|
| 1 | +/* |
| 2 | +Copyright 2026. |
| 3 | +
|
| 4 | +Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | +you may not use this file except in compliance with the License. |
| 6 | +You may obtain a copy of the License at |
| 7 | +
|
| 8 | + http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +
|
| 10 | +Unless required by applicable law or agreed to in writing, software |
| 11 | +distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | +See the License for the specific language governing permissions and |
| 14 | +limitations under the License. |
| 15 | +*/ |
| 16 | + |
| 17 | +package controller |
| 18 | + |
| 19 | +import ( |
| 20 | + "fmt" |
| 21 | + |
| 22 | + consolev1 "github.com/openshift/api/console/v1" |
| 23 | + appsv1 "k8s.io/api/apps/v1" |
| 24 | + corev1 "k8s.io/api/core/v1" |
| 25 | + networkingv1 "k8s.io/api/networking/v1" |
| 26 | + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| 27 | + "k8s.io/apimachinery/pkg/util/intstr" |
| 28 | +) |
| 29 | + |
| 30 | +// generateConsoleSelectorLabels returns a map of labels used as selectors |
| 31 | +// for the console plugin pods. |
| 32 | +func generateConsoleSelectorLabels() map[string]string { |
| 33 | + return map[string]string{ |
| 34 | + "app.kubernetes.io/component": "console-plugin", |
| 35 | + "app.kubernetes.io/managed-by": "openstack-lightspeed-operator", |
| 36 | + "app.kubernetes.io/name": "lightspeed-console-plugin", |
| 37 | + "app.kubernetes.io/part-of": "openstack-lightspeed", |
| 38 | + } |
| 39 | +} |
| 40 | + |
| 41 | +// buildConsoleDeploymentSpec builds the Deployment spec for the console plugin. |
| 42 | +func buildConsoleDeploymentSpec(consoleImage string) appsv1.DeploymentSpec { |
| 43 | + replicas := int32(1) |
| 44 | + volumeDefaultMode := VolumeDefaultMode |
| 45 | + labels := generateConsoleSelectorLabels() |
| 46 | + |
| 47 | + return appsv1.DeploymentSpec{ |
| 48 | + Replicas: &replicas, |
| 49 | + Selector: &metav1.LabelSelector{ |
| 50 | + MatchLabels: labels, |
| 51 | + }, |
| 52 | + Template: corev1.PodTemplateSpec{ |
| 53 | + ObjectMeta: metav1.ObjectMeta{ |
| 54 | + Labels: labels, |
| 55 | + }, |
| 56 | + Spec: corev1.PodSpec{ |
| 57 | + SecurityContext: &corev1.PodSecurityContext{ |
| 58 | + RunAsNonRoot: toPtr(true), |
| 59 | + SeccompProfile: &corev1.SeccompProfile{ |
| 60 | + Type: corev1.SeccompProfileTypeRuntimeDefault, |
| 61 | + }, |
| 62 | + }, |
| 63 | + ServiceAccountName: ConsoleUIServiceAccountName, |
| 64 | + Containers: []corev1.Container{ |
| 65 | + { |
| 66 | + Name: "lightspeed-console-plugin", |
| 67 | + Image: consoleImage, |
| 68 | + Ports: []corev1.ContainerPort{ |
| 69 | + { |
| 70 | + ContainerPort: ConsoleUIHTTPSPort, |
| 71 | + Name: "https", |
| 72 | + Protocol: corev1.ProtocolTCP, |
| 73 | + }, |
| 74 | + }, |
| 75 | + ImagePullPolicy: corev1.PullAlways, |
| 76 | + SecurityContext: &corev1.SecurityContext{ |
| 77 | + AllowPrivilegeEscalation: toPtr(false), |
| 78 | + }, |
| 79 | + VolumeMounts: []corev1.VolumeMount{ |
| 80 | + { |
| 81 | + Name: "lightspeed-console-plugin-cert", |
| 82 | + MountPath: "/var/cert", |
| 83 | + ReadOnly: true, |
| 84 | + }, |
| 85 | + { |
| 86 | + Name: "nginx-config", |
| 87 | + MountPath: "/etc/nginx/nginx.conf", |
| 88 | + SubPath: "nginx.conf", |
| 89 | + ReadOnly: true, |
| 90 | + }, |
| 91 | + { |
| 92 | + Name: "nginx-temp", |
| 93 | + MountPath: "/tmp/nginx", |
| 94 | + }, |
| 95 | + }, |
| 96 | + }, |
| 97 | + }, |
| 98 | + Volumes: []corev1.Volume{ |
| 99 | + { |
| 100 | + Name: "lightspeed-console-plugin-cert", |
| 101 | + VolumeSource: corev1.VolumeSource{ |
