Skip to content

Commit 21d7769

Browse files
stevekuznetsovstevekuznetsov
committed
*: add acrpull controller, binding
Signed-off-by: Steve Kuznetsov <[email protected]>
1 parent 91aa5af commit 21d7769

25 files changed

+870
-2
lines changed

‎acrpull/Makefile

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
-include ../setup-env.mk
2+
3+
deploy:
4+
kubectl create namespace acrpull --dry-run=client -o json | kubectl apply -f - && \
5+
helm upgrade --install ${HELM_DRY_RUN} acrpull \
6+
deploy/helm/acrpull/ \
7+
--set image=mcr.microsoft.com/aks/msi-acrpull@${ACRPULL_DIGEST} \
8+
--namespace acrpull
9+
.PHONY: deploy
10+
11+
undeploy:
12+
helm uninstall acrpull --namespace acrpull
13+
.PHONY: undeploy

‎acrpull/deploy/helm/acrpull/Chart.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v2
2+
name: acrpull
3+
description: Controller for injecting pull credentials from managed identities into AKS clusters.
4+
type: application
5+
version: 0.1.0
6+
appVersion: "v0.1.5"

‎acrpull/deploy/helm/acrpull/templates/acrpull.microsoft.com_acrpullbindings.yaml

+175
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,175 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
annotations:
6+
controller-gen.kubebuilder.io/version: v0.14.0
7+
name: acrpullbindings.acrpull.microsoft.com
8+
spec:
9+
group: acrpull.microsoft.com
10+
names:
11+
kind: AcrPullBinding
12+
listKind: AcrPullBindingList
13+
plural: acrpullbindings
14+
shortNames:
15+
- apb
16+
- apbs
17+
singular: acrpullbinding
18+
scope: Namespaced
19+
versions:
20+
- name: v1beta2
21+
schema:
22+
openAPIV3Schema:
23+
description: AcrPullBinding is the Schema for the acrpullbindings API
24+
properties:
25+
apiVersion:
26+
description: |-
27+
APIVersion defines the versioned schema of this representation of an object.
28+
Servers should convert recognized schemas to the latest internal value, and
29+
may reject unrecognized values.
30+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
31+
type: string
32+
kind:
33+
description: |-
34+
Kind is a string value representing the REST resource this object represents.
35+
Servers may infer this from the endpoint the client submits requests to.
36+
Cannot be updated.
37+
In CamelCase.
38+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
39+
type: string
40+
metadata:
41+
type: object
42+
spec:
43+
description: AcrPullBindingSpec defines the desired state of AcrPullBinding
44+
properties:
45+
acr:
46+
description: ACR holds specifics of the Azure Container Registry for
47+
which credentials are projected.
48+
properties:
49+
cloudConfig:
50+
description: AirgappedCloudConfiguration configures a custom cloud
51+
to interact with when running air-gapped.
52+
properties:
53+
entraAuthorityHost:
54+
description: EntraAuthorityHost configures a custom Entra
55+
host endpoint.
56+
minLength: 1
57+
type: string
58+
resourceManagerAudience:
59+
description: ResourceManagerAudience configures the audience
60+
for which tokens will be requested from Entra.
61+
minLength: 1
62+
type: string
63+
required:
64+
- entraAuthorityHost
65+
- resourceManagerAudience
66+
type: object
67+
environment:
68+
default: PublicCloud
69+
description: Environment specifies the Azure Cloud environment
70+
in which the ACR is deployed.
71+
enum:
72+
- PublicCloud
73+
- USGovernmentCloud
74+
- ChinaCloud
75+
- AirgappedCloud
76+
example: PublicCloud
77+
type: string
78+
scope:
79+
description: |-
80+
Scope defines the scope for the access token, e.g. pull/push access for a repository.
