Skip to content

Commit c002f11

Browse files
tmshorttmshort
committed
WIP: Integrate openshift resources
Signed-off-by: Todd Short <[email protected]>
1 parent dadb202 commit c002f11

14 files changed

+167
-103
lines changed

‎helm/olmv1/templates/00-namespace.yml

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,19 +4,21 @@ kind: Namespace
44
metadata:
55
annotations:
66
{{- include "olmv1.annotations" . | nindent 4 }}
7-
{{- with .Values.namespaces.olmv1.annotations }}
8-
{{- toYamlPretty . | nindent 4 }}
7+
{{- if .Values.options.openshift.enabled }}
8+
openshift.io/node-selector: ""
9+
workload.openshift.io/allowed: management
910
{{- end }}
1011
labels:
12+
{{- $psProfile := ternary "privileged" "restricted" .Values.options.openshift.enabled }}
1113
app.kubernetes.io/name: {{ include "olmv1.label.name" . }}
12-
pod-security.kubernetes.io/audit: {{ .Values.namespaces.olmv1.podSecurityProfile }}
14+
pod-security.kubernetes.io/audit: {{ $psProfile }}
1315
pod-security.kubernetes.io/audit-version: latest
14-
pod-security.kubernetes.io/enforce: {{ .Values.namespaces.olmv1.podSecurityProfile }}
16+
pod-security.kubernetes.io/enforce: {{ $psProfile }}
1517
pod-security.kubernetes.io/enforce-version: latest
16-
pod-security.kubernetes.io/warn: {{ .Values.namespaces.olmv1.podSecurityProfile }}
18+
pod-security.kubernetes.io/warn: {{ $psProfile }}
1719
pod-security.kubernetes.io/warn-version: latest
1820
{{- include "olmv1.labels" . | nindent 4 }}
19-
{{- with .Values.namespaces.olmv1.labels }}
20-
{{- toYamlPretty . | nindent 4 }}
21+
{{- if .Values.options.openshift.enabled }}
22+
openshift.io/cluster-monitoring: "true"
2123
{{- end }}
2224
name: {{ .Values.namespaces.olmv1.name }}

‎helm/olmv1/templates/09-clusterrole-catalogd-manager-role.yml

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,5 +35,14 @@ rules:
3535
- get
3636
- patch
3737
- update
38-
{{- include "olmv1.catalogd.clusterRole.rules" . | nindent 2 }}
38+
{{- if .Values.options.openshift.enabled }}
39+
- apiGroups:
40+
- security.openshift.io
41+
resources:
42+
- securitycontextconstraints
43+
resourceNames:
44+
- privileged
45+
verbs:
46+
- use
47+
{{- end }}
3948
{{- end }}

‎helm/olmv1/templates/14-clusterrole-operator-controller-manager-role.yml

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,5 +62,14 @@ rules:
6262
verbs:
6363
- list
6464
- watch
65-
{{- include "olmv1.operatorController.clusterRole.rules" . | nindent 2 }}
65+
{{- if .Values.options.openshift.enabled }}
66+
- apiGroups:
67+
- security.openshift.io
68+
resources:
69+
- securitycontextconstraints
70+
resourceNames:
71+
- privileged
72+
verbs:
73+
- use
74+
{{- end }}
6675
{{- end }}

‎helm/olmv1/templates/26-service-olmv1-system-catalogd-service.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ kind: Service
44
metadata:
55
annotations:
66
{{- include "olmv1.annotations" . | nindent 4 }}
7-
{{- with .Values.options.catalogd.service.annotations }}
8-
{{- toYaml . | nindent 4 }}
7+
{{- if .Values.options.openshift.enabled }}
8+
service.beta.openshift.io/serving-cert-secret-name: catalogserver-cert
99
{{- end }}
1010
labels:
1111
app.kubernetes.io/name: catalogd

