Skip to content

Commit 63782a9

Browse files
hongkailiuhongkailiu
committed
OTA-1427: USC: Maintain status insights for Nodes
1 parent 8a8bca5 commit 63782a9

File tree

116 files changed

+14740
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

116 files changed

+14740
-0
lines changed

‎install/0000_00_update-status-controller_02_rbac-DevPreviewNoUpgrade.yaml

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,44 @@ rules:
113113
- get
114114
---
115115
apiVersion: rbac.authorization.k8s.io/v1
116+
kind: ClusterRole
117+
metadata:
118+
name: update-status-controller-node-informer
119+
annotations:
120+
kubernetes.io/description: Role that allows the update status controller to watch and read node resources
121+
include.release.openshift.io/self-managed-high-availability: "true"
122+
release.openshift.io/feature-set: DevPreviewNoUpgrade
123+
rules:
124+
- apiGroups:
125+
- ""
126+
resources:
127+
- nodes
128+
verbs:
129+
- get
130+
- list
131+
- watch
132+
- apiGroups:
133+
- machineconfiguration.openshift.io
134+
resources:
135+
- machineconfigpools
136+
verbs:
137+
- list
138+
- apiGroups:
139+
- machineconfiguration.openshift.io
140+
resources:
141+
- machineconfigs
142+
verbs:
143+
- get
144+
- apiGroups:
145+
- config.openshift.io
146+
resources:
147+
- clusterversions
148+
resourceNames:
149+
- version
150+
verbs:
151+
- get
152+
---
153+
apiVersion: rbac.authorization.k8s.io/v1
116154
kind: RoleBinding
117155
metadata:
118156
name: update-status-controller-library
@@ -181,3 +219,20 @@ roleRef:
181219
kind: ClusterRole
182220
name: update-status-controller-control-plane-informer
183221
apiGroup: rbac.authorization.k8s.io
222+
---
223+
apiVersion: rbac.authorization.k8s.io/v1
224+
kind: ClusterRoleBinding
225+
metadata:
226+
name: update-status-controller-node-informer
227+
annotations:
228+
kubernetes.io/description: Grant the update status controller permission to read cluster resources (temporary, until we have UpdateInformer producers)
229+
include.release.openshift.io/self-managed-high-availability: "true"
230+
release.openshift.io/feature-set: DevPreviewNoUpgrade
231+
subjects:
232+
- kind: ServiceAccount
233+
name: update-status-controller
234+
namespace: openshift-update-status-controller
235+
roleRef:
236+
kind: ClusterRole
237+
name: update-status-controller-node-informer
238+
apiGroup: rbac.authorization.k8s.io

