Skip to content

Commit 762c96f

Browse files
kobzonegaJorres
kobzonega
and
Jorres
authored
Support auth through ydb-go-sdk in communication with YDB cluster (#158)
* feat: all debugging output * chore: clean up debug output * feat: moved healthcheck from grpc to go-sdk * feat: create tenant uses go-sdk now * refactor: a better entrypoint for all YDB connections * feat: no more useless logs * refactor: less copypaste * refactor: less copypaste * fix: typo * chore: make linter check after autoformatting * revert: now I understand our CI * fix: lint * chore: bump up chart version * init authOptions * some fixes after merge * lint errors fixes * rename field in spec to operatorConnection --------- Co-authored-by: tarasov-egor <jorres.tarasov@gmail.com>
1 parent 44ac9a1 commit 762c96f

23 files changed

+604
-131
lines changed

‎api/v1alpha1/connection_types.go

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
package v1alpha1
2+
3+
import (
4+
corev1 "k8s.io/api/core/v1"
5+
)
6+
7+
type ConnectionOptions struct {
8+
AccessToken *AccessTokenAuth `json:"accessToken,omitempty"`
9+
StaticCredentials *StaticCredentialsAuth `json:"staticCredentials,omitempty"`
10+
}
11+
12+
type AccessTokenAuth struct {
13+
*CredentialSource `json:",inline"`
14+
}
15+
16+
type StaticCredentialsAuth struct {
17+
Username string `json:"username"`
18+
Password *CredentialSource `json:"password,omitempty"`
19+
}
20+
21+
type CredentialSource struct {
22+
SecretKeyRef *corev1.SecretKeySelector `json:"secretKeyRef"`
23+
}

‎api/v1alpha1/const.go

+3
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,9 @@ const (
3131
BinariesDir = "/opt/ydb/bin"
3232
DaemonBinaryName = "ydbd"
3333

34+
DefaultRootUsername = "root"
35+
DefaultRootPassword = ""
36+
3437
AnnotationUpdateStrategyOnDelete = "ydb.tech/update-strategy-on-delete"
3538
AnnotationUpdateDNSPolicy = "ydb.tech/update-dns-policy"
3639
AnnotationSkipInitialization = "ydb.tech/skip-initialization"

‎api/v1alpha1/storage_types.go

+5
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,11 @@ type StorageSpec struct {
2727
// +required
2828
DataStore []corev1.PersistentVolumeClaimSpec `json:"dataStore"`
2929

30+
// (Optional) Operator connection settings
31+
// Default: (not specified)
32+
// +optional
33+
OperatorConnection *ConnectionOptions `json:"operatorConnection,omitempty"`
34+
3035
// (Optional) Storage services parameter overrides
3136
// Default: (not specified)
3237
// +optional

‎api/v1alpha1/storage_webhook.go

+31-2
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ package v1alpha1
33
import (
44
"fmt"
55

6-
"gopkg.in/yaml.v2"
6+
"gopkg.in/yaml.v3"
77
v1 "k8s.io/api/core/v1"
88
"k8s.io/apimachinery/pkg/runtime"
99
"k8s.io/utils/strings/slices"
@@ -21,6 +21,12 @@ func (r *Storage) SetupWebhookWithManager(mgr ctrl.Manager) error {
2121
Complete()
2222
}
2323

24+
type DomainsConfig struct {
25+
SecurityConfig struct {
26+
EnforceUserTokenRequirement bool `yaml:"enforce_user_token_requirement"`
27+
} `yaml:"security_config"`
28+
}
29+
2430
//+kubebuilder:webhook:path=/mutate-ydb-tech-v1alpha1-storage,mutating=true,failurePolicy=fail,sideEffects=None,groups=ydb.tech,resources=storages,verbs=create;update,versions=v1alpha1,name=mutate-storage.ydb.tech,admissionReviewVersions=v1
2531

2632
var _ webhook.Defaulter = &Storage{}
@@ -84,6 +90,15 @@ func (r *Storage) ValidateCreate() error {
8490
nodesNumber = int32(len(hosts))
8591
}
8692

