Skip to content

Commit c728cf6

Browse files
joelanfordjoelanford
committed
initial refactoring
1 parent 9a61b22 commit c728cf6

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+2079
-16
lines changed

‎Makefile

Lines changed: 15 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,16 @@ SHELL := /usr/bin/env bash -o pipefail
77
.SHELLFLAGS := -ec
88
export ROOT_DIR := $(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
99

10+
# attempt to generate the VERSION attribute for certificates
11+
# fail if it is unset afterwards, since the side effects are indirect
12+
ifeq ($(strip $(VERSION)),)
13+
VERSION := $(shell git describe --tags --always --dirty)
14+
endif
15+
export VERSION
16+
ifeq ($(strip $(VERSION)),)
17+
$(error undefined VERSION; resulting certs will be invalid)
18+
endif
19+
1020
GOLANG_VERSION := $(shell sed -En 's/^go (.*)$$/\1/p' "go.mod")
1121
# Image URL to use all building/pushing image targets
1222
ifeq ($(origin IMAGE_REGISTRY), undefined)
@@ -25,7 +35,7 @@ endif
2535
export CATD_IMAGE_REPO
2636

2737
ifeq ($(origin IMAGE_TAG), undefined)
28-
IMAGE_TAG := devel
38+
IMAGE_TAG := $(VERSION)
2939
endif
3040
export IMAGE_TAG
3141

@@ -77,7 +87,7 @@ else
7787
$(warning Could not find docker or podman in path! This may result in targets requiring a container runtime failing!)
7888
endif
7989

80-
KUSTOMIZE_BUILD_DIR := config/overlays/cert-manager
90+
KUSTOMIZE_BUILD_DIR := config-new/overlays/community
8191

8292
# Disable -j flag for make
8393
.NOTPARALLEL:
@@ -248,12 +258,11 @@ image-registry: ## Build the testdata catalog used for e2e tests and push it to
248258
# for example: ARTIFACT_PATH=/tmp/artifacts make test-e2e
249259
.PHONY: test-e2e
250260
test-e2e: KIND_CLUSTER_NAME := operator-controller-e2e
251-
test-e2e: KUSTOMIZE_BUILD_DIR := config/overlays/e2e
261+
test-e2e: KUSTOMIZE_BUILD_DIR := config-new/overlays/community-e2e
252262
test-e2e: GO_BUILD_EXTRA_FLAGS := -cover
253263
test-e2e: run image-registry e2e e2e-coverage kind-clean #HELP Run e2e test suite on local kind cluster
254264

255265
.PHONY: extension-developer-e2e
256-
extension-developer-e2e: KUSTOMIZE_BUILD_DIR := config/overlays/cert-manager
257266
extension-developer-e2e: KIND_CLUSTER_NAME := operator-controller-ext-dev-e2e
258267
extension-developer-e2e: export INSTALL_DEFAULT_CATALOGS := false
259268
extension-developer-e2e: run image-registry test-ext-dev-e2e kind-clean #EXHELP Run extension-developer e2e on local kind cluster
@@ -291,7 +300,7 @@ kind-load: $(KIND) #EXHELP Loads the currently constructed images into the KIND
291300
kind-deploy: export MANIFEST := ./operator-controller.yaml
292301
kind-deploy: export DEFAULT_CATALOG := ./config/catalogs/clustercatalogs/default-catalogs.yaml
293302
kind-deploy: manifests $(KUSTOMIZE)
294-
$(KUSTOMIZE) build $(KUSTOMIZE_BUILD_DIR) | sed "s/cert-git-version/cert-$(VERSION)/g" > $(MANIFEST)
303+
$(KUSTOMIZE) build $(KUSTOMIZE_BUILD_DIR) | envsubst '$$VERSION' > operator-controller.yaml
295304
envsubst '$$DEFAULT_CATALOG,$$CERT_MGR_VERSION,$$INSTALL_DEFAULT_CATALOGS,$$MANIFEST' < scripts/install.tpl.sh | bash -s
296305

297306
.PHONY: kind-cluster
@@ -306,16 +315,6 @@ kind-clean: $(KIND) #EXHELP Delete the kind cluster.
306315

