Skip to content

Commit 86f6df6

Browse files
shiradyshirady
committed
IAM Service and Route Addition
Signed-off-by: shirady <[email protected]>
1 parent 22f1cc3 commit 86f6df6

File tree

11 files changed

+282
-2
lines changed

11 files changed

+282
-2
lines changed

‎deploy/crds/noobaa.io_noobaas.yaml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,10 @@ spec:
2525
jsonPath: .status.services.serviceSts.nodePorts
2626
name: Sts-Endpoints
2727
type: string
28+
- description: IAM Endpoints
29+
jsonPath: .status.services.serviceIam.nodePorts
30+
name: Iam-Endpoints
31+
type: string
2832
- description: Syslog Endpoints
2933
jsonPath: .status.services.serviceSyslog.nodePorts
3034
name: Syslog-Endpoints
@@ -1756,6 +1760,12 @@ spec:
17561760
only from the listed subnets. This field will have no effect if DisableLoadBalancerService is set
17571761
to true
17581762
properties:
1763+
iam:
1764+
description: IAM is a list of subnets that will be allowed to
1765+
access the Noobaa IAM service
1766+
items:
1767+
type: string
1768+
type: array
17591769
s3:
17601770
description: S3 is a list of subnets that will be allowed to access
17611771
the Noobaa S3 service
@@ -2082,6 +2092,61 @@ spec:
20822092
services:
20832093
description: Services reports addresses for the services
20842094
properties:
2095+
serviceIam:
2096+
description: ServiceStatus is the status info and network addresses
2097+
of a service
2098+
properties:
2099+
externalDNS:
2100+
description: ExternalDNS are external public addresses for
2101+
the service
2102+
items:
2103+
type: string
2104+
type: array
2105+
externalIP:
2106+
description: |-
2107+
ExternalIP are external public addresses for the service
2108+
LoadBalancerPorts such as AWS ELB provide public address and load balancing for the service
2109+
IngressPorts are manually created public addresses for the service
2110+
https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
2111+
https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
2112+
https://kubernetes.io/docs/concepts/services-networking/ingress/
2113+
items:
2114+
type: string
2115+
type: array
2116+
internalDNS:
2117+
description: InternalDNS are internal addresses of the service
2118+
inside the cluster
2119+
items:
2120+
type: string
2121+
type: array
2122+
internalIP:
2123+
description: |-
2124+
InternalIP are internal addresses of the service inside the cluster
2125+
https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
2126+
items:
2127+
type: string
2128+
type: array
2129+
nodePorts:
2130+
description: |-
2131+
NodePorts are the most basic network available.
2132+
NodePorts use the networks available on the hosts of kubernetes nodes.
2133+
This generally works from within a pod, and from the internal
2134+
network of the nodes, but may fail from public network.
2135+
https://kubernetes.io/docs/concepts/services-networking/service/#nodeport
2136+
items:
2137+
type: string
2138+
type: array
2139+
podPorts:
2140+
description: |-
2141+
PodPorts are the second most basic network address.
2142+
Every pod has an IP in the cluster and the pods network is a mesh
2143+
so the operator running inside a pod in the cluster can use this address.
2144+
Note: pod IPs are not guaranteed to persist over restarts, so should be rediscovered.
2145+
Note2: when running the operator outside of the cluster, pod IP is not accessible.
2146+
items:
2147+
type: string
2148+
type: array
2149+
type: object
20852150
serviceMgmt:
20862151
description: ServiceStatus is the status info and network addresses
20872152
of a service

‎deploy/internal/deployment-endpoint.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ spec:
7878
- containerPort: 6001
7979
- containerPort: 6443
8080
- containerPort: 7443
81+
- containerPort: 13443
8182
env:
8283
- name: NODE_NAME
8384
valueFrom:

‎deploy/internal/route-iam.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: route.openshift.io/v1
2+
kind: Route
3+
metadata:
4+
labels:
5+
app: noobaa
6+
name: iam
7+
spec:
8+
port:
9+
targetPort: iam-https
10+
tls:
11+
insecureEdgeTerminationPolicy: Allow
12+
termination: reencrypt
13+
to:
14+
kind: Service
15+
name: iam
16+
weight: 100
17+
wildcardPolicy: None

