|
|
|
|
@@ -21,15 +21,15 @@ import (
|
|
|
|
|
|
|
|
|
|
const (
|
|
|
|
|
controlAgentNodeSelectorValue = "true"
|
|
|
|
|
controlAgentImage = "localhost/monok8s/control-agent:dev"
|
|
|
|
|
controlAgentImage = "localhost/monok8s/node-control:dev"
|
|
|
|
|
kubeconfig = "/etc/kubernetes/admin.conf"
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
func ApplyControlAgentDaemonSetResources(ctx context.Context, n *NodeContext) error {
|
|
|
|
|
func ApplyNodeControlDaemonSetResources(ctx context.Context, n *NodeContext) error {
|
|
|
|
|
// Only the control-plane should bootstrap this DaemonSet definition.
|
|
|
|
|
// And only when the feature is enabled.
|
|
|
|
|
if strings.TrimSpace(n.Config.Spec.ClusterRole) != "control-plane" || !n.Config.Spec.EnableControlAgent {
|
|
|
|
|
klog.InfoS("skipped for", "clusterRole", n.Config.Spec.ClusterRole, "enableControlAgent", n.Config.Spec.EnableControlAgent)
|
|
|
|
|
if strings.TrimSpace(n.Config.Spec.ClusterRole) != "control-plane" || !n.Config.Spec.EnableNodeControl {
|
|
|
|
|
klog.InfoS("skipped for", "clusterRole", n.Config.Spec.ClusterRole, "enableNodeAgent", n.Config.Spec.EnableNodeControl)
|
|
|
|
|
return nil
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
@@ -49,10 +49,10 @@ func ApplyControlAgentDaemonSetResources(ctx context.Context, n *NodeContext) er
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
labels := map[string]string{
|
|
|
|
|
"app.kubernetes.io/name": monov1alpha1.ControlAgentName,
|
|
|
|
|
"app.kubernetes.io/name": monov1alpha1.NodeAgentName,
|
|
|
|
|
"app.kubernetes.io/component": "agent",
|
|
|
|
|
"app.kubernetes.io/part-of": "monok8s",
|
|
|
|
|
"app.kubernetes.io/managed-by": "ctl",
|
|
|
|
|
"app.kubernetes.io/managed-by": monov1alpha1.NodeControlName,
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
kubeClient := clients.Kubernetes
|
|
|
|
|
@@ -60,16 +60,16 @@ func ApplyControlAgentDaemonSetResources(ctx context.Context, n *NodeContext) er
|
|
|
|
|
if err := ensureNamespace(ctx, kubeClient, namespace, labels); err != nil {
|
|
|
|
|
return fmt.Errorf("ensure namespace %q: %w", namespace, err)
|
|
|
|
|
}
|
|
|
|
|
if err := applyControlAgentServiceAccount(ctx, kubeClient, namespace, labels); err != nil {
|
|
|
|
|
if err := applyNodeAgentServiceAccount(ctx, kubeClient, namespace, labels); err != nil {
|
|
|
|
|
return fmt.Errorf("apply serviceaccount: %w", err)
|
|
|
|
|
}
|
|
|
|
|
if err := applyControlAgentClusterRole(ctx, kubeClient, labels); err != nil {
|
|
|
|
|
if err := applyNodeAgentClusterRole(ctx, kubeClient, labels); err != nil {
|
|
|
|
|
return fmt.Errorf("apply clusterrole: %w", err)
|
|
|
|
|
}
|
|
|
|
|
if err := applyControlAgentClusterRoleBinding(ctx, kubeClient, namespace, labels); err != nil {
|
|
|
|
|
if err := applyNodeAgentClusterRoleBinding(ctx, kubeClient, namespace, labels); err != nil {
|
|
|
|
|
return fmt.Errorf("apply clusterrolebinding: %w", err)
|
|
|
|
|
}
|
|
|
|
|
if err := applyControlAgentDaemonSet(ctx, kubeClient, namespace, labels); err != nil {
|
|
|
|
|
if err := applyNodeAgentDaemonSet(ctx, kubeClient, namespace, labels); err != nil {
|
|
|
|
|
return fmt.Errorf("apply daemonset: %w", err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
@@ -116,16 +116,16 @@ func copyStringMap(in map[string]string) map[string]string {
|
|
|
|
|
return out
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func applyControlAgentServiceAccount(ctx context.Context, kubeClient kubernetes.Interface, namespace string, labels map[string]string) error {
|
|
|
|
|
func applyNodeAgentServiceAccount(ctx context.Context, kubeClient kubernetes.Interface, namespace string, labels map[string]string) error {
|
|
|
|
|
want := &corev1.ServiceAccount{
|
|
|
|
|
ObjectMeta: metav1.ObjectMeta{
|
|
|
|
|
Name: monov1alpha1.ControlAgentName,
|
|
|
|
|
Name: monov1alpha1.NodeAgentName,
|
|
|
|
|
Namespace: namespace,
|
|
|
|
|
Labels: labels,
|
|
|
|
|
},
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
existing, err := kubeClient.CoreV1().ServiceAccounts(namespace).Get(ctx, monov1alpha1.ControlAgentName, metav1.GetOptions{})
|
|
|
|
|
existing, err := kubeClient.CoreV1().ServiceAccounts(namespace).Get(ctx, monov1alpha1.NodeAgentName, metav1.GetOptions{})
|
|
|
|
|
if apierrors.IsNotFound(err) {
|
|
|
|
|
_, err = kubeClient.CoreV1().ServiceAccounts(namespace).Create(ctx, want, metav1.CreateOptions{})
|
|
|
|
|
return err
|
|
|
|
|
@@ -148,7 +148,7 @@ func applyControlAgentServiceAccount(ctx context.Context, kubeClient kubernetes.
