Skip to content

Commit 371eb31

Browse files
chaosi-zjuchaosi-zju
committed
standardize the naming of karmada secrets in operator method
Signed-off-by: chaosi-zju <[email protected]>
1 parent b8edec1 commit 371eb31

File tree

21 files changed

+283
-286
lines changed

21 files changed

+283
-286
lines changed

‎operator/pkg/certs/certs.go‎

Lines changed: 11 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -90,8 +90,8 @@ func GetDefaultCertList() []*CertConfig {
9090
return []*CertConfig{
9191
// karmada cert config.
9292
KarmadaCertRootCA(),
93-
KarmadaCertAdmin(),
94-
KarmadaCertApiserver(),
93+
KarmadaCertServer(),
94+
KarmadaCertClient(),
9595
// front proxy cert config.
9696
KarmadaCertFrontProxyCA(),
9797
KarmadaCertFrontProxyClient(),
@@ -112,37 +112,23 @@ func KarmadaCertRootCA() *CertConfig {
112112
}
113113
}
114114

115-
// KarmadaCertAdmin returns karmada client cert config.
116-
func KarmadaCertAdmin() *CertConfig {
115+
// KarmadaCertServer returns karmada-server cert config.
116+
func KarmadaCertServer() *CertConfig {
117117
return &CertConfig{
118-
Name: constants.KarmadaCertAndKeyName,
118+
Name: constants.KarmadaServerCertAndKeyName,
119119
CAName: constants.CaCertAndKeyName,
120120
Config: certutil.Config{
121-
CommonName: "system:admin",
122-
Organization: []string{"system:masters"},
123-
Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
124-
},
125-
AltNamesMutatorFunc: makeAltNamesMutator(apiServerAltNamesMutator),
126-
}
127-
}
128-
129-
// KarmadaCertApiserver returns karmada apiserver cert config.
130-
func KarmadaCertApiserver() *CertConfig {
131-
return &CertConfig{
132-
Name: constants.ApiserverCertAndKeyName,
133-
CAName: constants.CaCertAndKeyName,
134-
Config: certutil.Config{
135-
CommonName: "karmada-apiserver",
121+
CommonName: "karmada-server",
136122
Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
137123
},
138124
AltNamesMutatorFunc: makeAltNamesMutator(apiServerAltNamesMutator),
139125
}
140126
}
141127

142-
// KarmadaCertClient returns karmada client cert config.
128+
// KarmadaCertClient returns karmada-client cert config.
143129
func KarmadaCertClient() *CertConfig {
144130
return &CertConfig{
145-
Name: "karmada-client",
131+
Name: constants.KarmadaClientCertAndKeyName,
146132
CAName: constants.CaCertAndKeyName,
147133
Config: certutil.Config{
148134
CommonName: "system:admin",
@@ -180,7 +166,7 @@ func KarmadaCertEtcdCA() *CertConfig {
180166
return &CertConfig{
181167
Name: constants.EtcdCaCertAndKeyName,
182168
Config: certutil.Config{
183-
CommonName: "karmada-etcd-ca",
169+
CommonName: "etcd-ca",
184170
},
185171
}
186172
}
@@ -191,7 +177,7 @@ func KarmadaCertEtcdServer() *CertConfig {
191177
Name: constants.EtcdServerCertAndKeyName,
192178
CAName: constants.EtcdCaCertAndKeyName,
193179
Config: certutil.Config{
194-
CommonName: "karmada-etcd-server",
180+
CommonName: "etcd-server",
195181
Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
196182
},
197183
AltNamesMutatorFunc: makeAltNamesMutator(etcdServerAltNamesMutator),
@@ -204,7 +190,7 @@ func KarmadaCertEtcdClient() *CertConfig {
204190
Name: constants.EtcdClientCertAndKeyName,
205191
CAName: constants.EtcdCaCertAndKeyName,
206192
Config: certutil.Config{
207-
CommonName: "karmada-etcd-client",
193+
CommonName: "etcd-client",
208194
Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
209195
},
210196
}

