seg_yinzy
/
che-server
mirror of https://github.com/eclipse-che/che-server.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Make all configmaps unique in same namespace (#18620) 

* Make all configmaps unique in the same namespace 

Signed-off-by: Sergii Kabashniuk <skabashniuk@redhat.com>
7.24.x
Sergii Kabashniuk 2020-12-21 10:29:15 +02:00 committed by GitHub
parent 44add764f4
commit 5656feade9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
14 changed files with 50 additions and 75 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
assembly/assembly-wsmaster-war/src/main/webapp/WEB-INF/classes/che/che.properties
View File

@ -489,6 +489,9 @@ che.infra.kubernetes.trusted_ca.src_configmap=NULL
# Holds the copy of che.infra.kubernetes.trusted_ca.src_configmap but in a workspace namespace.
# Content of this config map is mounted into all workspace containers including plugin brokers.
# Do not change the config map name unless it conflicts with the already existing config map.
# Note that the resulting config map name can be adjusted eventually to make it unique in k8s namespace.
# The original name would be stored in `che.original_name` label.
che.infra.kubernetes.trusted_ca.dest_configmap=ca-certs
# Configures path on workspace containers where the CA bundle should be mount.

5
infrastructures/kubernetes/pom.xml
View File

@ -255,11 +255,6 @@
<artifactId>mockito-core</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.mockito</groupId>
<artifactId>mockito-core</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.mockito</groupId>
<artifactId>mockito-testng</artifactId>

2
infrastructures/kubernetes/src/main/java/org/eclipse/che/workspace/infrastructure/kubernetes/KubernetesEnvironmentProvisioner.java
View File

@ -167,7 +167,6 @@ public interface KubernetesEnvironmentProvisioner<T extends KubernetesEnvironmen
// 3 stage - add Kubernetes env items
LOG.debug("Provisioning environment items for workspace '{}'", workspaceId);
restartPolicyRewriter.provision(k8sEnv, identity);
uniqueNamesProvisioner.provision(k8sEnv, identity);
resourceLimitRequestProvisioner.provision(k8sEnv, identity);
nodeSelectorProvisioner.provision(k8sEnv, identity);
externalServerTlsProvisioner.provision(k8sEnv, identity);
@ -183,6 +182,7 @@ public interface KubernetesEnvironmentProvisioner<T extends KubernetesEnvironmen
gitConfigProvisioner.provision(k8sEnv, identity);
gatewayRouterProvisioner.provision(k8sEnv, identity);
trustedCAProvisioner.provision(k8sEnv, identity);
uniqueNamesProvisioner.provision(k8sEnv, identity);
LOG.debug("Provisioning Kubernetes environment done for workspace '{}'", workspaceId);
}
}

9
infrastructures/kubernetes/src/main/java/org/eclipse/che/workspace/infrastructure/kubernetes/provision/GitConfigProvisioner.java
View File

@ -52,7 +52,7 @@ import org.eclipse.che.workspace.infrastructure.kubernetes.environment.Kubernete
@Singleton
public class GitConfigProvisioner implements ConfigurationProvisioner<KubernetesEnvironment> {
public static final String GIT_CONFIG_MAP_NAME_SUFFIX = "-gitconfig";
public static final String GIT_CONFIG_MAP_NAME = "gitconfig";
private static final String GIT_BASE_CONFIG_PATH = "/etc/";
public static final String GIT_CONFIG = "gitconfig";
@ -132,12 +132,7 @@ public class GitConfigProvisioner implements ConfigurationProvisioner<Kubernetes
private void prepareAndProvisionGitConfiguration(
String name, String email, KubernetesEnvironment k8sEnv, RuntimeIdentity identity) {
prepareGitConfigurationContent(name, email)
.ifPresent(
content -> {
String configMapName = identity.getWorkspaceId() + GIT_CONFIG_MAP_NAME_SUFFIX;
doProvisionGitConfiguration(configMapName, content, k8sEnv);
});
.ifPresent(content -> doProvisionGitConfiguration(GIT_CONFIG_MAP_NAME, content, k8sEnv));
}
private String getStringValueOrNull(Map<String, Object> map, String key) {

