Merge pull request #5679 from chaosi-zju/secret-local-config

standardize the naming of karmada config in local up method
karmada-io · Oct 15, 2024 · 47efa57 · 47efa57
2 parents bf771c7 + 1b79bba
commit 47efa57
Show file tree

Hide file tree

Showing 14 changed files with 126 additions and 127 deletions.
diff --git a/artifacts/agent/karmada-agent.yaml b/artifacts/agent/karmada-agent.yaml
@@ -25,7 +25,7 @@ spec:
           imagePullPolicy: {{image_pull_policy}}
           command:
             - /bin/karmada-agent
-            - --karmada-kubeconfig=/etc/kubeconfig/karmada-kubeconfig
+            - --karmada-kubeconfig=/etc/karmada/config/karmada.config
             - --karmada-context={{karmada_context}}
             - --cluster-name={{member_cluster_name}}
             - --cluster-api-endpoint={{member_cluster_api_endpoint}}
@@ -48,9 +48,9 @@ spec:
               name: metrics
               protocol: TCP
           volumeMounts:
-            - name: kubeconfig
-              mountPath: /etc/kubeconfig
+            - name: karmada-config
+              mountPath: /etc/karmada/config
       volumes:
-        - name: kubeconfig
+        - name: karmada-config
           secret:
-            secretName: karmada-kubeconfig
+            secretName: karmada-agent-config
diff --git a/artifacts/deploy/karmada-aggregated-apiserver.yaml b/artifacts/deploy/karmada-aggregated-apiserver.yaml
@@ -24,18 +24,11 @@ spec:
         - name: karmada-aggregated-apiserver
           image: docker.io/karmada/karmada-aggregated-apiserver:latest
           imagePullPolicy: IfNotPresent
-          volumeMounts:
-            - name: karmada-certs
-              mountPath: /etc/karmada/pki
-              readOnly: true
-            - name: kubeconfig
-              subPath: kubeconfig
-              mountPath: /etc/kubeconfig
           command:
             - /bin/karmada-aggregated-apiserver
-            - --kubeconfig=/etc/kubeconfig
-            - --authentication-kubeconfig=/etc/kubeconfig
-            - --authorization-kubeconfig=/etc/kubeconfig
+            - --kubeconfig=/etc/karmada/config/karmada.config
+            - --authentication-kubeconfig=/etc/karmada/config/karmada.config
+            - --authorization-kubeconfig=/etc/karmada/config/karmada.config
             - --etcd-servers=https://etcd-client.karmada-system.svc.cluster.local:2379
             - --etcd-cafile=/etc/karmada/pki/etcd-ca.crt
             - --etcd-certfile=/etc/karmada/pki/etcd-client.crt
@@ -65,13 +58,19 @@ spec:
             initialDelaySeconds: 10
             periodSeconds: 10
             timeoutSeconds: 15
+          volumeMounts:
+            - name: karmada-config
+              mountPath: /etc/karmada/config
+            - name: karmada-certs
+              mountPath: /etc/karmada/pki
+              readOnly: true
       volumes:
+        - name: karmada-config
+          secret:
+            secretName: karmada-aggregated-apiserver-config
         - name: karmada-certs
           secret:
             secretName: karmada-cert-secret
-        - name: kubeconfig
-          secret:
-            secretName: kubeconfig
 ---
 apiVersion: v1
 kind: Service

