Skip to content

Commit

Permalink
STSIAMRoleARN usage example
Browse files Browse the repository at this point in the history
  • Loading branch information
@alebedev87
alebedev87 committed Sep 27, 2023
1 parent 907b719 commit 8dc7a23
Show file tree
Hide file tree
Showing 96 changed files with 7,511 additions and 504 deletions.
18 changes: 9 additions & 9 deletions go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,14 +14,14 @@ require (
github.com/mikefarah/yq/v4 v4.24.4
github.com/onsi/ginkgo v1.16.5
github.com/onsi/gomega v1.27.7
github.com/openshift/api v0.0.0-20220906163444-2df055c101a3
github.com/openshift/cloud-credential-operator v0.0.0-20220512195103-2ea3d8c8240a
github.com/openshift/api v0.0.0-20230724190601-61a5301895a5
github.com/openshift/cloud-credential-operator v0.0.0-20230927060424-286b3c5f727b
github.com/operator-framework/operator-lib v0.11.0
github.com/spf13/cobra v1.6.0
k8s.io/api v0.27.2
k8s.io/apimachinery v0.27.2
k8s.io/client-go v0.27.2
k8s.io/utils v0.0.0-20230209194617-a36077c30491
github.com/spf13/cobra v1.6.1
k8s.io/api v0.27.3
k8s.io/apimachinery v0.27.3
k8s.io/client-go v0.27.3
k8s.io/utils v0.0.0-20230406110748-d93618cff8a2
sigs.k8s.io/aws-load-balancer-controller v0.0.0-20220923211742-8d282339857c
sigs.k8s.io/controller-runtime v0.15.0
sigs.k8s.io/controller-runtime/tools/setup-envtest v0.0.0-20220407132358-188b48630db2
Expand Down Expand Up @@ -110,7 +110,7 @@ require (
github.com/golangci/revgrep v0.0.0-20220804021717-745bb2f7c2e6 // indirect
github.com/golangci/unconvert v0.0.0-20180507085042-28b1c447d1f4 // indirect
github.com/google/gnostic v0.5.7-v3refs // indirect
github.com/google/gofuzz v1.1.0 // indirect
github.com/google/gofuzz v1.2.0 // indirect
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
github.com/google/uuid v1.3.0 // indirect
github.com/gordonklaus/ineffassign v0.0.0-20210914165742-4cc7213b9bc8 // indirect
Expand Down Expand Up @@ -203,7 +203,7 @@ require (
github.com/ssgreg/nlreturn/v2 v2.2.1 // indirect
github.com/stbenjam/no-sprintf-host-port v0.1.1 // indirect
github.com/stretchr/objx v0.5.0 // indirect
github.com/stretchr/testify v1.8.1 // indirect
github.com/stretchr/testify v1.8.2 // indirect
github.com/subosito/gotenv v1.4.1 // indirect
github.com/tdakkota/asciicheck v0.1.1 // indirect
github.com/tetafro/godot v1.4.11 // indirect
Expand Down
35 changes: 18 additions & 17 deletions go.sum
View file
Original file line number Diff line number Diff line change
Expand Up @@ -318,8 +318,8 @@ github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
github.com/google/gofuzz v1.1.0 h1:Hsa8mG0dQ46ij8Sl2AYJDUv1oA9/d6Vk+3LG99Oe02g=
github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
Expand Down Expand Up @@ -518,10 +518,10 @@ github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7J
github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
github.com/onsi/gomega v1.27.7 h1:fVih9JD6ogIiHUN6ePK7HJidyEDpWGVB5mzM7cWNXoU=
github.com/onsi/gomega v1.27.7/go.mod h1:1p8OOlwo2iUUDsHnOrjE5UKYJ+e3W8eQ3qSlRahPmr4=
github.com/openshift/api v0.0.0-20220906163444-2df055c101a3 h1:JEFTPLulnOSzBIsZZWitpm0SMJ+TFr7kUumAx7LvvGI=
github.com/openshift/api v0.0.0-20220906163444-2df055c101a3/go.mod h1:9JWn+H7X8wEPPc9D63krigXl8r3F1Mt6/lC98brUyhQ=
github.com/openshift/cloud-credential-operator v0.0.0-20220512195103-2ea3d8c8240a h1:YGI306ZRrlhnJ5Wwrb1dh6jgGxiZC/+Ee2g9UxY7XQE=
github.com/openshift/cloud-credential-operator v0.0.0-20220512195103-2ea3d8c8240a/go.mod h1:qTEqKytotRAu1/N5Grbfd0DGjD56EYk4zNsHg+4Hvlw=
github.com/openshift/api v0.0.0-20230724190601-61a5301895a5 h1:0n+J2TGJ/VssCO952qLcZtlLqb1sx57XHFA4aQZTL/E=
github.com/openshift/api v0.0.0-20230724190601-61a5301895a5/go.mod h1:yimSGmjsI+XF1mr+AKBs2//fSXIOhhetHGbMlBEfXbs=
github.com/openshift/cloud-credential-operator v0.0.0-20230927060424-286b3c5f727b h1:nDhOPPzpleoDwC8d/LJr4ysCL0XeQ+UPPzeIugLY5vQ=
github.com/openshift/cloud-credential-operator v0.0.0-20230927060424-286b3c5f727b/go.mod h1:yLu9n+ahkRncuNkTx7NIq5ievF65tNTbFNDgeZBs4YA=
github.com/operator-framework/operator-lib v0.11.0 h1:eYzqpiOfq9WBI4Trddisiq/X9BwCisZd3rIzmHRC9Z8=
github.com/operator-framework/operator-lib v0.11.0/go.mod h1:RpyKhFAoG6DmKTDIwMuO6pI3LRc8IE9rxEYWy476o6g=
github.com/otiai10/copy v1.2.0 h1:HvG945u96iNadPoG2/Ja2+AUJeW5YuFQMixq9yirC+k=
Expand Down Expand Up @@ -624,8 +624,8 @@ github.com/spf13/afero v1.8.2 h1:xehSyVa0YnHWsJ49JFljMpg1HX19V6NDZ1fkm1Xznbo=
github.com/spf13/afero v1.8.2/go.mod h1:CtAatgMJh6bJEIs48Ay/FOnkljP3WeGUG0MC1RfAqwo=
github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU=
github.com/spf13/cobra v1.6.0 h1:42a0n6jwCot1pUmomAp4T7DeMD+20LFv4Q54pxLf2LI=
github.com/spf13/cobra v1.6.0/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY=
github.com/spf13/cobra v1.6.1 h1:o94oiPyS4KD1mPy2fmcYYHHfCxLqYjJOhGsCHFZtEzA=
github.com/spf13/cobra v1.6.1/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY=
github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
Expand All @@ -650,8 +650,9 @@ github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs=
github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
github.com/tdakkota/asciicheck v0.1.1 h1:PKzG7JUTUmVspQTDqtkX9eSiLGossXTybutHwTXuO0A=
Expand Down Expand Up @@ -1138,22 +1139,22 @@ honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9
honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
honnef.co/go/tools v0.3.3 h1:oDx7VAwstgpYpb3wv0oxiZlxY+foCpRAwY7Vk6XpAgA=
honnef.co/go/tools v0.3.3/go.mod h1:jzwdWgg7Jdq75wlfblQxO4neNaFFSvgc1tD5Wv8U0Yw=
k8s.io/api v0.27.2 h1:+H17AJpUMvl+clT+BPnKf0E3ksMAzoBBg7CntpSuADo=
k8s.io/api v0.27.2/go.mod h1:ENmbocXfBT2ADujUXcBhHV55RIT31IIEvkntP6vZKS4=
k8s.io/api v0.27.3 h1:yR6oQXXnUEBWEWcvPWS0jQL575KoAboQPfJAuKNrw5Y=
k8s.io/api v0.27.3/go.mod h1:C4BNvZnQOF7JA/0Xed2S+aUyJSfTGkGFxLXz9MnpIpg=
k8s.io/apiextensions-apiserver v0.27.2 h1:iwhyoeS4xj9Y7v8YExhUwbVuBhMr3Q4bd/laClBV6Bo=
k8s.io/apiextensions-apiserver v0.27.2/go.mod h1:Oz9UdvGguL3ULgRdY9QMUzL2RZImotgxvGjdWRq6ZXQ=
k8s.io/apimachinery v0.27.2 h1:vBjGaKKieaIreI+oQwELalVG4d8f3YAMNpWLzDXkxeg=
k8s.io/apimachinery v0.27.2/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E=
k8s.io/client-go v0.27.2 h1:vDLSeuYvCHKeoQRhCXjxXO45nHVv2Ip4Fe0MfioMrhE=
k8s.io/client-go v0.27.2/go.mod h1:tY0gVmUsHrAmjzHX9zs7eCjxcBsf8IiNe7KQ52biTcQ=
k8s.io/apimachinery v0.27.3 h1:Ubye8oBufD04l9QnNtW05idcOe9Z3GQN8+7PqmuVcUM=
k8s.io/apimachinery v0.27.3/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E=
k8s.io/client-go v0.27.3 h1:7dnEGHZEJld3lYwxvLl7WoehK6lAq7GvgjxpA3nv1E8=
k8s.io/client-go v0.27.3/go.mod h1:2MBEKuTo6V1lbKy3z1euEGnhPfGZLKTS9tiJ2xodM48=
k8s.io/component-base v0.27.2 h1:neju+7s/r5O4x4/txeUONNTS9r1HsPbyoPBAtHsDCpo=
k8s.io/component-base v0.27.2/go.mod h1:5UPk7EjfgrfgRIuDBFtsEFAe4DAvP3U+M8RTzoSJkpo=
k8s.io/klog/v2 v2.90.1 h1:m4bYOKall2MmOiRaR1J+We67Do7vm9KiQVlT96lnHUw=
k8s.io/klog/v2 v2.90.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f h1:2kWPakN3i/k81b0gvD5C5FJ2kxm1WrQFanWchyKuqGg=
k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f/go.mod h1:byini6yhqGC14c3ebc/QwanvYwhuMWF6yz2F8uwW8eg=
k8s.io/utils v0.0.0-20230209194617-a36077c30491 h1:r0BAOLElQnnFhE/ApUsg3iHdVYYPBjNSSOMowRZxxsY=
k8s.io/utils v0.0.0-20230209194617-a36077c30491/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 h1:qY1Ad8PODbnymg2pRbkyMT/ylpTrCM8P2RJ0yroCyIk=
k8s.io/utils v0.0.0-20230406110748-d93618cff8a2/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
mvdan.cc/gofumpt v0.4.0 h1:JVf4NN1mIpHogBj7ABpgOyZc65/UUOkKQFkoURsz4MM=
mvdan.cc/gofumpt v0.4.0/go.mod h1:PljLOHDeZqgS8opHRKLzp2It2VBuSdteAgqUfzMTxlQ=
mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed h1:WX1yoOaKQfddO/mLzdV4wptyWgoH/6hwLs7QHTixo0I=
Expand Down
31 changes: 15 additions & 16 deletions pkg/controllers/awsloadbalancercontroller/credentials_request.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ package awsloadbalancercontroller
import (
"context"
"fmt"
"path"
"reflect"

corev1 "k8s.io/api/core/v1"
Expand Down Expand Up @@ -53,7 +54,7 @@ func (r *AWSLoadBalancerControllerReconciler) ensureCredentialsRequest(ctx conte
// The secret created will be in the operator namespace.
secretRef := createCredentialsSecretRef(credentialRequestSecretName, namespace)

desired, err := desiredCredentialsRequest(credReq, secretRef, name)
desired, err := desiredCredentialsRequest(credReq, secretRef, name, controller.Spec.CredentialsRequestConfig)
if err != nil {
return nil, fmt.Errorf("failed to build desired credentials request: %w", err)
}
Expand Down Expand Up @@ -135,7 +136,7 @@ func (r *AWSLoadBalancerControllerReconciler) updateCredentialsRequest(ctx conte
return true, nil
}

func desiredCredentialsRequest(name types.NamespacedName, secretRef corev1.ObjectReference, saName string) (*cco.CredentialsRequest, error) {
func desiredCredentialsRequest(name types.NamespacedName, secretRef corev1.ObjectReference, saName string, config *albo.AWSLoadBalancerCredentialsRequestConfig) (*cco.CredentialsRequest, error) {
credentialsRequest := &cco.CredentialsRequest{
ObjectMeta: metav1.ObjectMeta{
Name: name.Name,
Expand All @@ -147,23 +148,26 @@ func desiredCredentialsRequest(name types.NamespacedName, secretRef corev1.Objec
},
}

codec, err := cco.NewCodec()
if err != nil {
return nil, err
if config != nil && config.STSIAMRoleARN != "" {
credentialsRequest.Spec.CloudTokenPath = path.Join(boundSATokenDir, "token")
}

