Skip to content

Commit d0b39e4

Browse files
kkb0318kkb0318
authored
Merge pull request #1 from kkb0318/feature/eks
EKS support
2 parents e74546d + 5239068 commit d0b39e4

File tree

15 files changed

+339
-77
lines changed

15 files changed

+339
-77
lines changed

‎api/v1alpha1/irsasetup_types.go

Lines changed: 48 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -33,17 +33,34 @@ type IRSASetupSpec struct {
3333
// +required
3434
Cleanup bool `json:"cleanup"`
3535

36-
// Mode (Optional, Future Feature) Defines how the controller will operate once this feature is enabled.
37-
// Currently unused. Planned values:
36+
// Mode specifies the operation mode of the controller.
37+
// Possible values:
3838
// - "selfhosted": For self-managed Kubernetes clusters.
3939
// - "eks": For Amazon EKS environments.
40-
Mode string `json:"mode,omitempty"`
40+
// Default: "selfhosted"
41+
Mode SetupMode `json:"mode,omitempty"`
4142

4243
// Discovery configures the IdP Discovery process, essential for setting up IRSA by locating
4344
// the OIDC provider information.
44-
Discovery Discovery `json:"discovery"`
45+
// Only applicable when Mode is "selfhosted".
46+
// +optional
47+
Discovery Discovery `json:"discovery,omitempty"`
48+
49+
// IamOIDCProvider configures IAM OIDC IamOIDCProvider Name
50+
// Only applicable when Mode is "eks".
51+
IamOIDCProvider string `json:"iamOIDCProvider,omitempty"`
4552
}
4653

54+
// +kubebuilder:default=selfhosted
55+
// +kubebuilder:validation:Enum=selfhosted;eks
56+
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable"
57+
type SetupMode string
58+
59+
const (
60+
ModeSelfhosted = SetupMode("selfhosted")
61+
ModeEks = SetupMode("eks")
62+
)
63+
4764
// Discovery holds the configuration for IdP Discovery, which is crucial for locating
4865
// the OIDC provider in a self-hosted environment.
4966
type Discovery struct {
@@ -62,39 +79,39 @@ type S3Discovery struct {
6279

6380
// IRSASetupStatus defines the observed state of IRSASetup
6481
type IRSASetupStatus struct {
65-
SelfHostedSetup []metav1.Condition `json:"selfHostedSetup,omitempty"`
82+
Conditions []metav1.Condition `json:"conditions,omitempty"`
6683
}
6784

68-
// GetSelfhostedStatusConditions returns a pointer to the Status.Conditions slice
69-
func (in *IRSASetup) GetSelfhostedStatusConditions() *[]metav1.Condition {
70-
return &in.Status.SelfHostedSetup
85+
// GetStatusConditions returns a pointer to the Status.Conditions slice
86+
func (in *IRSASetup) GetStatusConditions() *[]metav1.Condition {
87+
return &in.Status.Conditions
7188
}
7289

73-
func SetupSelfHostedStatusReady(irsa IRSASetup, reason, message string) IRSASetup {
90+
func SetupStatusReady(irsa IRSASetup, reason, message string) IRSASetup {
7491
newCondition := metav1.Condition{
7592
Type: ReadyCondition,
7693
Status: metav1.ConditionTrue,
7794
Reason: reason,
7895
Message: message,
7996
}
80-
apimeta.SetStatusCondition(irsa.GetSelfhostedStatusConditions(), newCondition)
97+
apimeta.SetStatusCondition(irsa.GetStatusConditions(), newCondition)
8198
return irsa
8299
}
83100

84-
func SelfHostedStatusNotReady(irsa IRSASetup, reason, message string) IRSASetup {
101+
func StatusNotReady(irsa IRSASetup, reason, message string) IRSASetup {
85102
newCondition := metav1.Condition{
86103
Type: ReadyCondition,
87104
Status: metav1.ConditionFalse,
88105
Reason: reason,
89106
Message: message,
90107
}
91-
apimeta.SetStatusCondition(irsa.GetSelfhostedStatusConditions(), newCondition)
108+
apimeta.SetStatusCondition(irsa.GetStatusConditions(), newCondition)
92109
return irsa
93110
}
94111