37
infrastructures/kubernetes/src/main/java/org/eclipse/che/workspace/infrastructure/kubernetes/provision/KubernetesTrustedCAProvisioner.java
View File

@ -23,7 +23,6 @@ import io.fabric8.kubernetes.api.model.VolumeBuilder;
import io.fabric8.kubernetes.api.model.VolumeMountBuilder;
import java.util.HashMap;
import java.util.Map;
import java.util.Optional;
import javax.inject.Inject;
import javax.inject.Named;
import javax.inject.Singleton;
@ -35,7 +34,6 @@ import org.eclipse.che.workspace.infrastructure.kubernetes.environment.CheInstal
import org.eclipse.che.workspace.infrastructure.kubernetes.environment.KubernetesEnvironment;
import org.eclipse.che.workspace.infrastructure.kubernetes.environment.KubernetesEnvironment.PodData;
import org.eclipse.che.workspace.infrastructure.kubernetes.environment.KubernetesEnvironment.PodRole;
import org.eclipse.che.workspace.infrastructure.kubernetes.namespace.KubernetesNamespace;
import org.eclipse.che.workspace.infrastructure.kubernetes.namespace.KubernetesNamespaceFactory;
/**
@ -112,27 +110,20 @@ public class KubernetesTrustedCAProvisioner implements TrustedCAProvisioner {
return;
}
KubernetesNamespace namespace = namespaceFactory.getOrCreate(runtimeID);
Optional<ConfigMap> existing = namespace.configMaps().get(configMapName);
if (existing.isEmpty()
|| !(existing.get().getData() == allCaCertsConfigMap.getData()
|| existing.get().getData().equals(allCaCertsConfigMap.getData()))) {
// create or renew map
k8sEnv
.getConfigMaps()
.put(
configMapName,
new ConfigMapBuilder()
.withMetadata(
new ObjectMetaBuilder()
.withName(configMapName)
.withAnnotations(allCaCertsConfigMap.getMetadata().getAnnotations())
.withLabels(configMapLabelKeyValue)
.build())
.withApiVersion(allCaCertsConfigMap.getApiVersion())
.withData(allCaCertsConfigMap.getData())
.build());
}
k8sEnv
.getConfigMaps()
.put(
configMapName,
new ConfigMapBuilder()
.withMetadata(
new ObjectMetaBuilder()
.withName(configMapName)
.withAnnotations(allCaCertsConfigMap.getMetadata().getAnnotations())
.withLabels(configMapLabelKeyValue)
.build())
.withApiVersion(allCaCertsConfigMap.getApiVersion())
.withData(allCaCertsConfigMap.getData())
.build());
for (PodData pod : k8sEnv.getPodsData().values()) {
if (pod.getRole() == PodRole.DEPLOYMENT) {

10
infrastructures/kubernetes/src/main/java/org/eclipse/che/workspace/infrastructure/kubernetes/provision/SshKeysProvisioner.java
View File

@ -84,7 +84,7 @@ public class SshKeysProvisioner implements ConfigurationProvisioner<KubernetesEn
private static final String SSH_CONFIG = "ssh_config";
private static final String SSH_CONFIG_PATH = SSH_BASE_CONFIG_PATH + SSH_CONFIG;
private static final String SSH_CONFIG_MAP_NAME_SUFFIX = "-sshconfigmap";
private static final String SSH_CONFIG_MAP_NAME = "sshconfigmap";
private static final String SSH_SECRET_NAME_SUFFIX = "-sshprivatekeys";
private static final String SSH_SECRET_TYPE = "opaque";
@ -250,14 +250,12 @@ public class SshKeysProvisioner implements ConfigurationProvisioner<KubernetesEn
sshConfigData.append(buildConfig(sshPair.getName()));
}
String sshConfigMapName = wsId + SSH_CONFIG_MAP_NAME_SUFFIX;
Map<String, String> sshConfig = new HashMap<>();
sshConfig.put(SSH_CONFIG, sshConfigData.toString());
ConfigMap configMap =
new ConfigMapBuilder()
.withNewMetadata()
.withName(sshConfigMapName)
.withName(SSH_CONFIG_MAP_NAME)
.endMetadata()
.withData(sshConfig)
.build();
@ -267,7 +265,9 @@ public class SshKeysProvisioner implements ConfigurationProvisioner<KubernetesEn
.getPodsData()
.values()
.forEach(
p -> mountConfigFile(p.getSpec(), sshConfigMapName, p.getRole() != PodRole.INJECTABLE));
p ->
mountConfigFile(
p.getSpec(), SSH_CONFIG_MAP_NAME, p.getRole() != PodRole.INJECTABLE));
}
private void mountConfigFile(PodSpec podSpec, String sshConfigMapName, boolean addVolume) {

