Skip to content

Commit 5f48cf0

Browse files
jan-dijan-di
committed
Migrate provider command and package meta
Signed-off-by: Jan Dittrich <jan.dittrich@cgm.com>
1 parent 6ac4208 commit 5f48cf0

File tree

2 files changed

+98
-43
lines changed

2 files changed

+98
-43
lines changed

‎cmd/provider/main.go‎

Lines changed: 94 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -13,30 +13,39 @@ import (
1313
xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
1414
"github.com/crossplane/crossplane-runtime/v2/pkg/certificates"
1515
xpcontroller "github.com/crossplane/crossplane-runtime/v2/pkg/controller"
16+
"github.com/crossplane/crossplane-runtime/v2/pkg/errors"
1617
"github.com/crossplane/crossplane-runtime/v2/pkg/feature"
1718
"github.com/crossplane/crossplane-runtime/v2/pkg/logging"
1819
"github.com/crossplane/crossplane-runtime/v2/pkg/ratelimiter"
1920
"github.com/crossplane/crossplane-runtime/v2/pkg/reconciler/managed"
21+
"github.com/crossplane/crossplane-runtime/v2/pkg/gate"
2022
"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
23+
"github.com/crossplane/crossplane-runtime/v2/pkg/reconciler/customresourcesgate"
2124
"github.com/crossplane/crossplane-runtime/v2/pkg/statemetrics"
2225
tjcontroller "github.com/crossplane/upjet/v2/pkg/controller"
2326
"github.com/crossplane/upjet/v2/pkg/controller/conversion"
2427
kerrors "k8s.io/apimachinery/pkg/api/errors"
2528
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
29+
"k8s.io/apimachinery/pkg/runtime/schema"
2630
"k8s.io/client-go/tools/leaderelection/resourcelock"
2731
ctrl "sigs.k8s.io/controller-runtime"
2832
"sigs.k8s.io/controller-runtime/pkg/cache"
2933
"sigs.k8s.io/controller-runtime/pkg/log/zap"
3034
"sigs.k8s.io/controller-runtime/pkg/metrics"
35+
"sigs.k8s.io/controller-runtime/pkg/manager"
3136
"sigs.k8s.io/controller-runtime/pkg/webhook"
37+
authv1 "k8s.io/api/authorization/v1"
38+
apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
3239

33-
"github.com/crossplane-contrib/provider-openstack/apis"
34-
"github.com/crossplane-contrib/provider-openstack/apis/v1alpha1"
40+
apisCluster "github.com/crossplane-contrib/provider-openstack/apis/cluster"
41+
apisNamespaced "github.com/crossplane-contrib/provider-openstack/apis/namespaced"
3542
"github.com/crossplane-contrib/provider-openstack/config"
36-
resolverapis "github.com/crossplane-contrib/provider-openstack/internal/apis"
3743
"github.com/crossplane-contrib/provider-openstack/internal/clients"
38-
"github.com/crossplane-contrib/provider-openstack/internal/controller"
44+
resolverapis "github.com/crossplane-contrib/provider-openstack/internal/apis"
45+
controllerCluster "github.com/crossplane-contrib/provider-openstack/internal/controller/cluster"
46+
controllerNamespaced "github.com/crossplane-contrib/provider-openstack/internal/controller/namespaced"
3947
"github.com/crossplane-contrib/provider-openstack/internal/features"
48+
"github.com/crossplane-contrib/provider-openstack/internal/version"
4049
)
4150

4251
const (
@@ -69,9 +78,6 @@ func main() {
6978
_ = app.Flag("terraform-provider-source", "[DEPRECATED: This option is no longer used and it will be removed in a future release.] Terraform provider source.").Envar("TERRAFORM_PROVIDER_SOURCE").Hidden().Action(deprecationAction("terraform-provider-source")).String()
7079
_ = app.Flag("provider-ttl", "[DEPRECATED: This option is no longer used and it will be removed in a future release.] TTL for the native plugin processes before they are replaced. Changing the default may increase memory consumption.").Default("100").Hidden().Action(deprecationAction("provider-ttl")).Int()
7180

72-
namespace = app.Flag("namespace", "Namespace used to set as default scope in default secret store config.").Default("crossplane-system").Envar("POD_NAMESPACE").String()
73-
enableExternalSecretStores = app.Flag("enable-external-secret-stores", "Enable support for ExternalSecretStores.").Default("false").Envar("ENABLE_EXTERNAL_SECRET_STORES").Bool()
74-
essTLSCertsPath = app.Flag("ess-tls-cert-dir", "Path of ESS TLS certificates.").Envar("ESS_TLS_CERTS_DIR").String()
7581
enableManagementPolicies = app.Flag("enable-management-policies", "Enable support for Management Policies.").Default("true").Envar("ENABLE_MANAGEMENT_POLICIES").Bool()
7682

