Implement `karmadactl get` to support pull mode cluster #1575

lonelyCZ · 2022-04-01T06:58:37Z

Signed-off-by: lonelyCZ [email protected]

What type of PR is this?
/kind feature

What this PR does / why we need it:
Implement karmadactl get to support pull mode cluster through aggregated-apiserver.

Which issue(s) this PR fixes:
Fixes #1091

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

Implement `karmadactl get` to support pull mode cluster

RainbowMango · 2022-04-01T07:31:11Z

Wow, nice!!!
/assign @XiShanYongYe-Chang

XiShanYongYe-Chang · 2022-04-01T09:25:08Z

cmd/agent/app/agent.go

+	// create a ClusterRole in cluster.
+	clusterRole := &rbacv1.ClusterRole{}
+	clusterRole.Name = names.GenerateRoleName(impersonationSA.Name)
+	clusterRole.Rules = clusterPolicyRules
+	if _, err = ensureClusterRoleExist(clusterKubeClient, clusterRole); err != nil {
+		return nil, err
+	}
+
+	// create a ClusterRoleBinding in cluster.
+	clusterRoleBinding := &rbacv1.ClusterRoleBinding{}
+	clusterRoleBinding.Name = clusterRole.Name
+	clusterRoleBinding.Subjects = buildRoleBindingSubjects(impersonationSA.Name, impersonationSA.Namespace)
+	clusterRoleBinding.RoleRef = buildClusterRoleReference(clusterRole.Name)
+	if _, err = ensureClusterRoleBindingExist(clusterKubeClient, clusterRoleBinding); err != nil {
+		return nil, err
+	}
+


We have create ClusterRole karmada-impersonator and ClusterRoleBinding karmada-impersonator for pull mode cluster, perhaps we do not need to create those rbac resource.

# kubectl --kubeconfig /root/.kube/members.config --context member3 get clusterrole | grep karmada-impersonator karmada-impersonator 2022-04-01T08:02:54Z # kubectl --kubeconfig /root/.kube/members.config --context member3 get clusterrolebinding | grep karmada-impersonator karmada-impersonator

Oh, I didn't see where to create these rbac, and let me see again.

@XiShanYongYe-Chang I still can't find the exact location that create rbac for Pull cluster.

Look here: pkg/controllers/unifiedauth/unified_auth_controller.go

unified-auth-controller will create impersonator rbac for all cluster(include pull mode).

Does this controller(unified-auth-controller) need to be registered in agent component? Or directly manipulate PULL mode clusters in karmada-controller-manager component?

unified-auth-controller will create work with clusterrole/clusterrolebinding for all cluster:

karmada/pkg/controllers/unifiedauth/unified_auth_controller.go

Lines 122 to 132 in 7a1e96e

// step5: sync clusterrole to cluster for impersonation

if err := c.buildImpersonationClusterRole(cluster, rules); err != nil {

klog.Errorf("failed to sync impersonate clusterrole to cluster(%s): %v", cluster.Name, err)

return err

}

// step6: sync clusterrolebinding to cluster for impersonation

if err := c.buildImpersonationClusterRoleBinding(cluster); err != nil {

klog.Errorf("failed to sync impersonate clusterrolebinding to cluster(%s): %v", cluster.Name, err)

return err

}

Got it, thanks!

Have removed it.

Signed-off-by: lonelyCZ <[email protected]>

XiShanYongYe-Chang

good job!

/lgtm

XiShanYongYe-Chang · 2022-04-02T07:58:18Z

Test ok:

# ./karmadactl get po -n kube-system
NAME                                            CLUSTER   READY   STATUS    RESTARTS   AGE
coredns-64897985d-qvvpg                         member3   1/1     Running   0          12m
coredns-64897985d-xrt7g                         member3   1/1     Running   0          12m
etcd-member3-control-plane                      member3   1/1     Running   0          12m
kindnet-4qkq5                                   member3   1/1     Running   0          12m
kube-apiserver-member3-control-plane            member3   1/1     Running   0          12m
kube-controller-manager-member3-control-plane   member3   1/1     Running   0          12m
kube-proxy-rnrvz                                member3   1/1     Running   0          12m
kube-scheduler-member3-control-plane            member3   1/1     Running   0          12m
coredns-64897985d-5znl9                         member2   1/1     Running   0          12m
coredns-64897985d-rwj96                         member2   1/1     Running   0          12m
etcd-member2-control-plane                      member2   1/1     Running   0          12m
kindnet-24xj9                                   member2   1/1     Running   0          12m
kube-apiserver-member2-control-plane            member2   1/1     Running   0          12m
kube-controller-manager-member2-control-plane   member2   1/1     Running   0          12m
kube-proxy-ztwhq                                member2   1/1     Running   0          12m
kube-scheduler-member2-control-plane            member2   1/1     Running   0          12m
coredns-64897985d-gsl52                         member1   1/1     Running   0          12m
coredns-64897985d-rtjl2                         member1   1/1     Running   0          12m
etcd-member1-control-plane                      member1   1/1     Running   0          12m
kindnet-qccrb                                   member1   1/1     Running   0          12m
kube-apiserver-member1-control-plane            member1   1/1     Running   0          12m
kube-controller-manager-member1-control-plane   member1   1/1     Running   0          12m
kube-proxy-7fzfx                                member1   1/1     Running   0          12m
kube-scheduler-member1-control-plane            member1   1/1     Running   0          12m

RainbowMango

/approve

karmada-bot · 2022-04-06T09:01:20Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: RainbowMango

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [RainbowMango]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

karmada-bot added the kind/feature Categorizes issue or PR as related to a new feature. label Apr 1, 2022

karmada-bot requested review from mrlihanbo and RainbowMango April 1, 2022 06:58

karmada-bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Apr 1, 2022

lonelyCZ force-pushed the pr-get-pull branch from 0d9dfc2 to b8677fb Compare April 1, 2022 07:27

karmada-bot assigned XiShanYongYe-Chang Apr 1, 2022

XiShanYongYe-Chang reviewed Apr 1, 2022

View reviewed changes

Implement karmadactl get to support pull mode cluster

93c3c04

Signed-off-by: lonelyCZ <[email protected]>

lonelyCZ force-pushed the pr-get-pull branch from b8677fb to 93c3c04 Compare April 2, 2022 06:46

karmada-bot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Apr 2, 2022

XiShanYongYe-Chang reviewed Apr 2, 2022

View reviewed changes

karmada-bot added the lgtm Indicates that a PR is ready to be merged. label Apr 2, 2022

RainbowMango approved these changes Apr 6, 2022

View reviewed changes

karmada-bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 6, 2022

karmada-bot merged commit 79442df into karmada-io:master Apr 6, 2022

lonelyCZ deleted the pr-get-pull branch July 11, 2022 08:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement `karmadactl get` to support pull mode cluster #1575

Implement `karmadactl get` to support pull mode cluster #1575

lonelyCZ commented Apr 1, 2022

RainbowMango commented Apr 1, 2022

XiShanYongYe-Chang Apr 1, 2022

lonelyCZ Apr 1, 2022

lonelyCZ Apr 1, 2022

XiShanYongYe-Chang Apr 2, 2022

lonelyCZ Apr 2, 2022

XiShanYongYe-Chang Apr 2, 2022

lonelyCZ Apr 2, 2022

lonelyCZ Apr 2, 2022

XiShanYongYe-Chang left a comment

XiShanYongYe-Chang commented Apr 2, 2022

RainbowMango left a comment

karmada-bot commented Apr 6, 2022

	// step5: sync clusterrole to cluster for impersonation
	if err := c.buildImpersonationClusterRole(cluster, rules); err != nil {
	klog.Errorf("failed to sync impersonate clusterrole to cluster(%s): %v", cluster.Name, err)
	return err
	}

	// step6: sync clusterrolebinding to cluster for impersonation
	if err := c.buildImpersonationClusterRoleBinding(cluster); err != nil {
	klog.Errorf("failed to sync impersonate clusterrolebinding to cluster(%s): %v", cluster.Name, err)
	return err
	}

Implement karmadactl get to support pull mode cluster #1575

Implement karmadactl get to support pull mode cluster #1575

Conversation

lonelyCZ commented Apr 1, 2022

RainbowMango commented Apr 1, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

XiShanYongYe-Chang left a comment

Choose a reason for hiding this comment

XiShanYongYe-Chang commented Apr 2, 2022

RainbowMango left a comment

Choose a reason for hiding this comment

karmada-bot commented Apr 6, 2022

Implement `karmadactl get` to support pull mode cluster #1575

Implement `karmadactl get` to support pull mode cluster #1575