Documentation
¶
Overview ¶
Package apis provides BareMetalHost utilities: status checks, provisioning state monitoring, and Metal3 operations.
Package apis provides Kubernetes API utilities: CSR approval, BareMetalHost status checks, and Metal3 operations.
Context convention for polling (wait.PollUntilContextTimeout):
- The parent passed to PollUntilContextTimeout is context.Background(); the wait package applies the poll timeout.
- The condition callback must use its ctx argument for all API calls so requests are cancelled when the poll ends.
- One-off API reads outside a poll (e.g. a final spot check after timeout) use context.WithTimeout(context.Background(), d).
Helpers that only perform a single List/Get (e.g. diagnostics) also use a short WithTimeout on Background(); that is intentional and not a contradiction with the poll rules above.
Package apis provides Machine API utilities for machine.openshift.io (phase, nodeRef).
Index ¶
- Constants
- Variables
- func ApproveCSRs(oc *exutil.CLI, timeout time.Duration, pollInterval time.Duration, ...) int
- func ApproveNodeBootstrapperCSRsForNode(ctx context.Context, oc *exutil.CLI, nodeName string) (int, error)
- func BareMetalHostExists(oc *exutil.CLI, bmhName, namespace string) (bool, error)
- func ChangeBMCPasswordViaRedfish(oc *exutil.CLI, ...) error
- func ChangeSushyToolsPassword(username, newPassword string, sshConfig *core.SSHConfig, knownHostsPath string) error
- func ExpectClusterHealthy(pc *etcdv1alpha1.PacemakerCluster) error
- func ExpectNodeFencingHealthy(pc *etcdv1alpha1.PacemakerCluster, nodeName string) error
- func FindBMCSecretByNodeName(oc *exutil.CLI, namespace, nodeName string) (string, error)
- func FindBMHByNodeName(oc *exutil.CLI, namespace, nodeName string) (string, error)
- func GetBMH(oc *exutil.CLI, bmhName, namespace string) (*metal3v1alpha1.BareMetalHost, error)
- func GetBMHErrorMessage(oc *exutil.CLI, bmhName, namespace string) (string, error)
- func GetBMHProvisioningState(oc *exutil.CLI, bmhName, namespace string) (metal3v1alpha1.ProvisioningState, error)
- func GetBMHYAML(oc *exutil.CLI, bmhName, namespace string) ([]byte, error)
- func GetMachineProviderID(oc *exutil.CLI, machineName, namespace string) (string, error)
- func GetMachineYAML(oc *exutil.CLI, machineName, namespace string) ([]byte, error)
- func GetPacemakerCluster(oc *exutil.CLI) (*etcdv1alpha1.PacemakerCluster, error)
- func HasApprovedNodeCSR(oc *exutil.CLI, nodeName string) bool
- func IsPacemakerClusterAvailable(oc *exutil.CLI) bool
- func IsSushyEmulator(redfishPath string) bool
- func LogNodeCSRStatus(oc *exutil.CLI, nodeName string) bool
- func MachineExists(oc *exutil.CLI, machineName, namespace string) (bool, error)
- func ParseRedfishAddress(address string) (host, port, path string, err error)
- func RestoreBMCPassword(oc *exutil.CLI, namespace, name string, originalPassword []byte) error
- func RotateNodeBMCPassword(oc *exutil.CLI, node *corev1.Node) (string, string, []byte, error)
- func ValidateBMCCredentials(oc *exutil.CLI, ...) error
- func WaitForAndApproveNodeBootstrapperCSR(parentCtx context.Context, oc *exutil.CLI, nodeName string, ...) error
- type FencingCredentials
- type MachineStatus
Constants ¶
const ( BMCSecretNamespace = "openshift-machine-api" FencingCredentialsNamespace = "openshift-etcd" )
const NodeBootstrapperUsername = "system:serviceaccount:openshift-machine-config-operator:node-bootstrapper"
NodeBootstrapperUsername is the spec.username for the node-bootstrapper service account (kube-apiserver-client-kubelet CSRs).
const NodeCSRUsernamePrefix = "system:node:"
NodeCSRUsernamePrefix is the CSR spec.username prefix for kubelet node certificates (machine-approver approves these).
