-
customLabelDomain
string
diff --git a/imagevector/images.go b/imagevector/images.go
index c7e393d5..9d8cdeb8 100644
--- a/imagevector/images.go
+++ b/imagevector/images.go
@@ -31,8 +31,8 @@ const (
ImageNameMachineControllerManagerProviderOpenstack = "machine-controller-manager-provider-openstack"
// ImageNameMachineControllerManagerProviderStackit is a constant for an image in the image vector with name 'machine-controller-manager-provider-stackit'.
ImageNameMachineControllerManagerProviderStackit = "machine-controller-manager-provider-stackit"
- // ImageNameStackitAlbControllerManager is a constant for an image in the image vector with name 'stackit-alb-controller-manager'.
- ImageNameStackitAlbControllerManager = "stackit-alb-controller-manager"
+ // ImageNameStackitApplicationLoadBalancerController is a constant for an image in the image vector with name 'stackit-application-load-balancer-controller'.
+ ImageNameStackitApplicationLoadBalancerController = "stackit-application-load-balancer-controller"
// ImageNameStackitCloudControllerManager is a constant for an image in the image vector with name 'stackit-cloud-controller-manager'.
ImageNameStackitCloudControllerManager = "stackit-cloud-controller-manager"
// ImageNameStackitPodIdentityWebhook is a constant for an image in the image vector with name 'stackit-pod-identity-webhook'.
diff --git a/imagevector/images.yaml b/imagevector/images.yaml
index 5df95fc1..6253dfad 100644
--- a/imagevector/images.yaml
+++ b/imagevector/images.yaml
@@ -133,9 +133,11 @@ images:
repository: registry.k8s.io/sig-storage/livenessprobe
tag: "v2.18.0"
-- name: stackit-alb-controller-manager
- repository: reg3.infra.ske.eu01.stackit.cloud/temp/alb-controller-manager
- tag: "1245"
+- name: stackit-application-load-balancer-controller
+ sourceRepository: github.com/stackitcloud/application-load-balancer-controller
+ repository: ghcr.io/stackitcloud/application-load-balancer-controller-dev
+ tag: "albc"
+
- name: stackit-pod-identity-webhook
sourceRepository: github.com/stackitcloud/stackit-pod-identity-webhook
repository: ghcr.io/stackitcloud/stackit-pod-identity-webhook
diff --git a/pkg/admission/cmd/options.go b/pkg/admission/cmd/options.go
index be935c93..38d23988 100644
--- a/pkg/admission/cmd/options.go
+++ b/pkg/admission/cmd/options.go
@@ -2,6 +2,7 @@ package cmd
import (
webhookcmd "github.com/gardener/gardener/extensions/pkg/webhook/cmd"
+ "github.com/spf13/pflag"
"github.com/stackitcloud/gardener-extension-provider-stackit/v2/pkg/admission/mutator"
"github.com/stackitcloud/gardener-extension-provider-stackit/v2/pkg/admission/validator"
@@ -14,3 +15,45 @@ func GardenWebhookSwitchOptions() *webhookcmd.SwitchOptions {
webhookcmd.Switch(mutator.Name, mutator.New),
)
}
+
+// ConfigOptions are command line options that can be set for admission webhooks.
+type ConfigOptions struct {
+ // AllowApplicationLoadBalancerController configures if the application load balancer controller can be used in the ControlPlaneConfig.
+ AllowApplicationLoadBalancerController bool
+
+ config *Config
+}
+
+// Config is a completed admission configuration.
+type Config struct {
+ // AllowApplicationLoadBalancerController configures if the application load balancer controller can be used in the ControlPlaneConfig.
+ AllowApplicationLoadBalancerController bool
+}
+
+// AddFlags implements Flagger.AddFlags.
+func (c *ConfigOptions) AddFlags(fs *pflag.FlagSet) {
+ fs.BoolVar(
+ &c.AllowApplicationLoadBalancerController,
+ "allow-application-load-balancer-controller",
+ false,
+ "Configures if the application load balancer controller can be used in the ControlPlaneConfig.",
+ )
+}
+
+// Complete implements RESTCompleter.Complete.
+func (c *ConfigOptions) Complete() error {
+ c.config = &Config{
+ AllowApplicationLoadBalancerController: c.AllowApplicationLoadBalancerController,
+ }
+ return nil
+}
+
+// Completed returns the completed Config. Only call this if `Complete` was successful.
+func (c *ConfigOptions) Completed() *Config {
+ return c.config
+}
+
+// ApplyAllowApplicationLoadBalancerController sets the values of this Config in the given config.AllowApplicationLoadBalancerController.
+func (c *Config) ApplyAllowApplicationLoadBalancerController(cfg *bool) {
+ *cfg = c.AllowApplicationLoadBalancerController
+}
diff --git a/pkg/admission/validator/shoot.go b/pkg/admission/validator/shoot.go
index 8a4c031b..04e28eea 100644
--- a/pkg/admission/validator/shoot.go
+++ b/pkg/admission/validator/shoot.go
@@ -20,11 +20,15 @@ import (
)
// NewShootValidator returns a new instance of a shoot validator.
-func NewShootValidator(mgr manager.Manager) extensionswebhook.Validator {
- return &shoot{}
+func NewShootValidator(mgr manager.Manager, allowApplicationLoadBalancerController bool) extensionswebhook.Validator {
+ return &shoot{
+ allowApplicationLoadBalancerController: allowApplicationLoadBalancerController,
+ }
}
-type shoot struct{}
+type shoot struct {
+ allowApplicationLoadBalancerController bool
+}
// Validate validates the given shoot objects.
func (s *shoot) Validate(_ context.Context, newObj, oldObj client.Object) error {
@@ -45,7 +49,7 @@ func (s *shoot) Validate(_ context.Context, newObj, oldObj client.Object) error
allErrs := field.ErrorList{}
- allErrs = append(allErrs, stackitvalidation.ValidateControlPlaneConfig(cpConfig, shoot.Spec.Kubernetes.Version, field.NewPath("spec").Child("provider").Child("controlPlaneConfig"))...)
