From ffdaa9dfe9ba02852ba9782d1a0db84374637e63 Mon Sep 17 00:00:00 2001 From: Stefan Prodan Date: Sun, 29 Nov 2020 13:59:40 +0200 Subject: [PATCH 1/2] Fix tenant service account binding Signed-off-by: Stefan Prodan --- cmd/flux/create_tenant.go | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/cmd/flux/create_tenant.go b/cmd/flux/create_tenant.go index ee8dde41..185b45a0 100644 --- a/cmd/flux/create_tenant.go +++ b/cmd/flux/create_tenant.go @@ -55,8 +55,7 @@ reconcilers scope to the tenant namespaces.`, } const ( - tenantLabel = "toolkit.fluxcd.io/tenant" - tenantRoleBinding = "gotk-reconciler" + tenantLabel = "toolkit.fluxcd.io/tenant" ) var ( @@ -123,18 +122,20 @@ func createTenantCmdRun(cmd *cobra.Command, args []string) error { roleBinding := rbacv1.RoleBinding{ ObjectMeta: metav1.ObjectMeta{ - Name: tenantRoleBinding, + Name: fmt.Sprintf("%s-reconciler", tenant), Namespace: ns, Labels: objLabels, }, Subjects: []rbacv1.Subject{ { - Kind: "User", - Name: fmt.Sprintf("gotk:%s:reconciler", ns), + APIGroup: "rbac.authorization.k8s.io", + Kind: "User", + Name: fmt.Sprintf("gotk:%s:reconciler", ns), }, { - Kind: "ServiceAccount", - Name: tenant, + Kind: "ServiceAccount", + Name: tenant, + Namespace: ns, }, }, RoleRef: rbacv1.RoleRef{ @@ -290,7 +291,7 @@ func exportTenant(namespace corev1.Namespace, account corev1.ServiceAccount, rol fmt.Println(resourceToString(data)) account.TypeMeta = metav1.TypeMeta{ - APIVersion: "", + APIVersion: "v1", Kind: "ServiceAccount", } data, err = yaml.Marshal(account) From c813eaf6d1227d3039c02df3d8ff4fd06b157dcb Mon Sep 17 00:00:00 2001 From: Stefan Prodan Date: Sun, 29 Nov 2020 14:11:08 +0200 Subject: [PATCH 2/2] Do not try to reconcile a suspended object Signed-off-by: Stefan Prodan --- cmd/flux/reconcile_alert.go | 7 ++++++- cmd/flux/reconcile_helmrelease.go | 4 ++++ cmd/flux/reconcile_kustomization.go | 4 ++++ cmd/flux/reconcile_receiver.go | 6 +++++- cmd/flux/reconcile_source_bucket.go | 4 ++++ cmd/flux/reconcile_source_git.go | 4 ++++ cmd/flux/reconcile_source_helm.go | 4 ++++ 7 files changed, 31 insertions(+), 2 deletions(-) diff --git a/cmd/flux/reconcile_alert.go b/cmd/flux/reconcile_alert.go index 71b52867..d5acf204 100644 --- a/cmd/flux/reconcile_alert.go +++ b/cmd/flux/reconcile_alert.go @@ -64,13 +64,17 @@ func reconcileAlertCmdRun(cmd *cobra.Command, args []string) error { Name: name, } - logger.Actionf("annotating Alert %s in %s namespace", name, namespace) var alert notificationv1.Alert err = kubeClient.Get(ctx, namespacedName, &alert) if err != nil { return err } + if alert.Spec.Suspend { + return fmt.Errorf("resource is suspended") + } + + logger.Actionf("annotating Alert %s in %s namespace", name, namespace) if alert.Annotations == nil { alert.Annotations = map[string]string{ meta.ReconcileAtAnnotation: time.Now().Format(time.RFC3339Nano), @@ -78,6 +82,7 @@ func reconcileAlertCmdRun(cmd *cobra.Command, args []string) error { } else { alert.Annotations[meta.ReconcileAtAnnotation] = time.Now().Format(time.RFC3339Nano) } + if err := kubeClient.Update(ctx, &alert); err != nil { return err } diff --git a/cmd/flux/reconcile_helmrelease.go b/cmd/flux/reconcile_helmrelease.go index 9cde19de..80c8c575 100644 --- a/cmd/flux/reconcile_helmrelease.go +++ b/cmd/flux/reconcile_helmrelease.go @@ -86,6 +86,10 @@ func