93+
if configuration["domains_config"] != nil {
94+
if domainsConfig, ok := configuration["domains_config"].(DomainsConfig); ok {
95+
authEnabled := domainsConfig.SecurityConfig.EnforceUserTokenRequirement
96+
if (authEnabled && r.Spec.OperatorConnection == nil) || (!authEnabled && r.Spec.OperatorConnection != nil) {
97+
return fmt.Errorf("field 'spec.operatorConnection' does not satisfy with config option `enforce_user_token_requirement: %t`", authEnabled)
98+
}
99+
}
100+
}
101+
87102
minNodesPerErasure := map[ErasureType]int32{
88103
ErasureMirror3DC: 9,
89104
ErasureBlock42: 8,
@@ -103,7 +118,6 @@ func (r *Storage) ValidateCreate() error {
103118
return fmt.Errorf("the secret name %s is reserved, use another one", secret.Name)
104119
}
105120
}
106-
107121
if r.Spec.Volumes != nil {
108122
for _, volume := range r.Spec.Volumes {
109123
if volume.HostPath == nil {
@@ -124,6 +138,21 @@ func (r *Storage) ValidateCreate() error {
124138
func (r *Storage) ValidateUpdate(old runtime.Object) error {
125139
storagelog.Info("validate update", "name", r.Name)
126140

141+
configuration := make(map[string]interface{})
142+
err := yaml.Unmarshal([]byte(r.Spec.Configuration), &configuration)
143+
if err != nil {
144+
return fmt.Errorf("failed to parse Storage.spec.configuration, error: %w", err)
145+
}
146+
147+
if configuration["domains_config"] != nil {
148+
if domainsConfig, ok := configuration["domains_config"].(DomainsConfig); ok {
149+
authEnabled := domainsConfig.SecurityConfig.EnforceUserTokenRequirement
150+
if (authEnabled && r.Spec.OperatorConnection == nil) || (!authEnabled && r.Spec.OperatorConnection != nil) {
151+
return fmt.Errorf("field 'spec.operatorConnection' does not satisfy with config option `enforce_user_token_requirement: %t`", authEnabled)
152+
}
153+
}
154+
}
155+
127156
crdCheckError := checkMonitoringCRD(manager, storagelog, r.Spec.Monitoring != nil)
128157
if crdCheckError != nil {
129158
return crdCheckError

‎api/v1alpha1/zz_generated.deepcopy.go

+106
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎deploy/ydb-operator/Chart.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,10 @@ type: application
1515
# This is the chart version. This version number should be incremented each time you make changes
1616
# to the chart and its templates, including the app version.
1717
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18-
version: 0.4.33
18+
version: 0.4.34
1919

2020
# This is the version number of the application being deployed. This version number should be
2121
# incremented each time you make changes to the application. Versions are not expected to
2222
# follow Semantic Versioning. They should reflect the version the application is using.
2323
# It is recommended to use it with quotes.
24-
appVersion: "0.4.33"
24+
appVersion: "0.4.34"

‎deploy/ydb-operator/crds/storage.yaml

+59
Original file line numberDiff line numberDiff line change
@@ -2445,6 +2445,65 @@ spec:
24452445
description: Number of nodes (pods) in the cluster
24462446
format: int32
24472447
type: integer
2448+
operatorConnection:
2449+
description: '(Optional) Operator connection settings Default: (not
2450+
specified)'
2451+
properties:
2452+
accessToken:
2453+
properties:
2454+
secretKeyRef:
2455+
description: SecretKeySelector selects a key of a Secret.
2456+
properties:
2457+
key:
2458+
description: The key of the secret to select from. Must
2459+
be a valid secret key.
2460+
type: string
2461+
name:
2462+
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
2463+
TODO: Add other useful fields. apiVersion, kind, uid?'
2464+
type: string
2465+
optional:
2466+
description: Specify whether the Secret or its key must
2467+
be defined
2468+
type: boolean
2469+
required:
2470+
- key
2471+
type: object
2472+
required:
2473+
- secretKeyRef
2474+
type: object
2475+
staticCredentials:
2476+
properties:
2477+
password:
2478+
properties:
2479+
secretKeyRef:
2480+
description: SecretKeySelector selects a key of a Secret.
2481+
properties:
2482+
key:
2483+
description: The key of the secret to select from. Must
2484+
be a valid secret key.
2485+
type: string
2486+
name:
2487+
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
2488+
TODO: Add other useful fields. apiVersion, kind,
2489+
uid?'
2490+
type: string
2491+
optional:
2492+
description: Specify whether the Secret or its key
2493+
must be defined
2494+
type: boolean
2495+
required:
2496+
- key
2497+
type: object
2498+
required:
2499+
- secretKeyRef
2500+
type: object
2501+
username:
2502+
type: string
2503+
required:
2504+
- username
2505+
type: object
2506+
type: object
24482507
priorityClassName:
24492508
description: (Optional) If specified, the pod's priorityClassName.
24502509
type: string

