Deploy OS UI (Whisker) with Goldmane #3775

Brian-McM · 2025-02-14T18:06:41Z

Description

For PR author

Tests for change.
If changing pkg/apis/, run make gen-files
If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

Milestone set according to targeted release.
Appropriate labels:
- kind/bug if this is a bugfix.
- kind/enhancement if this is a a new feature.
- enterprise if this PR applies to Calico Enterprise only.

caseydavenport

Very first pass. I think building tooling to more consistently, easily, and reliably construct common Objects is probably a good idea, but I do worry about the work required to roll this out across the board and the likelihood of us ending up needing to maintain multiple different ways of constructing objects as a result. So I'm on the fence about shipping it as part of this PR - let's see what @tmjd and @rene-dekker have to say.

api/v1/whisker_types.go

config/enterprise_versions.yml

pkg/controller/clusterconnection/clusterconnection_controller.go

pkg/controller/utils/utils.go

pkg/controller/whisker/whisker_controller.go

pkg/render/whisker/component.go

caseydavenport · 2025-02-18T18:48:46Z

@Brian-McM I think you'll need some logic like this as well: https://github.com/caseydavenport/operator/pull/6/files#diff-ffe7b4311a6538484cedc5e685c3bde3e6ce1a95f86828103fb12992e8158842

caseydavenport · 2025-02-19T18:25:31Z

api/v1/whisker_types.go

+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Status WhiskerStatus `json:"status,omitempty"`


We'll need to add container overrides to everything this deploys. I'm OK for that to be a follow-up, but I also think it should be rather trivial to add now.

If you're cool with it I'm going to defer it, I tracked it in a ticket. Not sure if goldmane is going to stay here so kind of want to leave overrides until we sort that out.

config/enterprise_versions.yml

pkg/components/calico.go

caseydavenport · 2025-02-19T18:26:57Z

pkg/controller/whisker/whisker_controller.go

+
+var log = logf.Log.WithName(controllerName)
+
+// Add creates a new ManagementClusterConnection Controller and adds it to the Manager. The Manager will set fields on the Controller


Still copy/paste error in this comment

pkg/controller/whisker/whisker_controller.go

pkg/render/whisker/component.go

caseydavenport · 2025-02-19T18:47:06Z

pkg/render/whisker/component.go

+		},
+		{
+			APIGroups: []string{"projectcalico.org"},
+			Resources: []string{"felixconfigurations"},


Hm, what accesses felixconfigurations from this deployment?

UI APIs seems to need it when it's connected.

caseydavenport · 2025-02-19T18:47:26Z

pkg/render/whisker/component.go

+		{
+			APIGroups: []string{"*"},
+			Resources: []string{"*"},
+			Verbs:     []string{"get", "list", "watch"},


Should remove this wildcard permission

caseydavenport · 2025-02-19T18:47:47Z

pkg/render/whisker/component.go

+}
+
+func (c *Component) clusterRole() *rbacv1.ClusterRole {
+	policyRules := []rbacv1.PolicyRule{


Goldmane needs access to ConfigMaps in its own Namespace (should be done via a Role not ClusterRole, though)

pkg/render/whisker/component.go

rene-dekker · 2025-02-20T23:28:18Z

pkg/controller/whisker/whisker_controller.go

+	for _, secretName := range []string{
+		monitor.PrometheusServerTLSSecretName,
+		whisker.ManagedClusterConnectionSecretName,
+		"whisker-trusted-bundle",


This is not a secret.

rene-dekker · 2025-02-20T23:50:13Z

pkg/tls/certificatemanagement/certificatebundle.go

@@ -99,6 +99,10 @@ func createTrustedBundle(includeSystemBundle bool, name string, ca CertificateIn
 	return bundle, err
 }

+func (t *trustedBundle) SetName(name string) {


I'd rather that we follow the established pattern and have the existing controller (core_controller in this case) add the certificates.

rene-dekker · 2025-02-20T23:51:34Z

pkg/render/whisker/component.go

+			Name:  "PUSH_URL",
+			Value: "https://localhost:8080/api/v1/flows/bulk"})
+		volumeMounts = []corev1.VolumeMount{
+			secretMount("/certs", c.cfg.LinseedPublicCASecret),


How does this secret get into the namespace? I don't see it rendered in the PR, unless I'm missing something.

