@@ -22,12 +22,14 @@ import (
22
22
"strings"
23
23
"time"
24
24
25
- corev1 "k8s.io/api/core/v1"
25
+ v1 "k8s.io/api/core/v1"
26
26
kubeerrors "k8s.io/apimachinery/pkg/api/errors"
27
27
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
28
+ "k8s.io/apimachinery/pkg/runtime"
28
29
utilversion "k8s.io/apimachinery/pkg/util/version"
29
30
kube "k8s.io/client-go/kubernetes"
30
31
kubecorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
32
+ "k8s.io/client-go/tools/record"
31
33
"k8s.io/klog/v2"
32
34
33
35
cosiapi "sigs.k8s.io/container-object-storage-interface-api/apis"
@@ -48,6 +50,8 @@ type BucketAccessListener struct {
48
50
provisionerClient cosi.ProvisionerClient
49
51
driverName string
50
52
53
+ eventRecorder record.EventRecorder
54
+
51
55
kubeClient kube.Interface
52
56
bucketClient buckets.Interface
53
57
kubeVersion * utilversion.Version
@@ -62,9 +66,17 @@ func NewBucketAccessListener(driverName string, client cosi.ProvisionerClient) (
62
66
}
63
67
64
68
// Add attempts to provision credentials to access a given bucket. This function must be idempotent
69
+ //
70
+ // Recorded events
71
+ //
72
+ // BucketNotReady - BucketAccess can't be granted to bucket not in Ready state and without a bucketID
73
+ // MissingServiceAccountName - Must define ServiceAccountName when AuthenticationType is IAM
74
+ // InvalidBucketAccessClass - BucketAccessClass provided in the BucketAccess does not exist
75
+ //
65
76
// Return values
66
- // nil - BucketAccess successfully granted
67
- // non-nil err - Internal error [requeue'd with exponential backoff]
77
+ //
78
+ // nil - BucketAccess successfully granted
79
+ // non-nil err - Internal error [requeue'd with exponential backoff]
68
80
func (bal * BucketAccessListener ) Add (ctx context.Context , inputBucketAccess * v1alpha1.BucketAccess ) error {
69
81
bucketAccess := inputBucketAccess .DeepCopy ()
70
82
@@ -91,7 +103,10 @@ func (bal *BucketAccessListener) Add(ctx context.Context, inputBucketAccess *v1a
91
103
}
92
104
93
105
bucketAccessClass , err := bal .bucketAccessClasses ().Get (ctx , bucketAccessClassName , metav1.GetOptions {})
94
- if err != nil {
106
+ if kubeerrors .IsNotFound (err ) {
107
+ bal .recordEvent (inputBucketAccess , v1 .EventTypeWarning , "InvalidBucketAccessClass" , "BucketAccessClass provided in the BucketAccess does not exist" )
108
+ return err
109
+ } else if err != nil {
95
110
klog .ErrorS (err , "Failed to fetch bucketAccessClass" , "bucketAccessClass" , bucketAccessClassName )
96
111
return errors .Wrap (err , "Failed to fetch BucketAccessClass" )
97
112
}
@@ -129,6 +144,7 @@ func (bal *BucketAccessListener) Add(ctx context.Context, inputBucketAccess *v1a
129
144
}
130
145
131
146
if authType == cosi .AuthenticationType_IAM && bucketAccess .Spec .ServiceAccountName == "" {
147
+ bal .recordEvent (inputBucketAccess , v1 .EventTypeWarning , "MissingServiceAccountName" , "Must define ServiceAccountName when AuthenticationType is IAM" )
132
148
return errors .New ("Must define ServiceAccountName when AuthenticationType is IAM" )
133
149
}
134
150
@@ -146,6 +162,9 @@ func (bal *BucketAccessListener) Add(ctx context.Context, inputBucketAccess *v1a
146
162
return errors .Wrap (err , "Failed to fetch bucket" )
147
163
}
148
164
165
+ if bucket .Status .BucketID == "" {
166
+ bal .recordEvent (inputBucketAccess , v1 .EventTypeWarning , "BucketNotReady" , "BucketAccess can't be granted to bucket not in Ready state and without a bucketID" )
167
+ }
149
168
if bucket .Status .BucketReady != true || bucket .Status .BucketID == "" {
150
169
return errors .New ("BucketAccess can't be granted to bucket not in Ready state and without a bucketID" )
151
170
}
@@ -163,11 +182,7 @@ func (bal *BucketAccessListener) Add(ctx context.Context, inputBucketAccess *v1a
163
182
rsp , err := bal .provisionerClient .DriverGrantBucketAccess (ctx , req )
164
183
if err != nil {
165
184
if status .Code (err ) != codes .AlreadyExists {
166
- klog .V (3 ).ErrorS (err ,
167
- "Failed to grant access" ,
168
- "bucketAccess" , bucketAccess .ObjectMeta .Name ,
169
- "bucketClaim" , bucketClaimName ,
170
- )
185
+ bal .recordEvent (inputBucketAccess , v1 .EventTypeWarning , status .Code (err ).String (), "Failed to grant access" )
171
186
return errors .Wrap (err , "failed to grant access" )
172
187
}
173
188
@@ -237,7 +252,7 @@ func (bal *BucketAccessListener) Add(ctx context.Context, inputBucketAccess *v1a
237
252
return errors .Wrap (err , "failed to fetch secrets" )
238
253
}
239
254
240
- if _ , err := bal .secrets (namespace ).Create (ctx , & corev1 .Secret {
255
+ if _ , err := bal .secrets (namespace ).Create (ctx , & v1 .Secret {
241
256
ObjectMeta : metav1.ObjectMeta {
242
257
Name : secretCredName ,
243
258
Namespace : namespace ,
@@ -246,7 +261,7 @@ func (bal *BucketAccessListener) Add(ctx context.Context, inputBucketAccess *v1a
246
261
StringData : map [string ]string {
247
262
"BucketInfo" : string (stringData ),
248
263
},
249
- Type : corev1 .SecretTypeOpaque ,
264
+ Type : v1 .SecretTypeOpaque ,
250
265
}, metav1.CreateOptions {}); err != nil {
251
266
if ! kubeerrors .IsAlreadyExists (err ) {
252
267
klog .V (3 ).ErrorS (err ,
@@ -291,8 +306,9 @@ func (bal *BucketAccessListener) Add(ctx context.Context, inputBucketAccess *v1a
291
306
292
307
// Update attempts to reconcile changes to a given bucketAccess. This function must be idempotent
293
308
// Return values
294
- // nil - BucketAccess successfully reconciled
295
- // non-nil err - Internal error [requeue'd with exponential backoff]
309
+ //
310
+ // nil - BucketAccess successfully reconciled
311
+ // non-nil err - Internal error [requeue'd with exponential backoff]
296
312
func (bal * BucketAccessListener ) Update (ctx context.Context , old , new * v1alpha1.BucketAccess ) error {
297
313
klog .V (3 ).InfoS ("Update BucketAccess" ,
298
314
"name" , old .ObjectMeta .Name )
@@ -312,8 +328,9 @@ func (bal *BucketAccessListener) Update(ctx context.Context, old, new *v1alpha1.
312
328
313
329
// Delete attemps to delete a bucketAccess. This function must be idempotent
314
330
// Return values
315
- // nil - BucketAccess successfully deleted
316
- // non-nil err - Internal error [requeue'd with exponential backoff]
331
+ //
332
+ // nil - BucketAccess successfully deleted
333
+ // non-nil err - Internal error [requeue'd with exponential backoff]
317
334
func (bal * BucketAccessListener ) Delete (ctx context.Context , bucketAccess * v1alpha1.BucketAccess ) error {
318
335
klog .V (3 ).InfoS ("Delete BucketAccess" ,
319
336
"name" , bucketAccess .ObjectMeta .Name ,
@@ -346,11 +363,7 @@ func (bal *BucketAccessListener) deleteBucketAccessOp(ctx context.Context, bucke
346
363
347
364
// First we revoke the bucketAccess from the driver
348
365
if _ , err := bal .provisionerClient .DriverRevokeBucketAccess (ctx , req ); err != nil {
349
- klog .V (3 ).ErrorS (err ,
350
- "Failed to revoke bucket access" ,
351
- "bucketAccess" , bucketAccess .ObjectMeta .Name ,
352
- "bucketClaim" , bucketClaimName ,
353
- )
366
+ bal .recordEvent (bucketAccess , v1 .EventTypeWarning , status .Code (err ).String (), "Failed to revoke bucket access" )
354
367
return errors .Wrap (err , "failed to revoke access" )
355
368
}
356
369
@@ -446,3 +459,16 @@ func (bal *BucketAccessListener) InitializeKubeClient(k kube.Interface) {
446
459
func (bal * BucketAccessListener ) InitializeBucketClient (bc buckets.Interface ) {
447
460
bal .bucketClient = bc
448
461
}
462
+
463
+ // InitializeEventRecorder initializes the event recorder
464
+ func (bal * BucketAccessListener ) InitializeEventRecorder (er record.EventRecorder ) {
465
+ bal .eventRecorder = er
466
+ }
467
+
468
+ // recordEvent during the processing of the objects
469
+ func (bal * BucketAccessListener ) recordEvent (subject runtime.Object , eventtype , reason , message string ) {
470
+ if bal .eventRecorder == nil {
471
+ return
472
+ }
473
+ bal .eventRecorder .Event (subject , eventtype , reason , message )
474
+ }
0 commit comments