Skip to content

Commit 57c78cd

Browse files
jaswalkiranavtaralex0chan
jaswalkiranavtar
and
alex0chan
authored
✨ Miscellaneous code cleanup (#881)
* extract constants and remove permissions Signed-off-by: Alex <alexchan2988@gmail.com> * Addressing miscellaneous code cleanup Signed-off-by: Gaurav Jaswal <jaswalkiranavtar@gmail.com> --------- Signed-off-by: Alex <alexchan2988@gmail.com> Signed-off-by: Gaurav Jaswal <jaswalkiranavtar@gmail.com> Co-authored-by: Alex <alexchan2988@gmail.com>
1 parent a5f3912 commit 57c78cd

29 files changed

+210
-598
lines changed

‎manifests/klusterlet/management/klusterlet-agent-deployment.yaml

-4
Original file line numberDiff line numberDiff line change
@@ -121,10 +121,6 @@ spec:
121121
valueFrom:
122122
fieldRef:
123123
fieldPath: metadata.name
124-
{{if eq .RegistrationDriver.AuthType "awsirsa"}}
125-
- name: PATH
126-
value: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/awscli/dist
127-
{{end}}
128124
securityContext:
129125
allowPrivilegeEscalation: false
130126
capabilities:

‎manifests/klusterlet/management/klusterlet-registration-deployment.yaml

-4
Original file line numberDiff line numberDiff line change
@@ -107,10 +107,6 @@ spec:
107107
valueFrom:
108108
fieldRef:
109109
fieldPath: metadata.name
110-
{{if eq .RegistrationDriver.AuthType "awsirsa"}}
111-
- name: PATH
112-
value: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/awscli/dist
113-
{{end}}
114110
securityContext:
115111
allowPrivilegeEscalation: false
116112
capabilities:

‎manifests/klusterlet/management/klusterlet-work-deployment.yaml

-4
Original file line numberDiff line numberDiff line change
@@ -92,10 +92,6 @@ spec:
9292
valueFrom:
9393
fieldRef:
9494
fieldPath: metadata.name
95-
{{if eq .RegistrationDriver.AuthType "awsirsa"}}
96-
- name: PATH
97-
value: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/awscli/dist
98-
{{end}}
9995
securityContext:
10096
allowPrivilegeEscalation: false
10197
capabilities:

‎manifests/managed-cluster-policy/AccessPolicy.tmpl

-13
This file was deleted.

‎pkg/common/helpers/aws.go

+10-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
11
package helpers
22

3-
import "strings"
3+
import (
4+
"crypto/md5" // #nosec G501
5+
"encoding/hex"
6+
"strings"
7+
)
48

59
// GetAwsAccountIdAndClusterName Parses aws accountId and cluster-name from clusterArn
610
// e.g. if clusterArn is arn:aws:eks:us-west-2:123456789012:cluster/hub-cluster1
@@ -19,3 +23,8 @@ func GetAwsRegion(clusterArn string) string {
1923
clusterStringParts := strings.Split(clusterArn, ":")
2024
return clusterStringParts[3]
2125
}
26+
27+
func Md5HashSuffix(hubClusterAccountId string, hubClusterName string, managedClusterAccountId string, managedClusterName string) string {
28+
hash := md5.Sum([]byte(strings.Join([]string{hubClusterAccountId, hubClusterName, managedClusterAccountId, managedClusterName}, "#"))) // #nosec G401
29+
return hex.EncodeToString(hash[:])
30+
}

‎pkg/common/helpers/constants.go

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
package helpers
2+
3+
const (
4+
AwsIrsaAuthType = "awsirsa"
5+
CSRAuthType = "csr"
6+
)

‎pkg/common/helpers/helpers.go

-12
This file was deleted.

‎pkg/operator/operators/clustermanager/controllers/clustermanagercontroller/clustermanager_controller.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -427,7 +427,7 @@ func (n *clusterManagerController) getImagePullSecret(ctx context.Context) (stri
427427
func getIdentityCreatorRoleAndTags(cm operatorapiv1.ClusterManager) string {
428428
if cm.Spec.RegistrationConfiguration != nil {
429429
for _, registrationDriver := range cm.Spec.RegistrationConfiguration.RegistrationDrivers {
430-
if registrationDriver.AuthType == "awsirsa" && registrationDriver.AwsIrsa != nil {
430+
if registrationDriver.AuthType == commonhelper.AwsIrsaAuthType && registrationDriver.AwsIrsa != nil {
431431
hubClusterArn := registrationDriver.AwsIrsa.HubClusterArn
432432
hubClusterAccountId, hubClusterName := commonhelper.GetAwsAccountIdAndClusterName(hubClusterArn)
433433
return "arn:aws:iam::" + hubClusterAccountId + ":role/" + hubClusterName + "_managed-cluster-identity-creator"

