Skip to content

Commit 6b2f260

Browse files
bastjanbastjan
authored
Fix connection to vcluster (#6)
* Fix connection to vcluster * Add in cluster names to serving cert
1 parent ebe24ca commit 6b2f260

File tree

7 files changed

+72
-19
lines changed

7 files changed

+72
-19
lines changed

‎component/cluster.libsonnet

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -206,6 +206,12 @@ local cluster = function(name, options)
206206
emptyDir: {},
207207
},
208208
],
209+
local tlsSANs = [
210+
'--tls-san=%s.%s.svc.cluster.local' % [ name, options.namespace ],
211+
'--tls-san=%s.%s.svc' % [ name, options.namespace ],
212+
'--tls-san=%s.%s' % [ name, options.namespace ],
213+
'--tls-san=%s' % [ name ],
214+
],
209215
containers: [
210216
{
211217
image: formatImage(options.images.k3s),
@@ -233,7 +239,7 @@ local cluster = function(name, options)
233239
'--flannel-backend=none',
234240
'--service-cidr=%s' % options.host_service_cidr,
235241
'--kube-controller-manager-arg=controllers=*,-nodeipam,-nodelifecycle,-persistentvolume-binder,-attachdetach,-persistentvolume-expander,-cloud-node-lifecycle',
236-
] + options.k3s.additional_args,
242+
] + tlsSANs + options.k3s.additional_args,
237243
env: [],
238244
securityContext: {
239245
allowPrivilegeEscalation: false,
@@ -260,7 +266,7 @@ local cluster = function(name, options)
260266
args: [
261267
'--name=' + name,
262268
'--out-kube-config-secret=vc-%s-kubeconfig' % name,
263-
] + options.syncer.additional_args,
269+
] + tlsSANs + options.syncer.additional_args,
264270
livenessProbe: {
265271
httpGet: {
266272
path: '/healthz',
@@ -346,8 +352,8 @@ local cluster = function(name, options)
346352
headlessService,
347353
statefulSet,
348354
if options.ingress.host != null then ingress,
349-
if std.length(options.additional_manifests) > 0 then postSetup.ApplyManifests('%s-apply-manifests' % name, 'vc-%s-kubeconfig' % name, options.additional_manifests),
350-
if options.syn.registration_url != null then postSetup.Synthesize('%s-synthesize' % name, 'vc-%s-kubeconfig' % name, options.syn.registration_url),
355+
if std.length(options.additional_manifests) > 0 then postSetup.ApplyManifests(name, 'vc-%s-kubeconfig' % name, options.additional_manifests),
356+
if options.syn.registration_url != null then postSetup.Synthesize(name, 'vc-%s-kubeconfig' % name, options.syn.registration_url),
351357
] + if options.ocp_route.host != null then ocpRoute.RouteCreateJob(name, 'vc-%s-kubeconfig' % name, options.ocp_route.host) else []);
352358

353359
{

‎component/post-setup.libsonnet

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@ local kube = import 'lib/kube.libjsonnet';
44
local inv = kap.inventory();
55
local params = inv.parameters.vcluster;
66

7-
local synthesize = function(jobName, secretName, url)
7+
local synthesize = function(name, secretName, url)
8+
local jobName = '%s-synthesize' % name;
89
kube.Job(jobName) {
910
metadata+: {
1011
namespace: params.namespace,
@@ -23,6 +24,7 @@ local synthesize = function(jobName, secretName, url)
2324
args: [ '-eu', '-c', importstr './scripts/synthesize.sh', '--', url ],
2425
env: [
2526
{ name: 'HOME', value: '/export' },
27+
{ name: 'VCLUSTER_SERVER_URL', value: 'https://%s:443' % name },
2628
],
2729
volumeMounts: [
2830
{ name: 'export', mountPath: '/export' },
@@ -39,7 +41,8 @@ local synthesize = function(jobName, secretName, url)
3941
},
4042
};
4143

42-
local applyManifests = function(jobName, secretName, manifests)
44+
local applyManifests = function(name, secretName, manifests)
45+
local jobName = '%s-apply-manifests' % name;
4346
local manifestArray = if std.isArray(manifests) then
4447
manifests
4548
else if std.isObject(manifests) then
@@ -65,6 +68,7 @@ local applyManifests = function(jobName, secretName, manifests)
6568
args: [ '-eu', '-c', importstr './scripts/apply.sh', '--' ] + std.map(function(m) std.manifestJsonEx(m, ''), manifestArray),
6669
env: [
6770
{ name: 'HOME', value: '/export' },
71+
{ name: 'VCLUSTER_SERVER_URL', value: 'https://%s:443' % name },
6872
],
6973
volumeMounts: [
7074
{ name: 'export', mountPath: '/export' },

