud-builders/bazel'
10264
args:

‎cmd/gcp-controller-manager/BUILD

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,11 +46,8 @@ go_library(
4646
"//cmd/gcp-controller-manager/healthz",
4747
"//pkg/clientauthplugin/gcp",
4848
"//pkg/csrmetrics",
49-
"//pkg/nodeidentity",
50-
"//pkg/tpmattest",
5149
"//providers/gce",
5250
"//vendor/cloud.google.com/go/compute/metadata",
53-
"//vendor/github.com/google/go-tpm/tpm2",
5451
"//vendor/github.com/prometheus/client_golang/prometheus/promhttp",
5552
"//vendor/github.com/spf13/pflag",
5653
"//vendor/golang.org/x/oauth2",
@@ -123,10 +120,8 @@ go_test(
123120
embed = [":gcp-controller-manager_lib"],
124121
deps = [
125122
"//pkg/nodeidentity",
126-
"//pkg/tpmattest",
127123
"//vendor/github.com/google/go-cmp/cmp",
128124
"//vendor/github.com/google/go-cmp/cmp/cmpopts",
129-
"//vendor/github.com/google/go-tpm/tpm2",
130125
"//vendor/google.golang.org/api/compute/v0.beta:v0_beta",
131126
"//vendor/google.golang.org/api/compute/v1:compute",
132127
"//vendor/google.golang.org/api/container/v1:container",

‎cmd/gcp-controller-manager/csr_signer.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ func newGKESigner(ctx *controllerContext) (*gkeSigner, error) {
6969
webhook: webhook,
7070
ctx: ctx,
7171
retryBackoff: ClusterSigningGKERetryBackoff,
72-
validators: csrValidators(ctx),
72+
validators: csrValidators(),
7373
}, nil
7474
}
7575

‎cmd/gcp-controller-manager/loops.go

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,9 +41,6 @@ type controllerContext struct {
4141
recorder record.EventRecorder
4242
gcpCfg gcpConfig
4343
clusterSigningGKEKubeconfig string
44-
csrApproverVerifyClusterMembership bool
45-
csrApproverAllowLegacyKubelet bool
46-
csrApproverListReferrersConfig gceInstanceListReferrersConfig
4744
authAuthorizeServiceAccountMappingURL string
4845
authSyncNodeURL string
4946
hmsAuthorizeSAMappingURL string

‎cmd/gcp-controller-manager/main.go

Lines changed: 21 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -60,28 +60,23 @@ const (
6060
)
6161

