Skip to content
This repository was archived by the owner on Dec 6, 2024. It is now read-only.

Commit c4ebe8f

Browse files
mukhoakashmukhoakash
committed
Bulk of changes to bucketaccess and bucket controller
1 parent 75eee0e commit c4ebe8f

File tree

3 files changed

+129
-60
lines changed

3 files changed

+129
-60
lines changed

Diff for: ‎container-object-storage-interface-provisioner-sidecar/pkg/bucket/bucket_controller.go

+25-2
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,21 @@ func (b *BucketListener) Add(ctx context.Context, inputBucket *v1alpha1.Bucket)
120120
return errors.Wrap(err, "Failed to update bucket status")
121121
}
122122

123+
// Now we update the BucketReady status of BucketClaim
124+
if bucket.Spec.BucketClaim != nil {
125+
ref := bucket.Spec.BucketClaim
126+
bucketClaim, err := b.BucketClaims(ref.Namespace).Get(ctx, ref.Name, metav1.GetOptions{})
127+
if err != nil {
128+
return err
129+
}
130+
131+
bucketClaim.Status.BucketReady = true
132+
133+
if _, err := b.BucketClaims(bucketClaim.Namespace).Update(ctx, bucketClaim, metav1.UpdateOptions{}); err != nil {
134+
return err
135+
}
136+
}
137+
123138
return nil
124139
}
125140

@@ -183,13 +198,13 @@ func (b *BucketListener) Delete(ctx context.Context, inputBucket *v1alpha1.Bucke
183198

184199
if bucket.Spec.BucketClaim != nil {
185200
ref := bucket.Spec.BucketClaim
186-
bucketClaim, err := b.bucketClient.ObjectstorageV1alpha1().BucketClaims(ref.Namespace).Get(ctx, ref.Name, metav1.GetOptions{})
201+
bucketClaim, err := b.BucketClaims(ref.Namespace).Get(ctx, ref.Name, metav1.GetOptions{})
187202
if err != nil {
188203
return err
189204
}
190205

191206
controllerutil.RemoveFinalizer(bucketClaim, brFinalizer)
192-
if _, err := b.bucketClient.ObjectstorageV1alpha1().BucketClaims(bucketClaim.Namespace).Update(ctx, bucketClaim, metav1.UpdateOptions{}); err != nil {
207+
if _, err := b.BucketClaims(bucketClaim.Namespace).Update(ctx, bucketClaim, metav1.UpdateOptions{}); err != nil {
193208
return err
194209
}
195210
}
@@ -204,6 +219,14 @@ func (b *BucketListener) Buckets() bucketapi.BucketInterface {
204219
panic("uninitialized listener")
205220
}
206221

222+
func (b *BucketListener) BucketClaims(namespace string) bucketapi.BucketClaimInterface {
223+
if b.bucketClient != nil {
224+
return b.bucketClient.ObjectstorageV1alpha1().BucketClaims(namespace)
225+
}
226+
227+
panic ("uninitialized listener")
228+
}
229+
207230
// InitializeKubeClient initializes the kubernetes client
208231
func (b *BucketListener) InitializeKubeClient(k kube.Interface) {
209232
b.kubeClient = k

Diff for: ‎container-object-storage-interface-provisioner-sidecar/pkg/bucketaccess/bucketaccess_controller.go

+85-39
Original file line numberDiff line numberDiff line change
@@ -47,26 +47,23 @@ const (
4747
// BucketAccessListener manages Bucket objects
4848
type BucketAccessListener struct {
4949
provisionerClient cosi.ProvisionerClient
50-
provisionerName string
50+
driverName string
5151

5252
kubeClient kube.Interface
5353
bucketClient buckets.Interface
5454
kubeVersion *utilversion.Version
55-
56-
namespace string
5755
}
5856

5957
// NewBucketAccessListener returns a resource handler for BucketAccess objects
60-
func NewBucketAccessListener(provisionerName string, client cosi.ProvisionerClient) (*BucketAccessListener, error) {
58+
func NewBucketAccessListener(driverName string, client cosi.ProvisionerClient) (*BucketAccessListener, error) {
6159
ns := os.Getenv("POD_NAMESPACE")
6260
if ns == "" {
6361
return nil, errors.New("POD_NAMESPACE env var cannot be empty")
6462
}
6563

6664
return &BucketAccessListener{
67-
provisionerName: provisionerName,
65+
driverName: driverName,
6866
provisionerClient: client,
69-
namespace: ns,
7067
}, nil
7168
}
7269