‎helm/olmv1/templates/27-service-olmv1-system-operator-controller-service.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ kind: Service
44
metadata:
55
annotations:
66
{{- include "olmv1.annotations" . | nindent 4 }}
7-
{{- with .Values.options.operatorController.service.annotations }}
8-
{{- toYaml . | nindent 4 }}
7+
{{- if .Values.options.openshift.enabled }}
8+
service.beta.openshift.io/serving-cert-secret-name: operator-controller-cert
99
{{- end }}
1010
labels:
1111
app.kubernetes.io/name: operator-controller

‎helm/olmv1/templates/29-deployment-olmv1-system-catalogd-controller-manager.yml

Lines changed: 62 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,9 @@ spec:
2121
annotations:
2222
kubectl.kubernetes.io/default-container: manager
2323
{{- include "olmv1.annotations" . | nindent 8 }}
24-
{{- with .Values.options.catalogd.deployment.podAnnotations }}
25-
{{- toYamlPretty . | nindent 8 }}
24+
{{- if .Values.options.openshift.enabled }}
25+
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
26+
openshift.io/required-scc: privileged
2627
{{- end }}
2728
labels:
2829
app.kubernetes.io/name: catalogd
@@ -46,33 +47,34 @@ spec:
4647
- --tls-cert=/var/certs/tls.crt
4748
- --tls-key=/var/certs/tls.key
4849
- --pull-cas-dir=/var/ca-certs
49-
{{- end }}
50-
{{- with .Values.options.catalogd.deployment.podArguments }}
51-
{{- toYaml . | nindent 12 }}
50+
{{- else if .Values.options.openshift.enabled }}
51+
- --tls-cert=/var/certs/tls.crt
52+
- --tls-key=/var/certs/tls.key
53+
- --v=${LOG_VERBOSITY}
54+
- --global-pull-secret=openshift-config/pull-secret
5255
{{- end }}
5356
command:
5457
- ./catalogd
55-
{{- if or .Values.options.e2e.enabled .Values.options.catalogd.deployment.env }}
58+
{{- if or .Values.options.e2e.enabled .Values.options.openshift.enabled }}
5659
env:
57-
{{- end }}
5860
{{- if .Values.options.e2e.enabled }}
5961
- name: GOCOVERDIR
6062
value: /e2e-coverage
6163
{{- end }}
62-
{{- with .Values.options.catalogd.deployment.env }}
63-
{{- toYamlPretty . | nindent 12 }}
64+
{{- with .Values.options.openshift.enabled }}
65+
- name: SSL_CERT_DIR
66+
value: /var/ca-certs
67+
{{- end }}
6468
{{- end }}
6569
image: "{{ .Values.options.catalogd.deployment.image }}"
70+
name: manager
6671
{{- if not .Values.options.tilt.enabled }}
6772
livenessProbe:
6873
httpGet:
6974
path: /healthz
7075
port: 8081
7176
initialDelaySeconds: 15
7277
periodSeconds: 20
73-
{{- end }}
74-
name: manager
75-
{{- if not .Values.options.tilt.enabled }}
7678
readinessProbe:
7779
httpGet:
7880
path: /readyz
@@ -99,13 +101,22 @@ spec:
99101
- mountPath: /var/ca-certs
100102
name: ca-certs
101103
readOnly: true
104+
{{- else if .Values.options.openshift.enabled }}
105+
- mountPath: /var/certs
106+
name: catalogserver-certs
107+
- mountPath: /var/ca-certs
108+
name: ca-certs
109+
readOnly: true
110+
- mountPath: /etc/containers
111+
name: etc-containers
112+
readOnly: true
113+
- mountPath: /etc/docker
114+
name: etc-docker
115+
readOnly: true
102116
{{- end }}
103-
{{- with .Values.options.catalogd.deployment.volumeMounts }}
104-
{{- toYamlPretty . | nindent 12 }}
105-
{{- end }}
106-
{{- with .Values.deployments.containerSpec }}
107-
{{- toYamlPretty . | nindent 10 }}
108-
{{- end }}
117+
{{- with .Values.deployments.containerSpec }}
118+
{{- toYamlPretty . | nindent 10 }}
119+
{{- end }}
109120
serviceAccountName: catalogd-controller-manager
110121
volumes:
111122
{{- if .Values.options.e2e.enabled }}
@@ -134,9 +145,39 @@ spec:
134145
path: olm-ca.crt
135146
optional: false
136147
secretName: catalogd-service-cert-git-version
137-
{{- end }}
138-
{{- with .Values.options.catalogd.deployment.volumes }}
139-
{{- toYaml . | nindent 8 }}
148+
{{- else if .Values.options.openshift.enabled }}
149+
- name: catalogserver-certs
150+
secret:
151+
items:
152+
- key: tls.crt
153+
path: tls.crt
154+
- key: tls.key
155+
path: tls.key
156+
optional: false
157+
secretName: catalogserver-cert
158+
- name: ca-certs
159+
projected:
160+
sources:
161+
- configMap:
162+
items:
163+
- key: ca-bundle.crt
164+
path: ca-bundle.crt
165+
name: catalogd-trusted-ca-bundle
166+
optional: false
167+
- configMap:
168+
items:
169+
- key: service-ca.crt
170+
path: service-ca.crt
171+
name: openshift-service-ca.crt
172+
optional: false
173+
- hostPath:
174+
path: /etc/containers
175+
type: Directory
176+
name: etc-containers
177+
- hostPath:
178+
path: /etc/docker
179+
type: Directory
180+
name: etc-docker
140181
{{- end }}
141182
{{- with .Values.deployments.templateSpec }}
142183
{{- toYamlPretty . | nindent 6 }}

