Skip to content

Commit 06f2aec

Browse files
openshift-merge-robotopenshift-merge-robot
authored
Merge pull request #73 from qiujian16/addon-registratin
Add addon registration configuration
2 parents b719117 + 01473bf commit 06f2aec

4 files changed

+196
-2
lines changed

Diff for: ‎addon/v1alpha1/0000_01_addon.open-cluster-management.io_managedclusteraddons.crd.yaml

+59
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,14 @@ spec:
4848
spec:
4949
description: spec holds configuration that could apply to any operator.
5050
type: object
51+
properties:
52+
installNamespace:
53+
description: installNamespace is the namespace on the managed cluster
54+
to install the addon agent. If it is not set, open-cluster-management-agent-addon
55+
namespace is used to install the addon agent.
56+
type: string
57+
maxLength: 63
58+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
5159
status:
5260
description: status holds the information about the state of an operator. It
5361
is consistent with status information across the Kubernetes ecosystem.
@@ -156,6 +164,57 @@ spec:
156164
type: string
157165
maxLength: 316
158166
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
167+
registrations:
168+
description: registrations is the conifigurations for the addon agent
169+
to register to hub. It should be set by each addon controller on
170+
hub to define how the addon agent on managedcluster is registered.
171+
With the registration defined, The addon agent can access to kube
172+
apiserver with kube style API or other endpoints on hub cluster
173+
with client certificate authentication. A csr will be created per
174+
registration configuration. If more than one registrationConfig
175+
is defined, a csr will be created for each registration configuration.
176+
It is not allowed that multiple registrationConfigs have the same
177+
signer name. After the csr is approved on the hub cluster, the klusterlet
178+
agent will create a secret in the installNamespace for the registrationConfig.
179+
If the signerName is "kubernetes.io/kube-apiserver-client", the
180+
secret name will be "{addon name}-hub-kubeconfig" whose contents
181+
includes key/cert and kubeconfig. Otherwise, the secret name will
182+
be "{addon name}-{signer name}-client-cert" whose contents includes
183+
key/cert.
184+
type: array
185+
items:
186+
description: RegistrationConfig defines the configuration of the
187+
addon agent to register to hub. The Klusterlet agent will create
188+
a csr for the addon agent with the registrationConfig.
189+
type: object
190+
properties:
191+
signerName:
192+
description: signerName is the name of signer that addon agent
193+
will use to create csr.
194+
type: string
195+
maxLength: 571
196+
minLength: 5
197+
subject:
198+
description: "subject is the user subject of the addon agent
199+
to be registered to the hub. If it is not set, the addon agent
200+
will have the default subject \"subject\": { \t\"user\": \"system:open-cluster-management:addon:{addonName}:{clusterName}:{agentName}\",
201+
\t\"groups: [\"system:open-cluster-management:addon\", \"system:open-cluster-management:addon:{addonName}\",
202+
\"system:authenticated\"] }"
203+
type: object
204+
properties:
205+
groups:
206+
description: groups is the user group of the addon agent.
207+
type: array
208+
items:
209+
type: string
210+
organizationUnit:
211+
description: organizationUnit is the ou of the addon agent
212+
type: array
213+
items:
214+
type: string
215+
user:
216+
description: user is the user name of the addon agent.
217+
type: string
159218
relatedObjects:
160219
description: 'relatedObjects is a list of objects that are "interesting"
161220
or related to this operator. Common uses are: 1. the detailed resource

Diff for: ‎addon/v1alpha1/types_managedclusteraddon.go

+63-1
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,49 @@ type ManagedClusterAddOn struct {
2929
Status ManagedClusterAddOnStatus `json:"status"`
3030
}
3131

32-
// ManagedClusterAddOnSpec is empty for now.
32+
// ManagedClusterAddOnSpec defines the install configuration of
33+
// an addon agent on managed cluster.
3334
type ManagedClusterAddOnSpec struct {
35+
// installNamespace is the namespace on the managed cluster to install the addon agent.
36+
// If it is not set, open-cluster-management-agent-addon namespace is used to install the addon agent.
37+
// +optional
38+
// +kubebuilder:validation:MaxLength=63
39+
// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
40+
InstallNamespace string `json:"installNamespace,omitempty"`
41+
}
42+
43+
// RegistrationConfig defines the configuration of the addon agent to register to hub. The Klusterlet agent will
44+
// create a csr for the addon agent with the registrationConfig.
45+
type RegistrationConfig struct {
46+
// signerName is the name of signer that addon agent will use to create csr.
47+
// +required
48+
// +kubebuilder:validation:MaxLength=571
49+
// +kubebuilder:validation:MinLength=5
50+
SignerName string `json:"signerName"`
51+
52+
// subject is the user subject of the addon agent to be registered to the hub.
53+
// If it is not set, the addon agent will have the default subject
54+
// "subject": {
55+
// "user": "system:open-cluster-management:addon:{addonName}:{clusterName}:{agentName}",
56+
// "groups: ["system:open-cluster-management:addon", "system:open-cluster-management:addon:{addonName}", "system:authenticated"]
57+
// }
58+
//
59+
// +optional
60+
Subject Subject `json:"subject,omitempty"`
61+
}
62+
63+
// Subject is the user subject of the addon agent to be registered to the hub.
64+
type Subject struct {
65+
// user is the user name of the addon agent.
66+
User string `json:"user"`
67+
68+
// groups is the user group of the addon agent.
69+
// +optional
70+
Groups []string `json:"groups,omitempty"`
71+
72+
// organizationUnit is the ou of the addon agent
73+
// +optional
74+
OrganizationUnits []string `json:"organizationUnit,omitempty"`
3475
}
3576

3677
// ManagedClusterAddOnStatus provides information about the status of the operator.
@@ -59,8 +100,29 @@ type ManagedClusterAddOnStatus struct {
59100
// This resource is use to locate the configuration resource for the add-on.
60101
// +optional
61102
AddOnConfiguration ConfigCoordinates `json:"addOnConfiguration"`
103+
104+
// registrations is the conifigurations for the addon agent to register to hub. It should be set by each addon controller
105+
// on hub to define how the addon agent on managedcluster is registered. With the registration defined,
106+
// The addon agent can access to kube apiserver with kube style API or other endpoints on hub cluster with client
107+
// certificate authentication. A csr will be created per registration configuration. If more than one
108+
// registrationConfig is defined, a csr will be created for each registration configuration. It is not allowed that
109+
// multiple registrationConfigs have the same signer name. After the csr is approved on the hub cluster, the klusterlet
110+
// agent will create a secret in the installNamespace for the registrationConfig. If the signerName is
111+
// "kubernetes.io/kube-apiserver-client", the secret name will be "{addon name}-hub-kubeconfig" whose contents includes
112+
// key/cert and kubeconfig. Otherwise, the secret name will be "{addon name}-{signer name}-client-cert" whose contents includes key/cert.
113+
// +optional
114+
Registrations []RegistrationConfig `json:"registrations,omitempty"`
62115
}
63116

117+
const (
118+
// ManagedClusterAddOnConditionAvailable represents that the addon agent is running on the managed cluster
119+
ManagedClusterAddOnConditionAvailable string = "Available"
120+
121+
// ManagedClusterAddOnConditionDegraded represents that the addon agent is providing degraded service on
122+
// the managed cluster.
123+
ManagedClusterAddOnConditionDegraded string = "Degraded"
124+
)
125+
64126
// ObjectReference contains enough information to let you inspect or modify the referred object.
65127
type ObjectReference struct {
66128
// group of the referent.

Diff for: ‎addon/v1alpha1/zz_generated.deepcopy.go

+50
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: ‎addon/v1alpha1/zz_generated.swagger_doc_generated.go

+24-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)