@@ -21,9 +21,9 @@ import (
2121 "context"
2222
2323 "github.com/go-logr/logr"
24+ ocpconfigv1 "github.com/openshift/api/config/v1"
2425 ocpsecurityv1 "github.com/openshift/api/security/v1"
2526 kerrors "k8s.io/apimachinery/pkg/api/errors"
26- metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2727 "k8s.io/apimachinery/pkg/runtime/serializer"
2828 "k8s.io/apimachinery/pkg/types"
2929 "sigs.k8s.io/controller-runtime/pkg/client"
@@ -32,42 +32,77 @@ import (
3232)
3333
3434// Properties contains properties about the environment in which we are running
35+ var properties * Properties
36+
3537type Properties struct {
36- IsOpenShift bool // True if we are running on OpenShift
37- HasSCCRestrictedV2 bool // True if the SecurityContextConstraints "restricted-v2" exists
38+ IsOpenShift bool // True if we are running on OpenShift
39+ TLSSecurityProfileSpec * ocpconfigv1. TLSProfileSpec // Will be nil if not on OpenShift
3840}
3941
4042//nolint:lll
4143//+kubebuilder:rbac:groups=security.openshift.io,resources=securitycontextconstraints,verbs=get;list;watch;create;patch;update
44+ //+kubebuilder:rbac:groups=config.openshift.io,resources=apiservers,verbs=get;list;watch
4245
4346// Retrieves properties of the running cluster
44- func GetProperties (ctx context.Context , client client.Client , logger logr.Logger ) (Properties , error ) {
45- if err := ocpsecurityv1 .AddToScheme (client .Scheme ()); err != nil {
47+ func GetProperties (ctx context.Context , k8sClient client.Client , logger logr.Logger ) (Properties , error ) {
48+ if properties != nil {
49+ // Use cached value if it's set
50+ return * properties , nil
51+ }
52+
53+ if err := ocpsecurityv1 .AddToScheme (k8sClient .Scheme ()); err != nil {
4654 logger .Error (err , "unable to add scheme for security.openshift.io" )
4755 return Properties {}, err
4856 }
57+ if err := ocpconfigv1 .AddToScheme (k8sClient .Scheme ()); err != nil {
58+ logger .Error (err , "unable to add scheme for config.openshift.io" )
59+ return Properties {}, err
60+ }
4961
5062 var err error
5163 p := Properties {}
5264
53- if p .IsOpenShift , err = isOpenShift (ctx , client , logger ); err != nil {
65+ if p .IsOpenShift , err = isOpenShift (ctx , k8sClient , logger ); err != nil {
5466 return Properties {}, err
5567 }
5668 if p .IsOpenShift {
57- if p .HasSCCRestrictedV2 , err = hasSCCRestrictedV2 (ctx , client , logger ); err != nil {
69+ if p .TLSSecurityProfileSpec , err = getTLSProfile (ctx , k8sClient , logger ); err != nil {
5870 return Properties {}, err
5971 }
6072 }
73+
74+ // Cache properties for subsequent calls
75+ properties = & p
76+
6177 return p , nil
6278}
6379
80+ // For test usage, clear out our cached properties
81+ func clearProperties () {
82+ properties = nil
83+ }
84+
85+ // Checks to determine whether this is OpenShift by looking for any SecurityContextConstraint objects
86+ func isOpenShift (ctx context.Context , k8sClient client.Client , logger logr.Logger ) (bool , error ) {
87+ SCCs := ocpsecurityv1.SecurityContextConstraintsList {}
88+ err := k8sClient .List (ctx , & SCCs )
89+ if len (SCCs .Items ) > 0 {
90+ return true , nil
91+ }
92+ if err == nil || utils .IsCRDNotPresentError (err ) {
93+ return false , nil
94+ }
95+ logger .Error (err , "error while looking for SCCs" )
96+ return false , err
97+ }
98+
6499func EnsureVolSyncMoverSCCIfOpenShift (ctx context.Context , k8sClient client.Client , logger logr.Logger ,
65100 sccName string , sccRaw []byte ) error {
66- openShift , err := isOpenShift (ctx , k8sClient , logger )
101+ p , err := GetProperties (ctx , k8sClient , logger )
67102 if err != nil {
68103 return err
69104 }
70- if ! openShift {
105+ if ! p . IsOpenShift {
71106 return nil // Not OpenShift, nothing to do here
72107 }
73108
@@ -115,35 +150,3 @@ func EnsureVolSyncMoverSCCIfOpenShift(ctx context.Context, k8sClient client.Clie
115150 // Patch currentScc with our volsync mover scc
116151 return k8sClient .Patch (ctx , volsyncMoverScc , client .MergeFrom (currentScc ))
117152}
118-
119- // Checks to determine whether this is OpenShift by looking for any SecurityContextConstraint objects
120- func isOpenShift (ctx context.Context , c client.Client , l logr.Logger ) (bool , error ) {
121- SCCs := ocpsecurityv1.SecurityContextConstraintsList {}
122- err := c .List (ctx , & SCCs )
123- if len (SCCs .Items ) > 0 {
124- return true , nil
125- }
126- if err == nil || utils .IsCRDNotPresentError (err ) {
127- return false , nil
128- }
129- l .Error (err , "error while looking for SCCs" )
130- return false , err
131- }
132-
133- func hasSCCRestrictedV2 (ctx context.Context , c client.Client , l logr.Logger ) (bool , error ) {
134- scc := ocpsecurityv1.SecurityContextConstraints {
135- ObjectMeta : metav1.ObjectMeta {
136- Name : "restricted-v2" ,
137- },
138- }
139- // The following assumes SCC is a valid type (i.e., it's OpenShift)
140- err := c .Get (ctx , client .ObjectKeyFromObject (& scc ), & scc )
141- if err == nil {
142- return true , nil
143- }
144- if kerrors .IsNotFound (err ) {
145- return false , nil
146- }
147- l .Error (err , "error while looking for restricted-v2 SCC" )
148- return false , err
149- }
![openshift-merge-bot[bot]](https://avatars.githubusercontent.com/in/412865?v=4&size=40){kind=avatar}
0 commit comments