+ allErrs = append(allErrs, stackitvalidation.ValidateControlPlaneConfig(cpConfig, shoot.Spec.Kubernetes.Version, s.allowApplicationLoadBalancerController, field.NewPath("spec").Child("provider").Child("controlPlaneConfig"))...)
allErrs = append(allErrs, stackitvalidation.ValidateInfrastructureConfig(infraConfig, ptr.Deref(shoot.Spec.Networking, core.Networking{}).Nodes, field.NewPath("spec").Child("provider").Child("infrastructureConfig"))...)
diff --git a/pkg/admission/validator/shoot_test.go b/pkg/admission/validator/shoot_test.go
index b63549e2..051a6994 100644
--- a/pkg/admission/validator/shoot_test.go
+++ b/pkg/admission/validator/shoot_test.go
@@ -49,7 +49,7 @@ var _ = Describe("NamespacedCloudProfile Validator", func() {
Client: fakeClient,
Scheme: scheme,
}
- shootValidator = validator.NewShootValidator(fakeManager)
+ shootValidator = validator.NewShootValidator(fakeManager, true)
infrastructureConfig = v1alpha1.InfrastructureConfig{
FloatingPoolName: "floating-pool",
diff --git a/pkg/admission/validator/webhook.go b/pkg/admission/validator/webhook.go
index 0a0321f5..7a303c95 100644
--- a/pkg/admission/validator/webhook.go
+++ b/pkg/admission/validator/webhook.go
@@ -15,6 +15,17 @@ const (
Name = "validator"
)
+var (
+ // DefaultAddOptions are the default AddOptions for configuring the validator.
+ DefaultAddOptions = AddOptions{}
+)
+
+// AddOptions are options to apply when adding the STACKIT admission webhook to the manager.
+type AddOptions struct {
+ // AllowApplicationLoadBalancerController configures if the application load balancer controller can be used in the ControlPlaneConfig.
+ AllowApplicationLoadBalancerController bool
+}
+
var logger = log.Log.WithName("stackit-validator-webhook")
// New creates a new webhook that validates Shoot, CloudProfile, NamespacedCloudProfile, SecretBinding and CredentialsBinding resources.
@@ -25,9 +36,9 @@ func New(mgr manager.Manager) (*extensionswebhook.Webhook, error) {
Name: Name,
Path: "/webhooks/validate",
Validators: map[extensionswebhook.Validator][]extensionswebhook.Type{
- NewCloudProfileValidator(mgr): {{Obj: &core.CloudProfile{}}},
- NewShootValidator(mgr): {{Obj: &core.Shoot{}}},
- NewNamespacedCloudProfileValidator(mgr): {{Obj: &core.NamespacedCloudProfile{}}},
+ NewCloudProfileValidator(mgr): {{Obj: &core.CloudProfile{}}},
+ NewShootValidator(mgr, DefaultAddOptions.AllowApplicationLoadBalancerController): {{Obj: &core.Shoot{}}},
+ NewNamespacedCloudProfileValidator(mgr): {{Obj: &core.NamespacedCloudProfile{}}},
},
Target: extensionswebhook.TargetSeed,
ObjectSelector: &metav1.LabelSelector{
diff --git a/pkg/apis/config/types.go b/pkg/apis/config/types.go
index 4eed9a47..933affb5 100644
--- a/pkg/apis/config/types.go
+++ b/pkg/apis/config/types.go
@@ -31,9 +31,6 @@ type ControllerConfiguration struct {
// Deprecated: will be removed in a future version
RegistryCaches []RegistryCacheConfiguration
- // DeployALBIngressController
- DeployALBIngressController bool
-
// CustomLabelDomain is the domain prefix for custom labels applied to STACKIT infrastructure resources.
// For example, cluster labels will use "/cluster" (default: "kubernetes.io").
// NOTE: Only change this if you know what you are doing!!
diff --git a/pkg/apis/config/v1alpha1/types.go b/pkg/apis/config/v1alpha1/types.go
index f6570f88..9c3bf511 100644
--- a/pkg/apis/config/v1alpha1/types.go
+++ b/pkg/apis/config/v1alpha1/types.go
@@ -33,9 +33,6 @@ type ControllerConfiguration struct {
// +optional
RegistryCaches []RegistryCacheConfiguration `json:"registryCaches,omitempty"`
- // DeployALBIngressController
- DeployALBIngressController bool `json:"deployALBIngressController"`
-
// CustomLabelDomain is the domain prefix for custom labels applied to STACKIT infrastructure resources.
// For example, cluster labels will use "/cluster" (default: "kubernetes.io").
// +optional
diff --git a/pkg/apis/config/v1alpha1/zz_generated.conversion.go b/pkg/apis/config/v1alpha1/zz_generated.conversion.go
index a870fc9c..bb478ef7 100644
--- a/pkg/apis/config/v1alpha1/zz_generated.conversion.go
+++ b/pkg/apis/config/v1alpha1/zz_generated.conversion.go
@@ -85,7 +85,6 @@ func autoConvert_v1alpha1_ControllerConfiguration_To_config_ControllerConfigurat
}
out.HealthCheckConfig = (*apisconfigv1alpha1.HealthCheckConfig)(unsafe.Pointer(in.HealthCheckConfig))
out.RegistryCaches = *(*[]config.RegistryCacheConfiguration)(unsafe.Pointer(&in.RegistryCaches))
- out.DeployALBIngressController = in.DeployALBIngressController
out.CustomLabelDomain = in.CustomLabelDomain
return nil
}
@@ -102,7 +101,6 @@ func autoConvert_config_ControllerConfiguration_To_v1alpha1_ControllerConfigurat
}
out.HealthCheckConfig = (*apisconfigv1alpha1.HealthCheckConfig)(unsafe.Pointer(in.HealthCheckConfig))
out.RegistryCaches = *(*[]RegistryCacheConfiguration)(unsafe.Pointer(&in.RegistryCaches))
- out.DeployALBIngressController = in.DeployALBIngressController
out.CustomLabelDomain = in.CustomLabelDomain
return nil
}
diff --git a/pkg/apis/stackit/v1alpha1/types_cloudprofile.go b/pkg/apis/stackit/v1alpha1/types_cloudprofile.go
index bc565426..c57a2e87 100644
--- a/pkg/apis/stackit/v1alpha1/types_cloudprofile.go
+++ b/pkg/apis/stackit/v1alpha1/types_cloudprofile.go
@@ -219,9 +219,9 @@ type APIEndpoints struct {
// ApplicationLoadBalancer is the Endpoint of the Application LoadBalancer API.
