Merge pull request #65 from renugadevi-2613/v0.0.2

Re-architected code with hybrid implementation - (codeine + kubebuilder)

Dockerfile

@@ -13,7 +13,7 @@ RUN go mod download
 COPY main.go main.go
 COPY apis/ apis/
 COPY controllers/ controllers/
-
+COPY pkg/ pkg/
 # Build
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -a -o manager main.go
 

PROJECT

@@ -19,4 +19,18 @@ resources:
   kind: ConfigMap
   path: k8s.io/api/core/v1
   version: v1
+- controller: true
+  group: core
+  kind: Secret
+  path: k8s.io/api/core/v1
+  version: v1
+- api:
+    crdVersion: v1
+    namespaced: true
+  controller: true
+  domain: configurator.gopaddle.io
+  group: configurator.gopaddle.io
+  kind: CustomSecret
+  path: github.com/gopaddle-io/configurator/apis/configurator.gopaddle.io/v1alpha1
+  version: v1alpha1
 version: "3"

apis/configurator.gopaddle.io/v1alpha1/customsecret_types.go

@@ -0,0 +1,59 @@
+/*
+Copyright 2021.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
+// NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.
+
+// CustomSecretSpec defines the desired state of CustomSecret
+type CustomSecretSpec struct {
+	SecretName        string            `json:"secretName,omitempty"`
+	StringData        map[string]string `json:"stringData,omitempty"`
+	Data              map[string][]byte `json:"data,omitempty"`
+	Type              corev1.SecretType `json:"type,omitempty"`
+	SecretAnnotations map[string]string `json:"secretAnnotations,omitempty"`
+}
+
+// +genclient
+// +genclient:noStatus
+//+kubebuilder:object:root=true
+
+// CustomSecret is the Schema for the customsecrets API
+type CustomSecret struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec CustomSecretSpec `json:"spec,omitempty"`
+}
+
+//+kubebuilder:object:root=true
+
+// CustomSecretList contains a list of CustomSecret
+type CustomSecretList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []CustomSecret `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&CustomSecret{}, &CustomSecretList{})
+}

config/crd/bases/configurator.gopaddle.io_customsecrets.yaml

@@ -0,0 +1,65 @@
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.4.1
+  creationTimestamp: null
+  name: customsecrets.configurator.gopaddle.io
+spec:
+  group: configurator.gopaddle.io
+  names:
+    kind: CustomSecret
+    listKind: CustomSecretList
+    plural: customsecrets
+    singular: customsecret
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: CustomSecret is the Schema for the customsecrets API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: CustomSecretSpec defines the desired state of CustomSecret
+            properties:
+              data:
+                additionalProperties:
+                  format: byte
+                  type: string
+                type: object
+              secretAnnotations:
+                additionalProperties:
+                  type: string
+                type: object
+              secretName:
+                type: string
+              stringData:
+                additionalProperties:
+                  type: string
+                type: object
+              type:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

config/crd/kustomization.yaml

@@ -3,17 +3,20 @@
 # It should be run by config/default
 resources:
 - bases/configurator.gopaddle.io_customconfigmaps.yaml
+- bases/configurator.gopaddle.io_customsecrets.yaml
 #+kubebuilder:scaffold:crdkustomizeresource
 
 patchesStrategicMerge:
 # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
 # patches here are for enabling the conversion webhook for each CRD
 #- patches/webhook_in_customconfigmaps.yaml
+#- patches/webhook_in_customsecrets.yaml
 #+kubebuilder:scaffold:crdkustomizewebhookpatch
 
 # [CERTMANAGER] To enable webhook, uncomment all the sections with [CERTMANAGER] prefix.
 # patches here are for enabling the CA injection for each CRD
 #- patches/cainjection_in_customconfigmaps.yaml
+#- patches/cainjection_in_customsecrets.yaml
 #+kubebuilder:scaffold:crdkustomizecainjectionpatch
 
 # the following config is for teaching kustomize how to do kustomization for CRDs.

config/crd/patches/cainjection_in_customsecrets.yaml

@@ -0,0 +1,7 @@
+# The following patch adds a directive for certmanager to inject CA into the CRD
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
+  name: customsecrets.configurator.gopaddle.io

config/crd/patches/webhook_in_customsecrets.yaml

@@ -0,0 +1,16 @@
+# The following patch enables a conversion webhook for the CRD
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: customsecrets.configurator.gopaddle.io
+spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          namespace: system
+          name: webhook-service
+          path: /convert
+      conversionReviewVersions:
+      - v1

config/manager/kustomization.yaml

@@ -13,4 +13,4 @@ kind: Kustomization
 images:
 - name: controller
   newName: trov/configurator
-  newTag: "1.10"
+  newTag: "1.6"

config/manager/manager.yaml

@@ -22,8 +22,6 @@ spec:
       labels:
         control-plane: controller-manager
     spec:
-      securityContext:
-        runAsNonRoot: true
       containers:
       - command:
         - /manager
@@ -33,6 +31,8 @@ spec:
         name: manager
         securityContext:
           allowPrivilegeEscalation: false
+          runAsUser: 65532
+          runAsGroup: 65532
         livenessProbe:
           httpGet:
             path: /healthz
@@ -48,9 +48,14 @@ spec:
         resources:
           limits:
             cpu: 100m
-            memory: 30Mi
+            memory: 2000Mi
           requests:
             cpu: 100m
-            memory: 20Mi
+            memory: 1000Mi
+      initContainers:
+      - command:
+        - ./controllerInit
+        image: trov/controllerinit:1.3
+        name: init-controller
       serviceAccountName: controller-manager
       terminationGracePeriodSeconds: 10

config/rbac/customsecret_editor_role.yaml

@@ -0,0 +1,24 @@
+# permissions for end users to edit customsecrets.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: customsecret-editor-role
+rules:
+- apiGroups:
+  - configurator.gopaddle.io
+  resources:
+  - customsecrets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - configurator.gopaddle.io
+  resources:
+  - customsecrets/status
+  verbs:
+  - get

config/rbac/customsecret_viewer_role.yaml

@@ -0,0 +1,20 @@
+# permissions for end users to view customsecrets.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: customsecret-viewer-role
+rules:
+- apiGroups:
+  - configurator.gopaddle.io
+  resources:
+  - customsecrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - configurator.gopaddle.io
+  resources:
+  - customsecrets/status
+  verbs:
+  - get