Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feature: add BYOID support for OCI artifacts and Helm charts #1121

Merged
merged 1 commit into from
Feb 2, 2024
Merged

feature: add BYOID support for OCI artifacts and Helm charts #1121

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions cmd/helm-sync/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,8 +46,8 @@ var (
flIncludeCRDs = flag.String("include-crds", os.Getenv(reconcilermanager.HelmIncludeCRDs),
"include CRDs in the helm rendering output")
flAuth = flag.String("auth", util.EnvString(reconcilermanager.HelmAuthType, string(configsync.AuthNone)),
fmt.Sprintf("the authentication type for access to the Helm repository. Must be one of %s, %s, %s or %s. Defaults to %s",
configsync.AuthGCPServiceAccount, configsync.AuthToken, configsync.AuthGCENode, configsync.AuthNone, configsync.AuthNone))
fmt.Sprintf("the authentication type for access to the Helm repository. Must be one of %s, %s, %s, %s or %s. Defaults to %s",
configsync.AuthGCPServiceAccount, configsync.AuthK8sServiceAccount, configsync.AuthToken, configsync.AuthGCENode, configsync.AuthNone, configsync.AuthNone))
flReleaseName = flag.String("release-name", os.Getenv(reconcilermanager.HelmReleaseName),
"the name of helm release")
flNamespace = flag.String("namespace", os.Getenv(reconcilermanager.HelmReleaseNamespace),
Expand Down
6 changes: 3 additions & 3 deletions cmd/oci-sync/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,8 +35,8 @@ import (
var flImage = flag.String("image", util.EnvString(reconcilermanager.OciSyncImage, ""),
"the OCI image repository for the package")
var flAuth = flag.String("auth", util.EnvString(reconcilermanager.OciSyncAuth, string(configsync.AuthNone)),
fmt.Sprintf("the authentication type for access to the OCI package. Must be one of %s, %s, or %s. Defaults to %s",
configsync.AuthGCPServiceAccount, configsync.AuthGCENode, configsync.AuthNone, configsync.AuthNone))
fmt.Sprintf("the authentication type for access to the OCI package. Must be one of %s, %s, %s, or %s. Defaults to %s",
configsync.AuthGCPServiceAccount, configsync.AuthK8sServiceAccount, configsync.AuthGCENode, configsync.AuthNone, configsync.AuthNone))
var flRoot = flag.String("root", util.EnvString("OCI_SYNC_ROOT", util.EnvString("HOME", "")+"/oci"),
"the root directory for oci-sync operations, under which --dest will be created")
var flDest = flag.String("dest", util.EnvString("OCI_SYNC_DEST", ""),
Expand Down Expand Up @@ -86,7 +86,7 @@ func main() {
switch configsync.AuthType(*flAuth) {
case configsync.AuthNone:
auth = authn.Anonymous
case configsync.AuthGCPServiceAccount, configsync.AuthGCENode:
case configsync.AuthGCPServiceAccount, configsync.AuthK8sServiceAccount, configsync.AuthGCENode:
a, err := google.NewEnvAuthenticator()
if err != nil {
utillog.HandleError(log, true, "ERROR: failed to get the authentication with type %q: %v", *flAuth, err)
Expand Down
2 changes: 1 addition & 1 deletion e2e/nomostest/nt.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -971,7 +971,7 @@ func gitCommitFromSpec(nt *NT, gitSpec *v1beta1.Git) (string, error) {
pattern = "HEAD"
}
var args []string
if strings.Contains(gitSpec.Repo, "https://source.developers.google.com") {
if strings.Contains(gitSpec.Repo, testing.CSRHost) {
cloneDir, err := cloneCloudSourceRepo(nt, gitSpec.Repo)
if err != nil {
return "", err
Expand Down
15 changes: 12 additions & 3 deletions e2e/nomostest/testing/env.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,19 @@
package testing

const (
// ARHost is the host address of the Artifact Registry
ARHost = "us-docker.pkg.dev"

// GCRHost is the host address of the Container Registry
GCRHost = "gcr.io"

// CSRHost is the host address of the Cloud Source Repositories
CSRHost = "https://source.developers.google.com"

// TestInfraContainerRegistry is the Config Sync test-infra registry hosted on GCR
TestInfraContainerRegistry = "gcr.io/kpt-config-sync-ci-artifacts"
TestInfraContainerRegistry = GCRHost + "/kpt-config-sync-ci-artifacts"
// TestInfraArtifactRegistry is the Config Sync test-infra registry hosted on GAR
TestInfraArtifactRegistry = "us-docker.pkg.dev/kpt-config-sync-ci-artifacts/test-infra"
TestInfraArtifactRegistry = ARHost + "/kpt-config-sync-ci-artifacts/test-infra"
// ConfigSyncTestPublicRegistry is the Config Sync config-sync-test-public registry hosted on GAR
ConfigSyncTestPublicRegistry = "us-docker.pkg.dev/kpt-config-sync-ci-artifacts/config-sync-test-public"
ConfigSyncTestPublicRegistry = ARHost + "/kpt-config-sync-ci-artifacts/config-sync-test-public"
)
5 changes: 3 additions & 2 deletions e2e/nomostest/testutils/fleet_membership.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ import (
corev1 "k8s.io/api/core/v1"
"kpt.dev/configsync/e2e/nomostest"
"kpt.dev/configsync/pkg/api/configmanagement"
"kpt.dev/configsync/pkg/api/configsync"
hubv1 "kpt.dev/configsync/pkg/api/hub/v1"
"kpt.dev/configsync/pkg/metadata"
"kpt.dev/configsync/pkg/reconcilermanager"
Expand Down Expand Up @@ -122,7 +123,7 @@ func ClearMembershipInfo(nt *nomostest.NT, fleetMembership, fleetProject, gkeURI

