From 4429c8ca667b221988bc92bb91adeb1009a5d257 Mon Sep 17 00:00:00 2001 From: cuisongliu Date: Sun, 6 Nov 2022 15:31:15 +0800 Subject: [PATCH] feature(main): add pyament deploy (#2035) * feature(main): add pyament deploy Signed-off-by: cuisongliu --- .github/workflows/controllers.yml | 2 +- .github/workflows/services.yml | 39 +- controllers/terminal/Makefile | 2 +- controllers/terminal/deploy/Dockerfile | 5 +- controllers/terminal/deploy/README.md | 17 + .../{deploy.yaml => deploy.yaml.tmpl} | 2 +- controllers/user/Makefile | 4 +- .../user/config/default/kustomization.yaml | 5 + .../default/manager_auth_proxy_patch.yaml | 5 +- .../user/config/default/payment.env.tmpl | 5 + .../user/controllers/payment_controller.go | 2 +- controllers/user/deploy/Dockerfile | 9 +- controllers/user/deploy/README.md | 13 +- .../config/certmanager/certificate.yaml | 25 + .../config/certmanager/kustomization.yaml | 5 + .../config/certmanager/kustomizeconfig.yaml | 16 + .../crd/bases/user.sealos.io_accounts.yaml | 67 + .../crd/bases/user.sealos.io_payments.yaml | 64 + .../user.sealos.io_usergroupbindings.yaml | 140 ++ .../crd/bases/user.sealos.io_usergroups.yaml | 95 ++ .../crd/bases/user.sealos.io_users.yaml | 117 ++ .../manifests/config/crd/kustomization.yaml | 39 + .../manifests/config/crd/kustomizeconfig.yaml | 19 + .../crd/patches/cainjection_in_accounts.yaml | 7 + .../crd/patches/cainjection_in_groups.yaml | 7 + .../crd/patches/cainjection_in_payments.yaml | 7 + .../cainjection_in_usergroupbindings.yaml | 7 + ...jection_in_usergroupnamespacebindings.yaml | 7 + .../patches/cainjection_in_usergroups.yaml | 7 + .../cainjection_in_usergroupuserbindings.yaml | 7 + .../crd/patches/cainjection_in_users.yaml | 7 + .../crd/patches/webhook_in_accounts.yaml | 16 + .../crd/patches/webhook_in_payments.yaml | 16 + .../patches/webhook_in_usergroupbindings.yaml | 16 + ...webhook_in_usergroupnamespacebindings.yaml | 16 + .../crd/patches/webhook_in_usergroups.yaml | 16 + .../webhook_in_usergroupuserbindings.yaml | 16 + .../config/crd/patches/webhook_in_users.yaml | 16 + .../config/default/kustomization.yaml | 79 ++ .../default/manager_auth_proxy_patch.yaml | 50 + .../config/default/manager_config_patch.yaml | 20 + .../config/default/manager_webhook_patch.yaml | 23 + .../manifests/config/default/payment.env.tmpl | 5 + .../default/webhookcainjection_patch.yaml | 15 + .../manager/controller_manager_config.yaml | 21 + .../config/manager/kustomization.yaml | 16 + .../manifests/config/manager/manager.yaml | 72 + .../config/prometheus/kustomization.yaml | 2 + .../manifests/config/prometheus/monitor.yaml | 20 + .../config/rbac/account_editor_role.yaml | 24 + .../config/rbac/account_viewer_role.yaml | 20 + .../rbac/auth_proxy_client_clusterrole.yaml | 9 + .../config/rbac/auth_proxy_role.yaml | 17 + .../config/rbac/auth_proxy_role_binding.yaml | 12 + .../config/rbac/auth_proxy_service.yaml | 15 + .../manifests/config/rbac/kustomization.yaml | 18 + .../config/rbac/leader_election_role.yaml | 37 + .../rbac/leader_election_role_binding.yaml | 12 + .../config/rbac/payment_editor_role.yaml | 24 + .../config/rbac/payment_viewer_role.yaml | 20 + .../deploy/manifests/config/rbac/role.yaml | 259 ++++ .../manifests/config/rbac/role_binding.yaml | 12 + .../config/rbac/service_account.yaml | 5 + .../config/rbac/user_editor_role.yaml | 24 + .../config/rbac/user_viewer_role.yaml | 20 + .../config/rbac/usergroup_editor_role.yaml | 24 + .../config/rbac/usergroup_viewer_role.yaml | 20 + .../rbac/usergroupbinding_editor_role.yaml | 24 + .../rbac/usergroupbinding_viewer_role.yaml | 20 + .../deploy/manifests/config/samples/all.yaml | 90 ++ .../deploy/manifests/config/samples/app.log | 0 .../config/samples/user_v1_account.yaml | 6 + .../config/samples/user_v1_payment.yaml | 8 + .../config/samples/user_v1_user.yaml | 6 + .../config/samples/user_v1_usergroup.yaml | 4 + .../samples/user_v1_usergroupbinding.yaml | 6 + .../config/webhook/kustomization.yaml | 6 + .../config/webhook/kustomizeconfig.yaml | 25 + .../manifests/config/webhook/manifests.yaml | 134 ++ .../manifests/config/webhook/service.yaml | 13 + .../user/deploy/manifests/deploy.yaml.tmpl | 1180 ----------------- controllers/user/main.go | 2 +- pkg/pay/wechat_payment.go | 7 +- service/auth/deploy/Kubefile | 2 +- service/payment/Makefile | 2 +- service/payment/README.md | 5 +- service/payment/api/api.go | 2 +- webhooks/whitelist/deploy/Dockerfile | 2 +- 88 files changed, 2075 insertions(+), 1229 deletions(-) create mode 100644 controllers/terminal/deploy/README.md rename controllers/terminal/deploy/manifests/{deploy.yaml => deploy.yaml.tmpl} (99%) create mode 100644 controllers/user/config/default/payment.env.tmpl create mode 100644 controllers/user/deploy/manifests/config/certmanager/certificate.yaml create mode 100644 controllers/user/deploy/manifests/config/certmanager/kustomization.yaml create mode 100644 controllers/user/deploy/manifests/config/certmanager/kustomizeconfig.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/bases/user.sealos.io_accounts.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/bases/user.sealos.io_payments.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/bases/user.sealos.io_usergroupbindings.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/bases/user.sealos.io_usergroups.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/bases/user.sealos.io_users.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/kustomization.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/kustomizeconfig.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/patches/cainjection_in_accounts.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/patches/cainjection_in_groups.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/patches/cainjection_in_payments.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/patches/cainjection_in_usergroupbindings.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/patches/cainjection_in_usergroupnamespacebindings.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/patches/cainjection_in_usergroups.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/patches/cainjection_in_usergroupuserbindings.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/patches/cainjection_in_users.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/patches/webhook_in_accounts.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/patches/webhook_in_payments.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/patches/webhook_in_usergroupbindings.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/patches/webhook_in_usergroupnamespacebindings.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/patches/webhook_in_usergroups.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/patches/webhook_in_usergroupuserbindings.yaml create mode 100644 controllers/user/deploy/manifests/config/crd/patches/webhook_in_users.yaml create mode 100644 controllers/user/deploy/manifests/config/default/kustomization.yaml create mode 100644 controllers/user/deploy/manifests/config/default/manager_auth_proxy_patch.yaml create mode 100644 controllers/user/deploy/manifests/config/default/manager_config_patch.yaml create mode 100644 controllers/user/deploy/manifests/config/default/manager_webhook_patch.yaml create mode 100644 controllers/user/deploy/manifests/config/default/payment.env.tmpl create mode 100644 controllers/user/deploy/manifests/config/default/webhookcainjection_patch.yaml create mode 100644 controllers/user/deploy/manifests/config/manager/controller_manager_config.yaml create mode 100644 controllers/user/deploy/manifests/config/manager/kustomization.yaml create mode 100644 controllers/user/deploy/manifests/config/manager/manager.yaml create mode 100644 controllers/user/deploy/manifests/config/prometheus/kustomization.yaml create mode 100644 controllers/user/deploy/manifests/config/prometheus/monitor.yaml create mode 100644 controllers/user/deploy/manifests/config/rbac/account_editor_role.yaml create mode 100644 controllers/user/deploy/manifests/config/rbac/account_viewer_role.yaml create mode 100644 controllers/user/deploy/manifests/config/rbac/auth_proxy_client_clusterrole.yaml create mode 100644 controllers/user/deploy/manifests/config/rbac/auth_proxy_role.yaml create mode 100644 controllers/user/deploy/manifests/config/rbac/auth_proxy_role_binding.yaml create mode 100644 controllers/user/deploy/manifests/config/rbac/auth_proxy_service.yaml create mode 100644 controllers/user/deploy/manifests/config/rbac/kustomization.yaml create mode 100644 controllers/user/deploy/manifests/config/rbac/leader_election_role.yaml create mode 100644 controllers/user/deploy/manifests/config/rbac/leader_election_role_binding.yaml create mode 100644 controllers/user/deploy/manifests/config/rbac/payment_editor_role.yaml create mode 100644 controllers/user/deploy/manifests/config/rbac/payment_viewer_role.yaml create mode 100644 controllers/user/deploy/manifests/config/rbac/role.yaml create mode 100644 controllers/user/deploy/manifests/config/rbac/role_binding.yaml create mode 100644 controllers/user/deploy/manifests/config/rbac/service_account.yaml create mode 100644 controllers/user/deploy/manifests/config/rbac/user_editor_role.yaml create mode 100644 controllers/user/deploy/manifests/config/rbac/user_viewer_role.yaml create mode 100644 controllers/user/deploy/manifests/config/rbac/usergroup_editor_role.yaml create mode 100644 controllers/user/deploy/manifests/config/rbac/usergroup_viewer_role.yaml create mode 100644 controllers/user/deploy/manifests/config/rbac/usergroupbinding_editor_role.yaml create mode 100644 controllers/user/deploy/manifests/config/rbac/usergroupbinding_viewer_role.yaml create mode 100644 controllers/user/deploy/manifests/config/samples/all.yaml create mode 100644 controllers/user/deploy/manifests/config/samples/app.log create mode 100644 controllers/user/deploy/manifests/config/samples/user_v1_account.yaml create mode 100644 controllers/user/deploy/manifests/config/samples/user_v1_payment.yaml create mode 100644 controllers/user/deploy/manifests/config/samples/user_v1_user.yaml create mode 100644 controllers/user/deploy/manifests/config/samples/user_v1_usergroup.yaml create mode 100644 controllers/user/deploy/manifests/config/samples/user_v1_usergroupbinding.yaml create mode 100644 controllers/user/deploy/manifests/config/webhook/kustomization.yaml create mode 100644 controllers/user/deploy/manifests/config/webhook/kustomizeconfig.yaml create mode 100644 controllers/user/deploy/manifests/config/webhook/manifests.yaml create mode 100644 controllers/user/deploy/manifests/config/webhook/service.yaml delete mode 100644 controllers/user/deploy/manifests/deploy.yaml.tmpl diff --git a/.github/workflows/controllers.yml b/.github/workflows/controllers.yml index d02e43bfb..8202eaa90 100644 --- a/.github/workflows/controllers.yml +++ b/.github/workflows/controllers.yml @@ -85,7 +85,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - module: [ user, terminal ] + module: [ app,cluster,infra,metering,user, terminal,imagehub ] permissions: issues: write steps: diff --git a/.github/workflows/services.yml b/.github/workflows/services.yml index aaa4bfc12..7e3907af8 100644 --- a/.github/workflows/services.yml +++ b/.github/workflows/services.yml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - module: [ auth, payment ] + module: [ auth ] steps: - name: Checkout uses: actions/checkout@v3 @@ -80,21 +80,22 @@ jobs: -f Dockerfile \ . -# build-on-cluster-image: -# needs: -# - image-build -# runs-on: ubuntu-latest -# strategy: -# matrix: -# module: [ auth, payment ] -# permissions: -# issues: write -# steps: -# - name: Build ${{ matrix.module }}-webhook image -# uses: peter-evans/create-or-update-comment@v1 -# with: -# issue-number: 140 -# repository: labring/cluster-image -# body: | -# /imagebuild_apps sealos-${{ matrix.module }}-service dev -# token: "${{ secrets.GH_TOKEN }}" + build-on-cluster-image: + needs: + - image-build + runs-on: ubuntu-latest + strategy: + matrix: + module: [ auth ] + permissions: + issues: write + steps: + - name: Build ${{ matrix.module }}-service image + uses: peter-evans/create-or-update-comment@v1 + if: github.repository == 'labring/sealos' + with: + issue-number: 140 + repository: labring/cluster-image + body: | + /imagebuild_apps sealos-${{ matrix.module }}-service dev + token: "${{ secrets.GH_TOKEN }}" diff --git a/controllers/terminal/Makefile b/controllers/terminal/Makefile index 0b1baddbf..1a9b91473 100644 --- a/controllers/terminal/Makefile +++ b/controllers/terminal/Makefile @@ -94,7 +94,7 @@ uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified .PHONY: pre-deploy pre-deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config. cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG} - $(KUSTOMIZE) build config/default > deploy/manifests/deploy.yaml + $(KUSTOMIZE) build config/default > deploy/manifests/deploy.yaml.tmpl .PHONY: deploy deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config. diff --git a/controllers/terminal/deploy/Dockerfile b/controllers/terminal/deploy/Dockerfile index ad98d50b9..522a93c32 100644 --- a/controllers/terminal/deploy/Dockerfile +++ b/controllers/terminal/deploy/Dockerfile @@ -1,5 +1,6 @@ FROM scratch USER 65532:65532 COPY registry ./registry -COPY manifests ./terminal-controller -CMD ["kubectl apply -f terminal-controller/deploy.yaml"] +COPY manifests ./manifests/terminal-controller +ENV USER_NAMESPACE=user-system +CMD ["kubectl apply -f manifests/terminal-controller/deploy.yaml"] diff --git a/controllers/terminal/deploy/README.md b/controllers/terminal/deploy/README.md new file mode 100644 index 000000000..1745bc6d7 --- /dev/null +++ b/controllers/terminal/deploy/README.md @@ -0,0 +1,17 @@ +### How to build image + +```shell +sealos build -t docker.io/labring/sealos-terminal-controller:dev -f Dockerfile . +``` + +### Env + +| Name | Description | Default | +| --- |---------------------------| --- | +|`USER_NAMESPACE`| user controller namespace |`user-system`| + +### How to run + +```shell +sealos run --env USER_NAMESPACE=user-system docker.io/labring/sealos-terminal-controller:dev +``` diff --git a/controllers/terminal/deploy/manifests/deploy.yaml b/controllers/terminal/deploy/manifests/deploy.yaml.tmpl similarity index 99% rename from controllers/terminal/deploy/manifests/deploy.yaml rename to controllers/terminal/deploy/manifests/deploy.yaml.tmpl index ba0471593..bde51782c 100644 --- a/controllers/terminal/deploy/manifests/deploy.yaml +++ b/controllers/terminal/deploy/manifests/deploy.yaml.tmpl @@ -412,7 +412,7 @@ spec: - /manager env: - name: USER_NAMESPACE - value: user-system + value: {{ .USER_NAMESPACE }} image: ghcr.io/labring/sealos-terminal-controller:dev livenessProbe: httpGet: diff --git a/controllers/user/Makefile b/controllers/user/Makefile index ca8de4dc3..6597c4ef9 100644 --- a/controllers/user/Makefile +++ b/controllers/user/Makefile @@ -94,12 +94,12 @@ uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified .PHONY: deploy deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config. cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG} - $(KUSTOMIZE) build config/default | kubectl apply -f - + $(KUSTOMIZE) build -e SERVICE_NAME=webhook-service -e SERVICE_NAMESPACE=system | kubectl apply -f - .PHONY: deploy pre-deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config. cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG} - $(KUSTOMIZE) build -e SERVICE_NAME=webhook-service -e SERVICE_NAMESPACE=system config/default > deploy/manifests/deploy.yaml.tmpl + cp -rf config deploy/manifests/ .PHONY: undeploy undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion. diff --git a/controllers/user/config/default/kustomization.yaml b/controllers/user/config/default/kustomization.yaml index 2e71c7561..c426a6747 100644 --- a/controllers/user/config/default/kustomization.yaml +++ b/controllers/user/config/default/kustomization.yaml @@ -12,6 +12,11 @@ namePrefix: user- #commonLabels: # someName: someValue +secretGenerator: + - envs: + - payment.env + name: manager-secret + bases: - ../crd - ../rbac diff --git a/controllers/user/config/default/manager_auth_proxy_patch.yaml b/controllers/user/config/default/manager_auth_proxy_patch.yaml index 05edc4cb6..abc971dd6 100644 --- a/controllers/user/config/default/manager_auth_proxy_patch.yaml +++ b/controllers/user/config/default/manager_auth_proxy_patch.yaml @@ -39,9 +39,10 @@ spec: - "--health-probe-bind-address=:8081" - "--metrics-bind-address=127.0.0.1:8080" - "--leader-elect" + envFrom: + - secretRef: + name: manager-secret env: - - name: CallbackURL - value: "{{ .PaymentCallbackURL }}" - name: NAMESPACE_NAME valueFrom: fieldRef: diff --git a/controllers/user/config/default/payment.env.tmpl b/controllers/user/config/default/payment.env.tmpl new file mode 100644 index 000000000..1225dffae --- /dev/null +++ b/controllers/user/config/default/payment.env.tmpl @@ -0,0 +1,5 @@ +WechatPrivateKey={{ .WechatPrivateKey }} +MchID={{ .MchID }} +MchCertificateSerialNumber={{ .MchCertificateSerialNumber }} +MchAPIv3Key={{ .MchAPIv3Key }} +AppID={{ .AppID }} diff --git a/controllers/user/controllers/payment_controller.go b/controllers/user/controllers/payment_controller.go index dfb8b0f3c..d9decee07 100644 --- a/controllers/user/controllers/payment_controller.go +++ b/controllers/user/controllers/payment_controller.go @@ -73,7 +73,7 @@ func (r *PaymentReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct } } tradeNO := pay.GetRandomString(32) - codeURL, err := pay.WechatPay(p.Spec.Amount, p.Spec.UserID, tradeNO, "", os.Getenv(pay.CallbackURL)) + codeURL, err := pay.WechatPay(p.Spec.Amount, p.Spec.UserID, tradeNO, "", "") if err != nil { r.Logger.Error(err, "get codeURL failed") return ctrl.Result{Requeue: true, RequeueAfter: time.Second}, err diff --git a/controllers/user/deploy/Dockerfile b/controllers/user/deploy/Dockerfile index 3bfb7fe6d..574f60bf5 100644 --- a/controllers/user/deploy/Dockerfile +++ b/controllers/user/deploy/Dockerfile @@ -1,7 +1,12 @@ FROM scratch USER 65532:65532 -ENV PaymentCallbackURL="" +## +ENV WechatPrivateKey = "" +ENV MchID = "" +ENV MchCertificateSerialNumber = "" +ENV MchAPIv3Key = "" +ENV AppID = "" COPY manifests ./manifests/user-controller COPY registry ./registry -CMD ["kubectl apply -f manifests/user-controller/rbac.yaml","kubectl apply -f manifests/user-controller/deploy.yaml"] +CMD ["kubectl apply -f manifests/user-controller/rbac.yaml","cd manifests/config/manager && kustomize build -e SERVICE_NAME=webhook-service -e SERVICE_NAMESPACE=system | kubectl apply -f -"] diff --git a/controllers/user/deploy/README.md b/controllers/user/deploy/README.md index 9ac63fd24..2efd19d76 100644 --- a/controllers/user/deploy/README.md +++ b/controllers/user/deploy/README.md @@ -6,12 +6,17 @@ sealos build -t docker.io/labring/sealos-user-controller:dev -f Dockerfile . ### Env -| Name | Description | Default | -| --- | --- | --- | -|`PaymentCallbackURL`|Payment callback url|`http://localhost:8080/payment/callback`| +| Name | Description | Default | +| --- |--------------------------------------------------------| --- | +|`WechatPrivateKey`| Wechat private key |``| +|`MchID`| Wechat mch id |``| +|`MchCertificateSerialNumber`| Wechat mch certificate serial number |``| +|`MchAPIv3Key`| Wechat mch api v3 key |``| +|`AppID`| Wechat app id,if emoty then disable payment controller |``| ### How to run ```shell -sealos run --env PaymentCallbackURL=http://localhost:8080/payment/callback docker.io/labring/sealos-user-controller:dev +sealos run docker.io/labring/kustomize:v4.5.6 +sealos run --env WechatPrivateKey=xxx --env MchID=xxx --env MchCertificateSerialNumber --env MchAPIv3Key=xxx --env AppID=xxx docker.io/labring/sealos-user-controller:dev ``` diff --git a/controllers/user/deploy/manifests/config/certmanager/certificate.yaml b/controllers/user/deploy/manifests/config/certmanager/certificate.yaml new file mode 100644 index 000000000..52d866183 --- /dev/null +++ b/controllers/user/deploy/manifests/config/certmanager/certificate.yaml @@ -0,0 +1,25 @@ +# The following manifests contain a self-signed issuer CR and a certificate CR. +# More document can be found at https://docs.cert-manager.io +# WARNING: Targets CertManager v1.0. Check https://cert-manager.io/docs/installation/upgrading/ for breaking changes. +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: selfsigned-issuer + namespace: system +spec: + selfSigned: {} +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: serving-cert # this name should match the one appeared in kustomizeconfig.yaml + namespace: system +spec: + # $(SERVICE_NAME) and $(SERVICE_NAMESPACE) will be substituted by kustomize + dnsNames: + - $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc + - $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc.cluster.local + issuerRef: + kind: Issuer + name: selfsigned-issuer + secretName: webhook-server-cert # this secret will not be prefixed, since it's not managed by kustomize diff --git a/controllers/user/deploy/manifests/config/certmanager/kustomization.yaml b/controllers/user/deploy/manifests/config/certmanager/kustomization.yaml new file mode 100644 index 000000000..bebea5a59 --- /dev/null +++ b/controllers/user/deploy/manifests/config/certmanager/kustomization.yaml @@ -0,0 +1,5 @@ +resources: +- certificate.yaml + +configurations: +- kustomizeconfig.yaml diff --git a/controllers/user/deploy/manifests/config/certmanager/kustomizeconfig.yaml b/controllers/user/deploy/manifests/config/certmanager/kustomizeconfig.yaml new file mode 100644 index 000000000..90d7c313c --- /dev/null +++ b/controllers/user/deploy/manifests/config/certmanager/kustomizeconfig.yaml @@ -0,0 +1,16 @@ +# This configuration is for teaching kustomize how to update name ref and var substitution +nameReference: +- kind: Issuer + group: cert-manager.io + fieldSpecs: + - kind: Certificate + group: cert-manager.io + path: spec/issuerRef/name + +varReference: +- kind: Certificate + group: cert-manager.io + path: spec/commonName +- kind: Certificate + group: cert-manager.io + path: spec/dnsNames diff --git a/controllers/user/deploy/manifests/config/crd/bases/user.sealos.io_accounts.yaml b/controllers/user/deploy/manifests/config/crd/bases/user.sealos.io_accounts.yaml new file mode 100644 index 000000000..d1358ac83 --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/bases/user.sealos.io_accounts.yaml @@ -0,0 +1,67 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.10.0 + creationTimestamp: null + name: accounts.user.sealos.io +spec: + group: user.sealos.io + names: + kind: Account + listKind: AccountList + plural: accounts + singular: account + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: Account is the Schema for the accounts API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: AccountSpec defines the desired state of Account + type: object + status: + description: AccountStatus defines the observed state of Account + properties: + balance: + format: int64 + type: integer + chargeList: + description: 'INSERT ADDITIONAL STATUS FIELD - define observed state + of cluster Important: Run "make" to regenerate code after modifying + this file' + items: + properties: + balance: + format: int64 + type: integer + status: + type: string + time: + format: date-time + type: string + tradeNO: + type: string + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/controllers/user/deploy/manifests/config/crd/bases/user.sealos.io_payments.yaml b/controllers/user/deploy/manifests/config/crd/bases/user.sealos.io_payments.yaml new file mode 100644 index 000000000..c14cd8734 --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/bases/user.sealos.io_payments.yaml @@ -0,0 +1,64 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.10.0 + creationTimestamp: null + name: payments.user.sealos.io +spec: + group: user.sealos.io + names: + kind: Payment + listKind: PaymentList + plural: payments + singular: payment + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: Payment is the Schema for the payments API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: PaymentSpec defines the desired state of Payment + properties: + amount: + description: Amount is the amount of recharge + format: int64 + type: integer + userID: + description: UserID is the user id who want to recharge + type: string + type: object + status: + description: PaymentStatus defines the observed state of Payment + properties: + codeURL: + description: CodeURL is the codeURL of wechatpay + type: string + status: + description: Status is the status of wechatpay, charging, closed, + timeout + type: string + tradeNO: + description: TradeNO is the tradeNO of wechatpay + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/controllers/user/deploy/manifests/config/crd/bases/user.sealos.io_usergroupbindings.yaml b/controllers/user/deploy/manifests/config/crd/bases/user.sealos.io_usergroupbindings.yaml new file mode 100644 index 000000000..b057f559e --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/bases/user.sealos.io_usergroupbindings.yaml @@ -0,0 +1,140 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.10.0 + creationTimestamp: null + name: usergroupbindings.user.sealos.io +spec: + group: user.sealos.io + names: + kind: UserGroupBinding + listKind: UserGroupBindingList + plural: usergroupbindings + shortNames: + - ugbinding + singular: usergroupbinding + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .userGroupRef + name: UserGroup + type: string + - jsonPath: .subject.kind + name: Kind + type: string + - jsonPath: .status.phase + name: Phase + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: UserGroupBinding is the Schema for the usergroupbindings API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + roleRef: + default: user + description: RoleRef can only reference a ClusterRole in the global namespace. + type: string + status: + description: Status contains the different condition statuses for this + user group. + properties: + conditions: + description: Conditions contains the different condition statuses + for this user group. + items: + properties: + lastHeartbeatTime: + description: LastHeartbeatTime is the last time this condition + was updated. + format: date-time + type: string + lastTransitionTime: + description: LastTransitionTime is the last time the condition + changed from one status to another. + format: date-time + type: string + message: + description: Message is a human-readable message indicating + details about the last status change. + type: string + reason: + description: Reason is a (brief) reason for the condition's + last status change. + type: string + status: + description: Status is the status of the condition. One of True, + False, Unknown. + type: string + type: + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: The generation observed by the user controller. + format: int64 + type: integer + phase: + default: Unknown + description: Phase is the recently observed lifecycle phase of user + group binding + type: string + type: object + subject: + description: Subject holds references to the objects the role applies + to. + properties: + apiGroup: + description: APIGroup holds the API group of the referenced subject. + Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io" + for User and Group subjects. + type: string + kind: + description: Kind of object being referenced. Values defined by this + API group are "User", "Group", and "ServiceAccount". If the Authorizer + does not recognized the kind value, the Authorizer should report + an error. + type: string + name: + description: Name of the object being referenced. + type: string + namespace: + description: Namespace of the referenced object. If the object kind + is non-namespace, such as "User" or "Group", and this value is not + empty the Authorizer should report an error. + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + userGroupRef: + description: UserGroupRef is the reference to the user group that this + binding binds to. + type: string + required: + - userGroupRef + type: object + served: true + storage: true + subresources: + status: {} diff --git a/controllers/user/deploy/manifests/config/crd/bases/user.sealos.io_usergroups.yaml b/controllers/user/deploy/manifests/config/crd/bases/user.sealos.io_usergroups.yaml new file mode 100644 index 000000000..44584a526 --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/bases/user.sealos.io_usergroups.yaml @@ -0,0 +1,95 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.10.0 + creationTimestamp: null + name: usergroups.user.sealos.io +spec: + group: user.sealos.io + names: + kind: UserGroup + listKind: UserGroupList + plural: usergroups + shortNames: + - ug + singular: usergroup + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.phase + name: Phase + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: UserGroup is the Schema for the usergroups API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + status: + description: UserGroupStatus defines the observed state of UserGroup + properties: + conditions: + description: Conditions contains the different condition statuses + for this user group. + items: + properties: + lastHeartbeatTime: + description: LastHeartbeatTime is the last time this condition + was updated. + format: date-time + type: string + lastTransitionTime: + description: LastTransitionTime is the last time the condition + changed from one status to another. + format: date-time + type: string + message: + description: Message is a human-readable message indicating + details about the last status change. + type: string + reason: + description: Reason is a (brief) reason for the condition's + last status change. + type: string + status: + description: Status is the status of the condition. One of True, + False, Unknown. + type: string + type: + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: The generation observed by the user controller. + format: int64 + type: integer + phase: + default: Unknown + description: Phase is the recently observed lifecycle phase of user + group + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/controllers/user/deploy/manifests/config/crd/bases/user.sealos.io_users.yaml b/controllers/user/deploy/manifests/config/crd/bases/user.sealos.io_users.yaml new file mode 100644 index 000000000..fb49be670 --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/bases/user.sealos.io_users.yaml @@ -0,0 +1,117 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.10.0 + creationTimestamp: null + name: users.user.sealos.io +spec: + group: user.sealos.io + names: + kind: User + listKind: UserList + plural: users + singular: user + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.phase + name: Phase + type: string + - jsonPath: .status.observedCSRExpirationSeconds + name: ExpirationSeconds + type: integer + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: User is the Schema for the users API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: UserSpec defines the desired state of User + properties: + csrExpirationSeconds: + default: 7200 + description: "expirationSeconds is the requested duration of validity + of the issued certificate. The certificate signer may issue a certificate + with a different validity duration so a client must check the delta + between the notBefore and and notAfter fields in the issued certificate + to determine the actual duration. \n The minimum valid value for + expirationSeconds is 600, i.e. 10 minutes." + format: int32 + type: integer + type: object + status: + description: UserStatus defines the observed state of User + properties: + conditions: + description: Conditions contains the different condition statuses + for this user. + items: + properties: + lastHeartbeatTime: + description: LastHeartbeatTime is the last time this condition + was updated. + format: date-time + type: string + lastTransitionTime: + description: LastTransitionTime is the last time the condition + changed from one status to another. + format: date-time + type: string + message: + description: Message is a human-readable message indicating + details about the last status change. + type: string + reason: + description: Reason is a (brief) reason for the condition's + last status change. + type: string + status: + description: Status is the status of the condition. One of True, + False, Unknown. + type: string + type: + type: string + required: + - status + - type + type: object + type: array + kubeConfig: + type: string + observedCSRExpirationSeconds: + default: 7200 + format: int32 + type: integer + observedGeneration: + description: The generation observed by the user controller. + format: int64 + type: integer + phase: + default: Unknown + description: Phase is the recently observed lifecycle phase of user + type: string + required: + - kubeConfig + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/controllers/user/deploy/manifests/config/crd/kustomization.yaml b/controllers/user/deploy/manifests/config/crd/kustomization.yaml new file mode 100644 index 000000000..b83e37fd3 --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/kustomization.yaml @@ -0,0 +1,39 @@ +# This kustomization.yaml is not intended to be run by itself, +# since it depends on service name and namespace that are out of this kustomize package. +# It should be run by config/default +resources: +- bases/user.sealos.io_users.yaml +- bases/user.sealos.io_usergroups.yaml +- bases/user.sealos.io_usergroupbindings.yaml +- bases/user.sealos.io_accounts.yaml +- bases/user.sealos.io_payments.yaml +#+kubebuilder:scaffold:crdkustomizeresource + +patchesStrategicMerge: +# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix. +# patches here are for enabling the conversion webhook for each CRD +#- patches/webhook_in_users.yaml +#- patches/webhook_in_groups.yaml +#- patches/webhook_in_usergroups.yaml +#- patches/webhook_in_usergroupuserbindings.yaml +#- patches/webhook_in_usergroupnamespacebindings.yaml +#- patches/webhook_in_usergroupbindings.yaml +#- patches/webhook_in_accounts.yaml +#- patches/webhook_in_payments.yaml +#+kubebuilder:scaffold:crdkustomizewebhookpatch + +# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix. +# patches here are for enabling the CA injection for each CRD +#- patches/cainjection_in_users.yaml +#- patches/cainjection_in_groups.yaml +#- patches/cainjection_in_usergroups.yaml +#- patches/cainjection_in_usergroupuserbindings.yaml +#- patches/cainjection_in_usergroupnamespacebindings.yaml +#- patches/cainjection_in_usergroupbindings.yaml +#- patches/cainjection_in_accounts.yaml +#- patches/cainjection_in_payments.yaml +#+kubebuilder:scaffold:crdkustomizecainjectionpatch + +# the following config is for teaching kustomize how to do kustomization for CRDs. +configurations: +- kustomizeconfig.yaml diff --git a/controllers/user/deploy/manifests/config/crd/kustomizeconfig.yaml b/controllers/user/deploy/manifests/config/crd/kustomizeconfig.yaml new file mode 100644 index 000000000..ec5c150a9 --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/kustomizeconfig.yaml @@ -0,0 +1,19 @@ +# This file is for teaching kustomize how to substitute name and namespace reference in CRD +nameReference: +- kind: Service + version: v1 + fieldSpecs: + - kind: CustomResourceDefinition + version: v1 + group: apiextensions.k8s.io + path: spec/conversion/webhook/clientConfig/service/name + +namespace: +- kind: CustomResourceDefinition + version: v1 + group: apiextensions.k8s.io + path: spec/conversion/webhook/clientConfig/service/namespace + create: false + +varReference: +- path: metadata/annotations diff --git a/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_accounts.yaml b/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_accounts.yaml new file mode 100644 index 000000000..4c55aff7e --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_accounts.yaml @@ -0,0 +1,7 @@ +# The following patch adds a directive for certmanager to inject CA into the CRD +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME) + name: accounts.user.sealos.io diff --git a/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_groups.yaml b/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_groups.yaml new file mode 100644 index 000000000..504c057cf --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_groups.yaml @@ -0,0 +1,7 @@ +# The following patch adds a directive for certmanager to inject CA into the CRD +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME) + name: groups.user.sealos.io diff --git a/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_payments.yaml b/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_payments.yaml new file mode 100644 index 000000000..aa5d18a98 --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_payments.yaml @@ -0,0 +1,7 @@ +# The following patch adds a directive for certmanager to inject CA into the CRD +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME) + name: payments.user.sealos.io diff --git a/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_usergroupbindings.yaml b/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_usergroupbindings.yaml new file mode 100644 index 000000000..550ba8c73 --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_usergroupbindings.yaml @@ -0,0 +1,7 @@ +# The following patch adds a directive for certmanager to inject CA into the CRD +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME) + name: usergroupbindings.user.sealos.io diff --git a/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_usergroupnamespacebindings.yaml b/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_usergroupnamespacebindings.yaml new file mode 100644 index 000000000..95fc29c9a --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_usergroupnamespacebindings.yaml @@ -0,0 +1,7 @@ +# The following patch adds a directive for certmanager to inject CA into the CRD +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME) + name: usergroupnamespacebindings.user.sealos.io diff --git a/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_usergroups.yaml b/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_usergroups.yaml new file mode 100644 index 000000000..8cd5c9241 --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_usergroups.yaml @@ -0,0 +1,7 @@ +# The following patch adds a directive for certmanager to inject CA into the CRD +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME) + name: usergroups.user.sealos.io diff --git a/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_usergroupuserbindings.yaml b/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_usergroupuserbindings.yaml new file mode 100644 index 000000000..2f609d15a --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_usergroupuserbindings.yaml @@ -0,0 +1,7 @@ +# The following patch adds a directive for certmanager to inject CA into the CRD +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME) + name: usergroupuserbindings.user.sealos.io diff --git a/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_users.yaml b/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_users.yaml new file mode 100644 index 000000000..bd7b44e3b --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/patches/cainjection_in_users.yaml @@ -0,0 +1,7 @@ +# The following patch adds a directive for certmanager to inject CA into the CRD +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME) + name: users.user.sealos.io diff --git a/controllers/user/deploy/manifests/config/crd/patches/webhook_in_accounts.yaml b/controllers/user/deploy/manifests/config/crd/patches/webhook_in_accounts.yaml new file mode 100644 index 000000000..df2cfe222 --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/patches/webhook_in_accounts.yaml @@ -0,0 +1,16 @@ +# The following patch enables a conversion webhook for the CRD +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: accounts.user.sealos.