Skip to content

Commit b8de967

Browse files
jabellardjabellard
committed
Onwards!
Signed-off-by: Joe Nathan Abellard <[email protected]> Onwards! Signed-off-by: Joe Nathan Abellard <[email protected]> Onwards! Signed-off-by: Joe Nathan Abellard <[email protected]>
1 parent 47efa57 commit b8de967

File tree

6 files changed

+100
-9
lines changed

6 files changed

+100
-9
lines changed

Diff for: ‎charts/karmada-operator/crds/operator.karmada.io_karmadas.yaml

+21-3
Original file line numberDiff line numberDiff line change
@@ -65,12 +65,14 @@ spec:
6565
description: |-
6666
CAData is an SSL Certificate Authority file used to secure etcd communication.
6767
Required if using a TLS connection.
68+
Deprecated: This field is deprecated and will be removed in a future version. Use SecretRef for providing client connection credentials.
6869
format: byte
6970
type: string
7071
certData:
7172
description: |-
7273
CertData is an SSL certification file used to secure etcd communication.
7374
Required if using a TLS connection.
75+
Deprecated: This field is deprecated and will be removed in a future version. Use SecretRef for providing client connection credentials.
7476
format: byte
7577
type: string
7678
endpoints:
@@ -82,13 +84,29 @@ spec:
8284
description: |-
8385
KeyData is an SSL key file used to secure etcd communication.
8486
Required if using a TLS connection.
87+
Deprecated: This field is deprecated and will be removed in a future version. Use SecretRef for providing client connection credentials.
8588
format: byte
8689
type: string
90+
secretRef:
91+
description: |-
92+
SecretRef references a Kubernetes secret containing the etcd connection credentials.
93+
The secret must contain the following data keys:
94+
ca.crt: The Certificate Authority (CA) certificate data.
95+
tls.crt: The TLS certificate data used for verifying the etcd server's certificate.
96+
tls.key: The TLS private key.
97+
Required to configure the connection to an external etcd cluster.
98+
properties:
99+
name:
100+
description: Name is the name of resource being referenced.
101+
type: string
102+
namespace:
103+
description: Namespace is the namespace for the resource
104+
being referenced.
105+
type: string
106+
type: object
87107
required:
88-
- caData
89-
- certData
90108
- endpoints
91-
- keyData
109+
- secretRef
92110
type: object
93111
local:
94112
description: |-

Diff for: ‎operator/config/crds/operator.karmada.io_karmadas.yaml

+21-3
Original file line numberDiff line numberDiff line change
@@ -65,12 +65,14 @@ spec:
6565
description: |-
6666
CAData is an SSL Certificate Authority file used to secure etcd communication.
6767
Required if using a TLS connection.
68+
Deprecated: This field is deprecated and will be removed in a future version. Use SecretRef for providing client connection credentials.
6869
format: byte
6970
type: string
7071
certData:
7172
description: |-
7273
CertData is an SSL certification file used to secure etcd communication.
7374
Required if using a TLS connection.
75+
Deprecated: This field is deprecated and will be removed in a future version. Use SecretRef for providing client connection credentials.
7476
format: byte
7577
type: string
7678
endpoints:
@@ -82,13 +84,29 @@ spec:
8284
description: |-
8385
KeyData is an SSL key file used to secure etcd communication.
8486
Required if using a TLS connection.
87+
Deprecated: This field is deprecated and will be removed in a future version. Use SecretRef for providing client connection credentials.
8588
format: byte
8689
type: string
90+
secretRef:
91+
description: |-
92+
SecretRef references a Kubernetes secret containing the etcd connection credentials.
93+
The secret must contain the following data keys:
94+
ca.crt: The Certificate Authority (CA) certificate data.
95+
tls.crt: The TLS certificate data used for verifying the etcd server's certificate.
96+
tls.key: The TLS private key.
97+
Required to configure the connection to an external etcd cluster.
98+
properties:
99+
name:
100+
description: Name is the name of resource being referenced.
101+
type: string
102+
namespace:
103+
description: Namespace is the namespace for the resource
104+
being referenced.
105+
type: string
106+
type: object
87107
required:
88-
- caData
89-
- certData
90108
- endpoints
91-
- keyData
109+
- secretRef
92110
type: object
93111
local:
94112
description: |-

Diff for: ‎operator/pkg/apis/operator/v1alpha1/type.go

+16-3
Original file line numberDiff line numberDiff line change
@@ -239,19 +239,32 @@ type VolumeData struct {
239239
// operator has no knowledge of where certificate files live, and they must be supplied.
240240
type ExternalEtcd struct {
241241
// Endpoints of etcd members. Required for ExternalEtcd.
242+
// +required
242243
Endpoints []string `json:"endpoints"`
243244

244245
// CAData is an SSL Certificate Authority file used to secure etcd communication.
245246
// Required if using a TLS connection.
246-
CAData []byte `json:"caData"`
247+
// Deprecated: This field is deprecated and will be removed in a future version. Use SecretRef for providing client connection credentials.
248+
CAData []byte `json:"caData,omitempty"`
247249

248250
// CertData is an SSL certification file used to secure etcd communication.
249251
// Required if using a TLS connection.
250-
CertData []byte `json:"certData"`
252+
// Deprecated: This field is deprecated and will be removed in a future version. Use SecretRef for providing client connection credentials.
253+
CertData []byte `json:"certData,omitempty"`
251254

