mirror of
https://github.com/YuzuZensai/netbird-kubernetes-operator.git
synced 2026-09-13 10:49:15 +00:00
Add initial version with help and admission controller (#1)
- It adds a helm chart that will be hosted in the Github pages URL of this repository - an admission controller operator - Basic documentation for installing the operator, configuring CRDs and example pod configuration
This commit is contained in:
M. Essam
@@ -0,0 +1,156 @@
|
||||
/*
|
||||
Copyright 2025.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package controller
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
|
||||
"github.com/google/uuid"
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
"k8s.io/apimachinery/pkg/api/errors"
|
||||
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
ctrl "sigs.k8s.io/controller-runtime"
|
||||
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||
"sigs.k8s.io/controller-runtime/pkg/handler"
|
||||
"sigs.k8s.io/controller-runtime/pkg/log"
|
||||
"sigs.k8s.io/controller-runtime/pkg/reconcile"
|
||||
|
||||
netbirdiov1 "github.com/netbirdio/kubernetes-operator/api/v1"
|
||||
)
|
||||
|
||||
// NBSetupKeyReconciler reconciles a NBSetupKey object
|
||||
type NBSetupKeyReconciler struct {
|
||||
client.Client
|
||||
Scheme *runtime.Scheme
|
||||
ReferencedSecrets map[string]types.NamespacedName
|
||||
}
|
||||
|
||||
// Reconcile is part of the main kubernetes reconciliation loop which aims to
|
||||
// move the current state of the cluster closer to the desired state.
|
||||
func (r *NBSetupKeyReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
|
||||
_ = log.FromContext(ctx)
|
||||
|
||||
nbSetupKey := netbirdiov1.NBSetupKey{}
|
||||
err := r.Get(ctx, req.NamespacedName, &nbSetupKey)
|
||||
if err != nil {
|
||||
ctrl.Log.Error(fmt.Errorf("internalError"), "error getting NBSetupKey", "err", err, "namespace", req.Namespace, "name", req.Name)
|
||||
return ctrl.Result{}, nil
|
||||
}
|
||||
|
||||
if nbSetupKey.Spec.SecretKeyRef.Name == "" || nbSetupKey.Spec.SecretKeyRef.Key == "" {
|
||||
ctrl.Log.Error(fmt.Errorf("invalid NBSetupKey"), "secretKeyRef must contain both secret name and secret key", "namespace", req.Namespace, "name", req.Name)
|
||||
return ctrl.Result{}, r.setStatus(ctx, &nbSetupKey, netbirdiov1.NBSetupKeyStatus{
|
||||
Conditions: []netbirdiov1.NBSetupKeyCondition{
|
||||
{
|
||||
Type: netbirdiov1.Ready,
|
||||
Status: corev1.ConditionFalse,
|
||||
LastProbeTime: v1.Now(),
|
||||
Reason: "InvalidConfig",
|
||||
Message: "secretKeyRef must contain both secret name and secret key.",
|
||||
},
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
// Handle updated secret name
|
||||
for k, v := range r.ReferencedSecrets {
|
||||
if v == req.NamespacedName {
|
||||
delete(r.ReferencedSecrets, k)
|
||||
break
|
||||
}
|
||||
}
|
||||
r.ReferencedSecrets[fmt.Sprintf("%s/%s", nbSetupKey.Namespace, nbSetupKey.Spec.SecretKeyRef.Name)] = req.NamespacedName
