Skip to content
This repository was archived by the owner on Dec 11, 2023. It is now read-only.

Commit 6cb09b9

Browse files
author
odacremolbap
committed
reconcile service account
1 parent 705eac6 commit 6cb09b9

File tree

11 files changed

+343
-20
lines changed

11 files changed

+343
-20
lines changed

‎pkg/apis/eventing/v1alpha1/redisbroker_lifecycle.go‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ const (
2323
RedisBrokerRedisService apis.ConditionType = "RedisServiceReady"
2424
RedisBrokerRedisServiceEndpointsConditionReady apis.ConditionType = "RedisEndpointsReady"
2525
RedisBrokerBrokerDeployment apis.ConditionType = "BrokerDeploymentReady"
26+
RedisBrokerBrokerServiceAccount apis.ConditionType = "BrokerServiceAccountReady"
2627
RedisBrokerBrokerService apis.ConditionType = "BrokerServiceReady"
2728
RedisBrokerBrokerServiceEndpointsConditionReady apis.ConditionType = "BrokerEndpointsReady"
2829
RedisBrokerConfigSecret apis.ConditionType = "BrokerConfigSecretReady"
@@ -35,6 +36,7 @@ var redisBrokerCondSet = apis.NewLivingConditionSet(
3536
RedisBrokerRedisDeployment,
3637
RedisBrokerRedisService,
3738
RedisBrokerRedisServiceEndpointsConditionReady,
39+
RedisBrokerBrokerServiceAccount,
3840
RedisBrokerBrokerDeployment,
3941
RedisBrokerBrokerService,
4042
RedisBrokerBrokerServiceEndpointsConditionReady,
@@ -122,9 +124,22 @@ func (bs *RedisBrokerStatus) MarkConfigSecretReady() {
122124
redisBrokerCondSet.Manage(bs).MarkTrue(RedisBrokerConfigSecret)
123125
}
124126

127+
125128
// Manage Redis server state for both
126129
// Service and Deployment
127130

131+
func (bs *RedisBrokerStatus) MarkBrokerServiceAccountFailed(reason, messageFormat string, messageA ...interface{}) {
132+
redisBrokerCondSet.Manage(bs).MarkFalse(RedisBrokerBrokerServiceAccount, reason, messageFormat, messageA...)
133+
}
134+
135+
func (bs *RedisBrokerStatus) MarkBrokerServiceAccountUnknown(reason, messageFormat string, messageA ...interface{}) {
136+
redisBrokerCondSet.Manage(bs).MarkUnknown(RedisBrokerBrokerServiceAccount, reason, messageFormat, messageA...)
137+
}
138+
139+
func (bs *RedisBrokerStatus) MarkBrokerServiceAccountReady() {
140+
redisBrokerCondSet.Manage(bs).MarkTrue(RedisBrokerBrokerServiceAccount)
141+
}
142+
128143
func (bs *RedisBrokerStatus) MarkRedisDeploymentFailed(reason, messageFormat string, messageA ...interface{}) {
129144
redisBrokerCondSet.Manage(bs).MarkFalse(RedisBrokerRedisDeployment, reason, messageFormat, messageA...)
130145
}

‎pkg/reconciler/events.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ const (
2020
ReasonFailedDeploymentCreate = "FailedDeploymentCreate"
2121
ReasonFailedDeploymentUpdate = "FailedDeploymentUpdate"
2222

23+
ReasonFailedServiceAccountGet = "FailedServiceAccountGet"
24+
ReasonFailedServiceAccountCreate = "FailedServiceAccountCreate"
25+
2326
ReasonServiceCreate = "CreateService"
2427
ReasonServiceUpdate = "UpdateService"
2528
ReasonFailedServiceGet = "FailedServiceGet"

‎pkg/reconciler/redisbroker/reconcile_broker.go‎

Lines changed: 72 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ package redisbroker
33
import (
44
"context"
55
"fmt"
6-
"path"
76

87
"go.uber.org/zap"
98

@@ -32,21 +31,27 @@ const (
3231
brokerResourceSuffix = "redisbroker-broker"
3332
)
3433

35-
var (
36-
configMountedPath = path.Join(configSecretPath, configSecretFile)
37-
)
34+
// var (
35+
// configMountedPath = path.Join(configSecretPath, configSecretFile)
36+
// )
3837

3938
type brokerReconciler struct {
4039
client kubernetes.Interface
4140
deploymentLister appsv1listers.DeploymentLister
41+
serviceAccountLister corev1listers.ServiceAccountLister
4242
serviceLister corev1listers.ServiceLister
4343
endpointsLister corev1listers.EndpointsLister
4444
image string
4545
pullPolicy corev1.PullPolicy
4646
}
4747

