Skip to content

Commit ffbf30a

Browse files
KPostOfficeKPostOffice
committed
add hash to end of resource names to avoid name clash
Signed-off-by: Kevin <[email protected]>
1 parent 280b766 commit ffbf30a

File tree

3 files changed

+80
-17
lines changed

3 files changed

+80
-17
lines changed

‎pkg/controllers/raycluster_controller.go‎

Lines changed: 56 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,10 @@ func (r *RayClusterReconciler) Reconcile(ctx context.Context, req ctrl.Request)
119119

120120
cluster := &rayv1.RayCluster{}
121121

122+
if err := deleteDeprecatedObjects(ctx, r, cluster); err != nil {
123+
return ctrl.Result{RequeueAfter: requeueTime}, err
124+
}
125+
122126
if err := r.Get(ctx, req.NamespacedName, cluster); err != nil {
123127
if !errors.IsNotFound(err) {
124128
logger.Error(err, "Error getting RayCluster resource")
@@ -304,7 +308,7 @@ func isMTLSEnabled(cfg *config.KubeRayConfiguration) bool {
304308
}
305309

306310
func crbNameFromCluster(cluster *rayv1.RayCluster) string {
307-
return cluster.Name + "-" + cluster.Namespace + "-auth" // NOTE: potential naming conflicts ie {name: foo, ns: bar-baz} and {name: foo-bar, ns: baz}
311+
return getUniqueName(cluster.Name + "-" + cluster.Namespace + "-auth")
308312
}
309313

310314
func desiredOAuthClusterRoleBinding(cluster *rayv1.RayCluster) *rbacv1ac.ClusterRoleBindingApplyConfiguration {
@@ -326,7 +330,7 @@ func desiredOAuthClusterRoleBinding(cluster *rayv1.RayCluster) *rbacv1ac.Cluster
326330
}
327331

328332
func oauthServiceAccountNameFromCluster(cluster *rayv1.RayCluster) string {
329-
return cluster.Name + "-oauth-proxy"
333+
return getUniqueName(cluster.Name + "-oauth-proxy")
330334
}
331335

332336
func desiredServiceAccount(cluster *rayv1.RayCluster) *corev1ac.ServiceAccountApplyConfiguration {
@@ -363,11 +367,11 @@ func desiredClusterRoute(cluster *rayv1.RayCluster) *routev1ac.RouteApplyConfigu
363367
}
364368

365369
func oauthServiceNameFromCluster(cluster *rayv1.RayCluster) string {
366-
return cluster.Name + "-oauth"
370+
return getUniqueName(cluster.Name + "-oauth")
367371
}
368372

369373
func oauthServiceTLSSecretName(cluster *rayv1.RayCluster) string {
370-
return cluster.Name + "-proxy-tls-secret"
374+
return getUniqueName(cluster.Name + "-proxy-tls-secret")
371375
}
372376

373377
func desiredOAuthService(cluster *rayv1.RayCluster) *corev1ac.ServiceApplyConfiguration {
@@ -389,7 +393,7 @@ func desiredOAuthService(cluster *rayv1.RayCluster) *corev1ac.ServiceApplyConfig
389393
}
390394

391395
func oauthSecretNameFromCluster(cluster *rayv1.RayCluster) string {
392-
return cluster.Name + "-oauth-config"
396+
return getUniqueName(cluster.Name + "-oauth-config")
393397
}
394398

395399
// desiredOAuthSecret defines the desired OAuth secret object
@@ -406,7 +410,7 @@ func desiredOAuthSecret(cluster *rayv1.RayCluster, cookieSalt string) *corev1ac.
406410
}
407411

408412
func caSecretNameFromCluster(cluster *rayv1.RayCluster) string {
409-
return "ca-secret-" + cluster.Name
413+
return getUniqueName("ca-secret-" + cluster.Name)
410414
}
411415

412416
func desiredCASecret(cluster *rayv1.RayCluster, key, cert []byte) *corev1ac.SecretApplyConfiguration {
@@ -463,7 +467,9 @@ func generateCACertificate() ([]byte, []byte, error) {
463467
}
464468

