Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for Equinix Metal #283

Closed
wants to merge 1 commit into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
13 changes: 13 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,18 @@ data:
azure_region: Base64encodeRegion
```

### Equinix Metal
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In an ideal world, this Secret should not even exist on a cluster as the individual components that need to make cloud API calls would receive their credentials via Secrets directly. This allows for a future where we can introduce fine-grained creds/permissions if/when the platform/cloud allows it.


```yaml
apiVersion: v1
kind: Secret
metadata:
namespace: kube-system
name: equinix-metal-credentials
data:
api_key: EquinixMetalAPIKey
```

### GCP

```yaml
Expand Down Expand Up @@ -211,6 +223,7 @@ Cloud | Mint | Mint + Remove Admin Cred | Passthrough | Manual | Token
--- | --- | --- | --- | --- | ---
AWS | Y | 4.4+ | Y | 4.3+ | 4.6+ (expected)
Azure | Y | N | Y | Y | N
EquinixMetal | N | N | 4.x+ (expected) | N | N
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wasn't sure the right way to do this, whether it was to just add a 'Y' here or try to add the version like some of the fields for AWS and GCP...

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similar to my overall comment on this PR, we want to not add any in-cluster processing of CredentialsRequest CRs which means that the only column to be supported would be the Manual column.
This doesn't mean that you don't implement what is effectively Passthrough mode (where each Secret for each in-cluster component contains the same API key), but Passthrough mode implies in-cluster handling of CredentialsRequests...

Suggested change
EquinixMetal | N | N | 4.x+ (expected) | N | N
EquinixMetal | N | N | N | 4.x+ (expected) | N

GCP | Y | 4.7+ | Y | Y | N
KubeVirt | N | N | Y | N | N
OpenStack | N | N | Y | N | N
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ metadata:
name: cloudcredentials.operator.openshift.io
annotations:
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updating this through make update-vendored-crds was required to pass make verify

spec:
scope: Cluster
group: operator.openshift.io
Expand Down Expand Up @@ -44,12 +45,15 @@ spec:
type: object
properties:
credentialsMode:
description: CredentialsMode allows informing CCO that it should not
attempt to dynamically determine the root cloud credentials capabilities,
and it should just run in the specified mode. It also allows putting
the operator into "manual" mode if desired. Leaving the field in
default mode runs CCO so that the cluster's cloud credentials will
be dynamically probed for capabilities (on supported clouds/platforms).
description: 'CredentialsMode allows informing CCO that it should
not attempt to dynamically determine the root cloud credentials
capabilities, and it should just run in the specified mode. It also
allows putting the operator into "manual" mode if desired. Leaving
the field in default mode runs CCO so that the cluster''s cloud
credentials will be dynamically probed for capabilities (on supported
clouds/platforms). Supported modes: AWS/Azure/GCP: "" (Default),
"Mint", "Passthrough", "Manual" Others: Do not set value as other
platforms only support running in "Passthrough"'
type: string
enum:
- ""
Expand Down
21 changes: 10 additions & 11 deletions go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,10 @@ go 1.13
require (
cloud.google.com/go v0.56.0
github.com/Azure/azure-sdk-for-go v31.1.0+incompatible
github.com/Azure/go-autorest/autorest v0.10.0
github.com/Azure/go-autorest/autorest/adal v0.8.3
github.com/Azure/go-autorest/autorest v0.11.1
github.com/Azure/go-autorest/autorest/adal v0.9.5
github.com/Azure/go-autorest/autorest/azure/auth v0.4.2
github.com/Azure/go-autorest/autorest/date v0.2.0
github.com/Azure/go-autorest/autorest/date v0.3.0
github.com/Azure/go-autorest/autorest/to v0.3.0
github.com/Azure/go-autorest/autorest/validation v0.2.0 // indirect
github.com/aws/aws-sdk-go v1.37.14
Expand All @@ -19,12 +19,11 @@ require (
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b
github.com/golang/mock v1.4.3
github.com/google/go-cmp v0.5.1 // indirect
github.com/google/uuid v1.1.1
github.com/google/uuid v1.1.2
github.com/googleapis/gnostic v0.5.1 // indirect
github.com/imdario/mergo v0.3.10 // indirect
github.com/onsi/ginkgo v1.14.0 // indirect
github.com/openshift/api v0.0.0-20201103184615-27004eede929
github.com/openshift/api v0.0.0-20210225162315-bae60f47eed7
github.com/openshift/build-machinery-go v0.0.0-20200917070002-f171684f77ab
github.com/openshift/library-go v0.0.0-20200911100307-610c6e9e90b8
github.com/pkg/errors v0.9.1
Expand All @@ -45,10 +44,10 @@ require (
google.golang.org/grpc v1.28.0
gopkg.in/square/go-jose.v2 v2.5.1
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
k8s.io/api v0.19.2
k8s.io/apimachinery v0.19.2
k8s.io/client-go v0.19.2
k8s.io/code-generator v0.19.2
k8s.io/utils v0.0.0-20200729134348-d5654de09c73
k8s.io/api v0.20.0
k8s.io/apimachinery v0.20.0
k8s.io/client-go v0.20.0
k8s.io/code-generator v0.20.0
Comment on lines +47 to +50
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was required when I added the replace for github.com/openshift/api below.

I believe the other updates came in transitively through the replace and these updates

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, seems like you got caught in the middle of some changes

k8s.io/utils v0.0.0-20201110183641-67b214c5f920
sigs.k8s.io/controller-runtime v0.6.2
)
93 changes: 62 additions & 31 deletions go.sum

Large diffs are not rendered by default.

16 changes: 10 additions & 6 deletions manifests/00-config-custresdef.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ metadata:
name: cloudcredentials.operator.openshift.io
annotations:
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updating this through make update-vendored-crds was required to pass make verify

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

spec:
scope: Cluster
group: operator.openshift.io
Expand Down Expand Up @@ -44,12 +45,15 @@ spec:
type: object
properties:
credentialsMode:
description: CredentialsMode allows informing CCO that it should not
attempt to dynamically determine the root cloud credentials capabilities,
and it should just run in the specified mode. It also allows putting
the operator into "manual" mode if desired. Leaving the field in
default mode runs CCO so that the cluster's cloud credentials will
be dynamically probed for capabilities (on supported clouds/platforms).
description: 'CredentialsMode allows informing CCO that it should
not attempt to dynamically determine the root cloud credentials
capabilities, and it should just run in the specified mode. It also
allows putting the operator into "manual" mode if desired. Leaving
the field in default mode runs CCO so that the cluster''s cloud
credentials will be dynamically probed for capabilities (on supported
clouds/platforms). Supported modes: AWS/Azure/GCP: "" (Default),
"Mint", "Passthrough", "Manual" Others: Do not set value as other
platforms only support running in "Passthrough"'
type: string
enum:
- ""
Expand Down
1 change: 1 addition & 0 deletions pkg/apis/cloudcredential/v1/register.go
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,7 @@ func addKnownTypes(scheme *runtime.Scheme) error {
&GCPProviderStatus{}, &GCPProviderSpec{},
&VSphereProviderStatus{}, &VSphereProviderSpec{},
&KubevirtProviderStatus{}, &KubevirtProviderSpec{},
&EquinixMetalProviderStatus{}, &EquinixMetalProviderSpec{},
)

return nil
Expand Down
37 changes: 37 additions & 0 deletions pkg/apis/cloudcredential/v1/types_equinixmetal.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
/*
Copyright 2020 The OpenShift Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package v1

import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)

// TODO: these types should eventually be broken out, along with the actuator,
// to a separate repo.

// EquinixMetalProviderSpec contains the required information to create RBAC role
// bindings for EquinixMetal.
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
type EquinixMetalProviderSpec struct {
metav1.TypeMeta `json:",inline"`
}

// EquinixMetalProviderStatus contains the status of the credentials request in EquinixMetal.
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
type EquinixMetalProviderStatus struct {
metav1.TypeMeta `json:",inline"`
}
50 changes: 50 additions & 0 deletions pkg/apis/cloudcredential/v1/zz_generated.deepcopy.go

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

16 changes: 10 additions & 6 deletions pkg/assets/bootstrap/bindata.go

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading