Update CRDs

.travis.yml

@@ -1,7 +1,7 @@
 language: go
 
 go:
-  - "1.11"
+  - "1.12"
 
 install:
   - wget https://github.com/google/protobuf/releases/download/v3.0.2/protoc-3.0.2-linux-x86_64.zip

Makefile

@@ -1,33 +1,50 @@
 all: build
 .PHONY: all
 
-RUNTIME ?= podman
-RUNTIME_IMAGE_NAME ?= openshift-api-generator
+# Include the library makefile
+include $(addprefix ./hack/alpha-build-machinery/make/, \
+	golang.mk \
+	targets/openshift/deps.mk \
+	targets/openshift/crd-schema-gen.mk \
+)
 
-build:
-	go build github.com/openshift/api/...
-.PHONY: build
+GO_PACKAGES :=$(addsuffix ...,$(addprefix ./,$(filter-out vendor/,$(filter-out hack/,$(wildcard */)))))
+GO_BUILD_PACKAGES :=$(GO_PACKAGES)
+GO_BUILD_PACKAGES_EXPANDED :=$(GO_BUILD_PACKAGES)
+# LDFLAGS are not needed for dummy builds (saving time on calling git commands)
+GO_LD_FLAGS:=
 
-test:
-	go test github.com/openshift/api/...
-.PHONY: test
+# Set crd-schema-gen variables
+CONTROLLER_GEN_VERSION :=v0.2.1
 
-verify:
+# $1 - target name
+# $2 - apis
+# $3 - manifests
+# $4 - output
+$(call add-crd-gen,authorization,./authorization/v1,./authorization/v1,./authorization/v1)
+$(call add-crd-gen,config,./config/v1,./config/v1,./config/v1)
+$(call add-crd-gen,console,./console/v1,./console/v1,./console/v1)
+$(call add-crd-gen,operator,./operator/v1alpha1,./operator/v1alpha1,./operator/v1alpha1)
+$(call add-crd-gen,quota,./quota/v1,./quota/v1,./quota/v1)
+$(call add-crd-gen,security,./security/v1,./security/v1,./security/v1)
+
+RUNTIME ?= podman
+RUNTIME_IMAGE_NAME ?= openshift-api-generator
+
+verify-scripts:
 	bash -x hack/verify-deepcopy.sh
 	bash -x hack/verify-protobuf.sh
 	bash -x hack/verify-swagger-docs.sh
-.PHONY: verify
-
-update-deps:
-	hack/update-deps.sh
-.PHONY: update-deps
+.PHONY: verify-scripts
+verify: verify-scripts
 
-generate-with-container: Dockerfile.build
-	$(RUNTIME) build -t $(RUNTIME_IMAGE_NAME) -f Dockerfile.build .
-	$(RUNTIME) run -ti --rm -v $(PWD):/go/src/github.com/openshift/api:z -w /go/src/github.com/openshift/api $(RUNTIME_IMAGE_NAME) make generate
-
-generate:
+update-scripts:
 	hack/update-deepcopy.sh
 	hack/update-protobuf.sh
 	hack/update-swagger-docs.sh
-.PHONY: generate
+.PHONY: update-scripts
+update: update-scripts
+
+generate-with-container: Dockerfile.build
+	$(RUNTIME) build -t $(RUNTIME_IMAGE_NAME) -f Dockerfile.build .
+	$(RUNTIME) run -ti --rm -v $(PWD):/go/src/github.com/openshift/api:z -w /go/src/github.com/openshift/api $(RUNTIME_IMAGE_NAME) make update-scripts

authorization/v1/0000_03_authorization-openshift_01_rolebindingrestriction.crd.yaml

