ston1th/cloud-provider-pve
0
0
Fork 0
Code Issues 4 Pull requests Releases Wiki Activity

csr rewrite

Browse source
This commit is contained in:
ston1th 2020-11-01 00:01:57 +01:00
commit 954b5c0d61
8 changed files with 430 additions and 280 deletions
Download patch file Download diff file Expand all files Collapse all files

158
pkg/approver/approver.go
View file

@ -8,17 +8,98 @@ import (
pve "git.giftfish.de/ston1th/pve-go"
//"k8s.io/client-go/kubernetes/typed/certificates/v1"
"github.com/go-logr/logr"
certificatesv1beta1 "k8s.io/api/certificates/v1beta1"
apierrors "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/util/sets"
"k8s.io/client-go/kubernetes/typed/certificates/v1beta1"
typedcertificatesv1beta1 "k8s.io/client-go/kubernetes/typed/certificates/v1beta1"
"k8s.io/client-go/tools/record"
"k8s.io/kubernetes/pkg/apis/certificates"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/controller"
)
var ErrNoKubeletServingCSR = errors.New("CSR is no kubelet serving certificate")
type CSRReconciler struct {
client.Client
Recorder record.EventRecorder
Log logr.Logger
Scheme *runtime.Scheme
PVEClient *pve.Client
CSRClient *typedcertificatesv1beta1.CertificatesV1beta1Client
}
func (r *CSRReconciler) SetupWithManager(mgr ctrl.Manager, options controller.Options) error {
return ctrl.NewControllerManagedBy(mgr).
WithOptions(options).
For(&certificatesv1beta1.CertificateSigningRequest{}).
Complete(r)
}
func (r *CSRReconciler) Reconcile(req ctrl.Request) (res ctrl.Result, err error) {
ctx := context.Background()
log := r.Log
csr := &certificatesv1beta1.CertificateSigningRequest{}
if err = r.Get(ctx, req.NamespacedName, csr); err != nil {
if apierrors.IsNotFound(err) {
err = nil
return
}
return
}
if !csr.DeletionTimestamp.IsZero() {
return
}
err = r.approve(ctx, log, csr)
return
}
var conditionv1beta1 = certificatesv1beta1.CertificateSigningRequestCondition{
Type: certificatesv1beta1.CertificateApproved,
Reason: "AutoApproved",
Message: "Auto approving kubelet client certificate in PVE Cluster",
}
func (r *CSRReconciler) approve(ctx context.Context, log logr.Logger, request *certificatesv1beta1.CertificateSigningRequest) error {
if len(request.Status.Conditions) > 0 {
return nil
}
client := r.CSRClient.CertificateSigningRequests()
err := checkCSR(ctx, r.PVEClient, request)
if err == ErrNoKubeletServingCSR {
return nil
}
if err != nil {
return err
}
for {
if len(request.Status.Conditions) > 0 {
return nil
}
request.Status.Conditions = append(request.Status.Conditions, conditionv1beta1)
// Submit the updated CSR.
if _, err := client.UpdateApproval(ctx, request, metav1.UpdateOptions{}); err != nil {
if strings.Contains(err.Error(), "the object has been modified") {
// The CSR might have been updated by a third-party, retry until we
// succeed.
request, err = client.Get(ctx, request.ObjectMeta.Name, metav1.GetOptions{})
if err != nil {
return err
}
continue
}
return err
}
log.Info("csr approval successful", "name", request.ObjectMeta.Name)
return nil
}
}
func checkCSR(ctx context.Context, pveClient *pve.Client, request *certificatesv1beta1.CertificateSigningRequest) error {
req, err := certificates.ParseCSR(request.Spec.Request)
if err != nil {
@ -85,76 +166,3 @@ func checkCSR(ctx context.Context, pveClient *pve.Client, request *certificatesv
}
return nil
}
var conditionv1beta1 = certificatesv1beta1.CertificateSigningRequestCondition{
Type: certificatesv1beta1.CertificateApproved,
Reason: "AutoApproved",
Message: "Auto approving kubelet client certificate in PVE Cluster",
}
func ApproveV1beta1(log logr.Logger, pveClient *pve.Client, client v1beta1.CertificateSigningRequestInterface, request *certificatesv1beta1.CertificateSigningRequest) error {
if len(request.Status.Conditions) > 0 {
return nil
}
ctx := context.Background()
err := checkCSR(ctx, pveClient, request)
if err == ErrNoKubeletServingCSR {
return nil
}
if err != nil {
return err
}
for {
if len(request.Status.Conditions) > 0 {
return nil
}
request.Status.Conditions = append(request.Status.Conditions, conditionv1beta1)
// Submit the updated CSR.
if _, err := client.UpdateApproval(ctx, request, metav1.UpdateOptions{}); err != nil {
if strings.Contains(err.Error(), "the object has been modified") {
// The CSR might have been updated by a third-party, retry until we
// succeed.
request, err = client.Get(ctx, request.ObjectMeta.Name, metav1.GetOptions{})
if err != nil {
return err
}
continue
}
return err
}
log.Info("csr approval successful", "name", request.ObjectMeta.Name)
return nil
}
}
//func ApproveV1(pveClient *pve.Client, client v1.CertificateSigningRequestInterface, request *certificates.CertificateSigningRequest) error {
// if len(request.Status.Conditions) > 0 {
// return nil
// }
// err := checkCSR(pveClient, request)
// if err != nil {
// return err
// }
//
// for {
// if len(request.Status.Conditions) > 0 {
// return nil
// }
// request.Status.Conditions = append(request.Status.Conditions, condition)
// // Submit the updated CSR.
// if _, err := client.UpdateApproval(request); err != nil {
// if strings.Contains(err.Error(), "the object has been modified") {
// // The CSR might have been updated by a third-party, retry until we
// // succeed.
// request, err = client.Get(request.ObjectMeta.Name)
// if err != nil {
// return err
// }
// continue
// }
// return err
// }
// return nil
// }
//}