Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(on-prem): use the .spec.kubernetes.advanced.users.org parameter for kubernetes users creation #275

Merged
merged 1 commit into from
Oct 17, 2024

Conversation

speziato
Copy link
Contributor

@speziato speziato commented Oct 14, 2024

Closes #265

@speziato speziato linked an issue Oct 14, 2024 that may be closed by this pull request
@speziato speziato self-assigned this Oct 14, 2024
Copy link
Member

@nutellinoit nutellinoit left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did you test this change?

Copy link
Member

@ralgozino ralgozino left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately this change is not working for me.

This is what I did:

  1. Cleaned up local files and the .furyctl folder.
  2. Added a user to the list in the furyctl.yaml file under .spec.kubernetes.advanced.users.names and set .spec.kubernetes.advanced.users.org to a custom value.
  3. Run furyctl apply --phase kubernetes
  4. I checked the <username>.kubeconfig file that gets copied in the current folder for the Organization property in the certificates with the following command:
yq '.users[0].user.client-certificate-data' <username>.kubeconfig | base64 -d | openssl x509 -text | grep Subject:

I got O=sighup, CN=<username> as value.

I expected the additional user to have the O=<org I set in the furyctl.yaml>.

Closes #256

I think you meant #265 ;)

Copy link
Member

@ralgozino ralgozino left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As you wisely pointed out to me, this change was being overridden by furyctl compatibility patches in my test 🤕 .

Re testing these changes without the compatibility patches, the organization is set properly for the additional users.

well done @speziato 🎉

@speziato
Copy link
Contributor Author

speziato commented Oct 17, 2024

@nutellinoit

Did you test this change?

Yep, but I tested it in a wrong way: I edited the compatibility patch in furyctl and built it locally to test with KFD v1.29.4, saw that it was working and pushed the change here. The test I did was not as good as @ralgozino's one.

Basically, to test locally you can just clone this repo, checkout this branch, change the version property in kfd.yaml to something for which furyctl does not have embedded compatibility patches (such as v1.29.5), create a furyctl.yaml with that inexisting version and run furyctl create --distro-location <path-of-the-cloned-repo>

git clone https://github.com/sighupio/fury-distribution --branch=fix/on-prem-user-org
cd fury-distribution
sed -I "" -r 's#^(version:\ ).*#\1v1.29.5#g' kfd.yaml
furyctl create config --kind OnPremises --version v1.29.5 --distro-location .
# add the advanced.users.names and advanced.users.org properties to the furyctl.yaml
furyctl apply --distro-location . --phase kubernetes
yq '.users[0].user.client-certificate-data' <username>.kubeconfig | base64 -d | openssl x509 -text | grep Subject:

@nutellinoit nutellinoit self-requested a review October 17, 2024 12:12
Copy link
Member

@nutellinoit nutellinoit left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@speziato speziato merged commit 3646f9a into main Oct 17, 2024
1 check passed
@speziato speziato deleted the fix/on-prem-user-org branch October 17, 2024 12:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

on-prem: kubernetes.advanced.users.org seems to be ignored
3 participants