7783
certsDirSet = false
@@ -141,8 +147,13 @@ func main() {
141147
RenewDeadline: func() *time.Duration { d := 50 * time.Second; return &d }(),
142148
})
143149
kingpin.FatalIfError(err, "Cannot create controller manager")
144-
kingpin.FatalIfError(apis.AddToScheme(mgr.GetScheme()), "Cannot add OpenStack APIs to scheme")
145-
kingpin.FatalIfError(resolverapis.BuildScheme(apis.AddToSchemes), "Cannot register the OpenStack APIs with the API resolver's runtime scheme")
150+
kingpin.FatalIfError(apisCluster.AddToScheme(mgr.GetScheme()), "Cannot add cluster-scoped OpenStack APIs to scheme")
151+
kingpin.FatalIfError(apisNamespaced.AddToScheme(mgr.GetScheme()), "Cannot add namespace-scoped OpenStack APIs to scheme")
152+
kingpin.FatalIfError(apiextensionsv1.AddToScheme(mgr.GetScheme()), "Cannot add api-extensions APIs to scheme")
153+
kingpin.FatalIfError(authv1.AddToScheme(mgr.GetScheme()), "Cannot add k8s authorization APIs to scheme")
154+
155+
kingpin.FatalIfError(resolverapis.BuildScheme(apisCluster.AddToSchemes), "Cannot register the cluster-scoped OpenStack APIs with the API resolver's runtime scheme")
156+
kingpin.FatalIfError(resolverapis.BuildScheme(apisNamespaced.AddToSchemes), "Cannot register the namespace-scoped OpenStack APIs with the API resolver's runtime scheme")
146157

147158
metricRecorder := managed.NewMRMetricRecorder()
148159
stateMetrics := statemetrics.NewMRStateMetrics()
@@ -151,9 +162,13 @@ func main() {
151162
metrics.Registry.MustRegister(stateMetrics)
152163

153164
ctx := context.Background()
154-
provider, err := config.GetProvider(ctx, false)
155-
kingpin.FatalIfError(err, "Cannot initialize the provider configuration")
156-
o := tjcontroller.Options{
165+
166+
providerCluster, err := config.GetProvider(ctx, false)
167+
kingpin.FatalIfError(err, "Cannot initialize the cluster-scoped provider configuration")
168+
providerNamespaced, err := config.GetProviderNamespaced(ctx, true)
169+
kingpin.FatalIfError(err, "Cannot initialize the namespace-scoped provider configuration")
170+
171+
optionsCluster := tjcontroller.Options{
157172
Options: xpcontroller.Options{
158173
Logger: logr,
159174
GlobalRateLimiter: ratelimiter.NewGlobal(*maxReconcileRate),
@@ -166,47 +181,84 @@ func main() {
166181
MRStateMetrics: stateMetrics,
167182
},
168183
},
169-
Provider: provider,
170-
SetupFn: clients.TerraformSetupBuilder(provider.TerraformProvider),
184+
Provider: providerCluster,
185+
SetupFn: clients.TerraformSetupBuilder(providerCluster.TerraformProvider),
171186
PollJitter: pollJitter,
172187
OperationTrackerStore: tjcontroller.NewOperationStore(logr),
173188
StartWebhooks: *certsDir != "",
174189
}
175190

191+
optionsNamespaced := tjcontroller.Options{
192+
Options: xpcontroller.Options{
193+
Logger: logr,
194+
GlobalRateLimiter: ratelimiter.NewGlobal(*maxReconcileRate),
195+
PollInterval: *pollInterval,
196+
MaxConcurrentReconciles: *maxReconcileRate,
197+
Features: &feature.Flags{},
198+
MetricOptions: &xpcontroller.MetricOptions{
199+
PollStateMetricInterval: *pollStateMetricInterval,
200+
MRMetrics: metricRecorder,
201+
MRStateMetrics: stateMetrics,
202+
},
203+
},
204+
Provider: providerNamespaced,
205+
SetupFn: clients.TerraformSetupBuilder(providerNamespaced.TerraformProvider),
206+
PollJitter: pollJitter,
207+
OperationTrackerStore: tjcontroller.NewOperationStore(logr),
208+
StartWebhooks: *certsDir != "",
209+
}
210+
211+
176212
if *enableManagementPolicies {
177-
o.Features.Enable(features.EnableBetaManagementPolicies)
213+
optionsCluster.Features.Enable(features.EnableBetaManagementPolicies)
214+
optionsNamespaced.Features.Enable(features.EnableBetaManagementPolicies)
178215
logr.Info("Beta feature enabled", "flag", features.EnableBetaManagementPolicies)
179216
}
180217