Variables ¶
var BMHGVR = schema.GroupVersionResource{
Group: "metal3.io", Version: "v1alpha1", Resource: "baremetalhosts",
}
BMHGVR is the GroupVersionResource for BareMetalHost (metal3.io/v1alpha1). Use for API-based get/delete/patch.
var MachineGVR = schema.GroupVersionResource{
Group: "machine.openshift.io", Version: "v1beta1", Resource: "machines",
}
MachineGVR is the GroupVersionResource for Machine (machine.openshift.io/v1beta1). Use for API-based get/delete/patch.
var PacemakerClusterGVR = schema.GroupVersionResource{ Group: etcdv1alpha1.GroupName, Version: "v1alpha1", Resource: "pacemakerclusters", }
Functions ¶
func ApproveCSRs ¶
func ApproveCSRs(oc *exutil.CLI, timeout time.Duration, pollInterval time.Duration, expectedCSRCount int) int
ApproveCSRs monitors and approves pending CSRs until timeout or expected count reached.
approvedCount := ApproveCSRs(oc, 10*time.Minute, 1*time.Minute, 0)
func ApproveNodeBootstrapperCSRsForNode ¶
func ApproveNodeBootstrapperCSRsForNode(ctx context.Context, oc *exutil.CLI, nodeName string) (int, error)
ApproveNodeBootstrapperCSRsForNode finds Pending kube-apiserver-client-kubelet CSRs from the node-bootstrapper that are for the given node (request CN system:node:<nodeName>) and approves them. Returns the number approved.
This is a test workaround for a known product issue: cluster-machine-approver may not approve these CSRs when the replacement kubelet reuses an existing Node name, leaving kube-apiserver-client-kubelet CSRs Pending. Update the node-replacement spec comment with the OCPBUGS ID once filed.
ctx should be the PollUntilContextTimeout condition context when called from a poll so CSR List/Update respect cancellation.
func BareMetalHostExists ¶
BareMetalHostExists returns true if the BareMetalHost exists in the namespace.
func ChangeBMCPasswordViaRedfish ¶
func ChangeBMCPasswordViaRedfish(oc *exutil.CLI, nodeName, redfishHost, redfishPort, username, currentPassword, newPassword string) error
ChangeBMCPasswordViaRedfish changes the BMC password using the Redfish AccountService API. It discovers the account matching the given username, then PATCHes the password.
func ChangeSushyToolsPassword ¶
func ChangeSushyToolsPassword(username, newPassword string, sshConfig *core.SSHConfig, knownHostsPath string) error
ChangeSushyToolsPassword changes the BMC password on a sushy-tools virtual BMC by updating its htpasswd file and restarting the container via SSH to the hypervisor.
func ExpectClusterHealthy ¶
func ExpectClusterHealthy(pc *etcdv1alpha1.PacemakerCluster) error
func ExpectNodeFencingHealthy ¶
func ExpectNodeFencingHealthy(pc *etcdv1alpha1.PacemakerCluster, nodeName string) error
func FindBMCSecretByNodeName ¶
FindBMCSecretByNodeName finds a BMC secret name matching *-{shortName}-bmc-secret by listing via API.
func FindBMHByNodeName ¶
FindBMHByNodeName finds a BareMetalHost name matching *-{shortName} by listing via API.
func GetBMH ¶
func GetBMH(oc *exutil.CLI, bmhName, namespace string) (*metal3v1alpha1.BareMetalHost, error)
GetBMH retrieves a BareMetalHost via the cluster API (preferred over oc get).
func GetBMHErrorMessage ¶
GetBMHErrorMessage retrieves the error message from a BareMetalHost's status (via API).