// +optional
ApplicationLoadBalancer *string `json:"applicationLoadBalancer,omitempty"`
- // LoadbalancerCertificate is the Endpoint of the LoadBalancerCertificate API.
+ // ApplicationLoadBalancerCertificate is the Endpoint of the ApplicationLoadBalancerCertificate API.
// +optional
- LoadBalancerCertificate *string `json:"loadbalancerCertificate,omitempty"`
+ ApplicationLoadBalancerCertificate *string `json:"applicationLoadBalancerCertificate,omitempty"`
// TokenEndpoint is the token endpoint URL.
// +optional
TokenEndpoint *string `json:"tokenEndpoint,omitempty"`
diff --git a/pkg/apis/stackit/v1alpha1/types_controlplane.go b/pkg/apis/stackit/v1alpha1/types_controlplane.go
index 426d0df5..c259f9fa 100644
--- a/pkg/apis/stackit/v1alpha1/types_controlplane.go
+++ b/pkg/apis/stackit/v1alpha1/types_controlplane.go
@@ -33,7 +33,21 @@ type ControlPlaneConfig struct {
ApplicationLoadBalancer *ApplicationLoadBalancerConfig `json:"applicationLoadBalancer,omitempty"`
}
+// ApplicationLoadBalancerConfig defines the configuration for the
+// Application Load Balancer (ALB) integration.
type ApplicationLoadBalancerConfig struct {
+ // Enabled specifies whether the Application Load Balancer is activated.
+ Enabled bool `json:"enabled"`
+
+ // Ingress contains the configuration specific to the ALB's Ingress controller.
+ Ingress *ApplicationLoadBalancerConfigIngress `json:"ingress,omitempty"`
+}
+
+// ApplicationLoadBalancerConfigIngress defines the settings for the
+// Application Load Balancer Ingress resources.
+type ApplicationLoadBalancerConfigIngress struct {
+ // Enabled specifies whether the Ingress controller functionality
+ // for the ALB is activated to manage external access to services.
Enabled bool `json:"enabled"`
}
diff --git a/pkg/apis/stackit/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/stackit/v1alpha1/zz_generated.deepcopy.go
index aa21ec41..6d0c32e7 100644
--- a/pkg/apis/stackit/v1alpha1/zz_generated.deepcopy.go
+++ b/pkg/apis/stackit/v1alpha1/zz_generated.deepcopy.go
@@ -36,8 +36,8 @@ func (in *APIEndpoints) DeepCopyInto(out *APIEndpoints) {
*out = new(string)
**out = **in
}
- if in.LoadBalancerCertificate != nil {
- in, out := &in.LoadBalancerCertificate, &out.LoadBalancerCertificate
+ if in.ApplicationLoadBalancerCertificate != nil {
+ in, out := &in.ApplicationLoadBalancerCertificate, &out.ApplicationLoadBalancerCertificate
*out = new(string)
**out = **in
}
@@ -83,6 +83,11 @@ func (in *AccessControl) DeepCopy() *AccessControl {
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *ApplicationLoadBalancerConfig) DeepCopyInto(out *ApplicationLoadBalancerConfig) {
*out = *in
+ if in.Ingress != nil {
+ in, out := &in.Ingress, &out.Ingress
+ *out = new(ApplicationLoadBalancerConfigIngress)
+ **out = **in
+ }
return
}
@@ -96,6 +101,22 @@ func (in *ApplicationLoadBalancerConfig) DeepCopy() *ApplicationLoadBalancerConf
return out
}
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ApplicationLoadBalancerConfigIngress) DeepCopyInto(out *ApplicationLoadBalancerConfigIngress) {
+ *out = *in
+ return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ApplicationLoadBalancerConfigIngress.
+func (in *ApplicationLoadBalancerConfigIngress) DeepCopy() *ApplicationLoadBalancerConfigIngress {
+ if in == nil {
+ return nil
+ }
+ out := new(ApplicationLoadBalancerConfigIngress)
+ in.DeepCopyInto(out)
+ return out
+}
+
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *Bastion) DeepCopyInto(out *Bastion) {
*out = *in
@@ -334,7 +355,7 @@ func (in *ControlPlaneConfig) DeepCopyInto(out *ControlPlaneConfig) {
if in.ApplicationLoadBalancer != nil {
in, out := &in.ApplicationLoadBalancer, &out.ApplicationLoadBalancer
*out = new(ApplicationLoadBalancerConfig)
- **out = **in
+ (*in).DeepCopyInto(*out)
}
return
}
diff --git a/pkg/apis/stackit/validation/controlplane.go b/pkg/apis/stackit/validation/controlplane.go
index 66e6d391..f9e6c0fe 100644
--- a/pkg/apis/stackit/validation/controlplane.go
+++ b/pkg/apis/stackit/validation/controlplane.go
@@ -21,11 +21,13 @@ var (
)
// ValidateControlPlaneConfig validates a ControlPlaneConfig object.
