Skip to content

Commit a8d8b7e

Browse files
csrwngcsrwng
committed
cluster up: improve compatibility with previous versions
1 parent 6b1a836 commit a8d8b7e

File tree

9 files changed

+68
-110
lines changed

9 files changed

+68
-110
lines changed

‎pkg/oc/bootstrap/docker/openshift/admin.go

Lines changed: 14 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ import (
2424
configcmd "github.com/openshift/origin/pkg/config/cmd"
2525
"github.com/openshift/origin/pkg/oc/admin/policy"
2626
"github.com/openshift/origin/pkg/oc/bootstrap/docker/errors"
27-
securitytypedclient "github.com/openshift/origin/pkg/security/generated/internalclientset/typed/security/internalversion"
2827
)
2928

3029
const (
@@ -47,11 +46,7 @@ func (h *Helper) InstallRegistry(kubeClient kclientset.Interface, f *clientcmd.F
4746
return errors.NewError("error retrieving docker registry service").WithCause(err).WithDetails(h.OriginLog())
4847
}
4948

50-
securityClient, err := f.OpenshiftInternalSecurityClient()
51-
if err != nil {
52-
return err
53-
}
54-
err = AddSCCToServiceAccount(securityClient.Security(), "privileged", "registry", "default", out)
49+
err = h.AddSCCToServiceAccount("privileged", "registry", "default", out)
5550
if err != nil {
5651
return errors.NewError("cannot add privileged SCC to registry service account").WithCause(err).WithDetails(h.OriginLog())
5752
}
@@ -121,18 +116,9 @@ func (h *Helper) InstallRouter(kubeClient kclientset.Interface, f *clientcmd.Fac
121116
}
122117

123118
// Add router SA to privileged SCC
124-
securityClient, err := f.OpenshiftInternalSecurityClient()
125-
if err != nil {
126-
return err
127-
}
128-
privilegedSCC, err := securityClient.Security().SecurityContextConstraints().Get("privileged", metav1.GetOptions{})
129-
if err != nil {
130-
return errors.NewError("cannot retrieve privileged SCC").WithCause(err).WithDetails(h.OriginLog())
131-
}
132-
privilegedSCC.Users = append(privilegedSCC.Users, serviceaccount.MakeUsername("default", "router"))
133-
_, err = securityClient.Security().SecurityContextConstraints().Update(privilegedSCC)
119+
err = h.AddSCCToServiceAccount("privileged", "router", "default", out)
134120
if err != nil {
135-
return errors.NewError("cannot update privileged SCC").WithCause(err).WithDetails(h.OriginLog())
121+
return errors.NewError("cannot add privileged SCC to router service account").WithCause(err).WithDetails(h.OriginLog())
136122
}
137123

138124
routingSuffix := h.routingSuffix
@@ -197,14 +183,11 @@ func (h *Helper) InstallRouter(kubeClient kclientset.Interface, f *clientcmd.Fac
197183
return nil
198184
}
199185

200-
func AddClusterRole(authorizationClient authorizationtypedclient.ClusterRoleBindingsGetter, role, user string) error {
201-
clusterRoleBindingAccessor := policy.NewClusterRoleBindingAccessor(authorizationClient)
202-
addClusterReaderRole := policy.RoleModificationOptions{
203-
RoleName: role,
204-
RoleBindingAccessor: clusterRoleBindingAccessor,
205-
Users: []string{user},
206-
}
207-
return addClusterReaderRole.AddRole()
186+
func (h *Helper) AddClusterRole(role, user string, out io.Writer) error {
187+
command := []string{"oc", "adm", "policy", "add-cluster-role-to-user", role, user}
188+
result, err := h.execHelper.Command(command...).CombinedOutput()
189+
fmt.Fprintf(out, "%s", result)
190+
return err
208191
}
209192

210193
func AddRoleToServiceAccount(authorizationClient authorizationtypedclient.RoleBindingsGetter, role, sa, namespace string) error {
@@ -223,21 +206,12 @@ func AddRoleToServiceAccount(authorizationClient authorizationtypedclient.RoleBi
223206
return addRole.AddRole()
224207
}
225208

