migrate controller poolcoordinatorcert (openyurtio#1336)

charts/openyurt/templates/yurt-manager-auto-generated.yaml

@@ -503,6 +503,24 @@ metadata:
   creationTimestamp: null
   name: yurt-manager-role
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - secret
+  verbs:
+  - create
+  - get
+  - list
+  - patch
+  - update
 - apiGroups:
   - admissionregistration.k8s.io
   resources:
@@ -558,6 +576,7 @@ rules:
   resources:
   - certificatesigningrequests
   verbs:
+  - create
   - get
   - list
   - watch

charts/openyurt/templates/yurt-manager.yaml

@@ -60,11 +60,11 @@ spec:
           command:
             - /usr/local/bin/yurt-manager
           image: {{ .Values.yurtManager.image.repository }}:{{ .Values.yurtManager.image.tag }}
-          imagePullPolicy: Always
+          imagePullPolicy: IfNotPresent
           name: yurt-manager
           env:
             - name: WEBHOOK_PORT
-              value: {{ .Values.yurtManager.webhook.port }}
+              value: {{ .Values.yurtManager.webhook.port | quote }}
           ports:
             - containerPort: {{ .Values.yurtManager.webhook.port }}
               name: webhook-server

charts/openyurt/values.yaml

@@ -1,4 +1,3 @@
-
 imagePullSecrets: []
 imagePullPolicy: IfNotPresent
 
@@ -57,12 +56,12 @@ yurtManager:
     requests:
       cpu: 100m
       memory: 256Mi
-  affinity: 
+  affinity:
     nodeAffinity:
       requiredDuringSchedulingIgnoredDuringExecution:
         nodeSelectorTerms:
-        - matchExpressions:
-          - key: openyurt.io/is-edge-worker
-            operator: In
-            values:
-            - "false"
+          - matchExpressions:
+              - key: openyurt.io/is-edge-worker
+                operator: In
+                values:
+                  - "false"

cmd/yurt-controller-manager/app/controllermanager.go

@@ -309,7 +309,6 @@ var ControllersDisabledByDefault = sets.NewString()
 // paired to their InitFunc.  This allows for structured downstream composition and subdivision.
 func NewControllerInitializers() map[string]InitFunc {
 	controllers := map[string]InitFunc{}
-	controllers["poolcoordinatorcertmanager"] = startPoolCoordinatorCertManager
 	controllers["poolcoordinator"] = startPoolCoordinatorController
 	controllers["daemonpodupdater"] = startDaemonPodUpdaterController
 	controllers["servicetopologycontroller"] = startServiceTopologyController

cmd/yurt-controller-manager/app/core.go

@@ -25,21 +25,11 @@ import (
 	"net/http"
 
 	daemonpodupdater "github.com/openyurtio/openyurt/pkg/controller/daemonpodupdater"
-	poolcoordinatorcertmanager "github.com/openyurtio/openyurt/pkg/controller/poolcoordinator/cert"
 	poolcoordinator "github.com/openyurtio/openyurt/pkg/controller/poolcoordinator/delegatelease"
 	"github.com/openyurtio/openyurt/pkg/controller/poolcoordinator/podbinding"
 	"github.com/openyurtio/openyurt/pkg/controller/servicetopology"
 )
 
-func startPoolCoordinatorCertManager(ctx ControllerContext) (http.Handler, bool, error) {
-	poolcoordinatorCertManager := poolcoordinatorcertmanager.NewPoolCoordinatorCertManager(
-		ctx.ClientBuilder.ClientOrDie("poolcoordinator-cert-manager"),
-		ctx.InformerFactory.Core().V1().Pods(),
-	)
-	go poolcoordinatorCertManager.Run(1, ctx.Stop)
-	return nil, true, nil
-}
-
 func startPoolCoordinatorController(ctx ControllerContext) (http.Handler, bool, error) {
 	poolcoordinatorController := poolcoordinator.NewController(
 		ctx.ClientBuilder.ClientOrDie("poolcoordinator-delegate-lease"),

pkg/controller/add_poolcoordinatorcert.go

@@ -0,0 +1,30 @@
+/*
+Copyright 2023 The OpenYurt Authors.
+
+Licensed under the Apache License, Version 2.0 (the License);
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an AS IS BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controller
+
+import (
+	poolcoordinatorcert "github.com/openyurtio/openyurt/pkg/controller/poolcoordinator/cert"
+)
+
+// Note !!! @kadisi
+// Do not change the name of the file @kadisi
+// Auto generate by make addcontroller command !!!
+// Note !!!
+
+func init() {
+	controllerAddFuncs = append(controllerAddFuncs, poolcoordinatorcert.Add)
+}

pkg/controller/poolcoordinator/cert/certificate.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package cert
+package poolcoordinatorcert
 
 import (
 	"context"
@@ -200,7 +200,7 @@ func IsCertFromCA(cert *x509.Certificate, caCert *x509.Certificate) bool {
 	}
 
 	if _, err := cert.Verify(verifyOptions); err != nil {
-		klog.Infof("cert not authorized by current CA: %v", err)
+		klog.Infof(Format("cert not authorized by current CA: %v", err))
 		return false
 	}
 
@@ -301,10 +301,10 @@ func GetCertAndKeyFromCertMgr(certManager certificate.Manager, stopCh <-chan str
 	err = wait.PollUntil(5*time.Second, func() (bool, error) {
 		// keep polling until the certificate is signed
 		if certManager.Current() != nil {
-			klog.Infof("%s certificate signed successfully", ComponentName)
+			klog.Infof(Format("%s certificate signed successfully", ComponentName))
 			return true, nil
 		}
-		klog.Infof("waiting for the master to sign the %s certificate", ComponentName)
+		klog.Infof(Format("waiting for the master to sign the %s certificate", ComponentName))
 		return false, nil
 	}, stopCh)
 
@@ -349,7 +349,7 @@ func WriteCertIntoSecret(clientSet client.Interface, certName, secretName string
 		return err
 	}
 
-	klog.Infof("successfully write %s cert/key pair into %s", certName, secretName)
+	klog.Infof(Format("successfully write %s cert/key pair into %s", certName, secretName))
 
 	return nil
 }
@@ -385,7 +385,7 @@ func WriteCertAndKeyIntoSecret(clientSet client.Interface, certName, secretName
 		}
 	}
 
-	klog.Infof("successfully write %s cert/key into %s", certName, secretName)
+	klog.Infof(Format("successfully write %s cert/key into %s", certName, secretName))
 
 	return nil
 }
@@ -400,7 +400,7 @@ func WriteKubeConfigIntoSecret(clientSet client.Interface, secretName, kubeConfi
 		return err
 	}
 
-	klog.Infof("successfully write kubeconfig into secret %s", secretName)
+	klog.Infof(Format("successfully write kubeconfig into secret %s", secretName))
 
 	return nil
 }
@@ -430,7 +430,7 @@ func WriteKeyPairIntoSecret(clientSet client.Interface, secretName, keyName stri
 		return errors.Wrapf(err, "fail to write %s.pub into secret %s", keyName, secretName)
 	}
 
-	klog.Infof("successfully write key pair into secret %s", secretName)
+	klog.Infof(Format("successfully write key pair into secret %s", secretName))
 
 	return nil
 }

pkg/controller/poolcoordinator/cert/certificate_test.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package cert
+package poolcoordinatorcert
 
 import (
 	"crypto/x509"