Skip to content

Commit e3b8a9b

Browse files
prateekgogiaprateekgogia
authored
- Fix service IP, RBAC rules for CoreDNS (#54)
- Add kubelet role to authenticator config - Add podspec merge functionality to KCM and scheduler
1 parent 9786b50 commit e3b8a9b

File tree

4 files changed

+71
-48
lines changed

4 files changed

+71
-48
lines changed

‎operator/pkg/controllers/addons/coredns.go

+6-1
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ import (
3030
)
3131

3232
const (
33-
clusterIP = "10.96.0.10" // TODO hard coded for now fix this
33+
clusterIP = "10.100.0.10" // TODO hard coded for now fix this
3434
)
3535

3636
type CoreDNS struct {
@@ -81,6 +81,10 @@ func (c *CoreDNS) clusterRole(ctx context.Context) error {
8181
APIGroups: []string{""},
8282
Resources: []string{"nodes"},
8383
Verbs: []string{"get"},
84+
}, {
85+
APIGroups: []string{"discovery.k8s.io"},
86+
Resources: []string{"endpointslices"},
87+
Verbs: []string{"list", "watch"},
8488
}},
8589
})
8690
}
@@ -189,6 +193,7 @@ func (c *CoreDNS) deployment(ctx context.Context) error {
189193
Labels: coreDNSLabels(),
190194
},
191195
Spec: v1.PodSpec{
196+
DNSPolicy: v1.DNSDefault,
192197
PriorityClassName: "system-cluster-critical",
193198
ServiceAccountName: "coredns",
194199
Containers: []v1.Container{{

‎operator/pkg/controllers/master/authenticatorconfig.go

+7-1
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,13 @@ func (c *Controller) reconcileAuthenticatorConfig(ctx context.Context, controlPl
3737
if err != nil {
3838
return fmt.Errorf("getting AWS account ID, %w", err)
3939
}
40-
configMapBytes, err := ParseTemplate(authenticatorConfig, struct{ ClusterName, Namespace, Group, AWSAccountID, PrivateDNS string }{
40+
configMapBytes, err := ParseTemplate(authenticatorConfig, struct{ ClusterName, Namespace, Group, AWSAccountID, PrivateDNS, SessionName string }{
4141
ClusterName: controlPlane.ClusterName(),
4242
Namespace: controlPlane.Namespace,
4343
Group: v1alpha1.SchemeGroupVersion.Group,
4444
AWSAccountID: awsAccountID,
4545
PrivateDNS: "{{EC2PrivateDNSName}}",
46+
SessionName: "{{SessionNameRaw}}",
4647
})
4748
if err != nil {
4849
return fmt.Errorf("generating authenticator config, %w", err)
@@ -166,6 +167,11 @@ data:
166167
- system:nodes
167168
rolearn: arn:aws:iam::{{ .AWSAccountID }}:role/KitNodeRole
168169
username: system:node:{{ .PrivateDNS}}
170+
- groups:
171+
- system:bootstrappers
172+
- system:nodes
173+
rolearn: arn:aws:iam::{{ .AWSAccountID }}:role/KitletNodeRole
174+
username: system:node:{{ .SessionName }}
169175
# List of Account IDs to whitelist for authentication
170176
mapAccounts:
171177
- {{ .AWSAccountID }}

‎operator/pkg/controllers/master/kubecontrollermanager.go

+29-23
Original file line numberDiff line numberDiff line change
@@ -23,36 +23,42 @@ import (
2323
"github.com/awslabs/kit/operator/pkg/utils/functional"
2424
"github.com/awslabs/kit/operator/pkg/utils/imageprovider"
2525
"github.com/awslabs/kit/operator/pkg/utils/object"
26+
"github.com/awslabs/kit/operator/pkg/utils/patch"
2627
appsv1 "k8s.io/api/apps/v1"
2728
v1 "k8s.io/api/core/v1"
2829
"k8s.io/apimachinery/pkg/api/resource"
2930
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
3031
)
3132

32-
func (c *Controller) reconcileKCM(ctx context.Context, controlPlane *v1alpha1.ControlPlane) error {
33-
return c.kubeClient.EnsurePatch(ctx, &appsv1.Deployment{}, object.WithOwner(controlPlane, kcmDeploymentSpec(controlPlane)))
34-
}
35-
36-
func kcmDeploymentSpec(controlPlane *v1alpha1.ControlPlane) *appsv1.Deployment {
37-
return &appsv1.Deployment{
38-
ObjectMeta: metav1.ObjectMeta{
39-
Name: KCMDeploymentName(controlPlane.ClusterName()),
40-
Namespace: controlPlane.Namespace,
41-
},
42-
Spec: appsv1.DeploymentSpec{
43-
Selector: &metav1.LabelSelector{
44-
MatchLabels: kcmLabels(controlPlane.ClusterName()),
33+
func (c *Controller) reconcileKCM(ctx context.Context, controlPlane *v1alpha1.ControlPlane) (err error) {
34+
kcmPodSpec := kcmPodSpecFor(controlPlane)
35+
if controlPlane.Spec.Master.ControllerManager != nil {
36+
kcmPodSpec, err = patch.PodSpec(&kcmPodSpec, controlPlane.Spec.Master.ControllerManager.Spec)
37+
if err != nil {
38+
return fmt.Errorf("patch KCM pod spec, %w", err)
39+
}
40+
}
41+
return c.kubeClient.EnsurePatch(ctx, &appsv1.Deployment{},
42+
object.WithOwner(controlPlane, &appsv1.Deployment{
43+
ObjectMeta: metav1.ObjectMeta{
44+
Name: KCMDeploymentName(controlPlane.ClusterName()),
45+
Namespace: controlPlane.Namespace,
4546
},
46-
Replicas: aws.Int32(3),
47-
Strategy: appsv1.DeploymentStrategy{Type: appsv1.RecreateDeploymentStrategyType},
48-
Template: v1.PodTemplateSpec{
49-
ObjectMeta: metav1.ObjectMeta{
50-
Labels: kcmLabels(controlPlane.ClusterName()),
47+
Spec: appsv1.DeploymentSpec{
48+
Selector: &metav1.LabelSelector{
49+
MatchLabels: kcmLabels(controlPlane.ClusterName()),
50+
},
51+
Replicas: aws.Int32(3),
52+
Strategy: appsv1.DeploymentStrategy{Type: appsv1.RecreateDeploymentStrategyType},
53+
Template: v1.PodTemplateSpec{
54+
ObjectMeta: metav1.ObjectMeta{
55+
Labels: kcmLabels(controlPlane.ClusterName()),
56+
},
57+
Spec: kcmPodSpec,
5158
},
52-
Spec: *kcmPodSpecFor(controlPlane),
5359
},
54-
},
55-
}
60+
}),
61+
)
5662
}
5763

5864
func KCMDeploymentName(clusterName string) string {
@@ -63,9 +69,9 @@ func kcmLabels(clustername string) map[string]string {
6369
return functional.UnionStringMaps(labelsFor(clustername), map[string]string{"component": "kube-controller-manager"})
6470
}
6571

66-
func kcmPodSpecFor(controlPlane *v1alpha1.ControlPlane) *v1.PodSpec {
72+
func kcmPodSpecFor(controlPlane *v1alpha1.ControlPlane) v1.PodSpec {
6773
hostPathDirectoryOrCreate := v1.HostPathDirectoryOrCreate
68-
return &v1.PodSpec{
74+
return v1.PodSpec{
6975
TerminationGracePeriodSeconds: aws.Int64(1),
7076
HostNetwork: true,
7177
DNSPolicy: v1.DNSClusterFirstWithHostNet,

‎operator/pkg/controllers/master/kubescheduler.go

+29-23
Original file line numberDiff line numberDiff line change
@@ -22,36 +22,42 @@ import (
2222
"github.com/awslabs/kit/operator/pkg/apis/controlplane/v1alpha1"
2323
"github.com/awslabs/kit/operator/pkg/utils/imageprovider"
2424
"github.com/awslabs/kit/operator/pkg/utils/object"
25+
"github.com/awslabs/kit/operator/pkg/utils/patch"
2526
appsv1 "k8s.io/api/apps/v1"
2627
v1 "k8s.io/api/core/v1"
2728
"k8s.io/apimachinery/pkg/api/resource"
2829
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2930
)
3031

