Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Initial work to allow juju trust for sidecar charms #12883

Merged
merged 1 commit into from
Apr 16, 2021
Merged

Initial work to allow juju trust for sidecar charms #12883

merged 1 commit into from
Apr 16, 2021

Conversation

wallyworld
Copy link
Member

@wallyworld wallyworld commented Apr 16, 2021 •
edited
Loading

Add support for juju trust with sidecar charms.
This needed extra work to create, for each deployed application, a service account, roles, and rolebindings. The application pod is then given this service account rather than the cluster default. The initial role policy rules are the same as those used for pod spec charms.

Still need to implement this for pod spec charms

Also, a bigger issue is that the unit agent and k8s application provisioner workers both watch for trust changes separately. So the uniter agent might fire the config-change hook to signal a trust change before the provisioner has updated the service account roles. This will need to be addressed.

QA steps

juju bootstrap microk8s --config logging-config="juju.kubernetes.provider.application=DEBUG"
juju deploy facundo-snappass-test

Check application pod has service account set

kubectl -n controller-ian get -o json pod/facundo-snappass-test-0 | jq .spec.serviceAccount
facundo-snappass-test

Check app service account, role bindings, roles are created.

kubectl -n controller-ian get -o json serviceaccount/facundo-snappass-test
kubectl -n controller-ian get -o json roles/facundo-snappass-test
kubectl -n controller-ian get -o json rolebindings/facundo-snappass-test

Trust the app

juju trust facundo-snappass-test

Debug logs should have

DEBUG juju.kubernetes.provider.application Application "facundo-snappass-test", trust true

Role should have new rules:

kubectl -n controller-ian get -o json roles/facundo-snappass-test : jq .rules
[
    {
        "apiGroups": [
            "*"
        ],
        "resources": [
            "*"
        ],
        "verbs": [
            "*"
        ]
    }
]

Remove trust:

juju trust facundo-snappass-test --remove
kubectl -n controller-ian get -o json roles/facundo-snappass-test | jq .rules
[
  {
    "apiGroups": [
      ""
    ],
    "resources": [
      "pods",
      "services"
    ],
    "verbs": [
      "get",
      "list",
      "patch"
    ]
  },
  {
    "apiGroups": [
      ""
    ],
    "resources": [
      "pods/exec"
    ],
    "verbs": [
      "create"
    ]
  }
]

@wallyworld wallyworld force-pushed the test-sidecar-charms branch 2 times, most recently from a1722dd to 00dcc01 Compare April 16, 2021 04:57
hpidcock
hpidcock approved these changes Apr 16, 2021
View reviewed changes
Copy link
Member

@hpidcock hpidcock left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this, good start.

caas/application.go
@@ -23,11 +23,15 @@ type Application interface {
Watch() (watcher.NotifyWatcher, error)
WatchReplicas() (watcher.NotifyWatcher, error)

// Scale scales the Application's unit to the value specificied. Scale must
// Scale scales the Application's unit to the value specified. Scale must
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

heh

@wallyworld wallyworld force-pushed the test-sidecar-charms branch 2 times, most recently from 8124dc9 to ba3960d Compare April 16, 2021 05:51
@codecov-io
Copy link

Codecov Report

Merging #12883 (7332895) into 2.9 (034f71f) will not change coverage.
The diff coverage is n/a.

❗ Current head 7332895 differs from pull request most recent head ba3960d. Consider uploading reports for the commit ba3960d to get more accurate results
Impacted file tree graph

@@           Coverage Diff           @@
##              2.9   #12883   +/-   ##
=======================================
  Coverage   69.46%   69.46%           
=======================================
  Files         262      262           
  Lines       25178    25178           
=======================================
  Hits        17490    17490           
  Misses       5562     5562           
  Partials     2126     2126

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 034f71f...ba3960d. Read the comment docs.

@wallyworld wallyworld force-pushed the test-sidecar-charms branch from ba3960d to 2a756d7 Compare April 16, 2021 06:55
@wallyworld
Copy link
Member Author

$$merge$$

@wallyworld
Copy link
Member Author

2.9-rc11 - Sidecar charms don't include service token required to be able to talk to k8s api

@jujubot jujubot merged commit 9eacd60 into juju:2.9 Apr 16, 2021
@wallyworld wallyworld mentioned this pull request Apr 19, 2021
Merged
jujubot added a commit that referenced this pull request Apr 19, 2021
@jujubot
Merge pull request #12889 from wallyworld/ignore-volume-projection
6d9150f 
#12889

A recent PR #12883 added juju trust support which also activated mounting of service account secrets.
Newer k8s do this as a projected volume so that needs to be added to the ignore list when looping over volume mounts.

## QA steps

Deploy the latest charmed k8s, add it as a cloud to juju, and deploy a sidecar charm.
@wallyworld wallyworld mentioned this pull request Apr 21, 2021
Merged
jujubot added a commit that referenced this pull request Apr 21, 2021
@jujubot
Merge pull request #12909 from wallyworld/merge-2.9-20210421
5879b6b 
#12909

Merge 2.9

#12827 Unsubscribe from hub when closing state pool
#12829 Correct default bootstrap-timeout value displayed in help.
#12840 Constraint tags can be used for pod affinity
#12842 Fix upgrade series agent version handling
#12794 Add disk provisioning customization
#12845 Restore space support for manual machines
#12839 Support merging of netplan configs
#12853 Add display type for network-get results
#12854 Fix for LP1921557 sni in Juju login.
#12850 Use Base in Charmhub packge and its response structures.
#12858 Ensure assess-upgrade-series does not report started prematuremly
#12860 Removed logging from core annotations.
#12861 Fixes bug where empty error can happen in storage
#12865 Update Pebble version to include new files API
#12866 Workaround for k8s dashboard URL with k8s client proxy
#12862 Fix/lp 1923051
#12867 Fix/lp 1923561
#12870 Use channel logic in charm library
#12873 Add support for setting pod affinity topology key
#12874 Use Patch instead of Update for ensuring ingress resources
#12831 Integration fixes
#12879 Ensure refresh uses version
#12864 bug: fix for bootstrap fail on vsphere 7 + multi network
#12883 Initial work to allow juju trust for sidecar charms
#12884 Fix ssh with sidecar charms and containers.
#12886 Charmhub bases
#12881 Use charm pkg updates
#12889 Ignore projected volume mounts when looking up juju storage
#12890 Fix passing empty string container name to unit params
#12893 Add CLA checker GH action and remove codecov push action
#12897 Use production charmhub endpoint
#12887 Resource validation error
#12888 Ensure we validate the model target
#12898 Remove usage of systems package from CAAS application provisioner
#12899 CAAS bundle deployments
#12900 Bump up Pebble version to include user/group in list-files
#12901 charm Format helper
#12902 charm Iskubernetes helper
#12903 Display ... for really long k8s app versions in status
#12904 Filter out more full registry paths for app version in status
#12905 Fix k8s bundle deploys with v2 charms
#12906 Register resource-get for containeragent binary

Conflicts mostly due to charm v8 vs v9 imports.
The other one was due to changes to dashboard CLI.
```
# Conflicts:
# api/common/charms/common.go
# api/common/charms/common_test.go
# apiserver/facades/client/application/application.go
# apiserver/facades/client/application/charmstore.go
# apiserver/facades/client/application/update_series_mocks_test.go
# apiserver/facades/client/charms/client.go
# apiserver/facades/client/charms/convertions.go
# apiserver/facades/client/machinemanager/types_mock_test.go
# apiserver/facades/controller/caasoperatorprovisioner/provisioner.go
# cmd/juju/application/deployer/bundlehandler_test.go
# cmd/juju/application/refresh_test.go
# cmd/juju/application/refresher/refresher_mock_test.go
# cmd/juju/dashboard/dashboard.go
# core/charm/strategies_mock_test.go
# core/model/model.go
# core/model/model_test.go
# go.mod
# go.sum
# resource/resourceadapters/charmhub.go
# scripts/win-installer/setup.iss
# service/agentconf_test.go
# snap/snapcraft.yaml
# state/charm.go
# state/migration_export.go
# state/state.go
# version/version.go
# worker/caasfirewallerembedded/applicationworker.go
# worker/caasfirewallerembedded/applicationworker_test.go
```

## QA steps

See PRs
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@hpidcock hpidcock hpidcock approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@wallyworld @codecov-io @hpidcock @jujubot