Skip to content

Commit d334bac

Browse files
DiaphteirosDiaphteiros
authored
fix: bug fixes and secret copying (#21)
* fix helm values type * fix storage namespace * extend secrety copying mechanism * fix secret copy target requirement * check for namespace creation * fix access creation * add platformservice task * fix oci source use-case * add config examples to docs * feat: release v0.0.2
1 parent ad091e9 commit d334bac

File tree

15 files changed

+735
-176
lines changed

15 files changed

+735
-176
lines changed

‎Taskfile.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,3 +16,25 @@ includes:
1616
CHART_COMPONENTS: "[]"
1717
CRDS_COMPONENTS: platform-service-dns
1818
CRDS_PATH: '{{.ROOT_DIR}}/api/crds/manifests'
19+
20+
tasks:
21+
platformservice:
22+
desc: " Generates a PlatformService manifest for the current version. Set the VERBOSITY env var to overwrite the default verbosity level (INFO)."
23+
requires:
24+
vars:
25+
- VERSION
26+
vars:
27+
VERBOSITY:
28+
sh: echo "${VERBOSITY:-INFO}"
29+
cmds:
30+
- cmd: |
31+
cat << EOF
32+
apiVersion: openmcp.cloud/v1alpha1
33+
kind: PlatformService
34+
metadata:
35+
name: dns
36+
spec:
37+
image: ghcr.io/openmcp-project/images/platform-service-dns:{{.VERSION}}
38+
verbosity: {{.VERBOSITY}}
39+
EOF
40+
silent: true