It's via the install manifest retrieved from CC.

rene-dekker · 2025-02-20T23:52:30Z

pkg/render/whisker/component.go

+		c.clusterRoleBinding(),
+		c.goldmaneService(),
+		c.whiskerService(),
+		c.cfg.TrustedCertBundle.ConfigMap(WhiskerNamespace))


This is not how we render the bundle elsewhere. I'd rather have us use the established pattern.

rene-dekker · 2025-02-21T00:03:54Z

internal/controller/whisker_controller.go

+	Scheme *runtime.Scheme
+}
+
+// +kubebuilder:rbac:groups=operator.tigera.io,resources=managementclusterconnections,verbs=get;list;watch;create;update;patch;delete


The comments in this file are incorrect

rene-dekker · 2025-02-21T00:12:23Z

pkg/controller/whisker/whisker_controller.go

+		return nil
+	}
+
+	statusManager := status.New(mgr.GetClient(), "gold-rush", opts.KubernetesVersion)


What is the reason and meaning for this name? Wouldn't it be better if we stick with whisker?

This is left over from some previous naming

marvin-tigera added this to the v1.38.0 milestone Feb 14, 2025

marvin-tigera added docs-pr-required release-note-required labels Feb 14, 2025

Brian-McM force-pushed the bm-add-whisker branch from 798fc8c to 1fa1508 Compare February 18, 2025 16:57

caseydavenport reviewed Feb 18, 2025

View reviewed changes

Deploy OS UI (Whisker) with Goldmane and Guardian

b1eb33d

Brian-McM force-pushed the bm-add-whisker branch from 1fa1508 to b1eb33d Compare February 18, 2025 19:38

Brian-McM added 3 commits February 18, 2025 15:06

don't use new pattern

22ebd5b

remove new patterns

31469ac

add security context

d031e0a

caseydavenport requested changes Feb 19, 2025

View reviewed changes

Brian-McM added 2 commits February 20, 2025 13:44

remove extra permissions, clean up code

ea35dd5

disable whisker if crd doesn't exist, fix conflict with trusted bundel

2cd316a

Brian-McM marked this pull request as ready for review February 20, 2025 22:22

Brian-McM requested a review from a team as a code owner February 20, 2025 22:22

Brian-McM added 3 commits February 20, 2025 14:24

update copyrights

11adc64

remove guardian

639ca6c

fix static checks

0ec8af2

rene-dekker reviewed Feb 20, 2025

View reviewed changes

rene-dekker reviewed Feb 21, 2025

View reviewed changes

Brian-McM added 2 commits February 20, 2025 20:02

remove trusted bundle (not needed since guardian was removed)

1258982

remove unused code

d88add3

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Deploy OS UI (Whisker) with Goldmane #3775

Deploy OS UI (Whisker) with Goldmane #3775

Brian-McM commented Feb 14, 2025

caseydavenport left a comment

caseydavenport commented Feb 18, 2025

caseydavenport Feb 19, 2025

Brian-McM Feb 21, 2025

caseydavenport Feb 19, 2025

caseydavenport Feb 19, 2025

Brian-McM Feb 20, 2025

caseydavenport Feb 19, 2025

caseydavenport Feb 19, 2025

rene-dekker Feb 20, 2025

rene-dekker Feb 20, 2025

rene-dekker Feb 20, 2025

Brian-McM Feb 21, 2025

rene-dekker Feb 20, 2025

rene-dekker Feb 21, 2025

rene-dekker Feb 21, 2025

Brian-McM Feb 21, 2025


		var log = logf.Log.WithName(controllerName)

		// Add creates a new ManagementClusterConnection Controller and adds it to the Manager. The Manager will set fields on the Controller

Deploy OS UI (Whisker) with Goldmane #3775

Are you sure you want to change the base?

Deploy OS UI (Whisker) with Goldmane #3775

Conversation

Brian-McM commented Feb 14, 2025

Description

For PR author

For PR reviewers

caseydavenport left a comment

Choose a reason for hiding this comment

caseydavenport commented Feb 18, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment