90 Commits

Author SHA1 Message Date
daseul cho
88e08fa0ec fix(soot): correct TenantControlPlane name in trigger events (#1040) 2025-12-22 07:03:17 +01:00
Léonard Suslian
d3fb03a752 feat: add support for multiple Datastores (#961)
* feat: add support for multiple Datastores

* docs: add guide for datastore overrides

* feat(datastore): add e2e test for dataStoreOverrides

* ci: reclaim disk space from runner to fix flaky tests
2025-12-12 12:10:02 +01:00
Alfredo Suarez
880b36e0fa feat: gateway api support (#1000)
* Feat: Gateway Routes Specs, plus resource and status init progress

* Generated content, RBAC and start of e2e

* latest code POC Working but e2e fails

* Use Gateway API v1.2.0

* Remove draft comment

* Use TCPRoute

* Revert the charts folder to reduce noise

* Use the correct controller-gen version

* Rename fields and fix tcp/tls typos

* Rename TLSRouteSpec to GatewayRouteSpec

* Remove last instance of tcproute

* Renaming more fields to match the gateway api naming

* Remove ownership of the gateway

* Revert Ko to 0.14.1 and makefile comments

* service discovery, webhooks, and deadcode removal.

* add conditional check for gateway api resources and mark is as owned!

* removing duplicated code and note for maybe a refactor later

* E2E now works!

* e2e suite modifications to support Gateway API v1alpha2 TLSRoute

* Suggestions commit, naming and other related.

* First pass at the status update

* Rename route to gateway

* Only allow one hostname in gateway

* Update status types

* WIP: testing conditions

* Update status API

* Add tests

* Detect endpoint

* Update manifests

* Remove old code and use proper condition check

* Fix compilation error

* Watch the Gateway resources

* Rename fields

* Add missing port

* Add ingress endpoint to the kubeadm

* Error if access points are empty

* Check the spec and status to delay the creation of the kubeadm

* Use the spec for the hostname

* Update api/v1alpha1/tenantcontrolplane_types.go

Co-authored-by: Dario Tranchitella <dario@tranchitella.eu>

* PR fixes, CEL k8s validations, proper status updates checks

* more context and separation of functions

* resolve all pr comments, with indexer

* merge master - go {sum,mod} updates dependabot

* Feat: Gateway Routes Specs, plus resource and status init progress

* Use Gateway API v1.2.0

* merge master - go {sum,mod} updates dependabot

* sum go mod tidy

* leftover comments

* clean go.sum

* fix: missing generated crds spec

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* docs: gateway api support

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* golint comments

* linting and test fix.

* Gateway API resource watching was made conditional to prevent crashes when CRDs are absent, and TLSRoute creation now returns an error when the service isn't ready instead of creating invalid resources with empty rules.

* unit test was incorrect after all the fixes we did, gracefull errors are not expected due to conditional adds

* fix(conditional-indexer): Gateway Indexer should also be conditional

* fix(conditional-indexer): Gateway Indexer should also be conditional

---------

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
Co-authored-by: Hadrien Kohl <hadrien.kohl@gmail.com>
Co-authored-by: Dario Tranchitella <dario@tranchitella.eu>
2025-11-26 10:34:09 +01:00
Dario Tranchitella
de459fb5da feat!: write permissions (#937)
* fix: decoding object only if requested

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* feat(api): limiting write permissions

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* feat: write permissions handlers, routes, and controller

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* docs: write permissions

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

---------

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2025-10-03 14:30:58 +02:00
Dario Tranchitella
cb2152d5a7 feat: kubeconfig generator (#933)
* feat(api): kubeconfig generator

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* refactor: abstracting enqueue to channel function

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* fix: avoiding multiple context registration

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* feat: kubeconfig generator

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* docs: kubeconfig generator

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* feat(helm): deployment for kubeconfig generator

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

---------

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2025-09-22 15:32:50 +02:00
Dario Tranchitella
1a0858d350 fix: konnectivity logs and nil pointer dereference (#951)
* fix(konnectivity): avoiding nil pointer reconcile for agent

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* fix(log): ignoring not found errors for konnectivity cleanup

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

---------

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2025-09-07 11:02:44 +02:00
Dario Tranchitella
5e68fd8fe0 fix: honouring certificate expiratin threshold (#886)
Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2025-07-28 09:40:16 +02:00
Dario Tranchitella
cac1631523 feat: rotating certificates via annotation (#877)
* fix(kubeconfig): checking certificate authority data for validity

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* feat: rotating certificates via annotation

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* docs: rotating certificates via annotation

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

---------

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2025-07-21 09:23:29 +02:00
Dario Tranchitella
e366dc3959 feat: pausing reconciliation of controlled objects (#874)
* feat: pausing reconciliation of controlled objects

Objects such as TenantControlPlane and Secret can be annotated with
kamaji.clastix.io/paused to prevent controllers from processing them.