‎e2e/kind-cluster-config.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ containerdConfigPatches:
66
snapshotter = "native"
77
nodes:
88
- role: control-plane
9-
- role: worker
9+
- role: worker
1010
labels:
1111
worker: true
1212
- role: worker

‎go.mod

+8-4
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@ require (
99
github.com/onsi/gomega v1.27.6
1010
github.com/pkg/errors v0.9.1
1111
github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.50.0
12-
github.com/ydb-platform/ydb-go-genproto v0.0.0-20210916081217-f4e55570b874
13-
google.golang.org/grpc v1.49.0
12+
github.com/ydb-platform/ydb-go-genproto v0.0.0-20230801151335-81e01be38941
13+
github.com/ydb-platform/ydb-go-sdk/v3 v3.53.0
14+
google.golang.org/grpc v1.53.0
1415
google.golang.org/protobuf v1.28.1
15-
gopkg.in/yaml.v2 v2.4.0
1616
gopkg.in/yaml.v3 v3.0.1
1717
k8s.io/api v0.26.1
1818
k8s.io/apimachinery v0.26.1
@@ -37,6 +37,7 @@ require (
3737
github.com/go-openapi/swag v0.22.3 // indirect
3838
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
3939
github.com/gogo/protobuf v1.3.2 // indirect
40+
github.com/golang-jwt/jwt/v4 v4.4.1 // indirect
4041
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
4142
github.com/golang/protobuf v1.5.3 // indirect
4243
github.com/google/gnostic v0.6.9 // indirect
@@ -45,6 +46,7 @@ require (
4546
github.com/google/pprof v0.0.0-20230510103437-eeec1cb781c3 // indirect
4647
github.com/google/uuid v1.3.0 // indirect
4748
github.com/imdario/mergo v0.3.13 // indirect
49+
github.com/jonboulle/clockwork v0.3.0 // indirect
4850
github.com/josharian/intern v1.0.0 // indirect
4951
github.com/json-iterator/go v1.1.12 // indirect
5052
github.com/mailru/easyjson v0.7.7 // indirect
@@ -63,15 +65,17 @@ require (
6365
go.uber.org/zap v1.24.0 // indirect
6466
golang.org/x/net v0.10.0 // indirect
6567
golang.org/x/oauth2 v0.4.0 // indirect
68+
golang.org/x/sync v0.2.0 // indirect
6669
golang.org/x/sys v0.8.0 // indirect
6770
golang.org/x/term v0.8.0 // indirect
6871
golang.org/x/text v0.9.0 // indirect
6972
golang.org/x/time v0.3.0 // indirect
7073
golang.org/x/tools v0.9.1 // indirect
7174
gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
7275
google.golang.org/appengine v1.6.7 // indirect
73-
google.golang.org/genproto v0.0.0-20220502173005-c8bf987b8c21 // indirect
76+
google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f // indirect
7477
gopkg.in/inf.v0 v0.9.1 // indirect
78+
gopkg.in/yaml.v2 v2.4.0 // indirect
7579
k8s.io/apiextensions-apiserver v0.26.1 // indirect
7680
k8s.io/component-base v0.26.1 // indirect
7781
k8s.io/klog/v2 v2.90.0 // indirect

0 commit comments

Comments
 (0)