[WIP] V2 low-level operator implementation #626

EronWright · 2024-08-08T20:25:34Z

Proposed changes

This PR implements the auto.pulumi.com API Group, including the Workspace and Update types.

Integration tests for the workspace controller are included.

Example

apiVersion: auto.pulumi.com/v1alpha1
kind: Workspace
metadata:
  name: random-yaml-1e2fc47
spec:
  image: pulumi/pulumi:3.128.0-nonroot
  securityProfile: restricted  
  serviceAccountName: default
  git:
    url: https://github.com/pulumi/examples.git
    revision: 1e2fc471709448f3c9f7a250f28f1eafcde7017b
    dir: random-yaml
  env:
  - name: PULUMI_ACCESS_TOKEN
    valueFrom:
      secretKeyRef:
        name: pulumi-api-secret
        key: accessToken
  resources:
    requests:
      cpu: 1
      memory: 512Mi
    limits:
      cpu: 1
      memory: 512Mi

  # various extension points shown here.
  # - custom pod labels
  # - pod tolerations
  # - extra init container(s)
  # - extra volume(s) and volume mounts onto the 'pulumi' container
  podTemplate:
    metadata:
      labels:
        example.com/mylabel: bar
    spec:
      terminationGracePeriodSeconds: 3600
      tolerations:
        - key: "example.com/foo"
          operator: "Exists"
          effect: "NoSchedule"
      initContainers:
      - name: extra
        image: busybox
        command: ["sh", "-c", "echo 'Hello, extra init container!'"]
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            add:
            - NET_BIND_SERVICE
            drop:
            - ALL
        volumeMounts:
          - name: share
            mountPath: /share
      containers:
      - name: pulumi
        volumeMounts:
          - name: secret-volume
            mountPath: /etc/secret-volume
            readOnly: true
      volumes:
        - name: secret-volume
          secret:
            secretName: test-secret

Specific Changes

(agent) git source support
(operator) scaffolding
(operator) workspace api and controller and tests
(operator) update api and controller
(experimental) configuration block in Environment spec
(experimental) dockerfile for non-root pu/pu

Related issues (optional)

Closes #619

codecov · 2024-08-08T20:33:30Z

Codecov Report

Attention: Patch coverage is 22.15517% with 903 lines in your changes missing coverage. Please review.

Please upload report for BASE (v2@5b5d8a7). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
operator/internal/controller/update_controller.go	0.00%	318 Missing ⚠️
operator/api/v1alpha1/zz_generated.deepcopy.go	0.00%	241 Missing ⚠️
...erator/internal/controller/workspace_controller.go	66.40%	117 Missing and 11 partials ⚠️
operator/cmd/main.go	0.00%	72 Missing ⚠️
operator/test/utils/utils.go	0.00%	62 Missing ⚠️
agent/cmd/init.go	0.00%	40 Missing ⚠️
operator/internal/controller/utils.go	0.00%	38 Missing ⚠️
agent/cmd/serve.go	0.00%	3 Missing ⚠️
agent/cmd/root.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@          Coverage Diff          @@
##             v2     #626   +/-   ##
=====================================
  Coverage      ?   18.98%           
=====================================
  Files         ?       16           
  Lines         ?     3123           
  Branches      ?        0           
=====================================
  Hits          ?      593           
  Misses        ?     2438           
  Partials      ?       92

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

operator/test/utils/utils.go

operator/.DS_Store

agent/cmd/serve.go

operator/api/v1alpha1/update_types.go

blampe

Nothing blocking!

blampe · 2024-08-30T15:43:04Z

operator/.golangci.yml

+      linters:
+        - dupl
+        - lll
+linters:


Can we keep this consistent with the linter's we're using in p-k?

blampe · 2024-08-30T15:46:21Z

agent/cmd/init.go

+			}
+			// Configure authentication strategy to access the source
+			authData := map[string][]byte{}
+			authOpts, err := git.NewAuthOptions(*u, authData)


So does this just support simple user:password auth?

I intend to support the same options, but I was waiting to see how containerization would impact the options. e.g., the ability to mount the git credentials.

blampe · 2024-08-30T15:49:24Z

operator/Dockerfile

+# Build
+# the GOARCH has not a default value to allow the binary be built according to the host where the command
+# was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO
+# the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
+# by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
+RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager cmd/main.go


I'm guessing this is boilerplate? It's a little odd.