-func ValidateControlPlaneConfig(controlPlaneConfig *stackitv1alpha1.ControlPlaneConfig, version string, fldPath *field.Path) field.ErrorList {
+func ValidateControlPlaneConfig(controlPlaneConfig *stackitv1alpha1.ControlPlaneConfig, version string, allowApplicationLoadBalancerController bool, fldPath *field.Path) field.ErrorList {
allErrs := field.ErrorList{} // nolint:prealloc // size is not known yet
allErrs = append(allErrs, validateCloudController(controlPlaneConfig.CloudControllerManager, version, fldPath.Child("cloudControllerManager"))...)
+ allErrs = append(allErrs, validateApplicationLoadBalancer(controlPlaneConfig.ApplicationLoadBalancer, allowApplicationLoadBalancerController, fldPath.Child("applicationLoadBalancer"))...)
+
allErrs = append(allErrs, validateStorage(controlPlaneConfig.Storage, fldPath.Child("storage"))...)
return allErrs
@@ -58,6 +60,32 @@ func validateCloudController(cloudcontroller *stackitv1alpha1.CloudControllerMan
return allErrs
}
+func validateApplicationLoadBalancer(applicationLoadBalancerConfig *stackitv1alpha1.ApplicationLoadBalancerConfig, allowApplicationLoadBalancerController bool, fldPath *field.Path) field.ErrorList {
+ var allErrs field.ErrorList
+ if applicationLoadBalancerConfig == nil {
+ return allErrs
+ }
+ if !applicationLoadBalancerConfig.Enabled {
+ return allErrs
+ }
+
+ if !allowApplicationLoadBalancerController {
+ allErrs = append(allErrs, field.Invalid(fldPath.Child("enabled"), applicationLoadBalancerConfig.Enabled, "application load balancer support is disabled and cannot be enabled on a shoot"))
+ }
+
+ var controllerEnabled bool
+
+ if applicationLoadBalancerConfig.Ingress != nil && applicationLoadBalancerConfig.Ingress.Enabled {
+ controllerEnabled = true
+ }
+
+ if !controllerEnabled {
+ allErrs = append(allErrs, field.Invalid(fldPath.Root(), applicationLoadBalancerConfig, "at least one controller has to be enabled is required"))
+ }
+
+ return allErrs
+}
+
func validateStorage(storage *stackitv1alpha1.Storage, fldPath *field.Path) field.ErrorList {
var allErrs field.ErrorList
if storage == nil || storage.CSI == nil {
diff --git a/pkg/apis/stackit/validation/controlplane_test.go b/pkg/apis/stackit/validation/controlplane_test.go
index e95a2ac9..324f2901 100644
--- a/pkg/apis/stackit/validation/controlplane_test.go
+++ b/pkg/apis/stackit/validation/controlplane_test.go
@@ -26,7 +26,7 @@ var _ = Describe("ControlPlaneConfig validation", func() {
Describe("#ValidateControlPlaneConfig", func() {
It("should return no errors for a valid configuration", func() {
- Expect(ValidateControlPlaneConfig(controlPlane, "", nilPath)).To(BeEmpty())
+ Expect(ValidateControlPlaneConfig(controlPlane, "", false, nilPath)).To(BeEmpty())
})
It("should fail with invalid CCM feature gates", func() {
@@ -37,7 +37,7 @@ var _ = Describe("ControlPlaneConfig validation", func() {
},
}
- errorList := ValidateControlPlaneConfig(controlPlane, "1.28.2", nilPath)
+ errorList := ValidateControlPlaneConfig(controlPlane, "1.28.2", false, nilPath)
Expect(errorList).To(ConsistOf(
PointTo(MatchFields(IgnoreExtras, Fields{
@@ -51,13 +51,53 @@ var _ = Describe("ControlPlaneConfig validation", func() {
controlPlane.Storage = &stackitv1alpha1.Storage{
CSI: &stackitv1alpha1.CSI{Name: "stackit", CompatibilityMode: "bogus"},
}
- Expect(ValidateControlPlaneConfig(controlPlane, "", nilPath)).To(ConsistOf(
+ Expect(ValidateControlPlaneConfig(controlPlane, "", false, nilPath)).To(ConsistOf(
PointTo(MatchFields(IgnoreExtras, Fields{
"Type": Equal(field.ErrorTypeInvalid),
"Field": Equal("storage.csi.compatibilityMode"),
})),
))
})
+
+ It("should fail with no controller enabled for application load balancer", func() {
+ controlPlane.ApplicationLoadBalancer = &stackitv1alpha1.ApplicationLoadBalancerConfig{
+ Enabled: true,
+ Ingress: &stackitv1alpha1.ApplicationLoadBalancerConfigIngress{
+ Enabled: false,
+ },
+ }
+ Expect(ValidateControlPlaneConfig(controlPlane, "", true, nilPath)).To(ConsistOf(
+ PointTo(MatchFields(IgnoreExtras, Fields{
+ "Type": Equal(field.ErrorTypeInvalid),
+ "Field": Equal("applicationLoadBalancer"),
+ })),
+ ))
+ })
+
+ It("should fail with application load balancer and allow application load balancer controller on false", func() {
+ controlPlane.ApplicationLoadBalancer = &stackitv1alpha1.ApplicationLoadBalancerConfig{
+ Enabled: true,
+ Ingress: &stackitv1alpha1.ApplicationLoadBalancerConfigIngress{
+ Enabled: true,
+ },
+ }
+ Expect(ValidateControlPlaneConfig(controlPlane, "", false, nilPath)).To(ConsistOf(
+ PointTo(MatchFields(IgnoreExtras, Fields{
+ "Type": Equal(field.ErrorTypeInvalid),
+ "Field": Equal("applicationLoadBalancer.enabled"),
+ })),
+ ))
+ })
+
+ It("should succeed with application load balancer correctly configured", func() {
+ controlPlane.ApplicationLoadBalancer = &stackitv1alpha1.ApplicationLoadBalancerConfig{
+ Enabled: true,
+ Ingress: &stackitv1alpha1.ApplicationLoadBalancerConfigIngress{
+ Enabled: true,
+ },
+ }
+ Expect(ValidateControlPlaneConfig(controlPlane, "", true, nilPath).ToAggregate()).To(Succeed())
+ })
})
Describe("#ValidateControlPlaneConfigUpdate", func() {
diff --git a/pkg/cmd/config.go b/pkg/cmd/config.go
index cf5a74b2..91fea546 100644
--- a/pkg/cmd/config.go
+++ b/pkg/cmd/config.go
@@ -77,10 +77,6 @@ func (c *Config) ApplyRegistryCaches(regCaches *[]config.RegistryCacheConfigurat
*regCaches = c.Config.RegistryCaches
}
-func (c *Config) ApplyDeployALBIngressController(deployALBIngressController *bool) {
- *deployALBIngressController = c.Config.DeployALBIngressController
-}
-
// ApplyCustomLabelDomain sets the custom label domain configuration for infrastructure resources.