181-
if *enableExternalSecretStores {
182-
o.SecretStoreConfigGVK = &v1alpha1.StoreConfigGroupVersionKind
183-
logr.Info("Alpha feature enabled", "flag", features.EnableAlphaExternalSecretStores)
184-
185-
o.ESSOptions = &tjcontroller.ESSOptions{}
186-
if *essTLSCertsPath != "" {
187-
logr.Info("ESS TLS certificates path is set. Loading mTLS configuration.")
188-
tCfg, err := certificates.LoadMTLSConfig(filepath.Join(*essTLSCertsPath, "ca.crt"), filepath.Join(*essTLSCertsPath, "tls.crt"), filepath.Join(*essTLSCertsPath, "tls.key"), false)
189-
kingpin.FatalIfError(err, "Cannot load ESS TLS config.")
218+
canSafeStart, err := canWatchCRD(context.TODO(), mgr)
219+
kingpin.FatalIfError(err, "SafeStart precheck failed")
220+
if canSafeStart {
221+
crdGate := new(gate.Gate[schema.GroupVersionKind])
222+
optionsCluster.Gate = crdGate
223+
optionsNamespaced.Gate = crdGate
224+
kingpin.FatalIfError(customresourcesgate.Setup(mgr, xpcontroller.Options{
225+
Logger: logr,
226+
Gate: crdGate,
227+
MaxConcurrentReconciles: 1,
228+
}), "Cannot setup CRD gate")
229+
kingpin.FatalIfError(controllerCluster.SetupGated(mgr, optionsCluster), "Cannot setup cluster-scoped Template controllers")
230+
kingpin.FatalIfError(controllerNamespaced.SetupGated(mgr, optionsNamespaced), "Cannot setup namespace-scoped Template controllers")
231+
} else {
232+
logr.Info("Provider has missing RBAC permissions for watching CRDs, controller SafeStart capability will be disabled")
233+
kingpin.FatalIfError(conversion.RegisterConversions(optionsCluster.Provider, mgr.GetScheme()), "Cannot initialize the webhook conversion registry")
234+
kingpin.FatalIfError(controllerCluster.Setup(mgr, optionsCluster), "Cannot setup cluster-scoped OpenStack controllers")
235+
kingpin.FatalIfError(controllerNamespaced.Setup(mgr, optionsNamespaced), "Cannot setup namespace-scoped OpenStack controllers")
236+
kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
237+
}
190238

191-
o.ESSOptions.TLSConfig = tCfg
192-
}
239+
}
193240

194-
// Ensure default store config exists.
195-
kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(ctx, &v1alpha1.StoreConfig{
196-
ObjectMeta: metav1.ObjectMeta{
197-
Name: "default",
198-
},
199-
Spec: v1alpha1.StoreConfigSpec{
200-
// NOTE(turkenh): We only set required spec and expect optional
201-
// ones to properly be initialized with CRD level default values.
202-
SecretStoreConfig: xpv1.SecretStoreConfig{
203-
DefaultScope: *namespace,
241+
func canWatchCRD(ctx context.Context, mgr manager.Manager) (bool, error) {
242+
if err := authv1.AddToScheme(mgr.GetScheme()); err != nil {
243+
return false, err
244+
}
245+
verbs := []string{"get", "list", "watch"}
246+
for _, verb := range verbs {
247+
sar := &authv1.SelfSubjectAccessReview{
248+
Spec: authv1.SelfSubjectAccessReviewSpec{
249+
ResourceAttributes: &authv1.ResourceAttributes{
250+
Group: "apiextensions.k8s.io",
251+
Resource: "customresourcedefinitions",
252+
Verb: verb,
204253
},
205254
},
206-
})), "cannot create default store config")
255+
}
256+
if err := mgr.GetClient().Create(ctx, sar); err != nil {
257+
return false, errors.Wrapf(err, "unable to perform RBAC check for verb %s on CustomResourceDefinitions", verbs)
258+
}
259+
if !sar.Status.Allowed {
260+
return false, nil
261+
}
207262
}
208-
209-
kingpin.FatalIfError(conversion.RegisterConversions(o.Provider, mgr.GetScheme()), "Cannot initialize the webhook conversion registry")
210-
kingpin.FatalIfError(controller.Setup(mgr, o), "Cannot setup Azuread controllers")
211-
kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
212-
}
263+
return true, nil
264+
}

‎package/crossplane.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,7 @@ metadata:
1111
Provider OpenStack is a Crossplane provider for
1212
[OpenStack](https://openstack.org/).
1313
If you encounter an issue please reach out via GitHub issues!
14-
friendly-name.meta.crossplane.io: Provider OpenStack
14+
friendly-name.meta.crossplane.io: Provider OpenStack
15+
spec:
16+
capabilities:
17+
- SafeStart

0 commit comments

Comments
 (0)