Skip to content

Commit 042a012

Browse files
alexander-demicevalexander-demicev
committed
Add in-place updates test extension
Signed-off-by: Alex Demicev <alex.demicev@lambdal.com>
1 parent 0ac94e1 commit 042a012

18 files changed

Lines changed: 1226 additions & 2 deletions

‎Makefile‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -126,8 +126,10 @@ ORG ?= rancher
126126
CONTROLLER_IMAGE_NAME := cluster-api-provider-rke2
127127
BOOTSTRAP_IMAGE_NAME := $(CONTROLLER_IMAGE_NAME)-bootstrap
128128
CONTROLPLANE_IMAGE_NAME = $(CONTROLLER_IMAGE_NAME)-controlplane
129+
TEST_EXTENSION_IMAGE_NAME := $(CONTROLLER_IMAGE_NAME)-test-extension
129130
BOOTSTRAP_IMG ?= $(REGISTRY)/$(ORG)/$(BOOTSTRAP_IMAGE_NAME)
130131
CONTROLPLANE_IMG ?= $(REGISTRY)/$(ORG)/$(CONTROLPLANE_IMAGE_NAME)
132+
TEST_EXTENSION_IMG ?= $(REGISTRY)/$(ORG)/$(TEST_EXTENSION_IMAGE_NAME)
131133
IID_FILE ?= $(shell mktemp)
132134
LOCAL_IMAGES = $(shell pwd)/out/images
133135

@@ -351,6 +353,18 @@ docker-build-rke2-control-plane:
351353
$(MAKE) set-manifest-image MANIFEST_IMG=$(CONTROLPLANE_IMG) MANIFEST_TAG=$(TAG) TARGET_RESOURCE="./controlplane/config/default/manager_image_patch.yaml"
352354
$(MAKE) set-manifest-pull-policy TARGET_RESOURCE="./controlplane/config/default/manager_pull_policy.yaml"
353355

356+
.PHONY: docker-build-test-extension
357+
docker-build-test-extension: buildx-machine docker-pull-prerequisites ## Build the e2e test Runtime Extension image
358+
DOCKER_BUILDKIT=1 BUILDX_BUILDER=$(MACHINE) docker buildx build \
359+
--platform $(ARCH) \
360+
--load \
361+
--build-arg builder_image=$(GO_CONTAINER_IMAGE) \
362+
--build-arg goproxy=$(GOPROXY) \
363+
--build-arg package=./test/extension \
364+
--build-arg ldflags="$(LDFLAGS)" . -t $(TEST_EXTENSION_IMG):$(TAG)
365+
$(MAKE) set-manifest-image MANIFEST_IMG=$(TEST_EXTENSION_IMG) MANIFEST_TAG=$(TAG) TARGET_RESOURCE="./test/extension/config/default/manager_image_patch.yaml"
366+
$(MAKE) set-manifest-pull-policy TARGET_RESOURCE="./test/extension/config/default/manager_pull_policy.yaml"
367+
354368
## --------------------------------------
355369
## Testing
356370
## --------------------------------------
@@ -427,16 +441,17 @@ test-e2e: ## Run the end-to-end tests
427441
# https://www.suse.com/support/kb/doc/?id=000020048
428442
.PHONY: inotify-check
429443
inotify-check:
430-
@if [ `cat /proc/sys/fs/inotify/max_user_instances` -le 256 ]; then \
444+
@if [ -r /proc/sys/fs/inotify/max_user_instances ] && [ `cat /proc/sys/fs/inotify/max_user_instances` -le 256 ]; then \
431445
echo -e "\033[0;31mfs.inotify.max_user_instances is too low, test may fail (sudo sysctl fs.inotify.max_user_instances=8192)\033[0m";\
432446
fi
433-
@if [ `cat /proc/sys/fs/inotify/max_user_watches` -le 8192 ]; then \
447+
@if [ -r /proc/sys/fs/inotify/max_user_watches ] && [ `cat /proc/sys/fs/inotify/max_user_watches` -le 8192 ]; then \
434448
echo -e "\033[0;31mfs.inotify.max_user_watches is too low, tests may fail (sudo sysctl fs.inotify.max_user_watches=1048576)\033[0m"; \
435449
fi
436450