func (c *Config) ApplyCustomLabelDomain(customLabelDomain *string) {
*customLabelDomain = c.Config.CustomLabelDomain
diff --git a/pkg/controller/controlplane/add.go b/pkg/controller/controlplane/add.go
index ab687708..50a7698f 100644
--- a/pkg/controller/controlplane/add.go
+++ b/pkg/controller/controlplane/add.go
@@ -22,8 +22,6 @@ import (
var (
// DefaultAddOptions are the default AddOptions for AddToManager.
DefaultAddOptions = AddOptions{}
-
- DeployALBIngressController bool
)
// AddOptions are options to apply when adding the OpenStack controlplane controller to the manager.
@@ -50,7 +48,7 @@ func AddToManagerWithOptions(ctx context.Context, mgr manager.Manager, opts AddO
genericActuator, err := genericactuator.NewActuator(mgr, stackit.Name,
secretConfigsFunc, shootAccessSecretsFunc,
configChart, controlPlaneChart, controlPlaneShootChart, controlPlaneShootCRDsChart, storageClassChart,
- NewValuesProvider(mgr, DeployALBIngressController, opts.CustomLabelDomain, csiCompatibilityHandler),
+ NewValuesProvider(mgr, opts.CustomLabelDomain, csiCompatibilityHandler),
extensionscontroller.ChartRendererFactoryFunc(util.NewChartRendererForShoot),
imagevector.ImageVector(), "", nil, opts.WebhookServerNamespace)
if err != nil {
diff --git a/pkg/controller/controlplane/valuesprovider.go b/pkg/controller/controlplane/valuesprovider.go
index cda48001..886ce250 100644
--- a/pkg/controller/controlplane/valuesprovider.go
+++ b/pkg/controller/controlplane/valuesprovider.go
@@ -205,12 +205,14 @@ var (
},
},
{
- Name: openstack.STACKITALBControllerManagerName,
- Images: []string{imagevector.ImageNameStackitAlbControllerManager},
+ Name: openstack.STACKITApplicationLoadBalancerControllerName,
+ Images: []string{imagevector.ImageNameStackitApplicationLoadBalancerController},
Objects: []*chart.Object{
- // stackit-alb-controller-manager
- {Type: &appsv1.Deployment{}, Name: openstack.STACKITALBControllerManagerName},
- {Type: &vpaautoscalingv1.VerticalPodAutoscaler{}, Name: openstack.STACKITALBControllerManagerName},
+ // stackit-application-load-balancer-controller
+ {Type: &appsv1.Deployment{}, Name: openstack.STACKITApplicationLoadBalancerControllerName},
+ {Type: &vpaautoscalingv1.VerticalPodAutoscaler{}, Name: openstack.STACKITApplicationLoadBalancerControllerName},
+ {Type: &policyv1.PodDisruptionBudget{}, Name: openstack.STACKITApplicationLoadBalancerControllerName},
+ {Type: &corev1.ConfigMap{}, Name: openstack.STACKITApplicationLoadBalancerControllerName},
},
},
{
@@ -363,25 +365,23 @@ type CSICompatibilityHandler interface {
}
// NewValuesProvider creates a new ValuesProvider for the generic actuator.
-func NewValuesProvider(mgr manager.Manager, deployALBIngressController bool, customLabelDomain string, csiCompatibilityHandler CSICompatibilityHandler) genericactuator.ValuesProvider {
+func NewValuesProvider(mgr manager.Manager, customLabelDomain string, csiCompatibilityHandler CSICompatibilityHandler) genericactuator.ValuesProvider {
return &valuesProvider{
- client: mgr.GetClient(),
- decoder: serializer.NewCodecFactory(mgr.GetScheme(), serializer.EnableStrict).UniversalDecoder(),
- deployALBIngressController: deployALBIngressController,
- customLabelDomain: customLabelDomain,
- csiCompatibilityHandler: csiCompatibilityHandler,
+ client: mgr.GetClient(),
+ decoder: serializer.NewCodecFactory(mgr.GetScheme(), serializer.EnableStrict).UniversalDecoder(),
+ customLabelDomain: customLabelDomain,
+ csiCompatibilityHandler: csiCompatibilityHandler,
}
}
// valuesProvider is a ValuesProvider that provides OpenStack-specific values for the 2 charts applied by the generic actuator.
type valuesProvider struct {
genericactuator.NoopValuesProvider
- client k8sclient.Client
- config *rest.Config
- decoder runtime.Decoder
- deployALBIngressController bool
- customLabelDomain string
- csiCompatibilityHandler CSICompatibilityHandler
+ client k8sclient.Client
+ config *rest.Config
+ decoder runtime.Decoder
+ customLabelDomain string
+ csiCompatibilityHandler CSICompatibilityHandler
}
// GetConfigChartValues returns the values for the config chart applied by the generic actuator.