providerSpec, err := createProviderConfig(codec)
providerSpec, err := createProviderConfig(cco.Codec, config)
if err != nil {
return nil, err
}
credentialsRequest.Spec.ProviderSpec = providerSpec
return credentialsRequest, nil
}

func createProviderConfig(codec *cco.ProviderCodec) (*runtime.RawExtension, error) {
return codec.EncodeProviderSpec(&cco.AWSProviderSpec{
func createProviderConfig(codec *cco.ProviderCodec, config *albo.AWSLoadBalancerCredentialsRequestConfig) (*runtime.RawExtension, error) {
providerSpec := &cco.AWSProviderSpec{
StatementEntries: GetIAMPolicy().Statement,
})
}
if config != nil && config.STSIAMRoleARN != "" {
providerSpec.STSIAMRoleARN = config.STSIAMRoleARN
}
return codec.EncodeProviderSpec(providerSpec)
}

// createCredentialsRequestName will always return a fixed namespaced resource, so as to
Expand Down Expand Up @@ -199,19 +203,14 @@ func isCredentialsRequestChanged(current, desired *cco.CredentialsRequest) (bool
return true, nil
}

codec, err := cco.NewCodec()
if err != nil {
return false, err
}

currentAwsSpec := cco.AWSProviderSpec{}
err = codec.DecodeProviderSpec(current.Spec.ProviderSpec, &currentAwsSpec)
err := cco.Codec.DecodeProviderSpec(current.Spec.ProviderSpec, &currentAwsSpec)
if err != nil {
return false, err
}

desiredAwsSpec := cco.AWSProviderSpec{}
err = codec.DecodeProviderSpec(desired.Spec.ProviderSpec, &desiredAwsSpec)
err = cco.Codec.DecodeProviderSpec(desired.Spec.ProviderSpec, &desiredAwsSpec)
if err != nil {
return false, err
}
Expand Down
6 changes: 2 additions & 4 deletions pkg/controllers/awsloadbalancercontroller/credentials_request_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -154,8 +154,7 @@ func TestEnsureCredentialsRequest(t *testing.T) {
}

func testCompleteCredentialsRequest() *cco.CredentialsRequest {
codec, _ := cco.NewCodec()
cfg, _ := createProviderConfig(codec)
cfg, _ := createProviderConfig(cco.Codec, nil)
return &cco.CredentialsRequest{
ObjectMeta: metav1.ObjectMeta{
Name: "aws-load-balancer-controller-cluster",
Expand Down Expand Up @@ -194,7 +193,6 @@ func testCredentialsRequestSADiff() *cco.CredentialsRequest {
}

func testAWSProviderSpec() *runtime.RawExtension {
codec, _ := cco.NewCodec()
providerSpec, _ := codec.EncodeProviderSpec(&cco.AWSProviderSpec{})
providerSpec, _ := cco.Codec.EncodeProviderSpec(&cco.AWSProviderSpec{})
return providerSpec
}
7 changes: 1 addition & 6 deletions test/e2e/operator_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1113,12 +1113,7 @@ func TestAWSLoadBalancerControllerWithExternalTypeNLBAndNonStandardPort(t *testi

// ensureCredentialsRequest creates CredentialsRequest to provision a secret with the cloud credentials required by this e2e test.
func ensureCredentialsRequest(secret types.NamespacedName) error {
codec, err := cco.NewCodec()
if err != nil {
return err
}

providerSpec, err := codec.EncodeProviderSpec(&cco.AWSProviderSpec{
providerSpec, err := cco.Codec.EncodeProviderSpec(&cco.AWSProviderSpec{
StatementEntries: []cco.StatementEntry{
{
Action: []string{"wafv2:CreateWebACL", "wafv2:DeleteWebACL", "wafv2:ListWebACLs"},
Expand Down
11 changes: 4 additions & 7 deletions vendor/github.com/google/gofuzz/.travis.yml
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion vendor/github.com/google/gofuzz/CONTRIBUTING.md
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

18 changes: 18 additions & 0 deletions vendor/github.com/google/gofuzz/README.md
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

81 changes: 81 additions & 0 deletions vendor/github.com/google/gofuzz/bytesource/bytesource.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading

0 comments on commit 8dc7a23

Please sign in to comment.