From 00f5c0bedb6ca098dbc62a5549b71088c8012502 Mon Sep 17 00:00:00 2001 From: Joe Lanford Date: Sat, 24 Jun 2023 01:15:50 -0400 Subject: [PATCH 01/14] add rukpak Signed-off-by: Joe Lanford --- .../rukpak/01-namespace--openshift-rukpak.yml | 10 + ...tion--bundledeployments.core.rukpak.io.yml | 270 +++++++++++++ ...urcedefinition--bundles.core.rukpak.io.yml | 357 ++++++++++++++++++ ...iceaccount-openshift-rukpak-core-admin.yml | 8 + ...penshift-rukpak-helm-provisioner-admin.yml | 8 + ...openshift-rukpak-rukpak-webhooks-admin.yml | 8 + .../rukpak/08-clusterrole--bundle-reader.yml | 12 + .../09-clusterrole--bundle-uploader.yml | 12 + assets/rukpak/10-clusterrole--core-admin.yml | 95 +++++ ...12-clusterrole--helm-provisioner-admin.yml | 95 +++++ .../13-clusterrole--rukpak-webhooks-admin.yml | 22 ++ .../14-clusterrolebinding--core-admin.yml | 16 + ...terrolebinding--helm-provisioner-admin.yml | 16 + ...sterrolebinding--rukpak-webhooks-admin.yml | 16 + .../19-service-openshift-rukpak-core.yml | 16 + ...vice-openshift-rukpak-helm-provisioner.yml | 15 + ...penshift-rukpak-rukpak-webhook-service.yml | 15 + .../23-deployment-openshift-rukpak-core.yml | 108 ++++++ ...ment-openshift-rukpak-helm-provisioner.yml | 103 +++++ ...yment-openshift-rukpak-rukpak-webhooks.yml | 56 +++ ...ukpak-validating-webhook-configuration.yml | 52 +++ cmd/cluster-olm-operator/main.go | 102 ++++- 22 files changed, 1411 insertions(+), 1 deletion(-) create mode 100644 assets/rukpak/01-namespace--openshift-rukpak.yml create mode 100644 assets/rukpak/02-customresourcedefinition--bundledeployments.core.rukpak.io.yml create mode 100644 assets/rukpak/03-customresourcedefinition--bundles.core.rukpak.io.yml create mode 100644 assets/rukpak/05-serviceaccount-openshift-rukpak-core-admin.yml create mode 100644 assets/rukpak/06-serviceaccount-openshift-rukpak-helm-provisioner-admin.yml create mode 100644 assets/rukpak/07-serviceaccount-openshift-rukpak-rukpak-webhooks-admin.yml create mode 100644 assets/rukpak/08-clusterrole--bundle-reader.yml create mode 100644 assets/rukpak/09-clusterrole--bundle-uploader.yml create mode 100644 assets/rukpak/10-clusterrole--core-admin.yml create mode 100644 assets/rukpak/12-clusterrole--helm-provisioner-admin.yml create mode 100644 assets/rukpak/13-clusterrole--rukpak-webhooks-admin.yml create mode 100644 assets/rukpak/14-clusterrolebinding--core-admin.yml create mode 100644 assets/rukpak/16-clusterrolebinding--helm-provisioner-admin.yml create mode 100644 assets/rukpak/17-clusterrolebinding--rukpak-webhooks-admin.yml create mode 100644 assets/rukpak/19-service-openshift-rukpak-core.yml create mode 100644 assets/rukpak/20-service-openshift-rukpak-helm-provisioner.yml create mode 100644 assets/rukpak/21-service-openshift-rukpak-rukpak-webhook-service.yml create mode 100644 assets/rukpak/23-deployment-openshift-rukpak-core.yml create mode 100644 assets/rukpak/24-deployment-openshift-rukpak-helm-provisioner.yml create mode 100644 assets/rukpak/25-deployment-openshift-rukpak-rukpak-webhooks.yml create mode 100644 assets/rukpak/36-validatingwebhookconfiguration--rukpak-validating-webhook-configuration.yml diff --git a/assets/rukpak/01-namespace--openshift-rukpak.yml b/assets/rukpak/01-namespace--openshift-rukpak.yml new file mode 100644 index 000000000..0f8fd0f4b --- /dev/null +++ b/assets/rukpak/01-namespace--openshift-rukpak.yml @@ -0,0 +1,10 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + annotations: + release.openshift.io/feature-set: TechPreviewNoUpgrade + labels: + pod-security.kubernetes.io/enforce: baseline + pod-security.kubernetes.io/enforce-version: latest + name: openshift-rukpak diff --git a/assets/rukpak/02-customresourcedefinition--bundledeployments.core.rukpak.io.yml b/assets/rukpak/02-customresourcedefinition--bundledeployments.core.rukpak.io.yml new file mode 100644 index 000000000..fccad954b --- /dev/null +++ b/assets/rukpak/02-customresourcedefinition--bundledeployments.core.rukpak.io.yml @@ -0,0 +1,270 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.11.4 + release.openshift.io/feature-set: TechPreviewNoUpgrade + name: bundledeployments.core.rukpak.io +spec: + group: core.rukpak.io + names: + kind: BundleDeployment + listKind: BundleDeploymentList + plural: bundledeployments + shortNames: + - bd + - bds + singular: bundledeployment + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.activeBundle + name: Active Bundle + type: string + - jsonPath: .status.conditions[?(.type=="Installed")].reason + name: Install State + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .spec.provisionerClassName + name: Provisioner + priority: 1 + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: BundleDeployment is the Schema for the bundledeployments API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + properties: + name: + maxLength: 45 + type: string + type: object + spec: + description: BundleDeploymentSpec defines the desired state of BundleDeployment + properties: + config: + description: Config is provisioner specific configurations + type: object + x-kubernetes-preserve-unknown-fields: true + provisionerClassName: + description: ProvisionerClassName sets the name of the provisioner that should reconcile this BundleDeployment. + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + template: + description: Template describes the generated Bundle that this deployment will manage. + properties: + metadata: + description: 'Standard object''s metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata' + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: 'Specification of the desired behavior of the Bundle. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status' + properties: + provisionerClassName: + description: ProvisionerClassName sets the name of the provisioner that should reconcile this BundleDeployment. + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + source: + description: Source defines the configuration for the underlying Bundle content. + properties: + configMaps: + description: ConfigMaps is a list of config map references and their relative directory paths that represent a bundle filesystem. + items: + properties: + configMap: + description: ConfigMap is a reference to a configmap in the rukpak system namespace + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + path: + description: Path is the relative directory path within the bundle where the files from the configmap will be present when the bundle is unpacked. + type: string + required: + - configMap + type: object + type: array + git: + description: Git is the git repository that backs the content of this Bundle. + properties: + auth: + description: Auth configures the authorization method if necessary. + properties: + insecureSkipVerify: + description: InsecureSkipVerify controls whether a client verifies the server's certificate chain and host name. If InsecureSkipVerify is true, the clone operation will accept any certificate presented by the server and any host name in that certificate. In this mode, TLS is susceptible to machine-in-the-middle attacks unless custom verification is used. This should be used only for testing. + type: boolean + secret: + description: Secret contains reference to the secret that has authorization information and is in the namespace that the provisioner is deployed. The secret is expected to contain `data.username` and `data.password` for the username and password, respectively for http(s) scheme. Refer to https://kubernetes.io/docs/concepts/configuration/secret/#basic-authentication-secret For the ssh authorization of the GitSource, the secret is expected to contain `data.ssh-privatekey` and `data.ssh-knownhosts` for the ssh privatekey and the host entry in the known_hosts file respectively. Refer to https://kubernetes.io/docs/concepts/configuration/secret/#ssh-authentication-secrets + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + type: object + directory: + description: Directory refers to the location of the bundle within the git repository. Directory is optional and if not set defaults to ./manifests. + type: string + ref: + description: Ref configures the git source to clone a specific branch, tag, or commit from the specified repo. Ref is required, and exactly one field within Ref is required. Setting more than one field or zero fields will result in an error. + properties: + branch: + description: Branch refers to the branch to checkout from the repository. The Branch should contain the bundle manifests in the specified directory. + type: string + commit: + description: Commit refers to the commit to checkout from the repository. The Commit should contain the bundle manifests in the specified directory. + type: string + tag: + description: Tag refers to the tag to checkout from the repository. The Tag should contain the bundle manifests in the specified directory. + type: string + type: object + repository: + description: Repository is a URL link to the git repository containing the bundle. Repository is required and the URL should be parsable by a standard git tool. + type: string + required: + - ref + - repository + type: object + http: + description: HTTP is the remote location that backs the content of this Bundle. + properties: + auth: + description: Auth configures the authorization method if necessary. + properties: + insecureSkipVerify: + description: InsecureSkipVerify controls whether a client verifies the server's certificate chain and host name. If InsecureSkipVerify is true, the clone operation will accept any certificate presented by the server and any host name in that certificate. In this mode, TLS is susceptible to machine-in-the-middle attacks unless custom verification is used. This should be used only for testing. + type: boolean + secret: + description: Secret contains reference to the secret that has authorization information and is in the namespace that the provisioner is deployed. The secret is expected to contain `data.username` and `data.password` for the username and password, respectively for http(s) scheme. Refer to https://kubernetes.io/docs/concepts/configuration/secret/#basic-authentication-secret For the ssh authorization of the GitSource, the secret is expected to contain `data.ssh-privatekey` and `data.ssh-knownhosts` for the ssh privatekey and the host entry in the known_hosts file respectively. Refer to https://kubernetes.io/docs/concepts/configuration/secret/#ssh-authentication-secrets + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + type: object + url: + description: URL is where the bundle contents is. + type: string + required: + - url + type: object + image: + description: Image is the bundle image that backs the content of this bundle. + properties: + pullSecret: + description: ImagePullSecretName contains the name of the image pull secret in the namespace that the provisioner is deployed. + type: string + ref: + description: Ref contains the reference to a container image containing Bundle contents. + type: string + required: + - ref + type: object + type: + description: Type defines the kind of Bundle content being sourced. + type: string + upload: + description: Upload is a source that enables this Bundle's content to be uploaded via Rukpak's bundle upload service. This source type is primarily useful with bundle development workflows because it enables bundle developers to inject a local bundle directly into the cluster. + type: object + required: + - type + type: object + required: + - provisionerClassName + - source + type: object + required: + - spec + type: object + required: + - provisionerClassName + - template + type: object + status: + description: BundleDeploymentStatus defines the observed state of BundleDeployment + properties: + activeBundle: + type: string + conditions: + items: + description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + observedGeneration: + format: int64 + type: integer + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/assets/rukpak/03-customresourcedefinition--bundles.core.rukpak.io.yml b/assets/rukpak/03-customresourcedefinition--bundles.core.rukpak.io.yml new file mode 100644 index 000000000..0c75e082d --- /dev/null +++ b/assets/rukpak/03-customresourcedefinition--bundles.core.rukpak.io.yml @@ -0,0 +1,357 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.11.4 + release.openshift.io/feature-set: TechPreviewNoUpgrade + name: bundles.core.rukpak.io +spec: + group: core.rukpak.io + names: + kind: Bundle + listKind: BundleList + plural: bundles + singular: bundle + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .spec.source.type + name: Type + type: string + - jsonPath: .status.phase + name: Phase + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .spec.provisionerClassName + name: Provisioner + priority: 1 + type: string + - jsonPath: .status.resolvedSource + name: Resolved Source + priority: 1 + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: Bundle is the Schema for the bundles API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + properties: + name: + maxLength: 52 + type: string + type: object + spec: + description: BundleSpec defines the desired state of Bundle + properties: + provisionerClassName: + description: ProvisionerClassName sets the name of the provisioner that should reconcile this BundleDeployment. + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + source: + description: Source defines the configuration for the underlying Bundle content. + oneOf: + - required: + - git + - required: + - image + - required: + - configMaps + - required: + - upload + - required: + - http + properties: + configMaps: + description: ConfigMaps is a list of config map references and their relative directory paths that represent a bundle filesystem. + items: + properties: + configMap: + description: ConfigMap is a reference to a configmap in the rukpak system namespace + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + path: + description: Path is the relative directory path within the bundle where the files from the configmap will be present when the bundle is unpacked. + type: string + required: + - configMap + type: object + type: array + git: + description: Git is the git repository that backs the content of this Bundle. + properties: + auth: + description: Auth configures the authorization method if necessary. + properties: + insecureSkipVerify: + description: InsecureSkipVerify controls whether a client verifies the server's certificate chain and host name. If InsecureSkipVerify is true, the clone operation will accept any certificate presented by the server and any host name in that certificate. In this mode, TLS is susceptible to machine-in-the-middle attacks unless custom verification is used. This should be used only for testing. + type: boolean + secret: + description: Secret contains reference to the secret that has authorization information and is in the namespace that the provisioner is deployed. The secret is expected to contain `data.username` and `data.password` for the username and password, respectively for http(s) scheme. Refer to https://kubernetes.io/docs/concepts/configuration/secret/#basic-authentication-secret For the ssh authorization of the GitSource, the secret is expected to contain `data.ssh-privatekey` and `data.ssh-knownhosts` for the ssh privatekey and the host entry in the known_hosts file respectively. Refer to https://kubernetes.io/docs/concepts/configuration/secret/#ssh-authentication-secrets + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + type: object + directory: + description: Directory refers to the location of the bundle within the git repository. Directory is optional and if not set defaults to ./manifests. + type: string + ref: + description: Ref configures the git source to clone a specific branch, tag, or commit from the specified repo. Ref is required, and exactly one field within Ref is required. Setting more than one field or zero fields will result in an error. + oneOf: + - required: + - branch + - required: + - commit + - required: + - tag + properties: + branch: + description: Branch refers to the branch to checkout from the repository. The Branch should contain the bundle manifests in the specified directory. + type: string + commit: + description: Commit refers to the commit to checkout from the repository. The Commit should contain the bundle manifests in the specified directory. + type: string + tag: + description: Tag refers to the tag to checkout from the repository. The Tag should contain the bundle manifests in the specified directory. + type: string + type: object + repository: + description: Repository is a URL link to the git repository containing the bundle. Repository is required and the URL should be parsable by a standard git tool. + type: string + required: + - ref + - repository + type: object + http: + description: HTTP is the remote location that backs the content of this Bundle. + properties: + auth: + description: Auth configures the authorization method if necessary. + properties: + insecureSkipVerify: + description: InsecureSkipVerify controls whether a client verifies the server's certificate chain and host name. If InsecureSkipVerify is true, the clone operation will accept any certificate presented by the server and any host name in that certificate. In this mode, TLS is susceptible to machine-in-the-middle attacks unless custom verification is used. This should be used only for testing. + type: boolean + secret: + description: Secret contains reference to the secret that has authorization information and is in the namespace that the provisioner is deployed. The secret is expected to contain `data.username` and `data.password` for the username and password, respectively for http(s) scheme. Refer to https://kubernetes.io/docs/concepts/configuration/secret/#basic-authentication-secret For the ssh authorization of the GitSource, the secret is expected to contain `data.ssh-privatekey` and `data.ssh-knownhosts` for the ssh privatekey and the host entry in the known_hosts file respectively. Refer to https://kubernetes.io/docs/concepts/configuration/secret/#ssh-authentication-secrets + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + type: object + url: + description: URL is where the bundle contents is. + type: string + required: + - url + type: object + image: + description: Image is the bundle image that backs the content of this bundle. + properties: + pullSecret: + description: ImagePullSecretName contains the name of the image pull secret in the namespace that the provisioner is deployed. + type: string + ref: + description: Ref contains the reference to a container image containing Bundle contents. + type: string + required: + - ref + type: object + type: + description: Type defines the kind of Bundle content being sourced. + type: string + upload: + description: Upload is a source that enables this Bundle's content to be uploaded via Rukpak's bundle upload service. This source type is primarily useful with bundle development workflows because it enables bundle developers to inject a local bundle directly into the cluster. + type: object + required: + - type + type: object + required: + - provisionerClassName + - source + type: object + status: + description: BundleStatus defines the observed state of Bundle + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + contentURL: + type: string + observedGeneration: + format: int64 + type: integer + phase: + type: string + resolvedSource: + properties: + configMaps: + description: ConfigMaps is a