kubectl源码分析之set serviceaccount

Myth丶恋晨 2023-02-12 13:22 130阅读 0赞

#  欢迎关注我的公众号： #

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAaHhwamF2YTE_size_8_color_FFFFFF_t_70_g_se_x_16][]

目前刚开始写一个月，一共写了18篇原创文章，文章目录如下：

[istio多集群探秘，部署了50次多集群后我得出的结论][istio_50]

[istio多集群链路追踪，附实操视频][istio]

[istio防故障利器，你知道几个,istio新手不要读，太难！][istio_istio]

[istio业务权限控制，原来可以这么玩][istio 1]

[istio实现非侵入压缩，微服务之间如何实现压缩][istio 2]

[不懂envoyfilter也敢说精通istio系列-http-rbac-不要只会用AuthorizationPolicy配置权限][envoyfilter_istio_-http-rbac-_AuthorizationPolicy]

[不懂envoyfilter也敢说精通istio系列-02-http-corsFilter-不要只会vs][envoyfilter_istio_-02-http-corsFilter-_vs]

[不懂envoyfilter也敢说精通istio系列-03-http-csrf filter-再也不用再代码里写csrf逻辑了][envoyfilter_istio_-03-http-csrf filter-_csrf]

[不懂envoyfilter也敢说精通istio系列http-jwt\_authn-不要只会RequestAuthorization][envoyfilter_istio_http-jwt_authn-_RequestAuthorization]

[不懂envoyfilter也敢说精通istio系列-05-fault-filter-故障注入不止是vs][envoyfilter_istio_-05-fault-filter-_vs]

[不懂envoyfilter也敢说精通istio系列-06-http-match-配置路由不只是vs][envoyfilter_istio_-06-http-match-_vs]

[不懂envoyfilter也敢说精通istio系列-07-负载均衡配置不止是dr][envoyfilter_istio_-07-_dr]

[不懂envoyfilter也敢说精通istio系列-08-连接池和断路器][envoyfilter_istio_-08-]

[不懂envoyfilter也敢说精通istio系列-09-http-route filter][envoyfilter_istio_-09-http-route filter]

[不懂envoyfilter也敢说精通istio系列-network filter-redis proxy][envoyfilter_istio_-network filter-redis proxy]

[不懂envoyfilter也敢说精通istio系列-network filter-HttpConnectionManager][envoyfilter_istio_-network filter-HttpConnectionManager]

[不懂envoyfilter也敢说精通istio系列-ratelimit-istio ratelimit完全手册][envoyfilter_istio_-ratelimit-istio ratelimit]

加qq群，请联系：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h4cGphdmEx_size_16_color_FFFFFF_t_70][]  
————————————————

type SetServiceAccountOptions struct {//set serviceaccount结构体
    	PrintFlags  *genericclioptions.PrintFlags
    	RecordFlags *genericclioptions.RecordFlags
    
    	fileNameOptions        resource.FilenameOptions
    	dryRun                 bool
    	shortOutput            bool
    	all                    bool
    	output                 string
    	local                  bool
    	updatePodSpecForObject polymorphichelpers.UpdatePodSpecForObjectFunc
    	infos                  []*resource.Info
    	serviceAccountName     string
    
    	PrintObj printers.ResourcePrinterFunc
    	Recorder genericclioptions.Recorder
    
    	genericclioptions.IOStreams
    }

func NewSetServiceAccountOptions(streams genericclioptions.IOStreams) *SetServiceAccountOptions {
    	return &SetServiceAccountOptions{//初始化结构体
    		PrintFlags:  genericclioptions.NewPrintFlags("serviceaccount updated").WithTypeSetter(scheme.Scheme),
    		RecordFlags: genericclioptions.NewRecordFlags(),
    