@@ -0,0 +1,205 @@
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: rolebindingrestrictions.authorization.openshift.io
+spec:
+  group: authorization.openshift.io
+  names:
+    kind: RoleBindingRestriction
+    listKind: RoleBindingRestrictionList
+    plural: rolebindingrestrictions
+    singular: rolebindingrestriction
+  scope: Namespaced
+  versions:
+  - name: v1
+    served: true
+    storage: true
+  "validation":
+    "openAPIV3Schema":
+      description: RoleBindingRestriction is an object that can be matched against
+        a subject (user, group, or service account) to determine whether rolebindings
+        on that subject are allowed in the namespace to which the RoleBindingRestriction
+        belongs.  If any one of those RoleBindingRestriction objects matches a subject,
+        rolebindings on that subject in the namespace are allowed.
+      type: object
+      properties:
+        apiVersion:
+          description: 'APIVersion defines the versioned schema of this representation
+            of an object. Servers should convert recognized schemas to the latest
+            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+          type: string
+        kind:
+          description: 'Kind is a string value representing the REST resource this
+            object represents. Servers may infer this from the endpoint the client
+            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+          type: string
+        metadata:
+          description: Standard object's metadata.
+          type: object
+        spec:
+          description: Spec defines the matcher.
+          type: object
+          properties:
+            grouprestriction:
+              description: GroupRestriction matches against group subjects.
+              type: object
+              properties:
+                groups:
+                  description: Groups is a list of groups used to match against an
+                    individual user's groups. If the user is a member of one of the
+                    whitelisted groups, the user is allowed to be bound to a role.
+                  type: array
+                  items:
+                    type: string
+                  nullable: true
+                labels:
+                  description: Selectors specifies a list of label selectors over
+                    group labels.
+                  type: array
+                  items:
+                    description: A label selector is a label query over a set of resources.
+                      The result of matchLabels and matchExpressions are ANDed. An
+                      empty label selector matches all objects. A null label selector
+                      matches no objects.
+                    type: object
+                    properties:
+                      matchExpressions:
+                        description: matchExpressions is a list of label selector
+                          requirements. The requirements are ANDed.
+                        type: array
+                        items:
+                          description: A label selector requirement is a selector
+                            that contains values, a key, and an operator that relates
+                            the key and values.
+                          type: object
+                          required:
+                          - key
+                          - operator
+                          properties:
+                            key:
+                              description: key is the label key that the selector
+                                applies to.
+                              type: string
+                            operator:
+                              description: operator represents a key's relationship
+                                to a set of values. Valid operators are In, NotIn,
+                                Exists and DoesNotExist.
+                              type: string
+                            values:
+                              description: values is an array of string values. If
+                                the operator is In or NotIn, the values array must
+                                be non-empty. If the operator is Exists or DoesNotExist,
+                                the values array must be empty. This array is replaced
+                                during a strategic merge patch.
+                              type: array
+                              items:
+                                type: string
+                      matchLabels:
+                        description: matchLabels is a map of {key,value} pairs. A
+                          single {key,value} in the matchLabels map is equivalent
+                          to an element of matchExpressions, whose key field is "key",
+                          the operator is "In", and the values array contains only
+                          "value". The requirements are ANDed.
+                        type: object
+                        additionalProperties:
+                          type: string
+                  nullable: true
+              nullable: true
+            serviceaccountrestriction:
+              description: ServiceAccountRestriction matches against service-account
+                subjects.
+              type: object
+              properties:
+                namespaces:
+                  description: Namespaces specifies a list of literal namespace names.
+                  type: array
+                  items:
+                    type: string
+                serviceaccounts:
+                  description: ServiceAccounts specifies a list of literal service-account
+                    names.
+                  type: array
+                  items:
+                    description: ServiceAccountReference specifies a service account
+                      and namespace by their names.
+                    type: object
+                    properties:
+                      name:
+                        description: Name is the name of the service account.
+                        type: string
+                      namespace:
+                        description: Namespace is the namespace of the service account.  Service
+                          accounts from inside the whitelisted namespaces are allowed
+                          to be bound to roles.  If Namespace is empty, then the namespace
+                          of the RoleBindingRestriction in which the ServiceAccountReference
+                          is embedded is used.
+                        type: string
+              nullable: true
+            userrestriction:
+              description: UserRestriction matches against user subjects.
+              type: object
+              properties:
+                groups:
+                  description: Groups specifies a list of literal group names.
+                  type: array
+                  items:
+                    type: string
+                  nullable: true
+                labels:
+                  description: Selectors specifies a list of label selectors over
+                    user labels.
+                  type: array
+                  items:
+                    description: A label selector is a label query over a set of resources.
+                      The result of matchLabels and matchExpressions are ANDed. An
+                      empty label selector matches all objects. A null label selector
+                      matches no objects.
+                    type: object
+                    properties:
+                      matchExpressions:
+                        description: matchExpressions is a list of label selector
+                          requirements. The requirements are ANDed.
+                        type: array
+                        items:
+                          description: A label selector requirement is a selector
+                            that contains values, a key, and an operator that relates
+                            the key and values.
+                          type: object
+                          required:
+                          - key
+                          - operator
+                          properties:
+                            key:
+                              description: key is the label key that the selector
+                                applies to.
+                              type: string
+                            operator:
+                              description: operator represents a key's relationship
+                                to a set of values. Valid operators are In, NotIn,
+                                Exists and DoesNotExist.
+                              type: string
+                            values:
+                              description: values is an array of string values. If
+                                the operator is In or NotIn, the values array must
+                                be non-empty. If the operator is Exists or DoesNotExist,
+                                the values array must be empty. This array is replaced
+                                during a strategic merge patch.
+                              type: array
+                              items:
+                                type: string
+                      matchLabels:
+                        description: matchLabels is a map of {key,value} pairs. A
+                          single {key,value} in the matchLabels map is equivalent
+                          to an element of matchExpressions, whose key field is "key",
+                          the operator is "In", and the values array contains only
+                          "value". The requirements are ANDed.
+                        type: object
+                        additionalProperties:
+                          type: string
+                  nullable: true
+                users:
+                  description: Users specifies a list of literal user names.
+                  type: array
+                  items:
+                    type: string
+              nullable: true