‎pkg/operator/operators/clustermanager/controllers/clustermanagercontroller/clustermanager_runtime_reconcile.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
operatorapiv1 "open-cluster-management.io/api/operator/v1"
2222

2323
"open-cluster-management.io/ocm/manifests"
24+
commonhelpers "open-cluster-management.io/ocm/pkg/common/helpers"
2425
"open-cluster-management.io/ocm/pkg/operator/helpers"
2526
)
2627

@@ -77,11 +78,11 @@ func (c *runtimeReconcile) reconcile(ctx context.Context, cm *operatorapiv1.Clus
7778
var enabledRegistrationDrivers []string
7879
for _, registrationDriver := range cm.Spec.RegistrationConfiguration.RegistrationDrivers {
7980
enabledRegistrationDrivers = append(enabledRegistrationDrivers, registrationDriver.AuthType)
80-
if registrationDriver.AuthType == "awsirsa" && registrationDriver.AwsIrsa != nil {
81+
if registrationDriver.AuthType == commonhelpers.AwsIrsaAuthType && registrationDriver.AwsIrsa != nil {
8182
config.HubClusterArn = registrationDriver.AwsIrsa.HubClusterArn
8283
config.AutoApprovedARNPatterns = strings.Join(registrationDriver.AwsIrsa.AutoApprovedIdentities, ",")
8384
config.AwsResourceTags = strings.Join(registrationDriver.AwsIrsa.Tags, ",")
84-
} else if registrationDriver.AuthType == "csr" && registrationDriver.CSR != nil {
85+
} else if registrationDriver.AuthType == commonhelpers.CSRAuthType && registrationDriver.CSR != nil {
8586
config.AutoApprovedCSRUsers = strings.Join(registrationDriver.CSR.AutoApprovedIdentities, ",")
8687
}
8788
}

‎pkg/operator/operators/klusterlet/controllers/klusterletcontroller/klusterlet_controller.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,6 @@ const (
4242
klusterletFinalizer = "operator.open-cluster-management.io/klusterlet-cleanup"
4343
managedResourcesEvictionTimestampAnno = "operator.open-cluster-management.io/managed-resources-eviction-timestamp"
4444
klusterletNamespaceLabelKey = "operator.open-cluster-management.io/klusterlet"
45-
AwsIrsaAuthType = "awsirsa"
4645
)
4746

4847
type klusterletController struct {
@@ -346,7 +345,7 @@ func (n *klusterletController) sync(ctx context.Context, controllerContext facto
346345
config.RegistrationKubeAPIBurst = klusterlet.Spec.RegistrationConfiguration.KubeAPIBurst
347346
// Configuring Registration driver depending on registration auth
348347
if &klusterlet.Spec.RegistrationConfiguration.RegistrationDriver != nil &&
349-
klusterlet.Spec.RegistrationConfiguration.RegistrationDriver.AuthType == AwsIrsaAuthType {
348+
klusterlet.Spec.RegistrationConfiguration.RegistrationDriver.AuthType == commonhelpers.AwsIrsaAuthType {
350349

351350
hubClusterArn := klusterlet.Spec.RegistrationConfiguration.RegistrationDriver.AwsIrsa.HubClusterArn
352351
managedClusterArn := klusterlet.Spec.RegistrationConfiguration.RegistrationDriver.AwsIrsa.ManagedClusterArn

‎pkg/operator/operators/klusterlet/controllers/klusterletcontroller/klusterlet_controller_test.go

+4-3
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ import (
4242
"open-cluster-management.io/sdk-go/pkg/patcher"
4343

