From da1831efef46fed188fe745433d33a6551c49820 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=A4=A9=E5=85=83?= Date: Tue, 18 Aug 2020 11:00:18 +0800 Subject: [PATCH] add kubebuilder framework back and import oam-k8s-runtime --- Dockerfile | 9 +- Makefile | 58 ++++++++++++ PROJECT | 6 +- cmd/core/main.go | 94 ++++++++++++++++++++ config/default/manager_auth_proxy_patch.yaml | 25 ++++++ config/default/manager_webhook_patch.yaml | 23 +++++ go.sum | 1 + 7 files changed, 207 insertions(+), 9 deletions(-) create mode 100644 cmd/core/main.go create mode 100644 config/default/manager_auth_proxy_patch.yaml create mode 100644 config/default/manager_webhook_patch.yaml diff --git a/Dockerfile b/Dockerfile index f83874c7b..df96693ab 100644 --- a/Dockerfile +++ b/Dockerfile @@ -10,16 +10,17 @@ COPY go.sum go.sum RUN go mod download # Copy the go source -COPY cmd/server/main.go main.go +COPY cmd/core/main.go main.go COPY api/ api/ -COPY controllers/ controllers/ +COPY pkg/ pkg/ # Build -RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GO111MODULE=on go build -a -o manager cmd/server/main.go +RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GO111MODULE=on go build -a -o manager main.go # Use distroless as minimal base image to package the manager binary # Refer to https://github.com/GoogleContainerTools/distroless for more details -FROM gcr.io/distroless/static:nonroot +# oamdev/gcr.io-distroless-static:nonroot is syncd from gcr.io/distroless/static:nonroot as somewhere can't reach gcr.io +FROM oamdev/gcr.io-distroless-static:nonroot WORKDIR / COPY --from=builder /workspace/manager . USER nonroot:nonroot diff --git a/Makefile b/Makefile index 5c9ae9710..2ca4bc4b5 100644 --- a/Makefile +++ b/Makefile @@ -55,3 +55,61 @@ e2e-api-test: e2e-cleanup: # Clean up + + +# Image URL to use all building/pushing image targets +IMG ?= vela-core:latest +# Produce CRDs that work back to Kubernetes 1.11 (no version conversion) +CRD_OPTIONS ?= "crd:trivialVersions=true" + +# Run tests +core-test: generate fmt vet manifests + go test ./pkg/... -coverprofile cover.out + +# Build manager binary +manager: generate fmt vet + go build -o bin/manager ./cmd/core/main.go + +# Run against the configured Kubernetes cluster in ~/.kube/config +core-run: generate fmt vet manifests + go run ./cmd/core/main.go + +# Install CRDs into a cluster +core-install: manifests + kustomize build config/crd | kubectl apply -f - + +# Uninstall CRDs from a cluster +core-uninstall: manifests + kustomize build config/crd | kubectl delete -f - + +# Deploy controller in the configured Kubernetes cluster in ~/.kube/config +core-deploy: manifests + cd config/manager && kustomize edit set image controller=${IMG} + kustomize build config/default | kubectl apply -f - + +# Generate manifests e.g. CRD, RBAC etc. +manifests: controller-gen + $(CONTROLLER_GEN) $(CRD_OPTIONS) rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=config/crd/bases + + +# Generate code +generate: controller-gen + $(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..." + + +# find or download controller-gen +# download controller-gen if necessary +controller-gen: +ifeq (, $(shell which controller-gen)) + @{ \ + set -e ;\ + CONTROLLER_GEN_TMP_DIR=$$(mktemp -d) ;\ + cd $$CONTROLLER_GEN_TMP_DIR ;\ + go mod init tmp ;\ + go get sigs.k8s.io/controller-tools/cmd/controller-gen@v0.2.5 ;\ + rm -rf $$CONTROLLER_GEN_TMP_DIR ;\ + } +CONTROLLER_GEN=$(GOBIN)/controller-gen +else +CONTROLLER_GEN=$(shell which controller-gen) +endif diff --git a/PROJECT b/PROJECT index de9bede36..169a3d9e9 100644 --- a/PROJECT +++ b/PROJECT @@ -1,7 +1,3 @@ domain: oam.dev -repo: github.com/cloud-native-application/vela -resources: -- group: admin - kind: Template - version: v1alpha2 +repo: github.com/cloud-native-application/rudrx version: "2" diff --git a/cmd/core/main.go b/cmd/core/main.go new file mode 100644 index 000000000..8772549eb --- /dev/null +++ b/cmd/core/main.go @@ -0,0 +1,94 @@ +package main + +import ( + "flag" + "io" + "os" + "strconv" + + "github.com/crossplane/crossplane-runtime/pkg/logging" + "go.uber.org/zap/zapcore" + "gopkg.in/natefinch/lumberjack.v2" + "k8s.io/apimachinery/pkg/runtime" + clientgoscheme "k8s.io/client-go/kubernetes/scheme" + ctrl "sigs.k8s.io/controller-runtime" + "sigs.k8s.io/controller-runtime/pkg/log/zap" + + "github.com/crossplane/oam-kubernetes-runtime/apis/core" + controller "github.com/crossplane/oam-kubernetes-runtime/pkg/controller/v1alpha2" + webhook "github.com/crossplane/oam-kubernetes-runtime/pkg/webhook/v1alpha2" +) + +var