307316
#SECTION Build
308317

309-
# attempt to generate the VERSION attribute for certificates
310-
# fail if it is unset afterwards, since the side effects are indirect
311-
ifeq ($(strip $(VERSION)),)
312-
VERSION := $(shell git describe --tags --always --dirty)
313-
endif
314-
export VERSION
315-
ifeq ($(strip $(VERSION)),)
316-
$(error undefined VERSION; resulting certs will be invalid)
317-
endif
318-
319318
ifeq ($(origin CGO_ENABLED), undefined)
320319
CGO_ENABLED := 0
321320
endif
@@ -384,7 +383,7 @@ release: $(GORELEASER) #EXHELP Runs goreleaser for the operator-controller. By d
384383
quickstart: export MANIFEST := https://github.com/operator-framework/operator-controller/releases/download/$(VERSION)/operator-controller.yaml
385384
quickstart: export DEFAULT_CATALOG := "https://github.com/operator-framework/operator-controller/releases/download/$(VERSION)/default-catalogs.yaml"
386385
quickstart: $(KUSTOMIZE) manifests #EXHELP Generate the unified installation release manifests and scripts.
387-
$(KUSTOMIZE) build $(KUSTOMIZE_BUILD_DIR) | sed "s/cert-git-version/cert-$(VERSION)/g" | sed "s/:devel/:$(VERSION)/g" > operator-controller.yaml
386+
$(KUSTOMIZE) build $(KUSTOMIZE_BUILD_DIR) | envsubst '$$VERSION' > operator-controller.yaml
388387
envsubst '$$DEFAULT_CATALOG,$$CERT_MGR_VERSION,$$INSTALL_DEFAULT_CATALOGS,$$MANIFEST' < scripts/install.tpl.sh > install.sh
389388

390389
##@ Docs

‎config-new/base/catalogd/crd/bases/olm.operatorframework.io_clustercatalogs.yaml

Lines changed: 441 additions & 0 deletions
Large diffs are not rendered by default.

‎config-new/base/catalogd/crd/kustomization.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
4+
resources:
5+
- bases/olm.operatorframework.io_clustercatalogs.yaml
6+
- mutating_webhook_configuration.yaml

‎config-new/base/catalogd/crd/mutating_webhook_configuration.yaml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
apiVersion: admissionregistration.k8s.io/v1
3+
kind: MutatingWebhookConfiguration
4+
metadata:
5+
name: mutating-webhook-configuration
6+
webhooks:
7+
- admissionReviewVersions:
8+
- v1
9+
clientConfig:
10+
service:
11+
name: service
12+
namespace: __NAMESPACE_PLACEHOLDER__
13+
path: /mutate-olm-operatorframework-io-v1-clustercatalog
14+
port: 9443
15+
failurePolicy: Fail
16+
matchConditions:
17+
- expression: "'name' in object.metadata && (!has(object.metadata.labels) || !('olm.operatorframework.io/metadata.name' in object.metadata.labels) || object.metadata.labels['olm.operatorframework.io/metadata.name'] != object.metadata.name)"
18+
name: MissingOrIncorrectMetadataNameLabel
19+
name: inject-metadata-name.olm.operatorframework.io
20+
rules:
21+
- apiGroups:
22+
- olm.operatorframework.io
23+
apiVersions:
24+
- v1
25+
operations:
26+
- CREATE
27+
- UPDATE
28+
resources:
29+
- clustercatalogs
30+
sideEffects: None
31+
timeoutSeconds: 10

‎config-new/base/catalogd/kustomization.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
4+
labels:
5+
- pairs:
6+
app.kubernetes.io/name: catalogd
7+
includeTemplates: false
8+
includeSelectors: false
9+
10+
namePrefix: catalogd-
11+
12+
resources:
13+
- crd
14+
- rbac
15+
- manager
16+

‎config-new/base/catalogd/manager/deployment.yaml

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: controller-manager
5+
namespace: __NAMESPACE_PLACEHOLDER__
6+
annotations:
7+
kubectl.kubernetes.io/default-logs-container: manager
8+
spec:
9+
replicas: 1
10+
minReadySeconds: 5
11+
template:
12+
metadata:
13+
annotations:
14+
kubectl.kubernetes.io/default-container: manager
15+
spec:
16+
affinity:
17+
nodeAffinity:
18+
requiredDuringSchedulingIgnoredDuringExecution:
19+
nodeSelectorTerms:
20+
- matchExpressions:
21+
- key: kubernetes.io/arch
22+
operator: In
23+
values:
24+
- amd64
25+
- arm64
26+
- ppc64le
27+
- s390x
28+
- key: kubernetes.io/os
29+
operator: In
30+
values:
31+
- linux
32+
securityContext:
33+
runAsNonRoot: true
34+
seccompProfile:
35+
type: RuntimeDefault
36+
containers:
37+
- command:
38+
- ./catalogd
39+
args:
40+
- --leader-elect
41+
- --metrics-bind-address=:7443
42+
- --external-address=catalogd-service.$(POD_NAMESPACE).svc
43+
env:
44+
- name: POD_NAMESPACE
45+
valueFrom:
46+
fieldRef:
47+
fieldPath: metadata.namespace
48+
image: controller:latest
49+
name: manager
50+
volumeMounts:
51+
- name: cache
52+
mountPath: /var/cache/
53+
securityContext:
54+
allowPrivilegeEscalation: false
55+
capabilities:
56+
drop:
57+
- ALL
58+
livenessProbe:
59+
httpGet:
60+
path: /healthz
61+
port: 8081
62+
initialDelaySeconds: 15
63+
periodSeconds: 20
64+
readinessProbe:
65+
httpGet:
66+
path: /readyz
67+
port: 8081
68+
initialDelaySeconds: 5
69+
periodSeconds: 10
70+
resources:
71+
requests:
72+
cpu: 100m
73+
memory: 200Mi
74+
imagePullPolicy: IfNotPresent
75+
terminationMessagePolicy: FallbackToLogsOnError
76+
serviceAccountName: controller-manager
77+
terminationGracePeriodSeconds: 10
78+
volumes:
79+
- name: cache
80+
emptyDir: {}