437451
.PHONY: e2e-image
438452
e2e-image:
439453
TAG=$(TAG) $(MAKE) docker-build
454+
TAG=$(TAG) $(MAKE) docker-build-test-extension
440455

441456
.PHONY: compile-e2e
442457
compile-e2e: ## Test e2e compilation

‎test/extension/config/certmanager/certificate.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Self-signed Issuer + Certificate used by cert-manager to provision the TLS
2+
# material the test extension serves its Runtime SDK webhook on.
3+
apiVersion: cert-manager.io/v1
4+
kind: Issuer
5+
metadata:
6+
name: selfsigned-issuer
7+
namespace: system
8+
spec:
9+
selfSigned: {}
10+
---
11+
apiVersion: cert-manager.io/v1
12+
kind: Certificate
13+
metadata:
14+
# This name is referenced from kustomizeconfig.yaml.
15+
name: serving-cert
16+
namespace: system
17+
spec:
18+
# SERVICE_NAME and SERVICE_NAMESPACE are substituted by kustomize replacements
19+
# defined in config/default/kustomization.yaml.
20+
dnsNames:
21+
- SERVICE_NAME.SERVICE_NAMESPACE.svc
22+
- SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local
23+
issuerRef:
24+
kind: Issuer
25+
name: selfsigned-issuer
26+
# The secret name is NOT prefixed by kustomize so the manager_webhook_patch
27+
# can reference it directly.
28+
secretName: rke2-test-extension-webhook-service-cert
29+
subject:
30+
organizations:
31+
- Rancher by SUSE

‎test/extension/config/certmanager/kustomization.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
resources:
2+
- certificate.yaml
3+
4+
configurations:
5+
- kustomizeconfig.yaml

‎test/extension/config/certmanager/kustomizeconfig.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Teaches kustomize how to update Certificate.spec.issuerRef.name when the
2+
# Issuer name gets a kustomize prefix.
3+
nameReference:
4+
- kind: Issuer
5+
group: cert-manager.io
6+
fieldSpecs:
7+
- kind: Certificate
8+
group: cert-manager.io
9+
path: spec/issuerRef/name

‎test/extension/config/default/kustomization.yaml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# All resources are kustomize-namespaced under rke2-test-extension-system and
2+
# kustomize-prefixed with rke2-test-extension-. The webhook serving Secret name
3+
# is intentionally NOT prefixed (see manager_webhook_patch.yaml) so the
4+
# Deployment's volume reference stays stable.
5+
namespace: rke2-test-extension-system
6+
7+
namePrefix: rke2-test-extension-
8+
9+
labels:
10+
- includeSelectors: true
11+
pairs:
12+
cluster.x-k8s.io/provider: runtime-extension-rke2-test
13+
14+
resources:
15+
- namespace.yaml
16+
- manager.yaml
17+
- service.yaml
18+
- ../rbac
19+
- ../certmanager
20+
21+
patches:
22+
- path: manager_image_patch.yaml
23+
- path: manager_pull_policy.yaml
24+
- path: manager_webhook_patch.yaml
25+
26+
# Inject the Service name/namespace into the Certificate's dnsNames so cert-manager
27+
# generates a cert valid for the webhook Service FQDN.
28+
replacements:
29+
- source:
30+
kind: Service
31+
name: webhook-service
32+
version: v1
33+
fieldPath: .metadata.name
34+
targets:
35+
- select:
36+
group: cert-manager.io
37+
kind: Certificate
38+
version: v1
39+
fieldPaths:
40+
- .spec.dnsNames.0
41+
- .spec.dnsNames.1
42+
options:
43+
create: true
44+
delimiter: .
45+
- source:
46+
kind: Service
47+
name: webhook-service
48+
version: v1
49+
fieldPath: .metadata.namespace
50+
targets:
51+
- select:
52+
group: cert-manager.io
53+
kind: Certificate
54+
version: v1
55+
fieldPaths:
56+
- .spec.dnsNames.0
57+
- .spec.dnsNames.1
58+
options:
59+
create: true
60+
delimiter: .
61+
index: 1

