Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add PowerVS Ingress Operator Changes #1458

Merged
merged 1 commit into from
Jun 24, 2022
Merged

Add PowerVS Ingress Operator Changes #1458

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions api/fixtures/example.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -438,6 +438,7 @@ web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token
buildIBMCloudCreds(o.Name+"-cloud-ctrl-creds", o.PowerVS.ApiKey),
buildIBMCloudCreds(o.Name+"-node-mgmt-creds", o.PowerVS.ApiKey),
buildIBMCloudCreds(o.Name+"-cpo-creds", o.PowerVS.ApiKey),
buildIBMCloudCreds(o.Name+"-ingress-creds", o.PowerVS.ApiKey),
}
resources = powerVSResources.AsObjects()
platformSpec = hyperv1.PlatformSpec{
Expand All @@ -447,6 +448,7 @@ web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token
ResourceGroup: o.PowerVS.ResourceGroup,
Region: o.PowerVS.Region,
Zone: o.PowerVS.Zone,
CISInstanceCRN: o.PowerVS.CISInstanceCRN,
ServiceInstanceID: o.PowerVS.CloudInstanceID,
Subnet: &hyperv1.PowerVSResourceReference{
Name: &o.PowerVS.Subnet,
Expand All @@ -460,6 +462,7 @@ web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token
KubeCloudControllerCreds: corev1.LocalObjectReference{Name: powerVSResources.KubeCloudControllerCreds.Name},
NodePoolManagementCreds: corev1.LocalObjectReference{Name: powerVSResources.NodePoolManagementCreds.Name},
ControlPlaneOperatorCreds: corev1.LocalObjectReference{Name: powerVSResources.ControlPlaneOperatorCreds.Name},
IngressOperatorCloudCreds: corev1.LocalObjectReference{Name: powerVSResources.IngressOperatorCloudCreds.Name},
},
}
services = getIngressServicePublishingStrategyMapping(o.NetworkType)
Expand Down
5 changes: 5 additions & 0 deletions api/fixtures/example_ibmcloud_powervs.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ type ExamplePowerVSOptions struct {
ResourceGroup string
Region string
Zone string
CISInstanceCRN string
CloudInstanceID string
Subnet string
SubnetID string
Expand All @@ -30,6 +31,7 @@ type ExamplePowerVSResources struct {
KubeCloudControllerCreds *corev1.Secret
NodePoolManagementCreds *corev1.Secret
ControlPlaneOperatorCreds *corev1.Secret
IngressOperatorCloudCreds *corev1.Secret
}

func (o *ExamplePowerVSResources) AsObjects() []crclient.Object {
Expand All @@ -43,5 +45,8 @@ func (o *ExamplePowerVSResources) AsObjects() []crclient.Object {
if o.ControlPlaneOperatorCreds != nil {
objects = append(objects, o.ControlPlaneOperatorCreds)
}
if o.IngressOperatorCloudCreds != nil {
objects = append(objects, o.IngressOperatorCloudCreds)
}
return objects
}
13 changes: 13 additions & 0 deletions api/v1alpha1/hostedcluster_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -590,6 +590,13 @@ type PowerVSPlatformSpec struct {
// +immutable
AccountID string `json:"accountID"`

// CISInstanceCRN is the IBMCloud CIS Service Instance's Cloud Resource Name
// This field is immutable. Once set, It can't be changed.
//
// +kubebuilder:validation:Pattern=`^crn:`
// +immutable
CISInstanceCRN string `json:"cisInstanceCRN"`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we do any allowed input validation here? can we add an example to the // doc?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added a validation here. But this will be generated by the Infra creation process by getting the UUID of the base-domain passed. We already talked about CIS base domain in prerequisite section of PowerVS how-to guide.