scheme = runtime.NewScheme() + +func init() { + _ = clientgoscheme.AddToScheme(scheme) + _ = core.AddToScheme(scheme) + // +kubebuilder:scaffold:scheme +} + +func main() { + var metricsAddr, logFilePath string + var enableLeaderElection, logCompress bool + var logRetainDate int + var certDir string + var webhookPort int + var useWebhook bool + + flag.BoolVar(&useWebhook, "use-webhook", false, "Enable Admission Webhook") + flag.StringVar(&certDir, "webhook-cert-dir", "/k8s-webhook-server/serving-certs", "Admission webhook cert/key dir.") + flag.IntVar(&webhookPort, "webhook-port", 9443, "admission webhook listen address") + flag.StringVar(&metricsAddr, "metrics-addr", ":8080", "The address the metric endpoint binds to.") + flag.BoolVar(&enableLeaderElection, "enable-leader-election", false, + "Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager.") + flag.StringVar(&logFilePath, "log-file-path", "", "The address the metric endpoint binds to.") + flag.IntVar(&logRetainDate, "log-retain-date", 7, "The number of days of logs history to retain.") + flag.BoolVar(&logCompress, "log-compress", true, "Enable compression on the rotated logs.") + flag.Parse() + + // setup logging + var w io.Writer + if len(logFilePath) > 0 { + w = zapcore.AddSync(&lumberjack.Logger{ + Filename: logFilePath, + MaxAge: logRetainDate, // days + Compress: logCompress, + }) + } else { + w = os.Stdout + } + + ctrl.SetLogger(zap.New(func(o *zap.Options) { + o.Development = true + o.DestWritter = w + })) + + oamLog := ctrl.Log.WithName("vela-core") + mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{ + Scheme: scheme, + MetricsBindAddress: metricsAddr, + LeaderElection: enableLeaderElection, + LeaderElectionID: "vela-core", + Port: webhookPort, + CertDir: certDir, + }) + if err != nil { + oamLog.Error(err, "unable to create a controller manager") + os.Exit(1) + } + + if useWebhook { + oamLog.Info("OAM webhook enabled, will serving at :" + strconv.Itoa(webhookPort)) + webhook.Add(mgr) + } + + if err = controller.Setup(mgr, logging.NewLogrLogger(oamLog)); err != nil { + oamLog.Error(err, "unable to setup the oam core controller") + os.Exit(1) + } + oamLog.Info("starting the controller manager") + if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil { + oamLog.Error(err, "problem running manager") + os.Exit(1) + } +} diff --git a/config/default/manager_auth_proxy_patch.yaml b/config/default/manager_auth_proxy_patch.yaml new file mode 100644 index 000000000..77e743d1c --- /dev/null +++ b/config/default/manager_auth_proxy_patch.yaml @@ -0,0 +1,25 @@ +# This patch inject a sidecar container which is a HTTP proxy for the +# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: controller-manager + namespace: system +spec: + template: + spec: + containers: + - name: kube-rbac-proxy + image: gcr.io/kubebuilder/kube-rbac-proxy:v0.5.0 + args: + - "--secure-listen-address=0.0.0.0:8443" + - "--upstream=http://127.0.0.1:8080/" + - "--logtostderr=true" + - "--v=10" + ports: + - containerPort: 8443 + name: https + - name: manager + args: + - "--metrics-addr=127.0.0.1:8080" + - "--enable-leader-election" diff --git a/config/default/manager_webhook_patch.yaml b/config/default/manager_webhook_patch.yaml new file mode 100644 index 000000000..738de350b --- /dev/null +++ b/config/default/manager_webhook_patch.yaml @@ -0,0 +1,23 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: controller-manager + namespace: system +spec: + template: + spec: + containers: + - name: manager + ports: + - containerPort: 9443 + name: webhook-server + protocol: TCP + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true + volumes: + - name: cert + secret: + defaultMode: 420 + secretName: webhook-server-cert diff --git a/go.sum b/go.sum index e328eff64..be46d778d 100644 --- a/go.sum +++ b/go.sum @@ -594,6 +594,7 @@ github.com/rogpeppe/go-internal v1.4.0 h1:LUa41nrWTQNGhzdsZ5lTnkwbNjj6rXTdazA1cS github.com/rogpeppe/go-internal v1.4.0/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc= github.com/rogpeppe/go-internal v1.6.0 h1:IZRgg4sfrDH7nsAD1Y/Nwj+GzIfEwpJSLjCaNC3SbsI= github.com/rogpeppe/go-internal v1.6.0/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc= +github.com/rs/xid v1.2.1 h1:mhH9Nq+C1fY2l1XIpgxIiUOfNpRBYH1kKcr+qfKgjRc= github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ= github.com/rubenv/sql-migrate v0.0.0-20200212082348-64f95ea68aa3 h1:xkBtI5JktwbW/vf4vopBbhYsRFTGfQWHYXzC0/qYwxI= github.com/rubenv/sql-migrate v0.0.0-20200212082348-64f95ea68aa3/go.mod h1:rtQlpHw+eR6UrqaS3kX1VYeaCxzCVdimDS7g5Ln4pPc=