|
||||
|
||||
secret := corev1.Secret{}
|
||||
err = r.Get(ctx, types.NamespacedName{Namespace: nbSetupKey.Namespace, Name: nbSetupKey.Spec.SecretKeyRef.Name}, &secret)
|
||||
if err != nil {
|
||||
if !errors.IsNotFound(err) {
|
||||
ctrl.Log.Error(fmt.Errorf("internalError"), "error getting secret", "err", err, "namespace", req.Namespace, "name", req.Name)
|
||||
return ctrl.Result{}, err
|
||||
}
|
||||
ctrl.Log.Error(fmt.Errorf("invalid NBSetupKey"), "secret referenced not found", "err", err, "namespace", req.Namespace, "name", req.Name)
|
||||
return ctrl.Result{}, r.setStatus(ctx, &nbSetupKey, netbirdiov1.NBSetupKeyStatus{Conditions: []netbirdiov1.NBSetupKeyCondition{{
|
||||
Type: netbirdiov1.Ready,
|
||||
Status: corev1.ConditionFalse,
|
||||
LastProbeTime: v1.Now(),
|
||||
Reason: "SecretNotExists",
|
||||
Message: "Referenced secret does not exist",
|
||||
}}})
|
||||
}
|
||||
|
||||
uuidBytes, ok := secret.Data[nbSetupKey.Spec.SecretKeyRef.Key]
|
||||
if !ok {
|
||||
ctrl.Log.Error(fmt.Errorf("invalid NBSetupKey"), "secret key referenced not found", "namespace", req.Namespace, "name", req.Name)
|
||||
return ctrl.Result{}, r.setStatus(ctx, &nbSetupKey, netbirdiov1.NBSetupKeyStatus{Conditions: []netbirdiov1.NBSetupKeyCondition{{
|
||||
Type: netbirdiov1.Ready,
|
||||
Status: corev1.ConditionFalse,
|
||||
LastProbeTime: v1.Now(),
|
||||
Reason: "SecretKeyNotExists",
|
||||
Message: "Referenced secret key does not exist",
|
||||
}}})
|
||||
}
|
||||
|
||||
_, err = uuid.Parse(string(uuidBytes))
|
||||
if err != nil {
|
||||
ctrl.Log.Error(fmt.Errorf("invalid NBSetupKey"), "setupKey is not a valid UUID", "err", err, "namespace", req.Namespace, "name", req.Name)
|
||||
return ctrl.Result{}, r.setStatus(ctx, &nbSetupKey, netbirdiov1.NBSetupKeyStatus{Conditions: []netbirdiov1.NBSetupKeyCondition{{
|
||||
Type: netbirdiov1.Ready,
|
||||
Status: corev1.ConditionFalse,
|
||||
LastProbeTime: v1.Now(),
|
||||
Reason: "InvalidSetupKey",
|
||||
Message: "Referenced secret is not a valid SetupKey",
|
||||
}}})
|
||||
}
|
||||
return ctrl.Result{}, r.setStatus(ctx, &nbSetupKey, netbirdiov1.NBSetupKeyStatus{Conditions: []netbirdiov1.NBSetupKeyCondition{{
|
||||
Type: netbirdiov1.Ready,
|
||||
Status: corev1.ConditionTrue,
|
||||
LastProbeTime: v1.Now(),
|
||||
}}})
|
||||
}
|
||||
|
||||
func (r *NBSetupKeyReconciler) setStatus(ctx context.Context, nbsetupkey *netbirdiov1.NBSetupKey, status netbirdiov1.NBSetupKeyStatus) error {
|
||||
nbsetupkey.Status = status
|
||||
err := r.Status().Update(ctx, nbsetupkey)
|
||||
return err
|
||||
}
|
||||
|
||||
// SetupWithManager sets up the controller with the Manager.
|
||||
func (r *NBSetupKeyReconciler) SetupWithManager(mgr ctrl.Manager) error {
|
||||
r.ReferencedSecrets = make(map[string]types.NamespacedName)
|
||||
|
||||
return ctrl.NewControllerManagedBy(mgr).
|
||||
For(&netbirdiov1.NBSetupKey{}).
|
||||
Named("nbsetupkey").