3
infrastructures/kubernetes/src/main/java/org/eclipse/che/workspace/infrastructure/kubernetes/provision/UniqueNamesProvisioner.java
View File

@ -39,7 +39,8 @@ import org.eclipse.che.workspace.infrastructure.kubernetes.environment.Kubernete
import org.eclipse.che.workspace.infrastructure.kubernetes.environment.KubernetesEnvironment.PodData;
/**
* Makes names of Kubernetes pods and ingresses unique whole namespace by {@link Names}.
* Makes names of Kubernetes pods, ingresses and config maps unique whole namespace by {@link
* Names}.
*
* <p>Original names will be stored in {@link Constants#CHE_ORIGINAL_NAME_LABEL} label of renamed
* object.

5
infrastructures/kubernetes/src/main/java/org/eclipse/che/workspace/infrastructure/kubernetes/provision/secret/GitCredentialStorageFileSecretApplier.java
View File

@ -64,10 +64,7 @@ public class GitCredentialStorageFileSecretApplier extends FileSecretApplier {
keys.size()));
}
Path gitSecretFilePath = Paths.get(secretMountPath, keys.iterator().next());
ConfigMap gitConfigMap =
env.getConfigMaps()
.get(
runtimeIdentity.getWorkspaceId() + GitConfigProvisioner.GIT_CONFIG_MAP_NAME_SUFFIX);
ConfigMap gitConfigMap = env.getConfigMaps().get(GitConfigProvisioner.GIT_CONFIG_MAP_NAME);
if (gitConfigMap != null) {
Map<String, String> gitConfigMapData = gitConfigMap.getData();
String gitConfig = gitConfigMapData.get(GitConfigProvisioner.GIT_CONFIG);

3
infrastructures/kubernetes/src/test/java/org/eclipse/che/workspace/infrastructure/kubernetes/KubernetesEnvironmentProvisionerTest.java
View File

@ -153,7 +153,7 @@ public class KubernetesEnvironmentProvisionerTest {
provisionOrder.verify(envVarsProvisioner).provision(eq(k8sEnv), eq(runtimeIdentity));
provisionOrder.verify(volumesStrategy).provision(eq(k8sEnv), eq(runtimeIdentity));
provisionOrder.verify(restartPolicyRewriter).provision(eq(k8sEnv), eq(runtimeIdentity));
provisionOrder.verify(uniqueNamesProvisioner).provision(eq(k8sEnv), eq(runtimeIdentity));
provisionOrder.verify(ramLimitProvisioner).provision(eq(k8sEnv), eq(runtimeIdentity));
provisionOrder.verify(nodeSelectorProvisioner).provision(eq(k8sEnv), eq(runtimeIdentity));
provisionOrder
@ -170,6 +170,7 @@ public class KubernetesEnvironmentProvisionerTest {
provisionOrder.verify(gitConfigProvisioner).provision(eq(k8sEnv), eq(runtimeIdentity));
provisionOrder.verify(gatewayRouterProvisioner).provision(eq(k8sEnv), eq(runtimeIdentity));
provisionOrder.verify(trustedCAProvisioner).provision(eq(k8sEnv), eq(runtimeIdentity));
provisionOrder.verify(uniqueNamesProvisioner).provision(eq(k8sEnv), eq(runtimeIdentity));
provisionOrder.verifyNoMoreInteractions();
}
}