// ReconcilerPodHasFWICredsAnnotation checks whether the reconciler Pod has the
// FWI credentials annotation.
func ReconcilerPodHasFWICredsAnnotation(nt *nomostest.NT, reconcilerName, gsaEmail string) error {
func ReconcilerPodHasFWICredsAnnotation(nt *nomostest.NT, reconcilerName, gsaEmail string, auth configsync.AuthType) error {
var podList = &corev1.PodList{}
if err := nt.KubeClient.List(podList, client.InNamespace(configmanagement.ControllerNamespace), client.MatchingLabels{metadata.ReconcilerLabel: reconcilerName}); err != nil {
return err
Expand All @@ -140,7 +141,7 @@ func ReconcilerPodHasFWICredsAnnotation(nt *nomostest.NT, reconcilerName, gsaEma
if err := nt.KubeClient.Get("membership", "", membership); err != nil {
return err
}
expectedCreds, err := controllers.BuildFWICredsContent(membership.Spec.WorkloadIdentityPool, membership.Spec.IdentityProvider, gsaEmail)
expectedCreds, err := controllers.BuildFWICredsContent(membership.Spec.WorkloadIdentityPool, membership.Spec.IdentityProvider, gsaEmail, auth)
if err != nil {
return err
}
Expand Down
2 changes: 1 addition & 1 deletion e2e/testcases/csr_auth_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ const (
// references resources for tenant-a, tenant-b, and tenant-c.
// Each tenant includes a NetworkPolicy, a Role and a RoleBinding.
func csrRepo() string {
return fmt.Sprintf("https://source.developers.google.com/p/%s/r/kustomize-components", *e2e.GCPProject)
return fmt.Sprintf("%s/p/%s/r/kustomize-components", nomostesting.CSRHost, *e2e.GCPProject)
}

func gsaCSRReaderEmail() string {
Expand Down
3 changes: 2 additions & 1 deletion e2e/testcases/kcc_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,8 @@ func TestKCCResourcesOnCSR(t *testing.T) {

rs := fake.RootSyncObjectV1Beta1(configsync.RootSyncName)
nt.T.Log("sync to the kcc resources from a CSR repo")
nt.MustMergePatch(rs, fmt.Sprintf(`{"spec": {"git": {"dir": "kcc", "branch": "main", "repo": "https://source.developers.google.com/p/%s/r/configsync-kcc", "auth": "gcpserviceaccount","gcpServiceAccountEmail": "e2e-test-csr-reader@%s.iam.gserviceaccount.com", "secretRef": {"name": ""}}, "sourceFormat": "unstructured"}}`, *e2e.GCPProject, *e2e.GCPProject))
nt.MustMergePatch(rs, fmt.Sprintf(`{"spec": {"git": {"dir": "kcc", "branch": "main", "repo": "%s/p/%s/r/configsync-kcc", "auth": "gcpserviceaccount","gcpServiceAccountEmail": "e2e-test-csr-reader@%s.iam.gserviceaccount.com", "secretRef": {"name": ""}}, "sourceFormat": "unstructured"}}`,
nomostesting.CSRHost, *e2e.GCPProject, *e2e.GCPProject))

err := nt.WatchForAllSyncs(
nomostest.WithRootSha1Func(nomostest.RemoteRootRepoSha1Fn),
Expand Down
4 changes: 2 additions & 2 deletions e2e/testcases/oci_sync_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,12 +63,12 @@ const (
// privateGCRImage pulls the private OCI image by tag
// The test environment GCR is assumed to be private.
func privateGCRImage() string {
return fmt.Sprintf("gcr.io/%s/config-sync-test/kustomize-components:v1", *e2e.GCPProject)
return fmt.Sprintf("%s/%s/config-sync-test/kustomize-components:v1", nomostesting.GCRHost, *e2e.GCPProject)
}

// privateARImage() pulls the private OCI image by tag
func privateARImage() string {
return fmt.Sprintf("us-docker.pkg.dev/%s/config-sync-test-private/kustomize-components:v1", *e2e.GCPProject)
return fmt.Sprintf("%s/%s/config-sync-test-private/kustomize-components:v1", nomostesting.ARHost, *e2e.GCPProject)
}

func gsaARReaderEmail() string {
Expand Down
Loading