Skip to content

Commit a51da54

Browse files
jeffw17jeffw17
committed
Add two flags for init to capture csr users and aws arn patterns to whitelist for auto approval
Signed-off-by: Jeffrey Wong <[email protected]>
1 parent 35690fc commit a51da54

11 files changed

+49
-164
lines changed

‎go.mod

+1-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ require (
2828
k8s.io/klog/v2 v2.130.1
2929
k8s.io/kubectl v0.31.1
3030
k8s.io/utils v0.0.0-20240921022957-49e7df575cb6
31-
open-cluster-management.io/api v0.15.1-0.20250226073118-8c9793267c9e
31+
open-cluster-management.io/api v0.15.1-0.20250219064651-4281b7684d9b
3232
open-cluster-management.io/cluster-proxy v0.4.0
3333
open-cluster-management.io/managed-serviceaccount v0.6.0
3434
open-cluster-management.io/ocm v0.15.1-0.20250228202623-6c270f90a09a

‎go.sum

-2
Original file line numberDiff line numberDiff line change
@@ -565,8 +565,6 @@ k8s.io/utils v0.0.0-20240921022957-49e7df575cb6 h1:MDF6h2H/h4tbzmtIKTuctcwZmY0tY
565565
k8s.io/utils v0.0.0-20240921022957-49e7df575cb6/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
566566
open-cluster-management.io/api v0.15.1-0.20250219064651-4281b7684d9b h1:1ScdOKBMLbzA/k84P9Z64uSq3sxRclquej3tT1zhsqU=
567567
open-cluster-management.io/api v0.15.1-0.20250219064651-4281b7684d9b/go.mod h1:9erZEWEn4bEqh0nIX2wA7f/s3KCuFycQdBrPrRzi0QM=
568-
open-cluster-management.io/api v0.15.1-0.20250226073118-8c9793267c9e h1:4iQneGfxartfFSR+IHZRrjEuwtRpiHyKQ15Kd33YCVk=
569-
open-cluster-management.io/api v0.15.1-0.20250226073118-8c9793267c9e/go.mod h1:9erZEWEn4bEqh0nIX2wA7f/s3KCuFycQdBrPrRzi0QM=
570568
open-cluster-management.io/cluster-proxy v0.4.0 h1:rm0UDaDWe3/P3xLzwqdHtqNksKwSzsic02MkrEe6BnM=
571569
open-cluster-management.io/cluster-proxy v0.4.0/go.mod h1:gTvfDHAhGezhdg4BD3ECBn6jbg2Y5PbHhV2ceW5nrB0=
572570
open-cluster-management.io/managed-serviceaccount v0.6.0 h1:qIi5T9WQJBuoGqnYGIktXbtqfQoiN2H9XU2P/6lAQiw=

‎pkg/cmd/init/cmd.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ var example = `
1616
%[1]s init
1717
1818
# Initialize the hub cluster with the type of authentication. Either or both of csr,awsirsa
19-
%[1]s init --registration-auth awsirsa --registration-auth csr --hubClusterArn arn:aws:eks:us-west-2:123456789012:cluster/hub-cluster1
19+
%[1]s init --registration-drivers="awsirsa,csr" --hubClusterArn arn:aws:eks:us-west-2:123456789012:cluster/hub-cluster1
2020
`
2121

2222
// NewCmd ...
@@ -81,7 +81,7 @@ func NewCmd(clusteradmFlags *genericclioptionsclusteradm.ClusteradmFlags, stream
8181
_ = clusterManagerSet.SetAnnotation("singleton-name", "singletonSet", []string{})
8282
o.Helm.AddFlags(singletonSet)
8383
cmd.Flags().AddFlagSet(singletonSet)
84-
cmd.Flags().StringSliceVar(&o.registrationAuth, "registration-auth", []string{},
84+
cmd.Flags().StringSliceVar(&o.registrationDrivers, "registration-drivers", []string{},
8585
"The type of authentication to use for registering and authenticating with hub. Only csr and awsirsa are accepted as valid inputs. This flag can be repeated to specify multiple authentication types.")
8686
cmd.Flags().StringVar(&o.hubClusterArn, "hub-cluster-arn", "",
8787
"The hubCluster ARN to be passed if awsirsa is one of the registrationAuths and the cluster name in EKS kubeconfig doesn't contain hubClusterArn")

‎pkg/cmd/init/exec.go

+10-10
Original file line numberDiff line numberDiff line change
@@ -153,18 +153,18 @@ func (o *Options) validate() error {
153153
}
154154

155155
validRegistrationDriver := sets.New[string]("csr", "awsirsa")
156-
for _, driver := range o.registrationAuth {
156+
for _, driver := range o.registrationDrivers {
157157
if !validRegistrationDriver.Has(driver) {
158158
return fmt.Errorf("only csr and awsirsa are valid drivers")
159159
}
160160
}
161161

162-
featureGates := o.clusterManagerChartConfig.ClusterManager.RegistrationConfiguration.FeatureGates
162+
featureGates := genericclioptionsclusteradm.ConvertToFeatureGateAPI(
163+
genericclioptionsclusteradm.HubMutableFeatureGate, ocmfeature.DefaultHubRegistrationFeatureGates)
163164
managedClusterAutoApprove := false
164-
165165
for _, feature := range featureGates {
166-
if feature.Feature == "featuregate/ManagedClusterAutoApproval" {
167-
if feature.Mode == "Enabled" {
166+
if feature.Feature == "ManagedClusterAutoApproval" {
167+
if feature.Mode == "Enable" {
168168
managedClusterAutoApprove = true
169169
}
170170
}
@@ -173,12 +173,12 @@ func (o *Options) validate() error {
173173
if managedClusterAutoApprove {
174174
// If hub registration does not accept awsirsa, we stop user if they also pass in a list of patterns for AWS EKS ARN.
175175

176-
if len(o.autoApprovedARNPatterns) > 0 && !sets.New[string](o.registrationAuth...).Has("awsirsa") {
176+
if len(o.autoApprovedARNPatterns) > 0 && !sets.New[string](o.registrationDrivers...).Has("awsirsa") {
177177
return fmt.Errorf("should not provide list of patterns for aws eks arn if not initializing hub with awsirsa registration")
178178
}
179179

180180
// If hub registration does not accept csr, we stop user if they also pass in a list of users for CSR auto approval.
181-
if len(o.autoApprovedCSRIdentities) > 0 && !sets.New[string](o.registrationAuth...).Has("csr") {
181+
if len(o.autoApprovedCSRIdentities) > 0 && !sets.New[string](o.registrationDrivers...).Has("csr") {
182182
return fmt.Errorf("should not provide list of users for csr to auto approve if not initializing hub with csr registration")
183183
}
184184
} else if len(o.autoApprovedARNPatterns) > 0 || len(o.autoApprovedCSRIdentities) > 0 {
@@ -399,15 +399,15 @@ func getRegistrationDrivers(o *Options) ([]operatorv1.RegistrationDriverHub, err
399399
registrationDrivers := []operatorv1.RegistrationDriverHub{}
400400
var registrationDriver operatorv1.RegistrationDriverHub
401401

402-
for _, driver := range o.registrationAuth {
402+
for _, driver := range o.registrationDrivers {
403403
if driver == "csr" {
404-
registrationDriver = operatorv1.RegistrationDriverHub{AuthType: driver, CSR: &operatorv1.CSRConfig{AutoApprovedIdentities: o.autoApprovedCSRIdentities}}
404+
registrationDriver = operatorv1.RegistrationDriverHub{AuthType: driver, AutoApprovedIdentities: o.autoApprovedCSRIdentities}
405405
} else if driver == "awsirsa" {
406406
hubClusterArn, err := getHubClusterArn(o)
407407
if err != nil {
408408
return registrationDrivers, err
409409
}
410-
registrationDriver = operatorv1.RegistrationDriverHub{AuthType: driver, AwsIrsa: &operatorv1.AwsIrsaConfig{HubClusterArn: hubClusterArn, AutoApprovedIdentities: o.autoApprovedARNPatterns}}
410+
registrationDriver = operatorv1.RegistrationDriverHub{AuthType: driver, AutoApprovedIdentities: o.autoApprovedARNPatterns, HubClusterArn: hubClusterArn}
411411
}
412412
registrationDrivers = append(registrationDrivers, registrationDriver)
413413
}

