Skip to content

Commit e072c81

Browse files
vara2504vara2504
authored
Move Calico API server from calico-apiserver namespace to calico-system for OSS (#3989)
* move apiserver component from calico-apiserver ns to calico-system for OSS * Add APIServer finalizer only to the deployment * cleanup the apiserver deployment while switching between variant * correct cleanupdeployment * Update func name for cleanup deployment
1 parent 6e96722 commit e072c81

File tree

14 files changed

+137
-151
lines changed

14 files changed

+137
-151
lines changed

‎pkg/controller/apiserver/apiserver_controller.go‎

Lines changed: 20 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
"github.com/go-logr/logr"
2222
appsv1 "k8s.io/api/apps/v1"
2323

24+
v1 "k8s.io/api/apps/v1"
2425
corev1 "k8s.io/api/core/v1"
2526
"k8s.io/apimachinery/pkg/api/errors"
2627
"k8s.io/apimachinery/pkg/api/meta"
@@ -52,7 +53,6 @@ import (
5253
"github.com/tigera/operator/pkg/render"
5354
rcertificatemanagement "github.com/tigera/operator/pkg/render/certificatemanagement"
5455
"github.com/tigera/operator/pkg/render/common/authentication"
55-
rmeta "github.com/tigera/operator/pkg/render/common/meta"
5656
"github.com/tigera/operator/pkg/render/common/networkpolicy"
5757
"github.com/tigera/operator/pkg/render/monitor"
5858
"github.com/tigera/operator/pkg/tls/certificatemanagement"
@@ -78,7 +78,7 @@ func Add(mgr manager.Manager, opts options.AddOptions) error {
7878
go utils.WaitToAddTierWatch(networkpolicy.TigeraComponentTierName, c, opts.K8sClientset, log, r.tierWatchReady)
7979

8080
go utils.WaitToAddNetworkPolicyWatches(c, opts.K8sClientset, log, []types.NamespacedName{
81-
{Name: render.APIServerPolicyName, Namespace: rmeta.APIServerNamespace(operatorv1.TigeraSecureEnterprise)},
81+
{Name: render.APIServerPolicyName, Namespace: render.APIServerNamespace},
8282
})
8383
}
8484

@@ -139,7 +139,7 @@ func add(c ctrlruntime.Controller, r *ReconcileAPIServer) error {
139139
return fmt.Errorf("apiserver-controller failed to watch primary resource: %v", err)
140140
}
141141

142-
for _, namespace := range []string{common.OperatorNamespace(), rmeta.APIServerNamespace(operatorv1.TigeraSecureEnterprise)} {
142+
for _, namespace := range []string{common.OperatorNamespace(), render.APIServerNamespace} {
143143
for _, secretName := range []string{render.VoltronTunnelSecretName, render.ManagerTLSSecretName} {
144144
if err = utils.AddSecretsWatch(c, secretName, namespace); err != nil {
145145
return fmt.Errorf("apiserver-controller failed to watch the Secret resource: %v", err)
@@ -156,10 +156,7 @@ func add(c ctrlruntime.Controller, r *ReconcileAPIServer) error {
156156
}
157157

158158
// Watch for the namespace(s) managed by this controller.
159-
if err = c.WatchObject(&corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: rmeta.APIServerNamespace(operatorv1.Calico)}}, &handler.EnqueueRequestForObject{}); err != nil {
160-
return fmt.Errorf("apiserver-controller failed to watch resource: %w", err)
161-
}
162-
if err = c.WatchObject(&corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: rmeta.APIServerNamespace(operatorv1.TigeraSecureEnterprise)}}, &handler.EnqueueRequestForObject{}); err != nil {
159+
if err = c.WatchObject(&corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: render.APIServerNamespace}}, &handler.EnqueueRequestForObject{}); err != nil {
163160
return fmt.Errorf("apiserver-controller failed to watch resource: %w", err)
164161
}
165162

@@ -261,7 +258,6 @@ func (r *ReconcileAPIServer) Reconcile(ctx context.Context, request reconcile.Re
261258
r.status.SetDegraded(operatorv1.ResourceNotReady, "Waiting for Installation Variant to be set", nil, reqLogger)
262259
return reconcile.Result{}, nil
263260
}
264-
ns := rmeta.APIServerNamespace(installationSpec.Variant)
265261

266262
certificateManager, err := certificatemanager.Create(r.client, installationSpec, r.clusterDomain, common.OperatorNamespace())
267263
if err != nil {
@@ -271,13 +267,13 @@ func (r *ReconcileAPIServer) Reconcile(ctx context.Context, request reconcile.Re
271267