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + namespace: system + name: webhook-service + path: /convert + conversionReviewVersions: + - v1 diff --git a/controllers/user/deploy/manifests/config/crd/patches/webhook_in_payments.yaml b/controllers/user/deploy/manifests/config/crd/patches/webhook_in_payments.yaml new file mode 100644 index 000000000..b5734569a --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/patches/webhook_in_payments.yaml @@ -0,0 +1,16 @@ +# The following patch enables a conversion webhook for the CRD +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: payments.user.sealos.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + namespace: system + name: webhook-service + path: /convert + conversionReviewVersions: + - v1 diff --git a/controllers/user/deploy/manifests/config/crd/patches/webhook_in_usergroupbindings.yaml b/controllers/user/deploy/manifests/config/crd/patches/webhook_in_usergroupbindings.yaml new file mode 100644 index 000000000..08dae88d5 --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/patches/webhook_in_usergroupbindings.yaml @@ -0,0 +1,16 @@ +# The following patch enables a conversion webhook for the CRD +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: usergroupbindings.user.sealos.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + namespace: system + name: webhook-service + path: /convert + conversionReviewVersions: + - v1 diff --git a/controllers/user/deploy/manifests/config/crd/patches/webhook_in_usergroupnamespacebindings.yaml b/controllers/user/deploy/manifests/config/crd/patches/webhook_in_usergroupnamespacebindings.yaml new file mode 100644 index 000000000..a2879d288 --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/patches/webhook_in_usergroupnamespacebindings.yaml @@ -0,0 +1,16 @@ +# The following patch enables a conversion webhook for the CRD +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: usergroupnamespacebindings.user.sealos.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + namespace: system + name: webhook-service + path: /convert + conversionReviewVersions: + - v1 diff --git a/controllers/user/deploy/manifests/config/crd/patches/webhook_in_usergroups.yaml b/controllers/user/deploy/manifests/config/crd/patches/webhook_in_usergroups.yaml new file mode 100644 index 000000000..b8b67ad28 --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/patches/webhook_in_usergroups.yaml @@ -0,0 +1,16 @@ +# The following patch enables a conversion webhook for the CRD +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: usergroups.user.sealos.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + namespace: system + name: webhook-service + path: /convert + conversionReviewVersions: + - v1 diff --git a/controllers/user/deploy/manifests/config/crd/patches/webhook_in_usergroupuserbindings.yaml b/controllers/user/deploy/manifests/config/crd/patches/webhook_in_usergroupuserbindings.yaml new file mode 100644 index 000000000..2247a5983 --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/patches/webhook_in_usergroupuserbindings.yaml @@ -0,0 +1,16 @@ +# The following patch enables a conversion webhook for the CRD +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: usergroupuserbindings.user.sealos.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + namespace: system + name: webhook-service + path: /convert + conversionReviewVersions: + - v1 diff --git a/controllers/user/deploy/manifests/config/crd/patches/webhook_in_users.yaml b/controllers/user/deploy/manifests/config/crd/patches/webhook_in_users.yaml new file mode 100644 index 000000000..10f35b785 --- /dev/null +++ b/controllers/user/deploy/manifests/config/crd/patches/webhook_in_users.yaml @@ -0,0 +1,16 @@ +# The following patch enables a conversion webhook for the CRD +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: users.user.sealos.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + namespace: system + name: webhook-service + path: /convert + conversionReviewVersions: + - v1 diff --git a/controllers/user/deploy/manifests/config/default/kustomization.yaml b/controllers/user/deploy/manifests/config/default/kustomization.yaml new file mode 100644 index 000000000..c426a6747 --- /dev/null +++ b/controllers/user/deploy/manifests/config/default/kustomization.yaml @@ -0,0 +1,79 @@ +# Adds namespace to all resources. +namespace: user-system + +# Value of this field is prepended to the +# names of all resources, e.g. a deployment named +# "wordpress" becomes "alices-wordpress". +# Note that it should also match with the prefix (text before '-') of the namespace +# field above. +namePrefix: user- + +# Labels to add to all resources and selectors. +#commonLabels: +# someName: someValue + +secretGenerator: + - envs: + - payment.env + name: manager-secret + +bases: + - ../crd + - ../rbac + - ../manager + # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in + # crd/kustomization.yaml + - ../webhook + # [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required. + - ../certmanager +# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'. +#- ../prometheus + +patchesStrategicMerge: + # Protect the /metrics endpoint by putting it behind auth. + # If you want your controller-manager to expose the /metrics + # endpoint w/o any authn/z, please comment the following line. + - manager_auth_proxy_patch.yaml + + # Mount the controller config file for loading manager configurations + # through a ComponentConfig type + #- manager_config_patch.yaml + + # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in + # crd/kustomization.yaml + - manager_webhook_patch.yaml + + # [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. + # Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA injection in the admission webhooks. + # 'CERTMANAGER' needs to be enabled to use ca injection + - webhookcainjection_patch.yaml + +# the following config is for teaching kustomize how to do var substitution +vars: + # [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix. + - name: CERTIFICATE_NAMESPACE # namespace of the certificate CR + objref: + kind: Certificate + group: cert-manager.io + version: v1 + name: serving-cert # this name should match the one in certificate.yaml + fieldref: + fieldpath: metadata.namespace + - name: CERTIFICATE_NAME + objref: + kind: Certificate + group: cert-manager.io + version: v1 + name: serving-cert # this name should match the one in certificate.yaml + - name: SERVICE_NAMESPACE # namespace of the service + objref: + kind: Service + version: v1 + name: webhook-service + fieldref: + fieldpath: metadata.namespace + - name: SERVICE_NAME + objref: + kind: Service + version: v1 + name: webhook-service diff --git a/controllers/user/deploy/manifests/config/default/manager_auth_proxy_patch.yaml b/controllers/user/deploy/manifests/config/default/manager_auth_proxy_patch.yaml new file mode 100644 index 000000000..abc971dd6 --- /dev/null +++ b/controllers/user/deploy/manifests/config/default/manager_auth_proxy_patch.yaml @@ -0,0 +1,50 @@ +# This patch inject a sidecar container which is a HTTP proxy for the +# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: controller-manager + namespace: system +spec: + template: + spec: + containers: + - name: kube-rbac-proxy + securityContext: + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - "ALL" + image: gcr.io/kubebuilder/kube-rbac-proxy:v0.13.0 + args: + - "--secure-listen-address=0.0.0.0:8443" + - "--upstream=http://127.0.0.1:8080/" + - "--logtostderr=true" + - "--v=0" + ports: + - containerPort: 8443 + protocol: TCP + name: https + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 5m + memory: 64Mi + - name: manager + imagePullPolicy: Always + args: + - "--health-probe-bind-address=:8081" + - "--metrics-bind-address=127.0.0.1:8080" + - "--leader-elect" + envFrom: + - secretRef: + name: manager-secret + env: + - name: NAMESPACE_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace diff --git a/controllers/user/deploy/manifests/config/default/manager_config_patch.yaml b/controllers/user/deploy/manifests/config/default/manager_config_patch.yaml new file mode 100644 index 000000000..6c400155c --- /dev/null +++ b/controllers/user/deploy/manifests/config/default/manager_config_patch.yaml @@ -0,0 +1,20 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: controller-manager + namespace: system +spec: + template: + spec: + containers: + - name: manager + args: + - "--config=controller_manager_config.yaml" + volumeMounts: + - name: manager-config + mountPath: /controller_manager_config.yaml + subPath: controller_manager_config.yaml + volumes: + - name: manager-config + configMap: + name: manager-config diff --git a/controllers/user/deploy/manifests/config/default/manager_webhook_patch.yaml b/controllers/user/deploy/manifests/config/default/manager_webhook_patch.yaml new file mode 100644 index 000000000..738de350b --- /dev/null +++ b/controllers/user/deploy/manifests/config/default/manager_webhook_patch.yaml @@ -0,0 +1,23 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: controller-manager + namespace: system +spec: + template: + spec: + containers: + - name: manager + ports: + - containerPort: 9443 + name: webhook-server + protocol: TCP + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true + volumes: + - name: cert + secret: + defaultMode: 420 + secretName: webhook-server-cert diff --git a/controllers/user/deploy/manifests/config/default/payment.env.tmpl b/controllers/user/deploy/manifests/config/default/payment.env.tmpl new file mode 100644 index 000000000..1225dffae --- /dev/null +++ b/controllers/user/deploy/manifests/config/default/payment.env.tmpl @@ -0,0 +1,5 @@ +WechatPrivateKey={{ .WechatPrivateKey }} +MchID={{ .MchID }} +MchCertificateSerialNumber={{ .MchCertificateSerialNumber }} +MchAPIv3Key={{ .MchAPIv3Key }} +AppID={{ .AppID }} diff --git a/controllers/user/deploy/manifests/config/default/webhookcainjection_patch.yaml b/controllers/user/deploy/manifests/config/default/webhookcainjection_patch.yaml new file mode 100644 index 000000000..02ab515d4 --- /dev/null +++ b/controllers/user/deploy/manifests/config/default/webhookcainjection_patch.yaml @@ -0,0 +1,15 @@ +# This patch add annotation to admission webhook config and +# the variables $(CERTIFICATE_NAMESPACE) and $(CERTIFICATE_NAME) will be substituted by kustomize. +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: mutating-webhook-configuration + annotations: + cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME) +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: validating-webhook-configuration + annotations: + cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME) diff --git a/controllers/user/deploy/manifests/config/manager/controller_manager_config.yaml b/controllers/user/deploy/manifests/config/manager/controller_manager_config.yaml new file mode 100644 index 000000000..16173b89a --- /dev/null +++ b/controllers/user/deploy/manifests/config/manager/controller_manager_config.yaml @@ -0,0 +1,21 @@ +apiVersion: controller-runtime.sigs.k8s.io/v1alpha1 +kind: ControllerManagerConfig +health: + healthProbeBindAddress: :8081 +metrics: + bindAddress: 127.0.0.1:8080 +webhook: + port: 9443 +leaderElection: + leaderElect: true + resourceName: 785548a1.sealos.io +# leaderElectionReleaseOnCancel defines if the leader should step down volume +# when the Manager ends. This requires the binary to immediately end when the +# Manager is stopped, otherwise, this setting is unsafe. Setting this significantly +# speeds up voluntary leader transitions as the new leader don't have to wait +# LeaseDuration time first. +# In the default scaffold provided, the program ends immediately after +# the manager stops, so would be fine to enable this option. However, +# if you are doing or is intended to do any operation such as perform cleanups +# after the manager stops then its usage might be unsafe. +# leaderElectionReleaseOnCancel: true diff --git a/controllers/user/deploy/manifests/config/manager/kustomization.yaml b/controllers/user/deploy/manifests/config/manager/kustomization.yaml new file mode 100644 index 000000000..9bde16496 --- /dev/null +++ b/controllers/user/deploy/manifests/config/manager/kustomization.yaml @@ -0,0 +1,16 @@ +resources: +- manager.yaml + +generatorOptions: + disableNameSuffixHash: true + +configMapGenerator: +- files: + - controller_manager_config.yaml + name: manager-config +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +images: +- name: controller + newName: ghcr.io/labring/sealos-user-controller + newTag: dev diff --git a/controllers/user/deploy/manifests/config/manager/manager.yaml b/controllers/user/deploy/manifests/config/manager/manager.yaml new file mode 100644 index 000000000..41e0bdfd8 --- /dev/null +++ b/controllers/user/deploy/manifests/config/manager/manager.yaml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Namespace +metadata: + labels: + control-plane: controller-manager + name: system +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: controller-manager + namespace: system + labels: + control-plane: controller-manager +spec: + selector: + matchLabels: + control-plane: controller-manager + replicas: 3 + template: + metadata: + annotations: + kubectl.kubernetes.io/default-container: manager + labels: + control-plane: controller-manager + spec: + securityContext: + runAsNonRoot: true + # TODO(user): For common cases that do not require escalating privileges + # it is recommended to ensure that all your Pods/Containers are restrictive. + # More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted + # Please uncomment the following code if your project does NOT have to work on old Kubernetes + # versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ). + # seccompProfile: + # type: RuntimeDefault + containers: + - command: + - /manager + args: + - --leader-elect + image: controller:latest + imagePullPolicy: IfNotPresent + name: manager + securityContext: + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - "ALL" + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + # TODO(user): Configure the resources accordingly based on the project requirements. + # More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 10m + memory: 64Mi + serviceAccountName: controller-manager + terminationGracePeriodSeconds: 10 diff --git a/controllers/user/deploy/manifests/config/prometheus/kustomization.yaml b/controllers/user/deploy/manifests/config/prometheus/kustomization.yaml new file mode 100644 index 000000000..ed137168a --- /dev/null +++ b/controllers/user/deploy/manifests/config/prometheus/kustomization.yaml @@ -0,0 +1,2 @@ +resources: +- monitor.yaml diff --git a/controllers/user/deploy/manifests/config/prometheus/monitor.yaml b/controllers/user/deploy/manifests/config/prometheus/monitor.yaml new file mode 100644 index 000000000..d19136ae7 --- /dev/null +++ b/controllers/user/deploy/manifests/config/prometheus/monitor.yaml @@ -0,0 +1,20 @@ + +# Prometheus Monitor Service (Metrics) +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + labels: + control-plane: controller-manager + name: controller-manager-metrics-monitor + namespace: system +spec: + endpoints: + - path: /metrics + port: https + scheme: https + bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token + tlsConfig: + insecureSkipVerify: true + selector: + matchLabels: + control-plane: controller-manager diff --git a/controllers/user/deploy/manifests/config/rbac/account_editor_role.yaml b/controllers/user/deploy/manifests/config/rbac/account_editor_role.yaml new file mode 100644 index 000000000..2e29d9a70 --- /dev/null +++ b/controllers/user/deploy/manifests/config/rbac/account_editor_role.yaml @@ -0,0 +1,24 @@ +# permissions for end users to edit accounts. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: account-editor-role +rules: +- apiGroups: + - user.sealos.io + resources: + - accounts + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - user.sealos.io + resources: + - accounts/status + verbs: + - get diff --git a/controllers/user/deploy/manifests/config/rbac/account_viewer_role.yaml b/controllers/user/deploy/manifests/config/rbac/account_viewer_role.yaml new file mode 100644 index 000000000..d7b4d082a --- /dev/null +++ b/controllers/user/deploy/manifests/config/rbac/account_viewer_role.yaml @@ -0,0 +1,20 @@ +# permissions for end users to view accounts. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: account-viewer-role +rules: +- apiGroups: + - user.sealos.io + resources: + - accounts + verbs: + - get + - list + - watch +- apiGroups: + - user.sealos.io + resources: + - accounts/status + verbs: + - get diff --git a/controllers/user/deploy/manifests/config/rbac/auth_proxy_client_clusterrole.yaml b/controllers/user/deploy/manifests/config/rbac/auth_proxy_client_clusterrole.yaml new file mode 100644 index 000000000..51a75db47 --- /dev/null +++ b/controllers/user/deploy/manifests/config/rbac/auth_proxy_client_clusterrole.yaml @@ -0,0 +1,9 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: metrics-reader +rules: +- nonResourceURLs: + - "/metrics" + verbs: + - get diff --git a/controllers/user/deploy/manifests/config/rbac/auth_proxy_role.yaml b/controllers/user/deploy/manifests/config/rbac/auth_proxy_role.yaml new file mode 100644 index 000000000..80e1857c5 --- /dev/null +++ b/controllers/user/deploy/manifests/config/rbac/auth_proxy_role.yaml @@ -0,0 +1,17 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: proxy-role +rules: +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create diff --git a/controllers/user/deploy/manifests/config/rbac/auth_proxy_role_binding.yaml b/controllers/user/deploy/manifests/config/rbac/auth_proxy_role_binding.yaml new file mode 100644 index 000000000..ec7acc0a1 --- /dev/null +++ b/controllers/user/deploy/manifests/config/rbac/auth_proxy_role_binding.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: proxy-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: proxy-role +subjects: +- kind: ServiceAccount + name: controller-manager + namespace: system diff --git a/controllers/user/deploy/manifests/config/rbac/auth_proxy_service.yaml b/controllers/user/deploy/manifests/config/rbac/auth_proxy_service.yaml new file mode 100644 index 000000000..71f179727 --- /dev/null +++ b/controllers/user/deploy/manifests/config/rbac/auth_proxy_service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + control-plane: controller-manager + name: controller-manager-metrics-service + namespace: system +spec: + ports: + - name: https + port: 8443 + protocol: TCP + targetPort: https + selector: + control-plane: controller-manager diff --git a/controllers/user/deploy/manifests/config/rbac/kustomization.yaml b/controllers/user/deploy/manifests/config/rbac/kustomization.yaml new file mode 100644 index 000000000..731832a6a --- /dev/null +++ b/controllers/user/deploy/manifests/config/rbac/kustomization.yaml @@ -0,0 +1,18 @@ +resources: +# All RBAC will be applied under this service account in +# the deployment namespace. You may comment out this resource +# if your manager will use a service account that exists at +# runtime. Be sure to update RoleBinding and ClusterRoleBinding +# subjects if changing service account names. +- service_account.yaml +- role.yaml +- role_binding.yaml +- leader_election_role.yaml +- leader_election_role_binding.yaml +# Comment the following 4 lines if you want to disable +# the auth proxy (https://github.com/brancz/kube-rbac-proxy) +# which protects your /metrics endpoint. +- auth_proxy_service.yaml +- auth_proxy_role.yaml +- auth_proxy_role_binding.yaml +- auth_proxy_client_clusterrole.yaml diff --git a/controllers/user/deploy/manifests/config/rbac/leader_election_role.yaml b/controllers/user/deploy/manifests/config/rbac/leader_election_role.yaml new file mode 100644 index 000000000..4190ec805 --- /dev/null +++ b/controllers/user/deploy/manifests/config/rbac/leader_election_role.yaml @@ -0,0 +1,37 @@ +# permissions to do leader election. +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: leader-election-role +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch diff --git a/controllers/user/deploy/manifests/config/rbac/leader_election_role_binding.yaml b/controllers/user/deploy/manifests/config/rbac/leader_election_role_binding.yaml new file mode 100644 index 000000000..1d1321ed4 --- /dev/null +++ b/controllers/user/deploy/manifests/config/rbac/leader_election_role_binding.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: leader-election-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: leader-election-role +subjects: +- kind: ServiceAccount + name: controller-manager + namespace: system diff --git a/controllers/user/deploy/manifests/config/rbac/payment_editor_role.yaml b/controllers/user/deploy/manifests/config/rbac/payment_editor_role.yaml new file mode 100644 index 000000000..6ef23b07b --- /dev/null +++ b/controllers/user/deploy/manifests/config/rbac/payment_editor_role.yaml @@ -0,0 +1,24 @@ +# permissions for end users to edit payments. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: payment-editor-role +rules: +- apiGroups: + - user.sealos.io + resources: + - payments + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - user.sealos.io + resources: + - payments/status + verbs: + - get diff --git a/controllers/user/deploy/manifests/config/rbac/payment_viewer_role.yaml b/controllers/user/deploy/manifests/config/rbac/payment_viewer_role.yaml new file mode 100644 index 000000000..4f706d30b --- /dev/null +++ b/controllers/user/deploy/manifests/config/rbac/payment_viewer_role.yaml @@ -0,0 +1,20 @@ +# permissions for end users to view payments. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: payment-viewer-role +rules: +- apiGroups: + - user.sealos.io + resources: + - payments + verbs: + - get + - list + - watch +- apiGroups: + - user.sealos.io + resources: + - payments/status + verbs: + - get diff --git a/controllers/user/deploy/manifests/config/rbac/role.yaml b/controllers/user/deploy/manifests/config/rbac/role.yaml new file mode 100644 index 000000000..778ce870b --- /dev/null +++ b/controllers/user/deploy/manifests/config/rbac/role.yaml @@ -0,0 +1,259 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + creationTimestamp: null + name: manager-role +rules: +- apiGroups: + - certificates.k8s.io + resources: + - certificatesigningrequests + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - certificates.k8s.io + resources: + - certificatesigningrequests/approval + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - certificates.k8s.io + resources: + - certificatesigningrequests/status + verbs: + - get + - patch + - update +- apiGroups: + - certificates.k8s.io + resourceNames: + - kubernetes.io/kube-apiserver-client + resources: + - signers + verbs: + - approve +- apiGroups: + - "" + resources: + - namespaces + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - "" + resources: + - secrets/finalizers + verbs: + - update +- apiGroups: + - "" + resources: + - secrets/status + verbs: + - get + - patch + - update +- apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - "" + resources: + - serviceaccounts/status + verbs: + - get + - patch + - update +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - user.sealos.io + resources: + - accounts + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - user.sealos.io + resources: + - accounts/finalizers + verbs: + - update +- apiGroups: + - user.sealos.io + resources: + - accounts/status + verbs: + - get + - patch + - update +- apiGroups: + - user.sealos.io + resources: + - payments + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - user.sealos.io + resources: + - payments/finalizers + verbs: + - update +- apiGroups: + - user.sealos.io + resources: + - payments/status + verbs: + - get + - patch + - update +- apiGroups: + - user.sealos.io + resources: + - usergroupbindings + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - user.sealos.io + resources: + - usergroupbindings/finalizers + verbs: + - update +- apiGroups: + - user.sealos.io + resources: + - usergroupbindings/status + verbs: + - get + - patch + - update +- apiGroups: + - user.sealos.io + resources: + - usergroups + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - user.sealos.io + resources: + - usergroups/finalizers + verbs: + - update +- apiGroups: + - user.sealos.io + resources: + - usergroups/status + verbs: + - get + - patch + - update +- apiGroups: + - user.sealos.io + resources: + - users + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - user.sealos.io + resources: + - users/finalizers + verbs: + - update +- apiGroups: + - user.sealos.io + resources: + - users/status + verbs: + - get + - patch + - update diff --git a/controllers/user/deploy/manifests/config/rbac/role_binding.yaml b/controllers/user/deploy/manifests/config/rbac/role_binding.yaml new file mode 100644 index 000000000..2070ede44 --- /dev/null +++ b/controllers/user/deploy/manifests/config/rbac/role_binding.