‎component/scripts/apply.sh

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
11
#!/bin/sh
22
set -eu
33

4-
vcluster_kubeconfig=/etc/vcluster-kubeconfig/config
4+
cp /etc/vcluster-kubeconfig/config ./config
5+
vcluster_kubeconfig=./config
6+
7+
echo "Setting server URL..."
8+
9+
kubectl --kubeconfig "$vcluster_kubeconfig" config set clusters.local.server "$VCLUSTER_SERVER_URL"
510

611
echo "Applying manifests..."
712

‎component/scripts/synthesize.sh

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
11
#!/bin/sh
22
set -eu
33

4-
vcluster_kubeconfig=/etc/vcluster-kubeconfig/config
4+
cp /etc/vcluster-kubeconfig/config ./config
5+
vcluster_kubeconfig=./config
6+
7+
echo "Setting server URL..."
8+
9+
kubectl --kubeconfig "$vcluster_kubeconfig" config set clusters.local.server "$VCLUSTER_SERVER_URL"
510

611
echo "Checking for namespace 'syn'..."
712

‎tests/golden/defaults/defaults/defaults/10_cluster.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,10 @@ spec:
158158
- --flannel-backend=none
159159
- --service-cidr=172.30.0.0/16
160160
- --kube-controller-manager-arg=controllers=*,-nodeipam,-nodelifecycle,-persistentvolume-binder,-attachdetach,-persistentvolume-expander,-cloud-node-lifecycle
161+
- --tls-san=defaults.syn-defaults.svc.cluster.local
162+
- --tls-san=defaults.syn-defaults.svc
163+
- --tls-san=defaults.syn-defaults
164+
- --tls-san=defaults
161165
command:
162166
- /bin/k3s
163167
env: []
@@ -177,6 +181,10 @@ spec:
177181
- args:
178182
- --name=defaults
179183
- --out-kube-config-secret=vc-defaults-kubeconfig
184+
- --tls-san=defaults.syn-defaults.svc.cluster.local
185+
- --tls-san=defaults.syn-defaults.svc
186+
- --tls-san=defaults.syn-defaults
187+
- --tls-san=defaults
180188
env: []
181189
image: docker.io/loftsh/vcluster:0.5.0-beta.0
182190
livenessProbe:

‎tests/golden/oidc/oidc/oidc/10_cluster.yaml

Lines changed: 28 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,10 @@ spec:
158158
- --flannel-backend=none
159159
- --service-cidr=172.30.0.0/16
160160
- --kube-controller-manager-arg=controllers=*,-nodeipam,-nodelifecycle,-persistentvolume-binder,-attachdetach,-persistentvolume-expander,-cloud-node-lifecycle
161+
- --tls-san=oidc.testns.svc.cluster.local
162+
- --tls-san=oidc.testns.svc
163+
- --tls-san=oidc.testns
164+
- --tls-san=oidc
161165
- --kube-apiserver-arg=oidc-issuer-url=https://id.local/auth/realms/local
162166
- --kube-apiserver-arg=oidc-client-id=local
163167
- --kube-apiserver-arg=oidc-username-claim=email
@@ -181,6 +185,10 @@ spec:
181185
- args:
182186
- --name=oidc
183187
- --out-kube-config-secret=vc-oidc-kubeconfig
188+
- --tls-san=oidc.testns.svc.cluster.local
189+
- --tls-san=oidc.testns.svc
190+
- --tls-san=oidc.testns
191+
- --tls-san=oidc
184192
env: []
185193
image: docker.io/loftsh/vcluster:0.5.0-beta.0
186194
livenessProbe:
@@ -262,10 +270,13 @@ spec:
262270
- args:
263271
- -eu
264272
- -c
265-
- "#!/bin/sh\nset -eu\n\nvcluster_kubeconfig=/etc/vcluster-kubeconfig/config\n\
266-
\necho \"Applying manifests...\"\n\nfor manifest in \"$@\"\ndo\n printf\
267-
\ \"$manifest\" | kubectl --kubeconfig \"$vcluster_kubeconfig\" apply\
268-
\ -f - -oyaml\ndone\n\necho \"Done!\"\n"
273+
- "#!/bin/sh\nset -eu\n\ncp /etc/vcluster-kubeconfig/config ./config\n\
274+
vcluster_kubeconfig=./config\n\necho \"Setting server URL...\"\n\nkubectl\
275+
\ --kubeconfig \"$vcluster_kubeconfig\" config set clusters.local.server\
276+
\ \"$VCLUSTER_SERVER_URL\"\n\necho \"Applying manifests...\"\n\nfor\
277+
\ manifest in \"$@\"\ndo\n printf \"$manifest\" | kubectl --kubeconfig\
278+
\ \"$vcluster_kubeconfig\" apply -f - -oyaml\ndone\n\necho \"Done!\"\
279+
\n"
269280
- --
270281
- '{
271282
@@ -307,6 +318,8 @@ spec:
307318
env:
308319
- name: HOME
309320
value: /export
321+
- name: VCLUSTER_SERVER_URL
322+
value: https://oidc:443
310323
image: quay.io/bitnami/kubectl:1.22.4
311324
imagePullPolicy: IfNotPresent
312325
name: oidc-apply-manifests
@@ -352,20 +365,24 @@ spec:
352365
- args:
353366
- -eu
354367
- -c
355-
- "#!/bin/sh\nset -eu\n\nvcluster_kubeconfig=/etc/vcluster-kubeconfig/config\n\
356-
\necho \"Checking for namespace 'syn'...\"\n\nexists=$(kubectl --kubeconfig\
357-
\ \"$vcluster_kubeconfig\" get namespace syn --ignore-not-found)\nif\
358-
\ [ -n \"$exists\" ]; then\n echo \"Namespace 'syn' exists. Skipping\
359-
\ synthesize.\"\n exit 0\nfi\n\necho \"Starting synthesize...\"\n\n\
360-
kubectl --kubeconfig \"$vcluster_kubeconfig\" apply -f \"$1\"\n\necho\
361-
\ \"Done!\"\n"
368+
- "#!/bin/sh\nset -eu\n\ncp /etc/vcluster-kubeconfig/config ./config\n\
369+
vcluster_kubeconfig=./config\n\necho \"Setting server URL...\"\n\nkubectl\
370+
\ --kubeconfig \"$vcluster_kubeconfig\" config set clusters.local.server\
371+
\ \"$VCLUSTER_SERVER_URL\"\n\necho \"Checking for namespace 'syn'...\"\
372+
\n\nexists=$(kubectl --kubeconfig \"$vcluster_kubeconfig\" get namespace\
373+
\ syn --ignore-not-found)\nif [ -n \"$exists\" ]; then\n echo \"Namespace\
374+
\ 'syn' exists. Skipping synthesize.\"\n exit 0\nfi\n\necho \"Starting\
375+
\ synthesize...\"\n\nkubectl --kubeconfig \"$vcluster_kubeconfig\" apply\
376+
\ -f \"$1\"\n\necho \"Done!\"\n"
362377
- --
363378
- https://syn.example.com/steward/install.json?token=w84kxjbhf
364379
command:
365380
- sh
366381
env:
367382
- name: HOME
368383
value: /export
384+
- name: VCLUSTER_SERVER_URL
385+
value: https://oidc:443
369386
image: quay.io/bitnami/kubectl:1.22.4
370387
imagePullPolicy: IfNotPresent
371388
name: oidc-synthesize

‎tests/golden/openshift/openshift/openshift/10_cluster.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,10 @@ spec:
164164
- --flannel-backend=none
165165
- --service-cidr=172.30.0.0/16
166166
- --kube-controller-manager-arg=controllers=*,-nodeipam,-nodelifecycle,-persistentvolume-binder,-attachdetach,-persistentvolume-expander,-cloud-node-lifecycle
167+
- --tls-san=openshift.syn-openshift.svc.cluster.local
168+
- --tls-san=openshift.syn-openshift.svc
169+
- --tls-san=openshift.syn-openshift
170+
- --tls-san=openshift
167171
command:
168172
- /bin/k3s
169173
env: []
@@ -183,6 +187,10 @@ spec:
183187
- args:
184188
- --name=openshift
185189
- --out-kube-config-secret=vc-openshift-kubeconfig
190+
- --tls-san=openshift.syn-openshift.svc.cluster.local
191+
- --tls-san=openshift.syn-openshift.svc
192+
- --tls-san=openshift.syn-openshift
193+
- --tls-san=openshift
186194
env: []
187195
image: docker.io/loftsh/vcluster:0.5.0-beta.0
188196
livenessProbe:

0 commit comments

Comments
 (0)