feat: add remote cluster Liqo version detection #3147
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR adds the ability to query a Liqo cluster's version without establishing full peering, using minimal token-based authentication.
Summary of Changes
Version Query Infrastructure:
Created liqo-version ConfigMap to expose cluster version
Set up liqo-version-reader ServiceAccount with minimal RBAC (read access restricted to one specific ConfigMap only)
Auto-generated long-lived token stored in liqo-version-reader-token Secret
All resources created automatically at liqo-controller-manager startup
Public API Functions:
QueryRemoteVersion(): Query remote cluster version with API URL + token
GetLocalVersion(): Retrieve local cluster version from ConfigMap
GetVersionReaderToken(): Extract token from Secret for sharing
Security:
Token restricted to read ONE ConfigMap (liqo-version) in liqo namespace
No list, create, update, or delete permissions
Cannot access any other resources
Motivation
Administrators need to check version compatibility between clusters before initiating peering. This feature enables version queries using only a read-only token, without requiring full peering setup or exchanging cluster credentials.
Fixes # (no related issue)
How Has This Been Tested?
Unit Tests
All 17 version package unit tests pass
Tenant controller unit tests added
Integration Testing
Version resources (ConfigMap, Secret, Role, RoleBinding) created automatically on startup
Token successfully extracted from Secret
Token restricted to read only [object Object] ConfigMap (tested with kubectl)
Token cannot access other ConfigMaps or resources (verified permission denied)
RBAC auto-generated correctly via [object Object]
Test Configuration
Environment: k3s cluster
Liqo installation: liqoctl + custom build script
Kubernetes version: v1.31+