‎helm/olmv1/templates/30-deployment-olmv1-system-operator-controller-controller-manager.yml

Lines changed: 60 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,9 @@ spec:
2020
annotations:
2121
kubectl.kubernetes.io/default-container: manager
2222
{{- include "olmv1.annotations" . | nindent 8 }}
23-
{{- with .Values.options.operatorController.deployment.podAnnotations }}
24-
{{- toYamlPretty . | nindent 8 }}
23+
{{- if .Values.options.openshift.enabled }}
24+
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
25+
openshift.io/required-scc: privileged
2526
{{- end }}
2627
labels:
2728
app.kubernetes.io/name: operator-controller
@@ -46,33 +47,35 @@ spec:
4647
- --pull-cas-dir=/var/ca-certs
4748
- --tls-cert=/var/certs/tls.crt
4849
- --tls-key=/var/certs/tls.key
49-
{{- end }}
50-
{{- with .Values.options.operatorController.deployment.podArguments }}
51-
{{- toYamlPretty . | nindent 12 }}
50+
{{- else if .Values.options.openshift.enabled }}
51+
- --tls-cert=/var/certs/tls.crt
52+
- --tls-key=/var/certs/tls.key
53+
- --catalogd-cas-dir=/var/ca-certs
54+
- --v=${LOG_VERBOSITY}
55+
- --global-pull-secret=openshift-config/pull-secret
5256
{{- end }}
5357
command:
5458
- /operator-controller
55-
{{- if or .Values.options.e2e.enabled .Values.options.operatorController.deployment.env }}
59+
{{- if or .Values.options.e2e.enabled .Values.options.openshift.enabled }}
5660
env:
57-
{{- end }}
5861
{{- if .Values.options.e2e.enabled }}
5962
- name: GOCOVERDIR
6063
value: /e2e-coverage
6164
{{- end }}
62-
{{- with .Values.options.operatorController.deployment.env }}
63-
{{- toYamlPretty . | nindent 12 }}
65+
{{- if .Values.options.openshift.enabled }}
66+
- name: SSL_CERT_DIR
67+
value: /var/ca-certs
68+
{{- end }}
6469
{{- end }}
6570
image: "{{ .Values.options.operatorController.deployment.image }}"
71+
name: manager
6672
{{- if not .Values.options.tilt.enabled }}
6773
livenessProbe:
6874
httpGet:
6975
path: /healthz
7076
port: 8081
7177
initialDelaySeconds: 15
7278
periodSeconds: 20
73-
{{- end }}
74-
name: manager
75-
{{- if not .Values.options.tilt.enabled }}
7679
readinessProbe:
7780
httpGet:
7881
path: /readyz
@@ -102,9 +105,18 @@ spec:
102105
- mountPath: /var/ca-certs
103106
name: ca-certs
104107
readOnly: true
105-
{{- end }}
106-
{{- with .Values.options.operatorController.deployment.volumeMounts }}
107-
{{- toYaml . | nindent 12 }}
108+
{{- else if .Values.options.openshift.enabled }}
109+
- mountPath: /var/certs
110+
name: operator-controller-certs
111+
- mountPath: /var/ca-certs
112+
name: ca-certs
113+
readOnly: true
114+
- mountPath: /etc/containers
115+
name: etc-containers
116+
readOnly: true
117+
- mountPath: /etc/docker
118+
name: etc-docker
119+
readOnly: true
108120
{{- end }}
109121
{{- with .Values.deployments.containerSpec }}
110122
{{- toYaml . | nindent 10 }}
@@ -140,9 +152,39 @@ spec:
140152
path: olm-ca.crt
141153
optional: false
142154
secretName: operator-controller-cert
143-
{{- end }}
144-
{{- with .Values.options.operatorController.deployment.volumes }}
145-
{{- toYaml . | nindent 8 }}
155+
{{- else if .Values.options.openshift.enabled }}
156+
- name: operator-controller-certs
157+
secret:
158+
items:
159+
- key: tls.crt
160+
path: tls.crt
161+
- key: tls.key
162+
path: tls.key
163+
optional: false
164+
secretName: operator-controller-cert
165+
- name: ca-certs
166+
projected:
167+
sources:
168+
- configMap:
169+
items:
170+
- key: ca-bundle.crt
171+
path: ca-bundle.crt
172+
name: operator-controller-trusted-ca-bundle
173+
optional: false
174+
- configMap:
175+
items:
176+
- key: service-ca.crt
177+
path: service-ca.crt
178+
name: openshift-service-ca.crt
179+
optional: false
180+
- hostPath:
181+
path: /etc/containers
182+
type: Directory
183+
name: etc-containers
184+
- hostPath:
185+
path: /etc/docker
186+
type: Directory
187+
name: etc-docker
146188
{{- end }}
147189
{{- with .Values.deployments.templateSpec }}
148190
{{- toYamlPretty . | nindent 6 }}

‎helm/olmv1/templates/40-mutatingwebhookconfiguration-catalogd-mutating-webhook-configuration.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@ metadata:
1010
{{- if .Values.options.certManager.enabled }}
1111
cert-manager.io/inject-ca-from-secret: cert-manager/olmv1-ca
1212
{{- end }}
13-
{{- with .Values.options.catalogd.webhook.annotations }}
14-
{{- toYamlPretty . | nindent 4 }}
13+
{{- if .Values.options.openshift.enabled }}
14+
service.beta.openshift.io/inject-cabundle: "true"
1515
{{- end }}
1616
{{- include "olmv1.annotations" . | nindent 4 }}
1717
webhooks:

‎helm/olmv1/templates/_helpers.tpl

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -41,18 +41,6 @@ olm.operatorframework.io/feature-set: {{ .Values.options.featureSet -}}{{- if .V
4141
Insertion of additional rules for RBAC
4242
*/}}
4343

44-
{{- define "olmv1.catalogd.clusterRole.rules" -}}
45-
{{- with .Values.options.catalogd.clusterRole.rules }}
46-
{{- toYamlPretty . }}
47-
{{- end }}
48-
{{- end }}
49-
50-
{{- define "olmv1.operatorController.clusterRole.rules" -}}
51-
{{- with .Values.options.operatorController.clusterRole.rules }}
52-
{{- toYamlPretty . }}
53-
{{- end }}
54-
{{- end }}
55-
5644
{{/*
5745
Returns "operator-controller", "catalogd" or "olmv1" depending on enabled components
5846
*/}}

0 commit comments

Comments
 (0)