mirrors/kube-arangodb
1
0
Fork 0
mirror of https://github.com/arangodb/kube-arangodb.git synced 2024-12-14 11:57:37 +00:00
Code Activity

Added cleanup of obsolete access packages

Browse source
This commit is contained in:
Ewout Prangsma 2018-05-31 13:50:22 +02:00
parent 9999e55fde
commit 665d984854
No known key found for this signature in database
GPG key ID: 4DBAD380D93D0698
3 changed files with 50 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
docs/Manual/Deployment/Kubernetes/DeploymentResource.md
View file

@ -248,6 +248,8 @@ operator containing "access packages". An access package contains those `Secrets
to access the SyncMasters of this `ArangoDeployment`.
By removing a name from this setting, the corresponding `Secret` is also deleted.
Note that to remove all access packages, leave an empty array in place (`[]`).
Completely removing the setting results in not modifying the list.
See [the `ArangoDeploymentReplication` specification](./DeploymentReplicationResource.md) for more information
on access packages.

38
pkg/deployment/access_package.go
View file

@ -38,24 +38,58 @@ import (
const (
clientAuthValidFor = time.Hour * 24 * 365 // 1yr
clientAuthCurve = "P256"
labelKeyOriginalDeployment = "original-deployment-name"
)
// createAccessPackages creates a arangosync access packages specified
// in spec.sync.externalAccess.accessPackageSecretNames.
func (d *Deployment) createAccessPackages() error {
log := d.deps.Log
spec := d.apiObject.Spec
secrets := d.deps.KubeCli.CoreV1().Secrets(d.GetNamespace())
if !spec.Sync.IsEnabled() {
// We're only relevant when sync is enabled
return nil
}
// Create all access packages that we're asked to build
apNameMap := make(map[string]struct{})
for _, apSecretName := range spec.Sync.ExternalAccess.AccessPackageSecretNames {
apNameMap[apSecretName] = struct{}{}
if err := d.ensureAccessPackage(apSecretName); err != nil {
return maskAny(err)
}
}
// Remove all access packages that we did build, but are no longer needed
secretList, err := secrets.List(metav1.ListOptions{})
if err != nil {
log.Debug().Err(err).Msg("Failed to list secrets")
return maskAny(err)
}
for _, secret := range secretList.Items {
if d.isOwnerOf(&secret) {
if _, found := secret.Data[constants.SecretAccessPackageYaml]; found {
// Secret is an access package
if _, wanted := apNameMap[secret.GetName()]; !wanted {
// We found an obsolete access package secret. Remove it.
if err := secrets.Delete(secret.GetName(), &metav1.DeleteOptions{
Preconditions: &metav1.Preconditions{UID: &secret.UID},
}); err != nil && !k8sutil.IsNotFound(err) {
// Not serious enough to stop everything now, just log and create an event
log.Warn().Err(err).Msg("Failed to remove obsolete access package secret")
d.CreateEvent(k8sutil.NewErrorEvent("Access Package cleanup failed", err, d.apiObject))
} else {
// Access package removed, notify user
log.Info().Str("secret-name", secret.GetName()).Msg("Removed access package Secret")
d.CreateEvent(k8sutil.NewAccessPackageDeletedEvent(d.apiObject, secret.GetName()))
}
}
}
}
}
return nil
}
@ -117,7 +151,7 @@ func (d *Deployment) ensureAccessPackage(apSecretName string) error {
ObjectMeta: metav1.ObjectMeta{
Name: apSecretName + "-auth",
Labels: map[string]string{
"remote-deployment": d.apiObject.GetName(),
labelKeyOriginalDeployment: d.apiObject.GetName(),
},
},
Data: map[string][]byte{
@ -133,7 +167,7 @@ func (d *Deployment) ensureAccessPackage(apSecretName string) error {
ObjectMeta: metav1.ObjectMeta{
Name: apSecretName + "-ca",
Labels: map[string]string{
"remote-deployment": d.apiObject.GetName(),
labelKeyOriginalDeployment: d.apiObject.GetName(),
},
},
Data: map[string][]byte{

10
pkg/util/k8sutil/events.go
View file

@ -135,6 +135,16 @@ func NewAccessPackageCreatedEvent(apiObject APIObject, apSecretName string) *v1.
return event
}
// NewAccessPackageDeletedEvent creates an event indicating that a secret containing an access package
// has been deleted.
func NewAccessPackageDeletedEvent(apiObject APIObject, apSecretName string) *v1.Event {
event := newDeploymentEvent(apiObject)
event.Type = v1.EventTypeNormal
event.Reason = "Access package deleted"
event.Message = fmt.Sprintf("An access package named %s has been deleted", apSecretName)
return event
}
// NewErrorEvent creates an even of type error.
func NewErrorEvent(reason string, err error, apiObject APIObject) *v1.Event {
event := newDeploymentEvent(apiObject)