Skip to content

Commit b1dbc3e

Browse files
justinsbjustinsb
committed
ServiceIdentity: support cloudservices.gserviceaccount.com
This is an unusual P4SA, that is the P4SA for Managed Instance Groups (MIGs)
1 parent 9836755 commit b1dbc3e

File tree

6 files changed

+167
-52
lines changed

6 files changed

+167
-52
lines changed

‎pkg/controller/direct/registry/registry.go

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,9 @@ type registration struct {
3636
gvk schema.GroupVersionKind
3737
factory ModelFactoryFunc
3838
model directbase.Model
39-
rg predicate.ReconcileGate
39+
40+
// reconcileGate is a condition, we will reconcile only objects matching the specified condition
41+
reconcileGate predicate.ReconcileGate
4042
}
4143

4244
type ModelFactoryFunc func(ctx context.Context, config *config.ControllerConfig) (directbase.Model, error)
@@ -51,7 +53,7 @@ func GetModel(gk schema.GroupKind) (directbase.Model, error) {
5153

5254
func GetReconcileGate(gk schema.GroupKind) predicate.ReconcileGate {
5355
registration := singleton.registrations[gk]
54-
return registration.rg
56+
return registration.reconcileGate
5557
}
5658

5759
func PreferredGVK(gk schema.GroupKind) (schema.GroupVersionKind, bool) {
@@ -97,14 +99,14 @@ func RegisterModel(gvk schema.GroupVersionKind, modelFn ModelFactoryFunc) {
9799
RegisterModelWithReconcileGate(gvk, modelFn, rg)
98100
}
99101

100-
func RegisterModelWithReconcileGate(gvk schema.GroupVersionKind, modelFn ModelFactoryFunc, rg predicate.ReconcileGate) {
102+
func RegisterModelWithReconcileGate(gvk schema.GroupVersionKind, modelFn ModelFactoryFunc, reconcileGate predicate.ReconcileGate) {
101103
if singleton.registrations == nil {
102104
singleton.registrations = make(map[schema.GroupKind]*registration)
103105
}
104106
singleton.registrations[gvk.GroupKind()] = &registration{
105-
gvk: gvk,
106-
factory: modelFn,
107-
rg: rg,
107+
gvk: gvk,
108+
factory: modelFn,
109+
reconcileGate: reconcileGate,
108110
}
109111
}
110112

‎pkg/controller/direct/secretmanager/secret_controller.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,8 @@ const (
4444
)
4545

4646
func init() {
47-
rg := &SecretReconcileGate{}
48-
registry.RegisterModelWithReconcileGate(krm.SecretManagerSecretGVK, NewModel, rg)
47+
reconcileGate := &SecretReconcileGate{}
48+
registry.RegisterModelWithReconcileGate(krm.SecretManagerSecretGVK, NewModel, reconcileGate)
4949
}
5050

5151
type SecretReconcileGate struct {

‎pkg/controller/direct/serviceusage/serviceidentity_controller.go

Lines changed: 87 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,13 @@ import (
2626
"fmt"
2727
"time"
2828

29+
"github.com/GoogleCloudPlatform/k8s-config-connector/apis/common/projects"
2930
krm "github.com/GoogleCloudPlatform/k8s-config-connector/apis/serviceusage/v1beta1"
3031
"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/config"
3132
"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/controller/direct"
3233
"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/controller/direct/directbase"
3334
"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/controller/direct/registry"
35+
kccpredicate "github.com/GoogleCloudPlatform/k8s-config-connector/pkg/controller/predicate"
3436

3537
gcp "google.golang.org/api/serviceusage/v1beta1"
3638
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
@@ -39,8 +41,35 @@ import (
3941
"sigs.k8s.io/controller-runtime/pkg/client"
4042
)
4143

44+
// GoogleApisServiceAgent was historically used by multiple services, but for more granular permission control we moved to P4SAs instead.
45+
// MIGs were tricky to move though, and so instead of switching to a P4SA, they adopted the GoogleApisServiceAgent as their P4SA
46+
// We still want to support this though, so we recognize this "magic value"
47+
const GoogleApisServiceAgent = "cloudservices.gserviceaccount.com"
48+
4249
func init() {
43-
registry.RegisterModel(krm.ServiceIdentityGVK, NewServiceIdentityModel)
50+
reconcileGate := &SecretReconcileGate{}
51+
registry.RegisterModelWithReconcileGate(krm.ServiceIdentityGVK, NewServiceIdentityModel, reconcileGate)
52+
}
53+
54+
type SecretReconcileGate struct {
55+
optIn kccpredicate.OptInToDirectReconciliation
56+
}
57+
58+
var _ kccpredicate.ReconcileGate = &SecretReconcileGate{}
59+
60+
func (r *SecretReconcileGate) ShouldReconcile(o *unstructured.Unstructured) bool {
61+
if r.optIn.ShouldReconcile(o) {
62+
return true
63+
}
64+
obj := &krm.ServiceIdentity{}
65+
if err := runtime.DefaultUnstructuredConverter.FromUnstructured(o.Object, &obj); err != nil {
66+
return false
67+
}
68+
serviceName := direct.ValueOf(obj.Spec.ResourceID)
69+
if serviceName == "" {
70+
serviceName = obj.GetName()
71+
}
72+
return serviceName == GoogleApisServiceAgent
4473
}
4574