‎pkg/cmd/init/options.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ type Options struct {
5252
Streams genericiooptions.IOStreams
5353

5454
// The type of authentication to use for initializing the hub cluster
55-
registrationAuth []string
55+
registrationDrivers []string
5656
// The optional ARN to pass if awsirsa is one of the registrationAuths
5757
// and the cluster name in EKS kubeconfig doesn't contain hubClusterArn
5858
hubClusterArn string

‎test/e2e/clusteradm/init_test.go

+12-14
Original file line numberDiff line numberDiff line change
@@ -38,42 +38,40 @@ var _ = ginkgo.Describe("test clusteradm with bootstrap token in singleton mode"
3838
"--use-bootstrap-token",
3939
"--context", e2e.Cluster().Hub().Context(),
4040
"--bundle-version=latest",
41-
"--registration-auth=awsirsa",
41+
"--registration-drivers=awsirsa",
4242
"--hub-cluster-arn=arn:aws:eks:us-west-2:123456789012:cluster/hub-cluster1",
4343
)
4444
gomega.Expect(err).NotTo(gomega.HaveOccurred(), "clusteradm init error")
4545

4646
cm, err = operatorClient.OperatorV1().ClusterManagers().Get(context.TODO(), "cluster-manager", metav1.GetOptions{})
4747
gomega.Expect(err).NotTo(gomega.HaveOccurred())
48-
// Ensure that when only awsirsa is passed as registration-auth only awsirsa driver is available
48+
// Ensure that when only awsirsa is passed as registration-drivers only awsirsa driver is available
4949
gomega.Expect(len(cm.Spec.RegistrationConfiguration.RegistrationDrivers)).Should(gomega.Equal(1))
5050
gomega.Expect(cm.Spec.RegistrationConfiguration.RegistrationDrivers[0].AuthType).Should(gomega.Equal("awsirsa"))
5151

5252
err = e2e.Clusteradm().Init(
5353
"--use-bootstrap-token",
5454
"--context", e2e.Cluster().Hub().Context(),
5555
"--bundle-version=latest",
56-
"--registration-auth=awsirsa",
57-
"--registration-auth=csr",
56+
"--registration-drivers=awsirsa,csr",
5857
"--hub-cluster-arn=arn:aws:eks:us-west-2:123456789012:cluster/hub-cluster1",
5958
)
6059
gomega.Expect(err).NotTo(gomega.HaveOccurred(), "clusteradm init error")
6160

6261
cm, err = operatorClient.OperatorV1().ClusterManagers().Get(context.TODO(), "cluster-manager", metav1.GetOptions{})
6362
gomega.Expect(err).NotTo(gomega.HaveOccurred())
64-
// Ensure that awsirsa and csr is passed as registration-auth both the values are set.
63+
// Ensure that awsirsa and csr is passed as registration-drivers both the values are set.
6564
gomega.Expect(len(cm.Spec.RegistrationConfiguration.RegistrationDrivers)).Should(gomega.Equal(2))
66-
gomega.Expect(cm.Spec.RegistrationConfiguration.RegistrationDrivers[0].AuthType).Should(gomega.Equal("csr"))
67-
gomega.Expect(cm.Spec.RegistrationConfiguration.RegistrationDrivers[1].AuthType).Should(gomega.Equal("awsirsa"))
68-
gomega.Expect(cm.Spec.RegistrationConfiguration.RegistrationDrivers[1].HubClusterArn).
65+
gomega.Expect(cm.Spec.RegistrationConfiguration.RegistrationDrivers[0].AuthType).Should(gomega.Equal("awsirsa"))
66+
gomega.Expect(cm.Spec.RegistrationConfiguration.RegistrationDrivers[1].AuthType).Should(gomega.Equal("csr"))
67+
gomega.Expect(cm.Spec.RegistrationConfiguration.RegistrationDrivers[0].HubClusterArn).
6968
Should(gomega.Equal("arn:aws:eks:us-west-2:123456789012:cluster/hub-cluster1"))
7069

