7e21b9b78d
This change updates the apicerts controllers to return an error when they cannot successfully complete their Sync func. i.e. `return nil` is reserved for cases where the controller has fully completed its job with no errors. This makes it clear when a controller has wedged - i.e. it is waiting on some other controller or process to perform some action before it can complete. The controller lib's queue will exponentially back off and thus there is no need to be concerned with returning an error indefinitely or infinite log spam. Even when the kubelet throws away container logs, it will be clear what controllers are wedged based on the last hour or so of logs. Signed-off-by: Monis Khan <mok@vmware.com>
76 lines
2.6 KiB
Go
76 lines
2.6 KiB
Go
// Copyright 2020 the Pinniped contributors. All Rights Reserved.
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package apicerts
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
k8serrors "k8s.io/apimachinery/pkg/api/errors"
|
|
corev1informers "k8s.io/client-go/informers/core/v1"
|
|
"k8s.io/klog/v2"
|
|
aggregatorclient "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset"
|
|
|
|
pinnipedcontroller "go.pinniped.dev/internal/controller"
|
|
"go.pinniped.dev/internal/controllerlib"
|
|
)
|
|
|
|
type apiServiceUpdaterController struct {
|
|
namespace string
|
|
certsSecretResourceName string
|
|
aggregatorClient aggregatorclient.Interface
|
|
secretInformer corev1informers.SecretInformer
|
|
apiServiceName string
|
|
}
|
|
|
|
func NewAPIServiceUpdaterController(
|
|
namespace string,
|
|
certsSecretResourceName string,
|
|
apiServiceName string,
|
|
aggregatorClient aggregatorclient.Interface,
|
|
secretInformer corev1informers.SecretInformer,
|
|
withInformer pinnipedcontroller.WithInformerOptionFunc,
|
|
) controllerlib.Controller {
|
|
return controllerlib.New(
|
|
controllerlib.Config{
|
|
Name: "certs-manager-controller",
|
|
Syncer: &apiServiceUpdaterController{
|
|
namespace: namespace,
|
|
certsSecretResourceName: certsSecretResourceName,
|
|
aggregatorClient: aggregatorClient,
|
|
secretInformer: secretInformer,
|
|
apiServiceName: apiServiceName,
|
|
},
|
|
},
|
|
withInformer(
|
|
secretInformer,
|
|
pinnipedcontroller.NameAndNamespaceExactMatchFilterFactory(certsSecretResourceName, namespace),
|
|
controllerlib.InformerOption{},
|
|
),
|
|
)
|
|
}
|
|
|
|
func (c *apiServiceUpdaterController) Sync(ctx controllerlib.Context) error {
|
|
// Try to get the secret from the informer cache.
|
|
certSecret, err := c.secretInformer.Lister().Secrets(c.namespace).Get(c.certsSecretResourceName)
|
|
notFound := k8serrors.IsNotFound(err)
|
|
if err != nil && !notFound {
|
|
return fmt.Errorf("failed to get %s/%s secret: %w", c.namespace, c.certsSecretResourceName, err)
|
|
}
|
|
if notFound {
|
|
// The secret does not exist yet, so nothing to do.
|
|
klog.Info("apiServiceUpdaterController Sync found that the secret does not exist yet or was deleted")
|
|
//nolint: goerr113
|
|
return fmt.Errorf("apiServiceUpdaterController missing pre-requirements, secret %s/%s does not exist: %w",
|
|
c.namespace, c.certsSecretResourceName, controllerlib.ErrSyntheticRequeue)
|
|
}
|
|
|
|
// Update the APIService to give it the new CA bundle.
|
|
if err := UpdateAPIService(ctx.Context, c.aggregatorClient, c.apiServiceName, certSecret.Data[caCertificateSecretKey]); err != nil {
|
|
return fmt.Errorf("could not update the API service: %w", err)
|
|
}
|
|
|
|
klog.Info("apiServiceUpdaterController Sync successfully updated API service")
|
|
return nil
|
|
}
|