Skip to content

Commit 42f243e

Browse files
KPostOfficeKPostOffice
committed
add hash to end of resource names to avoid name clash
Signed-off-by: Kevin <[email protected]>
1 parent f31a77d commit 42f243e

File tree

3 files changed

+98
-17
lines changed

3 files changed

+98
-17
lines changed

‎pkg/controllers/raycluster_controller.go‎

Lines changed: 74 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,11 @@ func (r *RayClusterReconciler) Reconcile(ctx context.Context, req ctrl.Request)
126126
return ctrl.Result{}, client.IgnoreNotFound(err)
127127
}
128128

129+
if err := deleteDeprecatedObjects(ctx, r, cluster); err != nil {
130+
logger.Error(err, "Failed to delete deprecated objects")
131+
return ctrl.Result{RequeueAfter: requeueTime}, err
132+
}
133+
129134
if cluster.ObjectMeta.DeletionTimestamp.IsZero() {
130135
if !controllerutil.ContainsFinalizer(cluster, oAuthFinalizer) {
131136
logger.Info("Add a finalizer", "finalizer", oAuthFinalizer)
@@ -304,7 +309,7 @@ func isMTLSEnabled(cfg *config.KubeRayConfiguration) bool {
304309
}
305310

306311
func crbNameFromCluster(cluster *rayv1.RayCluster) string {
307-
return cluster.Name + "-" + cluster.Namespace + "-auth" // NOTE: potential naming conflicts ie {name: foo, ns: bar-baz} and {name: foo-bar, ns: baz}
312+
return getUniqueName(cluster.Name + "-" + cluster.Namespace + "-auth")
308313
}
309314

310315
func desiredOAuthClusterRoleBinding(cluster *rayv1.RayCluster) *rbacv1ac.ClusterRoleBindingApplyConfiguration {
@@ -326,7 +331,7 @@ func desiredOAuthClusterRoleBinding(cluster *rayv1.RayCluster) *rbacv1ac.Cluster
326331
}
327332

328333
func oauthServiceAccountNameFromCluster(cluster *rayv1.RayCluster) string {
329-
return cluster.Name + "-oauth-proxy"
334+
return getUniqueName(cluster.Name + "-oauth-proxy")
330335
}
331336

332337
func desiredServiceAccount(cluster *rayv1.RayCluster) *corev1ac.ServiceAccountApplyConfiguration {
@@ -363,11 +368,11 @@ func desiredClusterRoute(cluster *rayv1.RayCluster) *routev1ac.RouteApplyConfigu
363368
}
364369

365370
func oauthServiceNameFromCluster(cluster *rayv1.RayCluster) string {
366-
return cluster.Name + "-oauth"
371+
return getUniqueName(cluster.Name + "-oauth")
367372
}
368373

369374
func oauthServiceTLSSecretName(cluster *rayv1.RayCluster) string {
370-
return cluster.Name + "-proxy-tls-secret"
375+
return getUniqueName(cluster.Name + "-proxy-tls-secret")
371376
}
372377

373378
func desiredOAuthService(cluster *rayv1.RayCluster) *corev1ac.ServiceApplyConfiguration {
@@ -389,7 +394,7 @@ func desiredOAuthService(cluster *rayv1.RayCluster) *corev1ac.ServiceApplyConfig
389394
}
390395

391396
func oauthSecretNameFromCluster(cluster *rayv1.RayCluster) string {
392-
return cluster.Name + "-oauth-config"
397+
return getUniqueName(cluster.Name + "-oauth-config")
393398
}
394399

395400
// desiredOAuthSecret defines the desired OAuth secret object
@@ -406,7 +411,7 @@ func desiredOAuthSecret(cluster *rayv1.RayCluster, cookieSalt string) *corev1ac.
406411
}
407412

408413
func caSecretNameFromCluster(cluster *rayv1.RayCluster) string {
409-
return "ca-secret-" + cluster.Name
414+
return getUniqueName(cluster.Name + "-ca-secret")
410415
}
411416