‎VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
v0.0.1-dev
1+
v0.0.2

‎api/crds/manifests/dns.openmcp.cloud_dnsserviceconfigs.yaml‎

Lines changed: 96 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,8 @@ spec:
6767
- <environment> will be replaced with the environment name of the operator.
6868
- <cluster.name> will be replaced with the name of the reconciled Cluster.
6969
- <cluster.namespace> will be replaced with the namespace of the reconciled Cluster.
70-
type: string
70+
type: object
71+
x-kubernetes-preserve-unknown-fields: true
7172
name:
7273
description: |-
7374
Name is an optional name.
@@ -102,9 +103,9 @@ spec:
102103
chartName:
103104
description: |-
104105
ChartName specifies the name of the external-dns chart.
105-
Depending on the source, this can also be a relative path within the repository.
106-
When using a source that needs a version (helm or oci), append the version to the chart name using '@', e.g. '[email protected]' or omit for latest version.
107-
minLength: 1
106+
Can be omitted for oci sources, required for git and helm sources.
107+
For git sources, this is the path within the git repository to the chart.
108+
For helm sources, append the version to the chart name using '@', e.g. '[email protected]' or omit for latest version.
108109
type: string
109110
git:
110111
description: |-
@@ -638,10 +639,11 @@ spec:
638639
- interval
639640
- url
640641
type: object
641-
required:
642-
- chartName
643642
type: object
644643
x-kubernetes-validations:
644+
- message: chartName must be set if git is used as source
645+
rule: '(has(self.git) || has(self.helm)) ? (has(self.chartName)
646+
&& size(self.chartName) > 0) : true'
645647
- message: exactly one of the fields in [helm git oci] must be set
646648
rule: '[has(self.helm),has(self.git),has(self.oci)].filter(x,x==true).size()
647649
== 1'
@@ -653,48 +655,100 @@ spec:
653655
type: string
654656
secretsToCopy:
655657
description: |-
656-
SecretsToCopy specifies an optional list of secrets which will be copied from the provider namespace into the namespaces of the reconciled Clusters.
657-
This can, for example, be used to distribute credentials for the registry holding the external-dns helm chart.
658-
items:
659-
description: |-
660-
SecretCopy defines the name of the secret to copy and the name of the copied secret.
661-
If target is nil or target.name is empty, the secret will be copied with the same name as the source secret.
662-
properties:
663-
source:
664-
description: LocalObjectReference is a reference to an object
665-
in the same namespace as the resource referencing it.
658+
SecretsToCopy specifies secrets that should be copied to either the cluster's namespace on the platform cluster,
659+
or the namespace on the target cluster where the helm chart will be installed into.
660+
properties:
661+
toPlatformCluster:
662+
description: |-
663+
ToPlatformCluster lists secrets from the provider namespace that should be copied into the cluster's namespace on the platform cluster.
664+
This is useful e.g. for pull secrets for the helm chart registry.
665+
items:
666+
description: |-
667+
SecretCopy defines the name of the secret to copy and the name of the copied secret.
668+
If target is nil or target.name is empty, the secret will be copied with the same name as the source secret.
666669
properties:
667-
name:
668-
default: ""
670+
source:
669671
description: |-
670-
Name of the referent.
671-
This field is effectively required, but due to backwards compatibility is
672-
allowed to be empty. Instances of this type with an empty value here are
673-
almost certainly wrong.
674-
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
675-
type: string
672+
Source references the source secret to copy.
673+
It has to be in the namespace the provider pod is running in.
674+
properties:
675+
name:
676+
default: ""
677+
description: |-
678+
Name of the referent.
679+
This field is effectively required, but due to backwards compatibility is
680+
allowed to be empty. Instances of this type with an empty value here are
681+
almost certainly wrong.
682+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
683+
type: string
684+
type: object
685+
x-kubernetes-map-type: atomic
686+
target:
687+
description: |-
688+
Target is the name of the copied secret.
689+
If not set, the secret will be copied with the same name as the source secret.
690+
properties:
691+
name:
692+
default: ""
693+
description: |-
694+
Name of the referent.
695+
This field is effectively required, but due to backwards compatibility is
696+
allowed to be empty. Instances of this type with an empty value here are
697+
almost certainly wrong.
698+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
699+
type: string
700+
type: object
701+
x-kubernetes-map-type: atomic
702+
required:
703+
- source
676704
type: object
677-
x-kubernetes-map-type: atomic
678-
target:
679-
description: LocalObjectReference is a reference to an object
680-
in the same namespace as the resource referencing it.
705+
type: array
706+
toTargetCluster:
707+
description: |-
708+
ToTargetCluster lists secrets from the provider namespace that should be copied into the cluster's namespace on the target cluster.
709+
This allows propagating secrets that are required by the helm chart to the target cluster.
710+
items:
711+
description: |-
712+
SecretCopy defines the name of the secret to copy and the name of the copied secret.
713+
If target is nil or target.name is empty, the secret will be copied with the same name as the source secret.
681714
properties:
682-
name:
683-
default: ""
715+
source:
684716
description: |-
685-
Name of the referent.
686-
This field is effectively required, but due to backwards compatibility is
687-
allowed to be empty. Instances of this type with an empty value here are
688-
almost certainly wrong.
689-
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
690-
type: string
717+
Source references the source secret to copy.
718+
It has to be in the namespace the provider pod is running in.
719+
properties:
720+
name:
721+
default: ""
722+
description: |-
723+
Name of the referent.
724+
This field is effectively required, but due to backwards compatibility is
725+
allowed to be empty. Instances of this type with an empty value here are
726+
almost certainly wrong.
727+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
728+
type: string
729+
type: object
730+
x-kubernetes-map-type: atomic
731+
target:
732+
description: |-
733+
Target is the name of the copied secret.
734+
If not set, the secret will be copied with the same name as the source secret.
735+
properties:
736+
name:
737+
default: ""
738+
description: |-
739+
Name of the referent.
740+
This field is effectively required, but due to backwards compatibility is
741+
allowed to be empty. Instances of this type with an empty value here are
742+
almost certainly wrong.
743+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
744+
type: string
745+
type: object
746+
x-kubernetes-map-type: atomic
747+
required:
748+
- source
691749
type: object
692-
x-kubernetes-map-type: atomic
693-
required:
694-
- source
695-
- target
696-
type: object
697-
type: array
750+
type: array
751+
type: object
698752
required:
699753
- externalDNSSource
700754
type: object

‎api/dns/v1alpha1/config_types.go‎

Lines changed: 27 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,10 @@ type DNSServiceConfigSpec struct {
1616
// ExternalDNSSource is the source of the external-dns helm chart.
1717
ExternalDNSSource ExternalDNSSource `json:"externalDNSSource"`
1818

19-
// SecretsToCopy specifies an optional list of secrets which will be copied from the provider namespace into the namespaces of the reconciled Clusters.
20-
// This can, for example, be used to distribute credentials for the registry holding the external-dns helm chart.
19+
// SecretsToCopy specifies secrets that should be copied to either the cluster's namespace on the platform cluster,
20+
// or the namespace on the target cluster where the helm chart will be installed into.
2121
// +optional
22-
SecretsToCopy []SecretCopy `json:"secretsToCopy,omitempty"`
22+
SecretsToCopy *SecretsToCopy `json:"secretsToCopy,omitempty"`
2323