465469
func desiredWorkersNetworkPolicy(cluster *rayv1.RayCluster) *networkingv1ac.NetworkPolicyApplyConfiguration {
466-
return networkingv1ac.NetworkPolicy(cluster.Name+"-workers", cluster.Namespace).
470+
return networkingv1ac.NetworkPolicy(
471+
getUniqueName(cluster.Name+"-workers"), cluster.Namespace,
472+
).
467473
WithLabels(map[string]string{RayClusterNameLabel: cluster.Name}).
468474
WithSpec(networkingv1ac.NetworkPolicySpec().
469475
WithPodSelector(metav1ac.LabelSelector().WithMatchLabels(map[string]string{"ray.io/cluster": cluster.Name, "ray.io/node-type": "worker"})).
@@ -484,7 +490,7 @@ func desiredHeadNetworkPolicy(cluster *rayv1.RayCluster, cfg *config.KubeRayConf
484490
if ptr.Deref(cfg.MTLSEnabled, true) {
485491
allSecuredPorts = append(allSecuredPorts, networkingv1ac.NetworkPolicyPort().WithProtocol(corev1.ProtocolTCP).WithPort(intstr.FromInt(10001)))
486492
}
487-
return networkingv1ac.NetworkPolicy(cluster.Name+"-head", cluster.Namespace).
493+
return networkingv1ac.NetworkPolicy(getUniqueName(cluster.Name+"-head"), cluster.Namespace).
488494
WithLabels(map[string]string{RayClusterNameLabel: cluster.Name}).
489495
WithSpec(networkingv1ac.NetworkPolicySpec().
490496
WithPodSelector(metav1ac.LabelSelector().WithMatchLabels(map[string]string{"ray.io/cluster": cluster.Name, "ray.io/node-type": "head"})).
@@ -619,3 +625,45 @@ func (r *RayClusterReconciler) SetupWithManager(mgr ctrl.Manager) error {
619625

620626
return controller.Complete(r)
621627
}
628+
629+
func deleteDeprecatedObjects(ctx context.Context, r *RayClusterReconciler, cluster *rayv1.RayCluster) error {
630+
// Delete deprecated objects if they exist. These have all been replace by objects with names generated by
631+
// getUniqueName.
632+
if err := r.kubeClient.NetworkingV1().Ingresses(cluster.Namespace).Delete(ctx, "rayclient-"+cluster.Name, metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
633+
return err
634+
}
635+
if err := r.kubeClient.NetworkingV1().Ingresses(cluster.Namespace).Delete(ctx, "ray-dashboard-"+cluster.Name, metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
636+
return err
637+
}
638+
if err := r.routeClient.Routes(cluster.Namespace).Delete(ctx, "rayclient-"+cluster.Name, metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
639+
return err
640+
}
641+
if err := r.routeClient.Routes(cluster.Namespace).Delete(ctx, "ray-dashboard-"+cluster.Name, metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
642+
return err
643+
}
644+
if err := r.kubeClient.CoreV1().Secrets(cluster.Namespace).Delete(ctx, cluster.Name+"-oauth-config", metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
645+
return err
646+
}
647+
if err := r.kubeClient.CoreV1().Secrets(cluster.Namespace).Delete(ctx, "ca-secret-"+cluster.Name, metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
648+
return err
649+
}
650+
if err := r.kubeClient.CoreV1().ServiceAccounts(cluster.Namespace).Delete(ctx, cluster.Name+"-oauth-proxy", metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
651+
return err
652+
}
653+
if err := r.kubeClient.RbacV1().ClusterRoleBindings().Delete(ctx, cluster.Name+"-"+cluster.Namespace+"-auth", metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
654+
return err
655+
}
656+
if err := r.kubeClient.CoreV1().Services(cluster.Namespace).Delete(ctx, cluster.Name+"-oauth", metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
657+
return err
658+
}
659+
if err := r.kubeClient.CoreV1().Secrets(cluster.Namespace).Delete(ctx, cluster.Name+"-proxy-tls-secret", metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
660+
return err
661+
}
662+
if err := r.kubeClient.NetworkingV1().NetworkPolicies(cluster.Namespace).Delete(ctx, cluster.Name+"-workers", metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
663+
return err
664+
}
665+
if err := r.kubeClient.NetworkingV1().NetworkPolicies(cluster.Namespace).Delete(ctx, cluster.Name+"-head", metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
666+
return err
667+
}
668+
return nil
669+
}

‎pkg/controllers/raycluster_webhook.go‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ func (w *rayClusterWebhook) Default(ctx context.Context, obj runtime.Object) err
7474

7575
rayCluster.Spec.HeadGroupSpec.Template.Spec.Volumes = upsert(rayCluster.Spec.HeadGroupSpec.Template.Spec.Volumes, oauthProxyTLSSecretVolume(rayCluster), withVolumeName(oauthProxyVolumeName))
7676

77-
rayCluster.Spec.HeadGroupSpec.Template.Spec.ServiceAccountName = rayCluster.Name + "-oauth-proxy"
77+
rayCluster.Spec.HeadGroupSpec.Template.Spec.ServiceAccountName = oauthServiceAccountNameFromCluster(rayCluster)
7878
}
7979

8080
if ptr.Deref(w.Config.MTLSEnabled, true) {
@@ -218,7 +218,7 @@ func validateIngress(rayCluster *rayv1.RayCluster) field.ErrorList {
218218
func validateHeadGroupServiceAccountName(rayCluster *rayv1.RayCluster) field.ErrorList {
219219
var allErrors field.ErrorList
220220

