Skip to content

Commit 0cbe365

Browse files
PanSpagetkaPanSpagetka
committed
Enable partial reconcile of Rosa Operator Roles
1 parent bc8e7af commit 0cbe365

File tree

3 files changed

+52
-69
lines changed

3 files changed

+52
-69
lines changed

‎config/crd/bases/controlplane.cluster.x-k8s.io_rosacontrolplanes.yaml

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -759,15 +759,6 @@ spec:
759759
[\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:AttachVolume\",\n\t\t\t\t\"ec2:CreateSnapshot\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"ec2:CreateVolume\",\n\t\t\t\t\"ec2:DeleteSnapshot\",\n\t\t\t\t\"ec2:DeleteTags\",\n\t\t\t\t\"ec2:DeleteVolume\",\n\t\t\t\t\"ec2:DescribeInstances\",\n\t\t\t\t\"ec2:DescribeSnapshots\",\n\t\t\t\t\"ec2:DescribeTags\",\n\t\t\t\t\"ec2:DescribeVolumes\",\n\t\t\t\t\"ec2:DescribeVolumesModifications\",\n\t\t\t\t\"ec2:DetachVolume\",\n\t\t\t\t\"ec2:ModifyVolume\"\n\t\t\t],\n\t\t\t\"Resource\":
760760
\"*\"\n\t\t}\n\t]\n}"
761761
type: string
762-
required:
763-
- controlPlaneOperatorARN
764-
- imageRegistryARN
765-
- ingressARN
766-
- kmsProviderARN
767-
- kubeCloudControllerARN
768-
- networkARN
769-
- nodePoolManagementARN
770-
- storageARN
771762
type: object
772763
rosaClusterName:
773764
description: |-

‎config/crd/bases/infrastructure.cluster.x-k8s.io_rosaroleconfigs.yaml

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -410,15 +410,6 @@ spec:
410410
[\n\t\t{\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Action\": [\n\t\t\t\t\"ec2:AttachVolume\",\n\t\t\t\t\"ec2:CreateSnapshot\",\n\t\t\t\t\"ec2:CreateTags\",\n\t\t\t\t\"ec2:CreateVolume\",\n\t\t\t\t\"ec2:DeleteSnapshot\",\n\t\t\t\t\"ec2:DeleteTags\",\n\t\t\t\t\"ec2:DeleteVolume\",\n\t\t\t\t\"ec2:DescribeInstances\",\n\t\t\t\t\"ec2:DescribeSnapshots\",\n\t\t\t\t\"ec2:DescribeTags\",\n\t\t\t\t\"ec2:DescribeVolumes\",\n\t\t\t\t\"ec2:DescribeVolumesModifications\",\n\t\t\t\t\"ec2:DetachVolume\",\n\t\t\t\t\"ec2:ModifyVolume\"\n\t\t\t],\n\t\t\t\"Resource\":
411411
\"*\"\n\t\t}\n\t]\n}"
412412
type: string
413-
required:
414-
- controlPlaneOperatorARN
415-
- imageRegistryARN
416-
- ingressARN
417-
- kmsProviderARN
418-
- kubeCloudControllerARN
419-
- networkARN
420-
- nodePoolManagementARN
421-
- storageARN
422413
type: object
423414
type: object
424415
type: object

‎exp/controllers/rosaroleconfig_controller.go

Lines changed: 52 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ import (
4646
"sigs.k8s.io/controller-runtime/pkg/controller"
4747
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
4848

49+
"sigs.k8s.io/cluster-api-provider-aws/v2/controlplane/rosa/api/v1beta2"
4950
expinfrav1 "sigs.k8s.io/cluster-api-provider-aws/v2/exp/api/v1beta2"
5051
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud"
5152
"sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/scope"
@@ -150,18 +151,18 @@ func (r *ROSARoleConfigReconciler) Reconcile(ctx context.Context, req ctrl.Reque
150151
return ctrl.Result{}, fmt.Errorf("failed to OICD Config: %w", err)
151152
}
152153

153-
err = r.createOperatorRoles(ctx, roleConfig, scope, ocmClient)
154-
if err != nil {
155-
conditions.MarkFalse(scope.RosaRoleConfig, expinfrav1.RosaRoleConfigReadyCondition, expinfrav1.RosaRoleConfigReconciliationFailedReason, clusterv1.ConditionSeverityError, "Failed to create Operator Roles: %v", err)
156-
return ctrl.Result{}, fmt.Errorf("failed to Create OperatorRoles: %w", err)
157-
}
158-
159154
err = r.createOIDCProvider(scope, ocmClient)
160155
if err != nil {
161156
conditions.MarkFalse(scope.RosaRoleConfig, expinfrav1.RosaRoleConfigReadyCondition, expinfrav1.RosaRoleConfigReconciliationFailedReason, clusterv1.ConditionSeverityError, "Failed to create OIDC provider: %v", err)
162157
return ctrl.Result{}, fmt.Errorf("failed to Create OIDC provider: %w", err)
163158
}
164159

160+
err = r.createOperatorRoles(ctx, roleConfig, scope, ocmClient)
161+
if err != nil {
162+
conditions.MarkFalse(scope.RosaRoleConfig, expinfrav1.RosaRoleConfigReadyCondition, expinfrav1.RosaRoleConfigReconciliationFailedReason, clusterv1.ConditionSeverityError, "Failed to create Operator Roles: %v", err)
163+
return ctrl.Result{}, fmt.Errorf("failed to Create OperatorRoles: %w", err)
164+
}
165+
165166
if r.rosaRolesConfigReady(scope) {
166167
conditions.MarkTrue(scope.RosaRoleConfig, expinfrav1.RosaRoleConfigReadyCondition)
167168
conditions.Set(scope.RosaRoleConfig,
@@ -184,6 +185,12 @@ func (r *ROSARoleConfigReconciler) reconcileDelete(scope *scope.RosaRoleConfigSc
184185
return err
185186
}
186187

188+
err = r.deleteOperatorRoles(ocmClient, awsClient, scope.RosaRoleConfig.Spec.AccountRoleConfig.Prefix)
189+
if err != nil {
190+
conditions.MarkFalse(scope.RosaRoleConfig, expinfrav1.RosaRoleConfigReadyCondition, expinfrav1.RosaRoleConfigDeletionFailedReason, clusterv1.ConditionSeverityError, "Failed to delete operator roles: %v", err)
191+
return err
192+
}
193+
187194
oidcID := scope.RosaRoleConfig.Status.OIDCID
188195
if scope.RosaRoleConfig.Spec.OperatorRoleConfig.OIDCID == "" {
189196
err = r.deleteOIDCProvider(ocmClient, awsClient, oidcID)
@@ -193,12 +200,6 @@ func (r *ROSARoleConfigReconciler) reconcileDelete(scope *scope.RosaRoleConfigSc
193200
}
194201
}
195202

196-
err = r.deleteOperatorRoles(ocmClient, awsClient, scope.RosaRoleConfig.Spec.AccountRoleConfig.Prefix)
197-
if err != nil {
198-
conditions.MarkFalse(scope.RosaRoleConfig, expinfrav1.RosaRoleConfigReadyCondition, expinfrav1.RosaRoleConfigDeletionFailedReason, clusterv1.ConditionSeverityError, "Failed to delete operator roles: %v", err)
199-
return err
200-
}
201-
202203
err = r.deleteAccountRoles(ocmClient, awsClient, scope)
203204
if err != nil {
204205
conditions.MarkFalse(scope.RosaRoleConfig, expinfrav1.RosaRoleConfigReadyCondition, expinfrav1.RosaRoleConfigDeletionFailedReason, clusterv1.ConditionSeverityError, "Failed to delete account roles: %v", err)
@@ -267,36 +268,29 @@ func (r *ROSARoleConfigReconciler) createOperatorRoles(ctx context.Context, role
267268
return err
268269
}
269270

