Merge pull request #203 from alexander-demicev/injectmanifests

k8s-ci-robot · web-flow · commit 6b36677c7822 · 2023-08-04T06:22:22.000-07:00
✨Inject additional manifests on provider installation/upgrade
diff --git a/Tiltfile b/Tiltfile
@@ -18,7 +18,10 @@ def build_image():
         "OWNERS_ALIASES",
         "PROJECT",
         "SECURITY_CONTACTS"
-        ]
+        ],
+       build_args = {
+        "builder_image": "docker.io/library/golang:1.20.4",
+        }
     )
 
 def deploy():
diff --git a/api/v1alpha1/provider_types.go b/api/v1alpha1/provider_types.go
@@ -63,6 +63,23 @@ type ProviderSpec struct {
 	// https://github.com/kubernetes-sigs/cluster-api-provider-aws/releases.
 	// +optional
 	FetchConfig *FetchConfiguration `json:"fetchConfig,omitempty"`
+
+	// AdditionalManifests is reference to configmap that contains additional manifests that will be applied
+	// together with the provider components. The key for storing these manifests has to be `manifests`.
+	// The manifests are applied only once when a certain release is installed/upgraded. If namespace is not specified, the
+	// namespace of the provider will be used. There is no validation of the yaml content inside the configmap.
+	// +optional
+	AdditionalManifestsRef *ConfigmapReference `json:"additionalManifests,omitempty"`
+}
+
+// ConfigmapReference contains enough information to locate the configmap.
+type ConfigmapReference struct {
+	// Name defines the name of the configmap.
+	Name string `json:"name"`
+
+	// Namespace defines the namespace of the configmap.
+	// +optional
+	Namespace string `json:"namespace,omitempty"`
 }
 