4848
func (r *brokerReconciler) reconcile(ctx context.Context, rb *eventingv1alpha1.RedisBroker, redis *corev1.Service, secret *corev1.Secret) (*appsv1.Deployment, *corev1.Service, error) {
49-
d, err := r.reconcileDeployment(ctx, rb, redis, secret)
49+
sa, err := r.reconcileServiceAccount(ctx, rb)
50+
if err != nil {
51+
return nil, nil, err
52+
}
53+
54+
d, err := r.reconcileDeployment(ctx, rb,sa, redis, secret)
5055
if err != nil {
5156
return nil, nil, err
5257
}
@@ -64,12 +69,57 @@ func (r *brokerReconciler) reconcile(ctx context.Context, rb *eventingv1alpha1.R
6469
return d, svc, nil
6570
}
6671

67-
func buildBrokerDeployment(rb *eventingv1alpha1.RedisBroker, redis *corev1.Service, secret *corev1.Secret, image string, pullPolicy corev1.PullPolicy) *appsv1.Deployment {
72+
func buildBrokerServiceAccount(rb *eventingv1alpha1.RedisBroker) *corev1.ServiceAccount {
73+
return resources.NewServiceAccount(rb.Namespace, rb.Name+"-"+brokerResourceSuffix,
74+
resources.ServiceAccountWithMetaOptions(
75+
resources.MetaAddLabel(appAnnotation, appAnnotationValue),
76+
resources.MetaAddLabel("component", brokerResourceSuffix),
77+
resources.MetaAddLabel(resourceNameAnnotation, rb.Name+"-"+brokerResourceSuffix),
78+
resources.MetaAddOwner(rb, rb.GetGroupVersionKind())))
79+
}
80+
81+
func (r *brokerReconciler) reconcileServiceAccount(ctx context.Context, rb *eventingv1alpha1.RedisBroker) (*corev1.ServiceAccount, error) {
82+
desired := buildBrokerServiceAccount(rb)
83+
current, err := r.serviceAccountLister.ServiceAccounts(desired.Namespace).Get(desired.Name)
84+
85+
switch {
86+
case err == nil:
87+
// TODO check RoleBinding
88+
89+
case !apierrs.IsNotFound(err):
90+
// An error occurred retrieving current object.
91+
fullname := types.NamespacedName{Namespace: desired.Namespace, Name: desired.Name}
92+
logging.FromContext(ctx).Error("Unable to get broker ServiceAccount", zap.String("serviceAccount", fullname.String()), zap.Error(err))
93+
rb.Status.MarkBrokerServiceAccountFailed(reconciler.ReasonFailedServiceAccountGet, "Failed to get broker ServiceAccount")
94+
95+
return nil, pkgreconciler.NewEvent(corev1.EventTypeWarning, reconciler.ReasonFailedServiceAccountGet,
96+
"Failed to get broker ServiceAccount %s: %w", fullname, err)
97+
98+
default:
99+
// The ServiceAccount has not been found, create it.
100+
current, err = r.client.CoreV1().ServiceAccounts(desired.Namespace).Create(ctx, desired, metav1.CreateOptions{})
101+
if err != nil {
102+
fullname := types.NamespacedName{Namespace: desired.Namespace, Name: desired.Name}
103+
logging.FromContext(ctx).Error("Unable to create broker ServiceAccount", zap.String("serviceAccount", fullname.String()), zap.Error(err))
104+
rb.Status.MarkBrokerServiceAccountFailed(reconciler.ReasonFailedServiceAccountCreate, "Failed to create broker ServiceAccount")
105+
106+
return nil, pkgreconciler.NewEvent(corev1.EventTypeWarning, reconciler.ReasonFailedServiceAccountCreate,
107+
"Failed to create broker ServiceAccount %s: %w", fullname, err)
108+
}
109+
}
110+
111+
// Update status
112+
rb.Status.MarkBrokerServiceAccountReady()
113+
114+
return current, nil
115+
}
116+
117+
func buildBrokerDeployment(rb *eventingv1alpha1.RedisBroker,sa *corev1.ServiceAccount, redis *corev1.Service, secret *corev1.Secret, image string, pullPolicy corev1.PullPolicy) *appsv1.Deployment {
68118

69-
v := resources.NewVolume("config",
70-
resources.VolumeFromSecretOption(secret.Name, configSecretKey, configSecretFile))
71-
vm := resources.NewVolumeMount("config", configSecretPath,
72-
resources.VolumeMountWithReadOnlyOption(true))
119+
// v := resources.NewVolume("config",
120+
// resources.VolumeFromSecretOption(secret.Name, configSecretKey, configSecretFile))
121+
// vm := resources.NewVolumeMount("config", configSecretPath,
122+
// resources.VolumeMountWithReadOnlyOption(true))
73123

