Update job name and service name as configurable for cert generator (#…

…1889)

* add more flags

* rename

* add service validation

* add service read permission

Co-authored-by: shaowei su <shaowei.su@airbnb.com>

manifests/v1beta1/components/cert-generator/rbac.yaml

@@ -7,6 +7,7 @@ rules:
  - ""
  resources:
  - secrets
+ - services
  verbs:
  - get
  - create

pkg/cert-generator/v1beta1/generate/generate.go

@@ -39,6 +39,8 @@ import (
 // generateOptions contains values for all certificates.
 type generateOptions struct {
  namespace string
+ serviceName string
+ jobName string
  fullServiceDomain string
 }
 
@@ -59,12 +61,20 @@ func NewGenerateCmd(kubeClient client.Client) *cobra.Command {
  }
  f := cmd.Flags()
  f.StringVarP(&o.namespace, "namespace", "n", "kubeflow", "set namespace")
+ f.StringVarP(&o.jobName, "jobName", "j", consts.JobName, "set job name")
+ f.StringVarP(&o.serviceName, "serviceName", "s", consts.Service, "set service name")
  return cmd
 }
 
 // run is main function for `generate` subcommand.
 func (o *generateOptions) run(ctx context.Context, kubeClient client.Client) error {
- o.fullServiceDomain = strings.Join([]string{consts.Service, o.namespace, "svc"}, ".")
+ controllerService := &corev1.Service{}
+ if err := kubeClient.Get(ctx, client.ObjectKey{Namespace: o.namespace, Name: o.serviceName}, controllerService); err != nil {
+ klog.Errorf("Unable to locate controller service: %s", o.serviceName)
+ return err
+ }
+
+ o.fullServiceDomain = strings.Join([]string{o.serviceName, o.namespace, "svc"}, ".")
 
  caKeyPair, err := o.createCACert()
  if err != nil {
@@ -127,8 +137,8 @@ func (o *generateOptions) createCert(caKeyPair *certificates) (*certificates, er
  CommonName: o.fullServiceDomain,
  },
  DNSNames: []string{
- consts.Service,
- strings.Join([]string{consts.Service, o.namespace}, "."),
+ o.serviceName,
+ strings.Join([]string{o.serviceName, o.namespace}, "."),
  o.fullServiceDomain,
  },
  NotBefore: now,
@@ -156,7 +166,7 @@ func (o *generateOptions) createCert(caKeyPair *certificates) (*certificates, er
 func (o *generateOptions) createWebhookCertSecret(ctx context.Context, kubeClient client.Client, caKeyPair *certificates, keyPair *certificates) error {
 
  certGeneratorJob := &batchv1.Job{}
- if err := kubeClient.Get(ctx, client.ObjectKey{Namespace: o.namespace, Name: consts.JobName}, certGeneratorJob); err != nil {
+ if err := kubeClient.Get(ctx, client.ObjectKey{Namespace: o.namespace, Name: o.jobName}, certGeneratorJob); err != nil {
  return err
  }
 
@@ -177,7 +187,7 @@ func (o *generateOptions) createWebhookCertSecret(ctx context.Context, kubeClien
  APIVersion: "batch/v1",
  Kind: "Job",
  Controller: &isController,
- Name: consts.JobName,
+ Name: o.jobName,
  UID: jobUID,
  },
  },

pkg/cert-generator/v1beta1/generate/generate_test.go

@@ -85,7 +85,6 @@ func TestGenerate(t *testing.T) {
  },
  },
  }
-
  oldWebhookCertSecret := &corev1.Secret{
  TypeMeta: metav1.TypeMeta{
  Kind: "Secret",
@@ -96,6 +95,16 @@ func TestGenerate(t *testing.T) {
  Namespace: testNamespace,
  },
  }
+ testControllerService := &corev1.Service{
+ TypeMeta: metav1.TypeMeta{
+ Kind: "Service",
+ APIVersion: "v1",
+ },
+ ObjectMeta: metav1.ObjectMeta{
+ Name: consts.Service,
+ Namespace: testNamespace,
+ },
+ }
 
  tests := []struct {
  testDescription string
@@ -109,6 +118,7 @@ func TestGenerate(t *testing.T) {
  testGeneratorJob,
  testValidatingWebhook,
  testMutatingWebhook,
+ testControllerService,
  },
  },
  {
@@ -119,6 +129,7 @@ func TestGenerate(t *testing.T) {
  testValidatingWebhook,
  testMutatingWebhook,
  oldWebhookCertSecret,
+ testControllerService,
  },
  },
  {
@@ -127,6 +138,7 @@ func TestGenerate(t *testing.T) {
  objects: []client.Object{
  testValidatingWebhook,
  testMutatingWebhook,
+ testControllerService,
  },
  },
  {
@@ -135,6 +147,7 @@ func TestGenerate(t *testing.T) {
  objects: []client.Object{
  testGeneratorJob,
  testMutatingWebhook,
+ testControllerService,
  },
  },
  {
@@ -143,6 +156,15 @@ func TestGenerate(t *testing.T) {
  objects: []client.Object{
  testGeneratorJob,
  testValidatingWebhook,
+ testControllerService,
+ },
+ },
+ {
+ testDescription: "There is no Service katib-controller",
+ err: true,
+ objects: []client.Object{
+ testGeneratorJob,
+ testMutatingWebhook,
  },
  },
  }