|
40 | 40 | releaseName = "multicluster-controlplane" |
41 | 41 | ) |
42 | 42 |
|
| 43 | +var validRegistrationDriver = sets.New[string](operatorv1.CSRAuthType, operatorv1.AwsIrsaAuthType, operatorv1.GRPCAuthType) |
| 44 | + |
43 | 45 | func (o *Options) complete(cmd *cobra.Command, args []string) (err error) { |
44 | 46 | klog.V(1).InfoS("init options:", "dry-run", o.ClusteradmFlags.DryRun, "force", o.force, "output-file", o.outputFile) |
45 | 47 |
|
@@ -95,6 +97,25 @@ func (o *Options) complete(cmd *cobra.Command, args []string) (err error) { |
95 | 97 | genericclioptionsclusteradm.HubMutableFeatureGate, ocmfeature.DefaultHubAddonManagerFeatureGates), |
96 | 98 | }, |
97 | 99 | } |
| 100 | + if sets.New[string](o.registrationDrivers...).Has(operatorv1.GRPCAuthType) { |
| 101 | + if o.grpcServer == "" { |
| 102 | + return fmt.Errorf("grpc server should not be empty if registration driver has grpc type") |
| 103 | + } |
| 104 | + |
| 105 | + o.clusterManagerChartConfig.ClusterManager.ServerConfiguration = operatorv1.ServerConfiguration{ |
| 106 | + EndpointsExposure: []operatorv1.EndpointExposure{ |
| 107 | + { |
| 108 | + Protocol: operatorv1.GRPCAuthType, |
| 109 | + GRPC: &operatorv1.Endpoint{ |
| 110 | + Type: operatorv1.EndpointTypeHostname, |
| 111 | + Hostname: &operatorv1.HostnameConfig{ |
| 112 | + Host: o.grpcServer, |
| 113 | + }, |
| 114 | + }, |
| 115 | + }, |
| 116 | + }, |
| 117 | + } |
| 118 | + } |
98 | 119 | o.clusterManagerChartConfig.CreateBootstrapToken = o.useBootstrapToken |
99 | 120 |
|
100 | 121 | if o.imagePullCredFile != "" { |
@@ -155,25 +176,29 @@ func (o *Options) validate() error { |
155 | 176 | return fmt.Errorf("registry should not be empty") |
156 | 177 | } |
157 | 178 |
|
158 | | - validRegistrationDriver := sets.New[string]("csr", "awsirsa") |
159 | 179 | for _, driver := range o.registrationDrivers { |
160 | 180 | if !validRegistrationDriver.Has(driver) { |
161 | | - return fmt.Errorf("only csr and awsirsa are valid drivers") |
| 181 | + return fmt.Errorf("only csr,awsirsa and grpc are valid drivers") |
162 | 182 | } |
163 | 183 | } |
164 | 184 |
|
165 | 185 | if genericclioptionsclusteradm.HubMutableFeatureGate.Enabled("ManagedClusterAutoApproval") { |
166 | 186 | // If hub registration does not accept awsirsa, we stop user if they also pass in a list of patterns for AWS EKS ARN. |
167 | 187 |
|
168 | | - if len(o.autoApprovedARNPatterns) > 0 && !sets.New[string](o.registrationDrivers...).Has("awsirsa") { |
| 188 | + if len(o.autoApprovedARNPatterns) > 0 && !sets.New[string](o.registrationDrivers...).Has(operatorv1.AwsIrsaAuthType) { |
169 | 189 | return fmt.Errorf("should not provide list of patterns for aws eks arn if not initializing hub with awsirsa registration") |
170 | 190 | } |
171 | 191 |
|
172 | 192 | // If hub registration does not accept csr, we stop user if they also pass in a list of users for CSR auto approval. |
173 | | - if len(o.autoApprovedCSRIdentities) > 0 && !sets.New[string](o.registrationDrivers...).Has("csr") { |
| 193 | + if len(o.autoApprovedCSRIdentities) > 0 && !sets.New[string](o.registrationDrivers...).Has(operatorv1.CSRAuthType) { |
174 | 194 | return fmt.Errorf("should not provide list of users for csr to auto approve if not initializing hub with csr registration") |
