Skip to content

Commit 796b970

Browse files
jentingjenting
committed
Mount secret file
Signed-off-by: JenTing Hsiao <[email protected]>
1 parent 3a13060 commit 796b970

File tree

7 files changed

+63
-64
lines changed

7 files changed

+63
-64
lines changed

‎install/installer/cmd/testdata/render/aws-setup/config.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,9 @@ containerRegistry:
1111
certificate:
1212
kind: secret
1313
name: aws-ecr-credential
14-
credential:
14+
credentials:
1515
kind: secret
16-
name: aws-iam-user-credential
16+
name: aws-storage
1717
s3storage:
1818
region: eu-west-2
1919
endpoint: registry.amazonaws.com # Invalid endpoint - use to differentiate from objectStorage

‎install/installer/cmd/testdata/render/aws-setup/output.golden

Lines changed: 9 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎install/installer/pkg/common/storage.go

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ import (
1616
corev1 "k8s.io/api/core/v1"
1717
)
1818

19-
const storageMount = "/mnt/secrets/storage"
19+
const StorageMount = "/mnt/secrets/storage"
2020

2121
// StorageConfig produces config service configuration from the installer config
2222

@@ -39,7 +39,7 @@ func StorageConfig(context *RenderContext) storageconfig.StorageConfig {
3939
GCloudConfig: storageconfig.GCPConfig{
4040
Region: context.Config.Metadata.Region,
4141
Project: context.Config.ObjectStorage.CloudStorage.Project,
42-
CredentialsFile: filepath.Join(storageMount, "service-account.json"),
42+
CredentialsFile: filepath.Join(StorageMount, "service-account.json"),
4343
},
4444
}
4545
}
@@ -50,7 +50,7 @@ func StorageConfig(context *RenderContext) storageconfig.StorageConfig {
5050
S3Config: &storageconfig.S3Config{
5151
Region: context.Config.Metadata.Region,
5252
Bucket: context.Config.ObjectStorage.S3.BucketName,
53-
CredentialsFile: filepath.Join(storageMount, "credentials"),
53+
CredentialsFile: filepath.Join(StorageMount, "credentials"),
5454
},
5555
}
5656
}
@@ -90,7 +90,7 @@ func StorageConfig(context *RenderContext) storageconfig.StorageConfig {
9090
}
9191

9292
// mountStorage performs the actual storage mount, which is common across all providers
93-
func mountStorage(pod *corev1.PodSpec, secret string, container ...string) {
93+
func MountStorage(pod *corev1.PodSpec, secret string, container ...string) {
9494
volumeName := "storage-volume"
9595

9696
pod.Volumes = append(pod.Volumes,
@@ -124,7 +124,7 @@ func mountStorage(pod *corev1.PodSpec, secret string, container ...string) {
124124
corev1.VolumeMount{
125125
Name: volumeName,
126126
ReadOnly: true,
127-
MountPath: storageMount,
127+
MountPath: StorageMount,
128128
},
129129
)
130130
}
@@ -136,13 +136,13 @@ func mountStorage(pod *corev1.PodSpec, secret string, container ...string) {
136136
// added to all containers.
137137
func AddStorageMounts(ctx *RenderContext, pod *corev1.PodSpec, container ...string) error {
138138
if ctx.Config.ObjectStorage.CloudStorage != nil {
139-
mountStorage(pod, ctx.Config.ObjectStorage.CloudStorage.ServiceAccount.Name, container...)
139+
MountStorage(pod, ctx.Config.ObjectStorage.CloudStorage.ServiceAccount.Name, container...)
140140

141141
return nil
142142
}
143143

144144
if ctx.Config.ObjectStorage.S3 != nil {
145-
mountStorage(pod, ctx.Config.ObjectStorage.S3.Credentials.Name, container...)
145+
MountStorage(pod, ctx.Config.ObjectStorage.S3.Credentials.Name, container...)
146146

147147
return nil
148148
}

‎install/installer/pkg/components/refresh-credential/configmap.go

Lines changed: 6 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package refresh_credential
55

66
import (
77
"fmt"
8+
"path/filepath"
89

910
corev1 "k8s.io/api/core/v1"
1011
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -18,22 +19,17 @@ func configmap(ctx *common.RenderContext) ([]runtime.Object, error) {
1819
privateRegistry := isPrivateAWSECRURL(ctx.Config.ContainerRegistry.External.URL)
1920
region := getAWSRegion(ctx.Config.ContainerRegistry.External.URL)
2021

21-
credentialSecretName, err := credentialSecretName(ctx)
22-
if err != nil {
23-
return nil, err
24-
}
25-
2622
secretToUpdateName, err := secretToUpdateName(ctx)
2723
if err != nil {
2824
return nil, err
2925
}
3026

3127
registryCredentialCfg := config.Configuration{
32-
Namespace: ctx.Namespace,
33-
CredentialSecret: credentialSecretName,
34-
Region: region,
35-
PublicRegistry: !privateRegistry,
36-
SecretToUpdate: secretToUpdateName,
28+
Namespace: ctx.Namespace,
29+
CredentialsFile: filepath.Join(common.StorageMount, "credentials"),
30+
Region: region,
31+
PublicRegistry: !privateRegistry,
32+
SecretToUpdate: secretToUpdateName,
3733
}
3834

3935
json, err := common.ToJSONString(registryCredentialCfg)
@@ -62,10 +58,3 @@ func secretToUpdateName(ctx *common.RenderContext) (string, error) {
6258
}
6359
return ctx.Config.ContainerRegistry.External.Certificate.Name, nil
6460
}
65-
66-
func credentialSecretName(ctx *common.RenderContext) (string, error) {
67-
if ctx.Config.ContainerRegistry.External == nil {
68-
return "", fmt.Errorf("%s: invalid container registry config", Component)
69-
}
70-
return ctx.Config.ContainerRegistry.External.Credential.Name, nil
71-
}

‎install/installer/pkg/components/refresh-credential/cronjob.go

Lines changed: 36 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,41 @@ import (
1515
)
1616

1717
func cronjob(ctx *common.RenderContext) ([]runtime.Object, error) {
18+
podSpec := corev1.PodSpec{
19+
RestartPolicy: corev1.RestartPolicyOnFailure,
20+
ServiceAccountName: Component,
21+
Containers: []corev1.Container{
22+
{
23+
Name: Component,
24+
Args: []string{"ecr-update", "/config/config.json"},
25+
Image: ctx.ImageName(ctx.Config.Repository, Component, ctx.VersionManifest.Components.RegistryCredential.Version),
26+
ImagePullPolicy: corev1.PullIfNotPresent,
27+
SecurityContext: &corev1.SecurityContext{
28+
AllowPrivilegeEscalation: pointer.Bool(false),
29+
},
30+
VolumeMounts: []corev1.VolumeMount{
31+
{
32+
Name: "config",
33+
MountPath: "/config",
34+
ReadOnly: true,
35+
},
36+
},
37+
},
38+
},
39+
Volumes: []corev1.Volume{
40+
{
41+
Name: "config",
42+
VolumeSource: corev1.VolumeSource{
43+
ConfigMap: &corev1.ConfigMapVolumeSource{
44+
LocalObjectReference: corev1.LocalObjectReference{Name: Component},
45+
},
46+
},
47+
},
48+
},
49+
}
50+
51+
common.MountStorage(&podSpec, ctx.Config.ContainerRegistry.External.Credentials.Name, Component)
52+
1853
objectMeta := metav1.ObjectMeta{
1954
Name: Component,
2055
Namespace: ctx.Namespace,
@@ -36,38 +71,7 @@ func cronjob(ctx *common.RenderContext) ([]runtime.Object, error) {
3671
BackoffLimit: pointer.Int32(10),
3772
Template: corev1.PodTemplateSpec{
3873
ObjectMeta: objectMeta,
39-
Spec: corev1.PodSpec{
40-
RestartPolicy: corev1.RestartPolicyOnFailure,
41-
ServiceAccountName: Component,
42-
Containers: []corev1.Container{
43-
{
44-
Name: Component,
45-
Args: []string{"ecr-update", "/config/config.json"},
46-
Image: ctx.ImageName(ctx.Config.Repository, Component, ctx.VersionManifest.Components.RegistryCredential.Version),
47-
ImagePullPolicy: corev1.PullIfNotPresent,
48-
SecurityContext: &corev1.SecurityContext{
49-
AllowPrivilegeEscalation: pointer.Bool(false),
50-
},
51-
VolumeMounts: []corev1.VolumeMount{
52-
{
53-
Name: "config",
54-
MountPath: "/config",
55-
ReadOnly: true,
56-
},
57-
},
58-
},
59-
},
60-
Volumes: []corev1.Volume{
61-
{
62-
Name: "config",
63-
VolumeSource: corev1.VolumeSource{
64-
ConfigMap: &corev1.ConfigMapVolumeSource{
65-
LocalObjectReference: corev1.LocalObjectReference{Name: Component},
66-
},
67-
},
68-
},
69-
},
70-
},
74+
Spec: podSpec,
7175
},
7276
},
7377
},

‎install/installer/pkg/config/v1/config.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -303,7 +303,7 @@ type ContainerRegistry struct {
303303
type ContainerRegistryExternal struct {
304304
URL string `json:"url" validate:"required"`
305305
Certificate ObjectRef `json:"certificate" validate:"required"`
306-
Credential *ObjectRef `json:"credential,omitempty"`
306+
Credentials *ObjectRef `json:"credentials,omitempty"`
307307
}
308308

309309
type S3Storage struct {

‎install/installer/pkg/config/v1/validation.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -150,8 +150,8 @@ func (v version) ClusterValidation(rcfg interface{}) cluster.ValidationChecks {
150150
secretName := cfg.ContainerRegistry.External.Certificate.Name
151151
res = append(res, cluster.CheckSecret(secretName, cluster.CheckSecretRequiredData(".dockerconfigjson")))
152152

153-
if cfg.ContainerRegistry.External.Credential != nil {
154-
credSecretName := cfg.ContainerRegistry.External.Credential.Name
153+
if cfg.ContainerRegistry.External != nil {
154+
credSecretName := cfg.ContainerRegistry.External.Credentials.Name
155155
res = append(res, cluster.CheckSecret(credSecretName, cluster.CheckSecretRequiredData("accessKeyId", "secretAccessKey")))
156156
}
157157
}

0 commit comments

Comments
 (0)