Skip to content

Commit df9cb48

Browse files
mjudeikismjudeikis
committed
fix docker compose
1 parent 258fb55 commit df9cb48

9 files changed

Lines changed: 312 additions & 4 deletions

File tree

‎cli/cmd/kubectl-bind/cmd/kubectlBind.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,5 +70,5 @@ func KubectlBindCommand() *cobra.Command {
7070
}
7171
bindCmd.AddCommand(apiserviceCmd)
7272

73-
return root
73+
return bindCmd
7474
}

‎contrib/example-backend-kcp/backend/server.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ func NewServer(ctx context.Context, config *Config) (*Server, error) {
7575
config.Options.OIDC.IssuerClientSecret,
7676
callback,
7777
config.Options.OIDC.IssuerURL,
78+
config.Options.OIDC.ExternalIssuerURL,
7879
config.Options.OIDC.OIDCCAFile,
7980
)
8081
if err != nil {

‎contrib/example-backend-kcp/bootstrap/config/config/clusterworkspace-kube-bind-provider.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: tenancy.kcp.io/v1alpha1
2+
kind: Workspace
3+
metadata:
4+
name: kube-bind-provider
5+
annotations:
6+
bootstrap.kcp.io/create-only: "true"
7+
spec:
8+
type:
9+
name: organization
10+
path: root

