Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support multi secret #242

Merged
merged 8 commits into from
Nov 27, 2024
Merged

Support multi secret #242

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
6eec00c
multi secret
Sep 10, 2024
eb1567b
Merge remote-tracking branch 'refs/remotes/upstream/master' into mult…
Sep 18, 2024
f8c4cba
multi secret
Sep 18, 2024
8ffbf55
multi secret
Sep 18, 2024
2ce8067
Merge remote-tracking branch 'refs/remotes/upstream/master' into mult…
Sep 23, 2024
b08c22e
multi secret
Sep 23, 2024
f4cb998
Merge remote-tracking branch 'refs/remotes/upstream/master' into mult…
Oct 29, 2024
cb87526
Merge remote-tracking branch 'refs/remotes/upstream/master' into mult…
Nov 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions api/doris/v1/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,6 +208,10 @@ type BaseSpec struct {
//Security context for all containers running in the pod (unless they override it).
//+optional
ContainerSecurityContext *corev1.SecurityContext `json:"containerSecurityContext,omitempty"`

// Multi Secret for pod.
// +optional
Secrets []Secret `json:"secrets,omitempty"`
}

type SystemInitialization struct {
Expand Down Expand Up @@ -281,6 +285,16 @@ type MountConfigMapInfo struct {
MountPath string `json:"mountPath,omitempty"`
}

type Secret struct {
// name of secret that needs to mount.
SecretName string `json:"secretName,omitempty"`

// Current Secret Mount Path, default is "/etc/doris"
// If Secret belongs to the same Secrets, their MountPath cannot be repeated.
// +optional
Copy link
Contributor

@intelligentfu8 intelligentfu8 Sep 23, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

mountPath can't be repeated.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

MountPath string `json:"mountPath,omitempty"`
}

// ExportService consisting of expose ports for user access to software service.
type ExportService struct {
//type of service,the possible value for the service type are : ClusterIP, NodePort, LoadBalancer,ExternalName.
Expand Down
20 changes: 20 additions & 0 deletions api/doris/v1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

56 changes: 56 additions & 0 deletions config/crd/bases/crds.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1628,6 +1628,20 @@ spec:
it defaults to Limits if that is explicitly specified, otherwise
to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
type: object
secrets:
description: Multi Secret for pod.
items:
properties:
mountPath:
description: Current Secret Mount Path, default is "/etc/doris"
If Secret belongs to the same Secrets, their MountPath
cannot be repeated.
type: string
secretName:
description: name of secret that needs to mount.
type: string
type: object
type: array
securityContext:
description: Security context for pod.
properties:
Expand Down Expand Up @@ -3500,6 +3514,20 @@ spec:
it defaults to Limits if that is explicitly specified, otherwise
to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
type: object
secrets:
description: Multi Secret for pod.
items:
properties:
mountPath:
description: Current Secret Mount Path, default is "/etc/doris"
If Secret belongs to the same Secrets, their MountPath
cannot be repeated.
type: string
secretName:
description: name of secret that needs to mount.
type: string
type: object
type: array
securityContext:
description: Security context for pod.
properties:
Expand Down Expand Up @@ -6045,6 +6073,20 @@ spec:
it defaults to Limits if that is explicitly specified, otherwise
to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
type: object
secrets:
description: Multi Secret for pod.
items:
properties:
mountPath:
description: Current Secret Mount Path, default is "/etc/doris"
If Secret belongs to the same Secrets, their MountPath
cannot be repeated.
type: string
secretName:
description: name of secret that needs to mount.
type: string
type: object
type: array
securityContext:
description: Security context for pod.
properties:
Expand Down Expand Up @@ -7917,6 +7959,20 @@ spec:
it defaults to Limits if that is explicitly specified, otherwise
to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
type: object
secrets:
description: Multi Secret for pod.
items:
properties:
mountPath:
description: Current Secret Mount Path, default is "/etc/doris"
If Secret belongs to the same Secrets, their MountPath
cannot be repeated.
type: string
secretName:
description: name of secret that needs to mount.
type: string
type: object
type: array
securityContext:
description: Security context for pod.
properties:
Expand Down
56 changes: 56 additions & 0 deletions config/crd/bases/doris.selectdb.com_dorisclusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1628,6 +1628,20 @@ spec:
it defaults to Limits if that is explicitly specified, otherwise
to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
type: object
secrets:
description: Multi Secret for pod.
items:
properties:
mountPath:
description: Current Secret Mount Path, default is "/etc/doris"
If Secret belongs to the same Secrets, their MountPath
cannot be repeated.
type: string
secretName:
description: name of secret that needs to mount.
type: string
type: object
type: array
securityContext:
description: Security context for pod.
properties:
Expand Down Expand Up @@ -3500,6 +3514,20 @@ spec:
it defaults to Limits if that is explicitly specified, otherwise
to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
type: object
secrets:
description: Multi Secret for pod.
items:
properties:
mountPath:
description: Current Secret Mount Path, default is "/etc/doris"
If Secret belongs to the same Secrets, their MountPath
cannot be repeated.
type: string
secretName:
description: name of secret that needs to mount.
type: string
type: object
type: array
securityContext:
description: Security context for pod.
properties:
Expand Down Expand Up @@ -6045,6 +6073,20 @@ spec:
it defaults to Limits if that is explicitly specified, otherwise
to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
type: object
secrets:
description: Multi Secret for pod.
items:
properties:
mountPath:
description: Current Secret Mount Path, default is "/etc/doris"
If Secret belongs to the same Secrets, their MountPath
cannot be repeated.
type: string
secretName:
description: name of secret that needs to mount.
type: string
type: object
type: array
securityContext:
description: Security context for pod.
properties:
Expand Down Expand Up @@ -7917,6 +7959,20 @@ spec:
it defaults to Limits if that is explicitly specified, otherwise
to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
type: object
secrets:
description: Multi Secret for pod.
items:
properties:
mountPath:
description: Current Secret Mount Path, default is "/etc/doris"
If Secret belongs to the same Secrets, their MountPath
cannot be repeated.
type: string
secretName:
description: name of secret that needs to mount.
type: string
type: object
type: array
securityContext:
description: Security context for pod.
properties:
Expand Down
53 changes: 53 additions & 0 deletions doc/examples/doriscluster-sample-secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership. The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.