‎deploy/internal/service-iam.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: iam
5+
labels:
6+
app: noobaa
7+
noobaa-iam-svc: "true"
8+
annotations:
9+
service.beta.openshift.io/serving-cert-secret-name: 'noobaa-iam-serving-cert'
10+
service.alpha.openshift.io/serving-cert-secret-name: 'noobaa-iam-serving-cert'
11+
spec:
12+
type: LoadBalancer
13+
selector:
14+
noobaa-s3: SYSNAME
15+
ports:
16+
- port: 443
17+
targetPort: 13443
18+
name: iam-https

‎pkg/apis/noobaa/v1alpha1/noobaa_types.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ type AnnotationsSpec map[string]Annotations
3333
// +kubebuilder:resource:shortName=nb
3434
// +kubebuilder:printcolumn:name="S3-Endpoints",type="string",JSONPath=".status.services.serviceS3.nodePorts",description="S3 Endpoints"
3535
// +kubebuilder:printcolumn:name="Sts-Endpoints",type="string",JSONPath=".status.services.serviceSts.nodePorts",description="STS Endpoints"
36+
// +kubebuilder:printcolumn:name="Iam-Endpoints",type="string",JSONPath=".status.services.serviceIam.nodePorts",description="IAM Endpoints"
3637
// +kubebuilder:printcolumn:name="Syslog-Endpoints",type="string",JSONPath=".status.services.serviceSyslog.nodePorts",description="Syslog Endpoints"
3738
// +kubebuilder:printcolumn:name="Image",type="string",JSONPath=".status.actualImage",description="Actual Image"
3839
// +kubebuilder:printcolumn:name="Phase",type="string",JSONPath=".status.phase",description="Phase"
@@ -314,6 +315,10 @@ type LoadBalancerSourceSubnetSpec struct {
314315
// STS is a list of subnets that will be allowed to access the Noobaa STS service
315316
// +optional
316317
STS []string `json:"sts,omitempty"`
318+
319+
// IAM is a list of subnets that will be allowed to access the Noobaa IAM service
320+
// +optional
321+
IAM []string `json:"iam,omitempty"`
317322
}
318323

319324
// SecuritySpec is security spec to include various security items such as kms
@@ -559,6 +564,7 @@ type ServicesStatus struct {
559564
ServiceS3 ServiceStatus `json:"serviceS3"`
560565
// +optional
561566
ServiceSts ServiceStatus `json:"serviceSts,omitempty"`
567+
ServiceIam ServiceStatus `json:"serviceIam,omitempty"`
562568
ServiceSyslog ServiceStatus `json:"serviceSyslog,omitempty"`
563569
}
564570

‎pkg/apis/noobaa/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 6 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/bundle/deploy.go‎

Lines changed: 111 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1425,7 +1425,7 @@ spec:
14251425
status: {}
14261426
`
14271427

1428-
const Sha256_deploy_crds_noobaa_io_noobaas_yaml = "ee1ecf4ecb2fa8686e5e8de9dba25f962df79b57fd34abd482a9bfef4d4622fe"
1428+
const Sha256_deploy_crds_noobaa_io_noobaas_yaml = "0b124e4d763e8aecff6486d8f70491d8dfd30f35fb863746ef2fcb12bff69fbf"
14291429