270-
if len(operatorRoles) > 0 {
271-
for _, roles := range operatorRoles {
272-
for _, role := range roles {
273-
if strings.Contains(role.RoleName, fmt.Sprintf("%s-openshift-ingress-operator-cloud-credentials", config.Prefix)) {
274-
scope.RosaRoleConfig.Status.OperatorRolesRef.IngressARN = role.RoleARN
275-
}
276-
if strings.Contains(role.RoleName, fmt.Sprintf("%s-openshift-image-registry-installer-cloud-credentials", config.Prefix)) {
277-
scope.RosaRoleConfig.Status.OperatorRolesRef.ImageRegistryARN = role.RoleARN
278-
}
279-
if strings.Contains(role.RoleName, fmt.Sprintf("%s-openshift-cluster-csi-drivers-ebs-cloud-credentials", config.Prefix)) {
280-
scope.RosaRoleConfig.Status.OperatorRolesRef.StorageARN = role.RoleARN
281-
}
282-
if strings.Contains(role.RoleName, fmt.Sprintf("%s-openshift-cloud-network-config-controller-cloud-credentials", config.Prefix)) {
283-
scope.RosaRoleConfig.Status.OperatorRolesRef.NetworkARN = role.RoleARN
284-
}
285-
if strings.Contains(role.RoleName, fmt.Sprintf("%s-kube-system-kube-controller-manager", config.Prefix)) {
286-
scope.RosaRoleConfig.Status.OperatorRolesRef.KubeCloudControllerARN = role.RoleARN
287-
}
288-
if strings.Contains(role.RoleName, fmt.Sprintf("%s-kube-system-capa-controller-manager", config.Prefix)) {
289-
scope.RosaRoleConfig.Status.OperatorRolesRef.NodePoolManagementARN = role.RoleARN
290-
}
291-
if strings.Contains(role.RoleName, fmt.Sprintf("%s-kube-system-control-plane-operator", config.Prefix)) {
292-
scope.RosaRoleConfig.Status.OperatorRolesRef.ControlPlaneOperatorARN = role.RoleARN
293-
}
294-
if strings.Contains(role.RoleName, fmt.Sprintf("%s-kube-system-kms-provider", config.Prefix)) {
295-
scope.RosaRoleConfig.Status.OperatorRolesRef.KMSProviderARN = role.RoleARN
296-
}
271+
for _, roles := range operatorRoles {
272+
for _, role := range roles {
273+
if role.RoleName == fmt.Sprintf("%s-openshift-ingress-operator-cloud-credentials", config.Prefix) {
274+
scope.RosaRoleConfig.Status.OperatorRolesRef.IngressARN = role.RoleARN
275+
} else if role.RoleName == fmt.Sprintf("%s-openshift-image-registry-installer-cloud-credentials", config.Prefix) {
276+
scope.RosaRoleConfig.Status.OperatorRolesRef.ImageRegistryARN = role.RoleARN
277+
} else if role.RoleName == fmt.Sprintf("%s-openshift-cluster-csi-drivers-ebs-cloud-credentials", config.Prefix) {
278+
scope.RosaRoleConfig.Status.OperatorRolesRef.StorageARN = role.RoleARN
279+
} else if role.RoleName == fmt.Sprintf("%s-openshift-cloud-network-config-controller-cloud-credentials", config.Prefix) {
280+
scope.RosaRoleConfig.Status.OperatorRolesRef.NetworkARN = role.RoleARN
281+
} else if role.RoleName == fmt.Sprintf("%s-kube-system-kube-controller-manager", config.Prefix) {
282+
scope.RosaRoleConfig.Status.OperatorRolesRef.KubeCloudControllerARN = role.RoleARN
283+
} else if role.RoleName == fmt.Sprintf("%s-kube-system-capa-controller-manager", config.Prefix) {
284+
scope.RosaRoleConfig.Status.OperatorRolesRef.NodePoolManagementARN = role.RoleARN
285+
} else if role.RoleName == fmt.Sprintf("%s-kube-system-control-plane-operator", config.Prefix) {
286+
scope.RosaRoleConfig.Status.OperatorRolesRef.ControlPlaneOperatorARN = role.RoleARN
287+
} else if role.RoleName == fmt.Sprintf("%s-kube-system-kms-provider", config.Prefix) {
288+
scope.RosaRoleConfig.Status.OperatorRolesRef.KMSProviderARN = role.RoleARN
297289
}
298290
}
299-
} else {
291+
}
292+
293+
if !r.operatorRolesReady(&scope.RosaRoleConfig.Status.OperatorRolesRef) {
300294
err = operatorroles.CreateOperatorRoles(runtime, ocm.Production, config.PermissionsBoundaryARN, interactive.ModeAuto, policies, version, isSharedVpc, config.Prefix, hostedCp, installerRoleArn, forcePolicyCreation,
301295
oidcConfigID, config.SharedVPCConfig.RouteRoleARN, ocm.DefaultChannelGroup, config.SharedVPCConfig.VPCEndpointRoleARN)
302296
return err
@@ -407,15 +401,15 @@ func (r *ROSARoleConfigReconciler) createAccountRoles(ctx context.Context, roleC
407401
}
408402

