-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: EKS IAM Roles for Service Accounts for Runner Pods
One of the pod recreation conditions has been modified to use hash of runner spec, so that the controller does not keep restarting pods mutated by admission webhooks. This naturally allows us, for example, to use IRSA for EKS that requires its admission webhook to mutate the runner pod to have additional, IRSA-related volumes, volume mounts and env. Resolves #200
- Loading branch information
Yusuke Kuoka
committed
Dec 8, 2020
1 parent
f710a54
commit d222ef6
Showing
10 changed files
with
197 additions
and
23 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,14 +1,13 @@ | ||
| package controllers | ||
|
|
||
| import ( | ||
| corev1 "k8s.io/api/core/v1" | ||
| ) | ||
| func filterLabels(labels map[string]string, filter string) map[string]string { | ||
| filtered := map[string]string{} | ||
|
|
||
| func filterEnvVars(envVars []corev1.EnvVar, filter string) (filtered []corev1.EnvVar) { | ||
| for _, envVar := range envVars { | ||
| if envVar.Name != filter { | ||
| filtered = append(filtered, envVar) | ||
| for k, v := range labels { | ||
| if k != filter { | ||
| filtered[k] = v | ||
| } | ||
| } | ||
|
|
||
| return filtered | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| package controllers | ||
|
|
||
| import ( | ||
| "reflect" | ||
| "testing" | ||
| ) | ||
|
|
||
| func Test_filterLabels(t *testing.T) { | ||
| type args struct { | ||
| labels map[string]string | ||
| filter string | ||
| } | ||
| tests := []struct { | ||
| name string | ||
| args args | ||
| want map[string]string | ||
| }{ | ||
| { | ||
| name: "ok", | ||
| args: args{ | ||
| labels: map[string]string{LabelKeyRunnerTemplateHash: "abc", LabelKeyPodTemplateHash: "def"}, | ||
| filter: LabelKeyRunnerTemplateHash, | ||
| }, | ||
| want: map[string]string{LabelKeyPodTemplateHash: "def"}, | ||
| }, | ||
| } | ||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| if got := filterLabels(tt.args.labels, tt.args.filter); !reflect.DeepEqual(got, tt.want) { | ||
| t.Errorf("filterLabels() = %v, want %v", got, tt.want) | ||
| } | ||
| }) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| COMMIT=$(git rev-parse HEAD) | ||
| TAG=$(git describe --exact-match --abbrev=0 --tags "${COMMIT}" 2> /dev/null || true) | ||
| BRANCH=$(git branch | grep \* | cut -d ' ' -f2 | sed -e 's/[^a-zA-Z0-9+=._:/-]*//g' || true) | ||
| VERSION="" | ||
|
|
||
| if [ -z "$TAG" ]; then | ||
| [[ -n "$BRANCH" ]] && VERSION="${BRANCH}-" | ||
| VERSION="${VERSION}${COMMIT:0:8}" | ||
| else | ||
| VERSION=$TAG | ||
| fi | ||
|
|
||
| if [ -n "$(git diff --shortstat 2> /dev/null | tail -n1)" ]; then | ||
| VERSION="${VERSION}-dirty" | ||
| fi | ||
|
|
||
| export VERSION |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| package hash | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "hash/fnv" | ||
| "k8s.io/apimachinery/pkg/util/rand" | ||
| ) | ||
|
|
||
| func FNVHashStringObjects(objs ...interface{}) string { | ||
| hash := fnv.New32a() | ||
|
|
||
| for _, obj := range objs { | ||
| DeepHashObject(hash, obj) | ||
| } | ||
|
|
||
| return rand.SafeEncodeString(fmt.Sprint(hash.Sum32())) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| // Copyright 2015 The Kubernetes Authors. | ||
| // hash.go is copied from kubernetes's pkg/util/hash.go | ||
| // See https://github.com/kubernetes/kubernetes/blob/e1c617a88ec286f5f6cb2589d6ac562d095e1068/pkg/util/hash/hash.go#L25-L37 | ||
|
|
||
| package hash | ||
|
|
||
| import ( | ||
| "hash" | ||
|
|
||
| "github.com/davecgh/go-spew/spew" | ||
| ) | ||
|
|
||
| // DeepHashObject writes specified object to hash using the spew library | ||
| // which follows pointers and prints actual values of the nested objects | ||
| // ensuring the hash does not change when a pointer changes. | ||
| func DeepHashObject(hasher hash.Hash, objectToWrite interface{}) { | ||
| hasher.Reset() | ||
| printer := spew.ConfigState{ | ||
| Indent: " ", | ||
| SortKeys: true, | ||
| DisableMethods: true, | ||
| SpewKeys: true, | ||
| } | ||
| printer.Fprintf(hasher, "%#v", objectToWrite) | ||
| } |