14301430
const File_deploy_crds_noobaa_io_noobaas_yaml = `---
14311431
apiVersion: apiextensions.k8s.io/v1
@@ -1454,6 +1454,10 @@ spec:
14541454
jsonPath: .status.services.serviceSts.nodePorts
14551455
name: Sts-Endpoints
14561456
type: string
1457+
- description: IAM Endpoints
1458+
jsonPath: .status.services.serviceIam.nodePorts
1459+
name: Iam-Endpoints
1460+
type: string
14571461
- description: Syslog Endpoints
14581462
jsonPath: .status.services.serviceSyslog.nodePorts
14591463
name: Syslog-Endpoints
@@ -3185,6 +3189,12 @@ spec:
31853189
only from the listed subnets. This field will have no effect if DisableLoadBalancerService is set
31863190
to true
31873191
properties:
3192+
iam:
3193+
description: IAM is a list of subnets that will be allowed to
3194+
access the Noobaa IAM service
3195+
items:
3196+
type: string
3197+
type: array
31883198
s3:
31893199
description: S3 is a list of subnets that will be allowed to access
31903200
the Noobaa S3 service
@@ -3511,6 +3521,61 @@ spec:
35113521
services:
35123522
description: Services reports addresses for the services
35133523
properties:
3524+
serviceIam:
3525+
description: ServiceStatus is the status info and network addresses
3526+
of a service
3527+
properties:
3528+
externalDNS:
3529+
description: ExternalDNS are external public addresses for
3530+
the service
3531+
items:
3532+
type: string
3533+
type: array
3534+
externalIP:
3535+
description: |-
3536+
ExternalIP are external public addresses for the service
3537+
LoadBalancerPorts such as AWS ELB provide public address and load balancing for the service
3538+
IngressPorts are manually created public addresses for the service
3539+
https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
3540+
https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
3541+
https://kubernetes.io/docs/concepts/services-networking/ingress/
3542+
items:
3543+
type: string
3544+
type: array
3545+
internalDNS:
3546+
description: InternalDNS are internal addresses of the service
3547+
inside the cluster
3548+
items:
3549+
type: string
3550+
type: array
3551+
internalIP:
3552+
description: |-
3553+
InternalIP are internal addresses of the service inside the cluster
3554+
https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
3555+
items:
3556+
type: string
3557+
type: array
3558+
nodePorts:
3559+
description: |-
3560+
NodePorts are the most basic network available.
3561+
NodePorts use the networks available on the hosts of kubernetes nodes.
3562+
This generally works from within a pod, and from the internal
3563+
network of the nodes, but may fail from public network.
3564+
https://kubernetes.io/docs/concepts/services-networking/service/#nodeport
3565+
items:
3566+
type: string
3567+
type: array
3568+
podPorts:
3569+
description: |-
3570+
PodPorts are the second most basic network address.
3571+
Every pod has an IP in the cluster and the pods network is a mesh
3572+
so the operator running inside a pod in the cluster can use this address.
3573+
Note: pod IPs are not guaranteed to persist over restarts, so should be rediscovered.
3574+
Note2: when running the operator outside of the cluster, pod IP is not accessible.
3575+
items:
3576+
type: string
3577+
type: array
3578+
type: object
35143579
serviceMgmt:
35153580
description: ServiceStatus is the status info and network addresses
35163581
of a service
@@ -3979,7 +4044,7 @@ data:
39794044
shared_preload_libraries = 'pg_stat_statements'
39804045
`
39814046

3982-
const Sha256_deploy_internal_deployment_endpoint_yaml = "4221668694225599735ba859f68e47a9de8ce1aca685e0acd266c80e338bbda5"
4047+
const Sha256_deploy_internal_deployment_endpoint_yaml = "fe660e3c058907d96617e52b14d2fa66589e5e55ac7220535c86ff56c5c945a5"
39834048

39844049
const File_deploy_internal_deployment_endpoint_yaml = `apiVersion: apps/v1
39854050
kind: Deployment
@@ -4061,6 +4126,7 @@ spec:
40614126
- containerPort: 6001
40624127
- containerPort: 6443
40634128
- containerPort: 7443
4129+
- containerPort: 13443
40644130
env:
40654131
- name: NODE_NAME
40664132
valueFrom:
@@ -4833,6 +4899,27 @@ spec:
48334899
storage: 30Gi
48344900
`
48354901

4902+
const Sha256_deploy_internal_route_iam_yaml = "adffe421b21f035fb033b0907f6fcfb4b665f0113dc89887e0b6cdc6bf09ca95"
4903+
4904+
const File_deploy_internal_route_iam_yaml = `apiVersion: route.openshift.io/v1
4905+
kind: Route
4906+
metadata:
4907+
labels:
4908+
app: noobaa
4909+
name: iam
4910+
spec:
4911+
port:
4912+
targetPort: iam-https
4913+
tls:
4914+
insecureEdgeTerminationPolicy: Allow
4915+
termination: reencrypt
4916+
to:
4917+
kind: Service
4918+
name: iam
4919+
weight: 100
4920+
wildcardPolicy: None
4921+
`
4922+
48364923
const Sha256_deploy_internal_route_mgmt_yaml = "1d462d165da5a660b85900e46a11e4d1a53e1498bf9d086b4b68afdceab08394"
48374924

48384925
const File_deploy_internal_route_mgmt_yaml = `apiVersion: route.openshift.io/v1
@@ -4929,6 +5016,28 @@ spec:
49295016
name: postgres
49305017
`
49315018

