refactor: 按职责拆分 controller 启动流程

2026-09-27 17:37:45 +00:00
parent c7b80890fb
commit 356e21686f
8 changed files with 425 additions and 188 deletions
@@ -0,0 +1,94 @@
+package bootstrap
+
+import (
+	"crypto/tls"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+
+	// 保留 kubeconfig 支持的官方认证插件，不自建身份加载流程。
+	_ "k8s.io/client-go/plugin/pkg/client/auth"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/healthz"
+	"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
+	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+
+	databasev1alpha1 "git.ddupan.top/panxiao81/ayatori/api/database/v1alpha1"
+	executionv1alpha1 "git.ddupan.top/panxiao81/ayatori/api/execution/v1alpha1"
+)
+
+func newManager(options options) (ctrl.Manager, error) {
+	config, err := ctrl.GetConfig()
+	if err != nil {
+		return nil, fmt.Errorf("load Kubernetes configuration: %w", err)
+	}
+	configuration := options.manager.configuration()
+	options.database.configureManager(&configuration)
+	manager, err := ctrl.NewManager(config, configuration)
+	if err != nil {
+		return nil, fmt.Errorf("create controller manager: %w", err)
+	}
+	if err := manager.AddHealthzCheck("healthz", healthz.Ping); err != nil {
+		return nil, fmt.Errorf("set up health check: %w", err)
+	}
+	if err := manager.AddReadyzCheck("readyz", healthz.Ping); err != nil {
+		return nil, fmt.Errorf("set up readiness check: %w", err)
+	}
+	return manager, nil
+}
+
+func (o managerOptions) configuration() ctrl.Options {
+	scheme := runtime.NewScheme()
+	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
+	utilruntime.Must(executionv1alpha1.AddToScheme(scheme))
+	utilruntime.Must(databasev1alpha1.AddToScheme(scheme))
+	return ctrl.Options{
+		Scheme:                 scheme,
+		Metrics:                o.metricsOptions(),
+		WebhookServer:          webhook.NewServer(o.webhookOptions()),
+		HealthProbeBindAddress: o.probeAddr,
+		LeaderElection:         o.enableLeaderElection,
+		LeaderElectionID:       "a6325ed6.ddupan.top",
+		// 保持默认不主动释放选主 Lease：manager 停止后还要完成组件清理。
+	}
+}
+
+func (o managerOptions) tlsOptions() []func(*tls.Config) {
+	if o.enableHTTP2 {
+		return nil
+	}
+	// 默认禁用 HTTP/2，沿用 scaffold 对 Rapid Reset 等风险的防护。
+	return []func(*tls.Config){func(config *tls.Config) {
+		config.NextProtos = []string{"http/1.1"}
+	}}
+}
+
+func (o managerOptions) metricsOptions() metricsserver.Options {
+	options := metricsserver.Options{
+		BindAddress:   o.metricsAddr,
+		SecureServing: o.secureMetrics,
+		TLSOpts:       o.tlsOptions(),
+	}
+	if o.secureMetrics {
+		options.FilterProvider = filters.WithAuthenticationAndAuthorization
+	}
+	if o.metricsCertPath != "" {
+		options.CertDir = o.metricsCertPath
+		options.CertName = o.metricsCertName
+		options.KeyName = o.metricsCertKey
+	}
+	return options
+}
+
+func (o managerOptions) webhookOptions() webhook.Options {
+	options := webhook.Options{Port: o.webhookPort, TLSOpts: o.tlsOptions()}
+	if o.webhookCertPath != "" {
+		options.CertDir = o.webhookCertPath
+		options.CertName = o.webhookCertName
+		options.KeyName = o.webhookCertKey
+	}
+	return options
+}