4675
func NewServiceIdentityModel(ctx context.Context, config *config.ControllerConfig) (directbase.Model, error) {
@@ -74,9 +103,10 @@ func (m *serviceIdentityModel) AdapterForObject(ctx context.Context, reader clie
74103
return nil, err
75104
}
76105
return &serviceIdentityAdapter{
77-
gcpBeta: gcpBeta,
78-
id: id.(*krm.ServiceIdentityIdentity),
79-
desired: obj,
106+
gcpBeta: gcpBeta,
107+
id: id.(*krm.ServiceIdentityIdentity),
108+
desired: obj,
109+
projectMapper: m.config.ProjectMapper,
80110
}, nil
81111
}
82112

@@ -86,7 +116,9 @@ func (m *serviceIdentityModel) AdapterForURL(ctx context.Context, url string) (d
86116
}
87117

88118
type serviceIdentityAdapter struct {
89-
gcpBeta *gcp.APIService
119+
projectMapper *projects.ProjectMapper
120+
gcpBeta *gcp.APIService
121+
90122
id *krm.ServiceIdentityIdentity
91123
desired *krm.ServiceIdentity
92124
actual *gcp.ServiceIdentity // This will be populated from status or after generation
@@ -122,55 +154,66 @@ func (a *serviceIdentityAdapter) Create(ctx context.Context, createOp *directbas
122154
fqn := a.id.String()
123155
log.V(2).Info("generating service identity", "fqn", fqn)
124156

125-
// - parent: Name of the consumer and service to generate an identity for. The
126-
// `GenerateServiceIdentity` methods currently support projects, folders,
127-
// organizations. Example parents would be:
128-
// `projects/123/services/example.googleapis.com`
129-
// `folders/123/services/example.googleapis.com`
130-
// `organizations/123/services/example.googleapis.com`.
131-
132-
op, err := a.gcpBeta.Services.GenerateServiceIdentity(fqn).Context(ctx).Do()
133-
if err != nil {
134-
return fmt.Errorf("generating service identity for %q: %w", fqn, err)
135-
}
157+
status := &krm.ServiceIdentityStatus{}
158+
if a.id.Service == GoogleApisServiceAgent {
159+
// Special case: the MIG "P4SA" (which is also the "Google APIs Service Agent")
160+
// Format is always <projectNumber>@cloudservices.gserviceaccount.com
136161

137-
var serviceIdentity *gcp.GoogleApiServiceusageV1beta1ServiceIdentity
138-
for {
139-
if op.Done {
140-
klog.Warningf("RESPONSE IS %v", string(op.Response))
141-
klog.Warningf("FULL OPERATION IS %v", op)
142-
identity := &gcp.GoogleApiServiceusageV1beta1ServiceIdentity{}
143-
if err := json.Unmarshal(op.Response, identity); err != nil {
144-
return fmt.Errorf("error parsing response: %w", err)
145-
}
146-
serviceIdentity = identity
147-
break
148-
}
149-
time.Sleep(2 * time.Second)
150-
if err := ctx.Err(); err != nil {
151-
return err
162+
projectNumber, err := a.projectMapper.LookupProjectNumber(ctx, a.id.ParentID.ProjectID)
163+
if err != nil {
164+
return fmt.Errorf("looking up project number for %q: %w", a.id.ParentID.ProjectID, err)
152165
}
153-
op, err = a.gcpBeta.Operations.Get(op.Name).Context(ctx).Do()
166+
email := fmt.Sprintf("%[email protected]", projectNumber)
167+
status.Email = &email
168+
} else {
169+
// - parent: Name of the consumer and service to generate an identity for. The
170+
// `GenerateServiceIdentity` methods currently support projects, folders,
171+
// organizations. Example parents would be:
172+
// `projects/123/services/example.googleapis.com`
173+
// `folders/123/services/example.googleapis.com`
174+
// `organizations/123/services/example.googleapis.com`.
175+
176+
op, err := a.gcpBeta.Services.GenerateServiceIdentity(fqn).Context(ctx).Do()
154177
if err != nil {
155-
return fmt.Errorf("waiting for service identity generation for %q: %w", fqn, err)
178+
return fmt.Errorf("generating service identity for %q: %w", fqn, err)
156179
}
157-
}
158180

159-
log.V(2).Info("successfully generated service identity", "fqn", fqn, "identity.email", serviceIdentity.Email, "identity.uniqueId", serviceIdentity.UniqueId)
181+
var serviceIdentity *gcp.GoogleApiServiceusageV1beta1ServiceIdentity
182+
for {
183+
if op.Done {
184+
klog.Warningf("RESPONSE IS %v", string(op.Response))
185+
klog.Warningf("FULL OPERATION IS %v", op)
186+
identity := &gcp.GoogleApiServiceusageV1beta1ServiceIdentity{}
187+
if err := json.Unmarshal(op.Response, identity); err != nil {
188+
return fmt.Errorf("error parsing response: %w", err)
189+
}
190+
serviceIdentity = identity
191+
break
192+
}
193+
time.Sleep(2 * time.Second)
194+
if err := ctx.Err(); err != nil {
195+
return err
196+
}
197+
op, err = a.gcpBeta.Operations.Get(op.Name).Context(ctx).Do()
198+
if err != nil {
199+
return fmt.Errorf("waiting for service identity generation for %q: %w", fqn, err)
200+
}
201+
}
160202

161-
// It really doesn't seem worthwhile to use the mapper here
203+
log.V(2).Info("successfully generated service identity", "fqn", fqn, "identity.email", serviceIdentity.Email, "identity.uniqueId", serviceIdentity.UniqueId)
162204

163-
status := &krm.ServiceIdentityStatus{}
205+
// It really doesn't seem worthwhile to use the mapper here
164206

165-
// observedState := krm.ServiceIdentityObservedState{
166-
// Email: direct.ValueOf(serviceIdentity.Email),
167-
// UniqueID: direct.ValueOf(serviceIdentity.UniqueId),
168-
// }
207+
// observedState := krm.ServiceIdentityObservedState{
208+
// Email: direct.ValueOf(serviceIdentity.Email),
209+
// UniqueID: direct.ValueOf(serviceIdentity.UniqueId),
210+
// }
169211

170-
// status.ObservedState = &observedState
212+
// status.ObservedState = &observedState
171213

172-
status.Email = direct.LazyPtr(serviceIdentity.Email)
173-
// status.UniqueID = direct.LazyPtr(serviceIdentity.UniqueId)
214+
status.Email = direct.LazyPtr(serviceIdentity.Email)
215+
// status.UniqueID = direct.LazyPtr(serviceIdentity.UniqueId)
216+
}
174217

175218
// status.ExternalRef = direct.LazyPtr(parent)
176219
return createOp.UpdateStatus(ctx, status, nil)

‎pkg/test/resourcefixture/testdata/basic/serviceusage/v1beta1/serviceidentity/serviceidentity-gserviceaccount/_generated_object_serviceidentity-gserviceaccount.golden.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
apiVersion: serviceusage.cnrm.cloud.google.com/v1beta1
2+
kind: ServiceIdentity
3+
metadata:
4+
annotations:
5+
cnrm.cloud.google.com/management-conflict-prevention-policy: none
6+
finalizers:
7+
- cnrm.cloud.google.com/finalizer
8+
- cnrm.cloud.google.com/deletion-defender
9+
generation: 1
10+
labels:
11+
cnrm-test: "true"
12+
name: example
13+
namespace: ${uniqueId}
14+
spec:
15+
projectRef:
16+
external: ${projectId}
17+
resourceID: cloudservices.gserviceaccount.com
18+
status:
19+
conditions:
20+
- lastTransitionTime: "1970-01-01T00:00:00Z"
21+
message: The resource is up to date
22+
reason: UpToDate
23+
status: "True"
24+
type: Ready
25+
email: ${projectNumber}@cloudservices.gserviceaccount.com
26+
observedGeneration: 1

‎pkg/test/resourcefixture/testdata/basic/serviceusage/v1beta1/serviceidentity/serviceidentity-gserviceaccount/_http.log

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
GET https://cloudresourcemanager.googleapis.com/v3/projects/${projectId}?%24alt=json%3Benum-encoding%3Dint
2+
Content-Type: application/json
3+
User-Agent: kcc/${kccVersion} (+https://github.com/GoogleCloudPlatform/k8s-config-connector) kcc/controller-manager/${kccVersion}
4+
X-Goog-Request-Params: name=projects%2F${projectId}
5+
6+
200 OK
7+
Content-Type: application/json; charset=UTF-8
8+
Server: ESF
9+
Vary: Origin
10+
Vary: X-Origin
11+
Vary: Referer
12+
X-Content-Type-Options: nosniff
13+
X-Frame-Options: SAMEORIGIN
14+
X-Xss-Protection: 0
15+
16+
{
17+
"createTime": "2024-04-01T12:34:56.123456Z",
18+
"etag": "abcdef0123A=",
19+
"name": "projects/${projectNumber}",
20+
"projectId": "${projectId}",
21+
"state": 1
22+
}

‎pkg/test/resourcefixture/testdata/basic/serviceusage/v1beta1/serviceidentity/serviceidentity-gserviceaccount/create.yaml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Copyright 2025 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
apiVersion: serviceusage.cnrm.cloud.google.com/v1beta1
16+
kind: ServiceIdentity
17+
metadata:
18+
name: example
19+
spec:
20+
projectRef:
21+
external: ${projectId}
22+
resourceID: cloudservices.gserviceaccount.com

0 commit comments

Comments
 (0)