-
Notifications
You must be signed in to change notification settings - Fork 157
/
resourcesynccontroller.go
98 lines (83 loc) · 4.56 KB
/
resourcesynccontroller.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
package resourcesynccontroller
import (
"k8s.io/client-go/kubernetes"
"github.com/openshift/library-go/pkg/operator/events"
"github.com/openshift/library-go/pkg/operator/resourcesynccontroller"
"github.com/openshift/library-go/pkg/operator/v1helpers"
"github.com/openshift/cluster-kube-apiserver-operator/pkg/operator/operatorclient"
)
func NewResourceSyncController(
operatorConfigClient v1helpers.OperatorClient,
kubeInformersForNamespaces v1helpers.KubeInformersForNamespaces,
kubeClient kubernetes.Interface,
eventRecorder events.Recorder) (*resourcesynccontroller.ResourceSyncController, error) {
resourceSyncController := resourcesynccontroller.NewResourceSyncController(
operatorConfigClient,
kubeInformersForNamespaces,
v1helpers.CachedSecretGetter(kubeClient.CoreV1(), kubeInformersForNamespaces),
v1helpers.CachedConfigMapGetter(kubeClient.CoreV1(), kubeInformersForNamespaces),
eventRecorder,
)
if err := resourceSyncController.SyncConfigMap(
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.TargetNamespace, Name: "etcd-serving-ca"},
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.GlobalUserSpecifiedConfigNamespace, Name: "etcd-serving-ca"},
); err != nil {
return nil, err
}
if err := resourceSyncController.SyncSecret(
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.TargetNamespace, Name: "etcd-client"},
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.GlobalUserSpecifiedConfigNamespace, Name: "etcd-client"},
); err != nil {
return nil, err
}
// this configmaps holds the certs used to verify the SA token JWTs created by the kube-controller-manager-operator
if err := resourceSyncController.SyncConfigMap(
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.TargetNamespace, Name: "sa-token-signing-certs"},
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.GlobalMachineSpecifiedConfigNamespace, Name: "sa-token-signing-certs"},
); err != nil {
return nil, err
}
// this ca bundle contains certs to verify the aggregator. We copy it from the shared location to here.
if err := resourceSyncController.SyncConfigMap(
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.TargetNamespace, Name: "aggregator-client-ca"},
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.GlobalMachineSpecifiedConfigNamespace, Name: "kube-apiserver-aggregator-client-ca"},
); err != nil {
return nil, err
}
// this configmap allows us to verify the kubelet serving certs
if err := resourceSyncController.SyncConfigMap(
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.TargetNamespace, Name: "kubelet-serving-ca"},
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.GlobalMachineSpecifiedConfigNamespace, Name: "csr-controller-ca"},
); err != nil {
return nil, err
}
// this ca bundle contains certs used by the kube-apiserver to verify client certs
if err := resourceSyncController.SyncConfigMap(
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.GlobalMachineSpecifiedConfigNamespace, Name: "kube-apiserver-client-ca"},
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.TargetNamespace, Name: "client-ca"},
); err != nil {
return nil, err
}
// this ca bundle contains certs that can be used to verify a kubelet
if err := resourceSyncController.SyncConfigMap(
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.GlobalMachineSpecifiedConfigNamespace, Name: "kubelet-serving-ca"},
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.TargetNamespace, Name: "kubelet-serving-ca"},
); err != nil {
return nil, err
}
// this ca bundle contains certs that can be used to verify a kube-apiserver
if err := resourceSyncController.SyncConfigMap(
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.GlobalMachineSpecifiedConfigNamespace, Name: "kube-apiserver-server-ca"},
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.TargetNamespace, Name: "kube-apiserver-server-ca"},
); err != nil {
return nil, err
}
// this ca bundle contains public keys that can be used to verify bound tokens issued by the kube-apiserver
if err := resourceSyncController.SyncConfigMap(
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.GlobalMachineSpecifiedConfigNamespace, Name: "bound-sa-token-signing-certs"},
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.TargetNamespace, Name: "bound-sa-token-signing-certs"},
); err != nil {
return nil, err
}
return resourceSyncController, nil
}