Skip to content

Commit

Permalink
image: rewire imagetrigger controller initialization to use a control…
Browse files Browse the repository at this point in the history
…ler init func
  • Loading branch information
mfojtik committed May 19, 2017
1 parent b065c72 commit b4a2292
Show file tree
Hide file tree
Showing 11 changed files with 267 additions and 250 deletions.
16 changes: 16 additions & 0 deletions pkg/cmd/server/bootstrappolicy/controller_policy.go
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,22 @@ func init() {
eventsRule(),
},
})

// imagetrigger-controller
addControllerRole(rbac.ClusterRole{
ObjectMeta: metav1.ObjectMeta{Name: saRolePrefix + InfraImageTriggerControllerServiceAccountName},
Rules: []rbac.PolicyRule{
rbac.NewRule("list", "watch").Groups(imageGroup, legacyImageGroup).Resources("imagestreams").RuleOrDie(),
rbac.NewRule("get", "update").Groups(extensionsGroup).Resources("daemonsets").RuleOrDie(),
rbac.NewRule("get", "update").Groups(extensionsGroup, appsGroup).Resources("deployments").RuleOrDie(),
rbac.NewRule("get", "update").Groups(appsGroup).Resources("statefulsets").RuleOrDie(),
rbac.NewRule("get", "update").Groups(batchGroup).Resources("cronjobs").RuleOrDie(),
rbac.NewRule("get", "update").Groups(deployGroup, legacyDeployGroup).Resources("deploymentconfigs").RuleOrDie(),
rbac.NewRule("create").Groups(buildGroup, legacyBuildGroup).Resources("buildconfig/instantiate").RuleOrDie(),

eventsRule(),
},
})
}

// ControllerRoles returns the cluster roles used by controllers
Expand Down
59 changes: 3 additions & 56 deletions pkg/cmd/server/bootstrappolicy/infra_sa_policy.go
Original file line number Diff line number Diff line change
Expand Up @@ -14,21 +14,19 @@ import (
authorizationapi "github.com/openshift/origin/pkg/authorization/api"
_ "github.com/openshift/origin/pkg/authorization/api/install"
authorizationapiv1 "github.com/openshift/origin/pkg/authorization/api/v1"
buildapi "github.com/openshift/origin/pkg/build/api"
deployapi "github.com/openshift/origin/pkg/deploy/api"
imageapi "github.com/openshift/origin/pkg/image/api"

// we need the conversions registered for our init block
_ "github.com/openshift/origin/pkg/authorization/api/install"
)

const (
// The controllers below were convered to new controller initialization and use RBAC
// rules:
InfraBuildControllerServiceAccountName = "build-controller"
InfraImageTriggerControllerServiceAccountName = "imagetrigger-controller"
ImageTriggerControllerRoleName = "system:imagetrigger-controller"
InfraDeploymentConfigControllerServiceAccountName = "deploymentconfig-controller"
InfraDeploymentTriggerControllerServiceAccountName = "deployment-trigger-controller"
InfraDeployerControllerServiceAccountName = "deployer-controller"
InfraImageTriggerControllerServiceAccountName = "imagetrigger-controller"

InfraPersistentVolumeBinderControllerServiceAccountName = "pv-binder-controller"
PersistentVolumeBinderControllerRoleName = "system:pv-binder-controller"
Expand Down Expand Up @@ -130,57 +128,6 @@ func init() {
InfraSAs.serviceAccounts = sets.String{}
InfraSAs.saToRole = map[string]authorizationapi.ClusterRole{}

err = InfraSAs.addServiceAccount(
InfraImageTriggerControllerServiceAccountName,
authorizationapi.ClusterRole{
ObjectMeta: metav1.ObjectMeta{
Name: ImageTriggerControllerRoleName,
},
Rules: []authorizationapi.PolicyRule{
// List Watch
{
Verbs: sets.NewString("list", "watch"),
APIGroups: []string{imageapi.GroupName, imageapi.LegacyGroupName},
Resources: sets.NewString("imagestreams"),
},
// Spec update on triggerable resources
{
Verbs: sets.NewString("get", "update"),
APIGroups: []string{extensionsGroup},
Resources: sets.NewString("daemonsets"),
},
{
Verbs: sets.NewString("get", "update"),
APIGroups: []string{extensionsGroup, appsGroup},
Resources: sets.NewString("deployments"),
},
{
Verbs: sets.NewString("get", "update"),
APIGroups: []string{appsGroup},
Resources: sets.NewString("statefulsets"),
},
{
Verbs: sets.NewString("get", "update"),
APIGroups: []string{batchGroup},
Resources: sets.NewString("cronjobs"),
},
{
Verbs: sets.NewString("get", "update"),
APIGroups: []string{deployapi.GroupName, deployapi.LegacyGroupName},
Resources: sets.NewString("deploymentconfigs"),
},
{
Verbs: sets.NewString("create"),
APIGroups: []string{buildapi.GroupName, buildapi.LegacyGroupName},
Resources: sets.NewString("buildconfigs/instantiate"),
},
},
},
)
if err != nil {
panic(err)
}

err = InfraSAs.addServiceAccount(
InfraPersistentVolumeRecyclerControllerServiceAccountName,
authorizationapi.ClusterRole{
Expand Down
4 changes: 4 additions & 0 deletions pkg/cmd/server/origin/controller.go
Original file line number Diff line number Diff line change
Expand Up @@ -38,5 +38,9 @@ func (c *MasterConfig) NewOpenshiftControllerInitializers() (map[string]controll
deploymentTrigger := controller.DeploymentTriggerControllerConfig{Codec: codec}
ret["deploymenttrigger"] = deploymentTrigger.RunController