81+
Note: you need to pin it down to the repository level, there is no wildcard available,
82+
however a list of space-delimited scopes is acceptable.
83+
See docs for details: https://distribution.github.io/distribution/spec/auth/scope/
84+
85+
86+
Examples:
87+
repository:my-repository:pull,push
88+
repository:my-repository:pull repository:other-repository:push,pull
89+
example: repository:my-repository:pull,push
90+
minLength: 1
91+
type: string
92+
server:
93+
description: Server is the FQDN for the Azure Container Registry,
94+
e.g. example.azurecr.io
95+
example: example.azurecr.io
96+
type: string
97+
x-kubernetes-validations:
98+
- message: server must be a fully-qualified domain name
99+
rule: isURL('https://' + self) && url('https://' + self).getHostname()
100+
== self
101+
required:
102+
- environment
103+
- scope
104+
- server
105+
type: object
106+
x-kubernetes-validations:
107+
- message: a custom cloud configuration must be present for air-gapped
108+
cloud environments
109+
rule: 'self.environment == ''ArigappedCloud'' ? has(self.cloudConfig)
110+
: !has(self.cloudConfig)'
111+
auth:
112+
description: Auth determines how we will authenticate to the Azure
113+
Container Registry. Only one method may be provided.
114+
properties:
115+
managedIdentity:
116+
description: ManagedIdentity uses Azure Managed Identity to authenticate
117+
with Azure.
118+
properties:
119+
clientID:
120+
description: ClientID is the client identifier for the managed
121+
identity. Either provide the client ID or the resource ID.
122+
example: 1b461305-28be-5271-beda-bd9fd2e24251
123+
type: string
124+
resourceID:
125+
description: ResourceID is the resource identifier for the
126+
managed identity. Either provide the client ID or the resource
127+
ID.
128+
example: /subscriptions/sub-name/resourceGroups/rg-name/providers/Microsoft.ManagedIdentity/userAssignedIdentities/1b461305-28be-5271-beda-bd9fd2e24251
129+
type: string
130+
type: object
131+
x-kubernetes-validations:
132+
- message: only client or resource ID can be set
133+
rule: '[has(self.clientID), has(self.resourceID)].exists_one(x,
134+
x)'
135+
workloadIdentity:
136+
description: WorkloadIdentity uses Azure Workload Identity to
137+
authenticate with Azure.
138+
properties:
139+
serviceAccountRef:
140+
description: |-
141+
ServiceAccountName specifies the name of the service account
142+
that should be used when authenticating with WorkloadIdentity.
143+
type: string
144+
type: object
145+
type: object
146+
x-kubernetes-validations:
147+
- message: only one authentication type can be set
148+
rule: '[has(self.managedIdentity), has(self.workloadIdentity)].exists_one(x,
149+
x)'
150+
serviceAccountName:
151+
description: The name of the service account to associate the image
152+
pull secret with.
153+
type: string
154+
type: object
155+
status:
156+
description: AcrPullBindingStatus defines the observed state of AcrPullBinding
157+
properties:
158+
error:
159+
description: Error message if there was an error updating the token.
160+
type: string
161+
lastTokenRefreshTime:
162+
description: Information when was the last time the ACR token was
163+
refreshed.
164+
format: date-time
165+
type: string
166+
tokenExpirationTime:
167+
description: The expiration date of the current ACR token.
168+
format: date-time
169+
type: string
170+
type: object
171+
type: object
172+
served: true
173+
storage: true
174+
subresources:
175+
status: {}

