Move admission CA reconciliation into ground controller (#1011)

Author: Nuckal777

pkg/controller/ground.go

@@ -55,6 +55,7 @@ const (
 
 	UpgradeEnableAnnotation = "kubernikus.cloud.sap/upgrade"
 	SeedReconcileLabelKey   = "kubernikus.cloud.sap/seed-reconcile"
+	InjectAdmissionCAKey    = "kubernikus.cloud.sap/inject-admission-ca"
 )
 
 type GroundControl struct {
@@ -330,6 +331,9 @@ func (op *GroundControl) handler(key string) error {
 			if err := op.ensureStorageContainers(kluster, klusterSecret); err != nil {
 				return err
 			}
+			if err := op.ensureAdmissionCA(kluster, klusterSecret); err != nil {
+				return err
+			}
 
 			accessMode, err := util.PVAccessMode(op.Clients.Kubernetes, nil)
 			if err != nil {
@@ -1141,6 +1145,48 @@ func (op *GroundControl) ensureStorageContainers(kluster *v1.Kluster, klusterSec
 	return nil
 }
 
+// inject admission CA in labeled namespaces
+func (op *GroundControl) ensureAdmissionCA(kluster *v1.Kluster, klusterSecret *v1.Secret) error {
+	k8sClient, err := op.Clients.Satellites.ClientFor(kluster)
+	if err != nil {
+		return err
+	}
+	nsList, err := k8sClient.CoreV1().Namespaces().List(context.TODO(), meta_v1.ListOptions{LabelSelector: fmt.Sprintf("%s=true", InjectAdmissionCAKey)})
+	if err != nil {
+		return err
+	}
+	if nsList.Size() == 0 {
+		return nil
+	}
+	ca := map[string]string{"ca.crt": klusterSecret.Certificates.AdmissionCACertificate}
+	cm := api_v1.ConfigMap{
+		TypeMeta: meta_v1.TypeMeta{
+			Kind:       "ConfigMap",
+			APIVersion: "v1",
+		},
+		ObjectMeta: meta_v1.ObjectMeta{
+			Name: "admission-auth-ca",
+		},
+		Data: ca,
+	}
+	for _, ns := range nsList.Items {
+		_, err = k8sClient.CoreV1().ConfigMaps(ns.Name).Create(context.TODO(), &cm, meta_v1.CreateOptions{})
+		if apierrors.IsAlreadyExists(err) {
+			_, err = k8sClient.CoreV1().ConfigMaps(ns.Name).Update(context.TODO(), &cm, meta_v1.UpdateOptions{})
+		}
+		if err != nil {
+			return fmt.Errorf("Admission CA certificate reconciliation in namespace %s failed: %s", ns.Name, err)
+		}
+		op.Logger.Log(
+			"msg", "Reconciled admission CA certificate",
+			"namespace", ns.Name,
+			"kluster", kluster.GetName(),
+			"project", kluster.Account(),
+			"v", 6)
+	}
+	return nil
+}
+
 func (op *GroundControl) podAdd(obj interface{}) {
 	pod := obj.(*api_v1.Pod)
 

pkg/controller/ground/reconciler.go

@@ -14,7 +14,6 @@ import (
 	"helm.sh/helm/v3/pkg/chartutil"
 	"helm.sh/helm/v3/pkg/engine"
 	"helm.sh/helm/v3/pkg/releaseutil"
-	corev1 "k8s.io/api/core/v1"
 	extensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
@@ -33,7 +32,6 @@ import (
 	v1 "github.com/sapcc/kubernikus/pkg/apis/kubernikus/v1"
 	"github.com/sapcc/kubernikus/pkg/client/openstack/project"
 	"github.com/sapcc/kubernikus/pkg/controller/config"
-	"github.com/sapcc/kubernikus/pkg/util"
 )
 
 const SeedChartPath string = "charts/seed"
@@ -42,7 +40,6 @@ const ManagedByLabelKey string = "cloud.sap/managed-by"
 const ManagedByLabelValue string = "kubernikus"
 const SkipPatchKey string = "kubernikus.cloud.sap/skip-manage"
 const SkipPatchValue string = "true"
-const InjectAdmissionCAKey string = "kubernikus.cloud.sap/inject-admission-ca"
 
 var recreateKinds map[string]struct{} = map[string]struct{}{
 	"RoleBinding":        {},
@@ -210,48 +207,6 @@ func (sr *SeedReconciler) ReconcileSeeding(chartPath string, values map[string]i
 		return err
 	}
 
-	// inject admission CA in labeled namespaces
-	k8sClient, err := sr.Clients.Satellites.ClientFor(sr.Kluster)
-	if err != nil {
-		return err
-	}
-	nsList, err := k8sClient.CoreV1().Namespaces().List(context.TODO(), metav1.ListOptions{LabelSelector: fmt.Sprintf("%s=true", InjectAdmissionCAKey)})
-	if err != nil {
-		return err
-	}
-	if nsList.Size() > 0 {
-		secret, err := util.KlusterSecret(sr.Clients.Kubernetes, sr.Kluster)
-		if err != nil {
-			return fmt.Errorf("Couldn't get kluster secret: %s", err)
-		}
-		ca := map[string]string{"ca.crt": secret.Certificates.AdmissionCACertificate}
-		cm := corev1.ConfigMap{
-			TypeMeta: metav1.TypeMeta{
-				Kind:       "ConfigMap",
-				APIVersion: "v1",
-			},
-			ObjectMeta: metav1.ObjectMeta{
-				Name: "admission-auth-ca",
-			},
-			Data: ca,
-		}
-		for _, ns := range nsList.Items {
-			_, err = k8sClient.CoreV1().ConfigMaps(ns.Name).Create(context.TODO(), &cm, metav1.CreateOptions{})
-			if errors.IsAlreadyExists(err) {
-				_, err = k8sClient.CoreV1().ConfigMaps(ns.Name).Update(context.TODO(), &cm, metav1.UpdateOptions{})
-			}
-			if err != nil {
-				return fmt.Errorf("Admission CA certificate reconciliation in namespace %s failed: %s", ns.Name, err)
-			}
-			sr.Logger.Log(
-				"msg", "Reconciling admission CA certificate",
-				"namespace", ns.Name,
-				"kluster", sr.Kluster.GetName(),
-				"project", sr.Kluster.Account(),
-				"v", 6)
-		}
-	}
-
 	sr.Logger.Log(
 		"msg", "Seed reconciliation: successful",
 		"kluster", sr.Kluster.GetName(),