31-
func (c *Controller) reconcileScheduler(ctx context.Context, controlPlane *v1alpha1.ControlPlane) error {
32-
return c.kubeClient.EnsurePatch(ctx, &appsv1.Deployment{}, object.WithOwner(controlPlane, schedulerDeploymentSpec(controlPlane)))
33-
}
34-
35-
func schedulerDeploymentSpec(controlPlane *v1alpha1.ControlPlane) *appsv1.Deployment {
36-
return &appsv1.Deployment{
37-
ObjectMeta: metav1.ObjectMeta{
38-
Name: SchedulerDeploymentName(controlPlane.ClusterName()),
39-
Namespace: controlPlane.Namespace,
40-
},
41-
Spec: appsv1.DeploymentSpec{
42-
Selector: &metav1.LabelSelector{
43-
MatchLabels: schedulerLabels(controlPlane.ClusterName()),
32+
func (c *Controller) reconcileScheduler(ctx context.Context, controlPlane *v1alpha1.ControlPlane) (err error) {
33+
schedulerPodSpec := schedulerPodSpecFor(controlPlane)
34+
if controlPlane.Spec.Master.Scheduler != nil {
35+
schedulerPodSpec, err = patch.PodSpec(&schedulerPodSpec, controlPlane.Spec.Master.Scheduler.Spec)
36+
if err != nil {
37+
return fmt.Errorf("patch scheduler pod spec, %w", err)
38+
}
39+
}
40+
return c.kubeClient.EnsurePatch(ctx, &appsv1.Deployment{},
41+
object.WithOwner(controlPlane, &appsv1.Deployment{
42+
ObjectMeta: metav1.ObjectMeta{
43+
Name: SchedulerDeploymentName(controlPlane.ClusterName()),
44+
Namespace: controlPlane.Namespace,
4445
},
45-
Replicas: aws.Int32(3),
46-
Strategy: appsv1.DeploymentStrategy{Type: appsv1.RecreateDeploymentStrategyType},
47-
Template: v1.PodTemplateSpec{
48-
ObjectMeta: metav1.ObjectMeta{
49-
Labels: schedulerLabels(controlPlane.ClusterName()),
46+
Spec: appsv1.DeploymentSpec{
47+
Selector: &metav1.LabelSelector{
48+
MatchLabels: schedulerLabels(controlPlane.ClusterName()),
49+
},
50+
Replicas: aws.Int32(3),
51+
Strategy: appsv1.DeploymentStrategy{Type: appsv1.RecreateDeploymentStrategyType},
52+
Template: v1.PodTemplateSpec{
53+
ObjectMeta: metav1.ObjectMeta{
54+
Labels: schedulerLabels(controlPlane.ClusterName()),
55+
},
56+
Spec: schedulerPodSpec,
5057
},
51-
Spec: *schedulerPodSpecFor(controlPlane),
5258
},
53-
},
54-
}
59+
}),
60+
)
5561
}
5662

5763
func SchedulerDeploymentName(clusterName string) string {
@@ -64,9 +70,9 @@ func schedulerLabels(clustername string) map[string]string {
6470
}
6571
}
6672

67-
func schedulerPodSpecFor(controlPlane *v1alpha1.ControlPlane) *v1.PodSpec {
73+
func schedulerPodSpecFor(controlPlane *v1alpha1.ControlPlane) v1.PodSpec {
6874
hostPathDirectoryOrCreate := v1.HostPathDirectoryOrCreate
69-
return &v1.PodSpec{
75+
return v1.PodSpec{
7076
TerminationGracePeriodSeconds: aws.Int64(1),
7177
HostNetwork: true,
7278
DNSPolicy: v1.DNSClusterFirstWithHostNet,

0 commit comments

Comments
 (0)