Skip to content

Commit 07cdcc6

Browse files
IceberIceber
authored
Merge pull request #753 from scydas/feature_gate_cluster_authentication_secrets
add feature gate ClusterAuthenticationFromSecret
2 parents 3ef6b83 + 8bd142e commit 07cdcc6

File tree

5 files changed

+56
-29
lines changed

5 files changed

+56
-29
lines changed

‎pkg/kubeapiserver/apiserver.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ import (
1818
"k8s.io/apiserver/pkg/server/healthz"
1919
utilfeature "k8s.io/apiserver/pkg/util/feature"
2020
"k8s.io/apiserver/pkg/util/version"
21+
corev1listers "k8s.io/client-go/listers/core/v1"
2122
"k8s.io/client-go/restmapper"
2223
"k8s.io/component-base/tracing"
2324

@@ -142,7 +143,11 @@ func (c completedConfig) New(delegationTarget genericapiserver.DelegationTarget)
142143
restManager := NewRESTManager(c.GenericConfig.Serializer, runtime.ContentTypeJSON, c.StorageFactory, c.InitialAPIGroupResources)
143144
discoveryManager := discovery.NewDiscoveryManager(c.GenericConfig.Serializer, restManager, delegate)
144145

145-
secretLister := c.GenericConfig.SharedInformerFactory.Core().V1().Secrets().Lister().Secrets(c.ExtraConfig.SecretNamespace)
146+
var secretLister corev1listers.SecretNamespaceLister
147+
if utilfeature.DefaultFeatureGate.Enabled(ClusterAuthenticationFromSecret) {
148+
secretLister = c.GenericConfig.SharedInformerFactory.Core().V1().Secrets().Lister().Secrets(c.ExtraConfig.SecretNamespace)
149+
}
150+
146151
clusterInformer := c.InformerFactory.Cluster().V1alpha2().PediaClusters()
147152
connector := proxyrest.NewProxyConnector(clusterInformer.Lister(), secretLister, c.ExtraConfig.AllowPediaClusterConfigReuse, c.ExtraConfig.ExtraProxyRequestHeaderPrefixes)
148153

‎pkg/kubeapiserver/features.go‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,12 @@ const (
1212
// owner: @scydas
1313
// alpha: v0.9.0
1414
AllowProxyRequestToClusters featuregate.Feature = "AllowProxyRequestToClusters"
15+
16+
// ClusterAuthenticationFromSecret could get authentication information of the PediaCluster from Secret.
17+
//
18+
// owner: @scydas
19+
// alpha: v0.9.0
20+
ClusterAuthenticationFromSecret featuregate.Feature = "ClusterAuthenticationFromSecret"
1521
)
1622

1723
func init() {
@@ -21,5 +27,6 @@ func init() {
2127
// defaultInternalStorageFeatureGates consists of all known custom internalstorage feature keys.
2228
// To add a new feature, define a key for it above and add it here.
2329
var defaultInternalStorageFeatureGates = map[featuregate.Feature]featuregate.FeatureSpec{
24-
AllowProxyRequestToClusters: {Default: false, PreRelease: featuregate.Alpha},
30+
AllowProxyRequestToClusters: {Default: false, PreRelease: featuregate.Alpha},
31+
ClusterAuthenticationFromSecret: {Default: false, PreRelease: featuregate.Alpha},
2532
}

‎pkg/synchromanager/clustersynchro_manager.go‎

Lines changed: 32 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -92,24 +92,27 @@ func NewManager(client kubernetes.Interface, clusterpediaClient crdclientset.Int
9292
synchros: make(map[string]*clustersynchro.ClusterSynchro),
9393
}
9494

