🚧 AccessService resource/controller

PROJECT

@@ -30,4 +30,13 @@ resources:
   kind: ClusterTunnel
   path: github.com/adyanth/cloudflare-operator/api/v1alpha1
   version: v1alpha1
+- api:
+    crdVersion: v1
+    namespaced: true
+  controller: true
+  domain: cfargotunnel.com
+  group: networking
+  kind: AccessService
+  path: github.com/adyanth/cloudflare-operator/api/v1alpha1
+  version: v1alpha1
 version: "3"

api/v1alpha1/accessservice_types.go

@@ -0,0 +1,64 @@
+/*
+Copyright 2022.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
+// NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.
+
+// AccessServiceSpec defines the desired state of AccessService
+type AccessServiceSpec struct {
+	// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
+	// Important: Run "make" to regenerate code after modifying this file
+
+	// Foo is an example field of AccessService. Edit accessservice_types.go to remove/update
+	Foo string `json:"foo,omitempty"`
+}
+
+// AccessServiceStatus defines the observed state of AccessService
+type AccessServiceStatus struct {
+	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
+	// Important: Run "make" to regenerate code after modifying this file
+}
+
+//+kubebuilder:object:root=true
+//+kubebuilder:subresource:status
+
+// AccessService is the Schema for the accessservices API
+type AccessService struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   AccessServiceSpec   `json:"spec,omitempty"`
+	Status AccessServiceStatus `json:"status,omitempty"`
+}
+
+//+kubebuilder:object:root=true
+
+// AccessServiceList contains a list of AccessService
+type AccessServiceList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []AccessService `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&AccessService{}, &AccessServiceList{})
+}

config/crd/kustomization.yaml

@@ -5,6 +5,7 @@ resources:
 - bases/networking.cfargotunnel.com_tunnels.yaml
 - bases/networking.cfargotunnel.com_clustertunnels.yaml
 - bases/networking.cfargotunnel.com_tunnelbindings.yaml
+- bases/networking.cfargotunnel.com_accessservices.yaml
 #+kubebuilder:scaffold:crdkustomizeresource
 
 patchesStrategicMerge:
@@ -13,13 +14,15 @@ patchesStrategicMerge:
 #- patches/webhook_in_tunnels.yaml
 #- patches/webhook_in_clustertunnels.yaml
 #- patches/webhook_in_tunnelbindings.yaml
+#- patches/webhook_in_accessservices.yaml
 #+kubebuilder:scaffold:crdkustomizewebhookpatch
 
 # [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
 # patches here are for enabling the CA injection for each CRD
 #- patches/cainjection_in_tunnels.yaml
 #- patches/cainjection_in_clustertunnels.yaml
 #- patches/cainjection_in_tunnelbindings.yaml
+#- patches/cainjection_in_accessservices.yaml
 #+kubebuilder:scaffold:crdkustomizecainjectionpatch
 
 # the following config is for teaching kustomize how to do kustomization for CRDs.

config/crd/patches/cainjection_in_accessservices.yaml

@@ -0,0 +1,7 @@
+# The following patch adds a directive for certmanager to inject CA into the CRD
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
+  name: accessservices.networking.cfargotunnel.com

config/crd/patches/webhook_in_accessservices.yaml

@@ -0,0 +1,16 @@
+# The following patch enables a conversion webhook for the CRD
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: accessservices.networking.cfargotunnel.com
+spec:
+  conversion:
+    strategy: Webhook
+    webhook:
+      clientConfig:
+        service:
+          namespace: system
+          name: webhook-service
+          path: /convert
+      conversionReviewVersions:
+      - v1

config/rbac/accessservice_editor_role.yaml

@@ -0,0 +1,31 @@
+# permissions for end users to edit accessservices.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: clusterrole
+    app.kubernetes.io/instance: accessservice-editor-role
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: cloudflare-operator
+    app.kubernetes.io/part-of: cloudflare-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: accessservice-editor-role
+rules:
+- apiGroups:
+  - networking.cfargotunnel.com
+  resources:
+  - accessservices
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - networking.cfargotunnel.com
+  resources:
+  - accessservices/status
+  verbs:
+  - get

config/rbac/accessservice_viewer_role.yaml

@@ -0,0 +1,27 @@
+# permissions for end users to view accessservices.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: clusterrole
+    app.kubernetes.io/instance: accessservice-viewer-role
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: cloudflare-operator
+    app.kubernetes.io/part-of: cloudflare-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: accessservice-viewer-role
+rules:
+- apiGroups:
+  - networking.cfargotunnel.com
+  resources:
+  - accessservices
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - networking.cfargotunnel.com
+  resources:
+  - accessservices/status
+  verbs:
+  - get

config/samples/kustomization.yaml

@@ -7,4 +7,5 @@ resources:
 - v1_service.yaml
 - networking_v1alpha1_clustertunnel.yaml
 - networking_v1alpha1_tunnelbinding.yaml
+- networking_v1alpha1_accessservice.yaml
 #+kubebuilder:scaffold:manifestskustomizesamples

config/samples/networking_v1alpha1_accessservice.yaml

@@ -0,0 +1,12 @@
+apiVersion: networking.cfargotunnel.com/v1alpha1
+kind: AccessService
+metadata:
+  labels:
+    app.kubernetes.io/name: accessservice
+    app.kubernetes.io/instance: accessservice-sample
+    app.kubernetes.io/part-of: cloudflare-operator
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/created-by: cloudflare-operator
+  name: accessservice-sample
+spec:
+  # TODO(user): Add fields here

controllers/accessservice_controller.go

@@ -0,0 +1,62 @@
+/*
+Copyright 2022.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controllers
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+
+	networkingv1alpha1 "github.com/adyanth/cloudflare-operator/api/v1alpha1"
+)
+
+// AccessServiceReconciler reconciles a AccessService object
+type AccessServiceReconciler struct {
+	client.Client
+	Scheme *runtime.Scheme
+}
+
+//+kubebuilder:rbac:groups=networking.cfargotunnel.com,resources=accessservices,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups=networking.cfargotunnel.com,resources=accessservices/status,verbs=get;update;patch
+//+kubebuilder:rbac:groups=networking.cfargotunnel.com,resources=accessservices/finalizers,verbs=update
+
+// Reconcile is part of the main kubernetes reconciliation loop which aims to
+// move the current state of the cluster closer to the desired state.
+// TODO(user): Modify the Reconcile function to compare the state specified by
+// the AccessService object against the actual cluster state, and then
+// perform operations to make the cluster state reflect the state specified by
+// the user.
+//
+// For more details, check Reconcile and its Result here:
+// - https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/reconcile
+func (r *AccessServiceReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	_ = log.FromContext(ctx)
+
+	// TODO(user): your logic here
+
+	return ctrl.Result{}, nil
+}
+
+// SetupWithManager sets up the controller with the Manager.
+func (r *AccessServiceReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewControllerManagedBy(mgr).
+		For(&networkingv1alpha1.AccessService{}).
+		Complete(r)
+}

go.sum

@@ -80,7 +80,6 @@ github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+Ce
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.1.2 h1:YRXhKfTDauu4ajMg1TPgFO5jnlC2HCbmLXMcTG5cbYE=

main.go

@@ -106,6 +106,13 @@ func main() {
 		setupLog.Error(err, "unable to create controller", "controller", "ClusterTunnel")
 		os.Exit(1)
 	}
+	if err = (&controllers.AccessServiceReconciler{
+		Client: mgr.GetClient(),
+		Scheme: mgr.GetScheme(),
+	}).SetupWithManager(mgr); err != nil {
+		setupLog.Error(err, "unable to create controller", "controller", "AccessService")
+		os.Exit(1)
+	}
 	//+kubebuilder:scaffold:builder
 
 	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {