bugfix: update clusterrole and certificate for yurt-tunnel-server and fix kubeconfig path error for yurtctl

config/setup/yurt-tunnel-server.yaml

@@ -29,9 +29,7 @@ rules:
 - apiGroups:
   - ""
   resources:
-  - services
   - endpoints
-  - configmaps
   verbs:
   - get
 - apiGroups:
@@ -41,6 +39,32 @@ rules:
   verbs:
   - list
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - list
+  - watch
+  - get
+  - create
+  - update
+- apiGroups:
+  - "coordination.k8s.io"
+  resources:
+  - leases
+  verbs:
+  - create
+  - get
+  - update
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1beta1

config/yaml-template/yurt-tunnel-server.yaml

@@ -27,20 +27,44 @@ rules:
   verbs:
   - approve
 - apiGroups:
-  - ""
+    - ""
   resources:
-  - services
-  - endpoints
-  - configmaps
+    - endpoints
   verbs:
-  - get
+    - get
 - apiGroups:
-  - ""
+    - ""
   resources:
-  - nodes
+    - nodes
   verbs:
-  - list
-  - watch
+    - list
+    - watch
+- apiGroups:
+    - ""
+  resources:
+    - services
+  verbs:
+    - get
+    - list
+    - watch
+- apiGroups:
+    - ""
+  resources:
+    - configmaps
+  verbs:
+    - list
+    - watch
+    - get
+    - create
+    - update
+- apiGroups:
+    - "coordination.k8s.io"
+  resources:
+    - leases
+  verbs:
+    - create
+    - get
+    - update
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1beta1

pkg/yurtctl/cmd/revert/revert.go

@@ -263,7 +263,7 @@ func removeYurtTunnelServer(client *kubernetes.Clientset) error {
 		return fmt.Errorf("fail to delete the daemonset/%s: %s",
 			constants.YurttunnelServerComponentName, err)
 	}
-	klog.V(4).Infof("daemonset/%s is deleted", constants.YurttunnelServerComponentName)
+	klog.V(4).Infof("deployment/%s is deleted", constants.YurttunnelServerComponentName)
 
 	// 2.1 remove the Service
 	if err := client.CoreV1().Services(constants.YurttunnelNamespace).

pkg/yurtctl/constants/yurt-tunnel-server-tmpl.go

@@ -49,9 +49,7 @@ rules:
 - apiGroups:
   - ""
   resources:
-  - services
   - endpoints
-  - configmaps
   verbs:
   - get
 - apiGroups:
@@ -61,6 +59,32 @@ rules:
   verbs:
   - list
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - list
+  - watch
+  - get
+  - create
+  - update
+- apiGroups:
+  - "coordination.k8s.io"
+  resources:
+  - leases
+  verbs:
+  - create
+  - get
+  - update
 `
 	YurttunnelServerServiceAccount = `
 apiVersion: v1

pkg/yurtctl/util/edgenode/util.go

@@ -177,7 +177,7 @@ func PrepareKubeConfigPath(flags *pflag.FlagSet) (string, error) {
 	if kbCfgPath == "" {
 		if home := homedir.HomeDir(); home != "" {
 			homeKbCfg := filepath.Join(home, ".kube", "config")
-			if ok, _ := FileExists(kbCfgPath); ok {
+			if ok, _ := FileExists(homeKbCfg); ok {
 				kbCfgPath = homeKbCfg
 			}
 		}

pkg/yurttunnel/pki/certmanager/certmanager.go

@@ -55,23 +55,25 @@ func NewYurttunnelServerCertManager(
 	)
 	_ = wait.PollUntil(5*time.Second, func() (bool, error) {
 		dnsNames, ips, err = serveraddr.GetYurttunelServerDNSandIP(clientset)
-		if err == nil {
-			return true, nil
+		if err != nil {
+			return false, err
 		}
 
 		// get clusterIP for tunnel server internal service
 		svc, err := clientset.CoreV1().Services(constants.YurttunnelServerServiceNs).Get(context.Background(), constants.YurttunnelServerInternalServiceName, metav1.GetOptions{})
-		if err == nil {
-			if svc.Spec.ClusterIP != "" && net.ParseIP(svc.Spec.ClusterIP) != nil {
-				ips = append(ips, net.ParseIP(svc.Spec.ClusterIP))
-			}
-		} else if errors.IsNotFound(err) {
-			// compatible with versions that not supported dns
+		if errors.IsNotFound(err) {
+			// compatible with versions that not supported x-tunnel-server-internal-svc
 			return true, nil
+		} else if err != nil {
+			return false, err
+		}
+
+		if svc.Spec.ClusterIP != "" && net.ParseIP(svc.Spec.ClusterIP) != nil {
+			ips = append(ips, net.ParseIP(svc.Spec.ClusterIP))
+			dnsNames = append(dnsNames, serveraddr.GetDefaultDomainsForSvc(svc.Namespace, svc.Name)...)
 		}
 
-		klog.Errorf("failed to get DNS names and ips: %s", err)
-		return false, nil
+		return true, nil
 	}, stopCh)
 	// add user specified DNS anems and IP addresses
 	dnsNames = append(dnsNames, clCertNames...)
@@ -139,6 +141,7 @@ func newCertManager(
 		ClientFn: func(current *tls.Certificate) (clicert.CertificateSigningRequestInterface, error) {
 			return clientset.CertificatesV1beta1().CertificateSigningRequests(), nil
 		},
+		SignerName:  certificates.LegacyUnknownSignerName,
 		GetTemplate: getTemplate,
 		Usages: []certificates.KeyUsage{
 			certificates.UsageAny,

pkg/yurttunnel/server/serveraddr/addr.go

@@ -169,7 +169,7 @@ func extractTunnelServerDNSandIPs(svc *v1.Service, eps *v1.Endpoints, nodeLst *v
 	}
 
 	// extract dns and ip from ClusterIP info
-	dnsNames = append(dnsNames, getDefaultDomainsForSvc(svc.Namespace, svc.Name)...)
+	dnsNames = append(dnsNames, GetDefaultDomainsForSvc(svc.Namespace, svc.Name)...)
 	if svc.Spec.ClusterIP != "None" {
 		ips = append(ips, net.ParseIP(svc.Spec.ClusterIP))
 	}
@@ -266,7 +266,7 @@ func getNodePortDNSandIP(nodeLst *v1.NodeList) ([]string, []net.IP, error) {
 }
 
 // getDefaultDomainsForSvc get default domains for specified service
-func getDefaultDomainsForSvc(ns, name string) []string {
+func GetDefaultDomainsForSvc(ns, name string) []string {
 	domains := make([]string, 0)
 	if len(ns) == 0 || len(name) == 0 {
 		return domains

pkg/yurttunnel/server/serveraddr/addr_test.go

@@ -28,7 +28,7 @@ import (
 )
 
 func TestGetDefaultDomainsForSvcInputParamEmptyChar(t *testing.T) {
-	domains := getDefaultDomainsForSvc("", "")
+	domains := GetDefaultDomainsForSvc("", "")
 	if len(domains) != 0 {
 		t.Error("domains len is not equal zero")
 	}
@@ -37,7 +37,7 @@ func TestGetDefaultDomainsForSvcInputParamEmptyChar(t *testing.T) {
 func TestGetDefaultDomainsForSvc(t *testing.T) {
 	ns := "hello"
 	name := "world"
-	domains := getDefaultDomainsForSvc(ns, name)
+	domains := GetDefaultDomainsForSvc(ns, name)
 	if len(domains) == 0 {
 		t.Log("domains len is zero")
 	} else {