Skip to content

Commit 4083106

Browse files
tkatilatkatila
committed
operator: add possibility to use a secret for plugin images
Also, pack controller options into a struct. Signed-off-by: Tuomas Katila <[email protected]>
1 parent 6be594f commit 4083106

File tree

17 files changed

+226
-60
lines changed

17 files changed

+226
-60
lines changed

‎cmd/operator/main.go‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ import (
3434

3535
devicepluginv1 "github.com/intel/intel-device-plugins-for-kubernetes/pkg/apis/deviceplugin/v1"
3636
fpgav2 "github.com/intel/intel-device-plugins-for-kubernetes/pkg/apis/fpga/v2"
37+
"github.com/intel/intel-device-plugins-for-kubernetes/pkg/controllers"
3738
"github.com/intel/intel-device-plugins-for-kubernetes/pkg/controllers/dlb"
3839
"github.com/intel/intel-device-plugins-for-kubernetes/pkg/controllers/dsa"
3940
"github.com/intel/intel-device-plugins-for-kubernetes/pkg/controllers/fpga"
@@ -61,7 +62,7 @@ func init() {
6162
// +kubebuilder:scaffold:scheme
6263
}
6364

64-
type devicePluginControllerAndWebhook map[string](func(ctrl.Manager, string, bool) error)
65+
type devicePluginControllerAndWebhook map[string](func(ctrl.Manager, controllers.ControllerOptions) error)
6566

6667
type flagList []string
6768

@@ -208,15 +209,17 @@ func main() {
208209
os.Exit(1)
209210
}
210211

211-
ns := os.Getenv("DEVICEPLUGIN_NAMESPACE")
212-
if ns == "" {
213-
ns = devicePluginNamespace
212+
cargs := controllers.ControllerOptions{WithWebhook: true}
213+
214+
cargs.Namespace = os.Getenv("DEVICEPLUGIN_NAMESPACE")
215+
if cargs.Namespace == "" {
216+
cargs.Namespace = devicePluginNamespace
214217
}
215218

216-
withWebhook := true
219+
cargs.ImagePullSecretName = os.Getenv("DEVICEPLUGIN_SECRET")
217220

218221
for _, device := range devices {
219-
if err = setupControllerAndWebhook[device](mgr, ns, withWebhook); err != nil {
222+
if err = setupControllerAndWebhook[device](mgr, cargs); err != nil {
220223
setupLog.Error(err, "unable to initialize controller", "controller", device)
221224
os.Exit(1)
222225
}

‎pkg/controllers/dlb/controller.go‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,13 +43,13 @@ var defaultNodeSelector map[string]string = deployments.DLBPluginDaemonSet().Spe
4343
// +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=dlbdeviceplugins/finalizers,verbs=update
4444

4545
// SetupReconciler creates a new reconciler for DlbDevicePlugin objects.
46-
func SetupReconciler(mgr ctrl.Manager, namespace string, withWebhook bool) error {
47-
c := &controller{scheme: mgr.GetScheme(), ns: namespace}
46+
func SetupReconciler(mgr ctrl.Manager, args controllers.ControllerOptions) error {
47+
c := &controller{scheme: mgr.GetScheme(), args: args}
4848
if err := controllers.SetupWithManager(mgr, c, devicepluginv1.GroupVersion.String(), "DlbDevicePlugin", ownerKey); err != nil {
4949
return err
5050
}
5151

52-
if withWebhook {
52+
if args.WithWebhook {
5353
return (&devicepluginv1.DlbDevicePlugin{}).SetupWebhookWithManager(mgr)
5454
}
5555

@@ -59,7 +59,7 @@ func SetupReconciler(mgr ctrl.Manager, namespace string, withWebhook bool) error
5959
type controller struct {
6060
controllers.DefaultServiceAccountFactory
6161
scheme *runtime.Scheme
62-
ns string
62+
args controllers.ControllerOptions
6363
}
6464

6565
func (c *controller) CreateEmptyObject() client.Object {
@@ -92,7 +92,13 @@ func (c *controller) NewDaemonSet(rawObj client.Object) *apps.DaemonSet {
9292
setInitContainer(&ds.Spec.Template.Spec, devicePlugin.Spec)
9393
}
9494

95-
ds.ObjectMeta.Namespace = c.ns
95+
ds.ObjectMeta.Namespace = c.args.Namespace
96+
97+
if len(c.args.ImagePullSecretName) > 0 {
98+
ds.Spec.Template.Spec.ImagePullSecrets = []v1.LocalObjectReference{
99+
{Name: c.args.ImagePullSecretName},
100+
}
101+
}
96102