This will stop reconciling objects for debugging or other purposes.
Annotation value is irrelevant, just the key presence is evaluated.

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* docs: pausing reconciliation of controlled objects

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* chore(logs): typo for deleted resources

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

---------

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2025-07-16 10:44:48 +02:00
Dario Tranchitella
ce8d5f2516 refactor: requeue deprecated, migrating to requeue after (#837)
Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2025-06-10 17:27:45 +02:00
Dario Tranchitella
b027e23b99 feat: enhancing concurrent reconciliations (#790)
* feat: buffered channels for generic events

Channels used for GenericEvent feeding for cross controllers triggers
are now buffered according to the --max-concurrent-tcp-reconciles: this
is required to avoid channel full errors when dealing with large
management clusters serving a sizeable amount of Tenant Control Planes.

Increasing this value will put more pressure on memory (mostly for GC)
and CPU (provisioning multiple certificates at the same time).

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* refactor: retrying datastore status update

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* feat(performance): reducing memory consumption for channel triggers

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* feat(datastore): reconcile events only for root object changes

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* feat: waiting soot manager exit before termination

This change introduces a grace period of 10 seconds before abruptly
terminating the Tenant Control Plane deployment, allowing the soot
manager to complete its exit procedure and avoid false positive errors
due to API Server being unresponsive due to user deletion.

Aim of this change is reducing the amount of false positive errors upon
mass deletion of Tenant COntrol Plane objects.

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* refactor: unbuffered channel with timeout

WatchesRawSource is non blocking, no need to check if channel is full.
To prevent deadlocks a WithTimeout check has been introduced.

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

---------

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2025-04-23 21:00:29 +02:00
Dario Tranchitella
7c785726d9 refactor: consolidating struct members for soot controllers (#791)
Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2025-04-17 22:36:39 +02:00
Dario Tranchitella
b68010e072 feat!: introducing sleeping status (#773)
* feat(api): introducing sleeping status

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* chore(helm)!: introducing sleeping status

Marking this commit as breaking since a CustomResourceDefinition update
is required for users dealing with scale to zero since the introduction
of the new enum for the status field.

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* docs: introducing sleeping status

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

---------

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2025-04-07 16:44:13 +02:00
Mario Valderrama
dc18f27948 fix: stop watches when TCP is scaled to zero (#771) 2025-04-07 11:19:12 +02:00
Mario Valderrama
94a64d1f75 fix: prevent unnecessary copy in loop (#769) 2025-04-07 10:50:52 +02:00
Dario Tranchitella
dd099e750f fix(soot): triggering cleanup for failed soot manager (#761)
* fix(soot): triggering cleanup for failed soot manager

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* fix: logging blocked channels

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

---------

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2025-03-31 18:53:58 +02:00
Dario Tranchitella
1d72802abd refactor: avoid logging error and sentinel for status (#673)
Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2025-01-22 11:08:01 +01:00
Dario Tranchitella
2b17282b0e chore(go): bumping up to go1.23 (#643)
* chore(go): bumping up to go1.23

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* chore(golangci-lint): bumping up to v1.62.2

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

---------

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2024-12-01 16:09:26 +01:00
Dario Tranchitella
0c0111094e feat: making default datastore optional (#597)
* feat: making default datastore optional

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* feat(helm): making default datastore optional

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* docs: making default datastore optional

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

---------

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2024-10-30 20:23:34 +01:00
Dario Tranchitella
12248dea3d feat: dynamic certificate expiration deadline (#615)
* feat: dynamic certificate expiration deadline

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* docs: dynamic certificate expiration deadline

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

---------

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2024-10-25 19:49:21 +02:00
Dario Tranchitella
66d96a138d feat(deps): bump sigs.k8s.io/controller-runtime from 0.18.5 to 0.19.0 (#551)
* feat(deps): bump sigs.k8s.io/controller-runtime from 0.18.5 to 0.19.0

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* feat: bumping up k8s supported version to v1.30.0

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* feat(deps): aligning code to controlle-runtime v0.19.0

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* docs: clastix subscription plans info

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* chore: bumping up controller-gen to v0.16.1

* chore(kustomize): updating manifests for k8s v1.31.0 support

* chore(helm): updating manifests for k8s v1.31.0 support

* docs(api): updating api for k8s v1.31.0 support

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* fix(test): worker nodes join support from v1.29 onwards

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

* chore(ci): disabling swap

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

---------

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2024-08-20 17:37:18 +02:00
Dario Tranchitella
91cbf0c507 feat: telemetry
Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2024-06-27 11:38:41 +02:00
Dario Tranchitella
d57d5b5a56 feat(deps): bumping up sigs.k8s.io/controller-runtime to v0.18.4
Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2024-06-27 11:38:41 +02:00
Dario Tranchitella
d1910cd389 fix(nats): blocking reconciliation for missing multi-tenancy
Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2024-05-09 16:55:01 +02:00
Mathieu Cesbron
eff68db336 fix(certificate_lifecycle_controller): blocking reconciliation in case of error
Signed-off-by: Mathieu Cesbron <mathieu.cesbron@protonmail.com>
2024-02-26 21:27:17 +01:00
Dario Tranchitella
755cc5bacd refactor(golangci-lint): aligning to new linters
Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2023-12-15 13:02:49 +01:00
Dario Tranchitella
e0c86d685c feat: support for kubeadm cluster-admins rbac
Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2023-12-15 13:02:49 +01:00
Dario Tranchitella
ddb700f4f0 refactor: upgrading to new dependencies
Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
2023-12-15 13:02:49 +01:00
Dario Tranchitella
0f1a4f28de fix: blocking datastore secret deletion with finalizer 2023-09-29 10:56:28 +02:00
Dario Tranchitella
05cbff1fd8 docs: kubeconfig and certificates rotation 2023-08-03 18:03:54 +02:00
Dario Tranchitella
7e94ecdbab feat: kubeconfig and certificates rotation 2023-08-03 18:03:54 +02:00
Dario Tranchitella
f831f385c4 feat(cli): controller reconcile timeout flag with 30s default value 2023-08-01 13:51:09 +02:00
Dario Tranchitella
14c96b034a refactor(builder): abstracting deployment builders 2023-06-05 17:03:35 +02:00
Matteo Ruina
d06affc216 feat: tcp deployment mangling 2023-05-30 16:00:11 +02:00
Dario Tranchitella
4110b688c9 feat: configurable max concurrent tcp reconciles 2023-02-06 22:12:50 +01:00
Dario Tranchitella
830d86a38a feat: introducing enqueueback reconciliation status
Required for the changes introduced with 74f7157e8bf1081171aff48bc36de9af231597fb
2023-02-06 22:12:50 +01:00
Dario Tranchitella
44d1f3fa7f refactor: updating local tcp instance to avoid 2nd retrieval 2023-02-06 22:12:50 +01:00
Dario Tranchitella
2293e49e4b fix: certificate authority rotation handling 2023-01-13 19:09:03 +01:00
Dario Tranchitella
7ed3c44401 refactor(datastore): using webhooks for secrets instead of finalizers 2022-12-20 20:54:41 +01:00
Dario Tranchitella
b9cda29461 fix(migrate): allowing leases updates during migration 2022-12-20 20:45:09 +01:00
Dario Tranchitella
c6abe03fd1 fix(soot): typo on params for service name and namespace 2022-12-19 10:44:39 +01:00
Dario Tranchitella
18c60461e5 refactor: conforming finalizers management 2022-12-16 22:44:42 +01:00
Dario Tranchitella
ceab662671 feat(soot): using finalizer for clean-up 2022-12-16 22:44:42 +01:00
Dario Tranchitella
d38098a57e fix(soot): ensure that manager is stopped upon tcp deletion 2022-12-16 22:44:42 +01:00
Dario Tranchitella
017a50b8f6 fix(soot): ensuring manager to restart upon tcp pod restart 2022-12-16 22:44:42 +01:00
Dario Tranchitella
b880cff8d7 fix: missing datastore finalizer rbac 2022-12-15 15:50:30 +01:00
Dario Tranchitella
3f7fa08871 refactor: removing unused scheme 2022-12-15 15:50:30 +01:00
Dario Tranchitella
e83c34776b refactor(soot): creating channel source during controller setup 2022-12-14 21:23:47 +01:00
Dario Tranchitella
938341a2e7 refactor(log): uniforming log for soot controllers 2022-12-14 21:23:47 +01:00
Dario Tranchitella
3ea721cf2b feat(kubeadm): moving phases to soot manager 2022-12-14 21:23:47 +01:00