add multi-cluster deployment support via Cluster Inventory API

Signed-off-by: kahirokunn <okinakahiro@gmail.com>

Author: kahirokunn

cmd/operator/main.go

@@ -17,6 +17,9 @@ limitations under the License.
 package main
 
 import (
+	"flag"
+
+	"knative.dev/operator/pkg/reconciler/common"
 	"knative.dev/operator/pkg/reconciler/knativeeventing"
 	"knative.dev/operator/pkg/reconciler/knativeserving"
 	kubefilteredfactory "knative.dev/pkg/client/injection/kube/informers/factory/filtered"
@@ -25,6 +28,11 @@ import (
 )
 
 func main() {
+	flag.StringVar(&common.CredentialProvidersConfigPath,
+		"credential-providers-config", "",
+		"Path to the credential providers config file for "+
+			"Cluster Inventory API multi-cluster support")
+
 	ctx := signals.NewContext()
 	ctx = kubefilteredfactory.WithSelectors(ctx,
 		knativeserving.Selector,

config/crd/bases/operator.knative.dev_knativeeventings.yaml

@@ -66,6 +66,24 @@ spec:
                   - URL
                   type: object
                 type: array
+              clusterProfileRef:
+                description: |-
+                  ClusterProfileRef is an optional reference to a ClusterProfile resource
+                  (multicluster.x-k8s.io/v1alpha1). When set, the operator reconciles
+                  the component on the remote cluster described by the referenced
+                  ClusterProfile instead of the local cluster.
+                properties:
+                  name:
+                    description: Name is the name of the ClusterProfile resource.
+                    type: string
+                  namespace:
+                    description: Namespace is the namespace of the ClusterProfile
+                      resource.
+                    type: string
+                required:
+                - name
+                - namespace
+                type: object
               config:
                 additionalProperties:
                   additionalProperties:

config/crd/bases/operator.knative.dev_knativeservings.yaml

@@ -66,6 +66,24 @@ spec:
                   - URL
                   type: object
                 type: array
+              clusterProfileRef:
+                description: |-
+                  ClusterProfileRef is an optional reference to a ClusterProfile resource
+                  (multicluster.x-k8s.io/v1alpha1). When set, the operator reconciles
+                  the component on the remote cluster described by the referenced
+                  ClusterProfile instead of the local cluster.
+                properties:
+                  name:
+                    description: Name is the name of the ClusterProfile resource.
+                    type: string
+                  namespace:
+                    description: Namespace is the namespace of the ClusterProfile
+                      resource.
+                    type: string
+                required:
+                - name
+                - namespace
+                type: object
               config:
                 additionalProperties:
                   additionalProperties:

config/rbac/role.yaml

@@ -253,6 +253,17 @@ rules:
   - pods
   verbs:
   - get
+# Multi-cluster support: read ClusterProfile resources.
+# Requires the Cluster Inventory API CRD (multicluster.x-k8s.io).
+# These permissions are harmless if the CRD is not installed.
+- apiGroups:
+  - multicluster.x-k8s.io
+  resources:
+  - clusterprofiles
+  verbs:
+  - get
+  - list
+  - watch
 ---
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
@@ -644,3 +655,14 @@ rules:
       - list
       - get
       - watch
+  # Multi-cluster support: read ClusterProfile resources.
+  # Requires the Cluster Inventory API CRD (multicluster.x-k8s.io).
+  # These permissions are harmless if the CRD is not installed.
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - clusterprofiles
+    verbs:
+      - get
+      - list
+      - watch

pkg/apis/operator/base/common.go

@@ -79,6 +79,9 @@ type KComponentSpec interface {
 
 	// GetPodDisruptionBudgetOverride gets the PodDisruptionBudget configurations to override.
 	GetPodDisruptionBudgetOverride() []PodDisruptionBudgetOverride
+
+	// GetClusterProfileRef returns a reference to a ClusterProfile for multi-cluster deployment.
+	GetClusterProfileRef() *ClusterProfileReference
 }
 
 // KComponentStatus is a common interface for status mutations of all known types.
@@ -176,6 +179,13 @@ type CommonSpec struct {
 	// PodDisruptionBudgetOverride overrides PodDisruptionBudget configurations via minAvailable.
 	// +optional
 	PodDisruptionBudgetOverride []PodDisruptionBudgetOverride `json:"podDisruptionBudgets,omitempty"`
+
+	// ClusterProfileRef is an optional reference to a ClusterProfile resource
+	// (multicluster.x-k8s.io/v1alpha1). When set, the operator reconciles
+	// the component on the remote cluster described by the referenced
+	// ClusterProfile instead of the local cluster.
+	// +optional
+	ClusterProfileRef *ClusterProfileReference `json:"clusterProfileRef,omitempty"`
 }
 
 // GetConfig implements KComponentSpec.
@@ -233,6 +243,11 @@ func (c *CommonSpec) GetPodDisruptionBudgetOverride() []PodDisruptionBudgetOverr
 	return c.PodDisruptionBudgetOverride
 }
 
+// GetClusterProfileRef implements KComponentSpec.
+func (c *CommonSpec) GetClusterProfileRef() *ClusterProfileReference {
+	return c.ClusterProfileRef
+}
+
 // ConfigMapData is a nested map of maps representing all upstream ConfigMaps. The first
 // level key is the key to the ConfigMap itself (i.e. "logging") while the second level
 // is the data to be filled into the respective ConfigMap.
@@ -431,3 +446,14 @@ type CustomCerts struct {
 	// The name of the ConfigMap or Secret
 	Name string `json:"name"`
 }
+
+// ClusterProfileReference identifies a ClusterProfile resource from the
+// Cluster Inventory API (multicluster.x-k8s.io/v1alpha1).
+// When set, the operator deploys resources to the remote cluster described by
+// this ClusterProfile instead of the local cluster.
+type ClusterProfileReference struct {
+	// Name is the name of the ClusterProfile resource.
+	Name string `json:"name"`
+	// Namespace is the namespace of the ClusterProfile resource.
+	Namespace string `json:"namespace"`
+}