4444
"open-cluster-management.io/ocm/manifests"
45+
commonhelpers "open-cluster-management.io/ocm/pkg/common/helpers"
4546
testingcommon "open-cluster-management.io/ocm/pkg/common/testing"
4647
"open-cluster-management.io/ocm/pkg/operator/helpers"
4748
testinghelper "open-cluster-management.io/ocm/pkg/operator/helpers/testing"
@@ -1012,7 +1013,7 @@ func TestGetServersFromKlusterlet(t *testing.T) {
10121013
func TestAWSIrsaAuthInSingletonModeWithInvalidClusterArns(t *testing.T) {
10131014
klusterlet := newKlusterlet("klusterlet", "testns", "cluster1")
10141015
awsIrsaRegistrationDriver := operatorapiv1.RegistrationDriver{
1015-
AuthType: AwsIrsaAuthType,
1016+
AuthType: commonhelpers.AwsIrsaAuthType,
10161017
AwsIrsa: &operatorapiv1.AwsIrsa{
10171018
HubClusterArn: "arn:aws:bks:us-west-2:123456789012:cluster/hub-cluster1",
10181019
ManagedClusterArn: "arn:aws:eks:us-west-2:123456789012:cluster/managed-cluster1",
@@ -1043,7 +1044,7 @@ func TestAWSIrsaAuthInSingletonModeWithInvalidClusterArns(t *testing.T) {
10431044
func TestAWSIrsaAuthInSingletonMode(t *testing.T) {
10441045
klusterlet := newKlusterlet("klusterlet", "testns", "cluster1")
10451046
awsIrsaRegistrationDriver := operatorapiv1.RegistrationDriver{
1046-
AuthType: AwsIrsaAuthType,
1047+
AuthType: commonhelpers.AwsIrsaAuthType,
10471048
AwsIrsa: &operatorapiv1.AwsIrsa{
10481049
HubClusterArn: "arn:aws:eks:us-west-2:123456789012:cluster/hub-cluster1",
10491050
ManagedClusterArn: "arn:aws:eks:us-west-2:123456789012:cluster/managed-cluster1",
@@ -1075,7 +1076,7 @@ func TestAWSIrsaAuthInSingletonMode(t *testing.T) {
10751076
func TestAWSIrsaAuthInNonSingletonMode(t *testing.T) {
10761077
klusterlet := newKlusterlet("klusterlet", "testns", "cluster1")
10771078
awsIrsaRegistrationDriver := operatorapiv1.RegistrationDriver{
1078-
AuthType: AwsIrsaAuthType,
1079+
AuthType: commonhelpers.AwsIrsaAuthType,
10791080
AwsIrsa: &operatorapiv1.AwsIrsa{
10801081
HubClusterArn: "arn:aws:eks:us-west-2:123456789012:cluster/hub-cluster1",
10811082
ManagedClusterArn: "arn:aws:eks:us-west-2:123456789012:cluster/managed-cluster1",

‎pkg/registration/hub/manager.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ func NewHubManagerOptions() *HubManagerOptions {
6464
GCResourceList: []string{"addon.open-cluster-management.io/v1alpha1/managedclusteraddons",
6565
"work.open-cluster-management.io/v1/manifestworks"},
6666
ImportOption: importeroptions.New(),
67-
EnabledRegistrationDrivers: []string{"csr"},
67+
EnabledRegistrationDrivers: []string{commonhelpers.CSRAuthType},
6868
}
6969
}
7070

@@ -170,7 +170,7 @@ func (m *HubManagerOptions) RunControllerManagerWithInformers(
170170
var drivers []register.HubDriver
171171
for _, enabledRegistrationDriver := range m.EnabledRegistrationDrivers {
172172
switch enabledRegistrationDriver {
173-
case "csr":
173+
case commonhelpers.CSRAuthType:
174174
autoApprovedCSRUsers := m.ClusterAutoApprovalUsers
175175
if len(m.AutoApprovedCSRUsers) > 0 {
176176
autoApprovedCSRUsers = m.AutoApprovedCSRUsers
@@ -180,7 +180,7 @@ func (m *HubManagerOptions) RunControllerManagerWithInformers(
180180
return err
181181
}
182182
drivers = append(drivers, csrDriver)
183-
case "awsirsa":
183+
case commonhelpers.AwsIrsaAuthType:
184184
awsIRSAHubDriver, err := awsirsa.NewAWSIRSAHubDriver(ctx, m.HubClusterArn, m.AutoApprovedARNPatterns, m.AwsResourceTags)
185185
if err != nil {
186186
return err

‎pkg/registration/register/aws_irsa/aws_irsa.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ func (c *AWSIRSADriver) BuildKubeConfigFromTemplate(kubeConfig *clientcmdapi.Con
6464
kubeConfig.AuthInfos = map[string]*clientcmdapi.AuthInfo{register.DefaultKubeConfigAuth: {
6565
Exec: &clientcmdapi.ExecConfig{
6666
APIVersion: "client.authentication.k8s.io/v1beta1",
67-
Command: "aws",
67+
Command: "/awscli/dist/aws",
6868
Args: []string{
6969
"--region",
7070
awsRegion,

‎pkg/registration/register/aws_irsa/aws_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ func TestBuildKubeconfig(t *testing.T) {
5858
server: "https://127.0.0.1:6443",
5959
AuthInfoExec: &clientcmdapi.ExecConfig{
6060
APIVersion: "client.authentication.k8s.io/v1beta1",
61-
Command: "aws",
61+
Command: "/awscli/dist/aws",
6262
Args: []string{
6363
"--region",
6464
"us-west-2",

0 commit comments

Comments
 (0)