Skip to content

Commit 26b5962

Browse files
ctroughtctrought
authored
change from hostPath mounts to TZ environment variable, update RBAC for finalizers (kubesphere#148)
* generate rbac for controller * remove hostPath mounts, add TZ environment variable * add finalizers to markers for OwnerReferencesPermissionEnforcement enabled clusters * add TZ env var * add env to NM schema * update nm rbac markers * rebase
1 parent 6b0e9c1 commit 26b5962

File tree

16 files changed

+394
-87
lines changed

16 files changed

+394
-87
lines changed

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ undeploy:
6969

7070
# Generate manifests e.g. CRD, RBAC etc.
7171
manifests: controller-gen
72-
$(CONTROLLER_GEN) $(CRD_OPTIONS) rbac:roleName=controller-role webhook paths=./pkg/apis/v2beta1 paths=./pkg/apis/v2beta2 output:crd:artifacts:config=config/crd/bases
72+
$(CONTROLLER_GEN) $(CRD_OPTIONS) rbac:roleName=controller-role webhook paths=./pkg/apis/v2beta1 paths=./pkg/apis/v2beta2 paths=./controllers output:crd:artifacts:config=config/crd/bases
7373
cd config/manager && kustomize edit set image controller=${IMG} && cd ../../
7474
kustomize build config/default | sed -e '/creationTimestamp/d' > config/bundle.yaml
7575
kustomize build config/samples | sed -e '/creationTimestamp/d' > config/samples/bundle.yaml

‎adapter/deploy/yaml/adapter.yaml‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,9 @@ spec:
1919
args:
2020
- --with-stdout=true
2121
imagePullPolicy: Always
22-
volumeMounts:
23-
- mountPath: /etc/localtime
24-
name: host-time
25-
readOnly: true
22+
env:
23+
- name: TZ
24+
value: GMT
2625
lifecycle:
2726
preStop:
2827
httpGet:
@@ -48,12 +47,6 @@ spec:
4847
requests:
4948
cpu: 20m
5049
memory: 50Mi
51-
volumes:
52-
- hostPath:
53-
path: /etc/localtime
54-
type: ""
55-
name: host-time
56-
5750
---
5851
apiVersion: v1
5952
kind: Service

‎adapter/test/samples/socket.yaml‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -19,16 +19,12 @@ spec:
1919
command:
2020
- socket-server
2121
imagePullPolicy: Always
22-
volumeMounts:
23-
- mountPath: /etc/localtime
24-
name: host-time
25-
readOnly: true
26-
volumes:
27-
- hostPath:
28-
path: /etc/localtime
29-
type: ""
30-
name: host-time
31-
22+
env:
23+
- name: NAMESPACE
24+
valueFrom:
25+
fieldRef:
26+
apiVersion: v1
27+
fieldPath: metadata.namespace
3228
---
3329
apiVersion: v1
3430
kind: Service

