Skip to content

✨ Ensure ExtensionConfig controller can be used outside of the core provider #12754

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 12, 2025
Merged

✨ Ensure ExtensionConfig controller can be used outside of the core provider #12754

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 13 additions & 9 deletions controllers/alias.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -303,19 +303,23 @@ func (r *MachinePoolReconciler) SetupWithManager(ctx context.Context, mgr ctrl.M

// ExtensionConfigReconciler reconciles an ExtensionConfig object.
type ExtensionConfigReconciler struct {
Client client.Client
APIReader client.Reader
RuntimeClient runtimeclient.Client
Client client.Client
APIReader client.Reader
RuntimeClient runtimeclient.Client
PartialSecretCache cache.Cache
ReadOnly bool

// WatchFilterValue is the label value used to filter events prior to reconciliation.
WatchFilterValue string
}

func (r *ExtensionConfigReconciler) SetupWithManager(ctx context.Context, mgr ctrl.Manager, options controller.Options, partialSecretCache cache.Cache) error {
func (r *ExtensionConfigReconciler) SetupWithManager(ctx context.Context, mgr ctrl.Manager, options controller.Options) error {
return (&extensionconfigcontroller.Reconciler{
Client: r.Client,
APIReader: r.APIReader,
RuntimeClient: r.RuntimeClient,
WatchFilterValue: r.WatchFilterValue,
}).SetupWithManager(ctx, mgr, options, partialSecretCache)
Client: r.Client,
APIReader: r.APIReader,
RuntimeClient: r.RuntimeClient,
PartialSecretCache: r.PartialSecretCache,
ReadOnly: r.ReadOnly,
WatchFilterValue: r.WatchFilterValue,
}).SetupWithManager(ctx, mgr, options)
}
16 changes: 16 additions & 0 deletions controlplane/kubeadm/config/rbac/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,14 @@ rules:
verbs:
- create
- patch
- apiGroups:
- ""
resources:
- namespaces
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
Expand Down Expand Up @@ -90,3 +98,11 @@ rules:
- patch
- update
- watch
- apiGroups:
- runtime.cluster.x-k8s.io
resources:
- extensionconfigs
verbs:
- get
- list
- watch
48 changes: 48 additions & 0 deletions controlplane/kubeadm/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,22 +56,30 @@ import (
controlplanev1beta1 "sigs.k8s.io/cluster-api/api/controlplane/kubeadm/v1beta1"
controlplanev1 "sigs.k8s.io/cluster-api/api/controlplane/kubeadm/v1beta2"
clusterv1 "sigs.k8s.io/cluster-api/api/core/v1beta2"
runtimehooksv1 "sigs.k8s.io/cluster-api/api/runtime/hooks/v1alpha1"
runtimev1 "sigs.k8s.io/cluster-api/api/runtime/v1beta2"
"sigs.k8s.io/cluster-api/controllers"
"sigs.k8s.io/cluster-api/controllers/clustercache"
"sigs.k8s.io/cluster-api/controllers/crdmigrator"
"sigs.k8s.io/cluster-api/controllers/remote"
kubeadmcontrolplanecontrollers "sigs.k8s.io/cluster-api/controlplane/kubeadm/controllers"
"sigs.k8s.io/cluster-api/controlplane/kubeadm/internal/etcd"
kcpwebhooks "sigs.k8s.io/cluster-api/controlplane/kubeadm/webhooks"
runtimecatalog "sigs.k8s.io/cluster-api/exp/runtime/catalog"
runtimeclient "sigs.k8s.io/cluster-api/exp/runtime/client"
"sigs.k8s.io/cluster-api/feature"
controlplanev1alpha3 "sigs.k8s.io/cluster-api/internal/api/controlplane/kubeadm/v1alpha3"
controlplanev1alpha4 "sigs.k8s.io/cluster-api/internal/api/controlplane/kubeadm/v1alpha4"
"sigs.k8s.io/cluster-api/internal/contract"
internalruntimeclient "sigs.k8s.io/cluster-api/internal/runtime/client"
runtimeregistry "sigs.k8s.io/cluster-api/internal/runtime/registry"
"sigs.k8s.io/cluster-api/util/apiwarnings"
"sigs.k8s.io/cluster-api/util/flags"
"sigs.k8s.io/cluster-api/version"
)

var (
catalog = runtimecatalog.New()
scheme = runtime.NewScheme()
setupLog = ctrl.Log.WithName("setup")
controllerName = "cluster-api-kubeadm-control-plane-manager"
Expand All @@ -94,6 +102,8 @@ var (
webhookCertDir string
webhookCertName string
webhookKeyName string
runtimeExtensionCertFile string
runtimeExtensionKeyFile string
healthAddr string
managerOptions = flags.ManagerOptions{}
logOptions = logs.NewOptions()
Expand All @@ -116,6 +126,10 @@ func init() {
_ = controlplanev1.AddToScheme(scheme)
_ = bootstrapv1.AddToScheme(scheme)
_ = apiextensionsv1.AddToScheme(scheme)
_ = runtimev1.AddToScheme(scheme)