95-
// SelfHostedReadyStatus
96-
func SelfHostedReadyStatus(irsa IRSASetup) *metav1.Condition {
97-
if c := apimeta.FindStatusCondition(irsa.Status.SelfHostedSetup, ReadyCondition); c != nil {
112+
// ReadyStatus
113+
func ReadyStatus(irsa IRSASetup) *metav1.Condition {
114+
if c := apimeta.FindStatusCondition(irsa.Status.Conditions, ReadyCondition); c != nil {
98115
return c
99116
}
100117
return nil
@@ -113,22 +130,30 @@ func HasConditionReason(cond *metav1.Condition, reasons ...string) bool {
113130
return false
114131
}
115132

116-
func IsSelfHostedReadyConditionTrue(irsa IRSASetup) bool {
117-
return apimeta.IsStatusConditionTrue(irsa.Status.SelfHostedSetup, ReadyCondition)
133+
func IsReadyConditionTrue(irsa IRSASetup) bool {
134+
return apimeta.IsStatusConditionTrue(irsa.Status.Conditions, ReadyCondition)
118135
}
119136

120-
type SelfHostedReason string
137+
type SelfhostedConditionReason string
138+
139+
const (
140+
SelfHostedReasonFailedWebhook SelfhostedConditionReason = "SelfHostedSetupFailedWebhookCreation"
141+
SelfHostedReasonFailedOidc SelfhostedConditionReason = "SelfHostedSetupFailedOidcCreation"
142+
SelfHostedReasonFailedIssuer SelfhostedConditionReason = "SelfHostedSetupFailedIssuer"
143+
SelfHostedReasonFailedKeys SelfhostedConditionReason = "SelfHostedSetupFailedKeysCreation"
144+
SelfHostedReasonReady SelfhostedConditionReason = "SelfHostedSetupReady"
145+
)
146+
147+
type EksConditionReason string
121148

122149
const (
123-
SelfHostedReasonFailedWebhook SelfHostedReason = "SelfHostedSetupFailedWebhookCreation"
124-
SelfHostedReasonFailedOidc SelfHostedReason = "SelfHostedSetupFailedOidcCreation"
125-
SelfHostedReasonFailedKeys SelfHostedReason = "SelfHostedSetupFailedKeysCreation"
126-
SelfHostedReasonReady SelfHostedReason = "SelfHostedSetupReady"
150+
EksNotReady EksConditionReason = "EksOIDCNotReady"
151+
EksReasonReady EksConditionReason = "EksOIDCSetupReady"
127152
)
128153

129154
//+kubebuilder:object:root=true
130155
//+kubebuilder:subresource:status
131-
//+kubebuilder:printcolumn:name="SelfHostedReady",type="string",JSONPath=".status.selfHostedSetup[?(@.type==\"Ready\")].status",description=""
156+
//+kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].status",description=""
132157

133158
// IRSASetup represents a configuration for setting up IAM Roles for Service Accounts (IRSA) in a Kubernetes cluster.
134159
type IRSASetup struct {

‎api/v1alpha1/zz_generated.deepcopy.go

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/irsa-manager/crds/irsasetup-crd.yaml

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@ spec:
1414
scope: Namespaced
1515
versions:
1616
- additionalPrinterColumns:
17-
- jsonPath: .status.selfHostedSetup[?(@.type=="Ready")].status
18-
name: SelfHostedReady
17+
- jsonPath: .status.conditions[?(@.type=="Ready")].status
18+
name: Ready
1919
type: string
2020
name: v1alpha1
2121
schema:
@@ -52,6 +52,7 @@ spec:
5252
description: |-
5353
Discovery configures the IdP Discovery process, essential for setting up IRSA by locating
5454
the OIDC provider information.
55+
Only applicable when Mode is "selfhosted".
5556
properties:
5657
s3:
5758
description: S3 specifies the AWS S3 bucket details where the
@@ -70,21 +71,32 @@ spec:
7071
- region
7172
type: object
7273
type: object
74+
iamOIDCProvider:
75+
description: |-
76+
IamOIDCProvider configures IAM OIDC IamOIDCProvider Name
77+
Only applicable when Mode is "eks".
78+
type: string
7379
mode:
7480
description: |-
75-
Mode (Optional, Future Feature) Defines how the controller will operate once this feature is enabled.
76-
Currently unused. Planned values:
81+
Mode specifies the operation mode of the controller.
82+
Possible values:
7783
- "selfhosted": For self-managed Kubernetes clusters.
7884
- "eks": For Amazon EKS environments.
85+
Default: "selfhosted"
86+
enum:
87+
- selfhosted
88+
- eks
7989
type: string
90+
x-kubernetes-validations:
91+
- message: Value is immutable
92+
rule: self == oldSelf
8093
required:
8194
- cleanup
82-
- discovery
8395
type: object
8496
status:
8597
description: IRSASetupStatus defines the observed state of IRSASetup
8698
properties:
87-
selfHostedSetup:
99+
conditions:
88100
items:
89101
description: "Condition contains details for one aspect of the current
90102
state of this API Resource.\n---\nThis struct is intended for

‎charts/irsa-manager/templates/deployment.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,5 +71,7 @@ spec:
7171
| nindent 10 }}
7272
securityContext:
7373
runAsNonRoot: true
74+
seccompProfile:
75+
type: RuntimeDefault
7476
serviceAccountName: {{ include "irsa-manager.fullname" . }}-controller-manager
7577
terminationGracePeriodSeconds: 10

‎config/crd/bases/irsa-manager.kkb0318.github.io_irsasetups.yaml

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@ spec:
1515
scope: Namespaced
1616
versions:
1717
- additionalPrinterColumns:
18-
- jsonPath: .status.selfHostedSetup[?(@.type=="Ready")].status
19-
name: SelfHostedReady
18+
- jsonPath: .status.conditions[?(@.type=="Ready")].status
19+
name: Ready
2020
type: string
2121
name: v1alpha1
2222
schema:
@@ -53,6 +53,7 @@ spec:
5353
description: |-
5454
Discovery configures the IdP Discovery process, essential for setting up IRSA by locating
5555
the OIDC provider information.
56+
Only applicable when Mode is "selfhosted".
5657
properties:
5758
s3:
5859
description: S3 specifies the AWS S3 bucket details where the
@@ -71,21 +72,32 @@ spec:
7172
- region
7273
type: object
7374
type: object
75+
iamOIDCProvider:
76+
description: |-
77+
IamOIDCProvider configures IAM OIDC IamOIDCProvider Name
78+
Only applicable when Mode is "eks".
79+
type: string
7480
mode:
7581
description: |-
76-
Mode (Optional, Future Feature) Defines how the controller will operate once this feature is enabled.
77-
Currently unused. Planned values:
82+
Mode specifies the operation mode of the controller.
83+
Possible values:
7884
- "selfhosted": For self-managed Kubernetes clusters.
7985
- "eks": For Amazon EKS environments.
86+
Default: "selfhosted"
87+
enum:
88+
- selfhosted
89+
- eks
8090
type: string
91+
x-kubernetes-validations:
92+
- message: Value is immutable
93+
rule: self == oldSelf
8194
required:
8295
- cleanup
83-
- discovery
8496
type: object
8597
status:
8698
description: IRSASetupStatus defines the observed state of IRSASetup
8799
properties:
88-
selfHostedSetup:
100+
conditions:
89101
items:
90102
description: "Condition contains details for one aspect of the current
91103
state of this API Resource.\n---\nThis struct is intended for

‎config/manager/kustomization.yaml

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,8 @@
11
resources:
2-
- manager.yaml
2+
- manager.yaml
3+
apiVersion: kustomize.config.k8s.io/v1beta1
4+
kind: Kustomization
5+
images:
6+
- name: controller
7+
newName: ghcr.io/kkb0318/irsa-manager
8+
newTag: latest

‎docs/api.md

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ _Appears in:_
3131
| `s3` _[S3Discovery](#s3discovery)_ | S3 specifies the AWS S3 bucket details where the OIDC provider's discovery information is hosted. | | |
3232