‎config/bundle.yaml‎

Lines changed: 117 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4808,6 +4808,109 @@ spec:
48084808
description: The default namespace to which notification manager secrets
48094809
belong.
48104810
type: string
4811+
env:
4812+
description: List of environment variable
4813+
items:
4814+
description: EnvVar represents an environment variable present in
4815+
a Container.
4816+
properties:
4817+
name:
4818+
description: Name of the environment variable. Must be a C_IDENTIFIER.
4819+
type: string
4820+
value:
4821+
description: 'Variable references $(VAR_NAME) are expanded using
4822+
the previous defined environment variables in the container
4823+
and any service environment variables. If a variable cannot
4824+
be resolved, the reference in the input string will be unchanged.
4825+
The $(VAR_NAME) syntax can be escaped with a double $$, ie:
4826+
$$(VAR_NAME). Escaped references will never be expanded, regardless
4827+
of whether the variable exists or not. Defaults to "".'
4828+
type: string
4829+
valueFrom:
4830+
description: Source for the environment variable's value. Cannot
4831+
be used if value is not empty.
4832+
properties:
4833+
configMapKeyRef:
4834+
description: Selects a key of a ConfigMap.
4835+
properties:
4836+
key:
4837+
description: The key to select.
4838+
type: string
4839+
name:
4840+
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
4841+
TODO: Add other useful fields. apiVersion, kind, uid?'
4842+
type: string
4843+
optional:
4844+
description: Specify whether the ConfigMap or its key
4845+
must be defined
4846+
type: boolean
4847+
required:
4848+
- key
4849+
type: object
4850+
fieldRef:
4851+
description: 'Selects a field of the pod: supports metadata.name,
4852+
metadata.namespace, `metadata.labels[''<KEY>'']`, `metadata.annotations[''<KEY>'']`,
4853+
spec.nodeName, spec.serviceAccountName, status.hostIP,
4854+
status.podIP, status.podIPs.'
4855+
properties:
4856+
apiVersion:
4857+
description: Version of the schema the FieldPath is
4858+
written in terms of, defaults to "v1".
4859+
type: string
4860+
fieldPath:
4861+
description: Path of the field to select in the specified
4862+
API version.
4863+
type: string
4864+
required:
4865+
- fieldPath
4866+
type: object
4867+
resourceFieldRef:
4868+
description: 'Selects a resource of the container: only
4869+
resources limits and requests (limits.cpu, limits.memory,
4870+
limits.ephemeral-storage, requests.cpu, requests.memory
4871+
and requests.ephemeral-storage) are currently supported.'
4872+
properties:
4873+
containerName:
4874+
description: 'Container name: required for volumes,
4875+
optional for env vars'
4876+
type: string
4877+
divisor:
4878+
anyOf:
4879+
- type: integer
4880+
- type: string
4881+
description: Specifies the output format of the exposed
4882+
resources, defaults to "1"
4883+
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
4884+
x-kubernetes-int-or-string: true
4885+
resource:
4886+
description: 'Required: resource to select'
4887+
type: string
4888+
required:
4889+
- resource
4890+
type: object
4891+
secretKeyRef:
4892+
description: Selects a key of a secret in the pod's namespace
4893+
properties:
4894+
key:
4895+
description: The key of the secret to select from. Must
4896+
be a valid secret key.
4897+
type: string
4898+
name:
4899+
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
4900+
TODO: Add other useful fields. apiVersion, kind, uid?'
4901+
type: string
4902+
optional:
4903+
description: Specify whether the Secret or its key must
4904+
be defined
4905+
type: boolean
4906+
required:
4907+
- key
4908+
type: object
4909+
type: object
4910+
required:
4911+
- name
4912+
type: object
4913+
type: array
48114914
groupLabels:
48124915
description: Labels for grouping notifiations.
48134916
items:
@@ -10924,12 +11027,19 @@ rules:
1092411027
- apiGroups:
1092511028
- ""
1092611029
resources:
10927-
- secrets
1092811030
- configmaps
1092911031
verbs:
1093011032
- get
1093111033
- list
1093211034
- watch
11035+
- apiGroups:
11036+
- ""
11037+
resources:
11038+
- secrets
11039+
verbs:
11040+
- get
11041+
- list
11042+
- watch
1093311043
- apiGroups:
1093411044
- ""
1093511045
resources:
@@ -10958,6 +11068,12 @@ rules:
1095811068
- patch
1095911069
- update
1096011070
- watch
11071+
- apiGroups:
11072+
- notification.kubesphere.io
11073+
resources:
11074+
- notificationmanagers/finalizers
11075+
verbs:
11076+
- update
1096111077
- apiGroups:
1096211078
- notification.kubesphere.io
1096311079
resources:
@@ -11127,9 +11243,6 @@ spec:
1112711243
- mountPath: /tmp/k8s-webhook-server/serving-certs
1112811244
name: cert
1112911245
readOnly: true
11130-
- mountPath: /etc/localtime
11131-
name: host-time
11132-
readOnly: true
1113311246
- args:
1113411247
- --secure-listen-address=0.0.0.0:8443
1113511248
- --upstream=http://127.0.0.1:8080/
@@ -11147,10 +11260,6 @@ spec:
1114711260
secret:
1114811261
defaultMode: 420
1114911262
secretName: notification-manager-webhook-server-cert
11150-
- hostPath:
11151-
path: /etc/localtime
11152-
type: ""
11153-
name: host-time
1115411263
---
1115511264
apiVersion: admissionregistration.k8s.io/v1
1115611265
kind: ValidatingWebhookConfiguration

‎config/crd/bases/notification.kubesphere.io_notificationmanagers.yaml‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3668,6 +3668,109 @@ spec:
36683668
description: The default namespace to which notification manager secrets
36693669
belong.
36703670
type: string
3671+
env:
3672+
description: List of environment variable
3673+
items:
3674+
description: EnvVar represents an environment variable present in
3675+
a Container.
3676+
properties:
3677+
name:
3678+
description: Name of the environment variable. Must be a C_IDENTIFIER.
3679+
type: string
3680+
value:
3681+
description: 'Variable references $(VAR_NAME) are expanded using
3682+
the previous defined environment variables in the container
3683+
and any service environment variables. If a variable cannot
3684+
be resolved, the reference in the input string will be unchanged.
3685+
The $(VAR_NAME) syntax can be escaped with a double $$, ie:
3686+
$$(VAR_NAME). Escaped references will never be expanded, regardless
3687+
of whether the variable exists or not. Defaults to "".'
3688+
type: string
3689+
valueFrom:
3690+
description: Source for the environment variable's value. Cannot
3691+
be used if value is not empty.
3692+
properties:
3693+
configMapKeyRef:
3694+
description: Selects a key of a ConfigMap.
3695+
properties:
3696+
key:
3697+
description: The key to select.
3698+
type: string
3699+
name:
3700+
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3701+
TODO: Add other useful fields. apiVersion, kind, uid?'
3702+
type: string
3703+
optional:
3704+
description: Specify whether the ConfigMap or its key
3705+
must be defined
3706+
type: boolean
3707+
required:
3708+
- key
3709+
type: object
3710+
fieldRef:
3711+
description: 'Selects a field of the pod: supports metadata.name,
3712+
metadata.namespace, `metadata.labels[''<KEY>'']`, `metadata.annotations[''<KEY>'']`,
3713+
spec.nodeName, spec.serviceAccountName, status.hostIP,
3714+
status.podIP, status.podIPs.'
3715+
properties:
3716+
apiVersion:
3717+
description: Version of the schema the FieldPath is
3718+
written in terms of, defaults to "v1".
3719+
type: string
3720+
fieldPath:
3721+
description: Path of the field to select in the specified
3722+
API version.
3723+
type: string
3724+
required:
3725+
- fieldPath
3726+
type: object
3727+
resourceFieldRef:
3728+
description: 'Selects a resource of the container: only
3729+
resources limits and requests (limits.cpu, limits.memory,
3730+
limits.ephemeral-storage, requests.cpu, requests.memory
3731+
and requests.ephemeral-storage) are currently supported.'
3732+
properties:
3733+
containerName:
3734+
description: 'Container name: required for volumes,
3735+
optional for env vars'
3736+
type: string
3737+
divisor:
3738+
anyOf:
3739+
- type: integer
3740+
- type: string
3741+
description: Specifies the output format of the exposed
3742+
resources, defaults to "1"
3743+
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
3744+
x-kubernetes-int-or-string: true
3745+
resource:
3746+
description: 'Required: resource to select'
3747+
type: string
3748+
required:
3749+
- resource
3750+
type: object
3751+
secretKeyRef:
3752+
description: Selects a key of a secret in the pod's namespace
3753+
properties:
3754+
key:
3755+
description: The key of the secret to select from. Must
3756+
be a valid secret key.
3757+
type: string
3758+
name:
3759+
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
3760+
TODO: Add other useful fields. apiVersion, kind, uid?'
3761+
type: string
3762+
optional:
3763+
description: Specify whether the Secret or its key must
3764+
be defined
3765+
type: boolean
3766+
required:
3767+
- key
3768+
type: object
3769+
type: object
3770+
required:
3771+
- name
3772+
type: object
3773+
type: array
36713774
groupLabels:
36723775
description: Labels for grouping notifiations.
36733776
items:

‎config/manager/manager.yaml‎

Lines changed: 5 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -31,19 +31,10 @@ spec:
3131
requests:
3232
cpu: 100m
3333
memory: 20Mi
34-
volumeMounts:
35-
- mountPath: /etc/localtime
36-
name: host-time
37-
readOnly: true
3834
env:
39-
- name: NAMESPACE
40-
valueFrom:
41-
fieldRef:
42-
apiVersion: v1
43-
fieldPath: metadata.namespace
44-
volumes:
45-
- hostPath:
46-
path: /etc/localtime
47-
type: ""
48-
name: host-time
35+
- name: NAMESPACE
36+
valueFrom:
37+
fieldRef:
38+
apiVersion: v1
39+
fieldPath: metadata.namespace
4940
terminationGracePeriodSeconds: 10

‎config/rbac/role.yaml‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,19 @@ rules:
2121
- apiGroups:
2222
- ""
2323
resources:
24-
- secrets
2524
- configmaps
2625
verbs:
2726
- get
2827
- list
2928
- watch
29+
- apiGroups:
30+
- ""
31+
resources:
32+
- secrets
33+
verbs:
34+
- get
35+
- list
36+
- watch
3037
- apiGroups:
3138
- ""
3239
resources:
@@ -55,6 +62,12 @@ rules:
5562
- patch
5663
- update
5764
- watch
65+
- apiGroups:
66+
- notification.kubesphere.io
67+
resources:
68+
- notificationmanagers/finalizers
69+
verbs:
70+
- update
5871
- apiGroups:
5972
- notification.kubesphere.io
6073
resources:
@@ -63,4 +76,3 @@ rules:
6376
- get
6477
- patch
6578
- update
66-

0 commit comments

Comments
 (0)