‎config-new/base/catalogd/manager/kustomization.yaml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
4+
resources:
5+
- deployment.yaml
6+
- service.yaml
7+
8+
labels:
9+
- pairs:
10+
control-plane: catalogd-controller-manager
11+
includeSelectors: true
12+
includeTemplates: true
13+
14+
images:
15+
- name: controller
16+
newName: quay.io/operator-framework/catalogd
17+
newTag: ${VERSION}

‎config-new/base/catalogd/manager/service.yaml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: service
5+
namespace: __NAMESPACE_PLACEHOLDER__
6+
spec:
7+
ports:
8+
- name: http
9+
protocol: TCP
10+
port: 80
11+
targetPort: 8443
12+
- name: webhook
13+
protocol: TCP
14+
port: 9443
15+
targetPort: 9443
16+
- name: metrics
17+
protocol: TCP
18+
port: 7443
19+
targetPort: 7443

‎config-new/base/catalogd/rbac/auth_proxy_client_clusterrole.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
labels:
5+
app.kubernetes.io/part-of: olm
6+
app.kubernetes.io/name: catalogd
7+
name: metrics-reader
8+
rules:
9+
- nonResourceURLs:
10+
- "/metrics"
11+
verbs:
12+
- get

‎config-new/base/catalogd/rbac/auth_proxy_role.yaml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: proxy-role
5+
rules:
6+
- apiGroups:
7+
- authentication.k8s.io
8+
resources:
9+
- tokenreviews
10+
verbs:
11+
- create
12+
- apiGroups:
13+
- authorization.k8s.io
14+
resources:
15+
- subjectaccessreviews
16+
verbs:
17+
- create

‎config-new/base/catalogd/rbac/auth_proxy_role_binding.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
name: proxy-rolebinding
5+
roleRef:
6+
apiGroup: rbac.authorization.k8s.io
7+
kind: ClusterRole
8+
name: proxy-role
9+
subjects:
10+
- kind: ServiceAccount
11+
name: controller-manager
12+
namespace: __NAMESPACE_PLACEHOLDER__

‎config-new/base/catalogd/rbac/kustomization.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
4+
resources:
5+
- service_account.yaml
6+
- role.yaml
7+
- role_binding.yaml
8+
- leader_election_role.yaml
9+
- leader_election_role_binding.yaml
10+
11+
# The following RBAC configurations are used to protect
12+
# the metrics endpoint with authn/authz. These configurations
13+
# ensure that only authorized users and service accounts
14+
# can access the metrics endpoint. Comment the following
15+
# permissions if you want to disable this protection.
16+
# More info: https://book.kubebuilder.io/reference/metrics.html
17+
- auth_proxy_role.yaml
18+
- auth_proxy_role_binding.yaml
19+
- auth_proxy_client_clusterrole.yaml
20+
21+
# The following resources are pre-defined roles for editors and viewers
22+
# of APIs provided by this project.
23+
# TODO: CREATE AND ENABLE EDITOR/VIEWER CLUSTER ROLES FOR CATALOGD TO ALIGN WITH OPERATOR_CONTROLLER
24+
#- clustercatalog_editor_role.yaml
25+
#- clustercatalog_viewer_role.yaml

‎config-new/base/catalogd/rbac/leader_election_role.yaml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# permissions to do leader election.
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: Role
4+
metadata:
5+
name: leader-election-role
6+
rules:
7+
- apiGroups:
8+
- ""
9+
resources:
10+
- configmaps
11+
verbs:
12+
- get
13+
- list
14+
- watch
15+
- create
16+
- update
17+
- patch
18+
- delete
19+
- apiGroups:
20+
- coordination.k8s.io
21+
resources:
22+
- leases
23+
verbs:
24+
- get
25+
- list
26+
- watch
27+
- create
28+
- update
29+
- patch
30+
- delete
31+
- apiGroups:
32+
- ""
33+
resources:
34+
- events
35+
verbs:
36+
- create
37+
- patch

‎config-new/base/catalogd/rbac/leader_election_role_binding.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: RoleBinding
3+
metadata:
4+
name: leader-election-rolebinding
5+
roleRef:
6+
apiGroup: rbac.authorization.k8s.io
7+
kind: Role
8+
name: leader-election-role
9+
subjects:
10+
- kind: ServiceAccount
11+
name: controller-manager
12+
namespace: __NAMESPACE_PLACEHOLDER__

0 commit comments

Comments
 (0)