6262
var (
63-
port = pflag.Int("port", 8089, "Port to serve status endpoints on (such as /healthz and /metrics).")
64-
metricsPort = pflag.Int("metrics-port", 8089, "Deprecated. Port to expose Prometheus metrics on. If not set, uses the value of --port.")
65-
kubeconfig = pflag.String("kubeconfig", "", "Path to kubeconfig file with authorization and master location information.")
66-
clusterSigningGKEKubeconfig = pflag.String("cluster-signing-gke-kubeconfig", "", "If set, use the kubeconfig file to call GKE to sign cluster-scoped certificates instead of using a local private key.")
67-
gceConfigPath = pflag.String("gce-config", "/etc/gce.conf", "Path to gce.conf.")
68-
controllers = pflag.StringSlice("controllers", []string{"*"}, "Controllers to enable. Possible controllers are: "+strings.Join(loopNames(), ",")+".")
69-
csrApproverVerifyClusterMembership = pflag.Bool("csr-validate-cluster-membership", true, "Validate that VMs requesting CSRs belong to current GKE cluster.")
70-
csrApproverAllowLegacyKubelet = pflag.Bool("csr-allow-legacy-kubelet", true, "Allow legacy kubelet bootstrap flow.")
71-
csrApproverUseGCEInstanceListReferrers = pflag.Bool("csr-use-gce-instance-list-referrers", false, "If true use https://cloud.google.com/compute/docs/reference/rest/v1/instances/listReferrers to validate instance cluster membership.")
72-
csrApproverListReferrersInitialInterval = pflag.Duration("csr-gce-list-referrers-initial-interval", 5*time.Second, "Initial interval of the exponential back-off retries for calls to listReferrers, exponential factor is set to 1.5, defaults to 5s.")
73-
csrApproverListReferrersRetryCount = pflag.Int("csr-gce-list-referrers-retry-count", 10, "Maximal number of retries in exponential back-off for calls to listReferrers, defaults to 10")
74-
gceAPIEndpointOverride = pflag.String("gce-api-endpoint-override", "", "If set, talks to a different GCE API Endpoint. By default it talks to https://www.googleapis.com/compute/v1/projects/")
75-
directPath = pflag.Bool("direct-path", false, "Enable Direct Path.")
76-
authAuthorizeServiceAccountMappingURL = pflag.String("auth-authorize-service-account-mapping-url", "", "URL for reaching the Auth Service AuthorizeServiceAccountMapping API.")
77-
authSyncNodeURL = pflag.String("auth-sync-node-url", "", "URL for reaching the Auth Service SyncNode API.")
78-
hmsAuthorizeSAMappingURL = pflag.String("hms-authorize-sa-mapping-url", "", "URL for reaching the Hosted Master Service AuthorizeSAMapping API.")
79-
hmsSyncNodeURL = pflag.String("hms-sync-node-url", "", "URL for reaching the Hosted Master Service SyncNode API.")
80-
kubeletReadOnlyCSRApprover = pflag.Bool("kubelet-read-only-csr-approver", false, "Enable kubelet readonly csr approver or not")
81-
autopilotEnabled = pflag.Bool("autopilot", false, "Is this a GKE Autopilot cluster.")
82-
clearStalePodsOnNodeRegistration = pflag.Bool("clearStalePodsOnNodeRegistration", false, "If true, after node registration, delete pods bound to old node.")
83-
kubeconfigQPS = pflag.Float32("kubeconfig-qps", 100, "QPS to use while talking with kube-apiserver.")
84-
kubeconfigBurst = pflag.Int("kubeconfig-burst", 200, "Burst to use while talking with kube-apiserver.")
63+
port = pflag.Int("port", 8089, "Port to serve status endpoints on (such as /healthz and /metrics).")
64+
metricsPort = pflag.Int("metrics-port", 8089, "Deprecated. Port to expose Prometheus metrics on. If not set, uses the value of --port.")
65+
kubeconfig = pflag.String("kubeconfig", "", "Path to kubeconfig file with authorization and master location information.")
66+
clusterSigningGKEKubeconfig = pflag.String("cluster-signing-gke-kubeconfig", "", "If set, use the kubeconfig file to call GKE to sign cluster-scoped certificates instead of using a local private key.")
67+
gceConfigPath = pflag.String("gce-config", "/etc/gce.conf", "Path to gce.conf.")
68+
controllers = pflag.StringSlice("controllers", []string{"*"}, "Controllers to enable. Possible controllers are: "+strings.Join(loopNames(), ",")+".")
69+
gceAPIEndpointOverride = pflag.String("gce-api-endpoint-override", "", "If set, talks to a different GCE API Endpoint. By default it talks to https://www.googleapis.com/compute/v1/projects/")
70+
directPath = pflag.Bool("direct-path", false, "Enable Direct Path.")
71+
authAuthorizeServiceAccountMappingURL = pflag.String("auth-authorize-service-account-mapping-url", "", "URL for reaching the Auth Service AuthorizeServiceAccountMapping API.")
72+
authSyncNodeURL = pflag.String("auth-sync-node-url", "", "URL for reaching the Auth Service SyncNode API.")
73+
hmsAuthorizeSAMappingURL = pflag.String("hms-authorize-sa-mapping-url", "", "URL for reaching the Hosted Master Service AuthorizeSAMapping API.")
74+
hmsSyncNodeURL = pflag.String("hms-sync-node-url", "", "URL for reaching the Hosted Master Service SyncNode API.")
75+
kubeletReadOnlyCSRApprover = pflag.Bool("kubelet-read-only-csr-approver", false, "Enable kubelet readonly csr approver or not")
76+
autopilotEnabled = pflag.Bool("autopilot", false, "Is this a GKE Autopilot cluster.")
77+
clearStalePodsOnNodeRegistration = pflag.Bool("clearStalePodsOnNodeRegistration", false, "If true, after node registration, delete pods bound to old node.")
78+
kubeconfigQPS = pflag.Float32("kubeconfig-qps", 100, "QPS to use while talking with kube-apiserver.")
79+
kubeconfigBurst = pflag.Int("kubeconfig-burst", 200, "Burst to use while talking with kube-apiserver.")
8580
)
8681

