Documentation
¶
Overview ¶
Package azureprivatelinkservice implements the control-plane side of Azure Private Link Service lifecycle for self-managed HyperShift hosted clusters.
This package contains two controllers:
Observer: Watches the private-router Service for an Azure Internal Load Balancer IP and creates/updates an AzurePrivateLinkService CR with the discovered IP and platform configuration from the HostedControlPlane spec.
Reconciler: Watches AzurePrivateLinkService CRs and creates Azure Private Endpoint, Private DNS Zone, VNet Link, and A record resources in the guest VNet to enable private connectivity from the guest network to the hosted cluster API server.
The observer bridges the gap between the private-router Service (created by the CPO infra reconciler) and the management-plane HO controller that creates the Azure PLS. The reconciler completes the private connectivity chain after the HO controller populates the PLS alias in the CR status.
Condition progression on AzurePrivateLinkService status:
InternalLoadBalancerAvailable (HO) → PLSCreated (HO) → PrivateEndpointAvailable (CPO) → PrivateDNSAvailable (CPO) → AzurePrivateLinkServiceAvailable (CPO, overall)
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ControllerName ¶
Types ¶
type AzurePrivateLinkServiceObserver ¶
type AzurePrivateLinkServiceObserver struct {
client.Client
ControllerName string
ServiceNamespace string
ServiceName string
HCPNamespace string
upsert.CreateOrUpdateProvider
}
AzurePrivateLinkServiceObserver watches the private-router Service with an Azure Internal Load Balancer and reconciles an AzurePrivateLinkService CR representation for it.
func (*AzurePrivateLinkServiceObserver) SetupWithManager ¶
type AzurePrivateLinkServiceReconciler ¶
type AzurePrivateLinkServiceReconciler struct {
client.Client
PrivateEndpoints PrivateEndpointsAPI
PrivateDNSZones PrivateDNSZonesAPI
VirtualNetworkLinks VirtualNetworkLinksAPI
RecordSets RecordSetsAPI
}
AzurePrivateLinkServiceReconciler reconciles AzurePrivateLinkService resources by creating Private Endpoints, Private DNS Zones, VNet links, and A records in Azure.
It runs in the CPO (control-plane-operator) with scoped Azure credentials for the guest VNet. The reconciler waits for the HO platform controller to populate the PLS alias in the CR status before creating guest-side resources.
Azure Credentials: The CPO uses a workload identity scoped to the guest resource group/VNet. Required Azure RBAC permissions:
- Microsoft.Network/privateEndpoints/read, write, delete (PE lifecycle)
- Microsoft.Network/privateDnsZones/read, write, delete (DNS zone lifecycle)
- Microsoft.Network/privateDnsZones/virtualNetworkLinks/read, write, delete (VNet link)
- Microsoft.Network/privateDnsZones/A/read, write, delete (A record management)
Azure SDK client interfaces are used instead of concrete types to enable unit testing.
func (*AzurePrivateLinkServiceReconciler) Reconcile ¶
func (r *AzurePrivateLinkServiceReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)
Reconcile implements the main reconciliation logic for Azure Private Link Service resources.
func (*AzurePrivateLinkServiceReconciler) SetupWithManager ¶
func (r *AzurePrivateLinkServiceReconciler) SetupWithManager(mgr ctrl.Manager) error
SetupWithManager sets up the controller with the Manager. It watches AzurePrivateLinkService CRs as the primary resource, and also watches HostedControlPlane objects so that deletion of the HCP triggers reconciliation of the associated AzurePrivateLinkService CR. This enables the HCP finalizer to block HCP deletion until Azure resource cleanup is complete.
type PrivateDNSZonesAPI ¶
type PrivateDNSZonesAPI interface {
BeginCreateOrUpdate(ctx context.Context, resourceGroupName string, privateZoneName string, parameters armprivatedns.PrivateZone, options *armprivatedns.PrivateZonesClientBeginCreateOrUpdateOptions) (*azruntime.Poller[armprivatedns.PrivateZonesClientCreateOrUpdateResponse], error)
BeginDelete(ctx context.Context, resourceGroupName string, privateZoneName string, options *armprivatedns.PrivateZonesClientBeginDeleteOptions) (*azruntime.Poller[armprivatedns.PrivateZonesClientDeleteResponse], error)
}
PrivateDNSZonesAPI abstracts the Azure Private DNS Zones client.
type PrivateEndpointsAPI ¶
type PrivateEndpointsAPI interface {
BeginCreateOrUpdate(ctx context.Context, resourceGroupName string, privateEndpointName string, parameters armnetwork.PrivateEndpoint, options *armnetwork.PrivateEndpointsClientBeginCreateOrUpdateOptions) (*azruntime.Poller[armnetwork.PrivateEndpointsClientCreateOrUpdateResponse], error)
BeginDelete(ctx context.Context, resourceGroupName string, privateEndpointName string, options *armnetwork.PrivateEndpointsClientBeginDeleteOptions) (*azruntime.Poller[armnetwork.PrivateEndpointsClientDeleteResponse], error)
Get(ctx context.Context, resourceGroupName string, privateEndpointName string, options *armnetwork.PrivateEndpointsClientGetOptions) (armnetwork.PrivateEndpointsClientGetResponse, error)
}
PrivateEndpointsAPI abstracts the Azure Private Endpoints client.
type RecordSetsAPI ¶
type RecordSetsAPI interface {
CreateOrUpdate(ctx context.Context, resourceGroupName string, privateZoneName string, recordType armprivatedns.RecordType, relativeRecordSetName string, parameters armprivatedns.RecordSet, options *armprivatedns.RecordSetsClientCreateOrUpdateOptions) (armprivatedns.RecordSetsClientCreateOrUpdateResponse, error)
Delete(ctx context.Context, resourceGroupName string, privateZoneName string, recordType armprivatedns.RecordType, relativeRecordSetName string, options *armprivatedns.RecordSetsClientDeleteOptions) (armprivatedns.RecordSetsClientDeleteResponse, error)
}
RecordSetsAPI abstracts the Azure Record Sets client.
type VirtualNetworkLinksAPI ¶
type VirtualNetworkLinksAPI interface {
BeginCreateOrUpdate(ctx context.Context, resourceGroupName string, privateZoneName string, virtualNetworkLinkName string, parameters armprivatedns.VirtualNetworkLink, options *armprivatedns.VirtualNetworkLinksClientBeginCreateOrUpdateOptions) (*azruntime.Poller[armprivatedns.VirtualNetworkLinksClientCreateOrUpdateResponse], error)
BeginDelete(ctx context.Context, resourceGroupName string, privateZoneName string, virtualNetworkLinkName string, options *armprivatedns.VirtualNetworkLinksClientBeginDeleteOptions) (*azruntime.Poller[armprivatedns.VirtualNetworkLinksClientDeleteResponse], error)
}
VirtualNetworkLinksAPI abstracts the Azure Virtual Network Links client.
Source Files