From a8671ffaafeffc41f1ae1c883270a47fb214e118 Mon Sep 17 00:00:00 2001 From: Frikky Date: Wed, 24 Apr 2024 16:34:33 +0200 Subject: [PATCH] Bumped worker to use specific permissions --- functions/onprem/orborus/go.mod | 4 ++- functions/onprem/orborus/orborus.go | 45 ++++++++++----------------- functions/onprem/orborus/orborus.yaml | 2 +- functions/onprem/worker/worker.go | 38 ++++++++++++---------- 4 files changed, 41 insertions(+), 48 deletions(-) diff --git a/functions/onprem/orborus/go.mod b/functions/onprem/orborus/go.mod index 2e1a4551..30e0deca 100644 --- a/functions/onprem/orborus/go.mod +++ b/functions/onprem/orborus/go.mod @@ -1,6 +1,8 @@ module orborus -go 1.22 +go 1.22.0 + +toolchain go1.22.2 require ( github.com/docker/docker v26.1.0+incompatible diff --git a/functions/onprem/orborus/orborus.go b/functions/onprem/orborus/orborus.go index ff0e68c5..74109e92 100755 --- a/functions/onprem/orborus/orborus.go +++ b/functions/onprem/orborus/orborus.go @@ -687,7 +687,6 @@ func deployWorker(image string, identifier string, env []string, executionReques return err } - log.Printf("CONFIG: %s", config.String()) env = append(env, fmt.Sprintf("KUBERNETES_CONFIG=%s", config.String())) // Look for if there is a default service account in use @@ -698,22 +697,6 @@ func deployWorker(image string, identifier string, env []string, executionReques // use k8s downward API to find it if we are in a pod } - serviceAccounts, err := clientset.CoreV1().ServiceAccounts(kubernetesNamespace).List(context.Background(), metav1.ListOptions{}) - if err != nil { - log.Printf("[ERROR] Failed to list service accounts: %s", err) - } else { - log.Printf("[DEBUG] Found %d service accounts", len(serviceAccounts.Items)) - for _, serviceAccount := range serviceAccounts.Items { - log.Printf("[DEBUG] Service account: %s", serviceAccount.Name) - } - } - - for _, envVar := range os.Environ() { - if strings.Contains(strings.ToLower(envVar), "kubernetes") || strings.Contains(strings.ToLower(envVar), "k8s") { - log.Printf("[DEBUG] K8s var: %s", envVar) - } - } - // Check if namespace exist as variable. If so, make it if len(os.Getenv("KUBERNETES_NAMESPACE")) > 0 && !namespacemade { kubernetesNamespace = os.Getenv("KUBERNETES_NAMESPACE") @@ -968,24 +951,24 @@ func initializeImages() { if appSdkVersion == "" { appSdkVersion = "latest" - log.Printf("[WARNING] SHUFFLE_APP_SDK_VERSION not defined. Defaulting to %s", appSdkVersion) + log.Printf("[WARNING] SHUFFLE_APP_SDK_VERSION not defined. Defaulting to %#v", appSdkVersion) } if workerVersion == "" { workerVersion = "latest" - log.Printf("[WARNING] SHUFFLE_WORKER_VERSION not defined. Defaulting to %s", workerVersion) + log.Printf("[WARNING] SHUFFLE_WORKER_VERSION not defined. Defaulting to %#v", workerVersion) } if baseimageregistry == "" { baseimageregistry = "docker.io" // Dockerhub baseimageregistry = "ghcr.io" // Github - log.Printf("[DEBUG] Setting baseimageregistry") + log.Printf("[DEBUG] Setting baseimageregistry to %#v", baseimageregistry) } if baseimagename == "" { baseimagename = "frikky/shuffle" // Dockerhub baseimagename = "shuffle" // Github (ghcr.io) - log.Printf("[DEBUG] Setting baseimagename") + log.Printf("[DEBUG] Setting baseimagename to %#v", baseimagename) } log.Printf("[DEBUG] Setting swarm config to %#v. Default is empty.", swarmConfig) @@ -1005,16 +988,20 @@ func initializeImages() { pullOptions := types.ImagePullOptions{} for _, image := range images { - log.Printf("[DEBUG] Pulling image %s", image) - reader, err := dockercli.ImagePull(ctx, image, pullOptions) - if err != nil { - log.Printf("[ERROR] Failed getting image %s: %s", image, err) + if isKubernetes == "true" { + log.Printf("[DEBUG] Skipping image pull of '%s' because Kubernetes does it in realtime instead", image) + } else { + log.Printf("[DEBUG] Pulling image %s", image) + reader, err := dockercli.ImagePull(ctx, image, pullOptions) + if err != nil { + log.Printf("[ERROR] Failed getting image %s: %s", image, err) - continue + continue + } + + io.Copy(os.Stdout, reader) + log.Printf("[DEBUG] Successfully downloaded and built %s", image) } - - io.Copy(os.Stdout, reader) - log.Printf("[DEBUG] Successfully downloaded and built %s", image) } } diff --git a/functions/onprem/orborus/orborus.yaml b/functions/onprem/orborus/orborus.yaml index 36ac49e8..0ff50ef7 100644 --- a/functions/onprem/orborus/orborus.yaml +++ b/functions/onprem/orborus/orborus.yaml @@ -75,7 +75,7 @@ spec: value: "ghcr.io/shuffle/shuffle-worker:nightly" image: ghcr.io/shuffle/shuffle-orborus:nightly - #imagePullPolicy: Never + imagePullPolicy: Always name: shuffle-orborus resources: {} hostname: shuffle-orborus diff --git a/functions/onprem/worker/worker.go b/functions/onprem/worker/worker.go index 2367e187..87780f2b 100644 --- a/functions/onprem/worker/worker.go +++ b/functions/onprem/worker/worker.go @@ -1901,29 +1901,33 @@ func buildEnvVars(envMap map[string]string) []corev1.EnvVar { } func getKubernetesClient() (*kubernetes.Clientset, error) { - kubeconfigContent := os.Getenv("KUBECONFIG_CONTENT") + + // Gets the config content from Orborus. + kubeconfigContent := os.Getenv("KUBERNETES_CONFIG") if len(kubeconfigContent) > 0 { log.Printf("[INFO] Using KUBERNETES_CONFIG to set up Kubernetes client: %#v", os.Getenv("KUBERNETES_CONFIG")) config, err := rest.InClusterConfig() if err != nil { - return nil, err + log.Printf("[ERROR] Failed to create Kubernetes client from in-cluster config: %s", err) + } else { + // Replace client configuration with kubeconfig content + config, err = clientcmd.RESTConfigFromKubeConfig([]byte(kubeconfigContent)) + if err != nil { + log.Printf("[ERROR] Failed to create Kubernetes client from KUBERNETES_CONFIG: %s", err) + } else { + // Create Kubernetes client + clientset, err := kubernetes.NewForConfig(config) + if err != nil { + return nil, err + } + + return clientset, nil + } } + } - // Replace client configuration with kubeconfig content - config, err = clientcmd.RESTConfigFromKubeConfig([]byte(kubeconfigContent)) - if err != nil { - return nil, err - } - - // Create Kubernetes client - clientset, err := kubernetes.NewForConfig(config) - if err != nil { - return nil, err - } - - return clientset, nil - - } else if isRunningInCluster() { + // Fallback + if isRunningInCluster() { config, err := rest.InClusterConfig() if err != nil { return nil, err