Skip to content

HOSTEDCP-1285: Consume kas Pod port by name #3185

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
Nov 13, 2023
Merged

HOSTEDCP-1285: Consume kas Pod port by name #3185

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1176,7 +1176,7 @@ func (r *HostedControlPlaneReconciler) reconcileAPIServerService(ctx context.Con
p := kas.NewKubeAPIServerServiceParams(hcp)
apiServerService := manifests.KubeAPIServerService(hcp.Namespace)
if _, err := createOrUpdate(ctx, r.Client, apiServerService, func() error {
return kas.ReconcileService(apiServerService, serviceStrategy, p.OwnerReference, p.APIServerPort, p.APIServerListenPort, p.AllowedCIDRBlocks, util.IsPublicHCP(hcp), util.IsPrivateHCP(hcp))
return kas.ReconcileService(apiServerService, serviceStrategy, p.OwnerReference, p.APIServerPort, p.AllowedCIDRBlocks, util.IsPublicHCP(hcp), util.IsPrivateHCP(hcp))
}); err != nil {
return fmt.Errorf("failed to reconcile API server service: %w", err)
}
Expand Down Expand Up @@ -2393,7 +2393,7 @@ func (r *HostedControlPlaneReconciler) reconcileKubeAPIServer(ctx context.Contex

serviceMonitor := manifests.KASServiceMonitor(hcp.Namespace)
if result, err := createOrUpdate(ctx, r, serviceMonitor, func() error {
return kas.ReconcileServiceMonitor(serviceMonitor, int(p.APIServerPort), config.OwnerRefFrom(hcp), hcp.Spec.ClusterID, r.MetricsSet)
return kas.ReconcileServiceMonitor(serviceMonitor, config.OwnerRefFrom(hcp), hcp.Spec.ClusterID, r.MetricsSet)
}); err != nil {
return fmt.Errorf("failed to reconcile kas service monitor: %w", err)
} else {
Expand Down
3 changes: 2 additions & 1 deletion control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -216,6 +216,7 @@ func TestBuildOAuthVolumeTemplates(t *testing.T) {
func TestReconcileAPIServerService(t *testing.T) {
targetNamespace := "test"
apiPort := int32(1234)
kasPort := "client"
hostname := "test.example.com"
allowCIDR := []hyperv1.CIDRBlock{"1.2.3.4/24"}
allowCIDRString := []string{"1.2.3.4/24"}
Expand Down Expand Up @@ -248,7 +249,7 @@ func TestReconcileAPIServerService(t *testing.T) {
{
Protocol: corev1.ProtocolTCP,
Port: apiPort,
TargetPort: intstr.FromInt(int(apiPort)),
TargetPort: intstr.FromString(kasPort),
},
},
LoadBalancerSourceRanges: allowCIDRString,
Expand Down
22 changes: 9 additions & 13 deletions control-plane-operator/controllers/hostedcontrolplane/kas/params.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,11 +73,9 @@ type KubeAPIServerParams struct {

type KubeAPIServerServiceParams struct {
// APIServerPort is the port used for the SVC.
APIServerPort int
// APIServerListenPort is the port used for the TargetPort.
APIServerListenPort int
AllowedCIDRBlocks []string
OwnerReference *metav1.OwnerReference
APIServerPort int
AllowedCIDRBlocks []string
OwnerReference *metav1.OwnerReference
}

const (
Expand Down Expand Up @@ -123,7 +121,7 @@ func NewKubeAPIServerParams(ctx context.Context, hcp *hyperv1.HostedControlPlane

params.AdvertiseAddress = util.GetAdvertiseAddress(hcp, config.DefaultAdvertiseIPv4Address, config.DefaultAdvertiseIPv6Address)

params.APIServerPort = util.BindAPIPortWithDefault(hcp, config.DefaultAPIServerPort)
params.APIServerPort = util.BindAPIPortWithDefault(hcp)
if _, ok := hcp.Annotations[hyperv1.PortierisImageAnnotation]; ok {
params.Images.Portieris = hcp.Annotations[hyperv1.PortierisImageAnnotation]
}
Expand All @@ -146,7 +144,7 @@ func NewKubeAPIServerParams(ctx context.Context, hcp *hyperv1.HostedControlPlane
ProbeHandler: corev1.ProbeHandler{
HTTPGet: &corev1.HTTPGetAction{
Scheme: corev1.URISchemeHTTPS,
Port: intstr.FromInt(int(params.APIServerPort)),
Port: intstr.FromString("client"),
Path: "livez?exclude=etcd",
},
},
Expand Down Expand Up @@ -261,7 +259,7 @@ func NewKubeAPIServerParams(ctx context.Context, hcp *hyperv1.HostedControlPlane
ProbeHandler: corev1.ProbeHandler{
HTTPGet: &corev1.HTTPGetAction{
Scheme: corev1.URISchemeHTTPS,
Port: intstr.FromInt(int(params.APIServerPort)),
Port: intstr.FromString("client"),
Path: "readyz",
},
},
Expand Down Expand Up @@ -532,16 +530,14 @@ func (p *KubeAPIServerParams) ServiceNodePortRange() string {
}

