Skip to content

Commit d9f2776

Browse files
vpnachevialidzhikov
vpnachev
and
ialidzhikov
authored
[GEP-26] Move CredentialsBinding to security.gardener.cloud group (gardener#9734)
* Move CredentialsBinding to security.gardener.cloud group * Address review feedback * Fix reference to security api docs * Fix the integration test --------- Co-authored-by: ialidzhikov <i.alidjikov@gmail.com>
1 parent fdfd6d5 commit d9f2776

File tree

79 files changed

+2112
-1597
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

79 files changed

+2112
-1597
lines changed

charts/gardener/controlplane/charts/application/templates/apiservice-v1alpha1-authentication-gardener-cloud.yaml renamed to charts/gardener/controlplane/charts/application/templates/apiservice-v1alpha1-security-gardener-cloud.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
apiVersion: apiregistration.k8s.io/v1
33
kind: APIService
44
metadata:
5-
name: v1alpha1.authentication.gardener.cloud
5+
name: v1alpha1.security.gardener.cloud
66
labels:
77
app: gardener
88
role: apiserver
@@ -14,7 +14,7 @@ spec:
1414
{{- if not .Values.global.apiserver.insecureSkipTLSVerify }}
1515
caBundle: {{ required ".Values.global.apiserver.caBundle is required" (b64enc .Values.global.apiserver.caBundle) }}
1616
{{- end }}
17-
group: authentication.gardener.cloud
17+
group: security.gardener.cloud
1818
version: v1alpha1
1919
groupPriorityMinimum: 10
2020
versionPriority: 10

‎cmd/gardener-apiserver/app/gardener_apiserver.go‎

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -39,22 +39,22 @@ import (
3939
logf "sigs.k8s.io/controller-runtime/pkg/log"
4040

4141
"github.com/gardener/gardener/pkg/api"
42-
authenticationv1alpha1 "github.com/gardener/gardener/pkg/apis/authentication/v1alpha1"
4342
gardencorev1beta1 "github.com/gardener/gardener/pkg/apis/core/v1beta1"
4443
v1beta1constants "github.com/gardener/gardener/pkg/apis/core/v1beta1/constants"
4544
"github.com/gardener/gardener/pkg/apis/operations"
4645
operationsv1alpha1 "github.com/gardener/gardener/pkg/apis/operations/v1alpha1"
46+
securityv1alpha1 "github.com/gardener/gardener/pkg/apis/security/v1alpha1"
4747
seedmanagementv1alpha1 "github.com/gardener/gardener/pkg/apis/seedmanagement/v1alpha1"
4848
settingsv1alpha1 "github.com/gardener/gardener/pkg/apis/settings/v1alpha1"
4949
"github.com/gardener/gardener/pkg/apiserver"
5050
admissioninitializer "github.com/gardener/gardener/pkg/apiserver/admission/initializer"
5151
"github.com/gardener/gardener/pkg/apiserver/openapi"
5252
"github.com/gardener/gardener/pkg/apiserver/storage"
53-
authenticationclientset "github.com/gardener/gardener/pkg/client/authentication/clientset/versioned"
54-
authenticationinformers "github.com/gardener/gardener/pkg/client/authentication/informers/externalversions"
5553
gardencoreclientset "github.com/gardener/gardener/pkg/client/core/clientset/versioned"
5654
gardencoreinformers "github.com/gardener/gardener/pkg/client/core/informers/externalversions"
5755
kubernetesclient "github.com/gardener/gardener/pkg/client/kubernetes"
56+
securityclientset "github.com/gardener/gardener/pkg/client/security/clientset/versioned"
57+
securityinformers "github.com/gardener/gardener/pkg/client/security/informers/externalversions"
5858
seedmanagementclientset "github.com/gardener/gardener/pkg/client/seedmanagement/clientset/versioned"
5959
seedmanagementinformers "github.com/gardener/gardener/pkg/client/seedmanagement/informers/externalversions"
6060
settingsclientset "github.com/gardener/gardener/pkg/client/settings/clientset/versioned"
@@ -109,7 +109,7 @@ type Options struct {
109109
KubeInformerFactory kubeinformers.SharedInformerFactory
110110
SeedManagementInformerFactory seedmanagementinformers.SharedInformerFactory
111111
SettingsInformerFactory settingsinformers.SharedInformerFactory
112-
AuthenticationInformerFactory authenticationinformers.SharedInformerFactory
112+
SecurityInformerFactory securityinformers.SharedInformerFactory
113113

