gateway server and client controllers

cmd/liqo-controller-manager/main.go

@@ -35,6 +35,8 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/selection"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/dynamic/dynamicinformer"
 	"k8s.io/client-go/kubernetes"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
@@ -60,7 +62,9 @@ import (
 	"github.com/liqotech/liqo/cmd/virtual-kubelet/root"
 	"github.com/liqotech/liqo/pkg/consts"
 	identitymanager "github.com/liqotech/liqo/pkg/identityManager"
+	clientoperator "github.com/liqotech/liqo/pkg/liqo-controller-manager/external-network/client-operator"
 	configurationcontroller "github.com/liqotech/liqo/pkg/liqo-controller-manager/external-network/configuration-controller"
+	serveroperator "github.com/liqotech/liqo/pkg/liqo-controller-manager/external-network/server-operator"
 	foreignclusteroperator "github.com/liqotech/liqo/pkg/liqo-controller-manager/foreign-cluster-operator"
 	ipctrl "github.com/liqotech/liqo/pkg/liqo-controller-manager/ip-controller"
 	mapsctrl "github.com/liqotech/liqo/pkg/liqo-controller-manager/namespacemap-controller"
@@ -87,6 +91,7 @@ import (
 	tenantnamespace "github.com/liqotech/liqo/pkg/tenantNamespace"
 	argsutils "github.com/liqotech/liqo/pkg/utils/args"
 	"github.com/liqotech/liqo/pkg/utils/csr"
+	dynamicutils "github.com/liqotech/liqo/pkg/utils/dynamic"
 	liqoerrors "github.com/liqotech/liqo/pkg/utils/errors"
 	"github.com/liqotech/liqo/pkg/utils/indexer"
 	"github.com/liqotech/liqo/pkg/utils/mapper"
@@ -124,6 +129,8 @@ func main() {
 	var labelsNotReflected argsutils.StringList
 	var annotationsNotReflected argsutils.StringList
 	var ipamClient ipam.IpamClient
+	var gatewayServerResources argsutils.StringList
+	var gatewayClientResources argsutils.StringList
 
 	webhookPort := flag.Uint("webhook-port", 9443, "The port the webhook server binds to")
 	metricsAddr := flag.String("metrics-address", ":8080", "The address the metric endpoint binds to")
@@ -206,6 +213,10 @@ func main() {
 	// Node failure controller parameter
 	enableNodeFailureController := flag.Bool("enable-node-failure-controller", false, "Enable the node failure controller")
 
+	// External network parameters
+	flag.Var(&gatewayServerResources, "gateway-server-resources", "The list of resource types that implements the gateway server. They must be in the form <group>/<version>/<resource>")
+	flag.Var(&gatewayClientResources, "gateway-client-resources", "The list of resource types that implements the gateway client. They must be in the form <group>/<version>/<resource>")
+
 	liqoerrors.InitFlags(nil)
 	restcfg.InitFlags(nil)
 	klog.InitFlags(nil)
@@ -240,6 +251,11 @@ func main() {
 
 	config := restcfg.SetRateLimiter(ctrl.GetConfigOrDie())
 
+	dynClient := dynamic.NewForConfigOrDie(config)
+	factory := &dynamicutils.RunnableFactory{
+		DynamicSharedInformerFactory: dynamicinformer.NewFilteredDynamicSharedInformerFactory(dynClient, 0, corev1.NamespaceAll, nil),
+	}
+
 	// Create a label selector to filter only the events for pods managed by a ShadowPod (i.e., remote offloaded pods),
 	// as those are the only ones we are interested in to implement the resiliency mechanism.
 	reqRemoteLiqoPods, err := labels.NewRequirement(consts.ManagedByLabelKey, selection.Equals, []string{consts.ManagedByShadowPodValue})
@@ -272,6 +288,11 @@ func main() {
 		os.Exit(1)
 	}
 
+	if err = mgr.Add(factory); err != nil {
+		klog.Error(err)
+		os.Exit(1)
+	}
+
 	// Create a label selector to filter only the events for local offloaded pods
 	reqLocalLiqoPods, err := labels.NewRequirement(consts.LocalPodLabelKey, selection.Equals, []string{consts.LocalPodLabelValue})
 	utilruntime.Must(err)
@@ -498,6 +519,20 @@ func main() {
 		klog.Fatal(err)
 	}
 
+	serverReconciler := serveroperator.NewServerReconciler(mgr.GetClient(),
+		dynClient, factory, mgr.GetScheme(), gatewayServerResources.StringList)
+	if err := serverReconciler.SetupWithManager(mgr); err != nil {
+		klog.Error(err)
+		os.Exit(1)
+	}
+
+	clientReconciler := clientoperator.NewClientReconciler(mgr.GetClient(),
+		dynClient, factory, mgr.GetScheme(), gatewayClientResources.StringList)
+	if err := clientReconciler.SetupWithManager(mgr); err != nil {
+		klog.Error(err)
+		os.Exit(1)
+	}
+
 	// Start the handler to approve the virtual kubelet certificate signing requests.
 	csrWatcher := csr.NewWatcher(clientset, *resyncPeriod, labels.Everything(), fields.Everything())
 	csrWatcher.RegisterHandler(csr.ApproverHandler(clientset, "LiqoApproval", "This CSR was approved by Liqo",