|
||||
Watches(
|
||||
&corev1.Secret{},
|
||||
handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, obj client.Object) []reconcile.Request {
|
||||
if v, ok := r.ReferencedSecrets[fmt.Sprintf("%s/%s", obj.GetNamespace(), obj.GetName())]; ok {
|
||||
return []reconcile.Request{
|
||||
{
|
||||
NamespacedName: v,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}),
|
||||
). // Trigger reconciliation when the labeled Busybox resource changes
|
||||
Complete(r)
|
||||
}
|
||||
@@ -0,0 +1,200 @@
|
||||
/*
|
||||
Copyright 2025.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package controller
|
||||
|
||||
import (
|
||||
"context"
|
||||
|
||||
. "github.com/onsi/ginkgo/v2"
|
||||
. "github.com/onsi/gomega"
|
||||
v1 "k8s.io/api/core/v1"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
"sigs.k8s.io/controller-runtime/pkg/reconcile"
|
||||
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
|
||||
netbirdiov1 "github.com/netbirdio/kubernetes-operator/api/v1"
|
||||
)
|
||||
|
||||
var _ = Describe("NBSetupKey Controller", func() {
|
||||
Context("When reconciling a resource", func() {
|
||||
const resourceName = "test-resource"
|
||||
|
||||
ctx := context.Background()
|
||||
|
||||
typeNamespacedName := types.NamespacedName{
|
||||
Name: resourceName,
|
||||
Namespace: "default",
|
||||
}
|
||||
nbsetupkey := &netbirdiov1.NBSetupKey{}
|
||||
secret := &v1.Secret{}
|
||||
|
||||
BeforeEach(func() {
|
||||
By("creating the custom resource for the Kind NBSetupKey")
|
||||
err := k8sClient.Get(ctx, typeNamespacedName, nbsetupkey)
|
||||
resource := &netbirdiov1.NBSetupKey{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: resourceName,
|
||||
Namespace: "default",
|
||||
},
|
||||
Spec: netbirdiov1.NBSetupKeySpec{
|
||||
SecretKeyRef: v1.SecretKeySelector{
|
||||
LocalObjectReference: v1.LocalObjectReference{
|
||||
Name: resourceName,
|
||||
},
|
||||
Key: "setupkey",
|
||||
},
|
||||
},
|
||||
}
|
||||
if err == nil {
|
||||
Expect(k8sClient.Delete(ctx, nbsetupkey)).To(Succeed())
|
||||
}
|
||||
Expect(k8sClient.Create(ctx, resource)).To(Succeed())
|
||||
})
|
||||
|
||||
AfterEach(func() {
|
||||
resource := &netbirdiov1.NBSetupKey{}
|
||||
err := k8sClient.Get(ctx, typeNamespacedName, resource)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Cleanup the specific resource instance NBSetupKey")
|
||||
Expect(k8sClient.Delete(ctx, resource)).To(Succeed())
|
||||
})
|
||||
|
||||
When("No secret present", func() {
|
||||
It("should set status to not ready", func() {
|
||||
controllerReconciler := &NBSetupKeyReconciler{
|
||||
Client: k8sClient,
|
||||
Scheme: k8sClient.Scheme(),
|
||||
ReferencedSecrets: make(map[string]types.NamespacedName),
|
||||
}
|
||||
|
||||
_, err := controllerReconciler.Reconcile(ctx, reconcile.Request{
|
||||
NamespacedName: typeNamespacedName,
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
err = k8sClient.Get(ctx, typeNamespacedName, nbsetupkey)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
Expect(nbsetupkey.Status.Conditions).NotTo(BeNil())
|
||||
Expect(nbsetupkey.Status.Conditions).To(HaveLen(1))
|
||||
Expect(nbsetupkey.Status.Conditions[0].Status).To(Equal(v1.ConditionFalse))
|
||||
Expect(nbsetupkey.Status.Conditions[0].Reason).To(Equal("SecretNotExists"))
|
||||
Expect(controllerReconciler.ReferencedSecrets).To(HaveKey("default/test-resource"))
|
||||
})
|
||||
})
|
||||
|
||||
When("Secret present", Ordered, func() {
|
||||
createSecret := func(secretkey, setupkey string) {
|
||||
resource := &v1.Secret{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Namespace: "default",
|
||||
Name: resourceName,
|
||||
},
|
||||
Data: map[string][]byte{
|
||||
secretkey: []byte(setupkey),
|
||||
},
|
||||
}
|
||||
|
||||
secret = &v1.Secret{}
|
||||
err := k8sClient.Get(ctx, types.NamespacedName{Namespace: "default", Name: resourceName}, secret)
|
||||
if err == nil {
|
||||
Expect(k8sClient.Delete(ctx, secret)).To(Succeed())
|
||||
}
|
||||