252255
// KeyData is an SSL key file used to secure etcd communication.
253256
// Required if using a TLS connection.
254-
KeyData []byte `json:"keyData"`
257+
// Deprecated: This field is deprecated and will be removed in a future version. Use SecretRef for providing client connection credentials.
258+
KeyData []byte `json:"keyData,omitempty"`
259+
260+
// SecretRef references a Kubernetes secret containing the etcd connection credentials.
261+
// The secret must contain the following data keys:
262+
// ca.crt: The Certificate Authority (CA) certificate data.
263+
// tls.crt: The TLS certificate data used for verifying the etcd server's certificate.
264+
// tls.key: The TLS private key.
265+
// Required to configure the connection to an external etcd cluster.
266+
// +required
267+
SecretRef LocalSecretReference `json:"secretRef"`
255268
}
256269

257270
// KarmadaAPIServer holds settings to kube-apiserver component of the kubernetes.

Diff for: ‎operator/pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go

+1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: ‎operator/pkg/constants/constants.go

+3
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,9 @@ const (
125125

126126
// APIServiceName defines the karmada aggregated apiserver APIService resource name.
127127
APIServiceName = "v1alpha1.cluster.karmada.io"
128+
129+
// KarmadaApiserverEtcdClientCertNameSuffix defines the suffix for the Karmada API server etcd client cert name
130+
KarmadaApiserverEtcdClientCertNameSuffix = "karmada-apiserver-etcd-client-cert"
128131
)
129132

130133
var (

Diff for: ‎operator/pkg/controller/karmada/controller.go

+38
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,15 @@ package karmada
1818

1919
import (
2020
"context"
21+
"fmt"
2122
"reflect"
2223
"strconv"
2324
"time"
2425

26+
corev1 "k8s.io/api/core/v1"
2527
"k8s.io/apimachinery/pkg/api/errors"
28+
"k8s.io/apimachinery/pkg/api/meta"
29+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2630
"k8s.io/apimachinery/pkg/labels"
2731
"k8s.io/client-go/rest"
2832
"k8s.io/client-go/tools/record"
@@ -36,6 +40,7 @@ import (
3640
"sigs.k8s.io/controller-runtime/pkg/predicate"
3741

3842
operatorv1alpha1 "github.com/karmada-io/karmada/operator/pkg/apis/operator/v1alpha1"
43+
"github.com/karmada-io/karmada/operator/pkg/constants"
3944
operatorscheme "github.com/karmada-io/karmada/operator/pkg/scheme"
4045
)
4146

@@ -48,6 +53,9 @@ const (
4853

4954
// DisableCascadingDeletionLabel is the label that determine whether to perform cascade deletion
5055
DisableCascadingDeletionLabel = "operator.karmada.io/disable-cascading-deletion"
56+
57+
// ValidationErrorReason is the reason for a validation error
58+
ValidationErrorReason = "ValidationError"
5159
)
5260

5361
// Controller controls the Karmada resource.
@@ -77,6 +85,11 @@ func (ctrl *Controller) Reconcile(ctx context.Context, req controllerruntime.Req
7785
return controllerruntime.Result{}, err
7886
}
7987

88+
if err := ctrl.validateKarmada(karmada); err != nil {
89+
klog.Error(err, "Validation failed for karmada")
90+
return controllerruntime.Result{}, nil
91+
}
92+
8093
// The object is being deleted
8194
if !karmada.DeletionTimestamp.IsZero() {
8295
val, ok := karmada.Labels[DisableCascadingDeletionLabel]
@@ -96,6 +109,31 @@ func (ctrl *Controller) Reconcile(ctx context.Context, req controllerruntime.Req
96109
return controllerruntime.Result{}, ctrl.syncKarmada(karmada)
97110
}
98111

112+
// validateKarmada ensures the Karmada resource adheres to validation rules
113+
func (ctrl *Controller) validateKarmada(karmada *operatorv1alpha1.Karmada) error {
114+
if karmada.Spec.Components.Etcd != nil && karmada.Spec.Components.Etcd.External != nil {
115+
expectedSecretName := fmt.Sprintf("%s-%s", karmada.Name, constants.KarmadaApiserverEtcdClientCertNameSuffix)
116+
if karmada.Spec.Components.Etcd.External.SecretRef.Name != expectedSecretName {
117+
errorMessage := fmt.Sprintf("Secret name for external etcd client must be %s, but got %s", expectedSecretName, karmada.Spec.Components.Etcd.External.SecretRef.Name)
118+
ctrl.EventRecorder.Event(karmada, corev1.EventTypeWarning, ValidationErrorReason, errorMessage)
119+
120+
newCondition := metav1.Condition{
121+
Type: string(operatorv1alpha1.Ready),
122+
Status: metav1.ConditionFalse,
123+
Reason: ValidationErrorReason,
124+
Message: errorMessage,
125+
LastTransitionTime: metav1.Now(),
126+
}
127+
meta.SetStatusCondition(&karmada.Status.Conditions, newCondition)
128+
if err := ctrl.Status().Update(context.TODO(), karmada); err != nil {
129+
return err
130+
}
131+
return fmt.Errorf(errorMessage)
132+
}
133+
}
134+
return nil
135+
}
136+
99137
func (ctrl *Controller) syncKarmada(karmada *operatorv1alpha1.Karmada) error {
100138
klog.V(2).InfoS("Reconciling karmada", "name", karmada.Name)
101139
planner, err := NewPlannerFor(karmada, ctrl.Client, ctrl.Config)

0 commit comments

Comments
 (0)