// ResourceGroup is the IBMCloud Resource Group in which the cluster resides.
// This field is immutable. Once set, It can't be changed.
//
Expand Down Expand Up @@ -663,6 +670,12 @@ type PowerVSPlatformSpec struct {
//
// +immutable
ControlPlaneOperatorCreds corev1.LocalObjectReference `json:"controlPlaneOperatorCreds"`

// IngressOperatorCloudCreds is a reference to a secret containing ibm cloud
// credentials for ingress operator to get authenticated with ibm cloud.
//
// +immutable
IngressOperatorCloudCreds corev1.LocalObjectReference `json:"ingressOperatorCloudCreds"`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why is this needed?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated the PR description, please check.

}

// PowerVSVPC specifies IBM Cloud PowerVS LoadBalancer configuration for the control
Expand Down
1 change: 1 addition & 0 deletions api/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions cmd/cluster/powervs/create.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,6 +157,7 @@ func applyPlatformSpecificsValues(ctx context.Context, exampleOptions *apifixtur
ResourceGroup: opts.PowerVSPlatform.ResourceGroup,
Region: opts.PowerVSPlatform.Region,
Zone: opts.PowerVSPlatform.Zone,
CISInstanceCRN: infra.CisCrn,
CloudInstanceID: infra.PowerVSCloudInstanceID,
Subnet: infra.PowerVSDhcpSubnet,
SubnetID: infra.PowerVSDhcpSubnetID,
Expand Down
18 changes: 18 additions & 0 deletions cmd/install/assets/hypershift-operator/hypershift.openshift.io_hostedclusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2339,6 +2339,12 @@ spec:
description: AccountID is the IBMCloud account id. This field
is immutable. Once set, It can't be changed.
type: string
cisInstanceCRN:
description: CISInstanceCRN is the IBMCloud CIS Service Instance's
Cloud Resource Name This field is immutable. Once set, It
can't be changed.
pattern: '^crn:'
type: string
controlPlaneOperatorCreds:
description: "ControlPlaneOperatorCreds is a reference to
a secret containing cloud credentials with permissions matching
Expand All @@ -2351,6 +2357,16 @@ spec:
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
type: object
ingressOperatorCloudCreds:
description: IngressOperatorCloudCreds is a reference to a
secret containing ibm cloud credentials for ingress operator
to get authenticated with ibm cloud.
properties:
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
type: object
kubeCloudControllerCreds:
description: "KubeCloudControllerCreds is a reference to a
secret containing cloud credentials with permissions matching
Expand Down Expand Up @@ -2446,7 +2462,9 @@ spec:
type: string
required:
- accountID
- cisInstanceCRN
- controlPlaneOperatorCreds
- ingressOperatorCloudCreds
- kubeCloudControllerCreds
- nodePoolManagementCreds
- region
Expand Down
18 changes: 18 additions & 0 deletions cmd/install/assets/hypershift-operator/hypershift.openshift.io_hostedcontrolplanes.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2247,6 +2247,12 @@ spec:
description: AccountID is the IBMCloud account id. This field
is immutable. Once set, It can't be changed.
type: string
cisInstanceCRN:
description: CISInstanceCRN is the IBMCloud CIS Service Instance's
Cloud Resource Name This field is immutable. Once set, It
can't be changed.
pattern: '^crn:'
type: string
controlPlaneOperatorCreds:
description: "ControlPlaneOperatorCreds is a reference to
a secret containing cloud credentials with permissions matching
Expand All @@ -2259,6 +2265,16 @@ spec:
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
type: object
ingressOperatorCloudCreds:
description: IngressOperatorCloudCreds is a reference to a
secret containing ibm cloud credentials for ingress operator
to get authenticated with ibm cloud.
properties:
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
type: object
kubeCloudControllerCreds:
description: "KubeCloudControllerCreds is a reference to a
secret containing cloud credentials with permissions matching
Expand Down Expand Up @@ -2354,7 +2370,9 @@ spec:
type: string
required:
- accountID
- cisInstanceCRN
- controlPlaneOperatorCreds
- ingressOperatorCloudCreds
- kubeCloudControllerCreds
- nodePoolManagementCreds
- region
Expand Down
31 changes: 31 additions & 0 deletions control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -876,6 +876,37 @@ func (r *reconciler) reconcileCloudCredentialSecrets(ctx context.Context, hcp *h
}); err != nil {
errs = append(errs, fmt.Errorf("failed to reconcile csi driver secret: %w", err))
}
case hyperv1.PowerVSPlatform:
var ingressCredentials corev1.Secret
err := r.cpClient.Get(ctx, client.ObjectKey{Namespace: hcp.Namespace, Name: hcp.Spec.Platform.PowerVS.IngressOperatorCloudCreds.Name}, &ingressCredentials)
if err != nil {
errs = append(errs, fmt.Errorf("failed to get ingress operator cloud credentials secret %s from hcp namespace : %w", hcp.Spec.Platform.PowerVS.IngressOperatorCloudCreds.Name, err))
return errs
}