Expect(k8sClient.Create(ctx, resource)).To(Succeed())
|
||||
}
|
||||
|
||||
When("secret is invalid", func() {
|
||||
It("should set status to not ready", func() {
|
||||
createSecret("setupkey", "invalid-key")
|
||||
|
||||
controllerReconciler := &NBSetupKeyReconciler{
|
||||
Client: k8sClient,
|
||||
Scheme: k8sClient.Scheme(),
|
||||
ReferencedSecrets: make(map[string]types.NamespacedName),
|
||||
}
|
||||
|
||||
_, err := controllerReconciler.Reconcile(ctx, reconcile.Request{
|
||||
NamespacedName: typeNamespacedName,
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
err = k8sClient.Get(ctx, typeNamespacedName, nbsetupkey)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
Expect(nbsetupkey.Status.Conditions).NotTo(BeNil())
|
||||
Expect(nbsetupkey.Status.Conditions).To(HaveLen(1))
|
||||
Expect(nbsetupkey.Status.Conditions[0].Status).To(Equal(v1.ConditionFalse))
|
||||
Expect(nbsetupkey.Status.Conditions[0].Reason).To(Equal("InvalidSetupKey"))
|
||||
Expect(controllerReconciler.ReferencedSecrets).To(HaveKey("default/test-resource"))
|
||||
})
|
||||
})
|
||||
|
||||
When("secret key is missing", func() {
|
||||
It("should set status to not ready", func() {
|
||||
createSecret("key", "EEEEEEEE-EEEE-EEEE-EEEE-EEEEEEEEEEEE")
|
||||
|
||||
controllerReconciler := &NBSetupKeyReconciler{
|
||||
Client: k8sClient,
|
||||
Scheme: k8sClient.Scheme(),
|
||||
ReferencedSecrets: make(map[string]types.NamespacedName),
|
||||
}
|
||||
|
||||
_, err := controllerReconciler.Reconcile(ctx, reconcile.Request{
|
||||
NamespacedName: typeNamespacedName,
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
err = k8sClient.Get(ctx, typeNamespacedName, nbsetupkey)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
Expect(nbsetupkey.Status.Conditions).NotTo(BeNil())
|
||||
Expect(nbsetupkey.Status.Conditions).To(HaveLen(1))
|
||||
Expect(nbsetupkey.Status.Conditions[0].Status).To(Equal(v1.ConditionFalse))
|
||||
Expect(nbsetupkey.Status.Conditions[0].Reason).To(Equal("SecretKeyNotExists"))
|
||||
Expect(controllerReconciler.ReferencedSecrets).To(HaveKey("default/test-resource"))
|
||||
})
|
||||
})
|
||||
|
||||
When("secret is valid", func() {
|
||||
It("should set status to ready", func() {
|
||||
createSecret("setupkey", "EEEEEEEE-EEEE-EEEE-EEEE-EEEEEEEEEEEE")
|
||||
|
||||
controllerReconciler := &NBSetupKeyReconciler{
|
||||
Client: k8sClient,
|
||||
Scheme: k8sClient.Scheme(),
|
||||
ReferencedSecrets: make(map[string]types.NamespacedName),
|
||||
}
|
||||
|
||||
_, err := controllerReconciler.Reconcile(ctx, reconcile.Request{
|
||||
NamespacedName: typeNamespacedName,
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
err = k8sClient.Get(ctx, typeNamespacedName, nbsetupkey)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
Expect(nbsetupkey.Status.Conditions).NotTo(BeNil())
|
||||
Expect(nbsetupkey.Status.Conditions).To(HaveLen(1))
|
||||
Expect(nbsetupkey.Status.Conditions[0].Status).To(Equal(v1.ConditionTrue))
|
||||
Expect(controllerReconciler.ReferencedSecrets).To(HaveKey("default/test-resource"))
|
||||
})
|
||||
})
|
||||
})
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,116 @@
|
||||
/*
|
||||
Copyright 2025.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package controller
|
||||
|
||||
import (
|
||||
"context"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
. "github.com/onsi/ginkgo/v2"
|
||||
. "github.com/onsi/gomega"
|
||||
|
||||
"k8s.io/client-go/kubernetes/scheme"
|
||||
"k8s.io/client-go/rest"
|
||||
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||
"sigs.k8s.io/controller-runtime/pkg/envtest"
|
||||
logf "sigs.k8s.io/controller-runtime/pkg/log"
|
||||
"sigs.k8s.io/controller-runtime/pkg/log/zap"
|
||||
|
||||
netbirdiov1 "github.com/netbirdio/kubernetes-operator/api/v1"
|
||||
// +kubebuilder:scaffold:imports
|
||||
)
|
||||
|
||||
// These tests use Ginkgo (BDD-style Go testing framework). Refer to
|
||||
// http://onsi.github.io/ginkgo/ to learn more about Ginkgo.
|
||||
|
||||
var (
|
||||
ctx context.Context
|
||||
cancel context.CancelFunc
|
||||
testEnv *envtest.Environment
|
||||
cfg *rest.Config
|
||||
k8sClient client.Client
|
||||
)
|
||||
|
||||
func TestControllers(t *testing.T) {
|
||||
RegisterFailHandler(Fail)
|
||||
|
||||
RunSpecs(t, "Controller Suite")
|
||||
}
|
||||
|
||||
var _ = BeforeSuite(func() {
|
||||
logf.SetLogger(zap.New(zap.WriteTo(GinkgoWriter), zap.UseDevMode(true)))
|
||||
|
||||
ctx, cancel = context.WithCancel(context.TODO())
|
||||
|
||||
var err error
|
||||
err = netbirdiov1.AddToScheme(scheme.Scheme)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
// +kubebuilder:scaffold:scheme
|
||||
|
||||
By("bootstrapping test environment")
|
||||
testEnv = &envtest.Environment{
|
||||
CRDDirectoryPaths: []string{filepath.Join("..", "..", "helm", "netbird-operator", "crds")},
|
||||
ErrorIfCRDPathMissing: true,
|
||||
}
|
||||
|
||||
// Retrieve the first found binary directory to allow running tests from IDEs
|
||||
if getFirstFoundEnvTestBinaryDir() != "" {
|
||||
testEnv.BinaryAssetsDirectory = getFirstFoundEnvTestBinaryDir()
|
||||
}
|
||||
|
||||
// cfg is defined in this file globally.
|
||||
cfg, err = testEnv.Start()
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(cfg).NotTo(BeNil())
|
||||
|
||||
k8sClient, err = client.New(cfg, client.Options{Scheme: scheme.Scheme})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(k8sClient).NotTo(BeNil())
|
||||
})
|
||||
|
||||
var _ = AfterSuite(func() {
|
||||
By("tearing down the test environment")
|
||||
cancel()
|
||||
err := testEnv.Stop()
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
})
|
||||
|
||||
// getFirstFoundEnvTestBinaryDir locates the first binary in the specified path.
|
||||
// ENVTEST-based tests depend on specific binaries, usually located in paths set by
|
||||
// controller-runtime. When running tests directly (e.g., via an IDE) without using
|
||||
// Makefile targets, the 'BinaryAssetsDirectory' must be explicitly configured.
|
||||
//
|
||||
// This function streamlines the process by finding the required binaries, similar to
|
||||
// setting the 'KUBEBUILDER_ASSETS' environment variable. To ensure the binaries are
|
||||
// properly set up, run 'make setup-envtest' beforehand.
|
||||
func getFirstFoundEnvTestBinaryDir() string {
|
||||
basePath := filepath.Join("..", "..", "bin", "k8s")
|
||||
entries, err := os.ReadDir(basePath)
|
||||
if err != nil {
|
||||
logf.Log.Error(err, "Failed to read directory", "path", basePath)
|
||||
return ""
|
||||
}
|
||||
for _, entry := range entries {
|
||||
if entry.IsDir() {
|
||||
return filepath.Join(basePath, entry.Name())
|
||||
}
|
||||
}
|
||||
return ""
|
||||
}
|
||||
Reference in New Issue
Block a user