27
infrastructures/kubernetes/src/test/java/org/eclipse/che/workspace/infrastructure/kubernetes/provision/GitConfigProvisionerTest.java
View File

@ -205,9 +205,9 @@ public class GitConfigProvisionerTest {
assertEquals(mount.getSubPath(), "gitconfig");
assertEquals(k8sEnv.getConfigMaps().size(), 1);
assertTrue(k8sEnv.getConfigMaps().containsKey("wksp-gitconfig"));
assertTrue(k8sEnv.getConfigMaps().containsKey("gitconfig"));
ConfigMap configMap = k8sEnv.getConfigMaps().get("wksp-gitconfig");
ConfigMap configMap = k8sEnv.getConfigMaps().get("gitconfig");
assertEquals(configMap.getData().size(), 1);
assertTrue(configMap.getData().containsKey("gitconfig"));
@ -257,9 +257,9 @@ public class GitConfigProvisionerTest {
assertEquals(mount.getSubPath(), "gitconfig");
assertEquals(k8sEnv.getConfigMaps().size(), 1);
assertTrue(k8sEnv.getConfigMaps().containsKey("wksp-gitconfig"));
assertTrue(k8sEnv.getConfigMaps().containsKey("gitconfig"));
ConfigMap configMap = k8sEnv.getConfigMaps().get("wksp-gitconfig");
ConfigMap configMap = k8sEnv.getConfigMaps().get("gitconfig");
assertEquals(configMap.getData().size(), 1);
assertTrue(configMap.getData().containsKey("gitconfig"));
@ -309,9 +309,9 @@ public class GitConfigProvisionerTest {
assertEquals(mount.getSubPath(), "gitconfig");
assertEquals(k8sEnv.getConfigMaps().size(), 1);
assertTrue(k8sEnv.getConfigMaps().containsKey("wksp-gitconfig"));
assertTrue(k8sEnv.getConfigMaps().containsKey("gitconfig"));
ConfigMap configMap = k8sEnv.getConfigMaps().get("wksp-gitconfig");
ConfigMap configMap = k8sEnv.getConfigMaps().get("gitconfig");
assertEquals(configMap.getData().size(), 1);
assertTrue(configMap.getData().containsKey("gitconfig"));
@ -354,9 +354,9 @@ public class GitConfigProvisionerTest {
assertEquals(mount.getSubPath(), "gitconfig");
assertEquals(k8sEnv.getConfigMaps().size(), 1);
assertTrue(k8sEnv.getConfigMaps().containsKey("wksp-gitconfig"));
assertTrue(k8sEnv.getConfigMaps().containsKey("gitconfig"));
ConfigMap configMap = k8sEnv.getConfigMaps().get("wksp-gitconfig");
ConfigMap configMap = k8sEnv.getConfigMaps().get("gitconfig");
assertEquals(configMap.getData().size(), 1);
assertTrue(configMap.getData().containsKey("gitconfig"));
@ -402,9 +402,9 @@ public class GitConfigProvisionerTest {
assertEquals(mount.getSubPath(), "gitconfig");
assertEquals(k8sEnv.getConfigMaps().size(), 1);
assertTrue(k8sEnv.getConfigMaps().containsKey("wksp-gitconfig"));
assertTrue(k8sEnv.getConfigMaps().containsKey("gitconfig"));
ConfigMap configMap = k8sEnv.getConfigMaps().get("wksp-gitconfig");
ConfigMap configMap = k8sEnv.getConfigMaps().get("gitconfig");
assertEquals(configMap.getData().size(), 1);
assertTrue(configMap.getData().containsKey("gitconfig"));
@ -421,8 +421,6 @@ public class GitConfigProvisionerTest {
when(vcsSslCertificateProvisioner.getGitServerHost()).thenReturn("https://localhost");
when(vcsSslCertificateProvisioner.getCertPath()).thenReturn("/some/path");
when(runtimeIdentity.getWorkspaceId()).thenReturn("wksp");
ObjectMeta podMeta = new ObjectMetaBuilder().withName("wksp").build();
when(pod.getMetadata()).thenReturn(podMeta);
when(pod.getSpec()).thenReturn(podSpec);
@ -450,9 +448,9 @@ public class GitConfigProvisionerTest {
assertEquals(mount.getSubPath(), "gitconfig");
assertEquals(k8sEnv.getConfigMaps().size(), 1);
assertTrue(k8sEnv.getConfigMaps().containsKey("wksp-gitconfig"));
assertTrue(k8sEnv.getConfigMaps().containsKey("gitconfig"));
ConfigMap configMap = k8sEnv.getConfigMaps().get("wksp-gitconfig");
ConfigMap configMap = k8sEnv.getConfigMaps().get("gitconfig");
assertEquals(configMap.getData().size(), 1);
assertTrue(configMap.getData().containsKey("gitconfig"));
@ -471,7 +469,6 @@ public class GitConfigProvisionerTest {
singletonMap(
"theia-user-preferences", "{\"git.user.name\":\"user\",\"git.user.email\":\"email\"}");
when(preferenceManager.find(eq("id"), eq("theia-user-preferences"))).thenReturn(preferences);
when(runtimeIdentity.getWorkspaceId()).thenReturn("wksp");
Pod pod =
new PodBuilder()