    		Recorder: genericclioptions.NoopRecorder{},
    
    		IOStreams: streams,
    	}
    }

//创建set serviceaccount命令
    func NewCmdServiceAccount(f cmdutil.Factory, streams genericclioptions.IOStreams) *cobra.Command {
    	o := NewSetServiceAccountOptions(streams)//初始化结构体
    
    	cmd := &cobra.Command{//创建cobra命令
    		Use:                   "serviceaccount (-f FILENAME | TYPE NAME) SERVICE_ACCOUNT",
    		DisableFlagsInUseLine: true,
    		Aliases:               []string{"sa"},
    		Short:                 i18n.T("Update ServiceAccount of a resource"),
    		Long:                  serviceaccountLong,
    		Example:               serviceaccountExample,
    		Run: func(cmd *cobra.Command, args []string) {
    			cmdutil.CheckErr(o.Complete(f, cmd, args))//准备
    			cmdutil.CheckErr(o.Run())//运行
    		},
    	}
    
    	o.PrintFlags.AddFlags(cmd)//设置print选项
    	o.RecordFlags.AddFlags(cmd)//设置record选项
    
    	usage := "identifying the resource to get from a server."
    	cmdutil.AddFilenameOptionFlags(cmd, &o.fileNameOptions, usage)//设置文件选项
    	cmd.Flags().BoolVar(&o.all, "all", o.all, "Select all resources, including uninitialized ones, in the namespace of the specified resource types")//设置all选项
    	cmd.Flags().BoolVar(&o.local, "local", o.local, "If true, set serviceaccount will NOT contact api-server but run locally.")//设置local选项
    	cmdutil.AddDryRunFlag(cmd)//设置干跑选项
    	cmdutil.AddIncludeUninitializedFlag(cmd)
    	return cmd
    }

//准备
    func (o *SetServiceAccountOptions) Complete(f cmdutil.Factory, cmd *cobra.Command, args []string) error {
    	var err error
    
    	o.RecordFlags.Complete(cmd)//record complete
    	o.Recorder, err = o.RecordFlags.ToRecorder()//recordflag转recorder
    	if err != nil {
    		return err
    	}
    
    	o.shortOutput = cmdutil.GetFlagString(cmd, "output") == "name"//判断output是否为name
    	o.dryRun = cmdutil.GetDryRunFlag(cmd)//设置干跑
    	o.output = cmdutil.GetFlagString(cmd, "output")//设置output
    	o.updatePodSpecForObject = polymorphichelpers.UpdatePodSpecForObjectFn//设置updatePodSpecforObject函数
    
    	if o.dryRun {
    		o.PrintFlags.Complete("%s (dry run)")
    	}
    	printer, err := o.PrintFlags.ToPrinter()//printflag转printer
    	if err != nil {
    		return err
    	}
    	o.PrintObj = printer.PrintObj//设置printObj函数
    
    	cmdNamespace, enforceNamespace, err := f.ToRawKubeConfigLoader().Namespace()//获取namespace和enforceNamespace
    	if err != nil {
    		return err
    	}
    	if len(args) == 0 {//如果参数为空报错
    		return errors.New("serviceaccount is required")
    	}
    	o.serviceAccountName = args[len(args)-1]
    	resources := args[:len(args)-1]
    	builder := f.NewBuilder().
    		WithScheme(scheme.Scheme, scheme.Scheme.PrioritizedVersionsAllGroups()...).
    		LocalParam(o.local).
    		ContinueOnError().
    		NamespaceParam(cmdNamespace).DefaultNamespace().
    		FilenameParam(enforceNamespace, &o.fileNameOptions).
    		Flatten()//构造info对象
    	if !o.local {
    		builder.ResourceTypeOrNameArgs(o.all, resources...).
    			Latest()
    	}
    	o.infos, err = builder.Do().Infos()//设置info对象
    	if err != nil {
    		return err
    	}
    	return nil
    }

func (o *SetServiceAccountOptions) Run() error {
    	patchErrs := []error{}
    	patchFn := func(obj runtime.Object) ([]byte, error) {//创建patch，修改海曙
    		_, err := o.updatePodSpecForObject(obj, func(podSpec *v1.PodSpec) error {//更新pod spec
    			podSpec.ServiceAccountName = o.serviceAccountName//更新serviceaccountName
    			return nil
    		})
    		if err != nil {
    			return nil, err
    		}
    		// record this change (for rollout history)
    		if err := o.Recorder.Record(obj); err != nil {//判断是否创建change-cause注解
    			klog.V(4).Infof("error recording current command: %v", err)
    		}
    
