Merge pull request #136 from pgsgeo/pgs/namespaced-mode

Add support for reconciling specified namespaces
GoogleCloudPlatform · Oct 13, 2024 · 5e6da75 · 5e6da75
2 parents 61ec05b + 656a0da
commit 5e6da75
Show file tree

Hide file tree

Showing 3 changed files with 247 additions and 2 deletions.
diff --git a/README.md b/README.md
@@ -83,6 +83,7 @@ The controller parameters can be customized via changing the [controller deploym
  `port` to avoid name collisions when truncated.
 * `--max-rate-per-endpoint`: optional. Sets a default value for max-rate-per-endpoint that can be overridden by user config. Defaults to 0.
 * `--max-connections-per-endpoint`: optional. Same as above but for connections.
+* `--namespaces`: optional. Comma-separated list of namespaces to reconcile.
 * `--always-reconcile`: optional. Makes it possible to reconcile periodically even if the status annotations don't change. Defaults to false.
 * `--reconcile-period`: optional. Sets a reconciliation duration if always-reconcile mode is on. Defaults to 10 hours.
 

diff --git a/deploy/autoneg-namespaced.yaml b/deploy/autoneg-namespaced.yaml
@@ -0,0 +1,233 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+ labels:
+ app: autoneg
+ control-plane: controller-manager
+ name: autoneg-system
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ labels:
+ app: autoneg
+ name: autoneg-controller-manager
+ namespace: autoneg-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+ labels:
+ app: autoneg
+ name: autoneg-leader-election-role
+ namespace: autoneg-system
+rules:
+ - apiGroups:
+ - ""
+ resources:
+ - configmaps
+ verbs:
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - patch
+ - delete
+ - apiGroups:
+ - coordination.k8s.io
+ resources:
+ - leases
+ verbs:
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - patch
+ - delete
+ - apiGroups:
+ - ""
+ resources:
+ - events
+ verbs:
+ - create
+ - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+ name: autoneg-manager-role
+rules:
+ - apiGroups:
+ - ""
+ resources:
+ - events
+ verbs:
+ - create
+ - patch
+ - apiGroups:
+ - ""
+ resources:
+ - services
+ verbs:
+ - get
+ - list
+ - patch
+ - update
+ - watch
+ - apiGroups:
+ - ""
+ resources:
+ - services/finalizers
+ verbs:
+ - update
+ - apiGroups:
+ - ""
+ resources:
+ - services/status
+ verbs:
+ - get
+ - patch
+ - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ labels:
+ app: autoneg
+ name: autoneg-leader-election-rolebinding
+ namespace: autoneg-system
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: Role
+ name: autoneg-leader-election-role
+subjects:
+ - kind: ServiceAccount
+ name: autoneg-controller-manager
+ namespace: autoneg-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ name: autoneg-manager-rolebinding
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: Role
+ name: autoneg-manager-role
+subjects:
+ - kind: ServiceAccount
+ name: autoneg-controller-manager
+ namespace: idp
+---
+apiVersion: v1
+kind: Service
+metadata:
+ labels:
+ app: autoneg
+ control-plane: controller-manager
+ name: autoneg-controller-manager-metrics-service
+ namespace: autoneg-system
+spec:
+ ports:
+ - name: https
+ port: 8443
+ targetPort: https
+ selector:
+ app: autoneg
+ control-plane: controller-manager
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ labels:
+ app: autoneg
+ control-plane: controller-manager
+ name: autoneg-controller-manager
+ namespace: autoneg-system
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: autoneg
+ control-plane: controller-manager
+ template:
+ metadata:
+ labels:
+ app: autoneg
+ control-plane: controller-manager
+ spec:
+ containers:
+ - args:
+ - --secure-listen-address=0.0.0.0:8443
+ - --upstream=http://127.0.0.1:8080/
+ - --logtostderr=true
+ - --v=10
+ image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0
+ name: kube-rbac-proxy
+ ports:
+ - containerPort: 8443
+ name: https
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ privileged: false
+ readOnlyRootFilesystem: true
+ runAsGroup: 65532
+ runAsNonRoot: true
+ runAsUser: 65532
+ seccompProfile:
+ type: RuntimeDefault
+ - args:
+ - --health-probe-bind-address=:8081
+ - --metrics-bind-address=127.0.0.1:8080
+ - --leader-elect
+ - --zap-encoder=json
+ - --namespaces=autoneg-system
+ command:
+ - /manager
+ image: ghcr.io/googlecloudplatform/gke-autoneg-controller/gke-autoneg-controller:v1.1.0
+ livenessProbe:
+ httpGet:
+ path: /healthz
+ port: 8081
+ initialDelaySeconds: 15
+ periodSeconds: 20
+ name: manager
+ readinessProbe:
+ httpGet:
+ path: /readyz
+ port: 8081
+ initialDelaySeconds: 5
+ periodSeconds: 10
+ resources:
+ limits:
+ cpu: 100m
+ memory: 30Mi
+ requests:
+ cpu: 100m
+ memory: 20Mi
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ privileged: false
+ readOnlyRootFilesystem: true
+ runAsGroup: 65532
+ runAsNonRoot: true
+ runAsUser: 65532
+ seccompProfile:
+ type: RuntimeDefault
+ nodeSelector:
+ iam.gke.io/gke-metadata-server-enabled: "true"
+ securityContext:
+ runAsGroup: 65532
+ runAsNonRoot: true
+ runAsUser: 65532
+ seccompProfile:
+ type: RuntimeDefault
+ serviceAccountName: autoneg-controller-manager
+ terminationGracePeriodSeconds: 10
diff --git a/main.go b/main.go
@@ -21,6 +21,7 @@ import (
  "flag"
  "fmt"
  "os"
+ "strings"
  "time"
 
  // Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
@@ -34,6 +35,7 @@ import (
  utilruntime "k8s.io/apimachinery/pkg/util/runtime"
  clientgoscheme "k8s.io/client-go/kubernetes/scheme"
  ctrl "sigs.k8s.io/controller-runtime"
+ "sigs.k8s.io/controller-runtime/pkg/cache"
  "sigs.k8s.io/controller-runtime/pkg/healthz"
  "sigs.k8s.io/controller-runtime/pkg/log/zap"
 
@@ -65,10 +67,12 @@ func main() {
  var allowServiceName bool
  var alwaysReconcile bool
  var reconcilePeriod string
+ var namespaces string
  flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
  flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
  flag.Float64Var(&maxRatePerEndpointDefault, "max-rate-per-endpoint", 0, "Default max rate per endpoint. Can be overridden by user config.")
  flag.Float64Var(&maxConnectionsPerEndpointDefault, "max-connections-per-endpoint", 0, "Default max connections per endpoint. Can be overridden by user config.")
+ flag.StringVar(&namespaces, "namespaces", "", "List of namespaces where Services should be reconciled.")
  flag.BoolVar(&enableLeaderElection, "leader-elect", false,
  "Enable leader election for controller manager. "+
  "Enabling this will ensure there is only one active controller manager.")
@@ -116,14 +120,21 @@ func main() {
  os.Exit(1)
  }
 
- mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
+ mgrOpts := ctrl.Options{
  Scheme: scheme,
  MetricsBindAddress: metricsAddr,
  Port: 9443,
  HealthProbeBindAddress: probeAddr,
  LeaderElection: enableLeaderElection,
  LeaderElectionID: "9fe89c94.controller.autoneg.dev",
- })
+ }
+ if namespaces != "" {
+ mgrOpts.Cache = cache.Options{
+ Namespaces: strings.Split(namespaces, ","),
+ }
+ }
+
+ mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), mgrOpts)
  if err != nil {
  setupLog.Error(err, "unable to start manager")
  os.Exit(1)