@@ -77,60 +74,96 @@ func NewBucketAccessListener(provisionerName string, client cosi.ProvisionerClie
7774
func (bal *BucketAccessListener) Add(ctx context.Context, inputBucketAccess *v1alpha1.BucketAccess) error {
7875
bucketAccess := inputBucketAccess.DeepCopy()
7976

80-
bucketName := bucketAccess.Spec.BucketName
77+
bucketClaimName := bucketAccess.Spec.BucketClaimName
8178
klog.V(3).InfoS("Add BucketAccess",
8279
"name", bucketAccess.Name,
83-
"bucket", bucketName,
80+
"bucketClaim", bucketClaimName,
8481
)
8582

86-
if bucketAccess.Status.MintedSecret != nil {
87-
klog.V(5).InfoS("AccessAlreadyGranted",
83+
bucketAccessClassName := bucketAccess.Spec.BucketAccessClassName
84+
klog.V(3).InfoS("Add BucketAccess",
85+
"name", bucketAccess.Name,
86+
"BucketAccessClassName", bucketAccessClassName,
87+
)
88+
89+
secretCredName := bucketAccess.Spec.CredentialsSecretName
90+
if secretCredName == nil {
91+
return errors.New("CredentialsSecretName not defined in the BucketAccess")
92+
}
93+
94+
authType := cosi.AuthenticationType_UnknownAuthenticationType
95+
if bucketAccess.Spec.AuthenticationType == v1alpha1.AuthenticationTypeKey {
96+
authType = cosi.AuthenticationType_Key
97+
} else if bucketAccess.Spec.AuthenticationType == v1alpha1.AuthenticationTypeIAM {
98+
authType = cosi.AuthenticationType_IAM
99+
}
100+
101+
if authType == cosi.AuthenticationType_IAM && bucketAccess.Spec.ServiceAccountName == "" {
102+
return errors.New("Must define ServiceAccountName when AuthenticationType is IAM")
103+
}
104+
105+
namespace := bucketAccess.Namespace
106+
bucketClaim, err := bal.BucketClaims(namespace).Get(ctx, bucketClaimName, metav1.GetOptions{})
107+
if err != nil {
108+
klog.ErrorS(err, "Failed to fetch bucketClaim", "bucketClaim", bucketClaimName)
109+
return errors.Wrap(err, "Failed to fetch bucketClaim")
110+
}
111+
112+
113+
if bucketClaim.Status.BucketName == "" || bucketClaim.Status.BucketReady != true {
114+
err := errors.New("BucketName cannot be empty or BucketNotReady")
115+
klog.ErrorS(err,
116+
"Invalid arguments",
117+
"bucketClaim", bucketClaim.Name,
88118
"bucketAccess", bucketAccess.Name,
89-
"bucket", bucketName,
90119
)
91-
return nil
120+
return errors.Wrap(err, "Invalid arguments")
92121
}
93122

94-
bucket, err := bal.Buckets().Get(ctx, bucketName, metav1.GetOptions{})
123+
bucketAccessClass, err := bal.BucketAccessClasses().Get(ctx, bucketAccessClassName, metav1.GetOptions{})
95124
if err != nil {
96-
klog.ErrorS(err, "Failed to fetch bucket", "bucket", bucketName)
97-
return errors.Wrap(err, "Failed to fetch bucket")
125+
klog.ErrorS(err, "Failed to fetch bucketAccessClass", "bucketAccessClass", bucketAccessClassName)
126+
return errors.Wrap(err, "Failed to fetch BucketAccessClass")
98127
}
99128

100-
if !strings.EqualFold(bucket.Spec.Provisioner, bal.provisionerName) {
129+
if !strings.EqualFold(bucketAccessClass.DriverName, bal.driverName) {
101130
klog.V(5).InfoS("Skipping bucketaccess for provisiner",
102131
"bucketAccess", bucketAccess.Name,
103-
"provisioner", bucket.Spec.Provisioner,
132+
"driver", bucketAccessClass.DriverName,
104133
)
105134
return nil
106135
}
107136

108-
if bucketAccess.Status.AccessGranted {
137+
138+
if bucketAccess.Status.AccessGranted == true {
109139
klog.V(5).InfoS("AccessAlreadyGranted",
110-
"bucketaccess", bucketAccess.Name,
111-
"bucket", bucket.Name,
140+
"bucketAccess", bucketAccess.Name,
141+
"bucketClaim", bucketClaimName,
112142
)
113143
return nil
114144
}
115145