‎operator/pkg/constants/constants.go‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -88,14 +88,16 @@ const (
8888
EtcdServerCertAndKeyName = "etcd-server"
8989
// EtcdClientCertAndKeyName etcd client certificate key name
9090
EtcdClientCertAndKeyName = "etcd-client"
91-
// KarmadaCertAndKeyName karmada certificate key name
92-
KarmadaCertAndKeyName = "karmada"
93-
// ApiserverCertAndKeyName karmada apiserver certificate key name
94-
ApiserverCertAndKeyName = "apiserver"
91+
// KarmadaServerCertAndKeyName karmada apiserver certificate key name
92+
KarmadaServerCertAndKeyName = "karmada-server"
93+
// KarmadaClientCertAndKeyName karmada certificate key name
94+
KarmadaClientCertAndKeyName = "karmada-client"
9595
// FrontProxyCaCertAndKeyName front-proxy-client certificate key name
9696
FrontProxyCaCertAndKeyName = "front-proxy-ca"
9797
// FrontProxyClientCertAndKeyName front-proxy-client certificate key name
9898
FrontProxyClientCertAndKeyName = "front-proxy-client"
99+
// KarmadaKubeconfigSecretSubpath subPath name of the KarmadaKubeconfigSecret
100+
KarmadaKubeconfigSecretSubpath = "kubeconfig"
99101
// ClusterName karmada cluster name
100102
ClusterName = "karmada-apiserver"
101103
// UserName karmada cluster user name

‎operator/pkg/controller/karmada/planner.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -159,15 +159,15 @@ func (p *Planner) afterRunJob() error {
159159
return fmt.Errorf("error when creating cluster client to install karmada, err: %w", err)
160160
}
161161

162-
secret, err := remoteClient.CoreV1().Secrets(p.karmada.GetNamespace()).Get(context.TODO(), util.AdminKubeconfigSecretName(p.karmada.GetName()), metav1.GetOptions{})
162+
secret, err := remoteClient.CoreV1().Secrets(p.karmada.GetNamespace()).Get(context.TODO(), util.KarmadaKubeconfigSecretName, metav1.GetOptions{})
163163
if err != nil {
164164
return err
165165
}
166166

167167
_, err = localClusterClient.CoreV1().Secrets(p.karmada.GetNamespace()).Create(context.TODO(), &corev1.Secret{
168168
ObjectMeta: metav1.ObjectMeta{
169169
Namespace: p.karmada.GetNamespace(),
170-
Name: util.AdminKubeconfigSecretName(p.karmada.GetName()),
170+
Name: util.KarmadaKubeconfigSecretName,
171171
},
172172
Data: secret.Data,
173173
}, metav1.CreateOptions{})
@@ -178,7 +178,7 @@ func (p *Planner) afterRunJob() error {
178178

179179
p.karmada.Status.SecretRef = &operatorv1alpha1.LocalSecretReference{
180180
Namespace: p.karmada.GetNamespace(),
181-
Name: util.AdminKubeconfigSecretName(p.karmada.GetName()),
181+
Name: util.KarmadaKubeconfigSecretName,
182182
}
183183
return p.Client.Status().Update(context.TODO(), p.karmada)
184184
}

