|
| 1 | +package resource |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "fmt" |
| 6 | + "strings" |
| 7 | + |
| 8 | + corev1 "k8s.io/api/core/v1" |
| 9 | + "k8s.io/apimachinery/pkg/api/errors" |
| 10 | + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| 11 | + "k8s.io/apimachinery/pkg/runtime" |
| 12 | + coreset "k8s.io/client-go/kubernetes/typed/core/v1" |
| 13 | + corelisters "k8s.io/client-go/listers/core/v1" |
| 14 | + restclient "k8s.io/client-go/rest" |
| 15 | + "k8s.io/klog/v2" |
| 16 | + |
| 17 | + operatorv1 "github.com/openshift/api/operator/v1" |
| 18 | + configlisters "github.com/openshift/client-go/config/listers/config/v1" |
| 19 | + imageregistryv1listers "github.com/openshift/client-go/imageregistry/listers/imageregistry/v1" |
| 20 | + |
| 21 | + "github.com/openshift/cluster-image-registry-operator/pkg/client" |
| 22 | + "github.com/openshift/cluster-image-registry-operator/pkg/defaults" |
| 23 | + "github.com/openshift/cluster-image-registry-operator/pkg/storage" |
| 24 | +) |
| 25 | + |
| 26 | +var _ Mutator = &generatorImageRegistryCA{} |
| 27 | + |
| 28 | +type generatorImageRegistryCA struct { |
| 29 | + lister corelisters.ConfigMapNamespaceLister |
| 30 | + imageConfigLister configlisters.ImageLister |
| 31 | + openshiftConfigLister corelisters.ConfigMapNamespaceLister |
| 32 | + serviceLister corelisters.ServiceNamespaceLister |
| 33 | + imageRegistryConfigLister imageregistryv1listers.ConfigLister |
| 34 | + storageListers *client.StorageListers |
| 35 | + kubeconfig *restclient.Config |
| 36 | + client coreset.CoreV1Interface |
| 37 | +} |
| 38 | + |
| 39 | +func NewGeneratorImageRegistryCA( |
| 40 | + lister corelisters.ConfigMapNamespaceLister, |
| 41 | + imageConfigLister configlisters.ImageLister, |
| 42 | + openshiftConfigLister corelisters.ConfigMapNamespaceLister, |
| 43 | + serviceLister corelisters.ServiceNamespaceLister, |
| 44 | + imageRegistryConfigLister imageregistryv1listers.ConfigLister, |
| 45 | + storageListers *client.StorageListers, |
| 46 | + kubeconfig *restclient.Config, |
| 47 | + client coreset.CoreV1Interface, |
| 48 | +) Mutator { |
| 49 | + return &generatorImageRegistryCA{ |
| 50 | + lister: lister, |
| 51 | + imageConfigLister: imageConfigLister, |
| 52 | + openshiftConfigLister: openshiftConfigLister, |
| 53 | + serviceLister: serviceLister, |
| 54 | + imageRegistryConfigLister: imageRegistryConfigLister, |
| 55 | + storageListers: storageListers, |
| 56 | + kubeconfig: kubeconfig, |
| 57 | + client: client, |
| 58 | + } |
| 59 | +} |
| 60 | + |
| 61 | +func (girca *generatorImageRegistryCA) Type() runtime.Object { |
| 62 | + return &corev1.ConfigMap{} |
| 63 | +} |
| 64 | + |
| 65 | +func (girca *generatorImageRegistryCA) GetNamespace() string { |
| 66 | + return defaults.OpenShiftConfigManagedNamespace |
| 67 | +} |
| 68 | + |
| 69 | +func (girca *generatorImageRegistryCA) GetName() string { |
| 70 | + return defaults.ImageRegistryCAName |
| 71 | +} |
| 72 | + |
| 73 | +func (girca *generatorImageRegistryCA) storageDriver() (storage.Driver, bool, error) { |
| 74 | + imageRegistryConfig, err := girca.imageRegistryConfigLister.Get("cluster") |
| 75 | + if errors.IsNotFound(err) { |
| 76 | + return nil, false, nil |
| 77 | + } else if err != nil { |
| 78 | + return nil, false, err |
| 79 | + } |
| 80 | + |
| 81 | + if imageRegistryConfig.Spec.ManagementState == operatorv1.Removed { |
| 82 | + // The certificates controller does not need to know about |
| 83 | + // storage when the management state is Removed. |
| 84 | + return nil, false, nil |
| 85 | + } |
| 86 | + |
| 87 | + driver, err := storage.NewDriver(&imageRegistryConfig.Spec.Storage, girca.kubeconfig, girca.storageListers) |
| 88 | + if err == storage.ErrStorageNotConfigured || storage.IsMultiStoragesError(err) { |
| 89 | + return nil, false, nil |
| 90 | + } else if err != nil { |