74124
var stream string
75125
if rb.Spec.Redis != nil && rb.Spec.Redis.Stream != nil && *rb.Spec.Redis.Stream != "" {
@@ -80,8 +130,13 @@ func buildBrokerDeployment(rb *eventingv1alpha1.RedisBroker, redis *corev1.Servi
80130

81131
opts := []resources.ContainerOption{
82132
resources.ContainerAddArgs("start"),
83-
resources.ContainerAddVolumeMount(vm),
84-
resources.ContainerAddEnvFromValue("BROKER_CONFIG_PATH", configMountedPath),
133+
// resources.ContainerAddVolumeMount(vm),
134+
// resources.ContainerAddEnvFromValue("BROKER_CONFIG_PATH", configMountedPath),
135+
resources.ContainerAddEnvFromFieldRef("KUBERNETES_NAMESPACE", "metadata.namespace"),
136+
// resources.ContainerAddEnvFromValue("KUBERNETES_NAMESPACE", rb.Namespace),
137+
resources.ContainerAddEnvFromValue("BROKER_CONFIG_KUBERNETES_SECRET_NAME", secret.Name),
138+
resources.ContainerAddEnvFromValue("BROKER_CONFIG_KUBERNETES_SECRET_KEY", configSecretKey),
139+
85140
resources.ContainerAddEnvFromValue("REDIS_STREAM", stream),
86141
resources.ContainerWithImagePullPolicy(pullPolicy),
87142
}
@@ -127,13 +182,13 @@ func buildBrokerDeployment(rb *eventingv1alpha1.RedisBroker, redis *corev1.Servi
127182
resources.DeploymentAddSelectorForTemplate(resourceNameAnnotation, rb.Name+"-"+brokerResourceSuffix),
128183
resources.DeploymentSetReplicas(1),
129184
resources.DeploymentWithTemplateOptions(
130-
resources.PodSpecAddVolume(v),
185+
// resources.PodSpecAddVolume(v),
131186
resources.PodSpecAddContainer(
132187
resources.NewContainer("broker", image, opts...))))
133188
}
134189

135-
func (r *brokerReconciler) reconcileDeployment(ctx context.Context, rb *eventingv1alpha1.RedisBroker, redis *corev1.Service, secret *corev1.Secret) (*appsv1.Deployment, error) {
136-
desired := buildBrokerDeployment(rb, redis, secret, r.image, r.pullPolicy)
190+
func (r *brokerReconciler) reconcileDeployment(ctx context.Context, rb *eventingv1alpha1.RedisBroker,sa *corev1.ServiceAccount, redis *corev1.Service, secret *corev1.Secret) (*appsv1.Deployment, error) {
191+
desired := buildBrokerDeployment(rb,sa, redis, secret, r.image, r.pullPolicy)
137192
current, err := r.deploymentLister.Deployments(desired.Namespace).Get(desired.Name)
138193
switch {
139194
case err == nil:
@@ -154,7 +209,7 @@ func (r *brokerReconciler) reconcileDeployment(ctx context.Context, rb *eventing
154209
}
155210

156211
case !apierrs.IsNotFound(err):
157-
// An error ocurred retrieving current deployment.
212+
// An error occurred retrieving current deployment.
158213
fullname := types.NamespacedName{Namespace: desired.Namespace, Name: desired.Name}
159214
logging.FromContext(ctx).Error("Unable to get broker deployment", zap.String("deployment", fullname.String()), zap.Error(err))
160215
rb.Status.MarkBrokerDeploymentFailed(reconciler.ReasonFailedDeploymentGet, "Failed to get broker deployment")
@@ -216,7 +271,7 @@ func (r *brokerReconciler) reconcileService(ctx context.Context, rb *eventingv1a
216271
}
217272

218273
case !apierrs.IsNotFound(err):
219-
// An error ocurred retrieving current object.
274+
// An error occurred retrieving current object.
220275
fullname := types.NamespacedName{Namespace: desired.Namespace, Name: desired.Name}
221276
logging.FromContext(ctx).Error("Unable to get the service", zap.String("service", fullname.String()), zap.Error(err))
222277
rb.Status.MarkBrokerServiceFailed(reconciler.ReasonFailedServiceGet, "Failed to get broker service")

‎pkg/reconciler/redisbroker/reconcile_redis.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ func (r *redisReconciler) reconcileDeployment(ctx context.Context, rb *eventingv
9797
}
9898

9999
case !apierrs.IsNotFound(err):
100-
// An error ocurred retrieving current deployment.
100+
// An error occurred retrieving current deployment.
101101
fullname := types.NamespacedName{Namespace: desired.Namespace, Name: desired.Name}
102102
logging.FromContext(ctx).Error("Unable to get the deployment", zap.String("deployment", fullname.String()), zap.Error(err))
103103
rb.Status.MarkRedisDeploymentFailed(reconciler.ReasonFailedDeploymentGet, "Failed to get Redis deployment")
@@ -158,7 +158,7 @@ func (r *redisReconciler) reconcileService(ctx context.Context, rb *eventingv1al
158158
}
159159

