Skip to content

Commit 3c7b8a3

Browse files
2uasimojo2uasimojo
committed
HIVE-2302: Save metadata.json opaquely
Well, mostly. Previously any time installer added a field to metadata.json, we would need to evaluate and possibly add a bespoke field and code path for it to make sure it was supplied to the destroyer at deprovision time. With this change, we're offloading metadata.json verbatim (except in some cases we have to scrub/replace credentials fields -- see HIVE-2804 / #2612) to a new Secret in the ClusterDeployment's namespace, referenced from a new field: ClusterDeployment.Spec.ClusterMetadata.MetadataJSONSecretRef. For legacy clusters -- those created before this change -- we attempt to retrofit the new Secret based on the legacy fields. This is best effort and may not always work. In the future (but not here!) instead of building the installer's ClusterMetadata structure for the destroyer with individual fields from the CD's ClusterMetadata, we'll unmarshal it directly from the contents of this Secret.
1 parent c248a51 commit 3c7b8a3

24 files changed

+685
-40
lines changed

‎apis/hive/v1/aws/metadata.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,7 @@ package aws
44
type Metadata struct {
55
// HostedZoneRole is the role to assume when performing operations
66
// on a hosted zone owned by another account.
7+
// Deprecated. Use the Secret referenced by ClusterMetadata.MetadataJSONSecretRef instead. We
8+
// may stop populating this section in the future.
79
HostedZoneRole *string `json:"hostedZoneRole,omitempty"`
810
}

‎apis/hive/v1/azure/metadata.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,7 @@ package azure
33
// Metadata contains Azure metadata (e.g. for uninstalling the cluster).
44
type Metadata struct {
55
// ResourceGroupName is the name of the resource group in which the cluster resources were created.
6+
// Deprecated. Use the Secret referenced by ClusterMetadata.MetadataJSONSecretRef instead. We
7+
// may stop populating this section in the future.
68
ResourceGroupName *string `json:"resourceGroupName"`
79
}

‎apis/hive/v1/clusterdeployment_types.go‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -307,7 +307,13 @@ type ClusterMetadata struct {
307307
// +optional
308308
AdminPasswordSecretRef *corev1.LocalObjectReference `json:"adminPasswordSecretRef,omitempty"`
309309

310-
// Platform holds platform-specific cluster metadata
310+
// MetaddataJSONSecretRef references the secret containing the metadata.json emitted by the
311+
// installer, potentially scrubbed for sensitive data.
312+
MetadataJSONSecretRef *corev1.LocalObjectReference `json:"metadataJSONSecretRef,omitempty"`
313+
314+
// Platform holds platform-specific cluster metadata.
315+
// Deprecated. Use the Secret referenced by MetadataJSONSecretRef instead. We may stop
316+
// populating this section in the future.
311317
// +optional
312318
Platform *ClusterPlatformMetadata `json:"platform,omitempty"`
313319
}

‎apis/hive/v1/gcp/metadata.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ package gcp
33
// Metadata contains GCP metadata (e.g. for uninstalling the cluster).
44
type Metadata struct {
55
// NetworkProjectID is used for shared VPC setups
6+
// Deprecated. Use the Secret referenced by ClusterMetadata.MetadataJSONSecretRef instead. We
7+
// may stop populating this section in the future.
68
// +optional
79
NetworkProjectID *string `json:"networkProjectID,omitempty"`
810
}

‎apis/hive/v1/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crds/hive.openshift.io_clusterdeployments.yaml‎

Lines changed: 30 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -180,8 +180,27 @@ spec:
180180
infraID:
181181
description: InfraID is an identifier for this cluster generated during installation and used for tagging/naming resources in cloud providers.
182182
type: string
183+
metadataJSONSecretRef:
184+
description: |-
185+
MetaddataJSONSecretRef references the secret containing the metadata.json emitted by the
186+
installer, potentially scrubbed for sensitive data.
187+
properties:
188+
name:
189+
default: ""
190+
description: |-
191+
Name of the referent.
192+
This field is effectively required, but due to backwards compatibility is
193+
allowed to be empty. Instances of this type with an empty value here are
194+
almost certainly wrong.
195+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
196+
type: string
197+
type: object
198+
x-kubernetes-map-type: atomic
183199
platform:
184-
description: Platform holds platform-specific cluster metadata
200+
description: |-
201+
Platform holds platform-specific cluster metadata.
202+
Deprecated. Use the Secret referenced by MetadataJSONSecretRef instead. We may stop
203+
populating this section in the future.
185204
properties:
186205
aws:
187206
description: AWS holds AWS-specific cluster metadata
@@ -190,13 +209,18 @@ spec:
190209
description: |-
191210
HostedZoneRole is the role to assume when performing operations
192211
on a hosted zone owned by another account.
212+
Deprecated. Use the Secret referenced by ClusterMetadata.MetadataJSONSecretRef instead. We
213+
may stop populating this section in the future.
193214
type: string
194215
type: object
195216
azure:
196217
description: Azure holds azure-specific cluster metadata
197218
properties:
198219
resourceGroupName:
199-
description: ResourceGroupName is the name of the resource group in which the cluster resources were created.
220+
description: |-
221+
ResourceGroupName is the name of the resource group in which the cluster resources were created.
222+
Deprecated. Use the Secret referenced by ClusterMetadata.MetadataJSONSecretRef instead. We
223+
may stop populating this section in the future.
200224
type: string
201225
required:
202226
- resourceGroupName
@@ -205,7 +229,10 @@ spec:
205229
description: GCP holds GCP-specific cluster metadata
206230
properties:
207231
networkProjectID:
208-
description: NetworkProjectID is used for shared VPC setups
232+
description: |-
233+
NetworkProjectID is used for shared VPC setups
234+
Deprecated. Use the Secret referenced by ClusterMetadata.MetadataJSONSecretRef instead. We
235+
may stop populating this section in the future.
209236
type: string
210237
type: object
211238
type: object

‎config/crds/hiveinternal.openshift.io_fakeclusterinstalls.yaml‎

Lines changed: 30 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -92,8 +92,27 @@ spec:
9292
infraID:
9393
description: InfraID is an identifier for this cluster generated during installation and used for tagging/naming resources in cloud providers.
9494
type: string
95+
metadataJSONSecretRef:
96+
description: |-
97+
MetaddataJSONSecretRef references the secret containing the metadata.json emitted by the
98+
installer, potentially scrubbed for sensitive data.
99+
properties:
100+
name:
101+
default: ""
102+
description: |-
103+
Name of the referent.
104+
This field is effectively required, but due to backwards compatibility is
105+
allowed to be empty. Instances of this type with an empty value here are
106+
almost certainly wrong.
107+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
108+
type: string
109+
type: object
110+
x-kubernetes-map-type: atomic
95111
platform:
96-
description: Platform holds platform-specific cluster metadata
112+
description: |-
113+
Platform holds platform-specific cluster metadata.
114+
Deprecated. Use the Secret referenced by MetadataJSONSecretRef instead. We may stop
115+
populating this section in the future.
97116
properties:
98117
aws:
99118
description: AWS holds AWS-specific cluster metadata
@@ -102,13 +121,18 @@ spec:
102121
description: |-
103122
HostedZoneRole is the role to assume when performing operations
104123
on a hosted zone owned by another account.
124+
Deprecated. Use the Secret referenced by ClusterMetadata.MetadataJSONSecretRef instead. We
125+
may stop populating this section in the future.
105126
type: string
106127
type: object
107128
azure:
108129
description: Azure holds azure-specific cluster metadata
109130
properties:
110131
resourceGroupName:
111-
description: ResourceGroupName is the name of the resource group in which the cluster resources were created.
132+
description: |-
133+
ResourceGroupName is the name of the resource group in which the cluster resources were created.
134+
Deprecated. Use the Secret referenced by ClusterMetadata.MetadataJSONSecretRef instead. We
135+
may stop populating this section in the future.
112136
type: string
113137
required:
114138
- resourceGroupName
@@ -117,7 +141,10 @@ spec:
117141
description: GCP holds GCP-specific cluster metadata
118142
properties:
119143
networkProjectID:
120-
description: NetworkProjectID is used for shared VPC setups
144+
description: |-
145+
NetworkProjectID is used for shared VPC setups
146+
Deprecated. Use the Secret referenced by ClusterMetadata.MetadataJSONSecretRef instead. We
147+
may stop populating this section in the future.
121148
type: string
122149
type: object
123150
type: object

‎contrib/pkg/createcluster/create.go‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,7 @@ type Options struct {
158158
AdoptAdminKubeConfig string
159159
AdoptInfraID string
160160
AdoptClusterID string
161+
AdoptMetadataJSON string
161162
AdoptAdminUsername string
162163
AdoptAdminPassword string
163164
MachineNetwork string
@@ -337,6 +338,7 @@ OpenShift Installer publishes all the services of the cluster like API server an
337338
flags.StringVar(&opt.AdoptAdminKubeConfig, "adopt-admin-kubeconfig", "", "Path to a cluster admin kubeconfig file for a cluster being adopted. (required if using --adopt)")
338339
flags.StringVar(&opt.AdoptInfraID, "adopt-infra-id", "", "Infrastructure ID for this cluster's cloud provider. (required if using --adopt)")
339340
flags.StringVar(&opt.AdoptClusterID, "adopt-cluster-id", "", "Cluster UUID used for telemetry. (required if using --adopt)")
341+
flags.StringVar(&opt.AdoptMetadataJSON, "adopt-metadata-json", "", "Path to a metadata.json file for a cluster being adopted. (optional)")
340342
flags.StringVar(&opt.AdoptAdminUsername, "adopt-admin-username", "", "Username for cluster web console administrator. (optional)")
341343
flags.StringVar(&opt.AdoptAdminPassword, "adopt-admin-password", "", "Password for cluster web console administrator. (optional)")
342344

@@ -486,13 +488,19 @@ func (o *Options) Validate(cmd *cobra.Command) error {
486488
return fmt.Errorf("--adopt-admin-kubeconfig does not exist: %s", o.AdoptAdminKubeConfig)
487489
}
488490

491+
if o.AdoptMetadataJSON != "" {
492+
if _, err := os.Stat(o.AdoptMetadataJSON); os.IsNotExist(err) {
493+
return fmt.Errorf("--adopt-metadata-json does not exist: %s", o.AdoptMetadataJSON)
494+
}
495+
}
496+
489497
// Admin username and password must both be specified if either are.
490498
if (o.AdoptAdminUsername != "" || o.AdoptAdminPassword != "") && !(o.AdoptAdminUsername != "" && o.AdoptAdminPassword != "") {
491499
return fmt.Errorf("--adopt-admin-username and --adopt-admin-password must be used together")
492500
}
493501
} else {
494-
if o.AdoptAdminKubeConfig != "" || o.AdoptInfraID != "" || o.AdoptClusterID != "" || o.AdoptAdminUsername != "" || o.AdoptAdminPassword != "" {
495-
return fmt.Errorf("cannot use adoption options without --adopt: --adopt-admin-kube-config, --adopt-infra-id, --adopt-cluster-id, --adopt-admin-username, --adopt-admin-password")
502+
if o.AdoptAdminKubeConfig != "" || o.AdoptInfraID != "" || o.AdoptClusterID != "" || o.AdoptMetadataJSON != "" || o.AdoptAdminUsername != "" || o.AdoptAdminPassword != "" {
503+
return fmt.Errorf("cannot use adoption options without --adopt: --adopt-admin-kube-config, --adopt-infra-id, --adopt-cluster-id, --adopt-metadata-json, --adopt-admin-username, --adopt-admin-password")
496504
}
497505
}
498506

@@ -638,6 +646,13 @@ func (o *Options) GenerateObjects() ([]runtime.Object, error) {
638646
if err != nil {
639647
return nil, err
640648
}
649+
if o.AdoptMetadataJSON != "" {
650+
metadataJSONBytes, err := os.ReadFile(o.AdoptMetadataJSON)
651+
if err != nil {
652+
return nil, err
653+
}
654+
builder.AdoptMetadataJSON = metadataJSONBytes
655+
}
641656
builder.Adopt = o.Adopt
642657
builder.AdoptInfraID = o.AdoptInfraID
643658
builder.AdoptClusterID = o.AdoptClusterID

0 commit comments

Comments
 (0)