cloudCredentials := &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Namespace: "openshift-ingress-operator",
Name: "cloud-credentials",
},
}

_, err = r.CreateOrUpdate(ctx, r.client, cloudCredentials, func() error {
credData, credHasData := ingressCredentials.Data["ibmcloud_api_key"]
if !credHasData {
return fmt.Errorf("ingress cloud credentials secret %q is missing credentials key", ingressCredentials.Name)
}
cloudCredentials.Type = corev1.SecretTypeOpaque
if cloudCredentials.Data == nil {
cloudCredentials.Data = map[string][]byte{}
}
cloudCredentials.Data["ibmcloud_api_key"] = credData
return nil
})

if err != nil {
errs = append(errs, fmt.Errorf("failed to reconcile powervs cloud credentials secret %w", err))
}
}
return errs
}
Expand Down
26 changes: 26 additions & 0 deletions docs/content/reference/api.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5467,6 +5467,18 @@ This field is immutable. Once set, It can&rsquo;t be changed.</p>
</tr>
<tr>
<td>
<code>cisInstanceCRN</code></br>
<em>
string
</em>
</td>
<td>
<p>CISInstanceCRN is the IBMCloud CIS Service Instance&rsquo;s Cloud Resource Name
This field is immutable. Once set, It can&rsquo;t be changed.</p>
</td>
</tr>
<tr>
<td>
<code>resourceGroup</code></br>
<em>
string
Expand Down Expand Up @@ -5598,6 +5610,20 @@ This field is immutable. Once set, It can&rsquo;t be changed.</p>
<p>TODO(dan): document the &ldquo;control plane operator policy&rdquo;</p>
</td>
</tr>
<tr>
<td>
<code>ingressOperatorCloudCreds</code></br>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#localobjectreference-v1-core">
Kubernetes core/v1.LocalObjectReference
</a>
</em>
</td>
<td>
<p>IngressOperatorCloudCreds is a reference to a secret containing ibm cloud
credentials for ingress operator to get authenticated with ibm cloud.</p>
</td>
</tr>
</tbody>
</table>
###PowerVSResourceReference { #hypershift.openshift.io/v1alpha1.PowerVSResourceReference }
Expand Down
36 changes: 36 additions & 0 deletions hack/app-sre/saas_template.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22335,6 +22335,12 @@ objects:
description: AccountID is the IBMCloud account id. This
field is immutable. Once set, It can't be changed.
type: string
cisInstanceCRN:
description: CISInstanceCRN is the IBMCloud CIS Service
Instance's Cloud Resource Name This field is immutable.
Once set, It can't be changed.
pattern: '^crn:'
type: string
controlPlaneOperatorCreds:
description: "ControlPlaneOperatorCreds is a reference to
a secret containing cloud credentials with permissions
Expand All @@ -22347,6 +22353,16 @@ objects:
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
type: object
ingressOperatorCloudCreds:
description: IngressOperatorCloudCreds is a reference to
a secret containing ibm cloud credentials for ingress
operator to get authenticated with ibm cloud.
properties:
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
type: object
kubeCloudControllerCreds:
description: "KubeCloudControllerCreds is a reference to
a secret containing cloud credentials with permissions
Expand Down Expand Up @@ -22442,7 +22458,9 @@ objects:
type: string
required:
- accountID
- cisInstanceCRN
- controlPlaneOperatorCreds
- ingressOperatorCloudCreds
- kubeCloudControllerCreds
- nodePoolManagementCreds
- region
Expand Down Expand Up @@ -25316,6 +25334,12 @@ objects:
description: AccountID is the IBMCloud account id. This
field is immutable. Once set, It can't be changed.
type: string
cisInstanceCRN:
description: CISInstanceCRN is the IBMCloud CIS Service
Instance's Cloud Resource Name This field is immutable.
Once set, It can't be changed.
pattern: '^crn:'
type: string
controlPlaneOperatorCreds:
description: "ControlPlaneOperatorCreds is a reference to
a secret containing cloud credentials with permissions
Expand All @@ -25328,6 +25352,16 @@ objects:
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
type: object
ingressOperatorCloudCreds:
description: IngressOperatorCloudCreds is a reference to
a secret containing ibm cloud credentials for ingress
operator to get authenticated with ibm cloud.
properties:
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
type: object
kubeCloudControllerCreds:
description: "KubeCloudControllerCreds is a reference to
a secret containing cloud credentials with permissions
Expand Down Expand Up @@ -25423,7 +25457,9 @@ objects:
type: string
required:
- accountID
- cisInstanceCRN
- controlPlaneOperatorCreds
- ingressOperatorCloudCreds
- kubeCloudControllerCreds
- nodePoolManagementCreds
- region
Expand Down
36 changes: 36 additions & 0 deletions hypershift-operator/controllers/hostedcluster/internal/platform/powervs/powervs.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -262,6 +262,42 @@ func (p PowerVS) ReconcileCredentials(ctx context.Context, c client.Client, crea
if err != nil {
return fmt.Errorf("failed to reconcile control plane operator provider creds: %w", err)
}

// Reconcile the platform provider ingress operator credentials secret by
// resolving the reference from the HostedCluster and syncing the secret in
// the control plane namespace.
err = c.Get(ctx, client.ObjectKey{Namespace: hcluster.GetNamespace(), Name: hcluster.Spec.Platform.PowerVS.IngressOperatorCloudCreds.Name}, &src)
if err != nil {
return fmt.Errorf("failed to get ingress operator provider creds %s: %w", hcluster.Spec.Platform.PowerVS.IngressOperatorCloudCreds.Name, err)
}
dest = &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Namespace: controlPlaneNamespace,
Name: src.Name,
},
}
_, err = createOrUpdate(ctx, c, dest, func() error {
apiKeySrcData, apiKeySrcHasData := src.Data["ibmcloud_api_key"]
if !apiKeySrcHasData {
return fmt.Errorf("hostedcluster ingress operator credentials secret %q must have a credentials key ibmcloud_api_key", src.Name)
}
dest.Type = corev1.SecretTypeOpaque
if dest.Data == nil {
dest.Data = map[string][]byte{}
}
dest.Data["ibmcloud_api_key"] = apiKeySrcData

envSrcData, envSrcHasData := src.Data["ibm-credentials.env"]
if !envSrcHasData {
return fmt.Errorf("hostedcluster ingress operator credentials secret %q must have a credentials key ibm-credentials.env", src.Name)
}
dest.Data["ibm-credentials.env"] = envSrcData

return nil
})
if err != nil {
return fmt.Errorf("failed to reconcile ingress operator provider creds: %w", err)
}
return nil
}

Expand Down
5 changes: 3 additions & 2 deletions support/globalconfig/infrastructure.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,8 +71,9 @@ func ReconcileInfrastructure(infra *configv1.Infrastructure, hcp *hyperv1.Hosted
}
case hyperv1.PowerVSPlatform:
infra.Status.PlatformStatus.PowerVS = &configv1.PowerVSPlatformStatus{
Region: hcp.Spec.Platform.PowerVS.Region,
Zone: hcp.Spec.Platform.PowerVS.Zone,
Region: hcp.Spec.Platform.PowerVS.Region,
Zone: hcp.Spec.Platform.PowerVS.Zone,
CISInstanceCRN: hcp.Spec.Platform.PowerVS.CISInstanceCRN,
}
}
}