272268
// We need separate certificates for OSS vs Enterprise.
273269
secretName := render.ProjectCalicoAPIServerTLSSecretName(installationSpec.Variant)
274-
tlsSecret, err := certificateManager.GetOrCreateKeyPair(r.client, secretName, common.OperatorNamespace(), dns.GetServiceDNSNames(render.ProjectCalicoAPIServerServiceName(installationSpec.Variant), rmeta.APIServerNamespace(installationSpec.Variant), r.clusterDomain))
270+
tlsSecret, err := certificateManager.GetOrCreateKeyPair(r.client, secretName, common.OperatorNamespace(), dns.GetServiceDNSNames(render.ProjectCalicoAPIServerServiceName(installationSpec.Variant), render.APIServerNamespace, r.clusterDomain))
275271
if err != nil {
276272
r.status.SetDegraded(operatorv1.ResourceCreateError, "Unable to get or create tls key pair", err, reqLogger)
277273
return reconcile.Result{}, err
278274
}
279275

280-
certificateManager.AddToStatusManager(r.status, ns)
276+
certificateManager.AddToStatusManager(r.status, render.APIServerNamespace)
281277

282278
pullSecrets, err := utils.GetNetworkingPullSecrets(installationSpec, r.client)
283279
if err != nil {
@@ -439,7 +435,7 @@ func (r *ReconcileAPIServer) Reconcile(ctx context.Context, request reconcile.Re
439435
MultiTenant: r.multiTenant,
440436
KeyValidatorConfig: keyValidatorConfig,
441437
KubernetesVersion: r.kubernetesVersion,
442-
CanCleanupOlderResources: r.canCleanupLegacyNamespace(ctx, reqLogger),
438+
CanCleanupOlderResources: r.canCleanupLegacyNamespace(ctx, installationSpec.Variant, reqLogger),
443439
}
444440

445441
var components []render.Component
@@ -460,7 +456,7 @@ func (r *ReconcileAPIServer) Reconcile(ctx context.Context, request reconcile.Re
460456
components = append(components,
461457
component,
462458
rcertificatemanagement.CertificateManagement(&rcertificatemanagement.Config{
463-
Namespace: rmeta.APIServerNamespace(installationSpec.Variant),
459+
Namespace: render.APIServerNamespace,
464460
ServiceAccounts: []string{render.APIServerServiceAccountName(installationSpec.Variant)},
465461
KeyPairOptions: []rcertificatemanagement.KeyPairOption{
466462
rcertificatemanagement.NewKeyPairOption(tlsSecret, true, true),
@@ -515,12 +511,8 @@ func validateAPIServerResource(instance *operatorv1.APIServer) error {
515511
// prior to the CNI plugin being removed.
516512
func (r *ReconcileAPIServer) maintainFinalizer(ctx context.Context, apiserver client.Object) error {
517513
// These objects require graceful termination before the CNI plugin is torn down.
518-
_, spec, err := utils.GetInstallation(context.Background(), r.client)
519-
if err != nil {
520-
return err
521-
}
522-
apiServerNamespace := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: rmeta.APIServerNamespace(spec.Variant)}}
523-
return utils.MaintainInstallationFinalizer(ctx, r.client, apiserver, render.APIServerFinalizer, apiServerNamespace)
514+
apiServerDeployment := v1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: "calico-apiserver", Namespace: render.APIServerNamespace}}
515+
return utils.MaintainInstallationFinalizer(ctx, r.client, apiserver, render.APIServerFinalizer, &apiServerDeployment)
524516
}
525517

526518
// canCleanupLegacyNamespace determines whether the legacy "tigera-system" namespace
@@ -529,12 +521,16 @@ func (r *ReconcileAPIServer) maintainFinalizer(ctx context.Context, apiserver cl
529521
// - The new API server deployment in "calico-system" exists and is available.
530522
// - The old API server deployment in "tigera-system" is either removed or inactive.
531523
// - Both the APIServer custom resource and the TigeraStatus for 'apiserver' are in the Ready state
532-
func (r *ReconcileAPIServer) canCleanupLegacyNamespace(ctx context.Context, logger logr.Logger) bool {
533-
const (
534-
newNamespace = "calico-system"
535-
oldNamespace = "tigera-system"
536-
deploymentName = "tigera-apiserver"
537-
)
524+
func (r *ReconcileAPIServer) canCleanupLegacyNamespace(ctx context.Context, variant operatorv1.ProductVariant, logger logr.Logger) bool {
525+
526+
newNamespace := "calico-system"
527+
oldNamespace := "tigera-system"
528+
deploymentName := "tigera-apiserver"
529+
530+
if variant == operatorv1.Calico {
531+
oldNamespace = "calico-apiserver"
532+
deploymentName = "calico-apiserver"
533+
}
538534

539535
// Fetch the new API server deployment in calico-system
540536
newDeploy := &appsv1.Deployment{}

‎pkg/controller/apiserver/apiserver_controller_test.go‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,7 @@ var _ = Describe("apiserver controller tests", func() {
152152
mockStatus.On("ClearDegraded")
153153
mockStatus.On("AddCertificateSigningRequests", mock.Anything)
154154
mockStatus.On("RemoveCertificateSigningRequests", mock.Anything)
155+
mockStatus.On("RemoveDeployments", mock.Anything)
155156
mockStatus.On("ReadyToMonitor")
156157
mockStatus.On("SetMetaData", mock.Anything).Return()
157158
mockStatus.On("SetDegraded", operatorv1.ResourceReadError, mock.Anything, mock.Anything, mock.Anything).Return().Maybe()
@@ -836,7 +837,7 @@ var _ = Describe("apiserver controller tests", func() {
836837
}
837838
_, err = r.Reconcile(ctx, reconcile.Request{})
838839
Expect(err).ShouldNot(HaveOccurred())
839-
canCleanedUp := r.canCleanupLegacyNamespace(ctx, logf.Log.WithName("test"))
840+
canCleanedUp := r.canCleanupLegacyNamespace(ctx, installation.Spec.Variant, logf.Log.WithName("test"))
840841
Expect(canCleanedUp).To(BeTrue())
841842
})
842843

@@ -856,7 +857,7 @@ var _ = Describe("apiserver controller tests", func() {
856857
}
857858
_, err = r.Reconcile(ctx, reconcile.Request{})
858859
Expect(err).ShouldNot(HaveOccurred())
859-
canCleanedUp := r.canCleanupLegacyNamespace(ctx, logf.Log.WithName("test"))
860+
canCleanedUp := r.canCleanupLegacyNamespace(ctx, installation.Spec.Variant, logf.Log.WithName("test"))
860861
Expect(canCleanedUp).To(BeFalse())
861862
})
862863

@@ -882,7 +883,7 @@ var _ = Describe("apiserver controller tests", func() {
882883
}
883884
_, err = r.Reconcile(ctx, reconcile.Request{})
884885
Expect(err).ShouldNot(HaveOccurred())
885-
canCleanedUp := r.canCleanupLegacyNamespace(ctx, logf.Log.WithName("test"))
886+
canCleanedUp := r.canCleanupLegacyNamespace(ctx, installation.Spec.Variant, logf.Log.WithName("test"))
886887
Expect(canCleanedUp).To(BeFalse())
887888
})
888889

@@ -916,7 +917,7 @@ var _ = Describe("apiserver controller tests", func() {
916917
}
917918
_, err = r.Reconcile(ctx, reconcile.Request{})
918919
Expect(err).ShouldNot(HaveOccurred())
919-
canCleanedUp := r.canCleanupLegacyNamespace(ctx, logf.Log.WithName("test"))
920+
canCleanedUp := r.canCleanupLegacyNamespace(ctx, installation.Spec.Variant, logf.Log.WithName("test"))
920921
Expect(canCleanedUp).To(BeFalse())
921922
})
922923
})

‎pkg/controller/tiers/tiers_controller.go‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,6 @@ import (
4242
"github.com/tigera/operator/pkg/controller/utils"
4343
"github.com/tigera/operator/pkg/ctrlruntime"
4444
"github.com/tigera/operator/pkg/render"
45-
rmeta "github.com/tigera/operator/pkg/render/common/meta"
4645
"github.com/tigera/operator/pkg/render/common/networkpolicy"
4746
"github.com/tigera/operator/pkg/render/logstorage/eck"
4847
"github.com/tigera/operator/pkg/render/logstorage/kibana"
@@ -194,7 +193,6 @@ func (r *ReconcileTiers) prepareTiersConfig(ctx context.Context, reqLogger logr.
194193
render.PacketCaptureNamespace,
195194
render.PolicyRecommendationNamespace,
196195
common.TigeraPrometheusNamespace,
197-
rmeta.APIServerNamespace(operatorv1.TigeraSecureEnterprise),
198196
"tigera-skraper",
199197
}
200198
if r.multiTenant {

0 commit comments

Comments
 (0)