list of config map references and their relative directory paths that represent a bundle filesystem. + items: + properties: + configMap: + description: ConfigMap is a reference to a configmap in the rukpak system namespace + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + path: + description: Path is the relative directory path within the bundle where the files from the configmap will be present when the bundle is unpacked. + type: string + required: + - configMap + type: object + type: array + git: + description: Git is the git repository that backs the content of this Bundle. + properties: + auth: + description: Auth configures the authorization method if necessary. + properties: + insecureSkipVerify: + description: InsecureSkipVerify controls whether a client verifies the server's certificate chain and host name. If InsecureSkipVerify is true, the clone operation will accept any certificate presented by the server and any host name in that certificate. In this mode, TLS is susceptible to machine-in-the-middle attacks unless custom verification is used. This should be used only for testing. + type: boolean + secret: + description: Secret contains reference to the secret that has authorization information and is in the namespace that the provisioner is deployed. The secret is expected to contain `data.username` and `data.password` for the username and password, respectively for http(s) scheme. Refer to https://kubernetes.io/docs/concepts/configuration/secret/#basic-authentication-secret For the ssh authorization of the GitSource, the secret is expected to contain `data.ssh-privatekey` and `data.ssh-knownhosts` for the ssh privatekey and the host entry in the known_hosts file respectively. Refer to https://kubernetes.io/docs/concepts/configuration/secret/#ssh-authentication-secrets + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + type: object + directory: + description: Directory refers to the location of the bundle within the git repository. Directory is optional and if not set defaults to ./manifests. + type: string + ref: + description: Ref configures the git source to clone a specific branch, tag, or commit from the specified repo. Ref is required, and exactly one field within Ref is required. Setting more than one field or zero fields will result in an error. + properties: + branch: + description: Branch refers to the branch to checkout from the repository. The Branch should contain the bundle manifests in the specified directory. + type: string + commit: + description: Commit refers to the commit to checkout from the repository. The Commit should contain the bundle manifests in the specified directory. + type: string + tag: + description: Tag refers to the tag to checkout from the repository. The Tag should contain the bundle manifests in the specified directory. + type: string + type: object + repository: + description: Repository is a URL link to the git repository containing the bundle. Repository is required and the URL should be parsable by a standard git tool. + type: string + required: + - ref + - repository + type: object + http: + description: HTTP is the remote location that backs the content of this Bundle. + properties: + auth: + description: Auth configures the authorization method if necessary. + properties: + insecureSkipVerify: + description: InsecureSkipVerify controls whether a client verifies the server's certificate chain and host name. If InsecureSkipVerify is true, the clone operation will accept any certificate presented by the server and any host name in that certificate. In this mode, TLS is susceptible to machine-in-the-middle attacks unless custom verification is used. This should be used only for testing. + type: boolean + secret: + description: Secret contains reference to the secret that has authorization information and is in the namespace that the provisioner is deployed. The secret is expected to contain `data.username` and `data.password` for the username and password, respectively for http(s) scheme. Refer to https://kubernetes.io/docs/concepts/configuration/secret/#basic-authentication-secret For the ssh authorization of the GitSource, the secret is expected to contain `data.ssh-privatekey` and `data.ssh-knownhosts` for the ssh privatekey and the host entry in the known_hosts file respectively. Refer to https://kubernetes.io/docs/concepts/configuration/secret/#ssh-authentication-secrets + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + type: object + url: + description: URL is where the bundle contents is. + type: string + required: + - url + type: object + image: + description: Image is the bundle image that backs the content of this bundle. + properties: + pullSecret: + description: ImagePullSecretName contains the name of the image pull secret in the namespace that the provisioner is deployed. + type: string + ref: + description: Ref contains the reference to a container image containing Bundle contents. + type: string + required: + - ref + type: object + type: + description: Type defines the kind of Bundle content being sourced. + type: string + upload: + description: Upload is a source that enables this Bundle's content to be uploaded via Rukpak's bundle upload service. This source type is primarily useful with bundle development workflows because it enables bundle developers to inject a local bundle directly into the cluster. + type: object + required: + - type + type: object + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/assets/rukpak/05-serviceaccount-openshift-rukpak-core-admin.yml b/assets/rukpak/05-serviceaccount-openshift-rukpak-core-admin.yml new file mode 100644 index 000000000..d8fe42bfc --- /dev/null +++ b/assets/rukpak/05-serviceaccount-openshift-rukpak-core-admin.yml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + annotations: + release.openshift.io/feature-set: TechPreviewNoUpgrade + name: core-admin + namespace: openshift-rukpak diff --git a/assets/rukpak/06-serviceaccount-openshift-rukpak-helm-provisioner-admin.yml b/assets/rukpak/06-serviceaccount-openshift-rukpak-helm-provisioner-admin.yml new file mode 100644 index 000000000..e6400864e --- /dev/null +++ b/assets/rukpak/06-serviceaccount-openshift-rukpak-helm-provisioner-admin.yml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + annotations: + release.openshift.io/feature-set: TechPreviewNoUpgrade + name: helm-provisioner-admin + namespace: openshift-rukpak diff --git a/assets/rukpak/07-serviceaccount-openshift-rukpak-rukpak-webhooks-admin.yml b/assets/rukpak/07-serviceaccount-openshift-rukpak-rukpak-webhooks-admin.yml new file mode 100644 index 000000000..d37b4c0f2 --- /dev/null +++ b/assets/rukpak/07-serviceaccount-openshift-rukpak-rukpak-webhooks-admin.yml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + annotations: + release.openshift.io/feature-set: TechPreviewNoUpgrade + name: rukpak-webhooks-admin + namespace: openshift-rukpak diff --git a/assets/rukpak/08-clusterrole--bundle-reader.yml b/assets/rukpak/08-clusterrole--bundle-reader.yml new file mode 100644 index 000000000..3ba8c2fa6 --- /dev/null +++ b/assets/rukpak/08-clusterrole--bundle-reader.yml @@ -0,0 +1,12 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + annotations: + release.openshift.io/feature-set: TechPreviewNoUpgrade + name: bundle-reader +rules: + - nonResourceURLs: + - /bundles/* + verbs: + - get diff --git a/assets/rukpak/09-clusterrole--bundle-uploader.yml b/assets/rukpak/09-clusterrole--bundle-uploader.yml new file mode 100644 index 000000000..8660641d2 --- /dev/null +++ b/assets/rukpak/09-clusterrole--bundle-uploader.yml @@ -0,0 +1,12 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + annotations: + release.openshift.io/feature-set: TechPreviewNoUpgrade + name: bundle-uploader +rules: + - nonResourceURLs: + - /bundles/* + verbs: + - put diff --git a/assets/rukpak/10-clusterrole--core-admin.yml b/assets/rukpak/10-clusterrole--core-admin.yml new file mode 100644 index 000000000..fd88ef9a6 --- /dev/null +++ b/assets/rukpak/10-clusterrole--core-admin.yml @@ -0,0 +1,95 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + annotations: + release.openshift.io/feature-set: TechPreviewNoUpgrade + name: core-admin +rules: + - nonResourceURLs: + - /bundles/* + - /uploads/* + verbs: + - get + - apiGroups: + - '*' + resources: + - '*' + verbs: + - '*' + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create + - apiGroups: + - "" + resources: + - configmaps + verbs: + - list + - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - create + - delete + - list + - watch + - apiGroups: + - "" + resources: + - pods/log + verbs: + - get + - apiGroups: + - core.rukpak.io + resources: + - bundledeployments + verbs: + - list + - watch + - apiGroups: + - core.rukpak.io + resources: + - bundledeployments/finalizers + verbs: + - update + - apiGroups: + - core.rukpak.io + resources: + - bundledeployments/status + verbs: + - patch + - update + - apiGroups: + - core.rukpak.io + resources: + - bundles + verbs: + - list + - patch + - update + - watch + - apiGroups: + - core.rukpak.io + resources: + - bundles/finalizers + verbs: + - update + - apiGroups: + - core.rukpak.io + resources: + - bundles/status + verbs: + - patch + - update diff --git a/assets/rukpak/12-clusterrole--helm-provisioner-admin.yml b/assets/rukpak/12-clusterrole--helm-provisioner-admin.yml new file mode 100644 index 000000000..7c45a030e --- /dev/null +++ b/assets/rukpak/12-clusterrole--helm-provisioner-admin.yml @@ -0,0 +1,95 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + annotations: + release.openshift.io/feature-set: TechPreviewNoUpgrade + name: helm-provisioner-admin +rules: + - nonResourceURLs: + - /bundles/* + - /uploads/* + verbs: + - get + - apiGroups: + - '*' + resources: + - '*' + verbs: + - '*' + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create + - apiGroups: + - "" + resources: + - configmaps + verbs: + - list + - watch + - apiGroups: + - "" + resources: + - pods + verbs: + - create + - delete + - list + - watch + - apiGroups: + - "" + resources: + - pods/log + verbs: + - get + - apiGroups: + - core.rukpak.io + resources: + - bundledeployments + verbs: + - list + - watch + - apiGroups: + - core.rukpak.io + resources: + - bundledeployments/finalizers + verbs: + - update + - apiGroups: + - core.rukpak.io + resources: + - bundledeployments/status + verbs: + - patch + - update + - apiGroups: + - core.rukpak.io + resources: + - bundles + verbs: + - list + - patch + - update + - watch + - apiGroups: + - core.rukpak.io + resources: + - bundles/finalizers + verbs: + - update + - apiGroups: + - core.rukpak.io + resources: + - bundles/status + verbs: + - patch + - update diff --git a/assets/rukpak/13-clusterrole--rukpak-webhooks-admin.yml b/assets/rukpak/13-clusterrole--rukpak-webhooks-admin.yml new file mode 100644 index 000000000..594b8c280 --- /dev/null +++ b/assets/rukpak/13-clusterrole--rukpak-webhooks-admin.yml @@ -0,0 +1,22 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + annotations: + release.openshift.io/feature-set: TechPreviewNoUpgrade + name: rukpak-webhooks-admin +rules: + - apiGroups: + - "" + resources: + - configmaps + verbs: + - list + - watch + - apiGroups: + - core.rukpak.io + resources: + - bundles + verbs: + - list + - watch diff --git a/assets/rukpak/14-clusterrolebinding--core-admin.yml b/assets/rukpak/14-clusterrolebinding--core-admin.yml new file mode 100644 index 000000000..a94896a60 --- /dev/null +++ b/assets/rukpak/14-clusterrolebinding--core-admin.yml @@ -0,0 +1,16 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + annotations: + release.openshift.io/feature-set: TechPreviewNoUpgrade + name: core-admin +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: core-admin +subjects: + - apiGroup: "" + kind: ServiceAccount + name: core-admin + namespace: openshift-rukpak diff --git a/assets/rukpak/16-clusterrolebinding--helm-provisioner-admin.yml b/assets/rukpak/16-clusterrolebinding--helm-provisioner-admin.yml new file mode 100644 index 000000000..33e8b75d7 --- /dev/null +++ b/assets/rukpak/16-clusterrolebinding--helm-provisioner-admin.yml @@ -0,0 +1,16 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + annotations: + release.openshift.io/feature-set: TechPreviewNoUpgrade + name: helm-provisioner-admin +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: helm-provisioner-admin +subjects: + - apiGroup: "" + kind: ServiceAccount + name: helm-provisioner-admin + namespace: openshift-rukpak diff --git a/assets/rukpak/17-clusterrolebinding--rukpak-webhooks-admin.yml b/assets/rukpak/17-clusterrolebinding--rukpak-webhooks-admin.yml new file mode 100644 index 000000000..f0f1da03e --- /dev/null +++ b/assets/rukpak/17-clusterrolebinding--rukpak-webhooks-admin.yml @@ -0,0 +1,16 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + annotations: + release.openshift.io/feature-set: TechPreviewNoUpgrade + name: rukpak-webhooks-admin +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: rukpak-webhooks-admin +subjects: + - apiGroup: "" + kind: ServiceAccount + name: rukpak-webhooks-admin + namespace: openshift-rukpak diff --git a/assets/rukpak/19-service-openshift-rukpak-core.yml b/assets/rukpak/19-service-openshift-rukpak-core.yml new file mode 100644 index 000000000..5c48c560d --- /dev/null +++ b/assets/rukpak/19-service-openshift-rukpak-core.yml @@ -0,0 +1,16 @@ +--- +apiVersion: v1 +kind: Service +metadata: + annotations: + service.beta.openshift.io/serving-cert-secret-name: core-cert + name: core + namespace: openshift-rukpak +spec: + ports: + - name: https + port: 443 + protocol: TCP + targetPort: 8443 + selector: + app: core diff --git a/assets/rukpak/20-service-openshift-rukpak-helm-provisioner.yml b/assets/rukpak/20-service-openshift-rukpak-helm-provisioner.yml new file mode 100644 index 000000000..b4641ee4a --- /dev/null +++ b/assets/rukpak/20-service-openshift-rukpak-helm-provisioner.yml @@ -0,0 +1,15 @@ +--- +apiVersion: v1 +kind: Service +metadata: + annotations: + service.beta.openshift.io/serving-cert-secret-name: helm-provisioner-cert + name: helm-provisioner + namespace: openshift-rukpak +spec: + ports: + - port: 443 + protocol: TCP + targetPort: 8443 + selector: + app: helm-provisioner diff --git a/assets/rukpak/21-service-openshift-rukpak-rukpak-webhook-service.yml b/assets/rukpak/21-service-openshift-rukpak-rukpak-webhook-service.yml new file mode 100644 index 000000000..1c831c8dd --- /dev/null +++ b/assets/rukpak/21-service-openshift-rukpak-rukpak-webhook-service.yml @@ -0,0 +1,15 @@ +--- +apiVersion: v1 +kind: Service +metadata: + annotations: + service.beta.openshift.io/serving-cert-secret-name: rukpak-webhook-certificate + name: rukpak-webhook-service + namespace: openshift-rukpak +spec: + ports: + - port: 443 + protocol: TCP + targetPort: 9443 + selector: + app: webhooks diff --git a/assets/rukpak/23-deployment-openshift-rukpak-core.yml b/assets/rukpak/23-deployment-openshift-rukpak-core.yml new file mode 100644 index 000000000..002b6f8c6 --- /dev/null +++ b/assets/rukpak/23-deployment-openshift-rukpak-core.yml @@ -0,0 +1,108 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + release.openshift.io/feature-set: TechPreviewNoUpgrade + labels: + app: core + name: core + namespace: openshift-rukpak +spec: + replicas: 1 + selector: + matchLabels: + app: core + template: + metadata: + annotations: + kubectl.kubernetes.io/default-container: manager + release.openshift.io/feature-set: TechPreviewNoUpgrade + labels: + app: core + spec: + containers: + - args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=1 + - --client-ca-file=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt + - --tls-cert-file=/etc/pki/tls/tls.crt + - --tls-private-key-file=/etc/pki/tls/tls.key + - --upstream-ca-file=/etc/configmaps/ca-bundle/service-ca.crt + image: quay.io/brancz/kube-rbac-proxy:v0.12.0 + name: kube-rbac-proxy + ports: + - containerPort: 8443 + name: https + protocol: TCP + resources: + requests: + cpu: 1m + memory: 15Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + volumeMounts: + - mountPath: /etc/pki/tls + name: certs + - mountPath: /etc/configmaps/ca-bundle + name: ca-bundle + readOnly: false + - args: + - --unpack-image=quay.io/operator-framework/rukpak:v0.12.0 + - --base-upload-manager-url=https://core.openshift-rukpak.svc + - --provisioner-storage-dir=/var/cache/bundles + - --upload-storage-dir=/var/cache/uploads + - --http-bind-address=127.0.0.1:8080 + - --http-external-address=https://core.openshift-rukpak.svc + - --bundle-ca-file=/etc/configmaps/ca-bundle/service-ca.crt + command: + - /core + image: quay.io/operator-framework/rukpak:v0.12.0 + imagePullPolicy: IfNotPresent + name: manager + ports: + - containerPort: 8080 + resources: + requests: + cpu: 10m + memory: 160Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + volumeMounts: + - mountPath: /var/cache/bundles + name: bundle-cache + - mountPath: /var/cache/uploads + name: upload-cache + - mountPath: /etc/pki/tls + name: certs + - mountPath: /etc/configmaps/ca-bundle + name: ca-bundle + readOnly: false + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + serviceAccountName: core-admin + volumes: + - emptyDir: {} + name: bundle-cache + - emptyDir: {} + name: upload-cache + - name: certs + secret: + optional: false + secretName: core-cert + - configMap: + items: + - key: service-ca.crt + path: service-ca.crt + name: openshift-service-ca.crt + name: ca-bundle diff --git a/assets/rukpak/24-deployment-openshift-rukpak-helm-provisioner.yml b/assets/rukpak/24-deployment-openshift-rukpak-helm-provisioner.yml new file mode 100644 index 000000000..b04a812d1 --- /dev/null +++ b/assets/rukpak/24-deployment-openshift-rukpak-helm-provisioner.yml @@ -0,0 +1,103 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + release.openshift.io/feature-set: TechPreviewNoUpgrade + labels: + app: helm-provisioner + name: helm-provisioner + namespace: openshift-rukpak +spec: + replicas: 1 + selector: + matchLabels: + app: helm-provisioner + template: + metadata: + annotations: + kubectl.kubernetes.io/default-container: manager + release.openshift.io/feature-set: TechPreviewNoUpgrade + labels: + app: helm-provisioner + spec: + containers: + - args: + - --secure-listen-address=0.0.0.0:8443 + - --upstream=http://127.0.0.1:8080/ + - --logtostderr=true + - --v=1 + - --client-ca-file=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt + - --tls-cert-file=/etc/pki/tls/tls.crt + - --tls-private-key-file=/etc/pki/tls/tls.key + - --upstream-ca-file=/etc/configmaps/ca-bundle/service-ca.crt + image: quay.io/brancz/kube-rbac-proxy:v0.12.0 + name: kube-rbac-proxy + ports: + - containerPort: 8443 + name: https + protocol: TCP + resources: + requests: + cpu: 1m + memory: 15Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + volumeMounts: + - mountPath: /etc/pki/tls + name: certs + - mountPath: /etc/configmaps/ca-bundle + name: ca-bundle + readOnly: false + - args: + - --unpack-image=quay.io/operator-framework/rukpak:v0.12.0 + - --base-upload-manager-url=https://core.openshift-rukpak.svc + - --storage-dir=/var/cache/bundles + - --http-bind-address=127.0.0.1:8080 + - --http-external-address=https://helm-provisioner.openshift-rukpak.svc + - --bundle-ca-file=/etc/configmaps/ca-bundle/service-ca.crt + command: + - /helm + image: quay.io/operator-framework/rukpak:v0.12.0 + imagePullPolicy: IfNotPresent + name: manager + ports: + - containerPort: 8080 + resources: + requests: + cpu: 10m + memory: 160Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + volumeMounts: + - mountPath: /var/cache/bundles + name: bundle-cache + - mountPath: /etc/pki/tls + name: certs + - mountPath: /etc/configmaps/ca-bundle + name: ca-bundle + readOnly: false + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + serviceAccountName: helm-provisioner-admin + volumes: + - emptyDir: {} + name: bundle-cache + - name: certs + secret: + optional: false + secretName: helm-provisioner-cert + - configMap: + items: + - key: service-ca.crt + path: service-ca.crt + name: openshift-service-ca.crt + name: ca-bundle diff --git a/assets/rukpak/25-deployment-openshift-rukpak-rukpak-webhooks.yml b/assets/rukpak/25-deployment-openshift-rukpak-rukpak-webhooks.yml new file mode 100644 index 000000000..8e6a03017 --- /dev/null +++ b/assets/rukpak/25-deployment-openshift-rukpak-rukpak-webhooks.yml @@ -0,0 +1,56 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + release.openshift.io/feature-set: TechPreviewNoUpgrade + labels: + app: webhooks + name: rukpak-webhooks + namespace: openshift-rukpak +spec: + replicas: 1 + selector: + matchLabels: + app: webhooks + template: + metadata: + annotations: + release.openshift.io/feature-set: TechPreviewNoUpgrade + labels: + app: webhooks + spec: + containers: + - command: + - /webhooks + image: quay.io/operator-framework/rukpak:v0.12.0 + imagePullPolicy: IfNotPresent + name: webhooks + ports: + - containerPort: 8080 + - containerPort: 9443 + name: webhook-server + protocol: TCP + resources: + requests: + cpu: 1m + memory: 15Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + serviceAccountName: rukpak-webhooks-admin + volumes: + - name: cert + secret: + defaultMode: 420 + secretName: rukpak-webhook-certificate diff --git a/assets/rukpak/36-validatingwebhookconfiguration--rukpak-validating-webhook-configuration.yml b/assets/rukpak/36-validatingwebhookconfiguration--rukpak-validating-webhook-configuration.yml new file mode 100644 index 000000000..90677e5bc --- /dev/null +++ b/assets/rukpak/36-validatingwebhookconfiguration--rukpak-validating-webhook-configuration.yml @@ -0,0 +1,52 @@ +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + annotations: + service.beta.openshift.io/inject-cabundle: "true" + release.openshift.io/feature-set: TechPreviewNoUpgrade + name: rukpak-validating-webhook-configuration +webhooks: + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: rukpak-webhook-service + namespace: openshift-rukpak + path: /validate-core-v1-configmap + failurePolicy: Fail + name: vconfigmaps.core.rukpak.io + namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: rukpak-system + rules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - CREATE + - DELETE + resources: + - configmaps + sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: rukpak-webhook-service + namespace: openshift-rukpak + path: /validate-core-rukpak-io-v1alpha1-bundle + failurePolicy: Fail + name: vbundles.core.rukpak.io + rules: + - apiGroups: + - core.rukpak.io + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - bundles + sideEffects: None diff --git a/cmd/cluster-olm-operator/main.go b/cmd/cluster-olm-operator/main.go index 9967f45a2..74e1dd8c1 100644 --- a/cmd/cluster-olm-operator/main.go +++ b/cmd/cluster-olm-operator/main.go @@ -94,6 +94,36 @@ func runOperator(ctx context.Context, cc *controllercmd.ControllerContext) error } operatorControllerDeployment := "operator-controller/11-deployment-openshift-operator-controller-operator-controller-controller-manager.yml" + rukpakStaticFiles := []string{ + "rukpak/01-namespace--openshift-rukpak.yml", + "rukpak/02-customresourcedefinition--bundledeployments.core.rukpak.io.yml", + "rukpak/03-customresourcedefinition--bundles.core.rukpak.io.yml", + "rukpak/05-serviceaccount-openshift-rukpak-core-admin.yml", + "rukpak/06-serviceaccount-openshift-rukpak-helm-provisioner-admin.yml", + "rukpak/07-serviceaccount-openshift-rukpak-rukpak-webhooks-admin.yml", + "rukpak/08-clusterrole--bundle-reader.yml", + "rukpak/09-clusterrole--bundle-uploader.yml", + "rukpak/10-clusterrole--core-admin.yml", + "rukpak/12-clusterrole--helm-provisioner-admin.yml", + "rukpak/13-clusterrole--rukpak-webhooks-admin.yml", + "rukpak/14-clusterrolebinding--core-admin.yml", + "rukpak/16-clusterrolebinding--helm-provisioner-admin.yml", + "rukpak/17-clusterrolebinding--rukpak-webhooks-admin.yml", + "rukpak/19-service-openshift-rukpak-core.yml", + "rukpak/20-service-openshift-rukpak-helm-provisioner.yml", + "rukpak/21-service-openshift-rukpak-rukpak-webhook-service.yml", + "rukpak/36-validatingwebhookconfiguration--rukpak-validating-webhook-configuration.yml", + } + rukpakDeploymentFiles := map[string]string{ + "Core": "rukpak/23-deployment-openshift-rukpak-core.yml", + "HelmProvisioner": "rukpak/24-deployment-openshift-rukpak-helm-provisioner.yml", + "Webhooks": "rukpak/25-deployment-openshift-rukpak-rukpak-webhooks.yml", + } + rukpakDeploymentFileNames := make([]string, 0, len(rukpakDeploymentFiles)) + for _, file := range rukpakDeploymentFiles { + rukpakDeploymentFileNames = append(rukpakDeploymentFileNames, file) + } + catalogdRelatedObjects, err := assets.RelatedObjects(cl.RESTMapper, append(catalogdStaticFiles, catalogdDeployment)) if err != nil { return err @@ -104,7 +134,12 @@ func runOperator(ctx context.Context, cc *controllercmd.ControllerContext) error return err } - relatedObjects := append(catalogdRelatedObjects, operatorControllerRelatedObjects...) + rukpakRelatedObjects, err := assets.RelatedObjects(cl.RESTMapper, append(rukpakStaticFiles, rukpakDeploymentFileNames...)) + if err != nil { + return err + } + + relatedObjects := append(append(catalogdRelatedObjects, operatorControllerRelatedObjects...), rukpakRelatedObjects...) namespaces := sets.New[string]() for _, obj := range relatedObjects { @@ -167,6 +202,67 @@ func runOperator(ctx context.Context, cc *controllercmd.ControllerContext) error }, ) + rukpakStaticResourceController := staticresourcecontroller.NewStaticResourceController( + "RukpakStaticResources", + assets.ReadFile, + rukpakStaticFiles, + cl.ClientHolder(), + cl.OperatorClient, + cc.EventRecorder.ForComponent("RukpakStaticResources"), + ).AddKubeInformers(cl.KubeInformersForNamespaces) + + rukpakCoreDeploymentManifest, err := assets.ReadFile(rukpakDeploymentFiles["Core"]) + if err != nil { + return err + } + rukpakHelmProvisionerDeploymentManifest, err := assets.ReadFile(rukpakDeploymentFiles["HelmProvisioner"]) + if err != nil { + return err + } + rukpakWebhooksDeploymentManifest, err := assets.ReadFile(rukpakDeploymentFiles["Webhooks"]) + if err != nil { + return err + } + + rukpakCoreDeploymentController := deploymentcontroller.NewDeploymentController( + "RukpakCoreControllerDeployment", + rukpakCoreDeploymentManifest, + cc.EventRecorder.ForComponent("RukpakCoreControllerDeployment"), + cl.OperatorClient, + cl.KubeClient, + cl.KubeInformerFactory.Apps().V1().Deployments(), + nil, + []deploymentcontroller.ManifestHookFunc{ + replaceImageHook("${RUKPAK_IMAGE}", "RUKPAK_IMAGE"), + replaceImageHook("${KUBE_RBAC_PROXY_IMAGE}", "KUBE_RBAC_PROXY_IMAGE"), + }, + ) + rukpakHelmProvisionerDeploymentController := deploymentcontroller.NewDeploymentController( + "RukpakHelmProvisionerControllerDeployment", + rukpakHelmProvisionerDeploymentManifest, + cc.EventRecorder.ForComponent("RukpakHelmProvisionerControllerDeployment"), + cl.OperatorClient, + cl.KubeClient, + cl.KubeInformerFactory.Apps().V1().Deployments(), + nil, + []deploymentcontroller.ManifestHookFunc{ + replaceImageHook("${RUKPAK_IMAGE}", "RUKPAK_IMAGE"), + replaceImageHook("${KUBE_RBAC_PROXY_IMAGE}", "KUBE_RBAC_PROXY_IMAGE"), + }, + ) + rukpakWebhooksDeploymentController := deploymentcontroller.NewDeploymentController( + "RukpakWebhooksControllerDeployment", + rukpakWebhooksDeploymentManifest, + cc.EventRecorder.ForComponent("RukpakWebhooksControllerDeployment"), + cl.OperatorClient, + cl.KubeClient, + cl.KubeInformerFactory.Apps().V1().Deployments(), + nil, + []deploymentcontroller.ManifestHookFunc{ + replaceImageHook("${RUKPAK_IMAGE}", "RUKPAK_IMAGE"), + }, + ) + versionGetter := status.NewVersionGetter() versionGetter.SetVersion("operator", status.VersionForOperatorFromEnv()) @@ -187,6 +283,10 @@ func runOperator(ctx context.Context, cc *controllercmd.ControllerContext) error catalogdDeploymentController, operatorControllerStaticResourceController, operatorControllerDeploymentController, + rukpakStaticResourceController, + rukpakCoreDeploymentController, + rukpakHelmProvisionerDeploymentController, + rukpakWebhooksDeploymentController, clusterOperatorController, } { go func(c factory.Controller) { From 01596c85799d6fb5f0378a4d16f61ddf25d06646 Mon Sep 17 00:00:00 2001 From: dtfranz Date: Thu, 29 Jun 2023 14:27:26 -0700 Subject: [PATCH 02/14] Update manifests with latest from operator-framework-rukpak repo Signed-off-by: dtfranz --- ...yml => 00-namespace--openshift-rukpak.yml} | 3 -- ...ion--bundledeployments.core.rukpak.io.yml} | 3 +- ...rcedefinition--bundles.core.rukpak.io.yml} | 3 +- ...ceaccount-openshift-rukpak-core-admin.yml} | 2 - ...enshift-rukpak-helm-provisioner-admin.yml} | 2 - ...penshift-rukpak-rukpak-webhooks-admin.yml} | 2 - ....yml => 06-clusterrole--bundle-reader.yml} | 2 - ...ml => 07-clusterrole--bundle-uploader.yml} | 2 - ...min.yml => 08-clusterrole--core-admin.yml} | 2 - ...9-clusterrole--helm-provisioner-admin.yml} | 2 - ...10-clusterrole--rukpak-webhooks-admin.yml} | 2 - ... => 11-clusterrolebinding--core-admin.yml} | 2 - ...errolebinding--helm-provisioner-admin.yml} | 2 - ...terrolebinding--rukpak-webhooks-admin.yml} | 2 - ...l => 14-service-openshift-rukpak-core.yml} | 0 ...ice-openshift-rukpak-helm-provisioner.yml} | 0 ...enshift-rukpak-rukpak-webhook-service.yml} | 0 ...