operator: Support trusted_cluster resources #49920
Conversation
This supersedes UpsertTrustedCluster rpc. V2 performs resource name validation.
- Remove unnecessary ping - Update error messages - Use skipNameValidation consts - Validate cluster name before establishing trust - Do not reveal cluster name in error message - Use BadParameter instead of CompareFailed
1. Run `make manifests`. 2. Run `make -C crdgen update-protos`. 3. Run `make -C crdgen update-snapshot`.
github-actions
bot
requested review from
marcoandredinis,
mmcallister,
ptgott,
r0mant,
tigrato,
xinding33 and
zmb3
|
🤖 Vercel preview here: https://docs-9489cues6-goteleport.vercel.app/docs |
|
🤖 Vercel preview here: https://docs-bp1r7r3xa-goteleport.vercel.app/docs |
|
🤖 Vercel preview here: https://docs-3fqm1fpmj-goteleport.vercel.app/docs |
bernardjkim
temporarily deployed
to
docs-amplify
GitHub Actions
Inactive
|
@bernardjkim - this PR will require admin approval to merge due to its size. Consider breaking it up into a series smaller changes. |
|
Amplify deployment status
|
|
Hey @rosstimothy, would appreciate an admin approval if you have some time. |
integrations/operator/apis/resources/v1/trusted_cluster_types.go
Outdated
Show resolved
Hide resolved
| @@ -47,6 +47,7 @@ func SetupAllControllers(log logr.Logger, mgr manager.Manager, teleportClient *c | |||
| {"TeleportProvisionToken", NewProvisionTokenReconciler}, | |||
| {"TeleportOpenSSHServerV2", NewOpenSSHServerV2Reconciler}, | |||
| {"TeleportOpenSSHEICEServerV2", NewOpenSSHEICEServerV2Reconciler}, | |||
| {"TeleportTrustedClusterV2", NewTrustedClusterV2Reconciler}, | |||
There was a problem hiding this comment.
Did the operator have a V1 for TrustedClusters? If not can we drop the V2 here and everywhere else in this PR?
There was a problem hiding this comment.
Since v16, new CR/CRDs reflect the resource version in their kind/name. This is reqiured to cope with Teleport resource versioning strategy. Existing resources have not been migrated yet.
There was a problem hiding this comment.
Is this documented anywhere or tribal knowledge?
There was a problem hiding this comment.
This is described in RFD 160: https://github.com/gravitational/teleport/blob/master/rfd/0160-kubernetes-operator-resource-versioning.md
| // TeleportTrustedClusterV2 is the Schema for the trusted_clusters API | ||
| type TeleportTrustedClusterV2 struct { |
There was a problem hiding this comment.
Why do we need the V2 suffix?
There was a problem hiding this comment.
bernardjkim
temporarily deployed
to
docs-amplify
GitHub Actions
Inactive
bernardjkim
temporarily deployed
to
docs-amplify
GitHub Actions
Inactive
Supports #22474
Requires #49789
Todo: Write up guide for managing trusted_clusters with the teleport operatorChangelog: Add trusted_cluster support for the teleport operator.