‎contrib/example-backend-kcp/bootstrap/config/kube-bind-provider/bootstrap.go‎

Lines changed: 196 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,196 @@
1+
/*
2+
Copyright 2025 The Kube Bind Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package kubebindprovider
18+
19+
import (
20+
"context"
21+
"time"
22+
23+
kcpapiextensionsclientset "github.com/kcp-dev/client-go/apiextensions/client"
24+
kcpdynamic "github.com/kcp-dev/client-go/dynamic"
25+
apisv1alpha1 "github.com/kcp-dev/kcp/sdk/apis/apis/v1alpha1"
26+
kcpclient "github.com/kcp-dev/kcp/sdk/client/clientset/versioned"
27+
kcpclientset "github.com/kcp-dev/kcp/sdk/client/clientset/versioned/cluster"
28+
"github.com/kcp-dev/logicalcluster/v3"
29+
"github.com/kube-bind/kube-bind/contrib/example-backend-kcp/bootstrap/config/kube-bind-provider/resources"
30+
31+
apierrors "k8s.io/apimachinery/pkg/api/errors"
32+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
33+
"k8s.io/apimachinery/pkg/util/sets"
34+
"k8s.io/apimachinery/pkg/util/wait"
35+
"k8s.io/klog/v2"
36+
)
37+
38+
var (
39+
// RootClusterName is the workspace to host common APIs.
40+
RootClusterName = logicalcluster.NewPath("root:kube-bind-provider")
41+
)
42+
43+
// Bootstrap creates resources in this package by continuously retrying the list.
44+
// This is blocking, i.e. it only returns (with error) when the context is closed or with nil when
45+
// the bootstrapping is successfully completed.
46+
func Bootstrap(
47+
ctx context.Context,
48+
kcpClientSet kcpclientset.ClusterInterface,
49+
apiExtensionClusterClient kcpapiextensionsclientset.ClusterInterface,
50+
dynamicClusterClient kcpdynamic.ClusterInterface,
51+
batteriesIncluded sets.Set[string],
52+
) error {
53+
kcpClient := kcpClientSet.Cluster(RootClusterName)
54+
55+
computeDiscoveryClient := apiExtensionClusterClient.Cluster(RootClusterName).Discovery()
56+
computeDynamicClient := dynamicClusterClient.Cluster(RootClusterName)
57+
58+
crdClient := apiExtensionClusterClient.ApiextensionsV1().Cluster(RootClusterName).CustomResourceDefinitions()
59+
60+
err := bindAPIExport(ctx, kcpClient, "kube-bind.io")
61+
if err != nil {
62+
return err
63+
}
64+
65+
time.Sleep(10 * time.Second)
66+
67+
return resources.Bootstrap(ctx, kcpClientSet, computeDiscoveryClient, computeDynamicClient, crdClient, batteriesIncluded)
68+
}
69+
70+
func bindAPIExport(ctx context.Context, kcpClient kcpclient.Interface, exportName string) error {
71+
logger := klog.FromContext(ctx)
72+
73+
binding := &apisv1alpha1.APIBinding{
74+
ObjectMeta: metav1.ObjectMeta{
75+
Name: exportName,
76+
},
77+
Spec: apisv1alpha1.APIBindingSpec{
78+
Reference: apisv1alpha1.BindingReference{
79+
Export: &apisv1alpha1.ExportBindingReference{
80+
Path: "root:kube-bind",
81+
Name: exportName,
82+
},
83+
},
84+
},
85+
}
86+
87+
binding.Spec.PermissionClaims = []apisv1alpha1.AcceptablePermissionClaim{
88+
{
89+
PermissionClaim: apisv1alpha1.PermissionClaim{
90+
All: true,
91+
GroupResource: apisv1alpha1.GroupResource{
92+
Group: "rbac.authorization.k8s.io",
93+
Resource: "clusterrolebindings",
94+
},
95+
},
96+
State: apisv1alpha1.ClaimAccepted,
97+
},
98+
{
99+
PermissionClaim: apisv1alpha1.PermissionClaim{
100+
All: true,
101+
GroupResource: apisv1alpha1.GroupResource{
102+
Group: "rbac.authorization.k8s.io",
103+
Resource: "clusterroles",
104+
},
105+
},
106+
State: apisv1alpha1.ClaimAccepted,
107+
},
108+
{
109+
PermissionClaim: apisv1alpha1.PermissionClaim{
110+
All: true,
111+
GroupResource: apisv1alpha1.GroupResource{
112+
Group: "",
113+
Resource: "serviceaccounts",
114+
},
115+
},
116+
State: apisv1alpha1.ClaimAccepted,
117+
},
118+
{
119+
PermissionClaim: apisv1alpha1.PermissionClaim{
120+
All: true,
121+
GroupResource: apisv1alpha1.GroupResource{
122+
Group: "",
123+
Resource: "configmaps",
124+
},
125+
},
126+
State: apisv1alpha1.ClaimAccepted,
127+
},
128+
{
129+
PermissionClaim: apisv1alpha1.PermissionClaim{
130+
All: true,
131+
GroupResource: apisv1alpha1.GroupResource{
132+
Group: "",
133+
Resource: "secrets",
134+
},
135+
},
136+
State: apisv1alpha1.ClaimAccepted,
137+
},
138+
{
139+
PermissionClaim: apisv1alpha1.PermissionClaim{
140+
All: true,
141+
GroupResource: apisv1alpha1.GroupResource{
142+
Group: apisv1alpha1.SchemeGroupVersion.Group,
143+
Resource: "apiexports",
144+
},
145+
},
146+
State: apisv1alpha1.ClaimAccepted,
147+
},
148+
{
149+
PermissionClaim: apisv1alpha1.PermissionClaim{
150+
All: true,
151+
GroupResource: apisv1alpha1.GroupResource{
152+
Group: "apiextensions.k8s.io",
153+
Resource: "customresourcedefinitions",
154+
},
155+
},
156+
State: apisv1alpha1.ClaimAccepted,
157+
},
158+
}
159+
160+
_, err := kcpClient.ApisV1alpha1().APIBindings().Create(ctx, binding, metav1.CreateOptions{})
161+
if err == nil {
162+
return nil
163+
}
164+
if !apierrors.IsAlreadyExists(err) {
165+
return err
166+
}
167+
168+
if err := wait.PollUntilContextCancel(ctx, time.Second, true, func(ctx context.Context) (bool, error) {
169+
existing, err := kcpClient.ApisV1alpha1().APIBindings().Get(ctx, exportName, metav1.GetOptions{})
170+
if err != nil {
171+
logger.Error(err, "error getting APIBinding", "name", exportName)
172+
// Always keep trying. Don't ever return an error out of this function.
173+
return false, nil
174+
}
175+
176+
logger.V(2).Info("Updating API binding")
177+
existing.Spec = binding.Spec
178+
179+
_, err = kcpClient.ApisV1alpha1().APIBindings().Update(ctx, existing, metav1.UpdateOptions{})
180+
if err == nil {
181+
return true, nil
182+
}
183+
if apierrors.IsConflict(err) {
184+
logger.V(2).Info("API binding update conflict, retrying")
185+
return false, nil
186+
}
187+
188+
logger.Error(err, "error updating APIBinding")
189+
// Always keep trying. Don't ever return an error out of this function.
190+
return false, nil
191+
}); err != nil {
192+
return err
193+
}
194+
195+
return nil
196+
}