diff --git a/artifacts/deploy/karmada-config-secret.yaml b/artifacts/deploy/karmada-config-secret.yaml
@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ${component}-config
+  namespace: karmada-system
+stringData:
+  karmada.config: |-
+    apiVersion: v1
+    kind: Config
+    preferences: {}
+    clusters:
+    - name: karmada-apiserver
+      cluster:
+        certificate-authority-data: ${ca_crt}
+        server: https://karmada-apiserver.karmada-system.svc.cluster.local:5443
+    users:
+    - name: karmada-apiserver
+      user:
+        client-certificate-data: ${client_crt}
+        client-key-data: ${client_key}
+    contexts:
+    - name: karmada-apiserver
+      context:
+        cluster: karmada-apiserver
+        user: karmada-apiserver
+    current-context: karmada-apiserver
diff --git a/artifacts/deploy/karmada-controller-manager.yaml b/artifacts/deploy/karmada-controller-manager.yaml
@@ -25,7 +25,7 @@ spec:
           imagePullPolicy: IfNotPresent
           command:
             - /bin/karmada-controller-manager
-            - --kubeconfig=/etc/kubeconfig
+            - --kubeconfig=/etc/karmada/config/karmada.config
             - --metrics-bind-address=:8080
             - --cluster-status-update-frequency=10s
             - --failover-eviction-timeout=30s
@@ -47,10 +47,9 @@ spec:
               name: metrics
               protocol: TCP
           volumeMounts:
-          - name: kubeconfig
-            subPath: kubeconfig
-            mountPath: /etc/kubeconfig
+          - name: karmada-config
+            mountPath: /etc/karmada/config
       volumes:
-        - name: kubeconfig
+        - name: karmada-config
           secret:
-            secretName: kubeconfig
+            secretName: karmada-controller-manager-config
diff --git a/artifacts/deploy/karmada-descheduler.yaml b/artifacts/deploy/karmada-descheduler.yaml
@@ -25,7 +25,7 @@ spec:
           imagePullPolicy: IfNotPresent
           command:
             - /bin/karmada-descheduler
-            - --kubeconfig=/etc/kubeconfig
+            - --kubeconfig=/etc/karmada/config/karmada.config
             - --metrics-bind-address=0.0.0.0:8080
             - --health-probe-bind-address=0.0.0.0:10358
             - --scheduler-estimator-ca-file=/etc/karmada/pki/ca.crt
@@ -46,16 +46,15 @@ spec:
               name: metrics
               protocol: TCP
           volumeMounts:
+            - name: karmada-config
+              mountPath: /etc/karmada/config
             - name: karmada-certs
               mountPath: /etc/karmada/pki
               readOnly: true
-            - name: kubeconfig
-              subPath: kubeconfig
-              mountPath: /etc/kubeconfig
       volumes:
+        - name: karmada-config
+          secret:
+            secretName: karmada-descheduler-config
         - name: karmada-certs
           secret:
             secretName: karmada-cert-secret
-        - name: kubeconfig
-          secret:
-            secretName: kubeconfig
diff --git a/artifacts/deploy/karmada-metrics-adapter.yaml b/artifacts/deploy/karmada-metrics-adapter.yaml
@@ -24,18 +24,11 @@ spec:
         - name: karmada-metrics-adapter
           image: docker.io/karmada/karmada-metrics-adapter:latest
           imagePullPolicy: IfNotPresent
-          volumeMounts:
-            - name: karmada-certs
-              mountPath: /etc/karmada/pki
-              readOnly: true
-            - name: kubeconfig
-              subPath: kubeconfig
-              mountPath: /etc/kubeconfig
           command:
             - /bin/karmada-metrics-adapter
-            - --kubeconfig=/etc/kubeconfig
-            - --authentication-kubeconfig=/etc/kubeconfig
-            - --authorization-kubeconfig=/etc/kubeconfig
+            - --kubeconfig=/etc/karmada/config/karmada.config
+            - --authentication-kubeconfig=/etc/karmada/config/karmada.config
+            - --authorization-kubeconfig=/etc/karmada/config/karmada.config
             - --client-ca-file=/etc/karmada/pki/ca.crt
             - --tls-cert-file=/etc/karmada/pki/karmada.crt
             - --tls-private-key-file=/etc/karmada/pki/karmada.key
@@ -64,13 +57,19 @@ spec:
           resources:
             requests:
               cpu: 100m
+          volumeMounts:
+            - name: karmada-config
+              mountPath: /etc/karmada/config
+            - name: karmada-certs
+              mountPath: /etc/karmada/pki
+              readOnly: true
       volumes:
+        - name: karmada-config
+          secret:
+            secretName: karmada-metrics-adapter-config
         - name: karmada-certs
           secret:
             secretName: karmada-cert-secret
-        - name: kubeconfig
-          secret:
-            secretName: kubeconfig
 ---
 apiVersion: v1
 kind: Service

diff --git a/artifacts/deploy/karmada-scheduler.yaml b/artifacts/deploy/karmada-scheduler.yaml
@@ -38,7 +38,7 @@ spec:
               protocol: TCP
           command:
             - /bin/karmada-scheduler
-            - --kubeconfig=/etc/kubeconfig
+            - --kubeconfig=/etc/karmada/config/karmada.config
             - --metrics-bind-address=0.0.0.0:8080
             - --health-probe-bind-address=0.0.0.0:10351
             - --enable-scheduler-estimator=true
@@ -47,16 +47,15 @@ spec:
             - --scheduler-estimator-key-file=/etc/karmada/pki/karmada.key
             - --v=4
           volumeMounts:
+            - name: karmada-config
+              mountPath: /etc/karmada/config
             - name: karmada-certs
               mountPath: /etc/karmada/pki
               readOnly: true
-            - name: kubeconfig
-              subPath: kubeconfig
-              mountPath: /etc/kubeconfig
       volumes:
+        - name: karmada-config
+          secret:
+            secretName: karmada-scheduler-config
         - name: karmada-certs
           secret:
             secretName: karmada-cert-secret
-        - name: kubeconfig
-          secret:
-            secretName: kubeconfig
diff --git a/artifacts/deploy/karmada-search.yaml b/artifacts/deploy/karmada-search.yaml
@@ -24,18 +24,11 @@ spec:
         - name: karmada-search
           image: docker.io/karmada/karmada-search:latest
           imagePullPolicy: IfNotPresent
-          volumeMounts:
-            - name: karmada-certs
-              mountPath: /etc/karmada/pki
-              readOnly: true
-            - name: kubeconfig
-              subPath: kubeconfig
-              mountPath: /etc/kubeconfig
           command:
             - /bin/karmada-search
-            - --kubeconfig=/etc/kubeconfig
-            - --authentication-kubeconfig=/etc/kubeconfig
-            - --authorization-kubeconfig=/etc/kubeconfig
+            - --kubeconfig=/etc/karmada/config/karmada.config
+            - --authentication-kubeconfig=/etc/karmada/config/karmada.config
+            - --authorization-kubeconfig=/etc/karmada/config/karmada.config
             - --etcd-servers=https://etcd-client.karmada-system.svc.cluster.local:2379
             - --etcd-cafile=/etc/karmada/pki/etcd-ca.crt
             - --etcd-certfile=/etc/karmada/pki/etcd-client.crt
@@ -58,13 +51,19 @@ spec:
           resources:
             requests:
               cpu: 100m
+          volumeMounts:
+            - name: karmada-config
+              mountPath: /etc/karmada/config
+            - name: karmada-certs
+              mountPath: /etc/karmada/pki
+              readOnly: true
       volumes:
+        - name: karmada-config
+          secret:
+            secretName: karmada-search-config
         - name: karmada-certs
           secret:
             secretName: karmada-cert-secret
-        - name: kubeconfig
-          secret:
-            secretName: kubeconfig
 ---
 apiVersion: v1
 kind: Service