‎operator/pkg/controlplane/apiserver/apiserver.go‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -53,20 +53,20 @@ func EnsureKarmadaAggregatedAPIServer(client clientset.Interface, cfg *operatorv
5353
func installKarmadaAPIServer(client clientset.Interface, cfg *operatorv1alpha1.KarmadaAPIServer, name, namespace string, _ map[string]bool) error {
5454
apiserverDeploymentBytes, err := util.ParseTemplate(KarmadaApiserverDeployment, struct {
5555
DeploymentName, Namespace, Image, ImagePullPolicy, EtcdClientService string
56-
ServiceSubnet, KarmadaCertsSecret, EtcdCertsSecret string
56+
ServiceSubnet, KarmadaCertsSecret, KarmadaEtcdCertSecret string
5757
Replicas *int32
5858
EtcdListenClientPort int32
5959
}{
60-
DeploymentName: util.KarmadaAPIServerName(name),
61-
Namespace: namespace,
62-
Image: cfg.Image.Name(),
63-
ImagePullPolicy: string(cfg.ImagePullPolicy),
64-
EtcdClientService: util.KarmadaEtcdClientName(name),
65-
ServiceSubnet: *cfg.ServiceSubnet,
66-
KarmadaCertsSecret: util.KarmadaCertSecretName(name),
67-
EtcdCertsSecret: util.EtcdCertSecretName(name),
68-
Replicas: cfg.Replicas,
69-
EtcdListenClientPort: constants.EtcdListenClientPort,
60+
DeploymentName: util.KarmadaAPIServerName(name),
61+
Namespace: namespace,
62+
Image: cfg.Image.Name(),
63+
ImagePullPolicy: string(cfg.ImagePullPolicy),
64+
EtcdClientService: util.KarmadaEtcdClientName(name),
65+
ServiceSubnet: *cfg.ServiceSubnet,
66+
KarmadaCertsSecret: util.KarmadaCertsSecretName,
67+
KarmadaEtcdCertSecret: util.KarmadaEtcdCertSecretName,
68+
Replicas: cfg.Replicas,
69+
EtcdListenClientPort: constants.EtcdListenClientPort,
7070
})
7171
if err != nil {
7272
return fmt.Errorf("error when parsing karmadaApiserver deployment template: %w", err)
@@ -115,20 +115,20 @@ func createKarmadaAPIServerService(client clientset.Interface, cfg *operatorv1al
115115
func installKarmadaAggregatedAPIServer(client clientset.Interface, cfg *operatorv1alpha1.KarmadaAggregatedAPIServer, name, namespace string, featureGates map[string]bool) error {
116116
aggregatedAPIServerDeploymentBytes, err := util.ParseTemplate(KarmadaAggregatedAPIServerDeployment, struct {
117117
DeploymentName, Namespace, Image, ImagePullPolicy, EtcdClientService string
118-
KubeconfigSecret, KarmadaCertsSecret, EtcdCertsSecret string
118+
KarmadaCertsSecret, KarmadaEtcdCertSecret, KarmadaKubeconfigSecret string
119119
Replicas *int32
120120
EtcdListenClientPort int32
121121
}{
122-
DeploymentName: util.KarmadaAggregatedAPIServerName(name),
123-
Namespace: namespace,
124-
Image: cfg.Image.Name(),
125-
ImagePullPolicy: string(cfg.ImagePullPolicy),
126-
EtcdClientService: util.KarmadaEtcdClientName(name),
127-
KubeconfigSecret: util.AdminKubeconfigSecretName(name),
128-
KarmadaCertsSecret: util.KarmadaCertSecretName(name),
129-
EtcdCertsSecret: util.EtcdCertSecretName(name),
130-
Replicas: cfg.Replicas,
131-
EtcdListenClientPort: constants.EtcdListenClientPort,
122+
DeploymentName: util.KarmadaAggregatedAPIServerName(name),
123+
Namespace: namespace,
124+
Image: cfg.Image.Name(),
125+
ImagePullPolicy: string(cfg.ImagePullPolicy),
126+
EtcdClientService: util.KarmadaEtcdClientName(name),
127+
KarmadaCertsSecret: util.KarmadaCertsSecretName,
128+
KarmadaEtcdCertSecret: util.KarmadaEtcdCertSecretName,
129+
KarmadaKubeconfigSecret: util.KarmadaKubeconfigSecretName,
130+
Replicas: cfg.Replicas,
131+
EtcdListenClientPort: constants.EtcdListenClientPort,
132132
})
133133
if err != nil {
134134
return fmt.Errorf("error when parsing karmadaAggregatedAPIServer deployment template: %w", err)