// initialize other controllers
imageTrigger := controller.ImageTriggerControllerConfig{c.Options.DisabledFeatures}
ret["imagetrigger"] = imageTrigger.RunController

return ret, nil
}
139 changes: 139 additions & 0 deletions pkg/cmd/server/origin/controller/image.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,139 @@
package controller

import (
"fmt"

"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/runtime/schema"
kv1core "k8s.io/client-go/kubernetes/typed/core/v1"
kapi "k8s.io/kubernetes/pkg/api"
kapiv1 "k8s.io/kubernetes/pkg/api/v1"
kappsv1beta1 "k8s.io/kubernetes/pkg/apis/apps/v1beta1"
kextensionsv1beta1 "k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
kclientsetexternal "k8s.io/kubernetes/pkg/client/clientset_generated/clientset"

buildclient "github.com/openshift/origin/pkg/build/client"
oscache "github.com/openshift/origin/pkg/client/cache"
configapi "github.com/openshift/origin/pkg/cmd/server/api"
serverapi "github.com/openshift/origin/pkg/cmd/server/api"
"github.com/openshift/origin/pkg/cmd/server/bootstrappolicy"
imagetriggercontroller "github.com/openshift/origin/pkg/image/controller/trigger"
triggerannotations "github.com/openshift/origin/pkg/image/trigger/annotations"
triggerbuildconfigs "github.com/openshift/origin/pkg/image/trigger/buildconfigs"
triggerdeploymentconfigs "github.com/openshift/origin/pkg/image/trigger/deploymentconfigs"
)

type ImageTriggerControllerConfig struct {
DisabledFeatures serverapi.FeatureList
}

func (c *ImageTriggerControllerConfig) RunController(ctx ControllerContext) (bool, error) {
streamInformer := ctx.DeprecatedOpenshiftInformers.ImageStreams().Informer()
lister := temporaryLister{ctx.DeprecatedOpenshiftInformers.ImageStreams().Lister()}

oclient, err := ctx.ClientBuilder.DeprecatedOpenshiftClient(bootstrappolicy.InfraImageTriggerControllerServiceAccountName)
if err != nil {
return true, err
}
kclient := ctx.ClientBuilder.ClientOrDie(bootstrappolicy.InfraImageTriggerControllerServiceAccountName)

updater := podSpecUpdater{kclient}
bcInstantiator := buildclient.NewOSClientBuildConfigInstantiatorClient(oclient)
broadcaster := imagetriggercontroller.NewTriggerEventBroadcaster(kv1core.New(kclient.CoreV1().RESTClient()))