    		return runtime.Encode(scheme.DefaultJSONEncoder(), obj)//对象转json
    	}
    
    	patches := CalculatePatches(o.infos, scheme.DefaultJSONEncoder(), patchFn)//计算patch
    	for _, patch := range patches {//遍历patch
    		info := patch.Info
    		name := info.ObjectName()
    		if patch.Err != nil {//patch有错误则继续
    			patchErrs = append(patchErrs, fmt.Errorf("error: %s %v\n", name, patch.Err))
    			continue
    		}
    		if o.local || o.dryRun {//local或干跑则打印对象，继续
    			if err := o.PrintObj(info.Object, o.Out); err != nil {
    				patchErrs = append(patchErrs, err)
    			}
    			continue
    		}
    		actual, err := resource.NewHelper(info.Client, info.Mapping).Patch(info.Namespace, info.Name, types.StrategicMergePatchType, patch.Patch, nil)//应用patch到服务端
    		if err != nil {
    			patchErrs = append(patchErrs, fmt.Errorf("failed to patch ServiceAccountName %v", err))
    			continue
    		}
    
    		if err := o.PrintObj(actual, o.Out); err != nil {//打印结果
    			patchErrs = append(patchErrs, err)
    		}
    	}
    	return utilerrors.NewAggregate(patchErrs)
    }

[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAaHhwamF2YTE_size_8_color_FFFFFF_t_70_g_se_x_16]: https://img-blog.csdnimg.cn/20211007094240106.jpg?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAaHhwamF2YTE=,size_8,color_FFFFFF,t_70,g_se,x_16
[istio_50]: https://mp.weixin.qq.com/s/_OPMjmWCDSTlmbAxytg33A
[istio]: https://mp.weixin.qq.com/s/kjvtno_UzJAGr1joxm3tvw
[istio_istio]: https://mp.weixin.qq.com/s/e2-p_NY31Mc5y07S4Bb1JQ
[istio 1]: https://mp.weixin.qq.com/s/iTV0SCQLhSOTYncp3PxoHQ
[istio 2]: https://mp.weixin.qq.com/s/eINlrT242RlAwfuZu1_PcA
[envoyfilter_istio_-http-rbac-_AuthorizationPolicy]: https://mp.weixin.qq.com/s/Q-yTGBNqkjOov49LTXPrPA
[envoyfilter_istio_-02-http-corsFilter-_vs]: https://mp.weixin.qq.com/s/bFMdrT7OKSqoWv8pDXOIqQ
[envoyfilter_istio_-03-http-csrf filter-_csrf]: https://mp.weixin.qq.com/s/dlG9phV-kMMxs4UPzuRNYg
[envoyfilter_istio_http-jwt_authn-_RequestAuthorization]: https://mp.weixin.qq.com/s/IfrJ-FdLYsdhPkDrcO_YXA
[envoyfilter_istio_-05-fault-filter-_vs]: https://mp.weixin.qq.com/s/a4gDXqD8uswgglMwkUph2Q
[envoyfilter_istio_-06-http-match-_vs]: https://mp.weixin.qq.com/s/TpS3DHdcaJiPivIS_jsIGw
[envoyfilter_istio_-07-_dr]: https://mp.weixin.qq.com/s/k-zJm7n7OOKg6MotQJYPAA
[envoyfilter_istio_-08-]: https://mp.weixin.qq.com/s/n_bJ3saNeTtXRprIymhwzg
[envoyfilter_istio_-09-http-route filter]: https://mp.weixin.qq.com/s/JAeZr0BMVQxIrB3S_7Ru0A
[envoyfilter_istio_-network filter-redis proxy]: https://mp.weixin.qq.com/s/B9IPTI8F3q42nVkqbQRlPw
[envoyfilter_istio_-network filter-HttpConnectionManager]: https://mp.weixin.qq.com/s/W3OPQWkCVvuHGS49cTNhlg
[envoyfilter_istio_-ratelimit-istio ratelimit]: https://mp.weixin.qq.com/s/KgiDsELNol27mgZvDbFsqw
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h4cGphdmEx_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200524125723190.jpg?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h4cGphdmEx,size_16,color_FFFFFF,t_70