95-
secretInformer := corev1informers.NewSecretInformer(client, secretNamespace, 0, nil)
96-
if _, err := secretInformer.AddEventHandler(
97-
cache.ResourceEventHandlerFuncs{
98-
AddFunc: func(obj any) { manager.handleSecret(nil, obj.(*v1.Secret)) },
99-
UpdateFunc: func(older, newer any) { manager.handleSecret(older.(*v1.Secret), newer.(*v1.Secret)) },
100-
DeleteFunc: func(obj any) {
101-
objName, err := cache.DeletionHandlingObjectToName(obj)
102-
if err != nil {
103-
return
104-
}
105-
manager.handleDeletedSecret(objName.Name)
95+
if clusterpediafeature.FeatureGate.Enabled(features.ClusterAuthenticationFromSecret) {
96+
secretInformer := corev1informers.NewSecretInformer(client, secretNamespace, 0, nil)
97+
if _, err := secretInformer.AddEventHandler(
98+
cache.ResourceEventHandlerFuncs{
99+
AddFunc: func(obj any) { manager.handleSecret(nil, obj.(*v1.Secret)) },
100+
UpdateFunc: func(older, newer any) { manager.handleSecret(older.(*v1.Secret), newer.(*v1.Secret)) },
101+
DeleteFunc: func(obj any) {
102+
objName, err := cache.DeletionHandlingObjectToName(obj)
103+
if err != nil {
104+
return
105+
}
106+
manager.handleDeletedSecret(objName.Name)
107+
},
106108
},
107-
},
108-
); err != nil {
109-
klog.ErrorS(err, "error when adding event handler to informer")
109+
); err != nil {
110+
klog.ErrorS(err, "error when adding event handler to informer")
111+
}
112+
113+
manager.secretInformer = secretInformer
114+
manager.secretLister = corev1listers.NewSecretLister(secretInformer.GetIndexer()).Secrets(secretNamespace)
110115
}
111-
manager.secretInformer = secretInformer
112-
manager.secretLister = corev1listers.NewSecretLister(secretInformer.GetIndexer()).Secrets(secretNamespace)
113116

114117
if _, err := clusterinformer.Informer().AddEventHandler(
115118
cache.ResourceEventHandlerFuncs{
@@ -159,18 +162,20 @@ func (manager *Manager) Run(workers int, stopCh <-chan struct{}) {
159162
// informerFactory should not be controlled by stopCh
160163
stopInformer := make(chan struct{})
161164

162-
// Start the secret informer first
163-
go manager.secretInformer.Run(stopInformer)
164-
timeout := make(chan struct{})
165-
go func() {
166-
select {
167-
case <-stopCh:
168-
case <-time.After(60 * time.Second):
165+
if manager.secretInformer != nil {
166+
// Start the secret informer first
167+
go manager.secretInformer.Run(stopInformer)
168+
timeout := make(chan struct{})
169+
go func() {
170+
select {
171+
case <-stopCh:
172+
case <-time.After(60 * time.Second):
173+
}
174+
close(timeout)
175+
}()
176+
if !cache.WaitForCacheSync(timeout, manager.secretInformer.HasSynced) {
177+
klog.Fatal("clustersynchro manager: wait for secret informer failed")
169178
}
170-
close(timeout)
171-
}()
172-
if !cache.WaitForCacheSync(timeout, manager.secretInformer.HasSynced) {
173-
klog.Fatal("clustersynchro manager: wait for secret informer failed")
174179
}
175180

176181
manager.informerFactory.Start(stopInformer)

‎pkg/synchromanager/features/features.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,12 @@ const (
6868
// owner: @27149chen
6969
// alpha: v0.8.0
7070
IgnoreSyncLease featuregate.Feature = "IgnoreSyncLease"
71+
72+
// ClusterAuthenticationFromSecret could get authentication information of the PediaCluster from Secret.
73+
//
74+
// owner: @scydas
75+
// alpha: v0.9.0
76+
ClusterAuthenticationFromSecret featuregate.Feature = "ClusterAuthenticationFromSecret"
7177
)
7278

7379
func init() {
@@ -86,4 +92,5 @@ var defaultClusterSynchroManagerFeatureGates = map[featuregate.Feature]featurega
8692
ForcePaginatedListForResourceSync: {Default: false, PreRelease: featuregate.Alpha},
8793
StreamHandlePaginatedListForResourceSync: {Default: false, PreRelease: featuregate.Alpha},
8894
IgnoreSyncLease: {Default: false, PreRelease: featuregate.Alpha},
95+
ClusterAuthenticationFromSecret: {Default: false, PreRelease: featuregate.Alpha},
8996
}

‎pkg/utils/rest.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ func BuildClusterRestConfig(cluster *clusterv1alpha2.PediaCluster, lister v1.Sec
1919
if len(cluster.Spec.Kubeconfig) == 0 && len(cluster.Spec.TokenData) == 0 &&
2020
(len(cluster.Spec.CertData) == 0 || len(cluster.Spec.KeyData) == 0) &&
2121
cluster.Spec.AuthenticationFrom != nil {
22+
if lister == nil {
23+
return nil, fmt.Errorf("cluster authentication secret listers is nil, perhaps you need to enable feature gate %s", "ClusterAuthenticationFromSecret")
24+
}
2225
config, err := buildClusterRestConfigFromSecret(cluster.Spec.APIServer, cluster.Spec.AuthenticationFrom, lister)
2326
if err != nil {
2427
return nil, fmt.Errorf("Cluster Authentication Error: %w", err)

0 commit comments

Comments
 (0)