@@ -787,17 +787,18 @@ func (vp *valuesProvider) getControlPlaneChartValues(ctx context.Context, cpConf
return nil, fmt.Errorf("unsupported storage CSI Driver: %s", storageCSIDriver)
}
- if vp.deployALBIngressController {
- fmt.Println("deploying ALB Ingress Controller")
- albcm, err := getSTACKITALBCMChartValues(cpConfig, cluster, infra, stackitCredentialsConfig, apiEndpoints, scaledDown, stackitRegion)
+ if DeploySTACKITApplicationLoadBalancer(cpConfig) {
+ // Currently only the ingress source is allowed and the validation does not allow to enable the ALB controller of no source is enabled.
+ // When adding support for GatewayAPI it is required to adopt the configuration of the ALB controller here.
+ albcm, err := getSTACKITApplicationLoadBalancerCMChartValues(cpConfig, cluster, infra, stackitCredentialsConfig, apiEndpoints, checksums, scaledDown, stackitRegion)
if err != nil {
return nil, err
}
- controlPlaneValues[openstack.STACKITALBControllerManagerName] = albcm
+ controlPlaneValues[openstack.STACKITApplicationLoadBalancerControllerName] = albcm
} else {
// NOTE: ensure deletion of ALB deployment, if disabled
- if err := vp.deleteControlPlaneComponentsForGivenChart(ctx, cp.Namespace, openstack.STACKITALBControllerManagerName); err != nil {
+ if err := vp.deleteControlPlaneComponentsForGivenChart(ctx, cp.Namespace, openstack.STACKITApplicationLoadBalancerControllerName); err != nil {
return nil, err
}
}
@@ -1041,56 +1042,68 @@ func getCSIControllerChartValues(cluster *extensionscontroller.Cluster, userAgen
return values
}
-func getSTACKITALBCMChartValues(
- cpConfig *stackitv1alpha1.ControlPlaneConfig,
+func getSTACKITApplicationLoadBalancerCMChartValues(
+ _ *stackitv1alpha1.ControlPlaneConfig,
cluster *extensionscontroller.Cluster,
infra *stackitv1alpha1.InfrastructureStatus,
credentials *stackit.Credentials,
apiEndpoints *stackitv1alpha1.APIEndpoints,
+ checksums map[string]string,
scaledDown bool,
stackitRegion string,
) (map[string]any, error) {
- if !DeploySTACKITALB(cpConfig) {
- return nil, nil
- }
-
if credentials == nil {
return nil, fmt.Errorf("no STACKIT credentials are provided in cluster %s", cluster.Shoot.Name)
}
-
- config := map[string]any{
- "region": stackitRegion,
- "stackitProjectID": credentials.ProjectID,
+ if infra == nil {
+ return map[string]any{}, fmt.Errorf("can't determine networkID from as InfrastructureStatus is nil in cluster %s", cluster.Shoot.Name)
}
- if infra != nil {
- config["stackitNetworkID"] = infra.Networks.ID
+ globalSettings := map[string]any{
+ "region": stackitRegion,
+ "projectId": credentials.ProjectID,
}
if apiEndpoints != nil {
+ endpoints := map[string]any{}
if apiEndpoints.ApplicationLoadBalancer != nil {
- config["applicationLBApiUrl"] = apiEndpoints.ApplicationLoadBalancer
+ endpoints["applicationLoadBalancerApi"] = apiEndpoints.ApplicationLoadBalancer
}
- if apiEndpoints.LoadBalancerCertificate != nil {
- config["certificateApiUrl"] = *apiEndpoints.LoadBalancerCertificate
+ if apiEndpoints.ApplicationLoadBalancerCertificate != nil {
+ endpoints["applicationLoadBalancerCertificateApi"] = *apiEndpoints.ApplicationLoadBalancerCertificate
}
- if apiEndpoints.TokenEndpoint != nil {
- config["tokenUrl"] = *apiEndpoints.TokenEndpoint
+ if len(endpoints) > 0 {
+ globalSettings["apiEndpoints"] = endpoints
}
}
+ config := map[string]any{
+ "global": globalSettings,
+ "applicationLoadBalancer": map[string]any{
+ "networkId": infra.Networks.ID,
+ },
+ }
+
values := map[string]any{
"enabled": true,
"replicas": extensionscontroller.GetControlPlaneReplicas(cluster, scaledDown, 1),
"config": config,
+ "podAnnotations": map[string]any{
+ "checksum/secret-" + v1beta1constants.SecretNameCloudProvider: checksums[v1beta1constants.SecretNameCloudProvider],
+ "checksum/application-load-balancer-config": gardenerutils.ComputeChecksum(config),
+ },
+ }
+
+ if apiEndpoints != nil && apiEndpoints.TokenEndpoint != nil {
+ values["tokenEndpoint"] = *apiEndpoints.TokenEndpoint
}
return values, nil
}
-func DeploySTACKITALB(cpConfig *stackitv1alpha1.ControlPlaneConfig) bool {
+func DeploySTACKITApplicationLoadBalancer(cpConfig *stackitv1alpha1.ControlPlaneConfig) bool {
return ptr.Deref(cpConfig.ApplicationLoadBalancer, stackitv1alpha1.ApplicationLoadBalancerConfig{}).Enabled
}
diff --git a/pkg/controller/controlplane/valuesprovider_test.go b/pkg/controller/controlplane/valuesprovider_test.go
index 6796e224..ce1cf564 100644
--- a/pkg/controller/controlplane/valuesprovider_test.go
+++ b/pkg/controller/controlplane/valuesprovider_test.go