3333

34+
35+
3436
#### IRSA
3537

3638

@@ -102,8 +104,9 @@ _Appears in:_
102104
| Field | Description | Default | Validation |
103105
| --- | --- | --- | --- |
104106
| `cleanup` _boolean_ | Cleanup, when enabled, allows the IRSASetup to perform garbage collection<br />of resources that are no longer needed or managed. | | |
105-
| `mode` _string_ | Mode (Optional, Future Feature) Defines how the controller will operate once this feature is enabled.<br />Currently unused. Planned values:<br /> - "selfhosted": For self-managed Kubernetes clusters.<br /> - "eks": For Amazon EKS environments. | | |
106-
| `discovery` _[Discovery](#discovery)_ | Discovery configures the IdP Discovery process, essential for setting up IRSA by locating<br />the OIDC provider information. | | |
107+
| `mode` _[SetupMode](#setupmode)_ | Mode specifies the operation mode of the controller.<br />Possible values:<br /> - "selfhosted": For self-managed Kubernetes clusters.<br /> - "eks": For Amazon EKS environments.<br />Default: "selfhosted" | | Enum: [selfhosted eks] <br /> |
108+
| `discovery` _[Discovery](#discovery)_ | Discovery configures the IdP Discovery process, essential for setting up IRSA by locating<br />the OIDC provider information.<br />Only applicable when Mode is "selfhosted". | | |
109+
| `iamOIDCProvider` _string_ | IamOIDCProvider configures IAM OIDC IamOIDCProvider Name<br />Only applicable when Mode is "eks". | | |
107110

108111

109112

@@ -164,3 +167,17 @@ _Appears in:_
164167

165168

166169

170+
#### SetupMode
171+
172+
_Underlying type:_ _string_
173+
174+
175+
176+
_Validation:_
177+
- Enum: [selfhosted eks]
178+
179+
_Appears in:_
180+
- [IRSASetupSpec](#irsasetupspec)
181+
182+
183+

‎examples/eks.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: irsa-manager.kkb0318.github.io/v1alpha1
2+
kind: IRSASetup
3+
metadata:
4+
name: irsa-init
5+
namespace: irsa-manager-system
6+
spec:
7+
mode: eks
8+
cleanup: true
9+
iamOIDCProvider: "oidc.eks.<region>.amazonaws.com/id/<id>"

‎examples/irsa.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@ metadata:
66
spec:
77
cleanup: true
88
serviceAccount:
9-
name: irsa1-sa
9+
name: irsa111-sa
1010
namespaces:
1111
- kube-system
1212
- default
1313
iamRole:
14-
name: irsa1-role
14+
name: irsa111-role
1515
iamPolicies:
1616
- AmazonS3FullAccess

‎internal/controller/irsa_controller.go

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -51,13 +51,6 @@ type IRSAReconciler struct {
5151

5252
// Reconcile is part of the main kubernetes reconciliation loop which aims to
5353
// move the current state of the cluster closer to the desired state.
54-
// TODO(user): Modify the Reconcile function to compare the state specified by
55-
// the IRSA object against the actual cluster state, and then
56-
// perform operations to make the cluster state reflect the state specified by
57-
// the user.
58-
//
59-
// For more details, check Reconcile and its Result here:
60-
// - https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/reconcile
6154
func (r *IRSAReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
6255
log := ctrllog.FromContext(ctx)
6356
obj := &irsav1alpha1.IRSA{}
@@ -152,7 +145,7 @@ func (r *IRSAReconciler) reconcile(ctx context.Context, obj *irsav1alpha1.IRSA,
152145
return fmt.Errorf("error converting to IRSASetup for %s: %v", list.Items[0].GetName(), err)
153146
}
154147
serviceAccount := obj.Spec.ServiceAccount
155-
issuerMeta, err := issuer.NewS3IssuerMeta(&irsaSetup.Spec.Discovery.S3)
148+
issuerMeta, err := issuer.NewOIDCIssuerMeta(irsaSetup)
156149
if err != nil {
157150
return err
158151
}

0 commit comments

Comments
 (0)