* RBAC: restrict SeedImage controller auth to fleet-default
do not allow the seedimage-controller to operate on pods, services and
configmaps outside of the fleet-default namespace.
Fixes#457
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
* RBAC: move all rbac resources to rbac.yaml
Also have all of them collected and generated via kustomize
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
---------
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
The new Registry field allows to prepend a common registry to the
image URLs of the embedded ManagedOSVersion resources.
Fixes#549
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
* operator: introduce support to IPAM assigned IP address
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
* Add nmstate support
Signed-off-by: Andrea Mazzotti <andrea.mazzotti@suse.com>
---------
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
Signed-off-by: Andrea Mazzotti <andrea.mazzotti@suse.com>
Co-authored-by: Francesco Giudici <francesco.giudici@suse.com>
* Implement ManagedOSVersion controller and finalizer
Signed-off-by: Andrea Mazzotti <andrea.mazzotti@suse.com>
* Remove unused ManagedOSVersion Status
Signed-off-by: Andrea Mazzotti <andrea.mazzotti@suse.com>
---------
Signed-off-by: Andrea Mazzotti <andrea.mazzotti@suse.com>
Co-authored-by: Francesco Giudici <francesco.giudici@gmail.com>
* Update system-upgrade-controller API
Signed-off-by: Andrea Mazzotti <andrea.mazzotti@suse.com>
* Update Fleet API
Signed-off-by: Andrea Mazzotti <andrea.mazzotti@suse.com>
* Sanitize dependencies
Signed-off-by: Andrea Mazzotti <andrea.mazzotti@suse.com>
---------
Signed-off-by: Andrea Mazzotti <andrea.mazzotti@suse.com>
* Drain nodes by default on upgrade
Signed-off-by: Andrea Mazzotti <andrea.mazzotti@suse.com>
* Make DrainSpec nullable
Signed-off-by: Andrea Mazzotti <andrea.mazzotti@suse.com>
---------
Signed-off-by: Andrea Mazzotti <andrea.mazzotti@suse.com>
* Make snapshotter configurable
This commit adds the snapshotter type as a new parameter in
installation struct, defaults to btrfs. This is passed as
an environment variable to the elemental client call. Any
client previous to v2 will simply ignore this flag.
* Make loopdevice an explicit default
Signed-off-by: David Cassany <dcassany@suse.com>
* Add a sync failure counter
This commit adds a channel sync failure counter to count the
number of consecutive sync failures. This logic is meant to
prevent creating and deleting a pod in case of errors (e.g.
unreachable download URL) in an infinite loop. After several
attempts to synchronize it will give up until the next
scheduled synchronization.
* Add syncedGeneration in status
This commit adds in managedOSVersionChannel status
the generation of the last synchronization attempt. This
is useful to prevent spurious reconciles to trigger an
unexpected sync and also to force immediate resync in case
of a channel update.
Signed-off-by: David Cassany <dcassany@suse.com>
TargetPlatform is used when building raw disk-images for other
platforms. An example being building rpi images on a cluster running on
x86_64 hardware.
Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@suse.com>
* Add DeviceSelector types
Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@suse.com>
* Implement device-selector
This commit adds the implementation for picking the installation device
during registration based on a deviceSelector in the
MachineRegistration.
Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@suse.com>
---------
Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@suse.com>
* feat: Add Type field to SeedImageSpec
Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@suse.com>
* feat: Add raw disk build generation to SeedImage
If SeedImageSpec.Type is set to 'raw' we now try to run elemental
build-disk to generate the disk image.
Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@suse.com>
* Add elemental-toolkit to seedimage-builder
Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@suse.com>
* feat: Update yip to v1.4.5
Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@suse.com>
* feat: Reset yaml
Add yip cloud-config for raw disk-image that will extract the
elemental-register configuration to /oem/registration/config.yaml and
Start the elemental-register-install.service in the post-reset hook.
Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@suse.com>
* feat: Use new toolkit param deploy-command
Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@suse.com>
---------
Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@suse.com>
* Bring your own SeedImage builder
This commit adds functionality to define which build-image to use for a
SeedImage. If no build-image is provided the default one is used.
The BuildContainer only takes Name, Image, ImagePullPolicy, Args and
Command in order to limit what the user is able to do.
The user-defined build container will also mount a ConfigMap with
environment variables for device, base-image, registration-url and
ISO output-name.
Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@suse.com>
* feat: Add Size to SeedImageSpec
Size is used to calculate ephemeral resource requests when building the
seed-image.
Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@suse.com>
This commit moves the synchronization logic to allways happen in a Pod,
regardless being a Custom or JSON syncer. This allows having a simpler Pod
lifecycle management as part of the channel controller logic.
In addition, syncer pod logs are read on succeeded state instate of
running state to simplify Pod lifecycle management.
As a result channel updates trigger a new channel synchronization
without having to wait for the next scheduled sync.
Signed-off-by: David Cassany <dcassany@suse.com>
When hosts are registered with the --no-toolkit option no OS management
is possible, so we set a new os.unmanaged annotation to reflect this
and skip any attempt to reset if this is found.
This is needed to update the configmap associated with the builder pod,
which contains registration and cloud-init data for the ISO.
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
Add MachineRegistration Elemental Registration Auth to allow
selection of the authentication method.
Add MachineInventory MachineHash key for authentication types different than
TPM (which has its own TPMHash key).
make generate
make build-manifests
* Add client registration config utility
* Use a config-map for the seed-image pod
* Allow ConfigMaps manipulation in SeedImage RBAC
* Drop configmap-uid annotation
* go mod tidy
* Adapt tests
* Add createConfigMapObject tests
Signed-off-by: David Cassany <dcassany@suse.com>
* Add cloud-init support to seedImage
This commit adds a field to the SeedImage Spec for a cloud-config that
will be included in the built ISO.