@@ -65,9 +65,9 @@ func newTestScheme() *runtime.Scheme {
return scheme
}
-func newTestValuesProvider(cl client.Client, scheme *runtime.Scheme, deployALB bool, customLabelDomain string) *valuesProvider {
+func newTestValuesProvider(cl client.Client, scheme *runtime.Scheme, customLabelDomain string) *valuesProvider {
mgr := &testutils.FakeManager{Scheme: scheme, Client: cl}
- return NewValuesProvider(mgr, deployALB, customLabelDomain, new(noopCSICompatibilityHandler)).(*valuesProvider)
+ return NewValuesProvider(mgr, customLabelDomain, new(noopCSICompatibilityHandler)).(*valuesProvider)
}
func baseControlPlaneConfig() *stackitv1alpha1.ControlPlaneConfig {
@@ -436,7 +436,7 @@ var _ = Describe("ValuesProvider fake client", func() {
scheme = newTestScheme()
c = fake.NewClientBuilder().WithScheme(scheme).Build()
secretsManager = fakesecretsmanager.New(c, namespace)
- vp = newTestValuesProvider(c, scheme, true, "kubernetes.io")
+ vp = newTestValuesProvider(c, scheme, "kubernetes.io")
})
Describe("#GetConfigChartValues", func() {
@@ -617,7 +617,7 @@ var _ = Describe("ValuesProvider fake client", func() {
"tlsSecretName": stackitPodIdentityWebhookServerName,
},
}))
- Expect(values[openstack.STACKITALBControllerManagerName]).To(BeNil())
+ Expect(values[openstack.STACKITApplicationLoadBalancerControllerName]).To(BeNil())
})
It("returns OpenStack CSI values when selected", func() {
@@ -707,7 +707,7 @@ var _ = Describe("ValuesProvider fake client", func() {
DescribeTable("propagates custom label domains",
func(customLabelDomain string) {
- vp = newTestValuesProvider(c, scheme, true, customLabelDomain)
+ vp = newTestValuesProvider(c, scheme, customLabelDomain)
cp, cluster, providerSecret, _ := seedReadyControlPlane(ctx, c)
values, err := vp.GetControlPlaneChartValues(ctx, cp, cluster, secretsManager, checksumsFor(providerSecret), false)
@@ -726,32 +726,47 @@ var _ = Describe("ValuesProvider fake client", func() {
It("returns ALB controller values when enabled", func() {
cp, cluster, providerSecret, _ := seedReadyControlPlane(ctx, c)
cpConfig := baseControlPlaneConfig()
- cpConfig.ApplicationLoadBalancer = &stackitv1alpha1.ApplicationLoadBalancerConfig{Enabled: true}
+ cpConfig.ApplicationLoadBalancer = &stackitv1alpha1.ApplicationLoadBalancerConfig{
+ Enabled: true,
+ Ingress: &stackitv1alpha1.ApplicationLoadBalancerConfigIngress{
+ Enabled: false,
+ },
+ }
cp.Spec.ProviderConfig.Raw = encode(cpConfig)
values, err := vp.GetControlPlaneChartValues(ctx, cp, cluster, secretsManager, checksumsFor(providerSecret), false)
Expect(err).NotTo(HaveOccurred())
- Expect(chartValues(values, openstack.STACKITALBControllerManagerName)).To(BeComparableTo(map[string]any{
+ config := map[string]any{
+ "global": map[string]any{
+ "region": "eu01",
+ "projectId": "foo",
+ },
+ "applicationLoadBalancer": map[string]any{
+ "networkId": "network-acbd1234",
+ },
+ }
+
+ Expect(chartValues(values, openstack.STACKITApplicationLoadBalancerControllerName)).To(BeComparableTo(map[string]any{
"enabled": true,
"replicas": 1,
- "config": map[string]any{
- "region": "eu01",
- "stackitProjectID": "foo",
- "stackitNetworkID": "network-acbd1234",
+ "podAnnotations": map[string]any{
+ "checksum/application-load-balancer-config": gardenerutils.ComputeChecksum(config),
+ "checksum/secret-" + v1beta1constants.SecretNameCloudProvider: gardenerutils.ComputeChecksum(providerSecret.Data),
},
+ "config": config,
}))
})
- It("omits ALB controller values when the config disables ALB deployment", func() {
- vp = newTestValuesProvider(c, scheme, false, "kubernetes.io")
+ It("omits ALB controller values when the alb is ALB deployment", func() {
+ vp = newTestValuesProvider(c, scheme, "kubernetes.io")
cp, cluster, providerSecret, _ := seedReadyControlPlane(ctx, c)
cpConfig := baseControlPlaneConfig()
- cpConfig.ApplicationLoadBalancer = &stackitv1alpha1.ApplicationLoadBalancerConfig{Enabled: true}
+ cpConfig.ApplicationLoadBalancer = &stackitv1alpha1.ApplicationLoadBalancerConfig{Enabled: false}
cp.Spec.ProviderConfig.Raw = encode(cpConfig)
values, err := vp.GetControlPlaneChartValues(ctx, cp, cluster, secretsManager, checksumsFor(providerSecret), false)
Expect(err).NotTo(HaveOccurred())
- Expect(values[openstack.STACKITALBControllerManagerName]).To(BeNil())
+ Expect(values[openstack.STACKITApplicationLoadBalancerControllerName]).To(BeNil())
})
It("deletes legacy cleanup objects from the fake client", func() {
@@ -858,7 +873,7 @@ var _ = Describe("ValuesProvider fake client", func() {
},
}).
