Closed wondywang closed 1 year ago
This is looking great so far, this doesn’t do the TokenManagement aspects but I see your note that this can come later.
@wondywang.
@wondywang.
- Please fix lint/test failures.
- Please add UTs for the change.
- Please add a feature gate to guard your change entirely.
Ok, I will do it. If adding a new gate, I will prefer separate out a new file. I actually thought about doing that.
@Fei-Guo @christopherhein
PTAL, thanks.
LGTM. @christopherhein, take another look?
Overall looks great, @Fei-Guo & @ravisantoshgudimetla added the same feedback I would. Thank you @wondywang for taking the lead on this.
Overall looks great, @Fei-Guo & @ravisantoshgudimetla added the same feedback I would. Thank you @wondywang for taking the lead on this.
@christopherhein @ravisantoshgudimetla That's great, thanks! I will make some change later.
@wondywang - go-imports are failing. Can you fix and push the commit. LGTM from code standpoint.
@wondywang - go-imports are failing. Can you fix and push the commit. LGTM from code standpoint.
Sorry, I've been a little busy lately. I will get it done as soon as possible. @ravisantoshgudimetla
@Fei-Guo @christopherhein PTAL.
And I also update serviceAccount token manager in this commit. This part of the logic is an idea of mine (maybe not complete). Can be used as a reference. I plan not to mention PR for now. Wait for @ravisantoshgudimetla to finish it. What do you think?
/lgtm /approve
[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: Fei-Guo, wondywang
The full list of commands accepted by this bot can be found here.
The pull request process is described here
What this PR does / why we need it: This PR continue to improve the feature gated support for VirtualCluster to work with any Kubernetes version 1.21+ and when the RootCACertConfigMap feature is enabled in 1.20 clusters. To achieve this, before creating the pPod, the content in the kube-api-access volume is changed. Change it to directly mount the tenant cluster secret instead of applying the token of the super cluster.
Before:
After:
Here is the reference to the implementation in the Kubernetes: https://github.com/kubernetes/kubernetes/blob/master/plugin/pkg/admission/serviceaccount/admission.go
Follow-up needs to be considered: After Kubernetes version 1.24+, KCM will no longer distribute ServiceAccount tokens. I plan to add a token manager in the ServiceAccount sync controller to create ServiceAccount tokens and keep them in the validity period.
Which issue(s) this PR fixes:
282
/kind feature