97103
ds.Spec.Template.Spec.Containers[0].Args = getPodArgs(devicePlugin)
98104
ds.Spec.Template.Spec.Containers[0].Image = devicePlugin.Spec.Image

‎pkg/controllers/dlb/controller_test.go‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
4545
APIVersion: "apps/v1",
4646
},
4747
ObjectMeta: metav1.ObjectMeta{
48-
Namespace: c.ns,
48+
Namespace: c.args.Namespace,
4949
Name: appLabel + "-" + devicePlugin.Name,
5050
Labels: map[string]string{
5151
"app": appLabel,
@@ -155,6 +155,12 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
155155
},
156156
}
157157

158+
if len(c.args.ImagePullSecretName) > 0 {
159+
daemonSet.Spec.Template.Spec.ImagePullSecrets = []v1.LocalObjectReference{
160+
{Name: c.args.ImagePullSecretName},
161+
}
162+
}
163+
158164
return &daemonSet
159165
}
160166

@@ -171,4 +177,12 @@ func TestNewDaemonSetDLB(t *testing.T) {
171177
if !reflect.DeepEqual(expected, actual) {
172178
t.Errorf("expected and actuall daemonsets differ: %+s", diff.ObjectGoPrintDiff(expected, actual))
173179
}
180+
181+
c.args.ImagePullSecretName = "mysecret"
182+
183+
expected = c.newDaemonSetExpected(plugin)
184+
actual = c.NewDaemonSet(plugin)
185+
if !reflect.DeepEqual(expected, actual) {
186+
t.Errorf("expected and actual daemonsets with secret differ: %+s", diff.ObjectGoPrintDiff(expected, actual))
187+
}
174188
}

‎pkg/controllers/dsa/controller.go‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -47,13 +47,13 @@ var defaultNodeSelector = deployments.DSAPluginDaemonSet().Spec.Template.Spec.No
4747
// +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=dsadeviceplugins/finalizers,verbs=update
4848

4949
// SetupReconciler creates a new reconciler for DsaDevicePlugin objects.
50-
func SetupReconciler(mgr ctrl.Manager, namespace string, withWebhook bool) error {
51-
c := &controller{scheme: mgr.GetScheme(), ns: namespace}
50+
func SetupReconciler(mgr ctrl.Manager, args controllers.ControllerOptions) error {
51+
c := &controller{scheme: mgr.GetScheme(), args: args}
5252
if err := controllers.SetupWithManager(mgr, c, devicepluginv1.GroupVersion.String(), "DsaDevicePlugin", ownerKey); err != nil {
5353
return err
5454
}
5555

56-
if withWebhook {
56+
if args.WithWebhook {
5757
return (&devicepluginv1.DsaDevicePlugin{}).SetupWebhookWithManager(mgr)
5858
}
5959

@@ -63,7 +63,7 @@ func SetupReconciler(mgr ctrl.Manager, namespace string, withWebhook bool) error
6363
type controller struct {
6464
controllers.DefaultServiceAccountFactory
6565
scheme *runtime.Scheme
66-
ns string
66+
args controllers.ControllerOptions
6767
}
6868

6969
func (c *controller) CreateEmptyObject() client.Object {
@@ -200,14 +200,20 @@ func (c *controller) NewDaemonSet(rawObj client.Object) *apps.DaemonSet {
200200
daemonSet.Spec.Template.Spec.Tolerations = devicePlugin.Spec.Tolerations
201201
}
202202

203-
daemonSet.ObjectMeta.Namespace = c.ns
203+
daemonSet.ObjectMeta.Namespace = c.args.Namespace
204204
daemonSet.Spec.Template.Spec.Containers[0].Args = getPodArgs(devicePlugin)
205205
daemonSet.Spec.Template.Spec.Containers[0].Image = devicePlugin.Spec.Image
206206

207207
if devicePlugin.Spec.InitImage != "" {
208208
addInitContainer(daemonSet, devicePlugin)
209209
}
210210

211+
if len(c.args.ImagePullSecretName) > 0 {
212+
daemonSet.Spec.Template.Spec.ImagePullSecrets = []v1.LocalObjectReference{
213+
{Name: c.args.ImagePullSecretName},
214+
}
215+
}
216+
211217
return daemonSet
212218
}
213219

‎pkg/controllers/dsa/controller_test.go‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
4747
APIVersion: "apps/v1",
4848
},
4949
ObjectMeta: metav1.ObjectMeta{
50-
Namespace: c.ns,
50+
Namespace: c.args.Namespace,
5151
Name: appLabel + "-" + devicePlugin.Name,
5252
Labels: map[string]string{
5353
"app": appLabel,
@@ -177,6 +177,12 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
177177
addInitContainer(&daemonSet, devicePlugin)
178178
}
179179