> 17-deployment-openshift-rukpak-core.yml} | 13 +++--- ...ent-openshift-rukpak-helm-provisioner.yml} | 13 +++--- ...ment-openshift-rukpak-rukpak-webhooks.yml} | 7 +--- ...kpak-validating-webhook-configuration.yml} | 1 - cmd/cluster-olm-operator/main.go | 42 +++++++++---------- 22 files changed, 35 insertions(+), 72 deletions(-) rename assets/rukpak/{01-namespace--openshift-rukpak.yml => 00-namespace--openshift-rukpak.yml} (69%) rename assets/rukpak/{02-customresourcedefinition--bundledeployments.core.rukpak.io.yml => 01-customresourcedefinition--bundledeployments.core.rukpak.io.yml} (99%) rename assets/rukpak/{03-customresourcedefinition--bundles.core.rukpak.io.yml => 02-customresourcedefinition--bundles.core.rukpak.io.yml} (99%) rename assets/rukpak/{05-serviceaccount-openshift-rukpak-core-admin.yml => 03-serviceaccount-openshift-rukpak-core-admin.yml} (57%) rename assets/rukpak/{06-serviceaccount-openshift-rukpak-helm-provisioner-admin.yml => 04-serviceaccount-openshift-rukpak-helm-provisioner-admin.yml} (60%) rename assets/rukpak/{07-serviceaccount-openshift-rukpak-rukpak-webhooks-admin.yml => 05-serviceaccount-openshift-rukpak-rukpak-webhooks-admin.yml} (59%) rename assets/rukpak/{08-clusterrole--bundle-reader.yml => 06-clusterrole--bundle-reader.yml} (69%) rename assets/rukpak/{09-clusterrole--bundle-uploader.yml => 07-clusterrole--bundle-uploader.yml} (69%) rename assets/rukpak/{10-clusterrole--core-admin.yml => 08-clusterrole--core-admin.yml} (95%) rename assets/rukpak/{12-clusterrole--helm-provisioner-admin.yml => 09-clusterrole--helm-provisioner-admin.yml} (95%) rename assets/rukpak/{13-clusterrole--rukpak-webhooks-admin.yml => 10-clusterrole--rukpak-webhooks-admin.yml} (80%) rename assets/rukpak/{14-clusterrolebinding--core-admin.yml => 11-clusterrolebinding--core-admin.yml} (79%) rename assets/rukpak/{16-clusterrolebinding--helm-provisioner-admin.yml => 12-clusterrolebinding--helm-provisioner-admin.yml} (81%) rename assets/rukpak/{17-clusterrolebinding--rukpak-webhooks-admin.yml => 13-clusterrolebinding--rukpak-webhooks-admin.yml} (81%) rename assets/rukpak/{19-service-openshift-rukpak-core.yml => 14-service-openshift-rukpak-core.yml} (100%) rename assets/rukpak/{20-service-openshift-rukpak-helm-provisioner.yml => 15-service-openshift-rukpak-helm-provisioner.yml} (100%) rename assets/rukpak/{21-service-openshift-rukpak-rukpak-webhook-service.yml => 16-service-openshift-rukpak-rukpak-webhook-service.yml} (100%) rename assets/rukpak/{23-deployment-openshift-rukpak-core.yml => 17-deployment-openshift-rukpak-core.yml} (88%) rename assets/rukpak/{24-deployment-openshift-rukpak-helm-provisioner.yml => 18-deployment-openshift-rukpak-helm-provisioner.yml} (87%) rename assets/rukpak/{25-deployment-openshift-rukpak-rukpak-webhooks.yml => 19-deployment-openshift-rukpak-rukpak-webhooks.yml} (84%) rename assets/rukpak/{36-validatingwebhookconfiguration--rukpak-validating-webhook-configuration.yml => 20-validatingwebhookconfiguration--rukpak-validating-webhook-configuration.yml} (95%) diff --git a/assets/rukpak/01-namespace--openshift-rukpak.yml b/assets/rukpak/00-namespace--openshift-rukpak.yml similarity index 69% rename from assets/rukpak/01-namespace--openshift-rukpak.yml rename to assets/rukpak/00-namespace--openshift-rukpak.yml index 0f8fd0f4b..750696f67 100644 --- a/assets/rukpak/01-namespace--openshift-rukpak.yml +++ b/assets/rukpak/00-namespace--openshift-rukpak.yml @@ -1,9 +1,6 @@ ---- apiVersion: v1 kind: Namespace metadata: - annotations: - release.openshift.io/feature-set: TechPreviewNoUpgrade labels: pod-security.kubernetes.io/enforce: baseline pod-security.kubernetes.io/enforce-version: latest diff --git a/assets/rukpak/02-customresourcedefinition--bundledeployments.core.rukpak.io.yml b/assets/rukpak/01-customresourcedefinition--bundledeployments.core.rukpak.io.yml similarity index 99% rename from assets/rukpak/02-customresourcedefinition--bundledeployments.core.rukpak.io.yml rename to assets/rukpak/01-customresourcedefinition--bundledeployments.core.rukpak.io.yml index fccad954b..e6f928160 100644 --- a/assets/rukpak/02-customresourcedefinition--bundledeployments.core.rukpak.io.yml +++ b/assets/rukpak/01-customresourcedefinition--bundledeployments.core.rukpak.io.yml @@ -3,8 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.11.4 - release.openshift.io/feature-set: TechPreviewNoUpgrade + controller-gen.kubebuilder.io/version: v0.12.0 name: bundledeployments.core.rukpak.io spec: group: core.rukpak.io diff --git a/assets/rukpak/03-customresourcedefinition--bundles.core.rukpak.io.yml b/assets/rukpak/02-customresourcedefinition--bundles.core.rukpak.io.yml similarity index 99% rename from assets/rukpak/03-customresourcedefinition--bundles.core.rukpak.io.yml rename to assets/rukpak/02-customresourcedefinition--bundles.core.rukpak.io.yml index 0c75e082d..49d2aae34 100644 --- a/assets/rukpak/03-customresourcedefinition--bundles.core.rukpak.io.yml +++ b/assets/rukpak/02-customresourcedefinition--bundles.core.rukpak.io.yml @@ -3,8 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.11.4 - release.openshift.io/feature-set: TechPreviewNoUpgrade + controller-gen.kubebuilder.io/version: v0.12.0 name: bundles.core.rukpak.io spec: group: core.rukpak.io diff --git a/assets/rukpak/05-serviceaccount-openshift-rukpak-core-admin.yml b/assets/rukpak/03-serviceaccount-openshift-rukpak-core-admin.yml similarity index 57% rename from assets/rukpak/05-serviceaccount-openshift-rukpak-core-admin.yml rename to assets/rukpak/03-serviceaccount-openshift-rukpak-core-admin.yml index d8fe42bfc..5ecde8473 100644 --- a/assets/rukpak/05-serviceaccount-openshift-rukpak-core-admin.yml +++ b/assets/rukpak/03-serviceaccount-openshift-rukpak-core-admin.yml @@ -2,7 +2,5 @@ apiVersion: v1 kind: ServiceAccount metadata: - annotations: - release.openshift.io/feature-set: TechPreviewNoUpgrade name: core-admin namespace: openshift-rukpak diff --git a/assets/rukpak/06-serviceaccount-openshift-rukpak-helm-provisioner-admin.yml b/assets/rukpak/04-serviceaccount-openshift-rukpak-helm-provisioner-admin.yml similarity index 60% rename from assets/rukpak/06-serviceaccount-openshift-rukpak-helm-provisioner-admin.yml rename to assets/rukpak/04-serviceaccount-openshift-rukpak-helm-provisioner-admin.yml index e6400864e..a1dc4e266 100644 --- a/assets/rukpak/06-serviceaccount-openshift-rukpak-helm-provisioner-admin.yml +++ b/assets/rukpak/04-serviceaccount-openshift-rukpak-helm-provisioner-admin.yml @@ -2,7 +2,5 @@ apiVersion: v1 kind: ServiceAccount metadata: - annotations: - release.openshift.io/feature-set: TechPreviewNoUpgrade name: helm-provisioner-admin namespace: openshift-rukpak diff --git a/assets/rukpak/07-serviceaccount-openshift-rukpak-rukpak-webhooks-admin.yml b/assets/rukpak/05-serviceaccount-openshift-rukpak-rukpak-webhooks-admin.yml similarity index 59% rename from assets/rukpak/07-serviceaccount-openshift-rukpak-rukpak-webhooks-admin.yml rename to assets/rukpak/05-serviceaccount-openshift-rukpak-rukpak-webhooks-admin.yml index d37b4c0f2..7b4972f21 100644 --- a/assets/rukpak/07-serviceaccount-openshift-rukpak-rukpak-webhooks-admin.yml +++ b/assets/rukpak/05-serviceaccount-openshift-rukpak-rukpak-webhooks-admin.yml @@ -2,7 +2,5 @@ apiVersion: v1 kind: ServiceAccount metadata: - annotations: - release.openshift.io/feature-set: TechPreviewNoUpgrade name: rukpak-webhooks-admin namespace: openshift-rukpak diff --git a/assets/rukpak/08-clusterrole--bundle-reader.yml b/assets/rukpak/06-clusterrole--bundle-reader.yml similarity index 69% rename from assets/rukpak/08-clusterrole--bundle-reader.yml rename to assets/rukpak/06-clusterrole--bundle-reader.yml index 3ba8c2fa6..b2f7d3d3b 100644 --- a/assets/rukpak/08-clusterrole--bundle-reader.yml +++ b/assets/rukpak/06-clusterrole--bundle-reader.yml @@ -2,8 +2,6 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - annotations: - release.openshift.io/feature-set: TechPreviewNoUpgrade name: bundle-reader rules: - nonResourceURLs: diff --git a/assets/rukpak/09-clusterrole--bundle-uploader.yml b/assets/rukpak/07-clusterrole--bundle-uploader.yml similarity index 69% rename from assets/rukpak/09-clusterrole--bundle-uploader.yml rename to assets/rukpak/07-clusterrole--bundle-uploader.yml index 8660641d2..669d89a6f 100644 --- a/assets/rukpak/09-clusterrole--bundle-uploader.yml +++ b/assets/rukpak/07-clusterrole--bundle-uploader.yml @@ -2,8 +2,6 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - annotations: - release.openshift.io/feature-set: TechPreviewNoUpgrade name: bundle-uploader rules: - nonResourceURLs: diff --git a/assets/rukpak/10-clusterrole--core-admin.yml b/assets/rukpak/08-clusterrole--core-admin.yml similarity index 95% rename from assets/rukpak/10-clusterrole--core-admin.yml rename to assets/rukpak/08-clusterrole--core-admin.yml index fd88ef9a6..7b8bc7ace 100644 --- a/assets/rukpak/10-clusterrole--core-admin.yml +++ b/assets/rukpak/08-clusterrole--core-admin.yml @@ -2,8 +2,6 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - annotations: - release.openshift.io/feature-set: TechPreviewNoUpgrade name: core-admin rules: - nonResourceURLs: diff --git a/assets/rukpak/12-clusterrole--helm-provisioner-admin.yml b/assets/rukpak/09-clusterrole--helm-provisioner-admin.yml similarity index 95% rename from assets/rukpak/12-clusterrole--helm-provisioner-admin.yml rename to assets/rukpak/09-clusterrole--helm-provisioner-admin.yml index 7c45a030e..02cd43401 100644 --- a/assets/rukpak/12-clusterrole--helm-provisioner-admin.yml +++ b/assets/rukpak/09-clusterrole--helm-provisioner-admin.yml @@ -2,8 +2,6 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - annotations: - release.openshift.io/feature-set: TechPreviewNoUpgrade name: helm-provisioner-admin rules: - nonResourceURLs: diff --git a/assets/rukpak/13-clusterrole--rukpak-webhooks-admin.yml b/assets/rukpak/10-clusterrole--rukpak-webhooks-admin.yml similarity index 