config/v1/0000_03_config-operator_01_operatorhub.crd.yaml

@@ -0,0 +1,100 @@
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: operatorhubs.config.openshift.io
+spec:
+  group: config.openshift.io
+  names:
+    kind: OperatorHub
+    listKind: OperatorHubList
+    plural: operatorhubs
+    singular: operatorhub
+  scope: Cluster
+  subresources:
+    status: {}
+  version: v1
+  versions:
+  - name: v1
+    served: true
+    storage: true
+  "validation":
+    "openAPIV3Schema":
+      description: OperatorHub is the Schema for the operatorhubs API. It can be used
+        to change the state of the default hub sources for OperatorHub on the cluster
+        from enabled to disabled and vice versa.
+      type: object
+      properties:
+        apiVersion:
+          description: 'APIVersion defines the versioned schema of this representation
+            of an object. Servers should convert recognized schemas to the latest
+            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+          type: string
+        kind:
+          description: 'Kind is a string value representing the REST resource this
+            object represents. Servers may infer this from the endpoint the client
+            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+          type: string
+        metadata:
+          type: object
+        spec:
+          description: OperatorHubSpec defines the desired state of OperatorHub
+          type: object
+          properties:
+            disableAllDefaultSources:
+              description: disableAllDefaultSources allows you to disable all the
+                default hub sources. If this is true, a specific entry in sources
+                can be used to enable a default source. If this is false, a specific
+                entry in sources can be used to disable or enable a default source.
+              type: boolean
+            sources:
+              description: sources is the list of default hub sources and their configuration.
+                If the list is empty, it implies that the default hub sources are
+                enabled on the cluster unless disableAllDefaultSources is true. If
+                disableAllDefaultSources is true and sources is not empty, the configuration
+                present in sources will take precedence. The list of default hub sources
+                and their current state will always be reflected in the status block.
+              type: array
+              items:
+                description: HubSource is used to specify the hub source and its configuration
+                type: object
+                properties:
+                  disabled:
+                    description: disabled is used to disable a default hub source
+                      on cluster
+                    type: boolean
+                  name:
+                    description: name is the name of one of the default hub sources
+                    type: string
+                    maxLength: 253
+                    minLength: 1
+        status:
+          description: OperatorHubStatus defines the observed state of OperatorHub.
+            The current state of the default hub sources will always be reflected
+            here.
+          type: object
+          properties:
+            sources:
+              description: sources encapsulates the result of applying the configuration
+                for each hub source
+              type: array
+              items:
+                description: HubSourceStatus is used to reflect the current state
+                  of applying the configuration to a default source
+                type: object
+                properties:
+                  disabled:
+                    description: disabled is used to disable a default hub source
+                      on cluster
+                    type: boolean
+                  message:
+                    description: message provides more information regarding failures
+                    type: string
+                  name:
+                    description: name is the name of one of the default hub sources
+                    type: string
+                    maxLength: 253
+                    minLength: 1
+                  status:
+                    description: status indicates success or failure in applying the
+                      configuration
+                    type: string