 // ManagerSpec defines the properties that can be enabled on the controller manager for the provider.
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
diff --git a/config/crd/bases/operator.cluster.x-k8s.io_bootstrapproviders.yaml b/config/crd/bases/operator.cluster.x-k8s.io_bootstrapproviders.yaml
@@ -41,6 +41,23 @@ spec:
           spec:
             description: BootstrapProviderSpec defines the desired state of BootstrapProvider.
             properties:
+              additionalManifests:
+                description: AdditionalManifests is reference to configmap that contains
+                  additional manifests that will be applied together with the provider
+                  components. The key for storing these manifests has to be `manifests`.
+                  The manifests are applied only once when a certain release is installed/upgraded.
+                  If namespace is not specified, the namespace of the provider will
+                  be used. There is no validation of the yaml content inside the configmap.
+                properties:
+                  name:
+                    description: Name defines the name of the configmap.
+                    type: string
+                  namespace:
+                    description: Namespace defines the namespace of the configmap.
+                    type: string
+                required:
+                - name
+                type: object
               deployment:
                 description: Deployment defines the properties that can be enabled
                   on the deployment for the provider.
diff --git a/config/crd/bases/operator.cluster.x-k8s.io_controlplaneproviders.yaml b/config/crd/bases/operator.cluster.x-k8s.io_controlplaneproviders.yaml
@@ -42,6 +42,23 @@ spec:
           spec:
             description: ControlPlaneProviderSpec defines the desired state of ControlPlaneProvider.
             properties:
+              additionalManifests:
+                description: AdditionalManifests is reference to configmap that contains
+                  additional manifests that will be applied together with the provider
+                  components. The key for storing these manifests has to be `manifests`.
+                  The manifests are applied only once when a certain release is installed/upgraded.
+                  If namespace is not specified, the namespace of the provider will
+                  be used. There is no validation of the yaml content inside the configmap.
+                properties:
+                  name:
+                    description: Name defines the name of the configmap.
+                    type: string
+                  namespace:
+                    description: Namespace defines the namespace of the configmap.
+                    type: string
+                required:
+                - name
+                type: object
               deployment:
                 description: Deployment defines the properties that can be enabled
                   on the deployment for the provider.
diff --git a/config/crd/bases/operator.cluster.x-k8s.io_coreproviders.yaml b/config/crd/bases/operator.cluster.x-k8s.io_coreproviders.yaml
@@ -41,6 +41,23 @@ spec:
           spec:
             description: CoreProviderSpec defines the desired state of CoreProvider.
             properties:
+              additionalManifests:
+                description: AdditionalManifests is reference to configmap that contains
+                  additional manifests that will be applied together with the provider
+                  components. The key for storing these manifests has to be `manifests`.
+                  The manifests are applied only once when a certain release is installed/upgraded.
+                  If namespace is not specified, the namespace of the provider will
+                  be used. There is no validation of the yaml content inside the configmap.
+                properties:
+                  name:
+                    description: Name defines the name of the configmap.
+                    type: string
+                  namespace:
+                    description: Namespace defines the namespace of the configmap.
+                    type: string
+                required:
+                - name
+                type: object
               deployment:
                 description: Deployment defines the properties that can be enabled
                   on the deployment for the provider.
diff --git a/config/crd/bases/operator.cluster.x-k8s.io_infrastructureproviders.yaml b/config/crd/bases/operator.cluster.x-k8s.io_infrastructureproviders.yaml
@@ -42,6 +42,23 @@ spec:
           spec:
             description: InfrastructureProviderSpec defines the desired state of InfrastructureProvider.
             properties:
+              additionalManifests:
+                description: AdditionalManifests is reference to configmap that contains
+                  additional manifests that will be applied together with the provider
+                  components. The key for storing these manifests has to be `manifests`.
+                  The manifests are applied only once when a certain release is installed/upgraded.
+                  If namespace is not specified, the namespace of the provider will
+                  be used. There is no validation of the yaml content inside the configmap.
+                properties:
+                  name:
+                    description: Name defines the name of the configmap.
+                    type: string
+                  namespace:
+                    description: Namespace defines the namespace of the configmap.
+                    type: string
+                required:
+                - name
+                type: object
               deployment:
                 description: Deployment defines the properties that can be enabled
                   on the deployment for the provider.
diff --git a/docs/README.md b/docs/README.md
@@ -26,6 +26,7 @@
   * [Modifying a Provider](#modifying-a-provider)
   * [Deleting a Provider](#deleting-a-provider)
 - [Air-gapped Environment](#air-gapped-environment)
+- [Injecting additional manifests](#injecting-additional-manifests)
 
 # Introduction
 
@@ -717,3 +718,30 @@ yq eval -i '.metadata.labels += {"my-label": "label-value"}' configmap.yaml
 ```sh
 kubectl create -f configmap.yaml
 ```
+
+## Injecting additional manifests
+
+It is possible to inject additional manifests when installing/upgrading a provider. This can be useful when you need to add extra RBAC resources to the provider controller, for example.
+The field `AdditionalManifests` is a reference to a ConfigMap that contains additional manifests, which will be applied together with the provider components. The key for storing these manifests has to be `manifests`.
+The manifests are applied only once when a certain release is installed/upgraded. If the namespace is not specified, the namespace of the provider will be used. There is no validation of the YAML content inside the ConfigMap.
+
+```yaml
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: additional-manifests
+  namespace: capi-system
+data:
+  manifests: |
+    # Additional manifests go here
+---
+apiVersion: operator.cluster.x-k8s.io/v1alpha1
+kind: CoreProvider
+metadata:
+  name: cluster-api
+  namespace: capi-system
+spec:
+  additionalManifests:
+      name: additional-manifests
+```
diff --git a/internal/controller/manifests_downloader.go b/internal/controller/manifests_downloader.go
@@ -40,8 +40,9 @@ const (
 
 	compressedAnnotation = "provider.cluster.x-k8s.io/compressed"
 