8782
func main() {
@@ -106,17 +101,10 @@ func main() {
106101
logs.InitLogs()
107102

108103
s := &controllerManager{
109-
clusterSigningGKEKubeconfig: *clusterSigningGKEKubeconfig,
110-
gceConfigPath: *gceConfigPath,
111-
gceAPIEndpointOverride: *gceAPIEndpointOverride,
112-
controllers: *controllers,
113-
csrApproverVerifyClusterMembership: *csrApproverVerifyClusterMembership,
114-
csrApproverAllowLegacyKubelet: *csrApproverAllowLegacyKubelet,
115-
csrApproverListReferrersConfig: gceInstanceListReferrersConfig{
116-
enabled: *csrApproverUseGCEInstanceListReferrers,
117-
initialInterval: *csrApproverListReferrersInitialInterval,
118-
retryCount: *csrApproverListReferrersRetryCount,
119-
},
104+
clusterSigningGKEKubeconfig: *clusterSigningGKEKubeconfig,
105+
gceConfigPath: *gceConfigPath,
106+
gceAPIEndpointOverride: *gceAPIEndpointOverride,
107+
controllers: *controllers,
120108
leaderElectionConfig: *leConfig,
121109
authAuthorizeServiceAccountMappingURL: *authAuthorizeServiceAccountMappingURL,
122110
authSyncNodeURL: *authSyncNodeURL,
@@ -176,9 +164,6 @@ type controllerManager struct {
176164
gceConfigPath string
177165
gceAPIEndpointOverride string
178166
controllers []string
179-
csrApproverVerifyClusterMembership bool
180-
csrApproverAllowLegacyKubelet bool
181-
csrApproverListReferrersConfig gceInstanceListReferrersConfig
182167
leaderElectionConfig componentbaseconfig.LeaderElectionConfiguration
183168
authAuthorizeServiceAccountMappingURL string
184169
authSyncNodeURL string
@@ -197,13 +182,6 @@ type controllerManager struct {
197182
healthz *healthz.Handler
198183
}
199184

200-
// gceInstanceListReferrersConfig configuration on the ListReferrers retry logic.
201-
type gceInstanceListReferrersConfig struct {
202-
enabled bool
203-
initialInterval time.Duration
204-
retryCount int
205-
}
206-
207185
func (s *controllerManager) isEnabled(name string) bool {
208186
var star bool
209187
for _, controller := range s.controllers {
@@ -255,9 +233,6 @@ func run(s *controllerManager) error {
255233
}),
256234
gcpCfg: s.gcpConfig,
257235
clusterSigningGKEKubeconfig: s.clusterSigningGKEKubeconfig,
258-
csrApproverVerifyClusterMembership: s.csrApproverVerifyClusterMembership,
259-
csrApproverAllowLegacyKubelet: s.csrApproverAllowLegacyKubelet,
260-
csrApproverListReferrersConfig: s.csrApproverListReferrersConfig,
261236
authAuthorizeServiceAccountMappingURL: s.authAuthorizeServiceAccountMappingURL,
262237
authSyncNodeURL: s.authSyncNodeURL,
263238
hmsAuthorizeSAMappingURL: s.hmsAuthorizeSAMappingURL,

0 commit comments

Comments
 (0)