Skip to content

Commit 885756c

Browse files
kellyyankellyyan
authored
Merge pull request #1 from zac-nixon/znixon/kelly/auth
auth changes
2 parents 8d85071 + dbc8db9 commit 885756c

File tree

4 files changed

+88
-35
lines changed

4 files changed

+88
-35
lines changed

‎controllers/ingress/eventhandlers/ingress_class_params_events.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,8 +61,8 @@ func (h *enqueueRequestsForIngressClassParamsEvent) Delete(ctx context.Context,
6161
h.enqueueImpactedIngressClasses(ctx, ingClassParamsOld)
6262
}
6363

64-
func (h *enqueueRequestsForIngressClassParamsEvent) Generic(context.Context, event.TypedGenericEvent[*elbv2api.IngressClassParams], workqueue.TypedRateLimitingInterface[reconcile.Request]) {
65-
// we don't have any generic event for secrets.
64+
func (h *enqueueRequestsForIngressClassParamsEvent) Generic(ctx context.Context, e event.TypedGenericEvent[*elbv2api.IngressClassParams], _ workqueue.TypedRateLimitingInterface[reconcile.Request]) {
65+
h.enqueueImpactedIngressClasses(ctx, e.Object)
6666
}
6767

6868
func (h *enqueueRequestsForIngressClassParamsEvent) enqueueImpactedIngressClasses(ctx context.Context, ingClassParams *elbv2api.IngressClassParams) {

‎controllers/ingress/eventhandlers/secret_events.go

Lines changed: 29 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package eventhandlers
22

33
import (
44
"context"
5+
elbv2api "sigs.k8s.io/aws-load-balancer-controller/apis/elbv2/v1beta1"
56
"sigs.k8s.io/controller-runtime/pkg/reconcile"
67

78
"github.com/go-logr/logr"
@@ -18,11 +19,12 @@ import (
1819
)
1920

2021
// NewEnqueueRequestsForSecretEvent constructs new enqueueRequestsForSecretEvent.
21-
func NewEnqueueRequestsForSecretEvent(ingEventChan chan<- event.TypedGenericEvent[*networking.Ingress], svcEventChan chan<- event.TypedGenericEvent[*corev1.Service],
22+
func NewEnqueueRequestsForSecretEvent(ingEventChan chan<- event.TypedGenericEvent[*networking.Ingress], svcEventChan chan<- event.TypedGenericEvent[*corev1.Service], icpEventChan chan<- event.TypedGenericEvent[*elbv2api.IngressClassParams],
2223
k8sClient client.Client, eventRecorder record.EventRecorder, logger logr.Logger) handler.TypedEventHandler[*corev1.Secret, reconcile.Request] {
2324
return &enqueueRequestsForSecretEvent{
2425
ingEventChan: ingEventChan,
2526
svcEventChan: svcEventChan,
27+
icpEventChan: icpEventChan,
2628
k8sClient: k8sClient,
2729
eventRecorder: eventRecorder,
2830
logger: logger,
@@ -34,6 +36,7 @@ var _ handler.TypedEventHandler[*corev1.Secret, reconcile.Request] = (*enqueueRe
3436
type enqueueRequestsForSecretEvent struct {
3537
ingEventChan chan<- event.TypedGenericEvent[*networking.Ingress]
3638
svcEventChan chan<- event.TypedGenericEvent[*corev1.Service]
39+
icpEventChan chan<- event.TypedGenericEvent[*elbv2api.IngressClassParams]
3740
k8sClient client.Client
3841
eventRecorder record.EventRecorder
3942
logger logr.Logger
@@ -69,7 +72,7 @@ func (h *enqueueRequestsForSecretEvent) Generic(ctx context.Context, e event.Typ
6972
h.enqueueImpactedObjects(ctx, secretObj)
7073
}
7174

72-
func (h *enqueueRequestsForSecretEvent) enqueueImpactedObjects(ctx context.Context, secret *corev1.Secret) {
75+
func (h *enqueueRequestsForSecretEvent) enqueueImpactedObjects(_ context.Context, secret *corev1.Secret) {
7376
secretKey := k8s.NamespacedName(secret)
7477

7578
ingList := &networking.IngressList{}
@@ -79,6 +82,7 @@ func (h *enqueueRequestsForSecretEvent) enqueueImpactedObjects(ctx context.Conte
7982
h.logger.Error(err, "failed to fetch ingresses")
8083
return
8184
}
85+
8286
for index := range ingList.Items {
8387
ing := &ingList.Items[index]
8488

@@ -107,4 +111,27 @@ func (h *enqueueRequestsForSecretEvent) enqueueImpactedObjects(ctx context.Conte
107111
Object: svc,
108112
}
109113
}
114+
115+
if h.icpEventChan == nil {
116+
return
117+
}
118+
119+
ingressClassParamsList := &elbv2api.IngressClassParamsList{}
120+
if err := h.k8sClient.List(context.Background(), ingressClassParamsList,
121+
client.InNamespace(""),
122+
client.MatchingFields{ingress.IndexKeyIngressClassParamsSecretRefName: secret.GetName()}); err != nil {
123+
h.logger.Error(err, "failed to fetch ingress class params")
124+
return
125+
}
126+
127+
for index := range ingressClassParamsList.Items {
128+
icp := &ingressClassParamsList.Items[index]
129+
130+
h.logger.Info("enqueue ingress class for secret event",
131+
"secret", secretKey,
132+
"icp", k8s.NamespacedName(icp))
133+
h.icpEventChan <- event.TypedGenericEvent[*elbv2api.IngressClassParams]{
134+
Object: icp,
135+
}
136+
}
110137
}

‎controllers/ingress/group_controller.go

Lines changed: 43 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ package ingress
33
import (
44
"context"
55
"fmt"
6-
76
"github.com/go-logr/logr"
87
"github.com/pkg/errors"
98
corev1 "k8s.io/api/core/v1"
@@ -44,7 +43,10 @@ const (
4443
// the groupVersion of used Ingress & IngressClass resource.
4544
ingressResourcesGroupVersion = "networking.k8s.io/v1"
4645
ingressClassKind = "IngressClass"
47-
ingressClassParams = "IngressClassParams"
46+
47+
// the groupVersion of used by IngressClassParams resource.
48+
ingressClassParamsResourcesGroupVersion = "elbv2.k8s.aws/v1beta1"
49+
ingressClassParamsKind = "IngressClassParams"
4850
)
4951

5052
// NewGroupReconciler constructs new GroupReconciler
@@ -278,14 +280,20 @@ func (r *groupReconciler) SetupWithManager(ctx context.Context, mgr ctrl.Manager
278280
return err
279281
}
280282

281-
resList, err := clientSet.ServerResourcesForGroupVersion(ingressResourcesGroupVersion)
283+
ingressClassResourceList, err := clientSet.ServerResourcesForGroupVersion(ingressResourcesGroupVersion)
282284
if err != nil {
283285
return err
284286
}
285287

286-
ingressClassParamsAvailable := isResourceKindAvailable(resList, ingressClassParams)
287-
ingressClassResourceAvailable := isResourceKindAvailable(resList, ingressClassKind)
288-
if err := r.setupIndexes(ctx, mgr.GetFieldIndexer(), ingressClassParamsAvailable, ingressClassResourceAvailable); err != nil {
288+
ingressClassParamsResourceList, err := clientSet.ServerResourcesForGroupVersion(ingressClassParamsResourcesGroupVersion)
289+
if err != nil {
290+
return err
291+
}
292+
293+
ingressClassResourceAvailable := isResourceKindAvailable(ingressClassResourceList, ingressClassKind)
294+
295+
ingressClassParamsResourceAvailable := isResourceKindAvailable(ingressClassParamsResourceList, ingressClassParamsKind)
296+
if err := r.setupIndexes(ctx, mgr.GetFieldIndexer(), ingressClassResourceAvailable, ingressClassParamsResourceAvailable); err != nil {
289297
return err
290298
}
291299
if err := r.setupWatches(ctx, c, mgr, ingressClassResourceAvailable, clientSet); err != nil {
@@ -294,7 +302,7 @@ func (r *groupReconciler) SetupWithManager(ctx context.Context, mgr ctrl.Manager
294302
return nil
295303
}
296304

297-
func (r *groupReconciler) setupIndexes(ctx context.Context, fieldIndexer client.FieldIndexer, ingressClassParamsAvailable bool, ingressClassResourceAvailable bool) error {
305+
func (r *groupReconciler) setupIndexes(ctx context.Context, fieldIndexer client.FieldIndexer, ingressClassResourceAvailable bool, ingressClassParamsResourceAvailable bool) error {
298306
// Service indexes
299307
if err := fieldIndexer.IndexField(ctx, &networking.Ingress{}, ingress.IndexKeyServiceRefName,
300308
func(obj client.Object) []string {
@@ -304,21 +312,6 @@ func (r *groupReconciler) setupIndexes(ctx context.Context, fieldIndexer client.
304312
return err
305313
}
306314

307-
// Secret indexes
308-
if ingressClassParamsAvailable {
309-
if err := fieldIndexer.IndexField(ctx, &elbv2api.IngressClassParams{}, ingress.IndexKeySecretRefName,
310-
func(obj client.Object) []string {
311-
ingClassParamsObj := obj.(*elbv2api.IngressClassParams)
312-
if ingClassParamsObj.Spec.AuthConfig != nil && ingClassParamsObj.Spec.AuthConfig.IDPConfigOIDC != nil {
313-
return []string{ingClassParamsObj.Spec.AuthConfig.IDPConfigOIDC.SecretName}
314-
}
315-
return nil
316-
},
317-
); err != nil {
318-
return err
319-
}
320-
}
321-
322315
if err := fieldIndexer.IndexField(ctx, &networking.Ingress{}, ingress.IndexKeySecretRefName,
323316
func(obj client.Object) []string {
324317
return r.referenceIndexer.BuildSecretRefIndexes(context.Background(), &elbv2api.IngressClassParams{}, obj.(*networking.Ingress))
@@ -351,6 +344,16 @@ func (r *groupReconciler) setupIndexes(ctx context.Context, fieldIndexer client.
351344
return err
352345
}
353346
}
347+
348+
if ingressClassParamsResourceAvailable {
349+
if err := fieldIndexer.IndexField(ctx, &elbv2api.IngressClassParams{}, ingress.IndexKeyIngressClassParamsSecretRefName,
350+
func(obj client.Object) []string {
351+
return r.referenceIndexer.BuildIngressClassParamsSecretIndexes(context.Background(), obj.(*elbv2api.IngressClassParams))
352+
},
353+
); err != nil {
354+
return err
355+
}
356+
}
354357
return nil
355358
}
356359

@@ -362,8 +365,7 @@ func (r *groupReconciler) setupWatches(_ context.Context, c controller.Controlle
362365
r.logger.WithName("eventHandlers").WithName("ingress"))
363366
svcEventHandler := eventhandlers.NewEnqueueRequestsForServiceEvent(ingEventChan, r.k8sClient, r.eventRecorder,
364367
r.logger.WithName("eventHandlers").WithName("service"))
365-
secretEventHandler := eventhandlers.NewEnqueueRequestsForSecretEvent(ingEventChan, svcEventChan, r.k8sClient, r.eventRecorder,
366-
r.logger.WithName("eventHandlers").WithName("secret"))
368+
367369
if err := c.Watch(source.Channel(ingEventChan, ingEventHandler)); err != nil {
368370
return err
369371
}
@@ -376,15 +378,11 @@ func (r *groupReconciler) setupWatches(_ context.Context, c controller.Controlle
376378
if err := c.Watch(source.Kind(mgr.GetCache(), &corev1.Service{}, svcEventHandler)); err != nil {
377379
return err
378380
}
379-
// Add this watch for Secrets
380-
if err := c.Watch(source.Kind(mgr.GetCache(), &corev1.Secret{}, secretEventHandler)); err != nil {
381-
return err
382-
}
383-
if err := c.Watch(source.Channel(secretEventsChan, secretEventHandler)); err != nil {
384-
return err
385-
}
381+
382+
var ingressClassParamsEventChan chan event.TypedGenericEvent[*elbv2api.IngressClassParams]
386383
if ingressClassResourceAvailable {
387384
ingClassEventChan := make(chan event.TypedGenericEvent[*networking.IngressClass])
385+
ingressClassParamsEventChan = make(chan event.TypedGenericEvent[*elbv2api.IngressClassParams])
388386
ingClassParamsEventHandler := eventhandlers.NewEnqueueRequestsForIngressClassParamsEvent(ingClassEventChan, r.k8sClient, r.eventRecorder,
389387
r.logger.WithName("eventHandlers").WithName("ingressClassParams"))
390388
ingClassEventHandler := eventhandlers.NewEnqueueRequestsForIngressClassEvent(ingEventChan, r.k8sClient, r.eventRecorder,
@@ -398,7 +396,21 @@ func (r *groupReconciler) setupWatches(_ context.Context, c controller.Controlle
398396
if err := c.Watch(source.Kind(mgr.GetCache(), &networking.IngressClass{}, ingClassEventHandler)); err != nil {
399397
return err
400398
}
399+
if err := c.Watch(source.Channel(ingressClassParamsEventChan, ingClassParamsEventHandler)); err != nil {
400+
return err
401+
}
401402
}
403+
404+
secretEventHandler := eventhandlers.NewEnqueueRequestsForSecretEvent(ingEventChan, svcEventChan, ingressClassParamsEventChan, r.k8sClient, r.eventRecorder,
405+
r.logger.WithName("eventHandlers").WithName("secret"))
406+
// Add this watch for Secrets
407+
if err := c.Watch(source.Kind(mgr.GetCache(), &corev1.Secret{}, secretEventHandler)); err != nil {
408+
return err
409+
}
410+
if err := c.Watch(source.Channel(secretEventsChan, secretEventHandler)); err != nil {
411+
return err
412+
}
413+
402414
r.secretsManager = k8s.NewSecretsManager(clientSet, secretEventsChan, ctrl.Log.WithName("secrets-manager"))
403415
return nil
404416
}

‎pkg/ingress/reference_indexer.go

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ const (
2020
IndexKeyIngressClassRefName = "ingress.ingressClassRef.name"
2121
// IndexKeyIngressClassParamsRefName is index key for ingressClassParams referenced by IngressClass
2222
IndexKeyIngressClassParamsRefName = "ingressClass.ingressClassParamsRef.name"
23+
// IndexKeyIngressClassParamsSecretRefName is index key for secrets referenced by IngressClassParams
24+
IndexKeyIngressClassParamsSecretRefName = "ingressClass.ingressClassParamsRef.secret"
2325
)
2426

2527
// ReferenceIndexer has the ability to index Ingresses with referenced objects
@@ -32,6 +34,8 @@ type ReferenceIndexer interface {
3234
BuildIngressClassRefIndexes(ctx context.Context, ing *networking.Ingress) []string
3335
// BuildIngressClassParamsRefIndexes returns the name of related IngressClassParams objects
3436
BuildIngressClassParamsRefIndexes(ctx context.Context, ingClass *networking.IngressClass) []string
37+
// BuildIngressClassParamsSecretIndexes returns the secret names that the ingress class param references
38+
BuildIngressClassParamsSecretIndexes(ctx context.Context, ingressClassParams *elbv2api.IngressClassParams) []string
3539
}
3640

3741
// NewDefaultReferenceIndexer constructs new defaultReferenceIndexer
@@ -121,6 +125,16 @@ func (i *defaultReferenceIndexer) BuildIngressClassParamsRefIndexes(_ context.Co
121125
return []string{ingClassParamsName}
122126
}
123127

128+
func (i *defaultReferenceIndexer) BuildIngressClassParamsSecretIndexes(_ context.Context, ingressClassParams *elbv2api.IngressClassParams) []string {
129+
if ingressClassParams == nil {
130+
return nil
131+
}
132+
if ingressClassParams.Spec.AuthConfig != nil && ingressClassParams.Spec.AuthConfig.IDPConfigOIDC != nil && ingressClassParams.Spec.AuthConfig.IDPConfigOIDC.SecretName != "" {
133+
return []string{ingressClassParams.Spec.AuthConfig.IDPConfigOIDC.SecretName}
134+
}
135+
return nil
136+
}
137+
124138
func extractServiceNamesFromAction(action Action) []string {
125139
if action.Type != ActionTypeForward || action.ForwardConfig == nil {
126140
return nil

0 commit comments

Comments
 (0)