160160
case !apierrs.IsNotFound(err):
161-
// An error ocurred retrieving current object.
161+
// An error occurred retrieving current object.
162162
fullname := types.NamespacedName{Namespace: desired.Namespace, Name: desired.Name}
163163
logging.FromContext(ctx).Error("Unable to get the service", zap.String("service", fullname.String()), zap.Error(err))
164164
rb.Status.MarkRedisServiceFailed(reconciler.ReasonFailedServiceGet, "Failed to get Redis service")

‎pkg/reconciler/redisbroker/reconcile_secret.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ func (r *secretReconciler) reconcile(ctx context.Context, rb *eventingv1alpha1.R
6868
}
6969

7070
case !apierrs.IsNotFound(err):
71-
// An error ocurred retrieving current deployment.
71+
// An error occurred retrieving current deployment.
7272
fullname := types.NamespacedName{Namespace: desired.Namespace, Name: desired.Name}
7373
logging.FromContext(ctx).Error("Unable to get the deployment", zap.String("deployment", fullname.String()), zap.Error(err))
7474
rb.Status.MarkRedisDeploymentFailed(reconciler.ReasonFailedDeploymentGet, "Failed to get Redis deployment")

‎pkg/reconciler/resources/common_test.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ const (
1515
tSecretName = "test-secret"
1616
tSecretKey = "test-key"
1717
tVolumeMountFile = "myfile"
18+
19+
tServiceAccountName = "test-sa-name"
20+
tRoleName = "test-role-name"
21+
tRoleBindingName = "test-rolebinding-name"
1822
)
1923

2024
var (

‎pkg/reconciler/resources/container.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,22 @@ func ContainerAddEnvVarFromSecret(name, secretName, secretKey string) ContainerO
5555
}
5656
}
5757

58+
func ContainerAddEnvFromFieldRef(name, path string) ContainerOption {
59+
return func(c *corev1.Container) {
60+
if c.Env == nil {
61+
c.Env = make([]corev1.EnvVar, 0, 1)
62+
}
63+
c.Env = append(c.Env, corev1.EnvVar{
64+
Name: name,
65+
ValueFrom: &corev1.EnvVarSource{
66+
FieldRef: &corev1.ObjectFieldSelector{
67+
FieldPath: path,
68+
},
69+
},
70+
})
71+
}
72+
}
73+
5874
func ContainerAddArgs(s string) ContainerOption {
5975
return func(c *corev1.Container) {
6076
args := strings.Split(s, " ")

‎pkg/reconciler/resources/rolebinding.go‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
// Copyright 2022 TriggerMesh Inc.
2+
// SPDX-License-Identifier: Apache-2.0
3+
4+
package resources
5+
6+
import (
7+
corev1 "k8s.io/api/core/v1"
8+
rbacv1 "k8s.io/api/rbac/v1"
9+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
10+
)
11+
12+
type RoleBindingOption func(*rbacv1.RoleBinding)
13+
14+
func NewRoleBinding(namespace, name, roleName, subjectName string, opts ...RoleBindingOption) *rbacv1.RoleBinding {
15+
crGVK := rbacv1.SchemeGroupVersion.WithKind("ClusterRole")
16+
saGVK := corev1.SchemeGroupVersion.WithKind("ServiceAccount")
17+
18+
meta := NewMeta(namespace, name)
19+
rb := &rbacv1.RoleBinding{
20+
TypeMeta: metav1.TypeMeta{
21+
Kind: "RoleBinding",
22+
APIVersion: rbacv1.SchemeGroupVersion.String(),
23+
},
24+
ObjectMeta: *meta,
25+
RoleRef: rbacv1.RoleRef{
26+
APIGroup: crGVK.Group,
27+
Kind: crGVK.Kind,
28+
Name: roleName,
29+
},
30+
Subjects: []rbacv1.Subject{{
31+
APIGroup: saGVK.Group,
32+
Kind: saGVK.Kind,
33+
Namespace: namespace,
34+
Name: subjectName,
35+
}},
36+
}
37+
38+
for _, opt := range opts {
39+
opt(rb)
40+
}
41+
42+
return rb
43+
}
44+
45+
func RoleBindingWithMetaOptions(opts ...MetaOption) RoleBindingOption {
46+
return func(s *rbacv1.RoleBinding) {
47+
for _, opt := range opts {
48+
opt(&s.ObjectMeta)
49+
}
50+
}
51+
}

0 commit comments

Comments
 (0)