Allow custom service account names to be used for cloud controllers #103178

nckturner · 2021-06-25T07:45:57Z

What type of PR is this?

/kind feature

What this PR does / why we need it:

Allow custom client/service account names to be used for cloud controllers. This allows a cloud controller to use cloud provider managed RBAC when --use-service-account-credentials is set, rather than the in-tree default RBAC that is bootstrapped by the API server (like the node-controller).

Which issue(s) this PR fixes:

Fixes kubernetes/cloud-provider#48

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Cloud providers can set service account names for cloud controllers.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

nckturner · 2021-06-25T07:46:18Z

/sig cloud-provider

nckturner · 2021-06-25T07:46:34Z

/cc @cheftako

wongma7 · 2021-06-29T00:03:59Z

need gofmt https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/103178/pull-kubernetes-verify/1408330617036214272

nckturner · 2021-07-07T20:33:33Z

/triage accepted
/cc @andrewsykim

cmd/cloud-controller-manager/main.go

andrewsykim

/assign @cheftako @cici37

andrewsykim · 2021-07-08T19:23:03Z

staging/src/k8s.io/cloud-provider/app/controllermanager.go

-	"route":                startRouteControllerWrapper,
+var DefaultInitFuncConstructors = map[string]ControllerInitializerConstructor{
+	"cloud-node": {
+		ClientName:  "node-controller",


this probably deserves a comment that it's node-controller for historical reasons

andrewsykim · 2021-07-08T19:23:07Z

staging/src/k8s.io/cloud-provider/app/controllermanager.go

+		Constructor: StartCloudNodeControllerWrapper,
+	},
+	"cloud-node-lifecycle": {
+		ClientName:  "node-controller",


same here this probably deserves a comment that it's node-controller for historical reasons

Also that if you want to over-ride this is an example of where you should make the override.

cheftako · 2021-07-08T21:09:50Z

/lgtm

cheftako · 2021-07-08T21:10:45Z

/test pull-kubernetes-integration

nckturner · 2021-07-08T21:35:54Z

/hold

nckturner · 2021-07-08T21:36:35Z

Addressing comments.

nckturner · 2021-07-15T08:16:13Z

Also added examples to kubernetes/cmd/cloud-controller-manager/main.go and kubernetes/staging/src/k8s.io/cloud-provider/sample, and added comments.

cmd/cloud-controller-manager/nodeipamcontroller.go

staging/src/k8s.io/cloud-provider/app/controllermanager.go

cheftako · 2021-07-21T23:27:44Z

/approve

cheftako · 2021-07-23T23:59:53Z

/lgtm

dims · 2021-08-05T10:34:28Z

/ok-to-test

dims · 2021-08-06T01:44:33Z

@nckturner needs rebase. PTAL

* This allows a controller to use cloud provider managed RBAC when --use-service-account-credentials is set. * Create ControllerInitFuncConstructor to pass to init funcs to avoid future function signature growth. * Add comments for context around legacy naming of node controllers. * Add example for setting client names from cloud controller manager.

cheftako · 2021-08-24T06:34:24Z

/lgtm
/approve

k8s-ci-robot · 2021-08-24T06:34:58Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cheftako, nckturner, wongma7

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~cmd/cloud-controller-manager/OWNERS~~ [cheftako]
~~staging/src/k8s.io/cloud-provider/OWNERS~~ [cheftako]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

nckturner · 2021-08-24T17:45:25Z

/remove-hold

k8s-ci-robot added sig/cloud-provider Categorizes an issue or PR as relevant to SIG Cloud Provider. and removed do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Jun 25, 2021

k8s-ci-robot requested review from rootfs and vishh June 25, 2021 07:46

k8s-ci-robot added the area/cloudprovider label Jun 25, 2021

k8s-ci-robot requested a review from cheftako June 25, 2021 07:46

nckturner mentioned this pull request Jun 25, 2021

Set custom service account names for controllers kubernetes/cloud-provider-aws#237

