-
Notifications
You must be signed in to change notification settings - Fork 56
/
main.go
153 lines (129 loc) · 7.02 KB
/
main.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
/*
Copyright 2020 The Crossplane Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package main
import (
"context"
"os"
"path/filepath"
"time"
"github.com/crossplane/crossplane-runtime/pkg/certificates"
"github.com/crossplane/crossplane-runtime/pkg/controller"
"github.com/crossplane/crossplane-runtime/pkg/feature"
"go.uber.org/zap/zapcore"
"k8s.io/client-go/tools/leaderelection/resourcelock"
"gopkg.in/alecthomas/kingpin.v2"
kerrors "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/cache"
"sigs.k8s.io/controller-runtime/pkg/log/zap"
xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
"github.com/crossplane/crossplane-runtime/pkg/logging"
"github.com/crossplane/crossplane-runtime/pkg/ratelimiter"
"github.com/crossplane/crossplane-runtime/pkg/resource"
"github.com/upbound/provider-terraform/apis"
"github.com/upbound/provider-terraform/apis/v1beta1"
workspace "github.com/upbound/provider-terraform/internal/controller"
"github.com/upbound/provider-terraform/internal/controller/features"
)
func main() {
var (
app = kingpin.New(filepath.Base(os.Args[0]), "Terraform support for Crossplane.").DefaultEnvars()
debug = app.Flag("debug", "Run with debug logging.").Short('d').Bool()
syncInterval = app.Flag("sync", "Sync interval controls how often all resources will be double checked for drift.").Short('s').Default("1h").Duration()
pollInterval = app.Flag("poll", "Poll interval controls how often an individual resource should be checked for drift.").Default("10m").Duration()
pollJitter = app.Flag("poll-jitter", "If non-zero, varies the poll interval by a random amount up to plus-or-minus this value.").Default("1m").Duration()
timeout = app.Flag("timeout", "Controls how long Terraform processes may run before they are killed.").Default("20m").Duration()
leaderElection = app.Flag("leader-election", "Use leader election for the controller manager.").Short('l').Default("false").Envar("LEADER_ELECTION").Bool()
maxReconcileRate = app.Flag("max-reconcile-rate", "The maximum number of concurrent reconciliation operations.").Default("1").Int()
namespace = app.Flag("namespace", "Namespace used to set as default scope in default secret store config.").Default("crossplane-system").Envar("POD_NAMESPACE").String()
enableExternalSecretStores = app.Flag("enable-external-secret-stores", "Enable support for ExternalSecretStores.").Default("false").Envar("ENABLE_EXTERNAL_SECRET_STORES").Bool()
enableManagementPolicies = app.Flag("enable-management-policies", "Enable support for Management Policies.").Default("true").Envar("ENABLE_MANAGEMENT_POLICIES").Bool()
essTLSCertsPath = app.Flag("ess-tls-cert-dir", "Path of ESS TLS certificates.").Envar("ESS_TLS_CERTS_DIR").String()
)
kingpin.MustParse(app.Parse(os.Args[1:]))
zl := zap.New(zap.UseDevMode(*debug), UseISO8601())
log := logging.NewLogrLogger(zl.WithName("provider-terraform"))
// SetLogger is required starting in controller-runtime 0.15.0.
// https://github.com/kubernetes-sigs/controller-runtime/pull/2317
ctrl.SetLogger(zl)
log.Debug("Starting",
"sync-period", syncInterval.String(),
"poll-interval", pollInterval.String(),
"poll-jitter", pollJitter.String(),
"max-reconcile-rate", *maxReconcileRate)
cfg, err := ctrl.GetConfig()
kingpin.FatalIfError(err, "Cannot get API server rest config")
mgr, err := ctrl.NewManager(ratelimiter.LimitRESTConfig(cfg, *maxReconcileRate), ctrl.Options{
Cache: cache.Options{
SyncPeriod: syncInterval,
},
// controller-runtime uses both ConfigMaps and Leases for leader
// election by default. Leases expire after 15 seconds, with a
// 10 second renewal deadline. We've observed leader loss due to
// renewal deadlines being exceeded when under high load - i.e.
// hundreds of reconciles per second and ~200rps to the API
// server. Switching to Leases only and longer leases appears to
// alleviate this.
LeaderElection: *leaderElection,
LeaderElectionID: "crossplane-leader-election-provider-terraform",
LeaderElectionResourceLock: resourcelock.LeasesResourceLock,
LeaseDuration: func() *time.Duration { d := 60 * time.Second; return &d }(),
RenewDeadline: func() *time.Duration { d := 50 * time.Second; return &d }(),
})
kingpin.FatalIfError(err, "Cannot create controller manager")
kingpin.FatalIfError(apis.AddToScheme(mgr.GetScheme()), "Cannot add terraform APIs to scheme")
o := controller.Options{
Logger: log,
MaxConcurrentReconciles: *maxReconcileRate,
PollInterval: *pollInterval,
GlobalRateLimiter: ratelimiter.NewGlobal(*maxReconcileRate),
Features: &feature.Flags{},
}
if *enableManagementPolicies {
o.Features.Enable(features.EnableBetaManagementPolicies)
log.Info("Beta feature enabled", "flag", features.EnableBetaManagementPolicies)
}
if *enableExternalSecretStores {
o.Features.Enable(features.EnableAlphaExternalSecretStores)
log.Info("Alpha feature enabled", "flag", features.EnableAlphaExternalSecretStores)
o.ESSOptions = &controller.ESSOptions{}
if *essTLSCertsPath != "" {
log.Info("ESS TLS certificates path is set. Loading mTLS configuration.")
tCfg, err := certificates.LoadMTLSConfig(filepath.Join(*essTLSCertsPath, "ca.crt"), filepath.Join(*essTLSCertsPath, "tls.crt"), filepath.Join(*essTLSCertsPath, "tls.key"), false)
kingpin.FatalIfError(err, "Cannot load ESS TLS config.")
o.ESSOptions.TLSConfig = tCfg
}
// Ensure default store config exists.
kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1beta1.StoreConfig{
ObjectMeta: metav1.ObjectMeta{
Name: "default",
},
Spec: v1beta1.StoreConfigSpec{
// NOTE(turkenh): We only set required spec and expect optional
// ones to properly be initialized with CRD level default values.
SecretStoreConfig: xpv1.SecretStoreConfig{
DefaultScope: *namespace,
},
},
})), "cannot create default store config")
}
kingpin.FatalIfError(workspace.Setup(mgr, o, *timeout, *pollJitter), "Cannot setup Workspace controllers")
kingpin.FatalIfError(mgr.Start(ctrl.SetupSignalHandler()), "Cannot start controller manager")
}
// UseISO8601 sets the logger to use ISO8601 timestamp format
func UseISO8601() zap.Opts {
return func(o *zap.Options) {
o.TimeEncoder = zapcore.ISO8601TimeEncoder
}
}