Skip to content

🌱 clusterctl move should consider Secrets from provider's namespace #4598

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
May 31, 2021
Merged

🌱 clusterctl move should consider Secrets from provider's namespace #4598

merged 1 commit into from
May 31, 2021
+123 −51

Conversation

fabriziopandini
Copy link
Member

@fabriziopandini fabriziopandini commented May 11, 2021 •
edited
Loading

What this PR does / why we need it:
This PR implements the first of a set of changes meant to allow clusterctl move to deal properly with the new model for managing credentials being implemented by providers in v1alpha4.

More specifically this PR makes clusterctl move to consider Secrets from the infrastructure provider's namespace (in addition to secrets from the namespace being moved).

Which issue(s) this PR fixes:
Fixes: #3042

/assign @randomvariable
/assign @yastij

@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label May 11, 2021
@k8s-ci-robot k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label May 11, 2021
fabriziopandini
fabriziopandini commented May 11, 2021
View reviewed changes
cmd/clusterctl/client/cluster/objectgraph_test.go
},
{
name: "Cluster and Global + Namespaced External Objects",
// NOTE: External objects are CRD types installed by clusterctl, but not directly related with the CAPI hierarchy of objects. e.g. IPAM claims.
Copy link
Member Author

@fabriziopandini fabriziopandini May 11, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

NOTE: I'm cleaning up tests for external objects because this would help in implementing next step of move credentials; however if reviewer find this confusing I'm happy to move this to a separated PR

@fabriziopandini fabriziopandini mentioned this pull request May 11, 2021
Closed
vincepri
vincepri reviewed May 11, 2021
View reviewed changes
cmd/clusterctl/client/cluster/objectgraph.go
}
for _, p := range providers.Items {
if p.Type == string(clusterctlv1.InfrastructureProviderType) {
providerNamespaceSelector := []client.ListOption{client.InNamespace(p.Namespace)}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are the secrets we're interested about only in the infrastructure provider namespace? Like capa-system? Is this enforced somehow? cc @yastij @randomvariable @sedefsavas

Copy link
Member Author

@fabriziopandini fabriziopandini May 11, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@vincepri #4514 is documenting/enforcing this

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perfect for the docs, can we make sure to also enforce this in code?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be implemented on the provider side, might be @randomvariable has some ideas about how to enforce it..

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • default credentials mounted in the pods are within the provider namespace
  • the identityRef shouldn't have a namespace, so that's also good (especially for providers who reference a secret directly)
  • for providers referencing a CR or a cluster-scoped identityRef we'll need validation or a webhook the provider side if we need to look for which namespace the provider is installed

@fabriziopandini
Copy link
Member Author

/retest

@fabriziopandini fabriziopandini force-pushed the clusterctl-move-infrastructure-secrets branch from 55b8a16 to 8419393 Compare May 12, 2021 11:42
@vincepri
Copy link
Member

/retest

@sedefsavas sedefsavas mentioned this pull request May 19, 2021
Closed
@fabriziopandini fabriziopandini force-pushed the clusterctl-move-infrastructure-secrets branch from 8419393 to bdb5427 Compare May 25, 2021 19:40
@fabriziopandini
Copy link
Member Author

/retest

@fabriziopandini fabriziopandini added this to the v0.4 milestone May 26, 2021
@yastij
Copy link
Member

yastij commented May 27, 2021

@fabriziopandini - seems like pull-cluster-api-test-main is flaking with a concurrent read/write on map. Probably similar to https://kubernetes.slack.com/archives/C8TSNPY4T/p1621967651077900

@fabriziopandini
Copy link
Member Author

@yastij yes, we have a few fix in flight chasing some test flakes

@fabriziopandini
Copy link
Member Author

/retest

vincepri
vincepri approved these changes May 28, 2021
View reviewed changes
Copy link
Member

@vincepri vincepri left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve
/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 28, 2021
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vincepri

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 28, 2021
@fabriziopandini
Copy link
Member Author

/retest

@fabriziopandini fabriziopandini force-pushed the clusterctl-move-infrastructure-secrets branch from bdb5427 to c4bf2e7 Compare May 31, 2021 08:57
@k8s-ci-robot k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 31, 2021
@fabriziopandini
Copy link
Member Author

Rebased to fix a new test after #4695 changed a method signature

@enxebre
Copy link
Member

enxebre commented May 31, 2021

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 31, 2021
@k8s-ci-robot k8s-ci-robot merged commit df2ab2f into kubernetes-sigs:master May 31, 2021
@fabriziopandini fabriziopandini deleted the clusterctl-move-infrastructure-secrets branch June 1, 2021 11:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vincepri vincepri vincepri approved these changes

@JoelSpeed JoelSpeed Awaiting requested review from JoelSpeed

@sbueringer sbueringer Awaiting requested review from sbueringer

+1 more reviewer

@yastij yastij yastij left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@enxebre enxebre

@randomvariable randomvariable

@vincepri vincepri

@yastij yastij

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Milestone

v0.4

Development

Successfully merging this pull request may close these issues.

Adapt clusterctl move to the new multi-tenancy model

6 participants

@fabriziopandini @vincepri @yastij @k8s-ci-robot @enxebre @randomvariable