// Register the RuntimeHook types into the catalog.
_ = runtimehooksv1.AddToCatalog(catalog)
}

// InitFlags initializes the flags.
Expand Down Expand Up @@ -186,6 +200,12 @@ func InitFlags(fs *pflag.FlagSet) {
fs.StringVar(&webhookKeyName, "webhook-key-name", "tls.key",
"Webhook key name.")

fs.StringVar(&runtimeExtensionCertFile, "runtime-extension-client-cert-file", "",
"Path of the PEM-encoded client certificate to be used when calling runtime extensions.")

fs.StringVar(&runtimeExtensionKeyFile, "runtime-extension-client-key-file", "",
"Path of the PEM-encoded client key to be used when calling runtime extensions.")

fs.StringVar(&healthAddr, "health-addr", ":9440",
"The address the health endpoint binds to.")

Expand All @@ -209,6 +229,9 @@ func InitFlags(fs *pflag.FlagSet) {
// ADD CRD RBAC for CRD Migrator.
// +kubebuilder:rbac:groups=apiextensions.k8s.io,resources=customresourcedefinitions,verbs=get;list;watch
// +kubebuilder:rbac:groups=apiextensions.k8s.io,resources=customresourcedefinitions;customresourcedefinitions/status,verbs=update;patch,resourceNames=kubeadmcontrolplanes.controlplane.cluster.x-k8s.io;kubeadmcontrolplanetemplates.controlplane.cluster.x-k8s.io
// Add RBAC for ExtensionConfig controller and runtime client (intentionally does not include write permissions)
// +kubebuilder:rbac:groups=runtime.cluster.x-k8s.io,resources=extensionconfigs,verbs=get;list;watch
// +kubebuilder:rbac:groups="",resources=namespaces,verbs=get;list;watch

func main() {
InitFlags(pflag.CommandLine)
Expand Down Expand Up @@ -437,6 +460,30 @@ func setupReconcilers(ctx context.Context, mgr ctrl.Manager) {
setupLog.Error(err, "unable to create etcd logger")
os.Exit(1)
}

var runtimeClient runtimeclient.Client
if feature.Gates.Enabled(feature.InPlaceUpdates) {
// This is the creation of the runtimeClient for the controllers, embedding a shared catalog and registry instance.
runtimeClient = internalruntimeclient.New(internalruntimeclient.Options{
CertFile: runtimeExtensionCertFile,
KeyFile: runtimeExtensionKeyFile,
Catalog: catalog,
Registry: runtimeregistry.New(),
Client: mgr.GetClient(),
})

if err = (&controllers.ExtensionConfigReconciler{
Client: mgr.GetClient(),
APIReader: mgr.GetAPIReader(),
RuntimeClient: runtimeClient,
ReadOnly: true,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we want to have a way to prevent multiple instances of ExtensionConfig reconciler with write permissions to be created?

Copy link
Member Author

@sbueringer sbueringer Sep 11, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure how we can do this considering that these are separate binaries
(so I'm okay with the current state)

WatchFilterValue: watchFilterValue,
}).SetupWithManager(ctx, mgr, concurrency(10)); err != nil {
setupLog.Error(err, "Unable to create controller", "controller", "ExtensionConfig")
os.Exit(1)
}
}

if err := (&kubeadmcontrolplanecontrollers.KubeadmControlPlaneReconciler{
Client: mgr.GetClient(),
SecretCachingClient: secretCachingClient,
Expand All @@ -446,6 +493,7 @@ func setupReconcilers(ctx context.Context, mgr ctrl.Manager) {
EtcdCallTimeout: etcdCallTimeout,
EtcdLogger: etcdLogger,
RemoteConditionsGracePeriod: remoteConditionsGracePeriod,
//RuntimeClient: runtimeClient, // TODO(in-place): enable once we want to use it, also validate in SetupWithManager that RuntimeClient is set if feature gate is enabled.
}).SetupWithManager(ctx, mgr, concurrency(kubeadmControlPlaneConcurrency)); err != nil {
setupLog.Error(err, "unable to create controller", "controller", "KubeadmControlPlane")
os.Exit(1)
Expand Down
Loading