func NewKubeAPIServerServiceParams(hcp *hyperv1.HostedControlPlane) *KubeAPIServerServiceParams {
listenPort := util.BindAPIPortWithDefault(hcp, config.DefaultAPIServerPort)
port := util.InternalAPIPortWithDefault(hcp, config.DefaultAPIServerPort)
var allowedCIDRBlocks []string
for _, block := range util.AllowedCIDRBlocks(hcp) {
allowedCIDRBlocks = append(allowedCIDRBlocks, string(block))
}
return &KubeAPIServerServiceParams{
APIServerPort: int(port),
APIServerListenPort: int(listenPort),
AllowedCIDRBlocks: allowedCIDRBlocks,
OwnerReference: config.ControllerOwnerRef(hcp),
APIServerPort: int(port),
AllowedCIDRBlocks: allowedCIDRBlocks,
OwnerReference: config.ControllerOwnerRef(hcp),
}
}
7 changes: 3 additions & 4 deletions control-plane-operator/controllers/hostedcontrolplane/kas/service.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ import (
"github.com/openshift/hypershift/support/util"
)

func ReconcileService(svc *corev1.Service, strategy *hyperv1.ServicePublishingStrategy, owner *metav1.OwnerReference, apiServerServicePort int, apiServerListenPort int, apiAllowedCIDRBlocks []string, isPublic, isPrivate bool) error {
func ReconcileService(svc *corev1.Service, strategy *hyperv1.ServicePublishingStrategy, owner *metav1.OwnerReference, apiServerServicePort int, apiAllowedCIDRBlocks []string, isPublic, isPrivate bool) error {
util.EnsureOwnerRef(svc, owner)
if svc.Spec.Selector == nil {
svc.Spec.Selector = kasLabels()
Expand All @@ -40,7 +40,7 @@ func ReconcileService(svc *corev1.Service, strategy *hyperv1.ServicePublishingSt
}
portSpec.Port = int32(apiServerServicePort)
portSpec.Protocol = corev1.ProtocolTCP
portSpec.TargetPort = intstr.FromInt(apiServerListenPort)
portSpec.TargetPort = intstr.FromString("client")
if svc.Annotations == nil {
svc.Annotations = map[string]string{}
}
Expand Down Expand Up @@ -117,7 +117,6 @@ func ReconcileServiceStatus(svc *corev1.Service, strategy *hyperv1.ServicePublis

func ReconcilePrivateService(svc *corev1.Service, hcp *hyperv1.HostedControlPlane, owner *metav1.OwnerReference) error {
apiServerPort := util.InternalAPIPortWithDefault(hcp, config.DefaultAPIServerPort)
apiServerListenPort := util.BindAPIPortWithDefault(hcp, config.DefaultAPIServerPort)
util.EnsureOwnerRef(svc, owner)
svc.Spec.Selector = kasLabels()
var portSpec corev1.ServicePort
Expand All @@ -128,7 +127,7 @@ func ReconcilePrivateService(svc *corev1.Service, hcp *hyperv1.HostedControlPlan
}
portSpec.Port = int32(apiServerPort)
portSpec.Protocol = corev1.ProtocolTCP
portSpec.TargetPort = intstr.FromInt(int(apiServerListenPort))
portSpec.TargetPort = intstr.FromString("client")
svc.Spec.Type = corev1.ServiceTypeLoadBalancer
if svc.Annotations == nil {
svc.Annotations = map[string]string{}
Expand Down
4 changes: 2 additions & 2 deletions control-plane-operator/controllers/hostedcontrolplane/kas/servicemonitor.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,14 +15,14 @@ import (
"k8s.io/apimachinery/pkg/util/yaml"
)

func ReconcileServiceMonitor(sm *prometheusoperatorv1.ServiceMonitor, apiServerPort int, ownerRef config.OwnerRef, clusterID string, metricsSet metrics.MetricsSet) error {
func ReconcileServiceMonitor(sm *prometheusoperatorv1.ServiceMonitor, ownerRef config.OwnerRef, clusterID string, metricsSet metrics.MetricsSet) error {
ownerRef.ApplyTo(sm)

sm.Spec.Selector.MatchLabels = kasLabels()
sm.Spec.NamespaceSelector = prometheusoperatorv1.NamespaceSelector{
MatchNames: []string{sm.Namespace},
}
targetPort := intstr.FromInt(apiServerPort)
targetPort := intstr.FromString("client")
sm.Spec.Endpoints = []prometheusoperatorv1.Endpoint{
{
TargetPort: &targetPort,
Expand Down
4 changes: 2 additions & 2 deletions support/util/networking.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,15 +61,15 @@ func APIPort(hcp *hyperv1.HostedControlPlane) *int32 {

// BindAPIPortWithDefault will retrieve the port the kube-apiserver binds on locally in the pod.
// This comes from hcp.Spec.Networking.APIServer.Port if set and != 443
func BindAPIPortWithDefault(hcp *hyperv1.HostedControlPlane, defaultValue int32) int32 {
func BindAPIPortWithDefault(hcp *hyperv1.HostedControlPlane) int32 {
// Binding on 443 is not allowed. So returning default for that case.
// This provides backward compatibility for existing clusters which were defaulting to that value, ignoring it here and
// enforcing it in the data plane proxy by reconciling the endpoint. 443 API input is not allowed now.
// https://github.com/openshift/hypershift/pull/2964
if hcp.Spec.Networking.APIServer != nil && hcp.Spec.Networking.APIServer.Port != nil && *hcp.Spec.Networking.APIServer.Port != 443 {
return *hcp.Spec.Networking.APIServer.Port
}
return defaultValue
return 6443
}

// BindAPIPortWithDefaultFromHostedCluster will retrieve the port the kube-apiserver binds on locally in the pod.
Expand Down