If the cloud-config field is not set an empty file will be added to the
ISOs iso-config dir.
The reconciliation will take place in case the cloud-config is changed
and the base64 encoded value is used in an annotation in order to see if
the value has changed.
Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@suse.com>
* Linting
Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@suse.com>
* Add seedImage unit-tests
Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@suse.com>
---------
Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@suse.com>
This will be used to generate a random token used to construct the
download path of the final ISO (similar to what we do with the
MachineRegistration CRDS)
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
* operator: add SeedImage CRD and controller
* SeedImage: add Ready condition to track resource status
* SeedImage: add Pod and Service creation in the reconcile loop
* SeedImage: manage Pod lifecycle and set the download URL
* SeedImage: allow the pod to fail if something goes wrong
* SeedImage: add SeedImageReady condition
* SeedImage: improve status condition updates
* SeedImage: add controller tests
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
* operator: build-image API POD lifecycle management
Only one POD at a time allowed (for now).
* elemental-operator: improve build-image logging
* operator: add build-image Service
* operator: build-image API: delete Pod and Service on failure
* operator: add functions to manage registration cache
* operator: finalize build-image API Pod lifecycle
* operator: fix build-image API tests
* operator: ensure clean-up of build-image pods
* operator: add Services creation/deletion to Elemental ClusterRole
* operator: build-image: set download URL when job is completed
* operator: build-image: retry build job Pod creation if needed
* operator: build-image: in case of job Failure leave the Pod there
* operator: build-image: increase the time for job completion
* operator: make Code scanning happy
* operator: build-image: use NodePort Service
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
* Turn MachineInventoryRef into LocalObjectReference
Make the MachineInventorySelector reference to an owned
MachineInventory a LocalObjectReference, since a resource cannot
own another resource in a different namespace.
Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@suse.com>
* Fix typo
Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@suse.com>
---------
Signed-off-by: Fredrik Lönnegren <fredrik.lonnegren@suse.com>
Note that `config-dir` options for the install config got lost within the kubebuilder refactor. This is required to be able to pass custom hooks as part of the installation.
Signed-off-by: David Cassany <dcassany@suse.com>
* operator/registration: switch to Kubebuilder client
Fixes#239
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
* operator/registration: adapt tests to Kubebuilder client
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
* unit-tests: vendor controller-runtime fake client
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
* operator: add yaml annotations for correct marshalling
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
* operator/RBAC: add "get" verb to ServiceAccount resources
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
* operator: generate rbac
make generate-manifests
make build-rbac
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
* Add elementalcli package
Create a separate package to deal with elemental-cli installation.
This brings the elemental-cli functions declared in the config package
to a new package that just parses a map[string]interface argument.
This is a step to enable usage of the elemental-cli functions with the
new elementalv1.Config.Elemental.Install type.
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
* register: switch to Kubebuilder api
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
* register: add mapstructure annotations for correct marshalling
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
* register: reduce complexity of the run function
Make linter happy:
"cyclomatic complexity 16 of func `run` is high (> 15) (gocyclo)"
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
* register: drop io/ioutil in favor of os package
io/ioutil is deprecated
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
Signed-off-by: Francesco Giudici <francesco.giudici@suse.com>
This commit adds a rate limiter to the ManagedOSVersionChannel controller to prevent
stacking reconcile loops over the same resource in fast rates (doesn't make sense for a
ManagedOSVersionChannel). By default the controller runtime already includes an
equivalent rate limiter, but starts in the range of milliseconds, starting the exponential
rate limiter in the range of seconds is more than enough in this context.
In addition it drops the failures counter in the resource. This counter was supposed to
be used to limit the number attempts to sync in case of failure. This was a bad design,
status should not keep a counter like this as any change in status triggers a new
immediate reconcile loop, hence the counter was reaching the maximum as fast as the
controller runtime was executing reconcile loops without any rate limiter (rate limiter
applies only when there are no changes including status).
For now I think we can just live without the setting any maxium for failures. If we ever
need it I believe it should be coded and tracked within the controller itself, not in each
resource as this prevents the reconcile loop of being idempotent. Alternatively we could
prevent triggering the reconcile loop on status changes, however this prevents
reconciling if any third party (or user from the kubectl client) changes a resource status.
Fixes#257
Part of #240
Signed-off-by: David Cassany <dcassany@suse.com>
This commit adds few changes on the syncer logic:
* Makes use of ManagedOSVersionChannel status reason to track if there
is an on going synchronization rather than polling for the existence of a synchronization pod or not.
* Adds a logic to stop trying to synchronize after 4 consecutive attempts.
If it exceeds the maximum it just programs the next re-sync after the given sync
interval instead of immediately retrying.
* Adds some logging and comments here and there.
Signed-off-by: David Cassany <dcassany@suse.com>
* Implement syncer logic as part of the ManagedOSVersionChannel controller
This commit adds the logic to synchronize managedosversionchannels
within the already existing controller.
* make generate
* make build-manifests
* Update chart
* update e2e tests
Signed-off-by: David Cassany <dcassany@suse.com>
* Update vendor
* Run generation tasks
* Minor fixes in Makefile
* Remove old code
* Add remaning controllers
* Minor e2e tests improvements
* Switch osversionchannel syncer to controll runtime
* Minor fixes in controllers
* Fix unit tests
Francesco Giudici