Closed

nckturner force-pushed the custom-cloud-controller-client-names branch from 0c643eb to b7a8502 Compare July 7, 2021 20:32

k8s-ci-robot requested a review from andrewsykim July 7, 2021 20:33

k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Jul 7, 2021

nckturner force-pushed the custom-cloud-controller-client-names branch from b7a8502 to a3d566b Compare July 8, 2021 06:05

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jul 8, 2021

andrewsykim reviewed Jul 8, 2021

View reviewed changes

cmd/cloud-controller-manager/main.go Show resolved Hide resolved

cmd/cloud-controller-manager/main.go Outdated Show resolved Hide resolved

nckturner force-pushed the custom-cloud-controller-client-names branch from a3d566b to 8643261 Compare July 8, 2021 19:22

andrewsykim reviewed Jul 8, 2021

View reviewed changes

k8s-ci-robot assigned cheftako Jul 8, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 8, 2021

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 8, 2021

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 15, 2021

wongma7 approved these changes Jul 15, 2021

View reviewed changes

cmd/cloud-controller-manager/nodeipamcontroller.go Outdated Show resolved Hide resolved

staging/src/k8s.io/cloud-provider/app/controllermanager.go Outdated Show resolved Hide resolved

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 21, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 23, 2021

k8s-ci-robot added the ok-to-test Indicates a non-member PR verified by an org member that is safe to test. label Aug 5, 2021

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 6, 2021

nckturner force-pushed the custom-cloud-controller-client-names branch from a5f84b3 to a5b47f7 Compare August 24, 2021 00:52

k8s-ci-robot removed lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Aug 24, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 24, 2021

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 24, 2021

k8s-ci-robot merged commit 0c9bb96 into kubernetes:master Aug 24, 2021

k8s-ci-robot added this to the v1.23 milestone Aug 24, 2021

nckturner mentioned this pull request Mar 2, 2022

Set custom service account names for controllers kubernetes/cloud-provider-aws#311

Closed

nckturner mentioned this pull request Apr 20, 2023

Introduce controller aliases for KCM and CCM #115813

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow custom service account names to be used for cloud controllers #103178

Allow custom service account names to be used for cloud controllers #103178

nckturner commented Jun 25, 2021

nckturner commented Jun 25, 2021

nckturner commented Jun 25, 2021

wongma7 commented Jun 29, 2021

nckturner commented Jul 7, 2021

andrewsykim left a comment

andrewsykim Jul 8, 2021

cheftako Jul 8, 2021

andrewsykim Jul 8, 2021

cheftako Jul 8, 2021

cheftako commented Jul 8, 2021

cheftako commented Jul 8, 2021

nckturner commented Jul 8, 2021

nckturner commented Jul 8, 2021

nckturner commented Jul 15, 2021 •

edited

cheftako commented Jul 21, 2021

cheftako commented Jul 23, 2021

dims commented Aug 5, 2021

dims commented Aug 6, 2021

cheftako commented Aug 24, 2021

k8s-ci-robot commented Aug 24, 2021

nckturner commented Aug 24, 2021

Allow custom service account names to be used for cloud controllers #103178

Allow custom service account names to be used for cloud controllers #103178

Conversation

nckturner commented Jun 25, 2021

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

nckturner commented Jun 25, 2021

nckturner commented Jun 25, 2021

wongma7 commented Jun 29, 2021

nckturner commented Jul 7, 2021

andrewsykim left a comment

Choose a reason for hiding this comment

andrewsykim Jul 8, 2021

Choose a reason for hiding this comment

cheftako Jul 8, 2021

Choose a reason for hiding this comment

andrewsykim Jul 8, 2021

Choose a reason for hiding this comment

cheftako Jul 8, 2021

Choose a reason for hiding this comment

cheftako commented Jul 8, 2021

cheftako commented Jul 8, 2021

nckturner commented Jul 8, 2021

nckturner commented Jul 8, 2021

nckturner commented Jul 15, 2021 • edited

cheftako commented Jul 21, 2021

cheftako commented Jul 23, 2021

dims commented Aug 5, 2021

dims commented Aug 6, 2021

cheftako commented Aug 24, 2021

k8s-ci-robot commented Aug 24, 2021

nckturner commented Aug 24, 2021

nckturner commented Jul 15, 2021 •

edited