114114
Logs *logsv1.LoggingConfiguration
115115
}
@@ -123,7 +123,7 @@ func NewOptions() *Options {
123123
seedmanagementv1alpha1.SchemeGroupVersion,
124124
settingsv1alpha1.SchemeGroupVersion,
125125
operationsv1alpha1.SchemeGroupVersion,
126-
authenticationv1alpha1.SchemeGroupVersion,
126+
securityv1alpha1.SchemeGroupVersion,
127127
),
128128
),
129129
ServerRunOptions: genericoptions.NewServerRunOptions(),
@@ -212,12 +212,12 @@ func (o *Options) config(kubeAPIServerConfig *rest.Config, kubeClient *kubernete
212212
}
213213
o.SettingsInformerFactory = settingsinformers.NewSharedInformerFactory(settingsClient, protobufLoopbackConfig.Timeout)
214214

215-
// authentication client
216-
authenticationClient, err := authenticationclientset.NewForConfig(&protobufLoopbackConfig)
215+
// security client
216+
securityClient, err := securityclientset.NewForConfig(&protobufLoopbackConfig)
217217
if err != nil {
218218
return nil, err
219219
}
220-
o.AuthenticationInformerFactory = authenticationinformers.NewSharedInformerFactory(authenticationClient, protobufLoopbackConfig.Timeout)
220+
o.SecurityInformerFactory = securityinformers.NewSharedInformerFactory(securityClient, protobufLoopbackConfig.Timeout)
221221

222222
// dynamic client
223223
dynamicClient, err := dynamic.NewForConfig(kubeAPIServerConfig)
@@ -234,8 +234,8 @@ func (o *Options) config(kubeAPIServerConfig *rest.Config, kubeClient *kubernete
234234
o.SeedManagementInformerFactory,
235235
seedManagementClient,
236236
o.SettingsInformerFactory,
237-
o.AuthenticationInformerFactory,
238-
authenticationClient,
237+
o.SecurityInformerFactory,
238+
securityClient,
239239
o.KubeInformerFactory,
240240
kubeClient,
241241
dynamicClient,
@@ -310,7 +310,7 @@ func (o *Options) Run(ctx context.Context) error {
310310
o.CoreInformerFactory.Start(context.StopCh)
311311
o.KubeInformerFactory.Start(context.StopCh)
312312
o.SeedManagementInformerFactory.Start(context.StopCh)
313-
o.AuthenticationInformerFactory.Start(context.StopCh)
313+
o.SecurityInformerFactory.Start(context.StopCh)
314314
o.SettingsInformerFactory.Start(context.StopCh)
315315
return nil
316316
}); err != nil {
@@ -422,7 +422,8 @@ func (o *Options) ApplyTo(config *apiserver.Config, kubeClient kubernetes.Interf
422422
seedmanagementv1alpha1.SchemeGroupVersion,
423423
settingsv1alpha1.SchemeGroupVersion,
424424
operationsv1alpha1.SchemeGroupVersion,
425-
authenticationv1alpha1.SchemeGroupVersion,
425+
securityv1alpha1.SchemeGroupVersion,
426+
// Note: "authentication.gardener.cloud/v1alpha1" API is already used for CRD registration and must not be served by the API server.
426427
)
427428

428429
mergedResourceConfig, err := resourceconfig.MergeAPIResourceConfigs(resourceConfig, nil, api.Scheme)

‎docs/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@
7979
* [`extensions.gardener.cloud` API Group](api-reference/extensions.md)
8080
* [`operations.gardener.cloud` API Group](api-reference/operations.md)
8181
* [`resources.gardener.cloud` API Group](api-reference/resources.md)
82+
* [`security.gardener.cloid` API Group](api-reference/security.md)
8283
* [`seedmanagement.gardener.cloud` API Group](api-reference/seedmanagement.md)
8384
* [`settings.gardener.cloud` API Group](api-reference/settings.md)
8485

‎docs/api-reference/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,6 @@
55
* [`extensions.gardener.cloud` API Group](extensions.md)
66
* [`operations.gardener.cloud` API Group](operations.md)
77
* [`resources.gardener.cloud` API Group](resources.md)
8+
* [`security.gardener.cloid` API Group](security.md)
89
* [`seedmanagement.gardener.cloud` API Group](seedmanagement.md)
910
* [`settings.gardener.cloud` API Group](settings.md)

‎docs/api-reference/authentication.md‎

Lines changed: 3 additions & 125 deletions
Original file line numberDiff line numberDiff line change
@@ -6,103 +6,11 @@
66
</ul>
77
<h2 id="authentication.gardener.cloud/v1alpha1">authentication.gardener.cloud/v1alpha1</h2>
88
<p>
9-
<p>Package v1alpha1 is a version of the API.</p>
9+
<p>Package v1alpha1 is a version of the API.
10+
&ldquo;authentication.gardener.cloud/v1alpha1&rdquo; API is already used for CRD registration and must not be served by the API server.</p>
1011
</p>
1112
Resource Types:
12-
<ul><li>
13-
<a href="#authentication.gardener.cloud/v1alpha1.CredentialsBinding">CredentialsBinding</a>
14-
</li></ul>
15-
<h3 id="authentication.gardener.cloud/v1alpha1.CredentialsBinding">CredentialsBinding
16-
</h3>
17-
<p>
18-
<p>CredentialsBinding represents a binding to credentials in the same or another namespace.</p>
19-
</p>
20-
<table>
21-
<thead>
22-
<tr>
23-
<th>Field</th>
24-
<th>Description</th>
25-
</tr>
26-
</thead>
27-
<tbody>
28-
<tr>
29-
<td>
30-
<code>apiVersion</code></br>
31-
string</td>
32-
<td>
33-
<code>
34-
authentication.gardener.cloud/v1alpha1
35-
</code>
36-
</td>
37-
</tr>
38-
<tr>
39-
<td>
40-
<code>kind</code></br>
41-
string
42-
</td>
43-
<td><code>CredentialsBinding</code></td>
44-
</tr>
45-
<tr>
46-
<td>
47-
<code>metadata</code></br>
48-
<em>
49-
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#objectmeta-v1-meta">
50-
Kubernetes meta/v1.ObjectMeta
51-
</a>
52-
</em>
53-
</td>
54-
<td>
55-
<em>(Optional)</em>
56-
<p>Standard object metadata.</p>
57-
Refer to the Kubernetes API documentation for the fields of the
58-
<code>metadata</code> field.
59-
</td>
60-
</tr>
61-
<tr>
62-
<td>
63-
<code>provider</code></br>
64-
<em>
65-
<a href="#authentication.gardener.cloud/v1alpha1.CredentialsBindingProvider">
66-
CredentialsBindingProvider
67-
</a>
68-
</em>
69-
</td>
70-
<td>
71-
<p>Provider defines the provider type of the CredentialsBinding.
72-
This field is immutable.</p>
73-
</td>
74-
</tr>
75-
<tr>
76-
<td>
77-
<code>credentialsRef</code></br>
78-
<em>
79-
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#objectreference-v1-core">
80-
Kubernetes core/v1.ObjectReference
81-
</a>
82-
</em>
83-
</td>
84-
<td>
85-
<p>CredentialsRef is a reference to a resource holding the credentials.
86-
Accepted resources are core/v1.Secret and authentication.gardener.cloud/v1alpha1.WorkloadIdentity</p>
87-
</td>
88-
</tr>
89-
<tr>
90-
<td>
91-
<code>quotas</code></br>
92-
<em>
93-
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#objectreference-v1-core">
94-
[]Kubernetes core/v1.ObjectReference
95-
</a>
96-
</em>
97-
</td>
98-
<td>
99-
<em>(Optional)</em>
100-
<p>Quotas is a list of references to Quota objects in the same or another namespace.
101-
This field is immutable.</p>
102-
</td>
103-
</tr>
104-
</tbody>
105-
</table>
13+
<ul></ul>
10614
<h3 id="authentication.gardener.cloud/v1alpha1.AdminKubeconfigRequest">AdminKubeconfigRequest
10715
</h3>
10816
<p>
@@ -257,36 +165,6 @@ Kubernetes meta/v1.Time
257165
</tr>
258166
</tbody>
259167
</table>
260-
<h3 id="authentication.gardener.cloud/v1alpha1.CredentialsBindingProvider">CredentialsBindingProvider
261-
</h3>
262-
<p>
263-
(<em>Appears on:</em>
264-
<a href="#authentication.gardener.cloud/v1alpha1.CredentialsBinding">CredentialsBinding</a>)
265-
</p>
266-
<p>
267-
<p>CredentialsBindingProvider defines the provider type of the CredentialsBinding.</p>
268-
</p>
269-
<table>
270-
<thead>
271-
<tr>
272-
<th>Field</th>
273-
<th>Description</th>
274-
</tr>
275-
</thead>
276-
<tbody>
277-
<tr>
278-
<td>
279-
<code>type</code></br>
280-
<em>
281-
string
282-
</em>
283-
</td>
284-
<td>
285-
<p>Type is the type of the provider.</p>
286-
</td>
287-
</tr>
288-
</tbody>
289-
</table>
290168
<h3 id="authentication.gardener.cloud/v1alpha1.ViewerKubeconfigRequest">ViewerKubeconfigRequest
291169
</h3>
292170
<p>

0 commit comments

Comments
 (0)