deployments/liqo/README.md

@@ -113,11 +113,13 @@
 | networkManager.pod.extraArgs | list | `[]` | Extra arguments for the networkManager pod. |
 | networkManager.pod.labels | object | `{}` | Labels for the networkManager pod. |
 | networkManager.pod.resources | object | `{"limits":{},"requests":{}}` | Resource requests and limits (https://kubernetes.io/docs/user-guide/compute-resources/) for the networkManager pod. |
+| networking.clientResources | list | `[{"apiVersion":"networking.liqo.io/v1alpha1","resource":"wggatewayclients"}]` | Set the list of resources that implement the GatewayClient |
 | networking.internal | bool | `true` | Use the default Liqo network manager. |
 | networking.iptables | object | `{"mode":"nf_tables"}` | Iptables configuration tuning. |
 | networking.iptables.mode | string | `"nf_tables"` | Select the iptables mode to use. Possible values are "legacy" and "nf_tables". |
 | networking.mtu | int | `1340` | Set the MTU for the interfaces managed by liqo: vxlan, tunnel and veth interfaces. The value is used by the gateway and route operators. The default value is configured to ensure correct behavior regardless of the combination of the underlying environments (e.g., cloud providers). This guarantees improved compatibility at the cost of possible limited performance drops. |
 | networking.reflectIPs | bool | `true` | Reflect pod IPs and EnpointSlices to the remote clusters. |
+| networking.serverResources | list | `[{"apiVersion":"networking.liqo.io/v1alpha1","resource":"wggatewayservers"}]` | Set the list of resources that implement the GatewayServer |
 | openshiftConfig.enable | bool | `false` | Enable/Disable the OpenShift support, enabling Openshift-specific resources, and setting the pod security contexts in a way that is compatible with Openshift. |
 | openshiftConfig.virtualKubeletSCCs | list | `["anyuid"]` | Security context configurations granted to the virtual kubelet in the local cluster. The configuration of one or more SCCs for the virtual kubelet is not strictly required, and privileges can be reduced in production environments. Still, the default configuration (i.e., anyuid) is suggested to prevent problems (i.e., the virtual kubelet fails to add the appropriate labels) when attempting to offload pods not managed by higher-level abstractions (e.g., Deployments), and not associated with a properly privileged service account. Indeed, "anyuid" is the SCC automatically associated with pods created by cluster administrators. Any pod granted a more privileged SCC and not linked to an adequately privileged service account will fail to be offloaded. |
 | proxy.config.listeningPort | int | `8118` | Port used by the proxy pod. |

deployments/liqo/files/liqo-controller-manager-ClusterRole.yaml

@@ -395,6 +395,110 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - networking.liqo.io
+  resources:
+  - gatewayclients
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - networking.liqo.io
+  resources:
+  - gatewayclients/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - networking.liqo.io
+  resources:
+  - gatewayservers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - networking.liqo.io
+  resources:
+  - gatewayservers/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - networking.liqo.io
+  resources:
+  - wggatewayclients
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - networking.liqo.io
+  resources:
+  - wggatewayclients/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - networking.liqo.io
+  resources:
+  - wggatewayclienttemplates
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - networking.liqo.io
+  resources:
+  - wggatewayservers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - networking.liqo.io
+  resources:
+  - wggatewayservers/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - networking.liqo.io
+  resources:
+  - wggatewayservertemplates
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - offloading.liqo.io
   resources:

deployments/liqo/templates/_helpers.tpl

@@ -172,6 +172,17 @@ Concatenates a values list into a string in the form "--commandName=val1,val2"
 - {{ trimSuffix "," $res }}
 {{- end -}}
 
+{{/*
+Concatenates a values list of groupVersionResources into a string in the form "--commandName=group1/version1/resource1,group2/version2/resource2"
+*/}}
+{{- define "liqo.concatenateGroupVersionResources" -}}
+{{- $res := print .commandName "=" -}}
+{{- range $val := .list -}}
+{{- $res = print $res $val.apiVersion "/" $val.resource "," -}}
+{{- end -}}
+- {{ trimSuffix "," $res }}
+{{- end -}}
+
 {{/*
 Get the liqo clusterID ConfigMap name
 */}}

deployments/liqo/templates/liqo-controller-manager-deployment.yaml

@@ -91,6 +91,10 @@ spec:
           - --configmap-reflection-type={{ .Values.reflection.configmap.type }}
           - --secret-reflection-type={{ .Values.reflection.secret.type }}
           - --event-reflection-type={{ .Values.reflection.event.type }}
+          {{- $d := dict "commandName" "--gateway-server-resources" "list" .Values.networking.serverResources }}
+          {{- include "liqo.concatenateGroupVersionResources" $d | nindent 10 }}
+          {{- $d := dict "commandName" "--gateway-client-resources" "list" .Values.networking.clientResources }}
+          {{- include "liqo.concatenateGroupVersionResources" $d | nindent 10 }}
           {{- if .Values.reflection.skip.labels }}
           {{- $d := dict "commandName" "--labels-not-reflected" "list" .Values.reflection.skip.labels }}
           {{- include "liqo.concatenateList" $d | nindent 10 }}

deployments/liqo/values.yaml

@@ -37,6 +37,14 @@ networking:
   # The default value is configured to ensure correct behavior regardless of the combination of the underlying environments
   # (e.g., cloud providers). This guarantees improved compatibility at the cost of possible limited performance drops.
   mtu: 1340
+  # -- Set the list of resources that implement the GatewayServer
+  serverResources:
+    - apiVersion: networking.liqo.io/v1alpha1
+      resource: wggatewayservers
+  # -- Set the list of resources that implement the GatewayClient
+  clientResources:
+    - apiVersion: networking.liqo.io/v1alpha1
+      resource: wggatewayclients
 
 reflection:
   skip: