Skip to content

Commit 0344b9b

Browse files
liubog2008liubog2008
authored
feat: support mount sa token explicitly if automount is false (#6815)
1 parent 802bddb commit 0344b9b

10 files changed

Lines changed: 339 additions & 11 deletions

File tree

‎pkg/backup/backup/backup_cleaner.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -279,6 +279,11 @@ func (bc *backupCleaner) makeCleanJob(backup *v1alpha1.Backup) (*batchv1.Job, st
279279
},
280280
}
281281

282+
if backup.Spec.AutomountServiceAccountToken != nil && !*backup.Spec.AutomountServiceAccountToken {
283+
podSpec.Spec.Volumes = append(podSpec.Spec.Volumes, util.SATokenProjectionVolume())
284+
podSpec.Spec.Containers[0].VolumeMounts = append(podSpec.Spec.Containers[0].VolumeMounts, util.SATokenProjectionVolumeMount())
285+
}
286+
282287
job := &batchv1.Job{
283288
ObjectMeta: metav1.ObjectMeta{
284289
Name: backup.GetCleanJobName(),
@@ -479,6 +484,11 @@ func (bc *backupCleaner) makeStopLogBackupJob(backup *v1alpha1.Backup) (*batchv1
479484
},
480485
}
481486

487+
if backup.Spec.AutomountServiceAccountToken != nil && !*backup.Spec.AutomountServiceAccountToken {
488+
podSpec.Spec.Volumes = append(podSpec.Spec.Volumes, util.SATokenProjectionVolume())
489+
podSpec.Spec.Containers[0].VolumeMounts = append(podSpec.Spec.Containers[0].VolumeMounts, util.SATokenProjectionVolumeMount())
490+
}
491+
482492
job := &batchv1.Job{
483493
ObjectMeta: metav1.ObjectMeta{
484494
Name: jobName,

‎pkg/backup/backup/backup_manager.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -651,6 +651,11 @@ func (bm *backupManager) makeExportJob(backup *v1alpha1.Backup) (*batchv1.Job, s
651651
},
652652
}
653653

654+
if backup.Spec.AutomountServiceAccountToken != nil && !*backup.Spec.AutomountServiceAccountToken {
655+
podSpec.Spec.Volumes = append(podSpec.Spec.Volumes, util.SATokenProjectionVolume())
656+
podSpec.Spec.Containers[0].VolumeMounts = append(podSpec.Spec.Containers[0].VolumeMounts, util.SATokenProjectionVolumeMount())
657+
}
658+
654659
job := &batchv1.Job{
655660
ObjectMeta: metav1.ObjectMeta{
656661
Name: backup.GetBackupJobName(),
@@ -880,6 +885,11 @@ func (bm *backupManager) makeBRBackupJob(backup *v1alpha1.Backup) (*batchv1.Job,
880885
},
881886
}
882887

888+
if backup.Spec.AutomountServiceAccountToken != nil && !*backup.Spec.AutomountServiceAccountToken {
889+
podSpec.Spec.Volumes = append(podSpec.Spec.Volumes, util.SATokenProjectionVolume())
890+
podSpec.Spec.Containers[0].VolumeMounts = append(podSpec.Spec.Containers[0].VolumeMounts, util.SATokenProjectionVolumeMount())
891+
}
892+
883893
job := &batchv1.Job{
884894
ObjectMeta: metav1.ObjectMeta{
885895
Name: jobName,

‎pkg/backup/restore/restore_manager.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -858,6 +858,11 @@ func (rm *restoreManager) makeImportJob(restore *v1alpha1.Restore) (*batchv1.Job
858858
},
859859
}
860860

861+
if restore.Spec.AutomountServiceAccountToken != nil && !*restore.Spec.AutomountServiceAccountToken {
862+
podSpec.Spec.Volumes = append(podSpec.Spec.Volumes, util.SATokenProjectionVolume())
863+
podSpec.Spec.Containers[0].VolumeMounts = append(podSpec.Spec.Containers[0].VolumeMounts, util.SATokenProjectionVolumeMount())
864+
}
865+
861866
job := &batchv1.Job{
862867
ObjectMeta: metav1.ObjectMeta{
863868
Name: restore.GetRestoreJobName(),
@@ -1097,6 +1102,11 @@ func (rm *restoreManager) makeRestoreJobWithMode(restore *v1alpha1.Restore, isPr
10971102
},
10981103
}
10991104

1105+
if restore.Spec.AutomountServiceAccountToken != nil && !*restore.Spec.AutomountServiceAccountToken {
1106+
podSpec.Spec.Volumes = append(podSpec.Spec.Volumes, util.SATokenProjectionVolume())
1107+
podSpec.Spec.Containers[0].VolumeMounts = append(podSpec.Spec.Containers[0].VolumeMounts, util.SATokenProjectionVolumeMount())
1108+
}
1109+
11001110
// Job name differs between restore and prune jobs
11011111
jobName := restore.GetRestoreJobName()
11021112
if isPruneJob {

‎pkg/controller/compactbackup/compact_backup_controller.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -469,6 +469,11 @@ func (c *Controller) makeCompactJob(compact *v1alpha1.CompactBackup) (*batchv1.J
469469
},
470470
}
471471

472+
if compact.Spec.AutomountServiceAccountToken != nil && !*compact.Spec.AutomountServiceAccountToken {
473+
podSpec.Spec.Volumes = append(podSpec.Spec.Volumes, util.SATokenProjectionVolume())
474+
podSpec.Spec.Containers[0].VolumeMounts = append(podSpec.Spec.Containers[0].VolumeMounts, util.SATokenProjectionVolumeMount())
475+
}
476+
472477
job := &batchv1.Job{
473478
ObjectMeta: metav1.ObjectMeta{
474479
Name: jobName,

‎pkg/manager/member/tidb_discovery_manager.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -311,6 +311,11 @@ func (m *realTidbDiscoveryManager) getTidbDiscoveryDeployment(obj metav1.Object)
311311
})
312312
}
313313

314+
if baseSpec.AutomountServiceAccountToken() != nil && !*baseSpec.AutomountServiceAccountToken() {
315+
podSpec.Volumes = append(podSpec.Volumes, util.SATokenProjectionVolume())
316+
podSpec.Containers[0].VolumeMounts = append(podSpec.Containers[0].VolumeMounts, util.SATokenProjectionVolumeMount())
317+
}
318+
314319
podLabels := util.CombineStringMap(l.Labels(), baseSpec.Labels())
315320
podAnnotations := baseSpec.Annotations()
316321
d := &appsv1.Deployment{

‎pkg/util/util.go‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,66 @@ var (
5959
const (
6060
// LastAppliedConfigAnnotation is annotation key of last applied configuration
6161
LastAppliedConfigAnnotation = "pingcap.com/last-applied-configuration"
62+
63+
// SATokenProjectionVolumeName is the name of the projected service account token volume.
64+
SATokenProjectionVolumeName = "kube-api-access"
65+
// SATokenProjectionMountPath is the standard Kubernetes service account token mount path.
66+
SATokenProjectionMountPath = "/var/run/secrets/kubernetes.io/serviceaccount" // nolint:gosec
6267
)
6368

69+
// SATokenProjectionVolume returns a projected volume that replicates the three files
70+
// that rest.InClusterConfig() reads from /var/run/secrets/kubernetes.io/serviceaccount:
71+
// token, ca.crt, and namespace. Use this when automountServiceAccountToken is false
72+
// but the container still needs to call the Kubernetes API.
73+
func SATokenProjectionVolume() corev1.Volume {
74+
expirationSeconds := int64(3607)
75+
return corev1.Volume{
76+
Name: SATokenProjectionVolumeName,
77+
VolumeSource: corev1.VolumeSource{
78+
Projected: &corev1.ProjectedVolumeSource{
79+
Sources: []corev1.VolumeProjection{
80+
{
81+
ServiceAccountToken: &corev1.ServiceAccountTokenProjection{
82+
Path: "token",
83+
ExpirationSeconds: &expirationSeconds,
84+
},
85+
},
86+
{
87+
ConfigMap: &corev1.ConfigMapProjection{
88+
LocalObjectReference: corev1.LocalObjectReference{Name: "kube-root-ca.crt"},
89+
Items: []corev1.KeyToPath{
90+
{Key: "ca.crt", Path: "ca.crt"},
91+
},
92+
},
93+
},
94+
{
95+
DownwardAPI: &corev1.DownwardAPIProjection{
96+
Items: []corev1.DownwardAPIVolumeFile{
97+
{
98+
Path: "namespace",
99+
FieldRef: &corev1.ObjectFieldSelector{
100+
APIVersion: "v1",
101+
FieldPath: "metadata.namespace",
102+
},
103+
},
104+
},
105+
},
106+
},
107+
},
108+
},
109+
},
110+
}
111+
}
112+
113+
// SATokenProjectionVolumeMount returns the VolumeMount for SATokenProjectionVolume.
114+
func SATokenProjectionVolumeMount() corev1.VolumeMount {
115+
return corev1.VolumeMount{
116+
Name: SATokenProjectionVolumeName,
117+
MountPath: SATokenProjectionMountPath,
118+
ReadOnly: true,
119+
}
120+
}
121+
64122
func GetOrdinalFromPodName(podName string) (int32, error) {
65123
ordinalStr := podName[strings.LastIndex(podName, "-")+1:]
66124
ordinalInt, err := strconv.ParseInt(ordinalStr, 10, 32)

‎tests/config.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ type Config struct {
4141

4242
TidbVersions string `yaml:"tidb_versions" json:"tidb_versions"`
4343
InstallOperator bool `yaml:"install_opeartor" json:"install_opeartor"`
44+
InstallCertManager bool `yaml:"install_cert_manager" json:"install_cert_manager"`
4445
InstallDMMysql bool `yaml:"install_dm_mysql" json:"install_dm_mysql"`
4546
OperatorTag string `yaml:"operator_tag" json:"operator_tag"`
4647
OperatorImage string `yaml:"operator_image" json:"operator_image"`
@@ -96,6 +97,7 @@ type Node struct {
9697
func NewDefaultConfig() *Config {
9798
return &Config{
9899
AdditionalDrainerVersion: "v3.0.8",
100+
InstallCertManager: true,
99101

100102
PDMaxReplicas: 5,
101103
TiDBTokenLimit: 1024,

0 commit comments

Comments
 (0)