| 102 | + Secret: &corev1.SecretVolumeSource{ |
| 103 | + SecretName: ConsoleUIServiceCertSecretName, |
| 104 | + DefaultMode: &volumeDefaultMode, |
| 105 | + }, |
| 106 | + }, |
| 107 | + }, |
| 108 | + { |
| 109 | + Name: "nginx-config", |
| 110 | + VolumeSource: corev1.VolumeSource{ |
| 111 | + ConfigMap: &corev1.ConfigMapVolumeSource{ |
| 112 | + LocalObjectReference: corev1.LocalObjectReference{ |
| 113 | + Name: ConsoleUIConfigMapName, |
| 114 | + }, |
| 115 | + DefaultMode: &volumeDefaultMode, |
| 116 | + }, |
| 117 | + }, |
| 118 | + }, |
| 119 | + { |
| 120 | + Name: "nginx-temp", |
| 121 | + VolumeSource: corev1.VolumeSource{ |
| 122 | + EmptyDir: &corev1.EmptyDirVolumeSource{}, |
| 123 | + }, |
| 124 | + }, |
| 125 | + }, |
| 126 | + }, |
| 127 | + }, |
| 128 | + } |
| 129 | +} |
| 130 | + |
| 131 | +// buildConsolePluginSpec builds the ConsolePlugin spec with backend and proxy configuration. |
| 132 | +func buildConsolePluginSpec(namespace string) consolev1.ConsolePluginSpec { |
| 133 | + return consolev1.ConsolePluginSpec{ |
| 134 | + Backend: consolev1.ConsolePluginBackend{ |
| 135 | + Service: &consolev1.ConsolePluginService{ |
| 136 | + Name: ConsoleUIServiceName, |
| 137 | + Namespace: namespace, |
| 138 | + Port: ConsoleUIHTTPSPort, |
| 139 | + BasePath: "/", |
| 140 | + }, |
| 141 | + Type: consolev1.Service, |
| 142 | + }, |
| 143 | + DisplayName: "Lightspeed Console Plugin", |
| 144 | + I18n: consolev1.ConsolePluginI18n{ |
| 145 | + LoadType: consolev1.Preload, |
| 146 | + }, |
| 147 | + Proxy: []consolev1.ConsolePluginProxy{ |
| 148 | + { |
| 149 | + Alias: ConsoleProxyAlias, |
| 150 | + Authorization: consolev1.UserToken, |
| 151 | + Endpoint: consolev1.ConsolePluginProxyEndpoint{ |
| 152 | + Service: &consolev1.ConsolePluginProxyServiceConfig{ |
| 153 | + Name: OpenStackLightspeedAppServerServiceName, |
| 154 | + Namespace: namespace, |
| 155 | + Port: OpenStackLightspeedAppServerServicePort, |
| 156 | + }, |
| 157 | + Type: consolev1.ProxyTypeService, |
| 158 | + }, |
| 159 | + }, |
| 160 | + }, |
| 161 | + } |
| 162 | +} |
| 163 | + |
| 164 | +// buildConsoleNginxConfig returns the nginx configuration content for the console plugin. |
| 165 | +func buildConsoleNginxConfig() string { |
| 166 | + return fmt.Sprintf(consoleNginxConfigTemplate, ConsoleUIHTTPSPort) |
| 167 | +} |
| 168 | + |
| 169 | +// buildConsoleNetworkPolicySpec builds the NetworkPolicy spec for the console plugin. |
| 170 | +func buildConsoleNetworkPolicySpec() networkingv1.NetworkPolicySpec { |
| 171 | + return networkingv1.NetworkPolicySpec{ |
| 172 | + PodSelector: metav1.LabelSelector{ |
| 173 | + MatchLabels: generateConsoleSelectorLabels(), |
| 174 | + }, |
| 175 | + Ingress: []networkingv1.NetworkPolicyIngressRule{ |
| 176 | + { |
| 177 | + From: []networkingv1.NetworkPolicyPeer{ |
| 178 | + { |
| 179 | + NamespaceSelector: &metav1.LabelSelector{ |
| 180 | + MatchLabels: map[string]string{ |
| 181 | + "kubernetes.io/metadata.name": "openshift-console", |
| 182 | + }, |
| 183 | + }, |
| 184 | + PodSelector: &metav1.LabelSelector{ |
| 185 | + MatchLabels: map[string]string{ |
| 186 | + "app": "console", |
| 187 | + }, |
| 188 | + }, |
| 189 | + }, |
| 190 | + }, |
| 191 | + Ports: []networkingv1.NetworkPolicyPort{ |
| 192 | + { |
| 193 | + Protocol: toPtr(corev1.ProtocolTCP), |
| 194 | + Port: toPtr(intstr.FromInt32(ConsoleUIHTTPSPort)), |
| 195 | + }, |
| 196 | + }, |
| 197 | + }, |
| 198 | + }, |
| 199 | + PolicyTypes: []networkingv1.PolicyType{ |
| 200 | + networkingv1.PolicyTypeIngress, |
| 201 | + }, |
| 202 | + } |
| 203 | +} |
0 commit comments