175 | 195 | } |
176 | | - } else if len(o.autoApprovedARNPatterns) > 0 || len(o.autoApprovedCSRIdentities) > 0 { |
| 196 | + |
| 197 | + if len(o.autoApprovedGRPCIdentities) > 0 && !sets.New[string](o.registrationDrivers...).Has(operatorv1.GRPCAuthType) { |
| 198 | + return fmt.Errorf("should not provide list of users or identities for grpc cluster to auto approve if not initializing hub with grpc registration") |
| 199 | + } |
| 200 | + |
| 201 | + } else if len(o.autoApprovedARNPatterns) > 0 || len(o.autoApprovedCSRIdentities) > 0 || len(o.autoApprovedGRPCIdentities) > 0 { |
177 | 202 | return fmt.Errorf("should enable feature gate ManagedClusterAutoApproval before passing list of identities") |
178 | 203 | } |
179 | 204 |
|
@@ -394,22 +419,38 @@ func (o *Options) deploySingletonControlplane(kubeClient kubernetes.Interface) e |
394 | 419 |
|
395 | 420 | func getRegistrationDrivers(o *Options) ([]operatorv1.RegistrationDriverHub, error) { |
396 | 421 | registrationDrivers := []operatorv1.RegistrationDriverHub{} |
397 | | - var registrationDriver operatorv1.RegistrationDriverHub |
398 | 422 |
|
399 | 423 | for _, driver := range o.registrationDrivers { |
400 | | - if driver == "csr" { |
401 | | - csr := &operatorv1.CSRConfig{AutoApprovedIdentities: o.autoApprovedCSRIdentities} |
402 | | - registrationDriver = operatorv1.RegistrationDriverHub{AuthType: driver, CSR: csr} |
403 | | - } else if driver == "awsirsa" { |
| 424 | + var registrationDriver operatorv1.RegistrationDriverHub |
| 425 | + switch driver { |
| 426 | + case operatorv1.CSRAuthType: |
| 427 | + registrationDriver = operatorv1.RegistrationDriverHub{AuthType: operatorv1.CSRAuthType} |
| 428 | + if len(o.autoApprovedCSRIdentities) != 0 { |
| 429 | + registrationDriver.CSR = &operatorv1.CSRConfig{ |
| 430 | + AutoApprovedIdentities: o.autoApprovedCSRIdentities, |
| 431 | + } |
| 432 | + } |
| 433 | + case operatorv1.AwsIrsaAuthType: |
404 | 434 | hubClusterArn, err := getHubClusterArn(o) |
405 | 435 | if err != nil { |
406 | 436 | return registrationDrivers, err |
407 | 437 | } |
408 | 438 | awsirsa := &operatorv1.AwsIrsaConfig{HubClusterArn: hubClusterArn, Tags: o.awsResourceTags, AutoApprovedIdentities: o.autoApprovedARNPatterns} |
409 | | - registrationDriver = operatorv1.RegistrationDriverHub{AuthType: driver, AwsIrsa: awsirsa} |
| 439 | + registrationDriver = operatorv1.RegistrationDriverHub{AuthType: operatorv1.AwsIrsaAuthType, AwsIrsa: awsirsa} |
| 440 | + case operatorv1.GRPCAuthType: |
| 441 | + registrationDriver = operatorv1.RegistrationDriverHub{AuthType: operatorv1.GRPCAuthType} |
| 442 | + if len(o.autoApprovedGRPCIdentities) != 0 { |
| 443 | + registrationDriver.GRPC = &operatorv1.GRPCRegistrationConfig{ |
| 444 | + AutoApprovedIdentities: o.autoApprovedGRPCIdentities, |
| 445 | + } |
| 446 | + } |
| 447 | + default: |
| 448 | + return registrationDrivers, fmt.Errorf("unknown registration-drivers type: %s", driver) |
410 | 449 | } |
| 450 | + |
411 | 451 | registrationDrivers = append(registrationDrivers, registrationDriver) |
412 | 452 | } |
| 453 | + |
413 | 454 | return registrationDrivers, nil |
414 | 455 | } |
415 | 456 |
|
|
0 commit comments