‎operator/pkg/controlplane/apiserver/mainfests.go‎

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,8 @@ spec:
5757
- --bind-address=0.0.0.0
5858
- --secure-port=5443
5959
- --service-account-issuer=https://kubernetes.default.svc.cluster.local
60-
- --service-account-key-file=/etc/karmada/pki/karmada.key
61-
- --service-account-signing-key-file=/etc/karmada/pki/karmada.key
60+
- --service-account-key-file=/etc/karmada/pki/karmada-client.key
61+
- --service-account-signing-key-file=/etc/karmada/pki/karmada-client.key
6262
- --service-cluster-ip-range={{ .ServiceSubnet }}
6363
- --proxy-client-cert-file=/etc/karmada/pki/front-proxy-client.crt
6464
- --proxy-client-key-file=/etc/karmada/pki/front-proxy-client.key
@@ -67,8 +67,8 @@ spec:
6767
- --requestheader-extra-headers-prefix=X-Remote-Extra-
6868
- --requestheader-group-headers=X-Remote-Group
6969
- --requestheader-username-headers=X-Remote-User
70-
- --tls-cert-file=/etc/karmada/pki/apiserver.crt
71-
- --tls-private-key-file=/etc/karmada/pki/apiserver.key
70+
- --tls-cert-file=/etc/karmada/pki/karmada-server.crt
71+
- --tls-private-key-file=/etc/karmada/pki/karmada-server.key
7272
- --tls-min-version=VersionTLS13
7373
- --max-requests-inflight=1500
7474
- --max-mutating-requests-inflight=500
@@ -110,19 +110,19 @@ spec:
110110
protocol: TCP
111111
volumeMounts:
112112
- mountPath: /etc/karmada/pki
113-
name: apiserver-cert
113+
name: karmada-certs
114114
readOnly: true
115115
- mountPath: /etc/etcd/pki
116-
name: etcd-cert
116+
name: karmada-etcd-cert
117117
readOnly: true
118118
priorityClassName: system-node-critical
119119
volumes:
120-
- name: apiserver-cert
120+
- name: karmada-certs
121121
secret:
122122
secretName: {{ .KarmadaCertsSecret }}
123-
- name: etcd-cert
123+
- name: karmada-etcd-cert
124124
secret:
125-
secretName: {{ .EtcdCertsSecret }}
125+
secretName: {{ .KarmadaEtcdCertSecret }}
126126
`
127127

128128
// KarmadaApiserverService is karmada apiserver service manifest
@@ -173,39 +173,39 @@ spec:
173173
imagePullPolicy: {{ .ImagePullPolicy }}
174174
command:
175175
- /bin/karmada-aggregated-apiserver
176-
- --kubeconfig=/etc/karmada/kubeconfig
177-
- --authentication-kubeconfig=/etc/karmada/kubeconfig
178-
- --authorization-kubeconfig=/etc/karmada/kubeconfig
176+
- --kubeconfig=/etc/kubeconfig
177+
- --authentication-kubeconfig=/etc/kubeconfig
178+
- --authorization-kubeconfig=/etc/kubeconfig
179179
- --etcd-cafile=/etc/etcd/pki/etcd-ca.crt
180180
- --etcd-certfile=/etc/etcd/pki/etcd-client.crt
181181
- --etcd-keyfile=/etc/etcd/pki/etcd-client.key
182182
- --etcd-servers=https://{{ .EtcdClientService }}.{{ .Namespace }}.svc.cluster.local:{{ .EtcdListenClientPort }}
183-
- --tls-cert-file=/etc/karmada/pki/karmada.crt
184-
- --tls-private-key-file=/etc/karmada/pki/karmada.key
183+
- --tls-cert-file=/etc/karmada/pki/karmada-server.crt
184+
- --tls-private-key-file=/etc/karmada/pki/karmada-server.key
185185
- --tls-min-version=VersionTLS13
186186
- --audit-log-path=-
187187
- --audit-log-maxage=0
188188
- --audit-log-maxbackup=0
189189
volumeMounts:
190-
- mountPath: /etc/karmada/kubeconfig
191-
name: kubeconfig
190+
- mountPath: /etc/kubeconfig
191+
name: karmada-kubeconfig
192192
subPath: kubeconfig
193193
- mountPath: /etc/etcd/pki
194-
name: etcd-cert
194+
name: karmada-etcd-cert
195195
readOnly: true
196196
- mountPath: /etc/karmada/pki
197-
name: apiserver-cert
197+
name: karmada-certs
198198
readOnly: true
199199
volumes:
200-
- name: kubeconfig
200+
- name: karmada-kubeconfig
201201
secret:
202-
secretName: {{ .KubeconfigSecret }}
203-
- name: apiserver-cert
202+
secretName: {{ .KarmadaKubeconfigSecret }}
203+
- name: karmada-certs
204204
secret:
205205
secretName: {{ .KarmadaCertsSecret }}
206-
- name: etcd-cert
206+
- name: karmada-etcd-cert
207207
secret:
208-
secretName: {{ .EtcdCertsSecret }}
208+
secretName: {{ .KarmadaEtcdCertSecret }}
209209
`
210210
// KarmadaAggregatedAPIServerService is karmada aggregated APIServer Service manifest
211211
KarmadaAggregatedAPIServerService = `

0 commit comments

Comments
 (0)