‎pkg/updatestatus/mco/controller_common_constants.go

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
// Taken from: https://github.com/openshift/machine-config-operator/blob/11d5151a784c7d4be5255ea41acfbf5092eda592/pkg/controller/common/constants.go
2+
// TODO: Replace this file with the original MCO code when transitioning to server-side
3+
package mco
4+
5+
const (
6+
// MCONamespace is the namespace that should be used for all API objects owned by the MCO by default
7+
MCONamespace = "openshift-machine-config-operator"
8+
9+
// GeneratedByControllerVersionAnnotationKey is used to tag the machineconfigs generated by the controller with the version of the controller.
10+
GeneratedByControllerVersionAnnotationKey = "machineconfiguration.openshift.io/generated-by-controller-version"
11+
12+
// ReleaseImageVersionAnnotationKey is used to tag the rendered machineconfigs & controller config with the release image version.
13+
ReleaseImageVersionAnnotationKey = "machineconfiguration.openshift.io/release-image-version"
14+
15+
// OSImageURLOverriddenKey is used to tag a rendered machineconfig when OSImageURL has been overridden from default using machineconfig
16+
OSImageURLOverriddenKey = "machineconfiguration.openshift.io/os-image-url-overridden"
17+
18+
// ControllerConfigName is the name of the ControllerConfig object that controllers use
19+
ControllerConfigName = "machine-config-controller"
20+
21+
// KernelTypeDefault denominates the default kernel type
22+
KernelTypeDefault = "default"
23+
24+
// KernelTypeRealtime denominates the realtime kernel type
25+
KernelTypeRealtime = "realtime"
26+
27+
// KernelType64kPages denominates the 64k pages kernel
28+
KernelType64kPages = "64k-pages"
29+
30+
// MasterLabel defines the label associated with master node. The master taint uses the same label as taint's key
31+
MasterLabel = "node-role.kubernetes.io/master"
32+
33+
// MCNameSuffixAnnotationKey is used to keep track of the machine config name associated with a CR
34+
MCNameSuffixAnnotationKey = "machineconfiguration.openshift.io/mc-name-suffix"
35+
36+
// MaxMCNameSuffix is the maximum value of the name suffix of the machine config associated with kubeletconfig and containerruntime objects
37+
MaxMCNameSuffix int = 9
38+
39+
// ClusterFeatureInstanceName is a singleton name for featureGate configuration
40+
ClusterFeatureInstanceName = "cluster"
41+
42+
// ClusterNodeInstanceName is a singleton name for node configuration
43+
ClusterNodeInstanceName = "cluster"
44+
45+
// MachineConfigPoolMaster is the MachineConfigPool name given to the master
46+
MachineConfigPoolMaster = "master"
47+
48+
// MachineConfigPoolWorker is the MachineConfigPool name given to the worker
49+
MachineConfigPoolWorker = "worker"
50+
51+
// LayeringEnabledPoolLabel is the label that enables the "layered" workflow path for a pool.
52+
LayeringEnabledPoolLabel = "machineconfiguration.openshift.io/layering-enabled"
53+
54+
// ExperimentalNewestLayeredImageEquivalentConfigAnnotationKey is the annotation that signifies which rendered config
55+
// TODO(zzlotnik): Determine if we should use this still.
56+
ExperimentalNewestLayeredImageEquivalentConfigAnnotationKey = "machineconfiguration.openshift.io/newestImageEquivalentConfig"
57+
58+
OSImageBuildPodLabel = "machineconfiguration.openshift.io/buildPod"
59+
60+
// InternalMCOIgnitionVersion is the ignition version that the MCO converts everything to internally. The intent here is that
61+
// we should be able to update this constant when we bump the internal ignition version instead of having to hunt down all of
62+
// the version references and figure out "was this supposed to be explicitly 3.4.0 or just the default version which happens
63+
// to be 3.4.0 currently". Ideally if you find an explicit "3.4.0", it's supposed to be "3.4.0" version. If it's this constant,
64+
// it's supposed to be the internal default version.
65+
InternalMCOIgnitionVersion = "3.4.0"
66+
67+
// MachineConfigRoleLabel is the role on MachineConfigs, used to select for pools
68+
MachineConfigRoleLabel = "machineconfiguration.openshift.io/role"
69+
70+
// BootImagesConfigMapName is a Configmap of golden bootimages, updated by CVO on an upgrade
71+
BootImagesConfigMapName = "coreos-bootimages"
72+
73+
// MCOVersionHashKey is the key for indexing the MCO git version hash stored in the bootimages configmap
74+
MCOVersionHashKey = "MCOVersionHash"
75+
76+
// MCOReleaseImageVersionKey is the key for indexing the MCO release version stored in the bootimages configmap
77+
MCOReleaseImageVersionKey = "MCOReleaseImageVersion"
78+
79+
ServiceCARotateAnnotation = "machineconfiguration.openshift.io/service-ca-rotate"
80+
81+
ServiceCARotateTrue = "true"
82+
ServiceCARotateFalse = "false"
83+
)

‎pkg/updatestatus/mco/daemon_constants.go

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
// Taken from: https://github.com/openshift/machine-config-operator/blob/11d5151a784c7d4be5255ea41acfbf5092eda592/pkg/daemon/constants/constants.go
2+
// TODO: Replace this file with the original MCO code when transitioning to server-side
3+
package mco
4+
5+
const (
6+
// XXX
7+
//
8+
// Add a constant here, if and only if: it's exported (of course) and it's reused across the entire project.
9+
// Otherwise, prefer an unexported const in a specific package.
10+
//
11+
// XXX
12+
13+
// CurrentImageAnnotationKey is used to get the current OS image pullspec for a machine
14+
CurrentImageAnnotationKey = "machineconfiguration.openshift.io/currentImage"
15+
// DesiredImageAnnotationKey is used to specify the desired OS image pullspec for a machine
16+
DesiredImageAnnotationKey = "machineconfiguration.openshift.io/desiredImage"
17+
18+
// CurrentMachineConfigAnnotationKey is used to fetch current MachineConfig for a machine
19+
CurrentMachineConfigAnnotationKey = "machineconfiguration.openshift.io/currentConfig"
20+
// DesiredMachineConfigAnnotationKey is used to specify the desired MachineConfig for a machine
21+
DesiredMachineConfigAnnotationKey = "machineconfiguration.openshift.io/desiredConfig"
22+
// MachineConfigDaemonStateAnnotationKey is used to fetch the state of the daemon on the machine.
23+
MachineConfigDaemonStateAnnotationKey = "machineconfiguration.openshift.io/state"
24+
// DesiredDrainerAnnotationKey is set by the MCD to indicate drain/uncordon requests
25+
DesiredDrainerAnnotationKey = "machineconfiguration.openshift.io/desiredDrain"
26+
// LastAppliedDrainerAnnotationKey is set by the controller to indicate the last request applied
27+
LastAppliedDrainerAnnotationKey = "machineconfiguration.openshift.io/lastAppliedDrain"
28+
// DrainerStateDrain is used for drainer annotation as a value to indicate needing a drain
29+
DrainerStateDrain = "drain"
30+
// DrainerStateUncordon is used for drainer annotation as a value to indicate needing an uncordon
31+
DrainerStateUncordon = "uncordon"
32+
// ClusterControlPlaneTopologyAnnotationKey is set by the node controller by reading value from
33+
// controllerConfig. MCD uses the annotation value to decide drain action on the node.
34+
ClusterControlPlaneTopologyAnnotationKey = "machineconfiguration.openshift.io/controlPlaneTopology"
35+
// OpenShiftOperatorManagedLabel is used to filter out kube objects that don't need to be synced by the MCO
36+
OpenShiftOperatorManagedLabel = "openshift.io/operator-managed"
37+
// ControllerConfigResourceVersionKey is used for the certificate writer to indicate the last controllerconfig object it synced upon
38+
ControllerConfigResourceVersionKey = "machineconfiguration.openshift.io/lastSyncedControllerConfigResourceVersion"
39+
// ControllerConfigSyncServerCA is used to determine if we have already synced the server CA for this version of the controller config
40+
ControllerConfigSyncServerCA = "machineconfiguration.openshift.io/lastObservedServerCAAnnotation"
41+
// GeneratedByVersionAnnotationKey is used to tag the controllerconfig to synchronize the MCO and MCC
42+
GeneratedByVersionAnnotationKey = "machineconfiguration.openshift.io/generated-by-version"
43+
44+
// MachineConfigDaemonStateWorking is set by daemon when it is beginning to apply an update.
45+
MachineConfigDaemonStateWorking = "Working"
46+
// MachineConfigDaemonStateDone is set by daemon when it is done applying an update.
47+
MachineConfigDaemonStateDone = "Done"
48+
// MachineConfigDaemonStateDegraded is set by daemon when an error not caused by a bad MachineConfig
49+
// is thrown during an update.
50+
MachineConfigDaemonStateDegraded = "Degraded"
51+
// MachineConfigDaemonRebooting is used to indicate a reboot is either queued or is in progress.
52+
MachineConfigDaemonStateRebooting = "Rebooting"
53+
// MachineConfigDaemonStateUnreconcilable is set by the daemon when a MachineConfig cannot be applied.
54+