221-
if rayCluster.Spec.HeadGroupSpec.Template.Spec.ServiceAccountName != rayCluster.Name+"-oauth-proxy" {
221+
if rayCluster.Spec.HeadGroupSpec.Template.Spec.ServiceAccountName != oauthServiceAccountNameFromCluster(rayCluster) {
222222
allErrors = append(allErrors, field.Invalid(
223223
field.NewPath("spec", "headGroupSpec", "template", "spec", "serviceAccountName"),
224224
rayCluster.Spec.HeadGroupSpec.Template.Spec.ServiceAccountName,
@@ -241,7 +241,7 @@ func oauthProxyContainer(rayCluster *rayv1.RayCluster) corev1.Container {
241241
ValueFrom: &corev1.EnvVarSource{
242242
SecretKeyRef: &corev1.SecretKeySelector{
243243
LocalObjectReference: corev1.LocalObjectReference{
244-
Name: rayCluster.Name + "-oauth-config",
244+
Name: oauthSecretNameFromCluster(rayCluster),
245245
},
246246
Key: "cookie_secret",
247247
},
@@ -251,7 +251,7 @@ func oauthProxyContainer(rayCluster *rayv1.RayCluster) corev1.Container {
251251
Args: []string{
252252
"--https-address=:8443",
253253
"--provider=openshift",
254-
"--openshift-service-account=" + rayCluster.Name + "-oauth-proxy",
254+
"--openshift-service-account=" + oauthServiceAccountNameFromCluster(rayCluster),
255255
"--upstream=http://localhost:8265",
256256
"--tls-cert=/etc/tls/private/tls.crt",
257257
"--tls-key=/etc/tls/private/tls.key",
@@ -273,7 +273,7 @@ func oauthProxyTLSSecretVolume(rayCluster *rayv1.RayCluster) corev1.Volume {
273273
Name: oauthProxyVolumeName,
274274
VolumeSource: corev1.VolumeSource{
275275
Secret: &corev1.SecretVolumeSource{
276-
SecretName: rayCluster.Name + "-proxy-tls-secret",
276+
SecretName: oauthServiceTLSSecretName(rayCluster),
277277
},
278278
},
279279
}
@@ -329,7 +329,7 @@ func caVolumes(rayCluster *rayv1.RayCluster) []corev1.Volume {
329329
Name: "ca-vol",
330330
VolumeSource: corev1.VolumeSource{
331331
Secret: &corev1.SecretVolumeSource{
332-
SecretName: `ca-secret-` + rayCluster.Name,
332+
SecretName: caSecretNameFromCluster(rayCluster),
333333
},
334334
},
335335
},
@@ -343,9 +343,9 @@ func caVolumes(rayCluster *rayv1.RayCluster) []corev1.Volume {
343343
}
344344

345345
func rayHeadInitContainer(rayCluster *rayv1.RayCluster, config *config.KubeRayConfiguration) corev1.Container {
346-
rayClientRoute := "rayclient-" + rayCluster.Name + "-" + rayCluster.Namespace + "." + config.IngressDomain
346+
rayClientRoute := rayClientNameFromCluster(rayCluster) + "-" + rayCluster.Namespace + "." + config.IngressDomain
347347
// Service name for basic interactive
348-
svcDomain := rayCluster.Name + "-head-svc." + rayCluster.Namespace + ".svc"
348+
svcDomain := serviceNameFromCluster(rayCluster) + "." + rayCluster.Namespace + ".svc"
349349

350350
initContainerHead := corev1.Container{
351351
Name: "create-cert",

‎pkg/controllers/support.go‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
package controllers
22

33
import (
4+
"crypto/sha256"
5+
"fmt"
46
"os"
57

68
"github.com/go-logr/logr"
@@ -31,7 +33,7 @@ func getEnv(key, fallback string) string {
3133
}
3234

3335
func serviceNameFromCluster(cluster *rayv1.RayCluster) string {
34-
return cluster.Name + "-head-svc"
36+
return getUniqueName(cluster.Name + "-head-svc")
3537
}
3638

3739
func desiredRayClientRoute(cluster *rayv1.RayCluster) *routeapply.RouteApplyConfiguration {
@@ -209,3 +211,16 @@ func ownerRefForRayCluster(cluster *rayv1.RayCluster) *v1.OwnerReferenceApplyCon
209211
WithUID(cluster.UID).
210212
WithController(true)
211213
}
214+
215+
var (
216+
hashConstant = "codeflare-operator"
217+
hashLength = 8
218+
)
219+
220+
func controllerSpecificHash(s string) string {
221+
return fmt.Sprintf("%x", sha256.Sum256([]byte(hashConstant+s)))[:hashLength]
222+
}
223+
224+
func getUniqueName(s string) string {
225+
return s + "-" + controllerSpecificHash(s)
226+
}

0 commit comments

Comments
 (0)