Nail/fission-src
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Maintain CRD folder to keep track of Schemas (#1938)

Browse Source 
Adds CRD Yaml files needed for upgrade as the OpenAPISchema validation has been added.
This commit is contained in:
Harsh Thakur
2021-04-27 17:20:03 +05:30
committed by GitHub
parent 1cd8f4d4f7
commit 0d93c109fb
15 changed files with 693 additions and 251 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/preupgradechecks/main.go
+2 -3
View File
@@ -65,12 +65,11 @@ Options:
zap.Error(err))
}
if !crdBackedClient.IsFissionReInstall() {
installed := crdBackedClient.IsFissionReInstall()
if !installed {
logger.Info("nothing to do since CRDs are not present on the cluster")
return
}
crdBackedClient.VerifyFunctionSpecReferences()
crdBackedClient.RemoveClusterAdminRolesForFissionSAs()
crdBackedClient.SetupRoleBindings()
}
cmd/preupgradechecks/preupgradechecks.go
+1 -91
View File
@@ -29,7 +29,6 @@ import (
fv1 "github.com/fission/fission/pkg/apis/core/v1"
"github.com/fission/fission/pkg/crd"
"github.com/fission/fission/pkg/utils"
)
type (
@@ -71,9 +70,7 @@ func (client *PreUpgradeTaskClient) IsFissionReInstall() bool {
_, err := client.apiExtClient.ApiextensionsV1beta1().CustomResourceDefinitions().Get(FunctionCRD, metav1.GetOptions{})
if err != nil && k8serrors.IsNotFound(err) {
return false
}
if err == nil {
return true
}
}
@@ -132,90 +129,3 @@ func (client *PreUpgradeTaskClient) VerifyFunctionSpecReferences() {
client.logger.Info("function spec references verified")
}
// deleteClusterRoleBinding deletes the clusterRoleBinding passed as an argument to it.
// If its not present, it just ignores and returns no errors
func (client *PreUpgradeTaskClient) deleteClusterRoleBinding(clusterRoleBinding string) (err error) {
for i := 0; i < maxRetries; i++ {
err = client.k8sClient.RbacV1beta1().ClusterRoleBindings().Delete(clusterRoleBinding, &metav1.DeleteOptions{})
if err != nil && k8serrors.IsNotFound(err) || err == nil {
return nil
}
}
return err
}
// RemoveClusterAdminRolesForFissionSAs deletes the clusterRoleBindings previously created on this cluster
func (client *PreUpgradeTaskClient) RemoveClusterAdminRolesForFissionSAs() {
clusterRoleBindings := []string{"fission-builder-crd", "fission-fetcher-crd"}
for _, clusterRoleBinding := range clusterRoleBindings {
err := client.deleteClusterRoleBinding(clusterRoleBinding)
if err != nil {
client.logger.Fatal("error deleting rolebinding",
zap.Error(err),
zap.String("role_binding", clusterRoleBinding))
}
}
client.logger.Info("removed cluster admin privileges for fission-builder and fission-fetcher service accounts")
}
// NeedRoleBindings checks if there is at least one package or function in default namespace.
// It is needed to find out if package-getter-rb and secret-configmap-getter-rb needs to be created for fission-fetcher
// and fission-builder service accounts.
// This is because, we just deleted the ClusterRoleBindings for these service accounts in the previous function and
// for the existing functions to work, we need to give these SAs the right privileges
func (client *PreUpgradeTaskClient) NeedRoleBindings() bool {
pkgList, err := client.fissionClient.CoreV1().Packages(metav1.NamespaceDefault).List(metav1.ListOptions{})
if err == nil && len(pkgList.Items) > 0 {
return true
}
fnList, err := client.fissionClient.CoreV1().Functions(metav1.NamespaceDefault).List(metav1.ListOptions{})
if err == nil && len(fnList.Items) > 0 {
return true
}
return false
}
// SetupRoleBindings sets appropriate role bindings for fission-fetcher and fission-builder SAs
func (client *PreUpgradeTaskClient) SetupRoleBindings() {
if !client.NeedRoleBindings() {
client.logger.Info("no fission objects found, so no role-bindings to create")
return
}
// the fact that we're here implies that there had been a prior installation of fission and objects are present still
// so, we go ahead and create the role-bindings necessary for the fission-fetcher and fission-builder Service Accounts.
err := utils.SetupRoleBinding(client.logger, client.k8sClient, fv1.PackageGetterRB, metav1.NamespaceDefault, fv1.PackageGetterCR, fv1.ClusterRole, fv1.FissionFetcherSA, client.fnPodNs)
if err != nil {
client.logger.Fatal("error setting up rolebinding for service account",
zap.Error(err),
zap.String("role_binding", fv1.PackageGetterRB),
zap.String("service_account", fv1.FissionFetcherSA),
zap.String("service_account_namespace", client.fnPodNs))
}
err = utils.SetupRoleBinding(client.logger, client.k8sClient, fv1.PackageGetterRB, metav1.NamespaceDefault, fv1.PackageGetterCR, fv1.ClusterRole, fv1.FissionBuilderSA, client.envBuilderNs)
if err != nil {
client.logger.Fatal("error setting up rolebinding for service account",
zap.Error(err),
zap.String("role_binding", fv1.PackageGetterRB),
zap.String("service_account", fv1.FissionBuilderSA),
zap.String("service_account_namespace", client.envBuilderNs))
}
err = utils.SetupRoleBinding(client.logger, client.k8sClient, fv1.SecretConfigMapGetterRB, metav1.NamespaceDefault, fv1.SecretConfigMapGetterCR, fv1.ClusterRole, fv1.FissionFetcherSA, client.fnPodNs)
if err != nil {
client.logger.Fatal("error setting up rolebinding for service account",
zap.Error(err),
zap.String("role_binding", fv1.SecretConfigMapGetterRB),
zap.String("service_account", fv1.FissionFetcherSA),
zap.String("service_account_namespace", client.fnPodNs))
}
client.logger.Info("created rolebindings in default namespace",
zap.Strings("role_bindings", []string{fv1.PackageGetterRB, fv1.SecretConfigMapGetterRB}))
}