180+
if len(c.args.ImagePullSecretName) > 0 {
181+
daemonSet.Spec.Template.Spec.ImagePullSecrets = []v1.LocalObjectReference{
182+
{Name: c.args.ImagePullSecretName},
183+
}
184+
}
185+
180186
return &daemonSet
181187
}
182188

@@ -193,4 +199,12 @@ func TestNewDaemonSetDSA(t *testing.T) {
193199
if !reflect.DeepEqual(expected, actual) {
194200
t.Errorf("expected and actuall daemonsets differ: %+s", diff.ObjectGoPrintDiff(expected, actual))
195201
}
202+
203+
c.args.ImagePullSecretName = "mysecret"
204+
205+
expected = c.newDaemonSetExpected(plugin)
206+
actual = c.NewDaemonSet(plugin)
207+
if !reflect.DeepEqual(expected, actual) {
208+
t.Errorf("expected and actual daemonsets with secret differ: %+s", diff.ObjectGoPrintDiff(expected, actual))
209+
}
196210
}

‎pkg/controllers/fpga/controller.go‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222
"strings"
2323

2424
apps "k8s.io/api/apps/v1"
25+
v1 "k8s.io/api/core/v1"
2526
"k8s.io/apimachinery/pkg/runtime"
2627
"k8s.io/client-go/tools/reference"
2728
ctrl "sigs.k8s.io/controller-runtime"
@@ -42,13 +43,13 @@ var defaultNodeSelector = deployments.FPGAPluginDaemonSet().Spec.Template.Spec.N
4243
// +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=fpgadeviceplugins/finalizers,verbs=update
4344

4445
// SetupReconciler creates a new reconciler for FpgaDevicePlugin objects.
45-
func SetupReconciler(mgr ctrl.Manager, namespace string, withWebhook bool) error {
46-
c := &controller{scheme: mgr.GetScheme(), ns: namespace}
46+
func SetupReconciler(mgr ctrl.Manager, args controllers.ControllerOptions) error {
47+
c := &controller{scheme: mgr.GetScheme(), args: args}
4748
if err := controllers.SetupWithManager(mgr, c, devicepluginv1.GroupVersion.String(), "FpgaDevicePlugin", ownerKey); err != nil {
4849
return err
4950
}
5051

51-
if withWebhook {
52+
if args.WithWebhook {
5253
return (&devicepluginv1.FpgaDevicePlugin{}).SetupWebhookWithManager(mgr)
5354
}
5455

@@ -58,7 +59,7 @@ func SetupReconciler(mgr ctrl.Manager, namespace string, withWebhook bool) error
5859
type controller struct {
5960
controllers.DefaultServiceAccountFactory
6061
scheme *runtime.Scheme
61-
ns string
62+
args controllers.ControllerOptions
6263
}
6364

6465
func (c *controller) CreateEmptyObject() client.Object {
@@ -84,7 +85,13 @@ func (c *controller) NewDaemonSet(rawObj client.Object) *apps.DaemonSet {
8485
daemonSet.Spec.Template.Spec.Tolerations = devicePlugin.Spec.Tolerations
8586
}
8687

87-
daemonSet.ObjectMeta.Namespace = c.ns
88+
daemonSet.ObjectMeta.Namespace = c.args.Namespace
89+
90+
if len(c.args.ImagePullSecretName) > 0 {
91+
daemonSet.Spec.Template.Spec.ImagePullSecrets = []v1.LocalObjectReference{
92+
{Name: c.args.ImagePullSecretName},
93+
}
94+
}
8895

8996
daemonSet.Spec.Template.Spec.Containers[0].Args = getPodArgs(devicePlugin)
9097
daemonSet.Spec.Template.Spec.Containers[0].Image = devicePlugin.Spec.Image

‎pkg/controllers/fpga/controller_test.go‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,13 +42,13 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
4242
maxUnavailable := intstr.FromInt(1)
4343
maxSurge := intstr.FromInt(0)
4444

45-
return &apps.DaemonSet{
45+
ds := &apps.DaemonSet{
4646
TypeMeta: metav1.TypeMeta{
4747
Kind: "DaemonSet",
4848
APIVersion: "apps/v1",
4949
},
5050
ObjectMeta: metav1.ObjectMeta{
51-
Namespace: c.ns,
51+
Namespace: c.args.Namespace,
5252
Name: appLabel + "-" + devicePlugin.Name,
5353
Labels: map[string]string{
5454
"app": appLabel,
@@ -198,6 +198,14 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
198198
},
199199
},
200200
}
201+
202+
if len(c.args.ImagePullSecretName) > 0 {
203+
ds.Spec.Template.Spec.ImagePullSecrets = []v1.LocalObjectReference{
204+
{Name: c.args.ImagePullSecretName},
205+
}
206+
}
207+
208+
return ds
201209
}
202210