4
infrastructures/kubernetes/src/test/java/org/eclipse/che/workspace/infrastructure/kubernetes/provision/SshKeySecretProvisionerTest.java
View File

@ -144,9 +144,9 @@ public class SshKeySecretProvisionerTest {
Map<String, ConfigMap> configMaps = k8sEnv.getConfigMaps();
assertNotNull(configMaps);
assertTrue(configMaps.containsKey("wksp-sshconfigmap"));
assertTrue(configMaps.containsKey("sshconfigmap"));
ConfigMap sshConfigMap = configMaps.get("wksp-sshconfigmap");
ConfigMap sshConfigMap = configMaps.get("sshconfigmap");
assertNotNull(sshConfigMap);
Map<String, String> mapData = sshConfigMap.getData();

13
infrastructures/kubernetes/src/test/java/org/eclipse/che/workspace/infrastructure/kubernetes/provision/secret/GitCredentialStorageFileSecretApplierTest.java
View File

@ -13,6 +13,7 @@ package org.eclipse.che.workspace.infrastructure.kubernetes.provision.secret;
import static java.util.Collections.emptyMap;
import static java.util.Collections.singletonMap;
import static org.eclipse.che.workspace.infrastructure.kubernetes.provision.GitConfigProvisioner.GIT_CONFIG_MAP_NAME;
import static org.eclipse.che.workspace.infrastructure.kubernetes.provision.secret.FileSecretApplier.ANNOTATION_MOUNT_PATH;
import static org.eclipse.che.workspace.infrastructure.kubernetes.provision.secret.KubernetesSecretApplier.ANNOTATION_AUTOMOUNT;
import static org.eclipse.che.workspace.infrastructure.kubernetes.provision.secret.SecretAsContainerResourceProvisioner.ANNOTATION_MOUNT_AS;
@ -64,7 +65,7 @@ public class GitCredentialStorageFileSecretApplierTest {
when(environment.getPodsData()).thenReturn(singletonMap("pod1", podData));
when(podData.getRole()).thenReturn(KubernetesEnvironment.PodRole.DEPLOYMENT);
when(podData.getSpec()).thenReturn(podSpec);
when(runtimeIdentity.getWorkspaceId()).thenReturn("ws-1234598");
lenient().when(runtimeIdentity.getWorkspaceId()).thenReturn("ws-1234598");
}
@Test(
@ -124,10 +125,7 @@ public class GitCredentialStorageFileSecretApplierTest {
new ConfigMapBuilder()
.withData(ImmutableMap.of(GitConfigProvisioner.GIT_CONFIG, GIT_CONFIG_CONTENT))
.build();
when(environment.getConfigMaps())
.thenReturn(
ImmutableMap.of(
"ws-1234598" + GitConfigProvisioner.GIT_CONFIG_MAP_NAME_SUFFIX, configMap));
when(environment.getConfigMaps()).thenReturn(ImmutableMap.of(GIT_CONFIG_MAP_NAME, configMap));
// when
secretApplier.applySecret(environment, runtimeIdentity, secret);
// then
@ -172,10 +170,7 @@ public class GitCredentialStorageFileSecretApplierTest {
GIT_CONFIG_CONTENT
+ "[credential]\n\thelper = store --file /home/user/.git/credentials\n"))
.build();
when(environment.getConfigMaps())
.thenReturn(
ImmutableMap.of(
"ws-1234598" + GitConfigProvisioner.GIT_CONFIG_MAP_NAME_SUFFIX, configMap));
when(environment.getConfigMaps()).thenReturn(ImmutableMap.of(GIT_CONFIG_MAP_NAME, configMap));
// when
secretApplier.applySecret(environment, runtimeIdentity, secret);
}

2
infrastructures/openshift/src/main/java/org/eclipse/che/workspace/infrastructure/openshift/OpenShiftEnvironmentProvisioner.java
View File

@ -163,7 +163,6 @@ public class OpenShiftEnvironmentProvisioner
// 3 stage - add OpenShift env items
restartPolicyRewriter.provision(osEnv, identity);
uniqueNamesProvisioner.provision(osEnv, identity);
routeTlsProvisioner.provision(osEnv, identity);
resourceLimitRequestProvisioner.provision(osEnv, identity);
nodeSelectorProvisioner.provision(osEnv, identity);
@ -179,6 +178,7 @@ public class OpenShiftEnvironmentProvisioner
gatewayRouterProvisioner.provision(osEnv, identity);
deploymentMetadataProvisioner.provision(osEnv, identity);
trustedCAProvisioner.provision(osEnv, identity);
uniqueNamesProvisioner.provision(osEnv, identity);
LOG.debug(
"Provisioning OpenShift environment done for workspace '{}'", identity.getWorkspaceId());
}

2
infrastructures/openshift/src/test/java/org/eclipse/che/workspace/infrastructure/openshift/OpenShiftEnvironmentProvisionerTest.java
View File

@ -150,7 +150,6 @@ public class OpenShiftEnvironmentProvisionerTest {
provisionOrder.verify(envVarsProvisioner).provision(eq(osEnv), eq(runtimeIdentity));
provisionOrder.verify(volumesStrategy).provision(eq(osEnv), eq(runtimeIdentity));
provisionOrder.verify(restartPolicyRewriter).provision(eq(osEnv), eq(runtimeIdentity));
provisionOrder.verify(uniqueNamesProvisioner).provision(eq(osEnv), eq(runtimeIdentity));
provisionOrder.verify(tlsRouteProvisioner).provision(eq(osEnv), eq(runtimeIdentity));
provisionOrder.verify(ramLimitProvisioner).provision(eq(osEnv), eq(runtimeIdentity));
provisionOrder.verify(nodeSelectorProvisioner).provision(eq(osEnv), eq(runtimeIdentity));
@ -167,6 +166,7 @@ public class OpenShiftEnvironmentProvisionerTest {
provisionOrder.verify(gatewayRouterProvisioner).provision(eq(osEnv), eq(runtimeIdentity));
provisionOrder.verify(deploymentMetadataProvisioner).provision(eq(osEnv), eq(runtimeIdentity));
provisionOrder.verify(trustedCAProvisioner).provision(eq(osEnv), eq(runtimeIdentity));
provisionOrder.verify(uniqueNamesProvisioner).provision(eq(osEnv), eq(runtimeIdentity));
provisionOrder.verifyNoMoreInteractions();
}
}