‎acrpull/deploy/helm/acrpull/templates/controller_role.yaml

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: acrpull-controller
5+
rules:
6+
- apiGroups:
7+
- ""
8+
resources:
9+
- secrets
10+
verbs:
11+
- '*'
12+
- apiGroups:
13+
- ""
14+
resources:
15+
- serviceaccounts
16+
verbs:
17+
- get
18+
- list
19+
- patch
20+
- update
21+
- watch
22+
- apiGroups:
23+
- ""
24+
resources:
25+
- serviceaccounts/token
26+
verbs:
27+
- create
28+
- apiGroups:
29+
- acrpull.microsoft.com
30+
resources:
31+
- acrpullbindings
32+
verbs:
33+
- create
34+
- delete
35+
- get
36+
- list
37+
- patch
38+
- update
39+
- watch
40+
- apiGroups:
41+
- acrpull.microsoft.com
42+
resources:
43+
- acrpullbindings/finalizers
44+
verbs:
45+
- update
46+
- apiGroups:
47+
- acrpull.microsoft.com
48+
resources:
49+
- acrpullbindings/status
50+
verbs:
51+
- get
52+
- patch
53+
- update
54+
- apiGroups:
55+
- msi-acrpull.microsoft.com
56+
resources:
57+
- acrpullbindings
58+
verbs:
59+
- create
60+
- delete
61+
- get
62+
- list
63+
- patch
64+
- update
65+
- watch
66+
- apiGroups:
67+
- msi-acrpull.microsoft.com
68+
resources:
69+
- acrpullbindings/finalizers
70+
verbs:
71+
- update
72+
- apiGroups:
73+
- msi-acrpull.microsoft.com
74+
resources:
75+
- acrpullbindings/status
76+
verbs:
77+
- get
78+
- patch
79+
- update

‎acrpull/deploy/helm/acrpull/templates/controller_role_binding.yaml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
labels:
5+
app.kubernetes.io/name: acrpull
6+
app.kubernetes.io/managed-by: Helm
7+
name: acrpull-controller-binding
8+
roleRef:
9+
apiGroup: rbac.authorization.k8s.io
10+
kind: ClusterRole
11+
name: acrpull-controller
12+
subjects:
13+
- kind: ServiceAccount
14+
name: acrpull
15+
namespace: {{ .Values.namespace }}

‎acrpull/deploy/helm/acrpull/templates/deployment.yaml

+77
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: acrpull
5+
namespace: {{ .Values.namespace }}
6+
labels:
7+
app.kubernetes.io/name: acrpull
8+
app.kubernetes.io/managed-by: Helm
9+
spec:
10+
selector:
11+
matchLabels:
12+
app.kubernetes.io/name: acrpull
13+
replicas: 2
14+
template:
15+
metadata:
16+
labels:
17+
app.kubernetes.io/name: acrpull
18+
spec:
19+
securityContext:
20+
runAsNonRoot: true
21+
containers:
22+
- command:
23+
- /manager
24+
args:
25+
- "--health-probe-bind-address=:8081"
26+
- "--metrics-bind-address=127.0.0.1:8080"
27+
- "--leader-elect"
28+
image: "{{ .Values.image }}"
29+
name: acrpull-controller
30+
ports:
31+
- containerPort: 8080
32+
protocol: TCP
33+
name: metrics
34+
securityContext:
35+
runAsNonRoot: true
36+
seccompProfile:
37+
type: RuntimeDefault
38+
allowPrivilegeEscalation: false
39+
capabilities:
40+
drop:
41+
- "ALL"
42+
readOnlyRootFilesystem: true
43+
runAsUser: 1000
44+
runAsGroup: 3000
45+
livenessProbe:
46+
httpGet:
47+
path: /healthz
48+
port: 8081
49+
initialDelaySeconds: 15
50+
periodSeconds: 20
51+
readinessProbe:
52+
httpGet:
53+
path: /readyz
54+
port: 8081
55+
initialDelaySeconds: 5
56+
periodSeconds: 10
57+
resources:
58+
limits:
59+
cpu: 100m
60+
memory: 100Mi
61+
requests:
62+
cpu: 100m
63+
memory: 20Mi
64+
serviceAccountName: acrpull
65+
terminationGracePeriodSeconds: 10
66+
{{- with .Values.nodeSelector }}
67+
nodeSelector:
68+
{{- toYaml . | nindent 8 }}
69+
{{- end }}
70+
{{- with .Values.affinity }}
71+
affinity:
72+
{{- toYaml . | nindent 8 }}
73+
{{- end }}
74+
{{- with .Values.tolerations }}
75+
tolerations:
76+
{{- toYaml . | nindent 8 }}
77+
{{- end }}

0 commit comments

Comments
 (0)