7170
err = e2e.Clusteradm().Init(
7271
"--use-bootstrap-token",
7372
"--context", e2e.Cluster().Hub().Context(),
7473
"--bundle-version=latest",
75-
"--registration-auth=awsirsa",
76-
"--registration-auth=csr",
74+
"--registration-drivers=awsirsa,csr",
7775
"--hub-cluster-arn=arn:aws:eks:us-west-2:123456789012:cluster/hub-cluster1",
7876
"--feature-gates=ManagedClusterAutoApproval=true",
7977
"--auto-approved-csr-identities=csr1",
@@ -83,10 +81,10 @@ var _ = ginkgo.Describe("test clusteradm with bootstrap token in singleton mode"
8381
cm, err = operatorClient.OperatorV1().ClusterManagers().Get(context.TODO(), "cluster-manager", metav1.GetOptions{})
8482
gomega.Expect(err).NotTo(gomega.HaveOccurred())
8583
// Ensure that the auto approval identities contain user for CSR and pattern for AWS
86-
gomega.Expect(cm.Spec.RegistrationConfiguration.RegistrationDrivers[0].AuthType).Should(gomega.Equal("csr"))
87-
gomega.Expect(cm.Spec.RegistrationConfiguration.RegistrationDrivers[1].AuthType).Should(gomega.Equal("awsirsa"))
88-
gomega.Expect(cm.Spec.RegistrationConfiguration.RegistrationDrivers[0].CSR.AutoApprovedIdentities).Should(gomega.Equal("csr1"))
89-
gomega.Expect(cm.Spec.RegistrationConfiguration.RegistrationDrivers[1].AwsIrsa.AutoApprovedIdentities).Should(gomega.Equal("arn:aws:eks:us-west-2:123456789012:cluster/*"))
84+
gomega.Expect(cm.Spec.RegistrationConfiguration.RegistrationDrivers[0].AuthType).Should(gomega.Equal("awsirsa"))
85+
gomega.Expect(cm.Spec.RegistrationConfiguration.RegistrationDrivers[1].AuthType).Should(gomega.Equal("csr"))
86+
gomega.Expect(cm.Spec.RegistrationConfiguration.RegistrationDrivers[1].AutoApprovedIdentities[0]).Should(gomega.Equal("csr1"))
87+
gomega.Expect(cm.Spec.RegistrationConfiguration.RegistrationDrivers[0].AutoApprovedIdentities[0]).Should(gomega.Equal("arn:aws:eks:us-west-2:123456789012:cluster/*"))
9088

9189
err = e2e.Clusteradm().Init(
9290
"--use-bootstrap-token",

‎vendor/modules.txt

+1-1
Original file line numberDiff line numberDiff line change
@@ -1245,7 +1245,7 @@ k8s.io/utils/pointer
12451245
k8s.io/utils/ptr
12461246
k8s.io/utils/strings/slices
12471247
k8s.io/utils/trace
1248-
# open-cluster-management.io/api v0.15.1-0.20250226073118-8c9793267c9e
1248+
# open-cluster-management.io/api v0.15.1-0.20250219064651-4281b7684d9b
12491249
## explicit; go 1.22.0
12501250
open-cluster-management.io/api/addon/v1alpha1
12511251
open-cluster-management.io/api/client/addon/clientset/versioned

‎vendor/open-cluster-management.io/api/operator/v1/0000_01_operator.open-cluster-management.io_clustermanagers.crd.yaml

+13-34
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/open-cluster-management.io/api/operator/v1/types_clustermanager.go

+2-22
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/open-cluster-management.io/api/operator/v1/zz_generated.deepcopy.go

+4-56
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)