-	metadataConfigMapKey   = "metadata"
-	componentsConfigMapKey = "components"
+	metadataConfigMapKey            = "metadata"
+	componentsConfigMapKey          = "components"
+	additionalManifestsConfigMapKey = "manifests"
 
 	maxConfigMapSize = 1 * 1024 * 1024
 )
diff --git a/internal/controller/phases.go b/internal/controller/phases.go
@@ -155,7 +155,12 @@ func (p *phaseReconciler) load(ctx context.Context) (reconcile.Result, error) {
 		labelSelector = p.provider.GetSpec().FetchConfig.Selector
 	}
 
-	p.repo, err = p.configmapRepository(ctx, labelSelector)
+	additionalManifests, err := p.fetchAddionalManifests(ctx)
+	if err != nil {
+		return reconcile.Result{}, wrapPhaseError(err, "failed to load additional manifests")
+	}
+
+	p.repo, err = p.configmapRepository(ctx, labelSelector, additionalManifests)
 	if err != nil {
 		return reconcile.Result{}, wrapPhaseError(err, "failed to load the repository")
 	}
@@ -242,7 +247,7 @@ func (p *phaseReconciler) secretReader(ctx context.Context) (configclient.Reader
 
 // configmapRepository use clusterctl NewMemoryRepository structure to store the manifests
 // and metadata from a given configmap.
-func (p *phaseReconciler) configmapRepository(ctx context.Context, labelSelector *metav1.LabelSelector) (repository.Repository, error) {
+func (p *phaseReconciler) configmapRepository(ctx context.Context, labelSelector *metav1.LabelSelector, additionalManifests string) (repository.Repository, error) {
 	mr := repository.NewMemoryRepository()
 	mr.WithPaths("", "components.yaml")
 
@@ -289,12 +294,30 @@ func (p *phaseReconciler) configmapRepository(ctx context.Context, labelSelector
 			return nil, err
 		}
 
+		if additionalManifests != "" {
+			components = components + "\n---\n" + additionalManifests
+		}
+
 		mr.WithFile(version, mr.ComponentsPath(), []byte(components))
 	}
 
 	return mr, nil
 }
 
+func (p *phaseReconciler) fetchAddionalManifests(ctx context.Context) (string, error) {
+	cm := &corev1.ConfigMap{}
+
+	if p.provider.GetSpec().AdditionalManifestsRef != nil {
+		key := types.NamespacedName{Namespace: p.provider.GetSpec().AdditionalManifestsRef.Namespace, Name: p.provider.GetSpec().AdditionalManifestsRef.Name}
+
+		if err := p.ctrlClient.Get(ctx, key, cm); err != nil {
+			return "", fmt.Errorf("failed to get ConfigMap %s/%s: %w", key.Namespace, key.Name, err)
+		}
+	}
+
+	return cm.Data[additionalManifestsConfigMapKey], nil
+}
+
 // getComponentsData returns components data based on if it's compressed or not.
 func getComponentsData(cm corev1.ConfigMap) (string, error) {
 	// Data is not compressed, return it immediately.
diff --git a/internal/controller/phases_test.go b/internal/controller/phases_test.go
@@ -131,7 +131,7 @@ releaseSeries:
 	contract: v1alpha3`
 