‎test/extension/config/default/manager.yaml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: controller-manager
5+
namespace: system
6+
labels:
7+
control-plane: controller-manager
8+
spec:
9+
selector:
10+
matchLabels:
11+
control-plane: controller-manager
12+
replicas: 1
13+
template:
14+
metadata:
15+
annotations:
16+
kubectl.kubernetes.io/default-container: manager
17+
labels:
18+
control-plane: controller-manager
19+
spec:
20+
containers:
21+
- command:
22+
- /manager
23+
args:
24+
- "--leader-elect"
25+
- "--diagnostics-address=${CAPRKE2_TEST_EXTENSION_DIAGNOSTICS_ADDRESS:=:8443}"
26+
- "--insecure-diagnostics=${CAPRKE2_TEST_EXTENSION_INSECURE_DIAGNOSTICS:=false}"
27+
- "--v=${CAPRKE2_TEST_EXTENSION_DEBUG_LEVEL:=2}"
28+
image: controller:latest
29+
name: manager
30+
env:
31+
- name: POD_NAMESPACE
32+
valueFrom:
33+
fieldRef:
34+
fieldPath: metadata.namespace
35+
- name: POD_NAME
36+
valueFrom:
37+
fieldRef:
38+
fieldPath: metadata.name
39+
- name: POD_UID
40+
valueFrom:
41+
fieldRef:
42+
fieldPath: metadata.uid
43+
ports:
44+
- containerPort: 9440
45+
name: healthz
46+
protocol: TCP
47+
- containerPort: 8443
48+
name: metrics
49+
protocol: TCP
50+
readinessProbe:
51+
httpGet:
52+
path: /readyz
53+
port: healthz
54+
livenessProbe:
55+
httpGet:
56+
path: /healthz
57+
port: healthz
58+
securityContext:
59+
allowPrivilegeEscalation: false
60+
capabilities:
61+
drop:
62+
- ALL
63+
privileged: false
64+
runAsUser: 65532
65+
runAsGroup: 65532
66+
terminationMessagePolicy: FallbackToLogsOnError
67+
resources:
68+
limits:
69+
cpu: 200m
70+
memory: 128Mi
71+
requests:
72+
cpu: 10m
73+
memory: 64Mi
74+
terminationGracePeriodSeconds: 10
75+
serviceAccountName: manager
76+
tolerations:
77+
- effect: NoSchedule
78+
key: node-role.kubernetes.io/master
79+
- effect: NoSchedule
80+
key: node-role.kubernetes.io/control-plane

‎test/extension/config/default/manager_image_patch.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: controller-manager
5+
namespace: system
6+
spec:
7+
template:
8+
spec:
9+
containers:
10+
- image: ghcr.io/rancher/cluster-api-provider-rke2-test-extension:dev
11+
name: manager

‎test/extension/config/default/manager_pull_policy.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: controller-manager
5+
namespace: system
6+
spec:
7+
template:
8+
spec:
9+
containers:
10+
- name: manager
11+
imagePullPolicy: Always

‎test/extension/config/default/manager_webhook_patch.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: controller-manager
5+
namespace: system
6+
spec:
7+
template:
8+
spec:
9+
containers:
10+
- name: manager
11+
ports:
12+
- containerPort: 9443
13+
name: webhook-server
14+
protocol: TCP
15+
volumeMounts:
16+
- mountPath: /tmp/k8s-webhook-server/serving-certs
17+
name: cert
18+
readOnly: true
19+
volumes:
20+
- name: cert
21+
secret:
22+
secretName: rke2-test-extension-webhook-service-cert

‎test/extension/config/default/namespace.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
labels:
5+
cluster.x-k8s.io/provider: runtime-extension-rke2-test
6+
control-plane: controller-manager
7+
name: system

0 commit comments

Comments
 (0)