-
Notifications
You must be signed in to change notification settings - Fork 504
AGENT-1307: add MCD IRI manager #5807
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
13 commits
Select commit
Hold shift + click to select a range
a591768
add MCD IRI manager
andfasano 85777fd
allows MCD to get IRI resource
andfasano db03971
bump openshift/api and openshift/client-go
andfasano 625c0d1
managed the MCN status
andfasano 0a03489
add MCD IRI unit tests
andfasano 06ff204
using MachineConfigNodeLister instead of the client
andfasano caf52e2
fix stale reference to FeatureGateMachineConfigNodes feature
andfasano 4adea70
add basic e2e test for MCD IRI
andfasano 411484c
various fixes
andfasano d109072
cleanup MCN on IRI deletion
andfasano 80403a3
add missing verbs for mcd service role
andfasano 22b6552
temporary fix for the MCN IRI status CEL validation rule
andfasano d639f33
e2e test fix
andfasano File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| # See the OWNERS docs: https://git.k8s.io/community/contributors/guide/owners.md | ||
|
|
||
| approvers: | ||
| - andfasano | ||
| - bfournie | ||
| - pawanpinjarkar | ||
| - rwsu | ||
| - zaneb | ||
| reviewers: | ||
| - andfasano | ||
| - bfournie | ||
| - pawanpinjarkar | ||
| - rwsu | ||
| - zaneb | ||
|
|
||
140 changes: 140 additions & 0 deletions
140
pkg/daemon/internalreleaseimage/internalreleaseimage_fakeregistry_test.go
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,140 @@ | ||
| package internalreleaseimage | ||
|
|
||
| import ( | ||
| "crypto/rand" | ||
| "crypto/rsa" | ||
| "crypto/tls" | ||
| "crypto/x509" | ||
| "crypto/x509/pkix" | ||
| "encoding/pem" | ||
| "fmt" | ||
| "log" | ||
| "math/big" | ||
| "net" | ||
| "net/http" | ||
| "net/http/httptest" | ||
| "time" | ||
| ) | ||
|
|
||
| type FakeIRIRegistry struct { | ||
| mux *http.ServeMux | ||
| server *httptest.Server | ||
| responses map[string][]registryResponse | ||
| } | ||
|
|
||
| type registryResponse struct { | ||
| statusCode int | ||
| body string | ||
| } | ||
|
|
||
| // NewFakeIRIRegistry creates a new instance of the fake registry. | ||
| func NewFakeIRIRegistry() *FakeIRIRegistry { | ||
| return &FakeIRIRegistry{ | ||
| responses: make(map[string][]registryResponse), | ||
| } | ||
| } | ||
|
|
||
| func (fr *FakeIRIRegistry) AddResponse(endpoint string, statusCode int, body string) *FakeIRIRegistry { | ||
| epReplies, found := fr.responses[endpoint] | ||
| if !found { | ||
| epReplies = []registryResponse{} | ||
| } | ||
|
|
||
| epReplies = append(epReplies, registryResponse{ | ||
| statusCode: statusCode, | ||
| body: body, | ||
| }) | ||
| fr.responses[endpoint] = epReplies | ||
|
|
||
| return fr | ||
| } | ||
|
|
||
| // Start configures the handlers, brings up the local server for the | ||
| // registry. | ||
| func (fr *FakeIRIRegistry) Start() error { | ||
| fr.mux = http.NewServeMux() | ||
|
|
||
| // Ping handler | ||
| fr.mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { | ||
| epReplies, found := fr.responses[r.URL.Path] | ||
| if !found || len(epReplies) == 0 { | ||
| log.Fatalf("unexpected endpoint call received: %s", r.URL.Path) | ||
| } | ||
| reply := epReplies[0] | ||
| fr.responses[r.URL.Path] = epReplies[1:] | ||
|
|
||
| w.Header().Set("Content-Type", "application/json") | ||
| w.Header().Set("Docker-Distribution-Api-Version", "registry/2.0") | ||
| w.WriteHeader(reply.statusCode) | ||
|
|
||
| if _, err := w.Write([]byte(reply.body)); err != nil { | ||
| log.Fatal(err) | ||
| } | ||
|
coderabbitai[bot] marked this conversation as resolved.
|
||
| }) | ||
|
|
||
| err := fr.newTLSServer(fr.mux.ServeHTTP) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| fr.server.StartTLS() | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func (fr *FakeIRIRegistry) newTLSServer(handler http.HandlerFunc) error { | ||
| listener, err := net.Listen("tcp", "127.0.0.1:22625") | ||
|
andfasano marked this conversation as resolved.
|
||
| if err != nil { | ||
| return fmt.Errorf("failed to bind port: %v", err) | ||
| } | ||
| fr.server = httptest.NewUnstartedServer(handler) | ||
| fr.server.Listener = listener | ||
| cert, err := fr.generateSelfSignedCert() | ||
| if err != nil { | ||
| return fmt.Errorf("error configuring server cert: %w", err) | ||
| } | ||
| fr.server.TLS = &tls.Config{ | ||
| MinVersion: tls.VersionTLS13, | ||
| Certificates: []tls.Certificate{cert}, | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func (fr *FakeIRIRegistry) generateSelfSignedCert() (tls.Certificate, error) { | ||
| // Generate the private key | ||
| pk, err := rsa.GenerateKey(rand.Reader, 2048) | ||
| if err != nil { | ||
| return tls.Certificate{}, err | ||
| } | ||
| // Generate the serial number | ||
| sn, err := rand.Int(rand.Reader, big.NewInt(1000000)) | ||
| if err != nil { | ||
| return tls.Certificate{}, err | ||
| } | ||
| // Create the certificate template | ||
| template := x509.Certificate{ | ||
| SerialNumber: sn, | ||
| Subject: pkix.Name{ | ||
| Organization: []string{"IRI Tester"}, | ||
| }, | ||
| NotBefore: time.Now(), | ||
| NotAfter: time.Now().Add(1 * time.Hour), | ||
| KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature, | ||
| ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}, | ||
| BasicConstraintsValid: true, | ||
| DNSNames: []string{"localhost"}, | ||
| IPAddresses: []net.IP{net.ParseIP("127.0.0.1")}, | ||
| } | ||
| certDER, err := x509.CreateCertificate(rand.Reader, &template, &template, &pk.PublicKey, pk) | ||
| if err != nil { | ||
| return tls.Certificate{}, err | ||
| } | ||
|
|
||
| certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER}) | ||
| keyPEM := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(pk)}) | ||
| return tls.X509KeyPair(certPEM, keyPEM) | ||
| } | ||
|
|
||
| // Close shutdowns the fake registry server. | ||
| func (fr *FakeIRIRegistry) Close() { | ||
| fr.server.Close() | ||
| } | ||
85 changes: 85 additions & 0 deletions
85
pkg/daemon/internalreleaseimage/internalreleaseimage_helpers_test.go
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,85 @@ | ||
| package internalreleaseimage | ||
|
|
||
| import ( | ||
| mcfgv1 "github.com/openshift/api/machineconfiguration/v1" | ||
| mcfgv1alpha1 "github.com/openshift/api/machineconfiguration/v1alpha1" | ||
| "github.com/openshift/machine-config-operator/pkg/controller/common" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| v1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| "k8s.io/apimachinery/pkg/runtime" | ||
| ) | ||
|
|
||
| // iriBuilder simplifies the creation of an InternalReleaseImage resource in the test. | ||
| type iriBuilder struct { | ||
| obj *mcfgv1alpha1.InternalReleaseImage | ||
| } | ||
|
|
||
| func iri() *iriBuilder { | ||
| return &iriBuilder{ | ||
| obj: &mcfgv1alpha1.InternalReleaseImage{ | ||
| ObjectMeta: v1.ObjectMeta{ | ||
| Name: common.InternalReleaseImageInstanceName, | ||
| }, | ||
| Spec: mcfgv1alpha1.InternalReleaseImageSpec{ | ||
| Releases: []mcfgv1alpha1.InternalReleaseImageRef{ | ||
| { | ||
| Name: "ocp-release-bundle-4.21.5-x86_64", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| } | ||
| } | ||
|
|
||
| func (ib *iriBuilder) build() runtime.Object { | ||
| return ib.obj | ||
| } | ||
|
|
||
| // mcnBuilder simplifies the creation of a MachineConfigNode resource in the test. | ||
| type mcnBuilder struct { | ||
| obj *mcfgv1.MachineConfigNode | ||
| } | ||
|
|
||
| func machineConfigNode(name string) *mcnBuilder { | ||
| return &mcnBuilder{ | ||
| obj: &mcfgv1.MachineConfigNode{ | ||
| ObjectMeta: v1.ObjectMeta{ | ||
| Name: name, | ||
| }, | ||
| }, | ||
| } | ||
| } | ||
|
|
||
| func (mb *mcnBuilder) withIRIBundle(bundleName string, image string) *mcnBuilder { | ||
| mb.obj.Status = mcfgv1.MachineConfigNodeStatus{ | ||
| Conditions: []v1.Condition{ | ||
| { | ||
| Type: string(mcfgv1.MachineConfigNodeInternalReleaseImageDegraded), | ||
| Status: metav1.ConditionFalse, | ||
| }, | ||
| }, | ||
| InternalReleaseImage: mcfgv1.MachineConfigNodeStatusInternalReleaseImage{ | ||
| Releases: []mcfgv1.MachineConfigNodeStatusInternalReleaseImageRef{ | ||
| { | ||
| Name: bundleName, | ||
| Image: image, | ||
| Conditions: []v1.Condition{ | ||
| { | ||
| Type: string(mcfgv1alpha1.InternalReleaseImageConditionTypeDegraded), | ||
| Status: metav1.ConditionFalse, | ||
| }, | ||
| { | ||
| Type: string(mcfgv1alpha1.InternalReleaseImageConditionTypeAvailable), | ||
| Status: metav1.ConditionTrue, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| } | ||
| return mb | ||
| } | ||
|
|
||
| func (mb *mcnBuilder) build() runtime.Object { | ||
| return mb.obj | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think you added a newline entirely, instead of a newline character, but we can fix it later