MachineConfigDaemonStateUnreconcilable = "Unreconcilable"
55+
// MachineConfigDaemonReasonAnnotationKey is set by the daemon when it needs to report a human readable reason for its state. E.g. when state flips to degraded/unreconcilable.
56+
MachineConfigDaemonReasonAnnotationKey = "machineconfiguration.openshift.io/reason"
57+
// MachineConfigDaemonPostConfigAction is set by the daemon when it needs to report a human readable post config action that takes place during update.
58+
MachineConfigDaemonPostConfigAction = "machineconfiguration.openshift.io/post-config-action"
59+
// MachineConfigDaemonFinalizeFailureAnnotationKey is set by the daemon when ostree fails to finalize
60+
MachineConfigDaemonFinalizeFailureAnnotationKey = "machineconfiguration.openshift.io/ostree-finalize-staged-failure"
61+
// InitialNodeAnnotationsFilePath defines the path at which it will find the node annotations it needs to set on the node once it comes up for the first time.
62+
// The Machine Config Server writes the node annotations to this path.
63+
InitialNodeAnnotationsFilePath = "/etc/machine-config-daemon/node-annotations.json"
64+
// InitialNodeAnnotationsBakPath defines the path of InitialNodeAnnotationsFilePath when the initial bootstrap is done. We leave it around for debugging and reconciling.
65+
InitialNodeAnnotationsBakPath = "/etc/machine-config-daemon/node-annotation.json.bak"
66+
67+
// IgnitionSystemdPresetFile is where Ignition writes initial enabled/disabled systemd unit configs
68+
// This should be removed on boot after MCO takes over, so if any of these are deleted we can go back
69+
// to initial system settings
70+
IgnitionSystemdPresetFile = "/etc/systemd/system-preset/20-ignition.preset"
71+
72+
// EtcPivotFile is used by the `pivot` command
73+
// For more information, see https://github.com/openshift/pivot/pull/25/commits/c77788a35d7ee4058d1410e89e6c7937bca89f6c#diff-04c6e90faac2675aa89e2176d2eec7d8R44
74+
EtcPivotFile = "/etc/pivot/image-pullspec"
75+
76+
// MachineConfigEncapsulatedPath contains all of the data from a MachineConfig object
77+
// except the Spec/Config object; this supports inverting+encapsulating a MachineConfig
78+
// object so that Ignition can process it on first boot, and then the MCD can act on
79+
// non-Ignition fields such as the osImageURL and kernelArguments.
80+
MachineConfigEncapsulatedPath = "/etc/ignition-machine-config-encapsulated.json"
81+
82+
// MachineConfigEncapsulatedBakPath defines the path where the machineconfigdaemom-firstboot.service
83+
// will leave a copy of the encapsulated MachineConfig in MachineConfigEncapsulatedPath after
84+
// processing for debugging and auditing purposes.
85+
MachineConfigEncapsulatedBakPath = "/etc/ignition-machine-config-encapsulated.json.bak"
86+
87+
// MachineConfigDaemonForceFile if present causes the MCD to skip checking the validity of the
88+
// "currentConfig" state. Create this file (empty contents is fine) if you wish the MCD
89+
// to proceed and attempt to "reconcile" to the new "desiredConfig" state regardless.
90+
MachineConfigDaemonForceFile = "/run/machine-config-daemon-force"
91+
92+
// coreUser is "core" and currently the only permissible user name
93+
CoreUserName = "core"
94+
CoreGroupName = "core"
95+
96+
// changes to registries.conf will cause a crio reload and require extra logic about whether to drain
97+
ContainerRegistryConfPath = "/etc/containers/registries.conf"
98+
99+
// SSH Keys for user "core" will only be written at /home/core/.ssh
100+
CoreUserSSHPath = "/home/" + CoreUserName + "/.ssh"
101+
102+
// SSH keys in RHCOS 8 will be written to /home/core/.ssh/authorized_keys
103+
RHCOS8SSHKeyPath = CoreUserSSHPath + "/authorized_keys"
104+
105+
// SSH keys in RHCOS 9 / FCOS / SCOS will be written to /home/core/.ssh/authorized_keys.d/ignition
106+
RHCOS9SSHKeyPath = CoreUserSSHPath + "/authorized_keys.d/ignition"
107+
108+
// CRIOServiceName is used to specify reloads and restarts of the CRI-O service
109+
CRIOServiceName = "crio"
110+
)

0 commit comments

Comments
 (0)