| 91 | + return nil, false, err |
| 92 | + } |
| 93 | + |
| 94 | + canRedirect := !imageRegistryConfig.Spec.DisableRedirect |
| 95 | + |
| 96 | + return driver, canRedirect, nil |
| 97 | +} |
| 98 | + |
| 99 | +func (girca *generatorImageRegistryCA) expected() (runtime.Object, error) { |
| 100 | + cm := &corev1.ConfigMap{ |
| 101 | + ObjectMeta: metav1.ObjectMeta{ |
| 102 | + Name: girca.GetName(), |
| 103 | + Namespace: girca.GetNamespace(), |
| 104 | + }, |
| 105 | + Data: map[string]string{}, |
| 106 | + BinaryData: map[string][]byte{}, |
| 107 | + } |
| 108 | + |
| 109 | + var ownHostnameKeys []string |
| 110 | + |
| 111 | + serviceCA, err := girca.lister.Get(defaults.ServiceCAName) |
| 112 | + if errors.IsNotFound(err) { |
| 113 | + klog.V(4).Infof("missing the service CA configmap: %s", err) |
| 114 | + } else if err != nil { |
| 115 | + return cm, fmt.Errorf("%s: %s", girca.GetName(), err) |
| 116 | + } else { |
| 117 | + if cert, ok := serviceCA.Data["service-ca.crt"]; ok { |
| 118 | + internalHostnames, err := getServiceHostnames(girca.serviceLister, defaults.ServiceName) |
| 119 | + if err != nil { |
| 120 | + return cm, fmt.Errorf("%s: %s", girca.GetName(), err) |
| 121 | + } |
| 122 | + if len(internalHostnames) == 0 { |
| 123 | + klog.Infof("unable to get the service name to add service-ca.crt") |
| 124 | + } else { |
| 125 | + for _, internalHostname := range internalHostnames { |
| 126 | + key := strings.Replace(internalHostname, ":", "..", -1) |
| 127 | + ownHostnameKeys = append(ownHostnameKeys, key) |
| 128 | + cm.Data[key] = cert |
| 129 | + } |
| 130 | + } |
| 131 | + } else { |
| 132 | + klog.Infof("the service CA is not injected yet") |
| 133 | + } |
| 134 | + } |
| 135 | + |
| 136 | + driver, canRedirect, err := girca.storageDriver() |
| 137 | + if err != nil { |
| 138 | + return cm, fmt.Errorf("%s: %s", girca.GetName(), err) |
| 139 | + } |
| 140 | + if driver != nil { |
| 141 | + storageCABundle, _, err := driver.CABundle() |
| 142 | + if err != nil { |
| 143 | + return cm, fmt.Errorf("%s: %s", girca.GetName(), err) |
| 144 | + } |
| 145 | + if storageCABundle != "" { |
| 146 | + klog.V(4).Infof("using storage ca bundle (%d bytes)", len(storageCABundle)) |
| 147 | + if canRedirect { |
| 148 | + klog.V(4).Infof("injecting storage ca bundle into registry certificates...") |
| 149 | + for _, key := range ownHostnameKeys { |
| 150 | + cm.Data[key] += "\n" + storageCABundle |
| 151 | + } |
| 152 | + } |
| 153 | + } |
| 154 | + } |
| 155 | + |
| 156 | + return cm, nil |
| 157 | +} |
| 158 | + |
| 159 | +func (girca *generatorImageRegistryCA) Get() (runtime.Object, error) { |
| 160 | + return girca.lister.Get(girca.GetName()) |
| 161 | +} |
| 162 | + |
| 163 | +func (girca *generatorImageRegistryCA) Create() (runtime.Object, error) { |
| 164 | + return commonCreate(girca, func(obj runtime.Object) (runtime.Object, error) { |
| 165 | + return girca.client.ConfigMaps(girca.GetNamespace()).Create( |
| 166 | + context.TODO(), obj.(*corev1.ConfigMap), metav1.CreateOptions{}, |
| 167 | + ) |
| 168 | + }) |
| 169 | +} |
| 170 | + |
| 171 | +func (girca *generatorImageRegistryCA) Update(o runtime.Object) (runtime.Object, bool, error) { |
| 172 | + return commonUpdate(girca, o, func(obj runtime.Object) (runtime.Object, error) { |
| 173 | + return girca.client.ConfigMaps(girca.GetNamespace()).Update( |
| 174 | + context.TODO(), obj.(*corev1.ConfigMap), metav1.UpdateOptions{}, |
| 175 | + ) |
| 176 | + }) |
| 177 | +} |
| 178 | + |
| 179 | +func (girca *generatorImageRegistryCA) Delete(opts metav1.DeleteOptions) error { |
| 180 | + return girca.client.ConfigMaps(girca.GetNamespace()).Delete( |
| 181 | + context.TODO(), girca.GetName(), opts, |
| 182 | + ) |
| 183 | +} |
| 184 | + |
| 185 | +func (g *generatorImageRegistryCA) Owned() bool { |
| 186 | + return true |
| 187 | +} |
0 commit comments