github/capsule
1
0
Fork 0
mirror of https://github.com/projectcapsule/capsule.git synced 2026-08-25 16:07:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

Making CR/CRB names conforming to Kubernetes naming requirements (#91)

Browse Source
This commit is contained in:
Dario Tranchitella
2020-09-12 12:14:52 +02:00
committed by GitHub
parent 303fc4d69c
commit 9d0a7a78c1
7 changed files with 15 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -4
View File
@@ -61,7 +61,7 @@ make deploy
Log verbosity of the Capsule controller can be increased by passing the `--zap-log-level` option with a value from `1` to `10` or the [basic keywords](https://godoc.org/go.uber.org/zap/zapcore#Level) although it is suggested to use the `--zap-devel` flag to get also stack traces.
During startup Capsule controller will create additional ClusterRoles `capsule-namespace:deleter`, `capsule-namespace:provisioner` and ClusterRoleBinding `capsule-namespace:provisioner`. These resources are used in order to allow Capsule users to manage their namespaces in tenants.
During startup Capsule controller will create additional ClusterRoles `capsule-namespace-deleter`, `capsule-namespace-provisioner` and ClusterRoleBinding `capsule-namespace-provisioner`. These resources are used in order to allow Capsule users to manage their namespaces in tenants.
You can disallow users to create namespaces matching a particular regexp by passing `--protected-namespace-regex` option with a value of regular expression.
@@ -125,12 +125,9 @@ make remove
# /usr/local/bin/kustomize build config/default | kubectl delete -f -
# namespace "capsule-system" deleted
# customresourcedefinition.apiextensions.k8s.io "tenants.capsule.clastix.io" deleted
# clusterrole.rbac.authorization.k8s.io "capsule-namespace:deleter" deleted
# clusterrole.rbac.authorization.k8s.io "capsule-namespace:provisioner" deleted
# clusterrole.rbac.authorization.k8s.io "capsule-proxy-role" deleted
# clusterrole.rbac.authorization.k8s.io "capsule-metrics-reader" deleted
# clusterrolebinding.rbac.authorization.k8s.io "capsule-manager-rolebinding" deleted
# clusterrolebinding.rbac.authorization.k8s.io "capsule-namespace:provisioner" deleted
# clusterrolebinding.rbac.authorization.k8s.io "capsule-proxy-rolebinding" deleted
# secret "capsule-ca" deleted
# secret "capsule-tls" deleted
contributing.md
+2 -2
View File
@@ -155,9 +155,9 @@ You can check if Capsule is running tailing the logs:
```
# kubectl -n capsule-system logs --all-containers -f -l control-plane=controller-manager
...
2020-08-03T15:37:44.031Z INFO controllers.Tenant Role Binding sync result: unchanged {"Request.Name": "oil", "name": "namespace:deleter", "namespace": "oil-dev"}
2020-08-03T15:37:44.031Z INFO controllers.Tenant Role Binding sync result: unchanged {"Request.Name": "oil", "name": "namespace-deleter", "namespace": "oil-dev"}
2020-08-03T15:37:44.032Z INFO controllers.Tenant Role Binding sync result: unchanged {"Request.Name": "oil", "name": "namespace:admin", "namespace": "oil-production"}
2020-08-03T15:37:44.032Z INFO controllers.Tenant Role Binding sync result: unchanged {"Request.Name": "oil", "name": "namespace:deleter", "namespace": "oil-production"}
2020-08-03T15:37:44.032Z INFO controllers.Tenant Role Binding sync result: unchanged {"Request.Name": "oil", "name": "namespace-deleter", "namespace": "oil-production"}
2020-08-03T15:37:44.032Z INFO controllers.Tenant Tenant reconciling completed {"Request.Name": "oil"}
2020-08-03T15:37:44.032Z DEBUG controller-runtime.controller Successfully Reconciled {"controller": "tenant", "request": "/oil"}
2020-08-03T15:37:46.945Z INFO controllers.Namespace Reconciling Namespace {"Request.Name": "oil-staging"}
controllers/rbac/const.go
+2 -2
View File
@@ -22,8 +22,8 @@ import (
)
const (
ProvisionerRoleName = "capsule-namespace:provisioner"
DeleterRoleName = "capsule-namespace:deleter"
ProvisionerRoleName = "capsule-namespace-provisioner"
DeleterRoleName = "capsule-namespace-deleter"
)
var (
controllers/tenant_controller.go
+1 -1
View File
@@ -531,7 +531,7 @@ func (r *TenantReconciler) ownerRoleBinding(tenant *capsulev1alpha1.Tenant) erro
Kind: "ClusterRole",
Name: "admin",
}
rbl[types.NamespacedName{Namespace: i, Name: "namespace:deleter"}] = rbacv1.RoleRef{
rbl[types.NamespacedName{Namespace: i, Name: "namespace-deleter"}] = rbacv1.RoleRef{
APIGroup: "rbac.authorization.k8s.io",
Kind: "ClusterRole",
Name: rbac.DeleterRoleName,
e2e/suite_test.go
+1 -1
View File
@@ -48,7 +48,7 @@ var (
k8sClient client.Client
testEnv *envtest.Environment
defaulManagerPodArgs []string
tenantRoleBindingNames = []string{"namespace:admin", "namespace:deleter"}
tenantRoleBindingNames = []string{"namespace:admin", "namespace-deleter"}
)
const (
e2e/utils_test.go
+2 -1
View File
@@ -31,6 +31,7 @@ import (
"sigs.k8s.io/controller-runtime/pkg/client"
"github.com/clastix/capsule/api/v1alpha1"
"github.com/clastix/capsule/controllers/rbac"
)
const (
@@ -74,7 +75,7 @@ func CapsuleClusterGroupParamShouldBeUpdated(capsuleClusterGroup string, timeout
capsuleCRB := &rbacv1.ClusterRoleBinding{}
Eventually(func() string {
Expect(k8sClient.Get(context.TODO(), types.NamespacedName{Name: "capsule-namespace:provisioner"}, capsuleCRB)).Should(Succeed())
Expect(k8sClient.Get(context.TODO(), types.NamespacedName{Name: rbac.ProvisionerRoleName}, capsuleCRB)).Should(Succeed())
return capsuleCRB.Subjects[0].Name
}, timeout, defaultPollInterval).Should(BeIdenticalTo(capsuleClusterGroup))
use_cases.md
+6 -6
View File
@@ -156,7 +156,7 @@ kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
labels:
name: namespace:provisioner
name: namespace-provisioner
rules:
- apiGroups: [""]
resources: ["namespaces"]
@@ -165,13 +165,13 @@ rules:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: namespace:provisioner
name: namespace-provisioner
subjects:
- kind: Group
name: capsule.clastix.io
roleRef:
kind: ClusterRole
name: namespace:provisioner
name: namespace-provisioner
apiGroup: rbac.authorization.k8s.io
```
@@ -250,14 +250,14 @@ roleRef:
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: namespace:deleter
name: namespace-deleter
namespace: oil-production
subjects:
- kind: User
name: alice
roleRef:
kind: ClusterRole
name: namespace:deleter
name: namespace-deleter
apiGroup: rbac.authorization.k8s.io
```
@@ -293,7 +293,7 @@ Alice is the admin of the namespace:
alice@caas# kubectl get rolebindings -n oil-production
NAME ROLE AGE
namespace:admin ClusterRole/admin 9m5s
namespace:deleter ClusterRole/admin 9m5s
namespace-deleter ClusterRole/admin 9m5s
```
The said Role Binding resources are automatically created by Capsule when Alice creates a namespace in the tenant.