multi-tenant: EnsureNamespaceSA + ns_watcher SA provisioning (v8)

2026-04-26 07:41:46 +03:00
parent 82e1ff76a5
commit 161de70576
24 changed files with 970 additions and 1 deletions
@@ -0,0 +1,80 @@
+// Package buildermgr — NSWatcher for multi-tenant mode.
+//
+// Listens for Namespaces labeled fission.io/managed=true and calls
+// AddNamespace on envWatcher and packageWatcher so they pick up
+// Environments and Packages in new tenant namespaces without a restart.
+package buildermgr
+
+import (
+	"context"
+	"time"
+
+	"go.uber.org/zap"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	k8sInformers "k8s.io/client-go/informers"
+	"k8s.io/client-go/kubernetes"
+	k8sCache "k8s.io/client-go/tools/cache"
+
+	"github.com/fission/fission/pkg/utils/manager"
+)
+
+const builderManagedNSLabel = "fission.io/managed"
+
+// StartNSWatcher watches for Namespaces labeled fission.io/managed=true
+// and immediately registers per-NS informers in envWatcher and pkgWatcher.
+func StartNSWatcher(
+	ctx context.Context,
+	logger *zap.Logger,
+	kubeClient kubernetes.Interface,
+	envw *environmentWatcher,
+	pkgw *packageWatcher,
+	mgr manager.Interface,
+) {
+	factory := k8sInformers.NewSharedInformerFactoryWithOptions(
+		kubeClient,
+		30*time.Minute,
+		k8sInformers.WithTweakListOptions(func(opts *metav1.ListOptions) {
+			opts.LabelSelector = builderManagedNSLabel + "=true"
+		}),
+	)
+
+	nsInformer := factory.Core().V1().Namespaces().Informer()
+
+	_, _ = nsInformer.AddEventHandler(k8sCache.ResourceEventHandlerFuncs{
+		AddFunc: func(obj interface{}) {
+			ns := builderNSName(obj)
+			if ns == "" {
+				return
+			}
+			envw.AddNamespace(ctx, ns, mgr)
+			pkgw.AddNamespace(ctx, ns, mgr)
+		},
+		UpdateFunc: func(_, newObj interface{}) {
+			nsObj, ok := newObj.(*corev1.Namespace)
+			if !ok || nsObj.Labels[builderManagedNSLabel] != "true" {
+				return
+			}
+			envw.AddNamespace(ctx, nsObj.Name, mgr)
+			pkgw.AddNamespace(ctx, nsObj.Name, mgr)
+		},
+	})
+
+	mgr.Add(ctx, func(ctx context.Context) {
+		logger.Info("buildermgr.NSWatcher: started",
+			zap.String("label", builderManagedNSLabel+"=true"))
+		factory.Start(ctx.Done())
+		factory.WaitForCacheSync(ctx.Done())
+		logger.Info("buildermgr.NSWatcher: cache synced — watching for new namespaces")
+		<-ctx.Done()
+		logger.Info("buildermgr.NSWatcher: stopped")
+	})
+}
+
+func builderNSName(obj interface{}) string {
+	nsObj, ok := obj.(*corev1.Namespace)
+	if !ok {
+		return ""
+	}
+	return nsObj.Name
+}