5019+
const Sha256_deploy_internal_service_iam_yaml = "43625a02ee4d8282dbcc53aac62043d88a92e3ef4f27ed901463decd19e6ad4c"
5020+
5021+
const File_deploy_internal_service_iam_yaml = `apiVersion: v1
5022+
kind: Service
5023+
metadata:
5024+
name: iam
5025+
labels:
5026+
app: noobaa
5027+
noobaa-iam-svc: "true"
5028+
annotations:
5029+
service.beta.openshift.io/serving-cert-secret-name: 'noobaa-iam-serving-cert'
5030+
service.alpha.openshift.io/serving-cert-secret-name: 'noobaa-iam-serving-cert'
5031+
spec:
5032+
type: LoadBalancer
5033+
selector:
5034+
noobaa-s3: SYSNAME
5035+
ports:
5036+
- port: 443
5037+
targetPort: 13443
5038+
name: iam-https
5039+
`
5040+
49325041
const Sha256_deploy_internal_service_mgmt_yaml = "fa5f052fb360e6893fc446a318413a6f494a8610706ae7e36ff985b3b3a5c070"
49335042

49345043
const File_deploy_internal_service_mgmt_yaml = `apiVersion: v1

‎pkg/system/phase2_creating.go‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,15 @@ func (r *Reconciler) ReconcilePhaseCreating() error {
7777
return err
7878
}
7979
}
80+
if err := r.ReconcileObject(r.ServiceIam, r.SetDesiredServiceIam); err != nil {
81+
return err
82+
}
83+
// reconcile noobaa-iam route only if routes are enabled
84+
if !r.NooBaa.Spec.DisableRoutes {
85+
if err := r.ReconcileObjectOptional(r.RouteIam, r.SetDesiredRouteIam); err != nil {
86+
return err
87+
}
88+
}
8089
// the credentials that are created by cloud-credentials-operator sometimes take time
8190
// to be valid (requests sometimes returns InvalidAccessKeyId for 1-2 minutes)
8291
// creating the credential request as early as possible to try and avoid it
@@ -267,6 +276,28 @@ func (r *Reconciler) SetDesiredServiceSts() error {
267276
return nil
268277
}
269278

279+
// SetDesiredServiceIam updates the ServiceIam as desired for reconciling
280+
func (r *Reconciler) SetDesiredServiceIam() error {
281+
if r.NooBaa.Spec.DisableLoadBalancerService {
282+
r.ServiceIam.Spec.Type = corev1.ServiceTypeClusterIP
283+
r.ServiceIam.Spec.LoadBalancerSourceRanges = []string{}
284+
} else {
285+
// It is here in case disableLoadBalancerService is removed from the crd or changed to false
286+
r.ServiceIam.Spec.Type = corev1.ServiceTypeLoadBalancer
287+
r.ServiceIam.Spec.LoadBalancerSourceRanges = r.NooBaa.Spec.LoadBalancerSourceSubnets.IAM
288+
}
289+
r.ServiceIam.Spec.Selector["noobaa-s3"] = r.Request.Name
290+
return nil
291+
}
292+
293+
// SetDesiredRouteIam updates the RouteIam as desired for reconciling
294+
func (r *Reconciler) SetDesiredRouteIam() error {
295+
if r.NooBaa.Spec.DenyHTTP {
296+
r.RouteIam.Spec.TLS.InsecureEdgeTerminationPolicy = "None"
297+
}
298+
return nil
299+
}
300+
270301
// SetDesiredServiceDBForPostgres updates the postgres service
271302
func (r *Reconciler) SetDesiredServiceDBForPostgres() error {
272303
r.ServiceDbPg.Spec.Selector["noobaa-db"] = "postgres"

‎pkg/system/phase3_connecting.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ func (r *Reconciler) ReconcilePhaseConnecting() error {
4141

4242
r.CheckServiceStatus(r.ServiceS3, r.RouteS3, &r.NooBaa.Status.Services.ServiceS3, "s3-https")
4343
r.CheckServiceStatus(r.ServiceSts, r.RouteSts, &r.NooBaa.Status.Services.ServiceSts, "sts-https")
44+
r.CheckServiceStatus(r.ServiceIam, r.RouteIam, &r.NooBaa.Status.Services.ServiceIam, "iam-https")
4445

4546
return nil
4647

0 commit comments

Comments
 (0)