‎contrib/example-backend-kcp/bootstrap/config/kube-bind-provider/resources/bootstrap.go‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
/*
2+
Copyright 2025 The Kube Bind Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package resources
18+
19+
import (
20+
"context"
21+
"embed"
22+
23+
confighelpers "github.com/kcp-dev/kcp/config/helpers"
24+
kcpclientcluster "github.com/kcp-dev/kcp/sdk/client/clientset/versioned/cluster"
25+
26+
apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1"
27+
"k8s.io/apimachinery/pkg/util/sets"
28+
"k8s.io/client-go/discovery"
29+
"k8s.io/client-go/dynamic"
30+
)
31+
32+
//go:embed *.yaml
33+
var KubeFS embed.FS
34+
35+
// Bootstrap creates resources in this package by continuously retrying the list.
36+
// This is blocking, i.e. it only returns (with error) when the context is closed or with nil when
37+
// the bootstrapping is successfully completed.
38+
func Bootstrap(
39+
ctx context.Context,
40+
kcpClient kcpclientcluster.ClusterInterface,
41+
discoveryClient discovery.DiscoveryInterface,
42+
dynamicClient dynamic.Interface,
43+
crdClient apiextensionsv1.CustomResourceDefinitionInterface,
44+
batteriesIncluded sets.Set[string],
45+
) error {
46+
// create resources in core cluster
47+
return confighelpers.Bootstrap(ctx, discoveryClient, dynamicClient, batteriesIncluded, KubeFS, confighelpers.ReplaceOption())
48+
}

‎contrib/example-backend-kcp/bootstrap/config/kube-bind-provider/resources/crd.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
apiVersion: apiextensions.k8s.io/v1
2+
kind: CustomResourceDefinition
3+
metadata:
4+
name: mangodbs.mangodb.com
5+
labels:
6+
kube-bind.io/exported: "true"
7+
spec:
8+
group: mangodb.com
9+
names:
10+
kind: MangoDB
11+
listKind: MangoDBList
12+
plural: mangodbs
13+
singular: mangodb
14+
scope: Namespaced
15+
versions:
16+
- name: v1alpha1
17+
served: true
18+
storage: true
19+
schema:
20+
openAPIV3Schema:
21+
type: object
22+
properties:
23+
spec:
24+
type: object
25+
properties:
26+
tier:
27+
type: string
28+
enum:
29+
- Dedicated
30+
- Shared
31+
default: Shared
32+
status:
33+
type: object
34+
properties:
35+
phase:
36+
type: string
37+
required:
38+
- spec
39+
subresources:
40+
status: {}

‎contrib/example-backend-kcp/bootstrap/server.go‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import (
2525
bootstrapconfig "github.com/kube-bind/kube-bind/contrib/example-backend-kcp/bootstrap/config/config"
2626
bootstrapcore "github.com/kube-bind/kube-bind/contrib/example-backend-kcp/bootstrap/config/core"
2727
bootstrapkubebind "github.com/kube-bind/kube-bind/contrib/example-backend-kcp/bootstrap/config/kube-bind"
28+
bootstrapkubebindprovider "github.com/kube-bind/kube-bind/contrib/example-backend-kcp/bootstrap/config/kube-bind-provider"
2829
)
2930

3031
type Server struct {
@@ -72,7 +73,18 @@ func (s *Server) Start(ctx context.Context) error {
7273
s.Config.DynamicClusterClient,
7374
fakeBatteries,
7475
); err != nil {
75-
logger.Error(err, "failed to bootstrap core workspace")
76+
logger.Error(err, "failed to bootstrap workspace")
77+
return nil // don't klog.Fatal. This only happens when context is cancelled.
78+
}
79+
80+
if err := bootstrapkubebindprovider.Bootstrap(
81+
ctx,
82+
s.Config.KcpClusterClient,
83+
s.Config.ApiextensionsClient,
84+
s.Config.DynamicClusterClient,
85+
fakeBatteries,
86+
); err != nil {
87+
logger.Error(err, "failed to bootstrap provider workspace")
7688
return nil // don't klog.Fatal. This only happens when context is cancelled.
7789
}
7890

‎contrib/example-backend-kcp/hack/docker-compose/dex/kcp-config.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ staticClients:
1414
- http://localhost:8000 # oidc-login callback url
1515
- https://127.0.0.1:8080/callback # kube-bind callback url
1616
- https://127.0.0.1:6443/callback # kube-bind callback url
17+
- https://localhost:6444/callback # kube-bind callback url
1718
name: 'KCP App'
1819
secret: "Z2Fyc2lha2FsYmlzdmFuZGVuekWplCg=="
1920

‎contrib/example-backend-kcp/hack/docker-compose/docker-compose.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,8 +87,8 @@ services:
8787
--oidc-issuer-client-secret=Z2Fyc2lha2FsYmlzdmFuZGVuekWplCg==
8888
--oidc-issuer-client-id=kcp-dev
8989
--oidc-issuer-url=https://dex:5556/dex
90-
--oidc-callback-url=https://127.0.0.1:6444/callback
91-
--oidc-authorize-url=https://127.0.0.1:6444/authorize
90+
--oidc-callback-url=https://localhost:6444/callback
91+
--oidc-authorize-url=https://localhost:6444/authorize
9292
--oidc-ca-file=/certs/dex.pem
9393
--pretty-name="CorpAAA.com"
9494
--namespace-prefix="kube-bind-"

0 commit comments

Comments
 (0)