Offer a general purpose ReplicatedResource for clusterset

[tamalsaha]

Describe the enhancement
Currently there are case-by-case resources to replicate Resources in the Hub cluster to spoke cluster namespaces. Examples are:

• ManifestWorkResplicaSet
• ClusterAddonManager
• Potentially one for ManagedSeviceAccount Creating ManagedServiceAccount in cluster-set namespace did not work managed-serviceaccount#90
• For future addons that will also have a similar CRD like ManagedSeviceAccount

Will it make sense to support one general purpose ManagedResourceSet that will take a Placement and resourceTemplate and replicate that into the cluster namespaces according to placement logic. This can handle all the above cases as far as I can understand ( i have not thought through it deeply).

I am curious if this something like this was considered? If not, is this an option?

Thanks.

[mikeshng]

Hi @tamalsaha

I will let other maintainers chime in on your suggestion.

But just FYI I had a similar requirement and @JustinKuli was able provide me with a clever solution here: https://gist.github.com/JustinKuli/b66d1096e1262a0bc51f8ff8f29169f8 using ocm policy addon.

The idea is to use a Placement and a Policy to distribute a resource to managed cluster namespaces on a hub cluster, not to the actual managed clusters.

Let me know if you have any questions.

[qiujian16]

ManifestWorkResplicaSet and ClusterAddonManager has different purposes and different persona involved.

ManifestWorkResplicaSet is for the purpose of user can "replicate manifests to multiple clusters".
ClusterAddonManager is for the addon developer to develop an addon, then user can choose to enable the addon cluster by cluster, or by a certain strategy.
ManagedSeviceAccount seems to be also different, it meant to ask each spoke cluster provide some credential to access them.

The ManagedResourceSet seems to be quite similar as what ManifestWorkResplicaSet did?

[tamalsaha]

I was referring to the part where the controller for ManifestWorkResplicaSet, ClusterAddonManager, higher-level-of-ManagedSeviceAccount are all performing one general operation: create the individual ManifestWork, ManagedClusterAddon, ManagedServiceAccount object by copying the the parent object into the cluster namespaces. This general part can be offered a single resource. The template for the parent object can have the full underlying object spec (like PodTemplate).

apiVersion: cluster.open-cluster-management.io/v1beta2
kind: ManagedClusterSetResource
metadata:
  name: <name>
  namespace: <ns>
spec:
  placementRefs:
    - name: placement-byname # Name of a created Placement
  template:
    apiVersion:
    kind: 
    metadata:
      ...
   spec:
      ...

spec.template.apiVersion and spec.template.kind can dictate whether the underlying object is a ManfestWork / ManagedClusterAddon / ManagedServiceAccount .

[github-actions]

This issue is stale because it has been open for 120 days with no activity. After 14 days of inactivity, it will be closed. Remove the stable label to prevent this issue from being closed.