func GetBMHProvisioningState ¶
func GetBMHProvisioningState(oc *exutil.CLI, bmhName, namespace string) (metal3v1alpha1.ProvisioningState, error)
GetBMHProvisioningState retrieves the current provisioning state of a BareMetalHost (via API).
func GetBMHYAML ¶
GetBMHYAML returns the BareMetalHost resource as YAML bytes (for backup or failure diagnostics).
func GetMachineProviderID ¶
GetMachineProviderID returns the Machine's spec.providerID (e.g. baremetalhost:///...).
func GetMachineYAML ¶
GetMachineYAML returns the Machine resource as YAML bytes (for backup). Uses the cluster API.
func GetPacemakerCluster ¶
func GetPacemakerCluster(oc *exutil.CLI) (*etcdv1alpha1.PacemakerCluster, error)
func HasApprovedNodeCSR ¶
HasApprovedNodeCSR returns true if the node has at least one approved CSR (machine-approver has approved).
func IsSushyEmulator ¶
IsSushyEmulator returns true if the Redfish system path contains a UUID, which indicates sushy-tools (virtual BMC) rather than real hardware. sushy-tools uses paths like /redfish/v1/Systems/<uuid> and does not implement AccountService, so credential rotation is not possible.
func LogNodeCSRStatus ¶
LogNodeCSRStatus lists CSRs for the given node (spec.username == system:node:<nodeName>), logs pending vs approved counts, and returns true if at least one CSR for the node has been approved (e.g. by the machine-approver).
func MachineExists ¶
MachineExists returns true if the Machine exists in the namespace.
func ParseRedfishAddress ¶
ParseRedfishAddress parses a Redfish address into its components. Input format: "redfish+https://host:port/redfish/v1/Systems/1" (IPv6 uses bracket notation).
func RestoreBMCPassword ¶
RestoreBMCPassword restores the password key on the given BMC Secret in namespace (must match where the secret lives; BMC secrets for control-plane nodes are in BMCSecretNamespace).
func RotateNodeBMCPassword ¶
RotateNodeBMCPassword discovers the BMC Secret for the given node, rotates its "password" key and returns (namespace, secretName, originalPassword).
func ValidateBMCCredentials ¶
func ValidateBMCCredentials(oc *exutil.CLI, nodeName, redfishHost, redfishPort, redfishPath, username, password string, sslInsecure bool) error
ValidateBMCCredentials validates credentials against the BMC using fence_redfish --action status.
func WaitForAndApproveNodeBootstrapperCSR ¶
func WaitForAndApproveNodeBootstrapperCSR(parentCtx context.Context, oc *exutil.CLI, nodeName string, timeout time.Duration) error
WaitForAndApproveNodeBootstrapperCSR waits until a Pending kube-apiserver-client-kubelet CSR from the node-bootstrapper for the given node appears and approves it, or until the node becomes Ready. Success if: (1) test approves at least one matching CSR, or (2) node is Ready (CSR already approved by machine-approver, or race where approver wins mid-poll). Returns an error only on timeout when the node is still not Ready and no CSR was approved by this wait.
See ApproveNodeBootstrapperCSRsForNode for the known machine-approver / same-node-name replacement bug.
Types ¶
type FencingCredentials ¶
type FencingCredentials struct {
SecretName string
Address string
Username string
Password string
CertificateVerification string
}
FencingCredentials holds the fields from a fencing-credentials secret in openshift-etcd.
func FindFencingCredentialsByNodeName ¶
func FindFencingCredentialsByNodeName(oc *exutil.CLI, nodeName string) (*FencingCredentials, error)
FindFencingCredentialsByNodeName discovers the fencing-credentials secret for a node by listing secrets in openshift-etcd and matching against the node's short name.
type MachineStatus ¶
MachineStatus holds phase and nodeRef name from a Machine's status.
func GetMachineStatus ¶
func GetMachineStatus(oc *exutil.CLI, machineName, namespace string) (MachineStatus, error)
GetMachineStatus returns the Machine's status.phase and status.nodeRef.name using the dynamic client. Use this instead of oc get to interact with the cluster via API.
Source Files