412417
func desiredCASecret(cluster *rayv1.RayCluster, key, cert []byte) *corev1ac.SecretApplyConfiguration {
@@ -463,7 +468,9 @@ func generateCACertificate() ([]byte, []byte, error) {
463468
}
464469

465470
func desiredWorkersNetworkPolicy(cluster *rayv1.RayCluster) *networkingv1ac.NetworkPolicyApplyConfiguration {
466-
return networkingv1ac.NetworkPolicy(cluster.Name+"-workers", cluster.Namespace).
471+
return networkingv1ac.NetworkPolicy(
472+
getUniqueName(cluster.Name+"-workers"), cluster.Namespace,
473+
).
467474
WithLabels(map[string]string{RayClusterNameLabel: cluster.Name}).
468475
WithSpec(networkingv1ac.NetworkPolicySpec().
469476
WithPodSelector(metav1ac.LabelSelector().WithMatchLabels(map[string]string{"ray.io/cluster": cluster.Name, "ray.io/node-type": "worker"})).
@@ -484,7 +491,7 @@ func desiredHeadNetworkPolicy(cluster *rayv1.RayCluster, cfg *config.KubeRayConf
484491
if ptr.Deref(cfg.MTLSEnabled, true) {
485492
allSecuredPorts = append(allSecuredPorts, networkingv1ac.NetworkPolicyPort().WithProtocol(corev1.ProtocolTCP).WithPort(intstr.FromInt(10001)))
486493
}
487-
return networkingv1ac.NetworkPolicy(cluster.Name+"-head", cluster.Namespace).
494+
return networkingv1ac.NetworkPolicy(getUniqueName(cluster.Name+"-head"), cluster.Namespace).
488495
WithLabels(map[string]string{RayClusterNameLabel: cluster.Name}).
489496
WithSpec(networkingv1ac.NetworkPolicySpec().
490497
WithPodSelector(metav1ac.LabelSelector().WithMatchLabels(map[string]string{"ray.io/cluster": cluster.Name, "ray.io/node-type": "head"})).
@@ -619,3 +626,62 @@ func (r *RayClusterReconciler) SetupWithManager(mgr ctrl.Manager) error {
619626

620627
return controller.Complete(r)
621628
}
629+
630+
func deleteDeprecatedObjects(ctx context.Context, r *RayClusterReconciler, cluster *rayv1.RayCluster) error {
631+
// Delete deprecated objects if they exist. These have all been replace by objects with names generated by
632+
// getUniqueName.
633+
// TODO: DELETE THIS FUNCTION AFTER A FEW RELEASES. Current release = v1.7.0 (remove in 1.9.0 or 1.10.0)
634+
logger := ctrl.LoggerFrom(ctx)
635+
if !r.IsOpenShift {
636+
if err := r.kubeClient.NetworkingV1().Ingresses(cluster.Namespace).Delete(ctx, "rayclient-"+cluster.Name, metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
637+
logger.Error(err, "Failed to delete rayclient ingress")
638+
return err
639+
}
640+
if err := r.kubeClient.NetworkingV1().Ingresses(cluster.Namespace).Delete(ctx, "ray-dashboard-"+cluster.Name, metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
641+
logger.Error(err, "Failed to delete raydashboard ingress")
642+
return err
643+
}
644+
} else {
645+
if err := r.routeClient.Routes(cluster.Namespace).Delete(ctx, "rayclient-"+cluster.Name, metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
646+
logger.Error(err, "Failed to delete rayclient route")
647+
return err
648+
}
649+
if err := r.routeClient.Routes(cluster.Namespace).Delete(ctx, "ray-dashboard-"+cluster.Name, metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
650+
logger.Error(err, "Failed to delete ray-dashboard route")
651+
return err
652+
}
653+
}
654+
if err := r.kubeClient.CoreV1().Secrets(cluster.Namespace).Delete(ctx, cluster.Name+"-oauth-config", metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
655+
logger.Error(err, "Failed to delete oauth secret")
656+
return err
657+
}
658+
if err := r.kubeClient.CoreV1().Secrets(cluster.Namespace).Delete(ctx, "ca-secret-"+cluster.Name, metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
659+
logger.Error(err, "Failed to delete ca secret")
660+
return err
661+
}
662+
if err := r.kubeClient.CoreV1().ServiceAccounts(cluster.Namespace).Delete(ctx, cluster.Name+"-oauth-proxy", metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
663+
logger.Error(err, "Failed to delete SA")
664+
return err
665+
}
666+
if err := r.kubeClient.RbacV1().ClusterRoleBindings().Delete(ctx, cluster.Name+"-"+cluster.Namespace+"-auth", metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
667+
logger.Error(err, "Failed to delete CRB")
668+
return err
669+
}
670+
if err := r.kubeClient.CoreV1().Services(cluster.Namespace).Delete(ctx, cluster.Name+"-oauth", metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
671+
logger.Error(err, "Failed to delete service")
672+
return err
673+
}
674+
if err := r.kubeClient.CoreV1().Secrets(cluster.Namespace).Delete(ctx, cluster.Name+"-proxy-tls-secret", metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
675+
logger.Error(err, "Failed to delete tls secret")
676+
return err
677+
}
678+
if err := r.kubeClient.NetworkingV1().NetworkPolicies(cluster.Namespace).Delete(ctx, cluster.Name+"-workers", metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
679+
logger.Error(err, "Failed to delete worker nwp")
680+
return err
681+
}
682+
if err := r.kubeClient.NetworkingV1().NetworkPolicies(cluster.Namespace).Delete(ctx, cluster.Name+"-head", metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
683+
logger.Error(err, "Failed to delete head nwp")
684+
return err
685+
}
686+
return nil
687+
}

‎pkg/controllers/raycluster_webhook.go‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ func (w *rayClusterWebhook) Default(ctx context.Context, obj runtime.Object) err
7474

7575
rayCluster.Spec.HeadGroupSpec.Template.Spec.Volumes = upsert(rayCluster.Spec.HeadGroupSpec.Template.Spec.Volumes, oauthProxyTLSSecretVolume(rayCluster), withVolumeName(oauthProxyVolumeName))
7676

77-
rayCluster.Spec.HeadGroupSpec.Template.Spec.ServiceAccountName = rayCluster.Name + "-oauth-proxy"
77+
rayCluster.Spec.HeadGroupSpec.Template.Spec.ServiceAccountName = oauthServiceAccountNameFromCluster(rayCluster)
7878
}
7979

8080
if ptr.Deref(w.Config.MTLSEnabled, true) {
@@ -218,7 +218,7 @@ func validateIngress(rayCluster *rayv1.RayCluster) field.ErrorList {
218218
func validateHeadGroupServiceAccountName(rayCluster *rayv1.RayCluster) field.ErrorList {
219219
var allErrors field.ErrorList
220220

221-
if rayCluster.Spec.HeadGroupSpec.Template.Spec.ServiceAccountName != rayCluster.Name+"-oauth-proxy" {
221+
if rayCluster.Spec.HeadGroupSpec.Template.Spec.ServiceAccountName != oauthServiceAccountNameFromCluster(rayCluster) {
222222
allErrors = append(allErrors, field.Invalid(
223223
field.NewPath("spec", "headGroupSpec", "template", "spec", "serviceAccountName"),
224224
rayCluster.Spec.HeadGroupSpec.Template.Spec.ServiceAccountName,
@@ -241,7 +241,7 @@ func oauthProxyContainer(rayCluster *rayv1.RayCluster) corev1.Container {
241241
ValueFrom: &corev1.EnvVarSource{
242242
SecretKeyRef: &corev1.SecretKeySelector{
243243
LocalObjectReference: corev1.LocalObjectReference{
244-
Name: rayCluster.Name + "-oauth-config",
244+
Name: oauthSecretNameFromCluster(rayCluster),
245245
},
246246
Key: "cookie_secret",
247247
},
@@ -251,7 +251,7 @@ func oauthProxyContainer(rayCluster *rayv1.RayCluster) corev1.Container {
251251
Args: []string{
252252
"--https-address=:8443",
253253
"--provider=openshift",
254-
"--openshift-service-account=" + rayCluster.Name + "-oauth-proxy",
254+
"--openshift-service-account=" + oauthServiceAccountNameFromCluster(rayCluster),
255255
"--upstream=http://localhost:8265",
256256
"--tls-cert=/etc/tls/private/tls.crt",
257257
"--tls-key=/etc/tls/private/tls.key",
@@ -273,7 +273,7 @@ func oauthProxyTLSSecretVolume(rayCluster *rayv1.RayCluster) corev1.Volume {
273273
Name: oauthProxyVolumeName,
274274
VolumeSource: corev1.VolumeSource{
275275
Secret: &corev1.SecretVolumeSource{
276-
SecretName: rayCluster.Name + "-proxy-tls-secret",
276+
SecretName: oauthServiceTLSSecretName(rayCluster),
277277
},
278278
},
279279
}
@@ -329,7 +329,7 @@ func caVolumes(rayCluster *rayv1.RayCluster) []corev1.Volume {
329329
Name: "ca-vol",
330330
VolumeSource: corev1.VolumeSource{
331331
Secret: &corev1.SecretVolumeSource{
332-
SecretName: `ca-secret-` + rayCluster.Name,
332+
SecretName: caSecretNameFromCluster(rayCluster),
333333
},
334334
},
335335
},
@@ -343,9 +343,9 @@ func caVolumes(rayCluster *rayv1.RayCluster) []corev1.Volume {
343343
}
344344

345345
func rayHeadInitContainer(rayCluster *rayv1.RayCluster, config *config.KubeRayConfiguration) corev1.Container {
346-
rayClientRoute := "rayclient-" + rayCluster.Name + "-" + rayCluster.Namespace + "." + config.IngressDomain
346+
rayClientRoute := rayClientNameFromCluster(rayCluster) + "-" + rayCluster.Namespace + "." + config.IngressDomain
347347
// Service name for basic interactive
348-
svcDomain := rayCluster.Name + "-head-svc." + rayCluster.Namespace + ".svc"
348+
svcDomain := serviceNameFromCluster(rayCluster) + "." + rayCluster.Namespace + ".svc"
349349

350350
initContainerHead := corev1.Container{
351351
Name: "create-cert",

‎pkg/controllers/support.go‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
package controllers
22

33
import (
4+
"crypto/sha256"
5+
"fmt"
46
"os"
57

68
"github.com/go-logr/logr"
@@ -31,7 +33,7 @@ func getEnv(key, fallback string) string {
3133
}
3234

3335
func serviceNameFromCluster(cluster *rayv1.RayCluster) string {
34-
return cluster.Name + "-head-svc"
36+
return getUniqueName(cluster.Name + "-head-svc")
3537
}
3638

3739
func desiredRayClientRoute(cluster *rayv1.RayCluster) *routeapply.RouteApplyConfiguration {
@@ -209,3 +211,16 @@ func ownerRefForRayCluster(cluster *rayv1.RayCluster) *v1.OwnerReferenceApplyCon
209211
WithUID(cluster.UID).
210212
WithController(true)
211213
}
214+
215+
var (
216+
hashConstant = "codeflare-operator"
217+
hashLength = 8
218+
)
219+
220+
func controllerSpecificHash(s string) string {
221+
return fmt.Sprintf("%x", sha256.Sum256([]byte(hashConstant+s)))[:hashLength]
222+
}
223+
224+
func getUniqueName(s string) string {
225+
return s + "-" + controllerSpecificHash(s)
226+
}

0 commit comments

Comments
 (0)