116-
if bucket.Status.BucketID == "" {
117-
err := errors.New("BucketID cannot be empty")
118-
klog.ErrorS(err,
119-
"Invalid arguments",
120-
"bucket", bucket.Name,
121-
"bucketAccess", bucketAccess.Name,
122-
)
123-
return errors.Wrap(err, "Invalid arguments")
146+
bucket, err := bal.Buckets().Get(ctx, bucketClaim.Status.BucketName, metav1.GetOptions{})
147+
if err != nil {
148+
klog.ErrorS(err, "Failed to fetch bucket", "bucket", bucketClaim.Status.BucketName)
149+
return errors.Wrap(err, "Failed to fetch bucket")
124150
}
125151

126-
req := &cosi.ProvisionerGrantBucketAccessRequest{
152+
if bucket.Status.BucketStatus != true || bucket.Status.BucketID == "" {
153+
return errors.New("BucketAccess can't be granted to bucket not in Ready state and without a bucketID")
154+
}
155+
156+
accountName := "ba-" + bucketAccess.UID
157+
158+
req := &cosi.DriverGrantBucketAccessRequest{
127159
BucketId: bucket.Status.BucketID,
128-
AccountName: bucketAccess.Name,
129-
AccessPolicy: bucketAccess.Spec.PolicyActionsConfigMapData,
160+
AccountName: accountName,
161+
AuthenticationType: authType,
162+
Parameters: bucketAccessClass.Parameters,
130163
}
131164

132165
// This needs to be idempotent
133-
rsp, err := bal.provisionerClient.ProvisionerGrantBucketAccess(ctx, req)
166+
rsp, err := bal.provisionerClient.DriverGrantBucketAccess(ctx, req)
134167
if err != nil {
135168
if status.Code(err) != codes.AlreadyExists {
136169
klog.ErrorS(err,
@@ -142,9 +175,8 @@ func (bal *BucketAccessListener) Add(ctx context.Context, inputBucketAccess *v1a
142175
}
143176

144177
}
145-
ns := bal.namespace
146-
mintedSecretName := "ba-" + string(bucketAccess.UID)
147-
if _, err := bal.Secrets(ns).Get(ctx, mintedSecretName, metav1.GetOptions{}); err != nil {
178+
179+
if _, err := bal.Secrets(namespace).Get(ctx, secretCredName, metav1.GetOptions{}); err != nil {
148180
if !kubeerrors.IsNotFound(err) {
149181
klog.ErrorS(err,
150182
"Failed to create secrets",
@@ -156,10 +188,10 @@ func (bal *BucketAccessListener) Add(ctx context.Context, inputBucketAccess *v1a
156188
// if secret doesn't exist, create it
157189
credentials := rsp.Credentials
158190

159-
if _, err := bal.Secrets(ns).Create(ctx, &corev1.Secret{
191+
if _, err := bal.Secrets(namespace).Create(ctx, &corev1.Secret{
160192
ObjectMeta: metav1.ObjectMeta{
161-
Name: mintedSecretName,
162-
Namespace: ns,
193+
Name: secretCredName,
194+
Namespace: namespace,
163195
},
164196
StringData: map[string]string{
165197
Credentials: credentials,
@@ -179,7 +211,7 @@ func (bal *BucketAccessListener) Add(ctx context.Context, inputBucketAccess *v1a
179211
bucketAccess.Status.AccountID = rsp.AccountId
180212
bucketAccess.Status.MintedSecret = &corev1.SecretReference{
181213
Namespace: bal.namespace,
182-
Name: mintedSecretName,
214+
Name: secretCredName,
183215
}
184216
bucketAccess.Status.AccessGranted = true
185217

@@ -263,6 +295,20 @@ func (b *BucketAccessListener) Buckets() bucketapi.BucketInterface {
263295
panic("uninitialized listener")
264296
}
265297

298+
func (b *BucketAccessListener) BucketClaims(namespace string) bucketapi.BucketClaimInterface {
299+
if b.bucketClient != nil {
300+
return b.bucketClient.ObjectstorageV1alpha1().BucketClaims(namespace)
301+
}
302+
panic("uninitialized listener")
303+
}
304+
305+
func (b *BucketAccessListener) BucketAccessClasses() bucketapi.BucketClaimInterface {
306+
if b.bucketClient != nil {
307+
return b.bucketClient.ObjectstorageV1alpha1().BucketAccessClasses()
308+
}
309+
panic("uninitialized listener")
310+
}
311+
266312
// InitializeKubeClient initializes the kubernetes client
267313
func (b *BucketAccessListener) InitializeKubeClient(k kube.Interface) {
268314
b.kubeClient = k

Diff for: ‎container-object-storage-interface-provisioner-sidecar/pkg/provisioner/client.go

+19-19
Original file line numberDiff line numberDiff line change
@@ -34,37 +34,37 @@ type COSIProvisionerClient struct {
3434
provisionerClient cosi.ProvisionerClient
3535
}
3636

37-
func (c *COSIProvisionerClient) ProvisionerGetInfo(ctx context.Context,
38-
in *cosi.ProvisionerGetInfoRequest,
39-
opts ...grpc.CallOption) (*cosi.ProvisionerGetInfoResponse, error) {
37+
func (c *COSIProvisionerClient) DriverGetInfo(ctx context.Context,
38+
in *cosi.DriverGetInfoRequest,
39+
opts ...grpc.CallOption) (*cosi.DriverGetInfoResponse, error) {
4040

41-
return c.identityClient.ProvisionerGetInfo(ctx, in, opts...)
41+
return c.identityClient.DriverGetInfo(ctx, in, opts...)
4242
}
4343

4444
func (c *COSIProvisionerClient) ProvisionerCreateBucket(ctx context.Context,
45-
in *cosi.ProvisionerCreateBucketRequest,
46-
opts ...grpc.CallOption) (*cosi.ProvisionerCreateBucketResponse, error) {
45+
in *cosi.DriverCreateBucketRequest,
46+
opts ...grpc.CallOption) (*cosi.DriverCreateBucketResponse, error) {
4747

48-
return c.provisionerClient.ProvisionerCreateBucket(ctx, in, opts...)
48+
return c.provisionerClient.DriverCreateBucket(ctx, in, opts...)
4949
}
5050

51-
func (c *COSIProvisionerClient) ProvisionerDeleteBucket(ctx context.Context,
52-
in *cosi.ProvisionerDeleteBucketRequest,
53-
opts ...grpc.CallOption) (*cosi.ProvisionerDeleteBucketResponse, error) {
51+
func (c *COSIProvisionerClient) DriverDeleteBucket(ctx context.Context,
52+
in *cosi.DriverDeleteBucketRequest,
53+
opts ...grpc.CallOption) (*cosi.DriverDeleteBucketResponse, error) {
5454

55-
return c.provisionerClient.ProvisionerDeleteBucket(ctx, in, opts...)
55+
return c.provisionerClient.DriverDeleteBucket(ctx, in, opts...)
5656
}
5757

58-
func (c *COSIProvisionerClient) ProvisionerGrantBucketAccess(ctx context.Context,
59-
in *cosi.ProvisionerGrantBucketAccessRequest,
60-
opts ...grpc.CallOption) (*cosi.ProvisionerGrantBucketAccessResponse, error) {
58+
func (c *COSIProvisionerClient) DriverGrantBucketAccess(ctx context.Context,
59+
in *cosi.DriverGrantBucketAccessRequest,
60+
opts ...grpc.CallOption) (*cosi.DriverGrantBucketAccessResponse, error) {
6161

62-
return c.provisionerClient.ProvisionerGrantBucketAccess(ctx, in, opts...)
62+
return c.provisionerClient.DriverGrantBucketAccess(ctx, in, opts...)
6363
}
6464

65-
func (c *COSIProvisionerClient) ProvisionerRevokeBucketAccess(ctx context.Context,
66-
in *cosi.ProvisionerRevokeBucketAccessRequest,
67-
opts ...grpc.CallOption) (*cosi.ProvisionerRevokeBucketAccessResponse, error) {
65+
func (c *COSIProvisionerClient) DriverRevokeBucketAccess(ctx context.Context,
66+
in *cosi.DriverRevokeBucketAccessRequest,
67+
opts ...grpc.CallOption) (*cosi.DriverRevokeBucketAccessResponse, error) {
6868

69-
return c.provisionerClient.ProvisionerRevokeBucketAccess(ctx, in, opts...)
69+
return c.provisionerClient.DriverRevokeBucketAccess(ctx, in, opts...)
7070
}

0 commit comments

Comments
 (0)