409403
for _, role := range accountRoles {
410-
if strings.Contains(role.RoleName, fmt.Sprintf("%s-HCP-ROSA-Installer", config.Prefix)) {
404+
if role.RoleName == fmt.Sprintf("%s-HCP-ROSA-Installer-Role", config.Prefix) {
411405
createRoles = false
412406
scope.RosaRoleConfig.Status.AccountRolesRef.InstallerRoleARN = role.RoleARN
413407
}
414-
if strings.Contains(role.RoleName, fmt.Sprintf("%s-HCP-ROSA-Support", config.Prefix)) {
408+
if role.RoleName == fmt.Sprintf("%s-HCP-ROSA-Support-Role", config.Prefix) {
415409
createRoles = false
416410
scope.RosaRoleConfig.Status.AccountRolesRef.SupportRoleARN = role.RoleARN
417411
}
418-
if strings.Contains(role.RoleName, fmt.Sprintf("%s-HCP-ROSA-Worker", config.Prefix)) {
412+
if role.RoleName == fmt.Sprintf("%s-HCP-ROSA-Worker-Role", config.Prefix) {
419413
createRoles = false
420414
scope.RosaRoleConfig.Status.AccountRolesRef.WorkerRoleARN = role.RoleARN
421415
}
@@ -612,14 +606,21 @@ func (r ROSARoleConfigReconciler) rosaRolesConfigReady(scope *scope.RosaRoleConf
612606
scope.RosaRoleConfig.Status.AccountRolesRef.InstallerRoleARN == "" ||
613607
scope.RosaRoleConfig.Status.AccountRolesRef.SupportRoleARN == "" ||
614608
scope.RosaRoleConfig.Status.AccountRolesRef.WorkerRoleARN == "" ||
615-
scope.RosaRoleConfig.Status.OperatorRolesRef.ControlPlaneOperatorARN == "" ||
616-
scope.RosaRoleConfig.Status.OperatorRolesRef.ImageRegistryARN == "" ||
617-
scope.RosaRoleConfig.Status.OperatorRolesRef.IngressARN == "" ||
618-
scope.RosaRoleConfig.Status.OperatorRolesRef.KMSProviderARN == "" ||
619-
scope.RosaRoleConfig.Status.OperatorRolesRef.KubeCloudControllerARN == "" ||
620-
scope.RosaRoleConfig.Status.OperatorRolesRef.NetworkARN == "" ||
621-
scope.RosaRoleConfig.Status.OperatorRolesRef.NodePoolManagementARN == "" ||
622-
scope.RosaRoleConfig.Status.OperatorRolesRef.StorageARN == "" {
609+
!r.operatorRolesReady(&scope.RosaRoleConfig.Status.OperatorRolesRef) {
610+
return false
611+
}
612+
return true
613+
}
614+
615+
func (r ROSARoleConfigReconciler) operatorRolesReady(operatorRolesRef *v1beta2.AWSRolesRef) bool {
616+
if operatorRolesRef.ControlPlaneOperatorARN == "" ||
617+
operatorRolesRef.ImageRegistryARN == "" ||
618+
operatorRolesRef.IngressARN == "" ||
619+
operatorRolesRef.KMSProviderARN == "" ||
620+
operatorRolesRef.KubeCloudControllerARN == "" ||
621+
operatorRolesRef.NetworkARN == "" ||
622+
operatorRolesRef.NodePoolManagementARN == "" ||
623+
operatorRolesRef.StorageARN == "" {
623624
return false
624625
}
625626
return true

0 commit comments

Comments
 (0)