Skip to content

Commit 6da05cd

Browse files
acornett21acornett21
authored
Add parameter for service account name to all ackgenerate methods (#270)
Issue #, if available: - Fixes: aws-controllers-k8s/community#777 Description of changes: The goal of this is to move away from using the default service account. It seems this might have been done with the helm charts/templates, but was not ported to the Kustomization files. This means each operator/controller would have its own service account. Things that changed are below: - Refactored build so that ServiceAccountName is available in ack-generate controller process as well as ack-generate release process - added in `/rbac/service-account.yaml.tpl` to create a service account, and then referece this account in the `Deployment` and `ClusterRoleBinding` - Refactored build/release `sh` files to add in `ACK_GENERATE_SERVICE_ACCOUNT_NAME` to be used in both build and release process - Reordered some of the variables in the `sh` files so that if there is an error in the build/release process the `Default` values are actually presented to the user (currently they show up as blank since the variables are not initilaized before the `USAGE` variable) - **NOTE:** This changes the service account name in the `helm` process as well. It changes it from `ack-$SERVICE-controller` to `ack-$SERVICE-service-account`. I am not sure if this is backwards compatible for when a controller is installed/updated via a helm deployment. By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license. Signed-off-by: Adam D. Cornett <adc@redhat.com>
1 parent d2ebb1c commit 6da05cd

File tree

12 files changed

+78
-45
lines changed

12 files changed

+78
-45
lines changed

‎cmd/ack-generate/command/common.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -284,3 +284,13 @@ func getLatestAPIVersion() (string, error) {
284284
})
285285
return versions[len(versions)-1], nil
286286
}
287+
288+
// getServiceAccountName gets the service account name from the optional flag passed into ack-generate
289+
func getServiceAccountName() (string, error) {
290+
291+
if optServiceAccountName != "" {
292+
return optServiceAccountName, nil
293+
}
294+
295+
return "", fmt.Errorf("service account name not set")
296+
}

‎cmd/ack-generate/command/controller.go‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,11 @@ func generateController(cmd *cobra.Command, args []string) error {
6363
if err != nil {
6464
return err
6565
}
66-
ts, err := ackgenerate.Controller(m, optTemplateDirs)
66+
serviceAccountName, err := getServiceAccountName()
67+
if err != nil {
68+
return err
69+
}
70+
ts, err := ackgenerate.Controller(m, optTemplateDirs, serviceAccountName)
6771
if err != nil {
6872
return err
6973
}

‎cmd/ack-generate/command/release.go‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,8 @@ import (
2727
)
2828

2929
var (
30-
optReleaseOutputPath string
31-
optImageRepository string
32-
optServiceAccountName string
30+
optReleaseOutputPath string
31+
optImageRepository string
3332
)
3433

3534
var releaseCmd = &cobra.Command{
@@ -42,9 +41,6 @@ func init() {
4241
releaseCmd.PersistentFlags().StringVar(
4342
&optImageRepository, "image-repository", "", "the Docker image repository to use in release artifacts. Defaults to 'public.ecr.aws/aws-controllers-k8s/$service-controller'",
4443
)
45-
releaseCmd.PersistentFlags().StringVar(
46-
&optServiceAccountName, "service-account-name", "default", "The name of the ServiceAccount AND ClusterRole used for ACK service controller",
47-
)
4844
releaseCmd.PersistentFlags().StringVarP(
4945
&optReleaseOutputPath, "output", "o", "", "path to root directory to create generated files. Defaults to "+optServicesDir+"/$service",
5046
)

‎cmd/ack-generate/command/root.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ var (
4343
optGeneratorConfigPath string
4444
optMetadataConfigPath string
4545
optOutputPath string
46+
optServiceAccountName string
4647
)
4748

4849
var rootCmd = &cobra.Command{
@@ -121,6 +122,9 @@ func init() {
121122
rootCmd.PersistentFlags().StringVar(
122123
&optAWSSDKGoVersion, "aws-sdk-go-version", "", "Version of github.com/aws/aws-sdk-go used to generate apis and controllers files",
123124
)
125+
rootCmd.PersistentFlags().StringVar(
126+
&optServiceAccountName, "service-account-name", "", "The name of the ServiceAccount used for ACK service controller",
127+
)
124128
}
125129

126130
// Execute adds all child commands to the root command and sets flags

‎pkg/generate/ack/controller.go‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ var (
3535
"config/rbac/cluster-role-binding.yaml.tpl",
3636
"config/rbac/role-reader.yaml.tpl",
3737
"config/rbac/role-writer.yaml.tpl",
38+
"config/rbac/service-account.yaml.tpl",
3839
"config/rbac/kustomization.yaml.tpl",
3940
"config/crd/kustomization.yaml.tpl",
4041
"config/overlays/namespaced/kustomization.yaml.tpl",
@@ -167,6 +168,8 @@ var (
167168
func Controller(
168169
m *ackmodel.Model,
169170
templateBasePaths []string,
171+
// serviceAccountName is the name of the ServiceAccount used in the Helm chart
172+
serviceAccountName string,
170173
) (*templateset.TemplateSet, error) {
171174
crds, err := m.GetCRDs()
172175
if err != nil {
@@ -227,6 +230,7 @@ func Controller(
227230
configVars := &templateConfigVars{
228231
metaVars,
229232
m.GetConfig(),
233+
serviceAccountName,
230234
}
231235
if err = ts.Add("pkg/resource/registry.go", "pkg/resource/registry.go.tpl", configVars); err != nil {
232236
return nil, err
@@ -253,7 +257,7 @@ func Controller(
253257
// Finally, add the configuration YAML file templates
254258
for _, path := range controllerConfigTemplatePaths {
255259
outPath := strings.TrimSuffix(path, ".tpl")
256-
if err = ts.Add(outPath, path, metaVars); err != nil {
260+
if err = ts.Add(outPath, path, configVars); err != nil {
257261
return nil, err
258262
}
259263
}
@@ -271,5 +275,6 @@ type templateCmdVars struct {
271275
// access to the generator configuration definition
272276
type templateConfigVars struct {
273277
templateset.MetaVars
274-
GeneratorConfig *ackgenconfig.Config
278+
GeneratorConfig *ackgenconfig.Config
279+
ServiceAccountName string
275280
}

‎pkg/generate/ack/release.go‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -60,8 +60,7 @@ func Release(
6060
// imageRepository is the Docker image repository to use when generating
6161
// release files
6262
imageRepository string,
63-
// serviceAccountName is the name of the ServiceAccount and ClusterRole
64-
// used in the Helm chart
63+
// serviceAccountName is the name of the ServiceAccount used in the Helm chart
6564
serviceAccountName string,
6665
) (*templateset.TemplateSet, error) {
6766
ts := templateset.New(
@@ -100,7 +99,6 @@ type templateReleaseVars struct {
10099
// ImageRepository is the Docker image repository to inject into the Helm
101100
// values template
102101
ImageRepository string
103-
// ServiceAccountName is the name of the service account and cluster role
104-
// created by the Helm chart
102+
// ServiceAccountName is the name of the ServiceAccount used in the Helm chart
105103
ServiceAccountName string
106104
}

‎scripts/build-controller-release.sh‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ ACK_GENERATE_API_VERSION=${ACK_GENERATE_API_VERSION:-"v1alpha1"}
3434
ACK_GENERATE_CONFIG_PATH=${ACK_GENERATE_CONFIG_PATH:-""}
3535
ACK_METADATA_CONFIG_PATH=${ACK_METADATA_CONFIG_PATH:-""}
3636
AWS_SDK_GO_VERSION=${AWS_SDK_GO_VERSION:-""}
37+
ACK_GENERATE_SERVICE_ACCOUNT_NAME=${ACK_GENERATE_SERVICE_ACCOUNT_NAME:-"ack-$SERVICE-controller"}
3738

3839
DEFAULT_TEMPLATES_DIR="$ROOT_DIR/../../aws-controllers-k8s/code-generator/templates"
3940
TEMPLATES_DIR=${TEMPLATES_DIR:-$DEFAULT_TEMPLATES_DIR}
@@ -42,6 +43,7 @@ DEFAULT_RUNTIME_DIR="$ROOT_DIR/../runtime"
4243
RUNTIME_DIR=${RUNTIME_DIR:-$DEFAULT_RUNTIME_DIR}
4344
RUNTIME_API_VERSION=${RUNTIME_API_VERSION:-"v1alpha1"}
4445
NON_RELEASE_VERSION="v0.0.0-non-release-version"
46+
K8S_RBAC_ROLE_NAME=${K8S_RBAC_ROLE_NAME:-"ack-$SERVICE-controller"}
4547

4648
USAGE="
4749
Usage:
@@ -157,9 +159,6 @@ if [[ $RELEASE_VERSION != $NON_RELEASE_VERSION ]]; then
157159
fi
158160
fi
159161

160-
K8S_RBAC_ROLE_NAME=${K8S_RBAC_ROLE_NAME:-"ack-$SERVICE-controller"}
161-
ACK_GENERATE_SERVICE_ACCOUNT_NAME=${ACK_GENERATE_SERVICE_ACCOUNT_NAME:-"ack-$SERVICE-controller"}
162-
163162
if [ -z "$AWS_SDK_GO_VERSION" ]; then
164163
AWS_SDK_GO_VERSION=$(go list -m -f '{{ .Version }}' -modfile $SERVICE_CONTROLLER_SOURCE_PATH/go.mod github.com/aws/aws-sdk-go)
165164
fi

‎scripts/build-controller.sh‎

Lines changed: 36 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,11 @@ ACK_GENERATE_BIN_PATH=${ACK_GENERATE_BIN_PATH:-$DEFAULT_ACK_GENERATE_BIN_PATH}
2626
ACK_GENERATE_API_VERSION=${ACK_GENERATE_API_VERSION:-"v1alpha1"}
2727
ACK_GENERATE_CONFIG_PATH=${ACK_GENERATE_CONFIG_PATH:-""}
2828
ACK_METADATA_CONFIG_PATH=${ACK_METADATA_CONFIG_PATH:-""}
29+
ACK_GENERATE_SERVICE_ACCOUNT_NAME=${ACK_GENERATE_SERVICE_ACCOUNT_NAME:-"ack-$SERVICE-controller"}
2930
AWS_SDK_GO_VERSION=${AWS_SDK_GO_VERSION:-""}
3031
DEFAULT_RUNTIME_CRD_DIR="$ROOT_DIR/../../aws-controllers-k8s/runtime/config"
3132
RUNTIME_CRD_DIR=${RUNTIME_CRD_DIR:-$DEFAULT_RUNTIME_CRD_DIR}
33+
K8S_RBAC_ROLE_NAME=${K8S_RBAC_ROLE_NAME:-"ack-$SERVICE-controller"}
3234

3335
USAGE="
3436
Usage:
@@ -38,32 +40,35 @@ Usage:
3840
's3' 'sns' or 'sqs'
3941
4042
Environment variables:
41-
ACK_GENERATE_CACHE_DIR: Overrides the directory used for caching AWS API
42-
models used by the ack-generate tool.
43-
Default: $ACK_GENERATE_CACHE_DIR
44-
ACK_GENERATE_BIN_PATH: Overrides the path to the the ack-generate binary.
45-
Default: $ACK_GENERATE_BIN_PATH
46-
ACK_GENERATE_API_VERSION: Overrides the version of the Kubernetes API objects
47-
generated by the ack-generate apis command. If not
48-
specified, and the service controller has been
49-
previously generated, the latest generated API
50-
version is used. If the service controller has yet
51-
to be generated, 'v1alpha1' is used.
52-
ACK_GENERATE_CONFIG_PATH: Specify a path to the generator config YAML file to
53-
instruct the code generator for the service.
54-
Default: generator.yaml
55-
ACK_METADATA_CONFIG_PATH: Specify a path to the metadata config YAML file to
56-
instruct the code generator for the service.
57-
Default: metadata.yaml
58-
AWS_SDK_GO_VERSION: Overrides the version of github.com/aws/aws-sdk-go used
59-
by 'ack-generate' to fetch the service API Specifications.
60-
Default: Version of aws/aws-sdk-go in service go.mod
61-
TEMPLATES_DIR: Overrides the directory containg ack-generate templates
62-
Default: $TEMPLATES_DIR
63-
K8S_RBAC_ROLE_NAME: Name of the Kubernetes Role to use when generating
64-
the RBAC manifests for the custom resource
65-
definitions.
66-
Default: $K8S_RBAC_ROLE_NAME
43+
ACK_GENERATE_CACHE_DIR: Overrides the directory used for caching AWS API
44+
models used by the ack-generate tool.
45+
Default: $ACK_GENERATE_CACHE_DIR
46+
ACK_GENERATE_BIN_PATH: Overrides the path to the the ack-generate binary.
47+
Default: $ACK_GENERATE_BIN_PATH
48+
ACK_GENERATE_API_VERSION: Overrides the version of the Kubernetes API objects
49+
generated by the ack-generate apis command. If not
50+
specified, and the service controller has been
51+
previously generated, the latest generated API
52+
version is used. If the service controller has yet
53+
to be generated, 'v1alpha1' is used.
54+
ACK_GENERATE_CONFIG_PATH: Specify a path to the generator config YAML file to
55+
instruct the code generator for the service.
56+
Default: generator.yaml
57+
ACK_METADATA_CONFIG_PATH: Specify a path to the metadata config YAML file to
58+
instruct the code generator for the service.
59+
Default: metadata.yaml
60+
ACK_GENERATE_SERVICE_ACCOUNT_NAME: Name of the Kubernetes Service Account and
61+
Cluster Role to use in Helm chart.
62+
Default: $ACK_GENERATE_SERVICE_ACCOUNT_NAME
63+
AWS_SDK_GO_VERSION: Overrides the version of github.com/aws/aws-sdk-go used
64+
by 'ack-generate' to fetch the service API Specifications.
65+
Default: Version of aws/aws-sdk-go in service go.mod
66+
TEMPLATES_DIR: Overrides the directory containg ack-generate templates
67+
Default: $TEMPLATES_DIR
68+
K8S_RBAC_ROLE_NAME: Name of the Kubernetes Role to use when generating
69+
the RBAC manifests for the custom resource
70+
definitions.
71+
Default: $K8S_RBAC_ROLE_NAME
6772
"
6873

6974
if [ $# -ne 1 ]; then
@@ -119,9 +124,8 @@ if [[ -d "$SERVICE_CONTROLLER_SOURCE_PATH/templates" ]]; then
119124
BOILERPLATE_TXT_PATH="$SERVICE_CONTROLLER_SOURCE_PATH/templates/boilerplate.txt"
120125
fi
121126
fi
122-
TEMPLATE_DIRS=${TEMPLATE_DIRS:-$DEFAULT_TEMPLATE_DIRS}
123127

124-
K8S_RBAC_ROLE_NAME=${K8S_RBAC_ROLE_NAME:-"ack-$SERVICE-controller"}
128+
TEMPLATE_DIRS=${TEMPLATE_DIRS:-$DEFAULT_TEMPLATE_DIRS}
125129

126130
config_output_dir="$SERVICE_CONTROLLER_SOURCE_PATH/config/"
127131

@@ -174,6 +178,10 @@ if [ -n "$AWS_SDK_GO_VERSION" ]; then
174178
apis_args="$apis_args --aws-sdk-go-version $AWS_SDK_GO_VERSION"
175179
fi
176180

181+
if [ -n "$ACK_GENERATE_SERVICE_ACCOUNT_NAME" ]; then
182+
ag_args="$ag_args --service-account-name $ACK_GENERATE_SERVICE_ACCOUNT_NAME"
183+
fi
184+
177185
echo "Building Kubernetes API objects for $SERVICE"
178186
$ACK_GENERATE_BIN_PATH $apis_args
179187
if [ $? -ne 0 ]; then

‎templates/config/controller/deployment.yaml.tpl‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ spec:
6161
drop:
6262
- ALL
6363
terminationGracePeriodSeconds: 10
64+
serviceAccountName: {{ .ServiceAccountName }}
6465
hostIPC: false
6566
hostNetwork: false
6667
hostPID: false

‎templates/config/rbac/cluster-role-binding.yaml.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,5 +8,5 @@ roleRef:
88
name: ack-{{ .ServicePackageName }}-controller
99
subjects:
1010
- kind: ServiceAccount
11-
name: default
11+
name: {{ .ServiceAccountName }}
1212
namespace: ack-system

0 commit comments

Comments
 (0)