# this yaml describe `secret` config in DorisCluster CRD.
#Compareed to `doriscluster-sample.yaml`, It have `secret` config for fe
apiVersion: doris.selectdb.com/v1
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please add secrets that used in the example, in front of the yaml.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

kind: DorisCluster
metadata:
labels:
app.kubernetes.io/name: doriscluster
app.kubernetes.io/instance: doriscluster-sample-secret
app.kubernetes.io/part-of: doris-operator
name: doriscluster-sample-secret
spec:
feSpec:
replicas: 3
image: selectdb/doris.fe-ubuntu:2.1.1
limits:
cpu: 8
memory: 16Gi
requests:
cpu: 8
memory: 16Gi
secrets:
# use kubectl create secret generic db-user --from-file=./username.txt -n doris
- secretName: db-user
mountPath: /etc/doris
# use kubectl create secret generic db-pass --from-file=./password.txt -n doris
- secretName: db-pass
mountPath: /opt/doris
beSpec:
replicas: 3
image: selectdb/doris.be-ubuntu:2.1.1
limits:
cpu: 8
memory: 16Gi
requests:
cpu: 8
memory: 16Gi
56 changes: 56 additions & 0 deletions helm-charts/doris-operator/crds/doris.selectdb.com_dorisclusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1628,6 +1628,20 @@ spec:
it defaults to Limits if that is explicitly specified, otherwise
to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
type: object
secrets:
description: Multi Secret for pod.
items:
properties:
mountPath:
description: Current Secret Mount Path, default is "/etc/doris"
If Secret belongs to the same Secrets, their MountPath
cannot be repeated.
type: string
secretName:
description: name of secret that needs to mount.
type: string
type: object
type: array
securityContext:
description: Security context for pod.
properties:
Expand Down Expand Up @@ -3500,6 +3514,20 @@ spec:
it defaults to Limits if that is explicitly specified, otherwise
to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
type: object
secrets:
description: Multi Secret for pod.
items:
properties:
mountPath:
description: Current Secret Mount Path, default is "/etc/doris"
If Secret belongs to the same Secrets, their MountPath
cannot be repeated.
type: string
secretName:
description: name of secret that needs to mount.
type: string
type: object
type: array
securityContext:
description: Security context for pod.
properties:
Expand Down Expand Up @@ -6045,6 +6073,20 @@ spec:
it defaults to Limits if that is explicitly specified, otherwise
to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
type: object
secrets:
description: Multi Secret for pod.
items:
properties:
mountPath:
description: Current Secret Mount Path, default is "/etc/doris"
If Secret belongs to the same Secrets, their MountPath
cannot be repeated.
type: string
secretName:
description: name of secret that needs to mount.
type: string
type: object
type: array
securityContext:
description: Security context for pod.
properties:
Expand Down Expand Up @@ -7917,6 +7959,20 @@ spec:
it defaults to Limits if that is explicitly specified, otherwise
to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
type: object
secrets:
description: Multi Secret for pod.
items:
properties:
mountPath:
description: Current Secret Mount Path, default is "/etc/doris"
If Secret belongs to the same Secrets, their MountPath
cannot be repeated.
type: string
secretName:
description: name of secret that needs to mount.
type: string
type: object
type: array
securityContext:
description: Security context for pod.
properties:
Expand Down
14 changes: 14 additions & 0 deletions pkg/common/utils/k8s/client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -229,6 +229,20 @@ func GetConfigMap(ctx context.Context, k8scient client.Client, namespace, name s
return &configMap, nil
}

// CheckSecretExist check if the secret is in the namespace.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ChecSecretExist, check the secret exist or not in specify namespace.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done, and I moved this method to sub_controller.go

func CheckSecretExist(ctx context.Context, k8scient client.Client, namespace string, secrets []dorisv1.Secret) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This func is not necessary. After checking, it only prints the log and has no effect on subsequent operations. Checking whether it exists can be done later.

Copy link
Contributor Author

@hechao-ustc hechao-ustc Sep 18, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I moved CheckSecretExist to after k8s.ApplyStatefulSet. I think this check is necessary. Without this check and without created the secret, the operator log will not contain the following error log, and the pod will always be in the ContainerCreating state.
image

errMessage := ""
for _, secret := range secrets {
var s corev1.Secret
if getErr := k8scient.Get(ctx, types.NamespacedName{Namespace: namespace, Name: secret.SecretName}, &s); getErr != nil {
errMessage = errMessage + fmt.Sprintf("(name: %s, namespace: %s, err: %s), ", secret.SecretName, namespace, getErr.Error())
}
}
if errMessage != "" {
klog.Errorf("CheckSecretExist error: %s.", errMessage)
}
}

// GetConfigMaps get the configmap by the array of MountConfigMapInfo and namespace.
func GetConfigMaps(ctx context.Context, k8scient client.Client, namespace string, cms []dorisv1.MountConfigMapInfo) ([]*corev1.ConfigMap, error) {
var configMaps []*corev1.ConfigMap
Expand Down
Loading