diff --git a/artifacts/deploy/karmada-webhook.yaml b/artifacts/deploy/karmada-webhook.yaml
@@ -25,7 +25,7 @@ spec:
           imagePullPolicy: IfNotPresent
           command:
             - /bin/karmada-webhook
-            - --kubeconfig=/etc/kubeconfig
+            - --kubeconfig=/etc/karmada/config/karmada.config
             - --bind-address=0.0.0.0
             - --metrics-bind-address=:8080
             - --default-not-ready-toleration-seconds=30
@@ -38,22 +38,21 @@ spec:
             - containerPort: 8080
               name: metrics
               protocol: TCP
-          volumeMounts:
-            - name: kubeconfig
-              subPath: kubeconfig
-              mountPath: /etc/kubeconfig
-            - name: cert
-              mountPath: /var/serving-cert
-              readOnly: true
           readinessProbe:
             httpGet:
               path: /readyz
               port: 8443
               scheme: HTTPS
+          volumeMounts:
+            - name: karmada-config
+              mountPath: /etc/karmada/config
+            - name: cert
+              mountPath: /var/serving-cert
+              readOnly: true
       volumes:
-        - name: kubeconfig
+        - name: karmada-config
           secret:
-            secretName: kubeconfig
+            secretName: karmada-webhook-config
         - name: cert
           secret:
             secretName: webhook-cert

diff --git a/artifacts/deploy/kube-controller-manager.yaml b/artifacts/deploy/kube-controller-manager.yaml
@@ -31,20 +31,21 @@ spec:
                     values:
                       - kube-controller-manager
               topologyKey: kubernetes.io/hostname
+      priorityClassName: system-node-critical
       containers:
         - command:
             - kube-controller-manager
             - --allocate-node-cidrs=true
-            - --authentication-kubeconfig=/etc/kubeconfig
-            - --authorization-kubeconfig=/etc/kubeconfig
+            - --kubeconfig=/etc/karmada/config/karmada.config
+            - --authentication-kubeconfig=/etc/karmada/config/karmada.config
+            - --authorization-kubeconfig=/etc/karmada/config/karmada.config
             - --bind-address=0.0.0.0
             - --client-ca-file=/etc/karmada/pki/ca.crt
             - --cluster-cidr=10.244.0.0/16
             - --cluster-name=karmada
             - --cluster-signing-cert-file=/etc/karmada/pki/ca.crt
             - --cluster-signing-key-file=/etc/karmada/pki/ca.key
             - --controllers=namespace,garbagecollector,serviceaccount-token,ttl-after-finished,bootstrapsigner,tokencleaner,csrapproving,csrcleaner,csrsigning,clusterrole-aggregation
-            - --kubeconfig=/etc/kubeconfig
             - --leader-elect=true
             - --node-cidr-mask-size=24
             - --root-ca-file=/etc/karmada/pki/ca.crt
@@ -69,17 +70,15 @@ spec:
             requests:
               cpu: 200m
           volumeMounts:
+            - name: karmada-config
+              mountPath: /etc/karmada/config
             - mountPath: /etc/karmada/pki
               name: karmada-certs
               readOnly: true
-            - mountPath: /etc/kubeconfig
-              subPath: kubeconfig
-              name: kubeconfig
-      priorityClassName: system-node-critical
       volumes:
+        - name: karmada-config
+          secret:
+            secretName: kube-controller-manager-config
         - name: karmada-certs
           secret:
             secretName: karmada-cert-secret
-        - name: kubeconfig
-          secret:
-            secretName: kubeconfig
diff --git a/artifacts/deploy/secret.yaml b/artifacts/deploy/secret.yaml