reconcileHrCmdRun(cmd *cobra.Command, args []string) error { return err } + if helmRelease.Spec.Suspend { + return fmt.Errorf("resource is suspended") + } + if syncHrWithSource { switch helmRelease.Spec.Chart.Spec.SourceRef.Kind { case sourcev1.HelmRepositoryKind: diff --git a/cmd/flux/reconcile_kustomization.go b/cmd/flux/reconcile_kustomization.go index 800d939f..109096a3 100644 --- a/cmd/flux/reconcile_kustomization.go +++ b/cmd/flux/reconcile_kustomization.go @@ -84,6 +84,10 @@ func reconcileKsCmdRun(cmd *cobra.Command, args []string) error { return err } + if kustomization.Spec.Suspend { + return fmt.Errorf("resource is suspended") + } + if syncKsWithSource { switch kustomization.Spec.SourceRef.Kind { case sourcev1.GitRepositoryKind: diff --git a/cmd/flux/reconcile_receiver.go b/cmd/flux/reconcile_receiver.go index 16ce2e55..f89da3dc 100644 --- a/cmd/flux/reconcile_receiver.go +++ b/cmd/flux/reconcile_receiver.go @@ -64,13 +64,17 @@ func reconcileReceiverCmdRun(cmd *cobra.Command, args []string) error { Name: name, } - logger.Actionf("annotating Receiver %s in %s namespace", name, namespace) var receiver notificationv1.Receiver err = kubeClient.Get(ctx, namespacedName, &receiver) if err != nil { return err } + if receiver.Spec.Suspend { + return fmt.Errorf("resource is suspended") + } + + logger.Actionf("annotating Receiver %s in %s namespace", name, namespace) if receiver.Annotations == nil { receiver.Annotations = map[string]string{ meta.ReconcileAtAnnotation: time.Now().Format(time.RFC3339Nano), diff --git a/cmd/flux/reconcile_source_bucket.go b/cmd/flux/reconcile_source_bucket.go index f9520507..2c20598e 100644 --- a/cmd/flux/reconcile_source_bucket.go +++ b/cmd/flux/reconcile_source_bucket.go @@ -74,6 +74,10 @@ func reconcileSourceBucketCmdRun(cmd *cobra.Command, args []string) error { return err } + if bucket.Spec.Suspend { + return fmt.Errorf("resource is suspended") + } + lastHandledReconcileAt := bucket.Status.LastHandledReconcileAt logger.Actionf("annotating Bucket source %s in %s namespace", name, namespace) if err := requestBucketReconciliation(ctx, kubeClient, namespacedName, &bucket); err != nil { diff --git a/cmd/flux/reconcile_source_git.go b/cmd/flux/reconcile_source_git.go index cb95abbc..d6dfcd8e 100644 --- a/cmd/flux/reconcile_source_git.go +++ b/cmd/flux/reconcile_source_git.go @@ -72,6 +72,10 @@ func reconcileSourceGitCmdRun(cmd *cobra.Command, args []string) error { return err } + if repository.Spec.Suspend { + return fmt.Errorf("resource is suspended") + } + logger.Actionf("annotating GitRepository source %s in %s namespace", name, namespace) if err := requestGitRepositoryReconciliation(ctx, kubeClient, namespacedName, &repository); err != nil { return err diff --git a/cmd/flux/reconcile_source_helm.go b/cmd/flux/reconcile_source_helm.go index 076fcf08..782afcba 100644 --- a/cmd/flux/reconcile_source_helm.go +++ b/cmd/flux/reconcile_source_helm.go @@ -73,6 +73,10 @@ func reconcileSourceHelmCmdRun(cmd *cobra.Command, args []string) error { return err } + if repository.Spec.Suspend { + return fmt.Errorf("resource is suspended") + } + logger.Actionf("annotating HelmRepository source %s in %s namespace", name, namespace) if err := requestHelmRepositoryReconciliation(ctx, kubeClient, namespacedName, &repository); err != nil { return err