|
|
|
|
|
return err
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func applyControlAgentClusterRole(ctx context.Context, kubeClient kubernetes.Interface, labels map[string]string) error {
|
|
|
|
|
func applyNodeAgentClusterRole(ctx context.Context, kubeClient kubernetes.Interface, labels map[string]string) error {
|
|
|
|
|
wantRules := []rbacv1.PolicyRule{
|
|
|
|
|
{
|
|
|
|
|
APIGroups: []string{monov1alpha1.Group},
|
|
|
|
|
@@ -174,13 +174,13 @@ func applyControlAgentClusterRole(ctx context.Context, kubeClient kubernetes.Int
|
|
|
|
|
|
|
|
|
|
want := &rbacv1.ClusterRole{
|
|
|
|
|
ObjectMeta: metav1.ObjectMeta{
|
|
|
|
|
Name: monov1alpha1.ControlAgentName,
|
|
|
|
|
Name: monov1alpha1.NodeAgentName,
|
|
|
|
|
Labels: labels,
|
|
|
|
|
},
|
|
|
|
|
Rules: wantRules,
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
existing, err := kubeClient.RbacV1().ClusterRoles().Get(ctx, monov1alpha1.ControlAgentName, metav1.GetOptions{})
|
|
|
|
|
existing, err := kubeClient.RbacV1().ClusterRoles().Get(ctx, monov1alpha1.NodeAgentName, metav1.GetOptions{})
|
|
|
|
|
if apierrors.IsNotFound(err) {
|
|
|
|
|
_, err = kubeClient.RbacV1().ClusterRoles().Create(ctx, want, metav1.CreateOptions{})
|
|
|
|
|
return err
|
|
|
|
|
@@ -207,30 +207,30 @@ func applyControlAgentClusterRole(ctx context.Context, kubeClient kubernetes.Int
|
|
|
|
|
return err
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func applyControlAgentClusterRoleBinding(ctx context.Context, kubeClient kubernetes.Interface, namespace string, labels map[string]string) error {
|
|
|
|
|
func applyNodeAgentClusterRoleBinding(ctx context.Context, kubeClient kubernetes.Interface, namespace string, labels map[string]string) error {
|
|
|
|
|
wantRoleRef := rbacv1.RoleRef{
|
|
|
|
|
APIGroup: rbacv1.GroupName,
|
|
|
|
|
Kind: "ClusterRole",
|
|
|
|
|
Name: monov1alpha1.ControlAgentName,
|
|
|
|
|
Name: monov1alpha1.NodeAgentName,
|
|
|
|
|
}
|
|
|
|
|
wantSubjects := []rbacv1.Subject{
|
|
|
|
|
{
|
|
|
|
|
Kind: "ServiceAccount",
|
|
|
|
|
Name: monov1alpha1.ControlAgentName,
|
|
|
|
|
Name: monov1alpha1.NodeAgentName,
|
|
|
|
|
Namespace: namespace,
|
|
|
|
|
},
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
want := &rbacv1.ClusterRoleBinding{
|
|
|
|
|
ObjectMeta: metav1.ObjectMeta{
|
|
|
|
|
Name: monov1alpha1.ControlAgentName,
|
|
|
|
|
Name: monov1alpha1.NodeAgentName,
|
|
|
|
|
Labels: labels,
|
|
|
|
|
},
|
|
|
|
|
RoleRef: wantRoleRef,
|
|
|
|
|
Subjects: wantSubjects,
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
existing, err := kubeClient.RbacV1().ClusterRoleBindings().Get(ctx, monov1alpha1.ControlAgentName, metav1.GetOptions{})
|
|
|
|
|
existing, err := kubeClient.RbacV1().ClusterRoleBindings().Get(ctx, monov1alpha1.NodeAgentName, metav1.GetOptions{})
|
|
|
|
|
if apierrors.IsNotFound(err) {
|
|
|
|
|
_, err = kubeClient.RbacV1().ClusterRoleBindings().Create(ctx, want, metav1.CreateOptions{})
|
|
|
|
|
return err
|
|
|
|
|
@@ -241,7 +241,7 @@ func applyControlAgentClusterRoleBinding(ctx context.Context, kubeClient kuberne
|
|
|
|
|
|
|
|
|
|
// roleRef is immutable. If it differs, fail loudly instead of pretending we can patch it.