Build()
- interceptedProvider := newTestValuesProvider(interceptedClient, scheme, true, "kubernetes.io")
+ interceptedProvider := newTestValuesProvider(interceptedClient, scheme, "kubernetes.io")
apiURL, apiToken, err := interceptedProvider.checkEmergencyLoadBalancerAccess(ctx, secretKey)
Expect(err).To(MatchError(expectedErr))
diff --git a/pkg/controller/healthcheck/add.go b/pkg/controller/healthcheck/add.go
index 4ab43580..abb74407 100644
--- a/pkg/controller/healthcheck/add.go
+++ b/pkg/controller/healthcheck/add.go
@@ -31,20 +31,28 @@ import (
var (
defaultSyncPeriod = time.Second * 30
// DefaultAddOptions are the default DefaultAddArgs for AddToManager.
- DefaultAddOptions = healthcheck.DefaultAddArgs{
- HealthCheckConfig: healthcheckconfig.HealthCheckConfig{
- SyncPeriod: metav1.Duration{Duration: defaultSyncPeriod},
- ShootRESTOptions: &healthcheckconfig.RESTOptions{
- QPS: new(float32(100)),
- Burst: new(130),
+ DefaultAddOptions = AddOptions{
+ DefaultAddArgs: healthcheck.DefaultAddArgs{
+ HealthCheckConfig: healthcheckconfig.HealthCheckConfig{
+ SyncPeriod: metav1.Duration{Duration: defaultSyncPeriod},
+ ShootRESTOptions: &healthcheckconfig.RESTOptions{
+ QPS: new(float32(100)),
+ Burst: new(130),
+ },
},
},
}
)
+// AddOptions are options to apply when adding the STACKIT healthcheck controller to the manager.
+type AddOptions struct {
+ // DefaultAddArgs
+ healthcheck.DefaultAddArgs
+}
+
// RegisterHealthChecks registers health checks for each extension resource
// HealthChecks are grouped by extension (e.g worker), extension.type (e.g aws) and Health Check Type (e.g ShootControlPlaneHealthy)
-func RegisterHealthChecks(ctx context.Context, mgr manager.Manager, opts healthcheck.DefaultAddArgs) error {
+func RegisterHealthChecks(ctx context.Context, mgr manager.Manager, opts AddOptions) error {
healthchecks := []healthcheck.ConditionTypeToHealthCheck{
{
ConditionType: string(gardencorev1beta1.ShootControlPlaneHealthy),
@@ -75,16 +83,11 @@ func RegisterHealthChecks(ctx context.Context, mgr manager.Manager, opts healthc
HealthCheck: general.NewSeedDeploymentHealthChecker(controlplane.CSIStackitPrefix + "-" + openstack.CSISnapshotControllerName),
PreCheckFunc: checkCSISTACKIT,
},
- }
-
- if controlplane.DeployALBIngressController {
- healthchecks = append(healthchecks,
- healthcheck.ConditionTypeToHealthCheck{
- ConditionType: string(gardencorev1beta1.ShootControlPlaneHealthy),
- HealthCheck: general.NewSeedDeploymentHealthChecker(openstack.STACKITALBControllerManagerName),
- PreCheckFunc: checkALB,
- },
- )
+ {
+ ConditionType: string(gardencorev1beta1.ShootControlPlaneHealthy),
+ HealthCheck: general.NewSeedDeploymentHealthChecker(openstack.STACKITApplicationLoadBalancerControllerName),
+ PreCheckFunc: checkALB,
+ },
}
if err := healthcheck.DefaultRegistration(
@@ -93,7 +96,7 @@ func RegisterHealthChecks(ctx context.Context, mgr manager.Manager, opts healthc
func() client.ObjectList { return &extensionsv1alpha1.ControlPlaneList{} },
func() extensionsv1alpha1.Object { return &extensionsv1alpha1.ControlPlane{} },
mgr,
- opts,
+ opts.DefaultAddArgs,
nil,
healthchecks,
sets.New[gardencorev1beta1.ConditionType](),
@@ -107,7 +110,7 @@ func RegisterHealthChecks(ctx context.Context, mgr manager.Manager, opts healthc
func() client.ObjectList { return &extensionsv1alpha1.WorkerList{} },
func() extensionsv1alpha1.Object { return &extensionsv1alpha1.Worker{} },
mgr,
- opts,
+ opts.DefaultAddArgs,
nil,
[]healthcheck.ConditionTypeToHealthCheck{{
ConditionType: string(gardencorev1beta1.ShootEveryNodeReady),
@@ -173,7 +176,7 @@ func checkALB(_ context.Context, client client.Client, _ client.Object, clusterO
return false
}
- return controlplane.DeploySTACKITALB(cpConfig)
+ return controlplane.DeploySTACKITApplicationLoadBalancer(cpConfig)
}
// AddToManager adds a controller with the default Options.
diff --git a/pkg/openstack/types.go b/pkg/openstack/types.go
index 6b38156b..25c73e80 100644
--- a/pkg/openstack/types.go
+++ b/pkg/openstack/types.go
@@ -73,8 +73,8 @@ const (
CloudControllerManagerName = "cloud-controller-manager"
// STACKITCloudControllerManagerName is a constant for the name of the CloudController deployed by the worker controller. (stackit)
STACKITCloudControllerManagerName = "stackit-cloud-controller-manager"
- // STACKITALBControllerManagerName is a constant for the name of the ALB CloudController. (stackit)
- STACKITALBControllerManagerName = "stackit-alb-controller-manager"
+ // STACKITApplicationLoadBalancerControllerName is a constant for the name of the ALB CloudController. (stackit)
+ STACKITApplicationLoadBalancerControllerName = "stackit-application-load-balancer-controller"
// CSIDiskDriverTopologyKey is the label on persistent volumes that represents availability by zone.
// See https://github.com/kubernetes/cloud-provider-openstack/blob/master/examples/cinder-csi-plugin/topology/example.yaml
// See https://gitlab.cern.ch/cloud/cloud-provider-openstack/-/blob/release-1.19/docs/using-cinder-csi-plugin.md#enable-topology-aware-dynamic-provisioning-for-cinder-volumes
|