 	components := `
-	apiVersion: v1
+apiVersion: v1
 kind: Namespace
 metadata:
   labels:
@@ -147,12 +147,21 @@ metadata:
     control-plane: controller-manager
   name: capi-webhook-system
 ---`
+
+	additionalManifests := `
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: some-other-namespace
+---
+`
 	tests := []struct {
-		name               string
-		configMaps         []corev1.ConfigMap
-		want               repository.Repository
-		wantErr            string
-		wantDefaultVersion string
+		name                string
+		configMaps          []corev1.ConfigMap
+		additionalManifests string
+		want                repository.Repository
+		wantErr             string
+		wantDefaultVersion  string
 	}{
 		{
 			name:    "missing configmaps",
@@ -335,6 +344,28 @@ metadata:
 			},
 			wantDefaultVersion: "v1.2.3",
 		},
+		{
+			name: "with additional manifests",
+			configMaps: []corev1.ConfigMap{
+				{
+					TypeMeta: metav1.TypeMeta{
+						Kind:       "ConfigMap",
+						APIVersion: "v1",
+					},
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "v1.2.3",
+						Namespace: "ns1",
+						Labels:    map[string]string{"provider-components": "aws"},
+					},
+					Data: map[string]string{
+						"metadata":   metadata,
+						"components": components,
+					},
+				},
+			},
+			additionalManifests: additionalManifests,
+			wantDefaultVersion:  "v1.2.3",
+		},
 	}
 
 	for _, tt := range tests {
@@ -351,14 +382,25 @@ metadata:
 				g.Expect(fakeclient.Create(ctx, &tt.configMaps[i])).To(Succeed())
 			}
 
-			got, err := p.configmapRepository(context.TODO(), p.provider.GetSpec().FetchConfig.Selector)
+			got, err := p.configmapRepository(context.TODO(), p.provider.GetSpec().FetchConfig.Selector, tt.additionalManifests)
 			if len(tt.wantErr) > 0 {
 				g.Expect(err).Should(MatchError(tt.wantErr))
 				return
 			}
 			g.Expect(err).To(Succeed())
-			g.Expect(got.GetFile(got.DefaultVersion(), got.ComponentsPath())).To(Equal([]byte(components)))
-			g.Expect(got.GetFile(got.DefaultVersion(), "metadata.yaml")).To(Equal([]byte(metadata)))
+			gotComponents, err := got.GetFile(got.DefaultVersion(), got.ComponentsPath())
+			g.Expect(err).To(Succeed())
+
+			if tt.additionalManifests != "" {
+				g.Expect(string(gotComponents)).To(Equal(components + "\n---\n" + additionalManifests))
+			} else {
+				g.Expect(string(gotComponents)).To(Equal(components))
+			}
+
+			gotMetadata, err := got.GetFile(got.DefaultVersion(), "metadata.yaml")
+			g.Expect(err).To(Succeed())
+			g.Expect(string(gotMetadata)).To(Equal(metadata))
+
 			g.Expect(got.DefaultVersion()).To(Equal(tt.wantDefaultVersion))
 		})
 	}
diff --git a/internal/webhook/provider_webhook.go b/internal/webhook/provider_webhook.go
@@ -25,4 +25,8 @@ func setDefaultProviderSpec(providerSpec *operatorv1.ProviderSpec, providerNames
 	if providerSpec.SecretName != "" && providerSpec.SecretNamespace == "" {
 		providerSpec.SecretNamespace = providerNamespace
 	}
+
+	if providerSpec.AdditionalManifestsRef != nil && providerSpec.AdditionalManifestsRef.Namespace == "" {
+		providerSpec.AdditionalManifestsRef.Namespace = providerNamespace
+	}
 }
diff --git a/internal/webhook/provider_webhook_test.go b/internal/webhook/provider_webhook_test.go
diff --git a/test/e2e/minimal_configuration_test.go b/test/e2e/minimal_configuration_test.go

Original file line number	Diff line number	Diff line change
`@@ -40,8 +40,9 @@ const (`
`40`	`40`
`41`	`41`	`compressedAnnotation = "provider.cluster.x-k8s.io/compressed"`
`42`	`42`
`43`		`- metadataConfigMapKey = "metadata"`
`44`		`- componentsConfigMapKey = "components"`
	`43`	`+ metadataConfigMapKey = "metadata"`
	`44`	`+ componentsConfigMapKey = "components"`
	`45`	`+ additionalManifestsConfigMapKey = "manifests"`
`45`	`46`
`46`	`47`	`maxConfigMapSize = 1 * 1024 * 1024`
`47`	`48`	`)`