2424
// HelmReleaseReconciliationInterval is the interval at which the HelmRelease for external-dns is reconciled.
2525
// The value can be overwritten for specific purposes using ExternalDNSForPurposes.
@@ -34,15 +34,28 @@ type DNSServiceConfigSpec struct {
3434
ExternalDNSForPurposes []ExternalDNSPurposeConfig `json:"externalDNSForPurposes,omitempty"`
3535
}
3636

37+
type SecretsToCopy struct {
38+
// ToPlatformCluster lists secrets from the provider namespace that should be copied into the cluster's namespace on the platform cluster.
39+
// This is useful e.g. for pull secrets for the helm chart registry.
40+
// +optional
41+
ToPlatformCluster []SecretCopy `json:"toPlatformCluster,omitempty"`
42+
// ToTargetCluster lists secrets from the provider namespace that should be copied into the cluster's namespace on the target cluster.
43+
// This allows propagating secrets that are required by the helm chart to the target cluster.
44+
// +optional
45+
ToTargetCluster []SecretCopy `json:"toTargetCluster,omitempty"`
46+
}
47+
3748
// ExternalDNSSource defines the source of the external-dns helm chart in form of a Flux source.
3849
// Exactly one of 'HelmRepository', 'GitRepository' or 'OCIRepository' must be set.
3950
// If 'copyAuthSecret' is set, the referenced source secret is copied into the namespace where the Flux resources are created with the specified target name.
4051
// +kubebuilder:validation:ExactlyOneOf=helm;git;oci
52+
// +kubebuilder:validation:XValidation:rule="(has(self.git) || has(self.helm)) ? (has(self.chartName) && size(self.chartName) > 0) : true", message="chartName must be set if git is used as source"
4153
type ExternalDNSSource struct {
4254
// ChartName specifies the name of the external-dns chart.
43-
// Depending on the source, this can also be a relative path within the repository.
44-
// When using a source that needs a version (helm or oci), append the version to the chart name using '@', e.g. '[email protected]' or omit for latest version.
45-
// +kubebuilder:validation:MinLength=1
55+
// Can be omitted for oci sources, required for git and helm sources.
56+
// For git sources, this is the path within the git repository to the chart.
57+
// For helm sources, append the version to the chart name using '@', e.g. '[email protected]' or omit for latest version.
58+
// +optional
4659
ChartName string `json:"chartName"`
4760
Helm *fluxv1.HelmRepositorySpec `json:"helm,omitempty"`
4861
Git *fluxv1.GitRepositorySpec `json:"git,omitempty"`
@@ -52,7 +65,12 @@ type ExternalDNSSource struct {
5265
// SecretCopy defines the name of the secret to copy and the name of the copied secret.
5366
// If target is nil or target.name is empty, the secret will be copied with the same name as the source secret.
5467
type SecretCopy struct {
55-
Source commonapi.LocalObjectReference `json:"source"`
68+
// Source references the source secret to copy.
69+
// It has to be in the namespace the provider pod is running in.
70+
Source commonapi.LocalObjectReference `json:"source"`
71+
// Target is the name of the copied secret.
72+
// If not set, the secret will be copied with the same name as the source secret.
73+
// +optional
5674
Target *commonapi.LocalObjectReference `json:"target"`
5775
}
5876

@@ -80,8 +98,9 @@ type ExternalDNSPurposeConfig struct {
8098
// - <environment> will be replaced with the environment name of the operator.
8199
// - <cluster.name> will be replaced with the name of the reconciled Cluster.
82100
// - <cluster.namespace> will be replaced with the namespace of the reconciled Cluster.
83-
// +kubebuilder:validation:Type=string
101+
// +kubebuilder:validation:Type=object
84102
// +kubebuilder:validation:Schemaless
103+
// +kubebuilder:pruning:PreserveUnknownFields
85104
HelmValues *apiextensionsv1.JSON `json:"helmValues"`
86105
}
87106

‎api/dns/v1alpha1/constants.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,6 @@ const (
88
OperationAnnotation = "dns." + openmcpconst.OperationAnnotation
99

1010
ExternalDNSFinalizerOnCluster = "platformservice." + openmcpconst.OpenMCPGroupName + "/dns"
11+
12+
ReasonTargetClusterInteractionProblem = "TargetClusterInteractionProblem"
1113
)

‎api/dns/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 31 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)