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: manager-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: manager-role +subjects: +- kind: ServiceAccount + name: controller-manager + namespace: system diff --git a/controllers/user/deploy/manifests/config/rbac/service_account.yaml b/controllers/user/deploy/manifests/config/rbac/service_account.yaml new file mode 100644 index 000000000..7cd6025bf --- /dev/null +++ b/controllers/user/deploy/manifests/config/rbac/service_account.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: controller-manager + namespace: system diff --git a/controllers/user/deploy/manifests/config/rbac/user_editor_role.yaml b/controllers/user/deploy/manifests/config/rbac/user_editor_role.yaml new file mode 100644 index 000000000..d13cab598 --- /dev/null +++ b/controllers/user/deploy/manifests/config/rbac/user_editor_role.yaml @@ -0,0 +1,24 @@ +# permissions for end users to edit users. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: user-editor-role +rules: +- apiGroups: + - user.sealos.io + resources: + - users + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - user.sealos.io + resources: + - users/status + verbs: + - get diff --git a/controllers/user/deploy/manifests/config/rbac/user_viewer_role.yaml b/controllers/user/deploy/manifests/config/rbac/user_viewer_role.yaml new file mode 100644 index 000000000..e296fdd87 --- /dev/null +++ b/controllers/user/deploy/manifests/config/rbac/user_viewer_role.yaml @@ -0,0 +1,20 @@ +# permissions for end users to view users. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: user-viewer-role +rules: +- apiGroups: + - user.sealos.io + resources: + - users + verbs: + - get + - list + - watch +- apiGroups: + - user.sealos.io + resources: + - users/status + verbs: + - get diff --git a/controllers/user/deploy/manifests/config/rbac/usergroup_editor_role.yaml b/controllers/user/deploy/manifests/config/rbac/usergroup_editor_role.yaml new file mode 100644 index 000000000..5d18a8917 --- /dev/null +++ b/controllers/user/deploy/manifests/config/rbac/usergroup_editor_role.yaml @@ -0,0 +1,24 @@ +# permissions for end users to edit usergroups. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: usergroup-editor-role +rules: +- apiGroups: + - user.sealos.io + resources: + - usergroups + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - user.sealos.io + resources: + - usergroups/status + verbs: + - get diff --git a/controllers/user/deploy/manifests/config/rbac/usergroup_viewer_role.yaml b/controllers/user/deploy/manifests/config/rbac/usergroup_viewer_role.yaml new file mode 100644 index 000000000..cf3c24e80 --- /dev/null +++ b/controllers/user/deploy/manifests/config/rbac/usergroup_viewer_role.yaml @@ -0,0 +1,20 @@ +# permissions for end users to view usergroups. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: usergroup-viewer-role +rules: +- apiGroups: + - user.sealos.io + resources: + - usergroups + verbs: + - get + - list + - watch +- apiGroups: + - user.sealos.io + resources: + - usergroups/status + verbs: + - get diff --git a/controllers/user/deploy/manifests/config/rbac/usergroupbinding_editor_role.yaml b/controllers/user/deploy/manifests/config/rbac/usergroupbinding_editor_role.yaml new file mode 100644 index 000000000..c173a0db0 --- /dev/null +++ b/controllers/user/deploy/manifests/config/rbac/usergroupbinding_editor_role.yaml @@ -0,0 +1,24 @@ +# permissions for end users to edit usergroupbindings. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: usergroupbinding-editor-role +rules: +- apiGroups: + - user.sealos.io + resources: + - usergroupbindings + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - user.sealos.io + resources: + - usergroupbindings/status + verbs: + - get diff --git a/controllers/user/deploy/manifests/config/rbac/usergroupbinding_viewer_role.yaml b/controllers/user/deploy/manifests/config/rbac/usergroupbinding_viewer_role.yaml new file mode 100644 index 000000000..d94d1976b --- /dev/null +++ b/controllers/user/deploy/manifests/config/rbac/usergroupbinding_viewer_role.yaml @@ -0,0 +1,20 @@ +# permissions for end users to view usergroupbindings. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: usergroupbinding-viewer-role +rules: +- apiGroups: + - user.sealos.io + resources: + - usergroupbindings + verbs: + - get + - list + - watch +- apiGroups: + - user.sealos.io + resources: + - usergroupbindings/status + verbs: + - get diff --git a/controllers/user/deploy/manifests/config/samples/all.yaml b/controllers/user/deploy/manifests/config/samples/all.yaml new file mode 100644 index 000000000..ed15e5033 --- /dev/null +++ b/controllers/user/deploy/manifests/config/samples/all.yaml @@ -0,0 +1,90 @@ +apiVersion: user.sealos.io/v1 +kind: User +metadata: + name: f8699ded-58d3-432b-a9ff-56568b57a38d +spec: + displayName: cuisongliu +--- +apiVersion: user.sealos.io/v1 +kind: UserGroup +metadata: + name: f8699ded-58d3-432b-a9ff-56568b57a38d +--- +apiVersion: user.sealos.io/v1 +kind: UserGroupBinding +metadata: + name: f8699ded-58d3-432b-a9ff-56568b57a38d +subject: + kind: User + name: "f8699ded-58d3-432b-a9ff-56568b57a38d" # Name is case sensitive + apiGroup: sealos.io/v1 +userGroupRef: f8699ded-58d3-432b-a9ff-56568b57a38d +roleRefs: + kind: ClusterRole + name: sealos-user-admin-role + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: user.sealos.io/v1 +kind: UserGroupBinding +metadata: + name: f8699ded-58d3-432b-a9ff-56568b57a38d +subject: + kind: Namespace + name: "f8699ded-58d3-432b-a9ff-56568b57a38d" +userGroupRef: f8699ded-58d3-432b-a9ff-56568b57a38d + +## 创建者 sealos-user-create-role权限 +## 管理员 不能创建管理员使用webhook校验操作 新增sealos-user-manager-role权限 +## 只有管理员和创建者才需要设置role其他不需要设置（默认给namespace设置cluster-admin的Role权限） +## 创建User默认创建UserGroup 和 2个UserGroupBinding (对user(直接是创建人的role)和对namespace) +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: sealos-user-create-role +rules: + - apiGroups: + - user.sealos.io + resources: + - 'usergroupbindings' + verbs: + - create + - delete + - deletecollection + - patch + - update + - apiGroups: + - user.sealos.io + resources: + - 'listusergroupsbyuser' + - 'listuserbyusergroup' + verbs: + - list + - get + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: sealos-user-manager-role +rules: + - apiGroups: + - user.sealos.io + resources: + - '*' + verbs: + - create + - delete + - deletecollection + - patch + - update + - apiGroups: + - user.sealos.io + resources: + - 'listusergroupsbyuser' + - 'listuserbyusergroup' + - 'listnamespacebyusergroup' + verbs: + - list + - get + - watch diff --git a/controllers/user/deploy/manifests/config/samples/app.log b/controllers/user/deploy/manifests/config/samples/app.log new file mode 100644 index 000000000..e69de29bb diff --git a/controllers/user/deploy/manifests/config/samples/user_v1_account.yaml b/controllers/user/deploy/manifests/config/samples/user_v1_account.yaml new file mode 100644 index 000000000..0bb6eb06c --- /dev/null +++ b/controllers/user/deploy/manifests/config/samples/user_v1_account.yaml @@ -0,0 +1,6 @@ +apiVersion: user.sealos.io/v1 +kind: Account +metadata: + name: account-sample +spec: + # TODO(user): Add fields here diff --git a/controllers/user/deploy/manifests/config/samples/user_v1_payment.yaml b/controllers/user/deploy/manifests/config/samples/user_v1_payment.yaml new file mode 100644 index 000000000..a4e980cea --- /dev/null +++ b/controllers/user/deploy/manifests/config/samples/user_v1_payment.yaml @@ -0,0 +1,8 @@ +apiVersion: user.sealos.io/v1 +kind: Payment +metadata: + name: payment-sample +spec: + # TODO(user): Add fields here + userID: fanux + amount: 1 diff --git a/controllers/user/deploy/manifests/config/samples/user_v1_user.yaml b/controllers/user/deploy/manifests/config/samples/user_v1_user.yaml new file mode 100644 index 000000000..17387ed45 --- /dev/null +++ b/controllers/user/deploy/manifests/config/samples/user_v1_user.yaml @@ -0,0 +1,6 @@ +apiVersion: user.sealos.io/v1 +kind: User +metadata: + name: f8699ded-58d3-432b-a9ff-56568b57a38d +spec: + csrExpirationSeconds: 1000000000 diff --git a/controllers/user/deploy/manifests/config/samples/user_v1_usergroup.yaml b/controllers/user/deploy/manifests/config/samples/user_v1_usergroup.yaml new file mode 100644 index 000000000..e6e7cc114 --- /dev/null +++ b/controllers/user/deploy/manifests/config/samples/user_v1_usergroup.yaml @@ -0,0 +1,4 @@ +apiVersion: user.sealos.io/v1 +kind: UserGroup +metadata: + name: usergroup-sample diff --git a/controllers/user/deploy/manifests/config/samples/user_v1_usergroupbinding.yaml b/controllers/user/deploy/manifests/config/samples/user_v1_usergroupbinding.yaml new file mode 100644 index 000000000..36c0424b4 --- /dev/null +++ b/controllers/user/deploy/manifests/config/samples/user_v1_usergroupbinding.yaml @@ -0,0 +1,6 @@ +apiVersion: user.sealos.io/v1 +kind: UserGroupBinding +metadata: + name: usergroupbinding-sample +spec: + # TODO(user): Add fields here diff --git a/controllers/user/deploy/manifests/config/webhook/kustomization.yaml b/controllers/user/deploy/manifests/config/webhook/kustomization.yaml new file mode 100644 index 000000000..9cf26134e --- /dev/null +++ b/controllers/user/deploy/manifests/config/webhook/kustomization.yaml @@ -0,0 +1,6 @@ +resources: +- manifests.yaml +- service.yaml + +configurations: +- kustomizeconfig.yaml diff --git a/controllers/user/deploy/manifests/config/webhook/kustomizeconfig.yaml b/controllers/user/deploy/manifests/config/webhook/kustomizeconfig.yaml new file mode 100644 index 000000000..25e21e3c9 --- /dev/null +++ b/controllers/user/deploy/manifests/config/webhook/kustomizeconfig.yaml @@ -0,0 +1,25 @@ +# the following config is for teaching kustomize where to look at when substituting vars. +# It requires kustomize v2.1.0 or newer to work properly. +nameReference: +- kind: Service + version: v1 + fieldSpecs: + - kind: MutatingWebhookConfiguration + group: admissionregistration.k8s.io + path: webhooks/clientConfig/service/name + - kind: ValidatingWebhookConfiguration + group: admissionregistration.k8s.io + path: webhooks/clientConfig/service/name + +namespace: +- kind: MutatingWebhookConfiguration + group: admissionregistration.k8s.io + path: webhooks/clientConfig/service/namespace + create: true +- kind: ValidatingWebhookConfiguration + group: admissionregistration.k8s.io + path: webhooks/clientConfig/service/namespace + create: true + +varReference: +- path: metadata/annotations diff --git a/controllers/user/deploy/manifests/config/webhook/manifests.yaml b/controllers/user/deploy/manifests/config/webhook/manifests.yaml new file mode 100644 index 000000000..8aa2e1b37 --- /dev/null +++ b/controllers/user/deploy/manifests/config/webhook/manifests.yaml @@ -0,0 +1,134 @@ +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + creationTimestamp: null + name: mutating-webhook-configuration +webhooks: +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: webhook-service + namespace: system + path: /mutate-user-sealos-io-v1-user + failurePolicy: Fail + name: muser.kb.io + rules: + - apiGroups: + - user.sealos.io + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - users + sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: webhook-service + namespace: system + path: /mutate-user-sealos-io-v1-usergroup + failurePolicy: Fail + name: musergroup.kb.io + rules: + - apiGroups: + - user.sealos.io + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - usergroups + sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: webhook-service + namespace: system + path: /mutate-user-sealos-io-v1-usergroupbinding + failurePolicy: Fail + name: musergroupbinding.kb.io + rules: + - apiGroups: + - user.sealos.io + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - usergroupbindings + sideEffects: None +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + creationTimestamp: null + name: validating-webhook-configuration +webhooks: +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: webhook-service + namespace: system + path: /validate-user-sealos-io-v1-user + failurePolicy: Fail + name: vuser.kb.io + rules: + - apiGroups: + - user.sealos.io + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - users + sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: webhook-service + namespace: system + path: /validate-user-sealos-io-v1-usergroup + failurePolicy: Fail + name: vusergroup.kb.io + rules: + - apiGroups: + - user.sealos.io + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - usergroups + sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: webhook-service + namespace: system + path: /validate-user-sealos-io-v1-usergroupbinding + failurePolicy: Fail + name: vusergroupbinding.kb.io + rules: + - apiGroups: + - user.sealos.io + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - usergroupbindings + sideEffects: None diff --git a/controllers/user/deploy/manifests/config/webhook/service.yaml b/controllers/user/deploy/manifests/config/webhook/service.yaml new file mode 100644 index 000000000..3f638bd9c --- /dev/null +++ b/controllers/user/deploy/manifests/config/webhook/service.yaml @@ -0,0 +1,13 @@ + +apiVersion: v1 +kind: Service +metadata: + name: webhook-service + namespace: system +spec: + ports: + - port: 443 + protocol: TCP + targetPort: 9443 + selector: + control-plane: controller-manager diff --git a/controllers/user/deploy/manifests/deploy.yaml.tmpl b/controllers/user/deploy/manifests/deploy.yaml.tmpl deleted file mode 100644 index fd3a51d30..000000000 --- a/controllers/user/deploy/manifests/deploy.yaml.tmpl +++ /dev/null @@ -1,1180 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - labels: - control-plane: controller-manager - name: user-system ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.10.0 - creationTimestamp: null - name: accounts.user.sealos.io -spec: - group: user.sealos.io - names: - kind: Account - listKind: AccountList - plural: accounts - singular: account - scope: Namespaced - versions: - - name: v1 - schema: - openAPIV3Schema: - description: Account is the Schema for the accounts API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: AccountSpec defines the desired state of Account - type: object - status: - description: AccountStatus defines the observed state of Account - properties: - balance: - format: int64 - type: integer - chargeList: - description: 'INSERT ADDITIONAL STATUS FIELD - define observed state - of cluster Important: Run "make" to regenerate code after modifying - this file' - items: - properties: - balance: - format: int64 - type: integer - status: - type: string - time: - format: date-time - type: string - tradeNO: - type: string - type: object - type: array - type: object - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.10.0 - creationTimestamp: null - name: payments.user.sealos.io -spec: - group: user.sealos.io - names: - kind: Payment - listKind: PaymentList - plural: payments - singular: payment - scope: Namespaced - versions: - - name: v1 - schema: - openAPIV3Schema: - description: Payment is the Schema for the payments API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: PaymentSpec defines the desired state of Payment - properties: - amount: - description: Amount is the amount of recharge - format: int64 - type: integer - userID: - description: UserID is the user id who want to recharge - type: string - type: object - status: - description: PaymentStatus defines the observed state of Payment - properties: - codeURL: - description: CodeURL is the codeURL of wechatpay - type: string - status: - description: Status is the status of wechatpay, charging, closed, - timeout - type: string - tradeNO: - description: TradeNO is the tradeNO of wechatpay - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.10.0 - creationTimestamp: null - name: usergroupbindings.user.sealos.io -spec: - group: user.sealos.io - names: - kind: UserGroupBinding - listKind: UserGroupBindingList - plural: usergroupbindings - shortNames: - - ugbinding - singular: usergroupbinding - scope: Cluster - versions: - - additionalPrinterColumns: - - jsonPath: .userGroupRef - name: UserGroup - type: string - - jsonPath: .subject.kind - name: Kind - type: string - - jsonPath: .status.phase - name: Phase - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: UserGroupBinding is the Schema for the usergroupbindings API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - roleRef: - default: user - description: RoleRef can only reference a ClusterRole in the global namespace. - type: string - status: - description: Status contains the different condition statuses for this - user group. - properties: - conditions: - description: Conditions contains the different condition statuses - for this user group. - items: - properties: - lastHeartbeatTime: - description: LastHeartbeatTime is the last time this condition - was updated. - format: date-time - type: string - lastTransitionTime: - description: LastTransitionTime is the last time the condition - changed from one status to another. - format: date-time - type: string - message: - description: Message is a human-readable message indicating - details about the last status change. - type: string - reason: - description: Reason is a (brief) reason for the condition's - last status change. - type: string - status: - description: Status is the status of the condition. One of True, - False, Unknown. - type: string - type: - type: string - required: - - status - - type - type: object - type: array - observedGeneration: - description: The generation observed by the user controller. - format: int64 - type: integer - phase: - default: Unknown - description: Phase is the recently observed lifecycle phase of user - group binding - type: string - type: object - subject: - description: Subject holds references to the objects the role applies - to. - properties: - apiGroup: - description: APIGroup holds the API group of the referenced subject. - Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io" - for User and Group subjects. - type: string - kind: - description: Kind of object being referenced. Values defined by this - API group are "User", "Group", and "ServiceAccount". If the Authorizer - does not recognized the kind value, the Authorizer should report - an error. - type: string - name: - description: Name of the object being referenced. - type: string - namespace: - description: Namespace of the referenced object. If the object kind - is non-namespace, such as "User" or "Group", and this value is not - empty the Authorizer should report an error. - type: string - required: - - kind - - name - type: object - x-kubernetes-map-type: atomic - userGroupRef: - description: UserGroupRef is the reference to the user group that this - binding binds to. - type: string - required: - - userGroupRef - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.10.0 - creationTimestamp: null - name: usergroups.user.sealos.io -spec: - group: user.sealos.io - names: - kind: UserGroup - listKind: UserGroupList - plural: usergroups - shortNames: - - ug - singular: usergroup - scope: Cluster - versions: - - additionalPrinterColumns: - - jsonPath: .status.phase - name: Phase - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: UserGroup is the Schema for the usergroups API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - status: - description: UserGroupStatus defines the observed state of UserGroup - properties: - conditions: - description: Conditions contains the different condition statuses - for this user group. - items: - properties: - lastHeartbeatTime: - description: LastHeartbeatTime is the last time this condition - was updated. - format: date-time - type: string - lastTransitionTime: - description: LastTransitionTime is the last time the condition - changed from one status to another. - format: date-time - type: string - message: - description: Message is a human-readable message indicating - details about the last status change. - type: string - reason: - description: Reason is a (brief) reason for the condition's - last status change. - type: string - status: - description: Status is the status of the condition. One of True, - False, Unknown. - type: string - type: - type: string - required: - - status - - type - type: object - type: array - observedGeneration: - description: The generation observed by the user controller. - format: int64 - type: integer - phase: - default: Unknown - description: Phase is the recently observed lifecycle phase of user - group - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.10.0 - creationTimestamp: null - name: users.user.sealos.io -spec: - group: user.sealos.io - names: - kind: User - listKind: UserList - plural: users - singular: user - scope: Cluster - versions: - - additionalPrinterColumns: - - jsonPath: .status.phase - name: Phase - type: string - - jsonPath: .status.observedCSRExpirationSeconds - name: ExpirationSeconds - type: integer - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: User is the Schema for the users API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: UserSpec defines the desired state of User - properties: - csrExpirationSeconds: - default: 7200 - description: "expirationSeconds is the requested duration of validity - of the issued certificate. The certificate signer may issue a certificate - with a different validity duration so a client must check the delta - between the notBefore and and notAfter fields in the issued certificate - to determine the actual duration. \n The minimum valid value for - expirationSeconds is 600, i.e. 10 minutes." - format: int32 - type: integer - type: object - status: - description: UserStatus defines the observed state of User - properties: - conditions: - description: Conditions contains the different condition statuses - for this user. - items: - properties: - lastHeartbeatTime: - description: LastHeartbeatTime is the last time this condition - was updated. - format: date-time - type: string - lastTransitionTime: - description: LastTransitionTime is the last time the condition - changed from one status to another. - format: date-time - type: string - message: - description: Message is a human-readable message indicating - details about the last status change. - type: string - reason: - description: Reason is a (brief) reason for the condition's - last status change. - type: string - status: - description: Status is the status of the condition. One of True, - False, Unknown. - type: string - type: - type: string - required: - - status - - type - type: object - type: array - kubeConfig: - type: string - observedCSRExpirationSeconds: - default: 7200 - format: int32 - type: integer - observedGeneration: - description: The generation observed by the user controller. - format: int64 - type: integer - phase: - default: Unknown - description: Phase is the recently observed lifecycle phase of user - type: string - required: - - kubeConfig - type: object - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: user-controller-manager - namespace: user-system ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: user-leader-election-role - namespace: user-system -rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - creationTimestamp: null - name: user-manager-role -rules: -- apiGroups: - - certificates.k8s.io - resources: - - certificatesigningrequests - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - certificates.k8s.io - resources: - - certificatesigningrequests/approval - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - certificates.k8s.io - resources: - - certificatesigningrequests/status - verbs: - - get - - patch - - update -- apiGroups: - - certificates.k8s.io - resourceNames: - - kubernetes.io/kube-apiserver-client - resources: - - signers - verbs: - - approve -- apiGroups: - - "" - resources: - - namespaces - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - secrets - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - secrets/finalizers - verbs: - - update -- apiGroups: - - "" - resources: - - secrets/status - verbs: - - get - - patch - - update -- apiGroups: - - "" - resources: - - serviceaccounts - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - "" - resources: - - serviceaccounts/status - verbs: - - get - - patch - - update -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterrolebindings - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - rbac.authorization.k8s.io - resources: - - rolebindings - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - user.sealos.io - resources: - - accounts - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - user.sealos.io - resources: - - accounts/finalizers - verbs: - - update -- apiGroups: - - user.sealos.io - resources: - - accounts/status - verbs: - - get - - patch - - update -- apiGroups: - - user.sealos.io - resources: - - payments - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - user.sealos.io - resources: - - payments/finalizers - verbs: - - update -- apiGroups: - - user.sealos.io - resources: - - payments/status - verbs: - - get - - patch - - update -- apiGroups: - - user.sealos.io - resources: - - usergroupbindings - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - user.sealos.io - resources: - - usergroupbindings/finalizers - verbs: - - update -- apiGroups: - - user.sealos.io - resources: - - usergroupbindings/status - verbs: - - get - - patch - - update -- apiGroups: - - user.sealos.io - resources: - - usergroups - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - user.sealos.io - resources: - - usergroups/finalizers - verbs: - - update -- apiGroups: - - user.sealos.io - resources: - - usergroups/status - verbs: - - get - - patch - - update -- apiGroups: - - user.sealos.io - resources: - - users - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - user.sealos.io - resources: - - users/finalizers - verbs: - - update -- apiGroups: - - user.sealos.io - resources: - - users/status - verbs: - - get - - patch - - update ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: user-metrics-reader -rules: -- nonResourceURLs: - - /metrics - verbs: - - get ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: user-proxy-role -rules: -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: user-leader-election-rolebinding - namespace: user-system -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: user-leader-election-role -subjects: -- kind: ServiceAccount - name: user-controller-manager - namespace: user-system ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: user-manager-rolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: user-manager-role -subjects: -- kind: ServiceAccount - name: user-controller-manager - namespace: user-system ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: user-proxy-rolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: user-proxy-role -subjects: -- kind: ServiceAccount - name: user-controller-manager - namespace: user-system ---- -apiVersion: v1 -data: - controller_manager_config.yaml: | - apiVersion: controller-runtime.sigs.k8s.io/v1alpha1 - kind: ControllerManagerConfig - health: - healthProbeBindAddress: :8081 - metrics: - bindAddress: 127.0.0.1:8080 - webhook: - port: 9443 - leaderElection: - leaderElect: true - resourceName: 785548a1.sealos.io - # leaderElectionReleaseOnCancel defines if the leader should step down volume - # when the Manager ends. This requires the binary to immediately end when the - # Manager is stopped, otherwise, this setting is unsafe. Setting this significantly - # speeds up voluntary leader transitions as the new leader don't have to wait - # LeaseDuration time first. - # In the default scaffold provided, the program ends immediately after - # the manager stops, so would be fine to enable this option. However, - # if you are doing or is intended to do any operation such as perform cleanups - # after the manager stops then its usage might be unsafe. - # leaderElectionReleaseOnCancel: true -kind: ConfigMap -metadata: - name: user-manager-config - namespace: user-system ---- -apiVersion: v1 -kind: Service -metadata: - labels: - control-plane: controller-manager - name: user-controller-manager-metrics-service - namespace: user-system -spec: - ports: - - name: https - port: 8443 - protocol: TCP - targetPort: https - selector: - control-plane: controller-manager ---- -apiVersion: v1 -kind: Service -metadata: - name: user-webhook-service - namespace: user-system -spec: - ports: - - port: 443 - protocol: TCP - targetPort: 9443 - selector: - control-plane: controller-manager ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - control-plane: controller-manager - name: user-controller-manager - namespace: user-system -spec: - replicas: 3 - selector: - matchLabels: - control-plane: controller-manager - template: - metadata: - annotations: - kubectl.kubernetes.io/default-container: manager - labels: - control-plane: controller-manager - spec: - containers: - - args: - - --health-probe-bind-address=:8081 - - --metrics-bind-address=127.0.0.1:8080 - - --leader-elect - command: - - /manager - env: - - name: CallbackURL - value: '{{ .PaymentCallbackURL }}' - - name: NAMESPACE_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - image: ghcr.io/labring/sealos-user-controller:dev - imagePullPolicy: Always - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 15 - periodSeconds: 20 - name: manager - ports: - - containerPort: 9443 - name: webhook-server - protocol: TCP - readinessProbe: - httpGet: - path: /readyz - port: 8081 - initialDelaySeconds: 5 - periodSeconds: 10 - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 10m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - runAsNonRoot: true - volumeMounts: - - mountPath: /tmp/k8s-webhook-server/serving-certs - name: cert - readOnly: true - - args: - - --secure-listen-address=0.0.0.0:8443 - - --upstream=http://127.0.0.1:8080/ - - --logtostderr=true - - --v=0 - image: gcr.io/kubebuilder/kube-rbac-proxy:v0.13.0 - name: kube-rbac-proxy - ports: - - containerPort: 8443 - name: https - protocol: TCP - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 5m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - runAsNonRoot: true - securityContext: - runAsNonRoot: true - serviceAccountName: user-controller-manager - terminationGracePeriodSeconds: 10 - volumes: - - name: cert - secret: - defaultMode: 420 - secretName: webhook-server-cert ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: user-serving-cert - namespace: user-system -spec: - dnsNames: - - user-webhook-service.user-system.svc - - user-webhook-service.user-system.svc.cluster.local - issuerRef: - kind: Issuer - name: user-selfsigned-issuer - secretName: webhook-server-cert ---- -apiVersion: cert-manager.io/v1 -kind: Issuer -metadata: - name: user-selfsigned-issuer - namespace: user-system -spec: - selfSigned: {} ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: MutatingWebhookConfiguration -metadata: - annotations: - cert-manager.io/inject-ca-from: user-system/user-serving-cert - name: user-mutating-webhook-configuration -webhooks: -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: user-webhook-service - namespace: user-system - path: /mutate-user-sealos-io-v1-user - failurePolicy: Fail - name: muser.kb.io - rules: - - apiGroups: - - user.sealos.io - apiVersions: - - v1 - operations: - - CREATE - - UPDATE - resources: - - users - sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: user-webhook-service - namespace: user-system - path: /mutate-user-sealos-io-v1-usergroup - failurePolicy: Fail - name: musergroup.kb.io - rules: - - apiGroups: - - user.sealos.io - apiVersions: - - v1 - operations: - - CREATE - - UPDATE - resources: - - usergroups - sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: user-webhook-service - namespace: user-system - path: /mutate-user-sealos-io-v1-usergroupbinding - failurePolicy: Fail - name: musergroupbinding.kb.io - rules: - - apiGroups: - - user.sealos.io - apiVersions: - - v1 - operations: - - CREATE - - UPDATE - resources: - - usergroupbindings - sideEffects: None ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: - annotations: - cert-manager.io/inject-ca-from: user-system/user-serving-cert - name: user-validating-webhook-configuration -webhooks: -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: user-webhook-service - namespace: user-system - path: /validate-user-sealos-io-v1-user - failurePolicy: Fail - name: vuser.kb.io - rules: - - apiGroups: - - user.sealos.io - apiVersions: - - v1 - operations: - - CREATE - - UPDATE - resources: - - users - sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: user-webhook-service - namespace: user-system - path: /validate-user-sealos-io-v1-usergroup - failurePolicy: Fail - name: vusergroup.kb.io - rules: - - apiGroups: - - user.sealos.io - apiVersions: - - v1 - operations: - - CREATE - - UPDATE - resources: - - usergroups - sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: user-webhook-service - namespace: user-system - path: /validate-user-sealos-io-v1-usergroupbinding - failurePolicy: Fail - name: vusergroupbinding.kb.io - rules: - - apiGroups: - - user.sealos.io - apiVersions: - - v1 - operations: - - CREATE - - UPDATE - resources: - - usergroupbindings - sideEffects: None diff --git a/controllers/user/main.go b/controllers/user/main.go index 1ecf0d8f2..16abe46f9 100644 --- a/controllers/user/main.go +++ b/controllers/user/main.go @@ -116,7 +116,7 @@ func main() { setupLog.Error(err, "unable to create controller", "controller", "Account") os.Exit(1) } - if os.Getenv(pay.CallbackURL) != "" { + if os.Getenv(pay.AppID) != "" { if err = (&controllers.PaymentReconciler{ Client: mgr.GetClient(), Scheme: mgr.GetScheme(), diff --git a/pkg/pay/wechat_payment.go b/pkg/pay/wechat_payment.go index 5dbe5fa5f..b3f7dac8d 100644 --- a/pkg/pay/wechat_payment.go +++ b/pkg/pay/wechat_payment.go @@ -35,14 +35,12 @@ const ( MchCertificateSerialNumber = "MchCertificateSerialNumber" MchAPIv3Key = "MchAPIv3Key" AppID = "AppID" - CallbackURL = "CallbackURL" + NotifyCallbackURL = "NotifyCallbackURL" StatusSuccess = "SUCCESS" StatusProcessing = "PROCESSING" StatusNotPay = "NOTPAY" StatusFail = "FAILED" - - DefaultCallbackURL = "https://sealos.io/payment/wechat/callback" ) func NewClient(ctx context.Context, opts ...core.ClientOption) (*core.Client, error) { @@ -91,9 +89,6 @@ func WechatPay(amount int64, user, tradeNO, describe, callback string) (string, if tradeNO == "" { return "", fmt.Errorf("generate tradeNO failed") } - if callback == "" { - callback = DefaultCallbackURL - } if describe == "" { describe = "sealos cloud recharge" } diff --git a/service/auth/deploy/Kubefile b/service/auth/deploy/Kubefile index ebca57008..0b68ecc06 100644 --- a/service/auth/deploy/Kubefile +++ b/service/auth/deploy/Kubefile @@ -7,4 +7,4 @@ ENV clientIDEnv="" ENV clientSecretEnv="" ENV kubeconfigEnv="" ENV ssoEndpointEnv="https://login.sealos.io" -CMD ["kubectl apply -f auth-service/deploy.yaml"] +CMD ["kubectl apply -f manifests/auth-service/deploy.yaml"] diff --git a/service/payment/Makefile b/service/payment/Makefile index 88b467896..6d896d9bc 100644 --- a/service/payment/Makefile +++ b/service/payment/Makefile @@ -1,6 +1,6 @@ # Image URL to use all building/pushing image targets -IMG ?= ghcr.io/labring/payment-service:dev +IMG ?= ghcr.io/labring/sealos-payment-service:dev # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set) ifeq (,$(shell go env GOBIN)) diff --git a/service/payment/README.md b/service/payment/README.md index 2929ba142..04d9c78f0 100644 --- a/service/payment/README.md +++ b/service/payment/README.md @@ -8,9 +8,8 @@ Set those envs, then start the server `go run main.go` MchCertificateSerialNumber = "MchCertificateSerialNumber" MchAPIv3Key = "MchAPIv3Key" AppID = "AppID" - CallbackURL = "CallbackURL" + NotifyCallbackURL = "CallbackURL" - DefaultCallbackURL = "https://sealos.io/payment/wechat/callback" ``` # Get payment code-url @@ -36,4 +35,4 @@ go run main.go recharge --user fanux --amount 1 Use WeChat to scan the QR code below to recharge, please make sure the username and amount are correct User: fanux Amount: 1 -``` \ No newline at end of file +``` diff --git a/service/payment/api/api.go b/service/payment/api/api.go index ed1a103f2..5f32aa544 100644 --- a/service/payment/api/api.go +++ b/service/payment/api/api.go @@ -72,7 +72,7 @@ func (u Payment) getCodeURL(request *restful.Request, response *restful.Response return } - codeURL, err := pay.WechatPay(int64(a), user, "", "", os.Getenv(pay.CallbackURL)) + codeURL, err := pay.WechatPay(int64(a), user, "", "", os.Getenv(pay.NotifyCallbackURL)) if err != nil { _ = response.WriteErrorString(http.StatusInternalServerError, fmt.Sprintf("payment error : %v", err)) return diff --git a/webhooks/whitelist/deploy/Dockerfile b/webhooks/whitelist/deploy/Dockerfile index 1fea19bb0..beb947024 100644 --- a/webhooks/whitelist/deploy/Dockerfile +++ b/webhooks/whitelist/deploy/Dockerfile @@ -1,6 +1,6 @@ FROM scratch USER 65532:65532 - +COPY registry ./registry COPY manifests ./whitelist-webhook CMD ["kubectl apply -f whitelist-webhook/deploy.yaml"]