226-
func AddSCCToServiceAccount(securityClient securitytypedclient.SecurityContextConstraintsGetter, scc, sa, namespace string, out io.Writer) error {
227-
modifySCC := policy.SCCModificationOptions{
228-
SCCName: scc,
229-
SCCInterface: securityClient.SecurityContextConstraints(),
230-
Subjects: []kapi.ObjectReference{
231-
{
232-
Namespace: namespace,
233-
Name: sa,
234-
Kind: "ServiceAccount",
235-
},
236-
},
237-
238-
Out: out,
239-
}
240-
return modifySCC.AddSCC()
209+
func (h *Helper) AddSCCToServiceAccount(scc, sa, namespace string, out io.Writer) error {
210+
user := serviceaccount.MakeUsername(namespace, sa)
211+
command := []string{"oc", "adm", "policy", "add-scc-to-user", scc, user}
212+
result, err := h.execHelper.Command(command...).CombinedOutput()
213+
fmt.Fprintf(out, "%s", result)
214+
return err
241215
}
242216

243217
// catFiles concatenates multiple source files into a single destination file

‎pkg/oc/bootstrap/docker/openshift/ansible.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,7 @@ func (r *ansibleRunner) createServiceAccount(namespace string) error {
198198
return errors.NewError(fmt.Sprintf("cannot create %s service account", serviceAccount.Name)).WithCause(err).WithDetails(r.Helper.OriginLog())
199199
}
200200
// Add privileged SCC to serviceAccount
201-
if err = AddSCCToServiceAccount(r.SecurityClient.Security(), "privileged", serviceAccount.Name, namespace, &bytes.Buffer{}); err != nil {
201+
if err = r.AddSCCToServiceAccount("privileged", serviceAccount.Name, namespace, &bytes.Buffer{}); err != nil {
202202
return errors.NewError("cannot add privileged security context constraint to service account").WithCause(err).WithDetails(r.Helper.OriginLog())
203203
}
204204
return nil

‎pkg/oc/bootstrap/docker/openshift/helper.go

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,7 @@ var (
9090
}
9191
version15 = semver.MustParse("1.5.0")
9292
version35 = semver.MustParse("3.5.0")
93+
version36 = semver.MustParse("3.6.0")
9394
version37 = semver.MustParse("3.7.0")
9495
)
9596

@@ -696,6 +697,10 @@ func useAggregator(version semver.Version) bool {
696697
return version.GTE(version37)
697698
}
698699

700+
func enableAdmissionRegistrationAPI(version semver.Version) bool {
701+
return version.GT(version36)
702+
}
703+
699704
func (h *Helper) updateConfig(configDir string, opt *StartOptions) error {
700705
cfg, configPath, err := h.GetConfigFromLocalDir(configDir)
701706
if err != nil {
@@ -710,11 +715,6 @@ func (h *Helper) updateConfig(configDir string, opt *StartOptions) error {
710715
Configuration: &configapi.DefaultAdmissionConfig{},
711716
}
712717

713-
if cfg.KubernetesMasterConfig.APIServerArguments == nil {
714-
cfg.KubernetesMasterConfig.APIServerArguments = configapi.ExtendedArguments{}
715-
}
716-
cfg.KubernetesMasterConfig.APIServerArguments["runtime-config"] = append(cfg.KubernetesMasterConfig.APIServerArguments["runtime-config"], "apis/admissionregistration.k8s.io/v1alpha1=true")
717-
718718
if len(opt.RoutingSuffix) > 0 {
719719
cfg.RoutingConfig.Subdomain = opt.RoutingSuffix
720720
} else {
@@ -767,6 +767,14 @@ func (h *Helper) updateConfig(configDir string, opt *StartOptions) error {
767767
if err != nil {
768768
return err
769769
}
770+
771+
if enableAdmissionRegistrationAPI(version) {
772+
if cfg.KubernetesMasterConfig.APIServerArguments == nil {
773+
cfg.KubernetesMasterConfig.APIServerArguments = configapi.ExtendedArguments{}
774+
}
775+
cfg.KubernetesMasterConfig.APIServerArguments["runtime-config"] = append(cfg.KubernetesMasterConfig.APIServerArguments["runtime-config"], "apis/admissionregistration.k8s.io/v1alpha1=true")
776+
}
777+
770778
if useAggregator(version) || opt.ServiceCatalog {
771779
// setup the api aggegrator
772780
cfg.AggregatorConfig = configapi.AggregatorConfig{