Yes it is entirely boilerplate from kubebuilder v.latest.

blampe · 2024-08-30T15:53:16Z

operator/cmd/main.go

+	// if the enable-http2 flag is false (the default), http/2 should be disabled
+	// due to its vulnerabilities. More specifically, disabling http/2 will
+	// prevent from being vulnerable to the HTTP/2 Stream Cancelation and
+	// Rapid Reset CVEs. For more information see:
+	// - https://github.com/advisories/GHSA-qppj-fm5r-hxr3
+	// - https://github.com/advisories/GHSA-4374-p667-p6c8
+	disableHTTP2 := func(c *tls.Config) {
+		setupLog.Info("disabling http/2")
+		c.NextProtos = []string{"http/1.1"}
+	}


This isn't needed anymore - we're using unaffected versions of x/net and grpc.

blampe · 2024-08-30T15:53:43Z

operator/cmd/main.go

+		WebhookServer:          webhookServer,
+		HealthProbeBindAddress: probeAddr,
+		LeaderElection:         enableLeaderElection,
+		LeaderElectionID:       "30fa952a.pulumi.com",


Suggested change

LeaderElectionID: "30fa952a.pulumi.com",

LeaderElectionID: "operator.pulumi.com",

EronWright added 2 commits August 8, 2024 13:19

agent - skip install for yaml programs

465e0f8

operator implememtation

a5c65bc

EronWright changed the title ~~V2 low-level operator implementation~~ [WIP] V2 low-level operator implementation Aug 8, 2024

EronWright added 6 commits August 8, 2024 15:23

force annotation

bf6aa82

examples

bb3a679

agent: git support

68ba18e

workspace git support

9917a4f

example

8042b2e

workspace pod template

b9498ee

mjeffryes assigned EronWright Aug 9, 2024

nonroot support

c2a196b

EronWright added the impact/no-changelog-required This issue doesn't require a CHANGELOG update label Aug 12, 2024

EronWright mentioned this pull request Aug 12, 2024

Automation API for Kubernetes #612

Closed

mjeffryes added this to the 0.108 milestone Aug 16, 2024

mikhailshilkov removed this from the 0.108 milestone Aug 22, 2024

integration test for workspace controller

ac1cdc8

EronWright marked this pull request as ready for review August 23, 2024 00:07

CI tests

8a43deb

EronWright requested review from blampe and rquitales August 23, 2024 01:03

EronWright added 3 commits August 22, 2024 18:08

remove dead code

f67afb4

test

9f088e6

update controller

c78d341

rquitales reviewed Aug 23, 2024

View reviewed changes

operator/test/utils/utils.go Show resolved Hide resolved

operator/.DS_Store Outdated Show resolved Hide resolved

agent/cmd/serve.go Outdated Show resolved Hide resolved

operator/api/v1alpha1/update_types.go Show resolved Hide resolved

workspace-level configuration

8894da6

EronWright requested a review from rquitales August 26, 2024 21:32

EronWright added 2 commits August 26, 2024 14:34

feedback

6978518

test fix

7108b3e

blampe approved these changes Aug 30, 2024

View reviewed changes

EronWright merged commit a21e0e4 into v2 Sep 6, 2024
6 checks passed

EronWright deleted the v2-operator branch September 6, 2024 18:12

EronWright restored the v2-operator branch September 6, 2024 18:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[WIP] V2 low-level operator implementation #626

[WIP] V2 low-level operator implementation #626

EronWright commented Aug 8, 2024 •

edited

Loading

codecov bot commented Aug 8, 2024 •

edited

Loading

blampe left a comment

blampe Aug 30, 2024

blampe Aug 30, 2024

EronWright Aug 30, 2024

blampe Aug 30, 2024

EronWright Aug 30, 2024

blampe Aug 30, 2024

blampe Aug 30, 2024

	LeaderElectionID: "30fa952a.pulumi.com",
	LeaderElectionID: "operator.pulumi.com",

[WIP] V2 low-level operator implementation #626

[WIP] V2 low-level operator implementation #626

Conversation

EronWright commented Aug 8, 2024 • edited Loading

Proposed changes

Example

Specific Changes

Related issues (optional)

codecov bot commented Aug 8, 2024 • edited Loading

Codecov Report

blampe left a comment

Choose a reason for hiding this comment

blampe Aug 30, 2024

Choose a reason for hiding this comment

blampe Aug 30, 2024

Choose a reason for hiding this comment

EronWright Aug 30, 2024

Choose a reason for hiding this comment

blampe Aug 30, 2024

Choose a reason for hiding this comment

EronWright Aug 30, 2024

Choose a reason for hiding this comment

blampe Aug 30, 2024

Choose a reason for hiding this comment

blampe Aug 30, 2024

Choose a reason for hiding this comment

EronWright commented Aug 8, 2024 •

edited

Loading

codecov bot commented Aug 8, 2024 •

edited

Loading