sources := []imagetriggercontroller.TriggerSource{
{
Resource: schema.GroupResource{Group: "apps.openshift.io", Resource: "deploymentconfigs"},
Informer: ctx.DeprecatedOpenshiftInformers.DeploymentConfigs().Informer(),
Store: ctx.DeprecatedOpenshiftInformers.DeploymentConfigs().Indexer(),
TriggerFn: triggerdeploymentconfigs.NewDeploymentConfigTriggerIndexer,
Reactor: &triggerdeploymentconfigs.DeploymentConfigReactor{Client: oclient},
},
}
if !c.DisabledFeatures.Has(configapi.FeatureBuilder) {
sources = append(sources, imagetriggercontroller.TriggerSource{
Resource: schema.GroupResource{Group: "build.openshift.io", Resource: "buildconfigs"},
Informer: ctx.DeprecatedOpenshiftInformers.BuildConfigs().Informer(),
Store: ctx.DeprecatedOpenshiftInformers.BuildConfigs().Indexer(),
TriggerFn: triggerbuildconfigs.NewBuildConfigTriggerIndexer,
Reactor: &triggerbuildconfigs.BuildConfigReactor{Instantiator: bcInstantiator},
})
}
if !c.DisabledFeatures.Has("triggers.image.openshift.io/deployments") {
sources = append(sources, imagetriggercontroller.TriggerSource{
Resource: schema.GroupResource{Group: "extensions", Resource: "deployments"},
Informer: ctx.DeprecatedOpenshiftInformers.KubernetesInformers().Apps().V1beta1().Deployments().Informer(),
Store: ctx.DeprecatedOpenshiftInformers.KubernetesInformers().Apps().V1beta1().Deployments().Informer().GetIndexer(),
TriggerFn: triggerannotations.NewAnnotationTriggerIndexer,
Reactor: &triggerannotations.AnnotationReactor{Updater: updater, Copier: kapi.Scheme},
})
}
if !c.DisabledFeatures.Has("triggers.image.openshift.io/daemonsets") {
sources = append(sources, imagetriggercontroller.TriggerSource{
Resource: schema.GroupResource{Group: "extensions", Resource: "daemonsets"},
Informer: ctx.DeprecatedOpenshiftInformers.KubernetesInformers().Extensions().V1beta1().DaemonSets().Informer(),
Store: ctx.DeprecatedOpenshiftInformers.KubernetesInformers().Extensions().V1beta1().DaemonSets().Informer().GetIndexer(),
TriggerFn: triggerannotations.NewAnnotationTriggerIndexer,
Reactor: &triggerannotations.AnnotationReactor{Updater: updater, Copier: kapi.Scheme},
})
}
if !c.DisabledFeatures.Has("triggers.image.openshift.io/statefulsets") {
sources = append(sources, imagetriggercontroller.TriggerSource{
Resource: schema.GroupResource{Group: "apps", Resource: "statefulsets"},
Informer: ctx.DeprecatedOpenshiftInformers.KubernetesInformers().Apps().V1beta1().StatefulSets().Informer(),
Store: ctx.DeprecatedOpenshiftInformers.KubernetesInformers().Apps().V1beta1().StatefulSets().Informer().GetIndexer(),
TriggerFn: triggerannotations.NewAnnotationTriggerIndexer,
Reactor: &triggerannotations.AnnotationReactor{Updater: updater, Copier: kapi.Scheme},
})
}
if !c.DisabledFeatures.Has("triggers.image.openshift.io/cronjobs") {
sources = append(sources, imagetriggercontroller.TriggerSource{
Resource: schema.GroupResource{Group: "batch", Resource: "cronjobs"},
Informer: ctx.DeprecatedOpenshiftInformers.KubernetesInformers().Batch().V2alpha1().CronJobs().Informer(),
Store: ctx.DeprecatedOpenshiftInformers.KubernetesInformers().Batch().V2alpha1().CronJobs().Informer().GetIndexer(),
TriggerFn: triggerannotations.NewAnnotationTriggerIndexer,
Reactor: &triggerannotations.AnnotationReactor{Updater: updater, Copier: kapi.Scheme},
})
}

go imagetriggercontroller.NewTriggerController(
broadcaster,
streamInformer,
lister,
sources...,
).Run(5, ctx.Stop)

return true, nil
}

// TODO: remove when generated informers exist
type temporaryLister struct {
*oscache.StoreToImageStreamLister
}

func (l temporaryLister) ImageStreams(namespace string) imagetriggercontroller.ImageStreamNamespaceLister {
return l.StoreToImageStreamLister.ImageStreams(namespace)
}

type podSpecUpdater struct {
kclient kclientsetexternal.Interface
}

func (u podSpecUpdater) Update(obj runtime.Object) error {
switch t := obj.(type) {
case *kextensionsv1beta1.DaemonSet:
_, err := u.kclient.Extensions().DaemonSets(t.Namespace).Update(t)
return err
case *kappsv1beta1.Deployment:
_, err := u.kclient.Apps().Deployments(t.Namespace).Update(t)
return err
case *kappsv1beta1.StatefulSet:
_, err := u.kclient.Apps().StatefulSets(t.Namespace).Update(t)
return err
case *kapiv1.Pod:
_, err := u.kclient.Core().Pods(t.Namespace).Update(t)
return err
default:
return fmt.Errorf("unrecognized object - no trigger update possible for %T", obj)
}
}
9 changes: 0 additions & 9 deletions pkg/cmd/server/origin/master_config.go
Original file line number Diff line number Diff line change
Expand Up @@ -1016,15 +1016,6 @@ func (c *MasterConfig) DeploymentConfigClients() (*osclient.Client, kclientsetin
return c.PrivilegedLoopbackOpenShiftClient, c.PrivilegedLoopbackKubernetesClientsetInternal
}

// ImageTriggerControllerClients returns the trigger controller client objects
func (c *MasterConfig) ImageTriggerControllerClients() (*osclient.Client, kclientsetinternal.Interface, kclientsetexternal.Interface) {
_, osClient, internalKubeClientset, externalKubeClientset, err := c.GetServiceAccountClients(bootstrappolicy.InfraImageTriggerControllerServiceAccountName)
if err != nil {
glog.Fatal(err)
}
return osClient, internalKubeClientset, externalKubeClientset
}

// DeploymentLogClient returns the deployment log client object
func (c *MasterConfig) DeploymentLogClient() kclientsetinternal.Interface {
return c.PrivilegedLoopbackKubernetesClientsetInternal
Expand Down
Loading

0 comments on commit b4a2292

Please sign in to comment.