‎pkg/oc/bootstrap/docker/openshift/logging.go

Lines changed: 5 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ func (h *Helper) InstallLoggingViaAnsible(f *clientcmd.Factory, serverIP, public
3838

3939
// Create logging namespace
4040
out := &bytes.Buffer{}
41-
err = CreateProject(f, loggingNamespace, "", "", "oc", out)
41+
err = h.CreateProject(f, loggingNamespace, "", "", "", out)
4242
if err != nil {
4343
return errors.NewError("cannot create logging project").WithCause(err).WithDetails(out.String())
4444
}
@@ -65,18 +65,10 @@ func (h *Helper) InstallLogging(f *clientcmd.Factory, publicHostname, loggerHost
6565
if err != nil {
6666
return errors.NewError("cannot obtain API clients").WithCause(err).WithDetails(h.OriginLog())
6767
}
68-
authorizationClient, err := f.OpenshiftInternalAuthorizationClient()
69-
if err != nil {
70-
return errors.NewError("cannot obtain API clients").WithCause(err).WithDetails(h.OriginLog())
71-
}
7268
templateClient, err := f.OpenshiftInternalTemplateClient()
7369
if err != nil {
7470
return errors.NewError("cannot obtain API clients").WithCause(err).WithDetails(h.OriginLog())
7571
}
76-
securityClient, err := f.OpenshiftInternalSecurityClient()
77-
if err != nil {
78-
return errors.NewError("cannot obtain API clients").WithCause(err).WithDetails(h.OriginLog())
79-
}
8072

8173
_, err = kubeClient.Core().Namespaces().Get(loggingNamespace, metav1.GetOptions{})
8274
if err == nil {
@@ -86,7 +78,7 @@ func (h *Helper) InstallLogging(f *clientcmd.Factory, publicHostname, loggerHost
8678

8779
// Create logging namespace
8880
out := &bytes.Buffer{}
89-
err = CreateProject(f, loggingNamespace, "", "", "oc", out)
81+
err = h.CreateProject(f, loggingNamespace, "", "", "", out)
9082
if err != nil {
9183
return errors.NewError("cannot create logging project").WithCause(err).WithDetails(out.String())
9284
}
@@ -98,17 +90,17 @@ func (h *Helper) InstallLogging(f *clientcmd.Factory, publicHostname, loggerHost
9890
}
9991

10092
// Add oauth-editor cluster role to logging-deployer sa
101-
if err = AddClusterRole(authorizationClient.Authorization(), "oauth-editor", "system:serviceaccount:logging:logging-deployer"); err != nil {
93+
if err = h.AddClusterRole("oauth-editor", "system:serviceaccount:logging:logging-deployer", out); err != nil {
10294
return errors.NewError("cannot add oauth editor role to logging deployer service account").WithCause(err).WithDetails(h.OriginLog())
10395
}
10496

10597
// Add cluster-reader cluster role to aggregated-logging-fluentd sa
106-
if err = AddClusterRole(authorizationClient.Authorization(), "cluster-reader", "system:serviceaccount:logging:aggregated-logging-fluentd"); err != nil {
98+
if err = h.AddClusterRole("cluster-reader", "system:serviceaccount:logging:aggregated-logging-fluentd", out); err != nil {
10799
return errors.NewError("cannot cluster reader role to logging fluentd service account").WithCause(err).WithDetails(h.OriginLog())
108100
}
109101

110102
// Add privileged SCC to aggregated-logging-fluentd sa
111-
if err = AddSCCToServiceAccount(securityClient.Security(), "privileged", "aggregated-logging-fluentd", loggingNamespace, out); err != nil {
103+
if err = h.AddSCCToServiceAccount("privileged", "aggregated-logging-fluentd", loggingNamespace, out); err != nil {
112104
return errors.NewError("cannot add privileged security context constraint to logging fluentd service account").WithCause(err).WithDetails(h.OriginLog())
113105
}
114106

‎pkg/oc/bootstrap/docker/openshift/metrics.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package openshift
22

33
import (
4+
"bytes"
45
"fmt"
56

67
apierrors "k8s.io/apimachinery/pkg/api/errors"
@@ -96,8 +97,9 @@ func (h *Helper) InstallMetrics(f *clientcmd.Factory, hostName, imagePrefix, ima
9697
}
9798

9899
// Add cluster reader role to heapster service account
99-
if err = AddClusterRole(authorizationClient.Authorization(), "cluster-reader", "system:serviceaccount:openshift-infra:heapster"); err != nil {
100-
return errors.NewError("cannot add cluster reader role to heapster service account").WithCause(err).WithDetails(h.OriginLog())
100+
cmdOutput := &bytes.Buffer{}
101+
if err = h.AddClusterRole("cluster-reader", "system:serviceaccount:openshift-infra:heapster", cmdOutput); err != nil {
102+
return errors.NewError("cannot add cluster reader role to heapster service account").WithCause(err).WithDetails(cmdOutput.String())
101103
}
102104

103105
// Create metrics deployer secret

‎pkg/oc/bootstrap/docker/openshift/project.go

Lines changed: 19 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,8 @@ package openshift
22

33
import (
44
"io"
5-
"io/ioutil"
5+
"strings"
66

7-
"k8s.io/apimachinery/pkg/api/errors"
87
kclientcmd "k8s.io/client-go/tools/clientcmd"
98

109
"github.com/openshift/origin/pkg/cmd/util/clientcmd"
@@ -13,36 +12,16 @@ import (
1312
)
1413

1514
// CreateProject creates a project
16-
func CreateProject(f *clientcmd.Factory, name, display, desc, basecmd string, out io.Writer) error {
17-
projectClient, err := f.OpenshiftInternalProjectClient()
18-
if err != nil {
19-
return err
20-
}
21-
pathOptions := config.NewPathOptionsWithConfig("")
22-
opt := &cmd.NewProjectOptions{
23-
ProjectName: name,
24-
DisplayName: display,
25-
Description: desc,
26-
27-
Name: basecmd,
28-
29-
Client: projectClient.Project(),
30-
31-
ProjectOptions: &cmd.ProjectOptions{PathOptions: pathOptions},
32-
Out: ioutil.Discard,
15+
func (h *Helper) CreateProject(f *clientcmd.Factory, name, display, desc, token string, out io.Writer) error {
16+
command := []string{"oc", "new-project", name, "--display-name", display, "--description", desc}
17+
if len(token) > 0 {
18+
command = append(command, "--token", token)
3319
}
34-
err = opt.ProjectOptions.Complete(f, []string{}, ioutil.Discard)
35-
if err != nil {
36-
return err
37-
}
38-
err = opt.Run()
39-
if err != nil {
40-
if errors.IsAlreadyExists(err) {
41-
return setCurrentProject(f, name, out)
42-
}
43-
return err
20+
result, err := h.execHelper.Command(command...).CombinedOutput()
21+
if err == nil || (err != nil && strings.Contains(result, "AlreadyExists")) {
22+
return setCurrentProject(f, name, out)
4423
}
45-
return nil
24+
return err
4625
}
4726

4827
func setCurrentProject(f *clientcmd.Factory, name string, out io.Writer) error {
@@ -52,11 +31,18 @@ func setCurrentProject(f *clientcmd.Factory, name string, out io.Writer) error {
5231
return opt.RunProject()
5332
}
5433

55-
func LoggedInUserFactory() (*clientcmd.Factory, error) {
34+
// LoggedInUserFactory returns a factory for the currently logged in
35+
// user as well as a token.
36+
func LoggedInUserFactory() (*clientcmd.Factory, string, error) {
5637
cfg, err := config.NewOpenShiftClientConfigLoadingRules().Load()
5738
if err != nil {
58-
return nil, err
39+
return nil, "", err
5940
}
6041
defaultCfg := kclientcmd.NewDefaultClientConfig(*cfg, &kclientcmd.ConfigOverrides{})
61-
return clientcmd.NewFactory(defaultCfg), nil
42+
clientCfg, err := defaultCfg.ClientConfig()
43+
if err != nil {
44+
return nil, "", err
45+
}
46+
47+
return clientcmd.NewFactory(defaultCfg), clientCfg.BearerToken, nil
6248
}

‎pkg/oc/bootstrap/docker/openshift/pvsetup.go

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -124,15 +124,17 @@ func (h *Helper) ensurePVInstallerSA(authorizationClient authorizationtypedclien
124124
}
125125
}
126126

127-
err = AddSCCToServiceAccount(securityClient.Security(), "privileged", "pvinstaller", "default", &bytes.Buffer{})
127+
cmdOut := &bytes.Buffer{}
128+
err = h.AddSCCToServiceAccount("privileged", "pvinstaller", "default", cmdOut)
128129
if err != nil {
129-
return errors.NewError("cannot add privileged SCC to pvinstaller service account").WithCause(err).WithDetails(h.OriginLog())
130+
return errors.NewError("cannot add privileged SCC to pvinstaller service account").WithCause(err).WithDetails(cmdOut.String())
130131
}
131132

132133
saUser := serviceaccount.MakeUsername(pvSetupNamespace, pvInstallerSA)
133-
err = AddClusterRole(authorizationClient, "cluster-admin", saUser)
134+
cmdOut = &bytes.Buffer{}
135+
err = h.AddClusterRole("cluster-admin", saUser, cmdOut)
134136
if err != nil {
135-
return errors.NewError("cannot add cluster role to service account (%s/%s)", pvSetupNamespace, pvInstallerSA).WithCause(err).WithDetails(h.OriginLog())
137+
return errors.NewError("cannot add cluster role to service account (%s/%s)", pvSetupNamespace, pvInstallerSA).WithCause(err).WithDetails(cmdOut.String())
136138
}
137139

138140
return nil

‎pkg/oc/bootstrap/docker/up.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1117,11 +1117,11 @@ func (c *ClientStartConfig) Login(out io.Writer) error {
11171117

11181118
// CreateProject creates a new project for the current user
11191119
func (c *ClientStartConfig) CreateProject(out io.Writer) error {
1120-
f, err := openshift.LoggedInUserFactory()
1120+
f, token, err := openshift.LoggedInUserFactory()
11211121
if err != nil {
11221122
return errors.NewError("cannot get logged in user client").WithCause(err)
11231123
}
1124-
return openshift.CreateProject(f, initialProjectName, initialProjectDisplay, initialProjectDesc, "oc", out)
1124+
return c.OpenShiftHelper().CreateProject(f, initialProjectName, initialProjectDisplay, initialProjectDesc, token, out)
11251125
}
11261126

11271127
// RemoveTemporaryDirectory removes the local configuration directory

‎test/extended/clusterup.sh

Lines changed: 4 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -277,16 +277,10 @@ readonly default_tests=(
277277
"numerichostname"
278278
"portinuse"
279279
"svcaccess"
280-
281-
# enable once https://github.com/openshift/origin/issues/16995 is fixed
282-
# "default"
283-
# enable once https://github.com/openshift/origin/issues/16995 is fixed
284-
# "image::ose3.3"
285-
# enable once https://github.com/openshift/origin/issues/16995 is fixed
286-
# "image::ose3.4"
287-
# enable once https://github.com/openshift/origin/issues/16995 is fixed
288-
# "image::ose3.5"
289-
280+
"default"
281+
"image::ose3.3"
282+
"image::ose3.4"
283+
"image::ose3.5"
290284
"image::ose3.6"
291285

292286
# logging+metrics team needs to fix/enable these tests.

0 commit comments

Comments
 (0)