|
|
|
|
|
if !reflect.DeepEqual(existing.RoleRef, want.RoleRef) {
|
|
|
|
|
return fmt.Errorf("existing ClusterRoleBinding %q has different roleRef and must be recreated", monov1alpha1.ControlAgentName)
|
|
|
|
|
return fmt.Errorf("existing ClusterRoleBinding %q has different roleRef and must be recreated", monov1alpha1.NodeAgentName)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
changed := false
|
|
|
|
|
@@ -262,26 +262,26 @@ func applyControlAgentClusterRoleBinding(ctx context.Context, kubeClient kuberne
|
|
|
|
|
return err
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func applyControlAgentDaemonSet(ctx context.Context, kubeClient kubernetes.Interface, namespace string, labels map[string]string) error {
|
|
|
|
|
func applyNodeAgentDaemonSet(ctx context.Context, kubeClient kubernetes.Interface, namespace string, labels map[string]string) error {
|
|
|
|
|
privileged := true
|
|
|
|
|
|
|
|
|
|
dsLabels := map[string]string{
|
|
|
|
|
"app.kubernetes.io/name": monov1alpha1.ControlAgentName,
|
|
|
|
|
"app.kubernetes.io/name": monov1alpha1.NodeAgentName,
|
|
|
|
|
"app.kubernetes.io/component": "agent",
|
|
|
|
|
"app.kubernetes.io/part-of": "monok8s",
|
|
|
|
|
"app.kubernetes.io/managed-by": "ctl",
|
|
|
|
|
"app.kubernetes.io/managed-by": monov1alpha1.NodeControlName,
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
want := &appsv1.DaemonSet{
|
|
|
|
|
ObjectMeta: metav1.ObjectMeta{
|
|
|
|
|
Name: monov1alpha1.ControlAgentName,
|
|
|
|
|
Name: monov1alpha1.NodeAgentName,
|
|
|
|
|
Namespace: namespace,
|
|
|
|
|
Labels: labels,
|
|
|
|
|
},
|
|
|
|
|
Spec: appsv1.DaemonSetSpec{
|
|
|
|
|
Selector: &metav1.LabelSelector{
|
|
|
|
|
MatchLabels: map[string]string{
|
|
|
|
|
"app.kubernetes.io/name": monov1alpha1.ControlAgentName,
|
|
|
|
|
"app.kubernetes.io/name": monov1alpha1.NodeAgentName,
|
|
|
|
|
},
|
|
|
|
|
},
|
|
|
|
|
Template: corev1.PodTemplateSpec{
|
|
|
|
|
@@ -289,12 +289,12 @@ func applyControlAgentDaemonSet(ctx context.Context, kubeClient kubernetes.Inter
|
|
|
|
|
Labels: dsLabels,
|
|
|
|
|
},
|
|
|
|
|
Spec: corev1.PodSpec{
|
|
|
|
|
ServiceAccountName: monov1alpha1.ControlAgentName,
|
|
|
|
|
ServiceAccountName: monov1alpha1.NodeAgentName,
|
|
|
|
|
HostNetwork: true,
|
|
|
|
|
HostPID: true,
|
|
|
|
|
DNSPolicy: corev1.DNSClusterFirstWithHostNet,
|
|
|
|
|
NodeSelector: map[string]string{
|
|
|
|
|
monov1alpha1.ControlAgentKey: controlAgentNodeSelectorValue,
|
|
|
|
|
monov1alpha1.NodeControlKey: controlAgentNodeSelectorValue,
|
|
|
|
|
},
|
|
|
|
|
Tolerations: []corev1.Toleration{
|
|
|
|
|
{Operator: corev1.TolerationOpExists},
|
|
|
|
|
@@ -379,7 +379,7 @@ func applyControlAgentDaemonSet(ctx context.Context, kubeClient kubernetes.Inter
|
|
|
|
|
},
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
existing, err := kubeClient.AppsV1().DaemonSets(namespace).Get(ctx, monov1alpha1.ControlAgentName, metav1.GetOptions{})
|
|
|
|
|
existing, err := kubeClient.AppsV1().DaemonSets(namespace).Get(ctx, monov1alpha1.NodeAgentName, metav1.GetOptions{})
|
|
|
|
|
if apierrors.IsNotFound(err) {
|
|
|
|
|
_, err = kubeClient.AppsV1().DaemonSets(namespace).Create(ctx, want, metav1.CreateOptions{})
|
|
|
|
|
return err
|
|
|
|
|
|