203211
// Test that FPGA daemonset created by using go:embed is
@@ -218,4 +226,12 @@ func TestNewDaemonSetFPGA(t *testing.T) {
218226
if !reflect.DeepEqual(expected, actual) {
219227
t.Errorf("expected and actuall daemonsets differ: %+s", diff.ObjectGoPrintDiff(expected, actual))
220228
}
229+
230+
c.args.ImagePullSecretName = "mysecret"
231+
232+
expected = c.newDaemonSetExpected(plugin)
233+
actual = c.NewDaemonSet(plugin)
234+
if !reflect.DeepEqual(expected, actual) {
235+
t.Errorf("expected and actual daemonsets with secret differ: %+s", diff.ObjectGoPrintDiff(expected, actual))
236+
}
221237
}

‎pkg/controllers/gpu/controller.go‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -49,13 +49,13 @@ var defaultNodeSelector = deployments.GPUPluginDaemonSet().Spec.Template.Spec.No
4949
// +kubebuilder:rbac:groups=deviceplugin.intel.com,resources=gpudeviceplugins/finalizers,verbs=update
5050

5151
// SetupReconciler creates a new reconciler for GpuDevicePlugin objects.
52-
func SetupReconciler(mgr ctrl.Manager, namespace string, withWebhook bool) error {
53-
c := &controller{scheme: mgr.GetScheme(), ns: namespace}
52+
func SetupReconciler(mgr ctrl.Manager, args controllers.ControllerOptions) error {
53+
c := &controller{scheme: mgr.GetScheme(), args: args}
5454
if err := controllers.SetupWithManager(mgr, c, devicepluginv1.GroupVersion.String(), "GpuDevicePlugin", ownerKey); err != nil {
5555
return err
5656
}
5757

58-
if withWebhook {
58+
if args.WithWebhook {
5959
return (&devicepluginv1.GpuDevicePlugin{}).SetupWebhookWithManager(mgr)
6060
}
6161

@@ -64,7 +64,7 @@ func SetupReconciler(mgr ctrl.Manager, namespace string, withWebhook bool) error
6464

6565
type controller struct {
6666
scheme *runtime.Scheme
67-
ns string
67+
args controllers.ControllerOptions
6868
}
6969

7070
func (c *controller) CreateEmptyObject() client.Object {
@@ -80,7 +80,7 @@ func (c *controller) NewSharedServiceAccount() *v1.ServiceAccount {
8080
return &v1.ServiceAccount{
8181
ObjectMeta: metav1.ObjectMeta{
8282
Name: serviceAccountName,
83-
Namespace: c.ns,
83+
Namespace: c.args.Namespace,
8484
},
8585
}
8686
}
@@ -89,13 +89,13 @@ func (c *controller) NewSharedClusterRoleBinding() *rbacv1.ClusterRoleBinding {
8989
return &rbacv1.ClusterRoleBinding{
9090
ObjectMeta: metav1.ObjectMeta{
9191
Name: roleBindingName,
92-
Namespace: c.ns,
92+
Namespace: c.args.Namespace,
9393
},
9494
Subjects: []rbacv1.Subject{
9595
{
9696
Kind: "ServiceAccount",
9797
Name: serviceAccountName,
98-
Namespace: c.ns,
98+
Namespace: c.args.Namespace,
9999
},
100100
},
101101
RoleRef: rbacv1.RoleRef{
@@ -140,10 +140,16 @@ func (c *controller) NewDaemonSet(rawObj client.Object) *apps.DaemonSet {
140140
daemonSet.Spec.Template.Spec.Tolerations = devicePlugin.Spec.Tolerations
141141
}
142142

143-
daemonSet.ObjectMeta.Namespace = c.ns
143+
daemonSet.ObjectMeta.Namespace = c.args.Namespace
144144
daemonSet.Spec.Template.Spec.Containers[0].Args = getPodArgs(devicePlugin)
145145
daemonSet.Spec.Template.Spec.Containers[0].Image = devicePlugin.Spec.Image
146146

147+
if len(c.args.ImagePullSecretName) > 0 {
148+
daemonSet.Spec.Template.Spec.ImagePullSecrets = []v1.LocalObjectReference{
149+
{Name: c.args.ImagePullSecretName},
150+
}
151+
}
152+
147153
if devicePlugin.Spec.InitImage == "" {
148154
daemonSet.Spec.Template.Spec.InitContainers = nil
149155
daemonSet.Spec.Template.Spec.Volumes = removeVolume(daemonSet.Spec.Template.Spec.Volumes, "nfd-features")

0 commit comments

Comments
 (0)