80% rename from assets/rukpak/13-clusterrole--rukpak-webhooks-admin.yml rename to assets/rukpak/10-clusterrole--rukpak-webhooks-admin.yml index 594b8c280..85846705c 100644 --- a/assets/rukpak/13-clusterrole--rukpak-webhooks-admin.yml +++ b/assets/rukpak/10-clusterrole--rukpak-webhooks-admin.yml @@ -2,8 +2,6 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - annotations: - release.openshift.io/feature-set: TechPreviewNoUpgrade name: rukpak-webhooks-admin rules: - apiGroups: diff --git a/assets/rukpak/14-clusterrolebinding--core-admin.yml b/assets/rukpak/11-clusterrolebinding--core-admin.yml similarity index 79% rename from assets/rukpak/14-clusterrolebinding--core-admin.yml rename to assets/rukpak/11-clusterrolebinding--core-admin.yml index a94896a60..29b261477 100644 --- a/assets/rukpak/14-clusterrolebinding--core-admin.yml +++ b/assets/rukpak/11-clusterrolebinding--core-admin.yml @@ -2,8 +2,6 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - annotations: - release.openshift.io/feature-set: TechPreviewNoUpgrade name: core-admin roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/assets/rukpak/16-clusterrolebinding--helm-provisioner-admin.yml b/assets/rukpak/12-clusterrolebinding--helm-provisioner-admin.yml similarity index 81% rename from assets/rukpak/16-clusterrolebinding--helm-provisioner-admin.yml rename to assets/rukpak/12-clusterrolebinding--helm-provisioner-admin.yml index 33e8b75d7..9430b9ce8 100644 --- a/assets/rukpak/16-clusterrolebinding--helm-provisioner-admin.yml +++ b/assets/rukpak/12-clusterrolebinding--helm-provisioner-admin.yml @@ -2,8 +2,6 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - annotations: - release.openshift.io/feature-set: TechPreviewNoUpgrade name: helm-provisioner-admin roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/assets/rukpak/17-clusterrolebinding--rukpak-webhooks-admin.yml b/assets/rukpak/13-clusterrolebinding--rukpak-webhooks-admin.yml similarity index 81% rename from assets/rukpak/17-clusterrolebinding--rukpak-webhooks-admin.yml rename to assets/rukpak/13-clusterrolebinding--rukpak-webhooks-admin.yml index f0f1da03e..2e9134b7f 100644 --- a/assets/rukpak/17-clusterrolebinding--rukpak-webhooks-admin.yml +++ b/assets/rukpak/13-clusterrolebinding--rukpak-webhooks-admin.yml @@ -2,8 +2,6 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - annotations: - release.openshift.io/feature-set: TechPreviewNoUpgrade name: rukpak-webhooks-admin roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/assets/rukpak/19-service-openshift-rukpak-core.yml b/assets/rukpak/14-service-openshift-rukpak-core.yml similarity index 100% rename from assets/rukpak/19-service-openshift-rukpak-core.yml rename to assets/rukpak/14-service-openshift-rukpak-core.yml diff --git a/assets/rukpak/20-service-openshift-rukpak-helm-provisioner.yml b/assets/rukpak/15-service-openshift-rukpak-helm-provisioner.yml similarity index 100% rename from assets/rukpak/20-service-openshift-rukpak-helm-provisioner.yml rename to assets/rukpak/15-service-openshift-rukpak-helm-provisioner.yml diff --git a/assets/rukpak/21-service-openshift-rukpak-rukpak-webhook-service.yml b/assets/rukpak/16-service-openshift-rukpak-rukpak-webhook-service.yml similarity index 100% rename from assets/rukpak/21-service-openshift-rukpak-rukpak-webhook-service.yml rename to assets/rukpak/16-service-openshift-rukpak-rukpak-webhook-service.yml diff --git a/assets/rukpak/23-deployment-openshift-rukpak-core.yml b/assets/rukpak/17-deployment-openshift-rukpak-core.yml similarity index 88% rename from assets/rukpak/23-deployment-openshift-rukpak-core.yml rename to assets/rukpak/17-deployment-openshift-rukpak-core.yml index 002b6f8c6..bbde8d1e0 100644 --- a/assets/rukpak/23-deployment-openshift-rukpak-core.yml +++ b/assets/rukpak/17-deployment-openshift-rukpak-core.yml @@ -2,8 +2,6 @@ apiVersion: apps/v1 kind: Deployment metadata: - annotations: - release.openshift.io/feature-set: TechPreviewNoUpgrade labels: app: core name: core @@ -17,7 +15,6 @@ spec: metadata: annotations: kubectl.kubernetes.io/default-container: manager - release.openshift.io/feature-set: TechPreviewNoUpgrade labels: app: core spec: @@ -31,7 +28,7 @@ spec: - --tls-cert-file=/etc/pki/tls/tls.crt - --tls-private-key-file=/etc/pki/tls/tls.key - --upstream-ca-file=/etc/configmaps/ca-bundle/service-ca.crt - image: quay.io/brancz/kube-rbac-proxy:v0.12.0 + image: ${KUBE_RBAC_PROXY_IMAGE} name: kube-rbac-proxy ports: - containerPort: 8443 @@ -53,7 +50,7 @@ spec: name: ca-bundle readOnly: false - args: - - --unpack-image=quay.io/operator-framework/rukpak:v0.12.0 + - --unpack-image=${RUKPAK_IMAGE} - --base-upload-manager-url=https://core.openshift-rukpak.svc - --provisioner-storage-dir=/var/cache/bundles - --upload-storage-dir=/var/cache/uploads @@ -62,7 +59,7 @@ spec: - --bundle-ca-file=/etc/configmaps/ca-bundle/service-ca.crt command: - /core - image: quay.io/operator-framework/rukpak:v0.12.0 + image: ${RUKPAK_IMAGE} imagePullPolicy: IfNotPresent name: manager ports: @@ -102,7 +99,7 @@ spec: secretName: core-cert - configMap: items: - - key: service-ca.crt - path: service-ca.crt + - key: service-ca.crt + path: service-ca.crt name: openshift-service-ca.crt name: ca-bundle diff --git a/assets/rukpak/24-deployment-openshift-rukpak-helm-provisioner.yml b/assets/rukpak/18-deployment-openshift-rukpak-helm-provisioner.yml similarity index 87% rename from assets/rukpak/24-deployment-openshift-rukpak-helm-provisioner.yml rename to assets/rukpak/18-deployment-openshift-rukpak-helm-provisioner.yml index b04a812d1..a01785e10 100644 --- a/assets/rukpak/24-deployment-openshift-rukpak-helm-provisioner.yml +++ b/assets/rukpak/18-deployment-openshift-rukpak-helm-provisioner.yml @@ -2,8 +2,6 @@ apiVersion: apps/v1 kind: Deployment metadata: - annotations: - release.openshift.io/feature-set: TechPreviewNoUpgrade labels: app: helm-provisioner name: helm-provisioner @@ -17,7 +15,6 @@ spec: metadata: annotations: kubectl.kubernetes.io/default-container: manager - release.openshift.io/feature-set: TechPreviewNoUpgrade labels: app: helm-provisioner spec: @@ -31,7 +28,7 @@ spec: - --tls-cert-file=/etc/pki/tls/tls.crt - --tls-private-key-file=/etc/pki/tls/tls.key - --upstream-ca-file=/etc/configmaps/ca-bundle/service-ca.crt - image: quay.io/brancz/kube-rbac-proxy:v0.12.0 + image: ${KUBE_RBAC_PROXY_IMAGE} name: kube-rbac-proxy ports: - containerPort: 8443 @@ -53,7 +50,7 @@ spec: name: ca-bundle readOnly: false - args: - - --unpack-image=quay.io/operator-framework/rukpak:v0.12.0 + - --unpack-image=${RUKPAK_IMAGE} - --base-upload-manager-url=https://core.openshift-rukpak.svc - --storage-dir=/var/cache/bundles - --http-bind-address=127.0.0.1:8080 @@ -61,7 +58,7 @@ spec: - --bundle-ca-file=/etc/configmaps/ca-bundle/service-ca.crt command: - /helm - image: quay.io/operator-framework/rukpak:v0.12.0 + image: ${RUKPAK_IMAGE} imagePullPolicy: IfNotPresent name: manager ports: @@ -97,7 +94,7 @@ spec: secretName: helm-provisioner-cert - configMap: items: - - key: service-ca.crt - path: service-ca.crt + - key: service-ca.crt + path: service-ca.crt name: openshift-service-ca.crt name: ca-bundle diff --git a/assets/rukpak/25-deployment-openshift-rukpak-rukpak-webhooks.yml b/assets/rukpak/19-deployment-openshift-rukpak-rukpak-webhooks.yml similarity index 84% rename from assets/rukpak/25-deployment-openshift-rukpak-rukpak-webhooks.yml rename to assets/rukpak/19-deployment-openshift-rukpak-rukpak-webhooks.yml index 8e6a03017..537cfd1b9 100644 --- a/assets/rukpak/25-deployment-openshift-rukpak-rukpak-webhooks.yml +++ b/assets/rukpak/19-deployment-openshift-rukpak-rukpak-webhooks.yml @@ -2,8 +2,6 @@ apiVersion: apps/v1 kind: Deployment metadata: - annotations: - release.openshift.io/feature-set: TechPreviewNoUpgrade labels: app: webhooks name: rukpak-webhooks @@ -15,15 +13,13 @@ spec: app: webhooks template: metadata: - annotations: - release.openshift.io/feature-set: TechPreviewNoUpgrade labels: app: webhooks spec: containers: - command: - /webhooks - image: quay.io/operator-framework/rukpak:v0.12.0 + image: ${RUKPAK_IMAGE} imagePullPolicy: IfNotPresent name: webhooks ports: @@ -44,6 +40,7 @@ spec: - mountPath: /tmp/k8s-webhook-server/serving-certs name: cert readOnly: true + args: [] securityContext: runAsNonRoot: true seccompProfile: diff --git a/assets/rukpak/36-validatingwebhookconfiguration--rukpak-validating-webhook-configuration.yml b/assets/rukpak/20-validatingwebhookconfiguration--rukpak-validating-webhook-configuration.yml similarity index 95% rename from assets/rukpak/36-validatingwebhookconfiguration--rukpak-validating-webhook-configuration.yml rename to assets/rukpak/20-validatingwebhookconfiguration--rukpak-validating-webhook-configuration.yml index 90677e5bc..a1666c79f 100644 --- a/assets/rukpak/36-validatingwebhookconfiguration--rukpak-validating-webhook-configuration.yml +++ b/assets/rukpak/20-validatingwebhookconfiguration--rukpak-validating-webhook-configuration.yml @@ -4,7 +4,6 @@ kind: ValidatingWebhookConfiguration metadata: annotations: service.beta.openshift.io/inject-cabundle: "true" - release.openshift.io/feature-set: TechPreviewNoUpgrade name: rukpak-validating-webhook-configuration webhooks: - admissionReviewVersions: diff --git a/cmd/cluster-olm-operator/main.go b/cmd/cluster-olm-operator/main.go index 74e1dd8c1..87654f455 100644 --- a/cmd/cluster-olm-operator/main.go +++ b/cmd/cluster-olm-operator/main.go @@ -95,29 +95,29 @@ func runOperator(ctx context.Context, cc *controllercmd.ControllerContext) error operatorControllerDeployment := "operator-controller/11-deployment-openshift-operator-controller-operator-controller-controller-manager.yml" rukpakStaticFiles := []string{ - "rukpak/01-namespace--openshift-rukpak.yml", - "rukpak/02-customresourcedefinition--bundledeployments.core.rukpak.io.yml", - "rukpak/03-customresourcedefinition--bundles.core.rukpak.io.yml", - "rukpak/05-serviceaccount-openshift-rukpak-core-admin.yml", - "rukpak/06-serviceaccount-openshift-rukpak-helm-provisioner-admin.yml", - "rukpak/07-serviceaccount-openshift-rukpak-rukpak-webhooks-admin.yml", - "rukpak/08-clusterrole--bundle-reader.yml", - "rukpak/09-clusterrole--bundle-uploader.yml", - "rukpak/10-clusterrole--core-admin.yml", - "rukpak/12-clusterrole--helm-provisioner-admin.yml", - "rukpak/13-clusterrole--rukpak-webhooks-admin.yml", - "rukpak/14-clusterrolebinding--core-admin.yml", - "rukpak/16-clusterrolebinding--helm-provisioner-admin.yml", - "rukpak/17-clusterrolebinding--rukpak-webhooks-admin.yml", - "rukpak/19-service-openshift-rukpak-core.yml", - "rukpak/20-service-openshift-rukpak-helm-provisioner.yml", - "rukpak/21-service-openshift-rukpak-rukpak-webhook-service.yml", - "rukpak/36-validatingwebhookconfiguration--rukpak-validating-webhook-configuration.yml", + "rukpak/00-namespace--openshift-rukpak.yml", + "rukpak/01-customresourcedefinition--bundledeployments.core.rukpak.io.yml", + "rukpak/02-customresourcedefinition--bundles.core.rukpak.io.yml", + "rukpak/03-serviceaccount-openshift-rukpak-core-admin.yml", + "rukpak/04-serviceaccount-openshift-rukpak-helm-provisioner-admin.yml", + "rukpak/05-serviceaccount-openshift-rukpak-rukpak-webhooks-admin.yml", + "rukpak/06-clusterrole--bundle-reader.yml", + "rukpak/07-clusterrole--bundle-uploader.yml", + "rukpak/08-clusterrole--core-admin.yml", + "rukpak/09-clusterrole--helm-provisioner-admin.yml", + "rukpak/10-clusterrole--rukpak-webhooks-admin.yml", + "rukpak/11-clusterrolebinding--core-admin.yml", + "rukpak/12-clusterrolebinding--helm-provisioner-admin.yml", + "rukpak/13-clusterrolebinding--rukpak-webhooks-admin.yml", + "rukpak/14-service-openshift-rukpak-core.yml", + "rukpak/15-service-openshift-rukpak-helm-provisioner.yml", + "rukpak/16-service-openshift-rukpak-rukpak-webhook-service.yml", + "rukpak/20-validatingwebhookconfiguration--rukpak-validating-webhook-configuration.yml", } rukpakDeploymentFiles := map[string]string{ - "Core": "rukpak/23-deployment-openshift-rukpak-core.yml", - "HelmProvisioner": "rukpak/24-deployment-openshift-rukpak-helm-provisioner.yml", - "Webhooks": "rukpak/25-deployment-openshift-rukpak-rukpak-webhooks.yml", + "Core": "rukpak/17-deployment-openshift-rukpak-core.yml", + "HelmProvisioner": "rukpak/18-deployment-openshift-rukpak-helm-provisioner.yml", + "Webhooks": "rukpak/19-deployment-openshift-rukpak-rukpak-webhooks.yml", } rukpakDeploymentFileNames := make([]string, 0, len(rukpakDeploymentFiles)) for _, file := range rukpakDeploymentFiles { From fbc3dab7f1ef77083d8267ba60b024d5331209e5 Mon Sep 17 00:00:00 2001 From: dtfranz Date: Thu, 29 Jun 2023 14:34:04 -0700 Subject: [PATCH 03/14] Add RUKPAK_IMAGE for replacement in manifests Co-authored-by: Andy Goldstein Signed-off-by: dtfranz --- manifests/0000_51_olm_06_deployment.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/manifests/0000_51_olm_06_deployment.yaml b/manifests/0000_51_olm_06_deployment.yaml index 6a4eb4434..698ad6275 100644 --- a/manifests/0000_51_olm_06_deployment.yaml +++ b/manifests/0000_51_olm_06_deployment.yaml @@ -45,6 +45,8 @@ spec: value: quay.io/openshift/origin-olm-catalogd:latest - name: OPERATOR_CONTROLLER_IMAGE value: quay.io/openshift/origin-olm-operator-controller:latest + - name: RUKPAK_IMAGE + value: quay.io/openshift/origin-olm-rukpak:latest resources: requests: cpu: 10m From fefc80ad28978f8f7bcbdfc384edc3c04b2fd6cd Mon Sep 17 00:00:00 2001 From: dtfranz Date: Fri, 30 Jun 2023 08:52:22 -0700 Subject: [PATCH 04/14] Add rukpak clusterroles to cluster-olm-operator clusterrole binding Signed-off-by: dtfranz --- manifests/0000_51_olm_02_operator_clusterrole.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/manifests/0000_51_olm_02_operator_clusterrole.yaml b/manifests/0000_51_olm_02_operator_clusterrole.yaml index 3f71a37b0..4a5b452ba 100644 --- a/manifests/0000_51_olm_02_operator_clusterrole.yaml +++ b/manifests/0000_51_olm_02_operator_clusterrole.yaml @@ -167,3 +167,8 @@ rules: - operator-controller-metrics-reader - operator-controller-proxy-role - operator-controller-leader-election-role + - bundle-reader + - bundle-uploader + - core-admin + - helm-provisioner-admin + - rukpak-webhooks-admin From a401f6f3658acb4c401a7e1b55b989ddf496c1b3 Mon Sep 17 00:00:00 2001 From: dtfranz Date: Fri, 30 Jun 2023 13:20:33 -0700 Subject: [PATCH 05/14] Add rbac for validatingwebhooks to operator clusterrole Signed-off-by: dtfranz --- manifests/0000_51_olm_02_operator_clusterrole.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/manifests/0000_51_olm_02_operator_clusterrole.yaml b/manifests/0000_51_olm_02_operator_clusterrole.yaml index 4a5b452ba..db347f9e6 100644 --- a/manifests/0000_51_olm_02_operator_clusterrole.yaml +++ b/manifests/0000_51_olm_02_operator_clusterrole.yaml @@ -172,3 +172,15 @@ rules: - core-admin - helm-provisioner-admin - rukpak-webhooks-admin + - apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + verbs: + - create + - update + - patch + - get + - list + - watch + - delete From 5864e4ae43c586c003c801f649f266c2015956e6 Mon Sep 17 00:00:00 2001 From: Andy Goldstein Date: Mon, 3 Jul 2023 11:01:47 -0400 Subject: [PATCH 06/14] Include in payload for CVO Signed-off-by: Andy Goldstein --- Dockerfile | 3 ++- manifests/image-references | 24 ++++++++++++++++++++++++ manifests/image-references.pending | 17 ----------------- 3 files changed, 26 insertions(+), 18 deletions(-) create mode 100644 manifests/image-references delete mode 100644 manifests/image-references.pending diff --git a/Dockerfile b/Dockerfile index cd00b7147..4ba3a1502 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,5 +9,6 @@ COPY --from=builder /build/bin/cluster-olm-operator / USER 1001 -LABEL io.k8s.display-name="OpenShift Cluster Operator Lifecycle Manager (OLM) Operator" \ +LABEL io.openshift.release.operator=true \ + io.k8s.display-name="OpenShift Cluster Operator Lifecycle Manager (OLM) Operator" \ io.k8s.description="This cluster-olm-operator installs and maintains the Operator Lifecycle Manager (OLM) components of the OCP cluster." diff --git a/manifests/image-references b/manifests/image-references new file mode 100644 index 000000000..6c82c2bde --- /dev/null +++ b/manifests/image-references @@ -0,0 +1,24 @@ +kind: ImageStream +apiVersion: image.openshift.io/v1 +spec: + tags: + - name: cluster-olm-operator + from: + kind: DockerImage + name: quay.io/openshift/origin-cluster-olm-operator:latest + - name: olm-catalogd + from: + kind: DockerImage + name: quay.io/openshift/origin-olm-catalogd:latest + - name: olm-operator-controller + from: + kind: DockerImage + name: quay.io/openshift/origin-olm-operator-controller:latest + - name: olm-rukpak + from: + kind: DockerImage + name: quay.io/openshift/origin-olm-rukpak:latest + - name: kube-rbac-proxy + from: + kind: DockerImage + name: quay.io/openshift/origin-kube-rbac-proxy:latest diff --git a/manifests/image-references.pending b/manifests/image-references.pending deleted file mode 100644 index 19e103ef2..000000000 --- a/manifests/image-references.pending +++ /dev/null @@ -1,17 +0,0 @@ -kind: ImageStream -apiVersion: image.openshift.io/v1 -spec: - # Uncomment these after we have builds of all the images in OSBS -# tags: -# - name: cluster-olm-operator -# from: -# kind: DockerImage -# name: quay.io/openshift/origin-cluster-olm-operator:latest -# - name: olm-catalogd -# from: -# kind: DockerImage -# name: quay.io/openshift/origin-olm-catalogd:latest -# - name: olm-operator-controller -# from: -# kind: DockerImage -# name: quay.io/openshift/origin-olm-operator-controller:latest From c367105f2a77715216d6fd1481901043a83bb9b5 Mon Sep 17 00:00:00 2001 From: Andy Goldstein Date: Mon, 3 Jul 2023 11:47:49 -0400 Subject: [PATCH 07/14] Copy manifests into image Signed-off-by: Andy Goldstein --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 4ba3a1502..da47ed67b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -6,7 +6,7 @@ RUN make build FROM registry.ci.openshift.org/ocp/4.14:base COPY --from=builder /build/bin/cluster-olm-operator / - +COPY manifests /manifests USER 1001 LABEL io.openshift.release.operator=true \ From 43307ad10cc485a1d4c6e44af91f02fe0830b3e9 Mon Sep 17 00:00:00 2001 From: Andy Goldstein Date: Mon, 3 Jul 2023 14:40:14 -0400 Subject: [PATCH 08/14] Bump openshift/api Signed-off-by: Andy Goldstein --- go.mod | 8 +- go.sum | 4 +- .../config/v1/custom.apiserver.testsuite.yaml | 35 ++ .../api/config/v1/custom.dns.testsuite.yaml | 104 +++++ .../v1/custom.infrastructure.testsuite.yaml | 104 +++++ .../openshift/api/config/v1/feature_gates.go | 10 + .../openshift/api/config/v1/types_feature.go | 1 + .../0000_10_controlplanemachineset.crd.yaml | 1 + ...olplanemachineset.openstack.testsuite.yaml | 45 +++ .../machine/v1beta1/0000_10_machine.crd.yaml | 1 + .../v1beta1/0000_10_machinehealthcheck.yaml | 1 + .../v1beta1/0000_10_machineset.crd.yaml | 1 + .../api/machine/v1beta1/types_awsprovider.go | 5 + .../zz_generated.swagger_doc_generated.go | 1 + .../openshift/api/operator/.codegen.yaml | 2 + ...g-operator_01_olm-CustomNoUpgrade.crd.yaml | 140 +++++++ ...ator_01_olm-TechPreviewNoUpgrade.crd.yaml} | 3 + .../v1alpha1/custom.olm.testsuite.yaml | 28 ++ .../v1alpha1/techpreview.olm.testsuite.yaml | 14 +- .../openshift/api/operator/v1alpha1/types.go | 29 +- .../api/operator/v1alpha1/types_olm.go | 2 +- .../zz_generated.swagger_doc_generated.go | 16 +- .../openshift/api/route/.codegen.yaml | 6 + .../api/route/v1/custom.route.testsuite.yaml | 103 +++++ .../openshift/api/route/v1/generated.pb.go | 377 ++++++++++++++---- .../openshift/api/route/v1/generated.proto | 21 + .../route/v1/route-CustomNoUpgrade.crd.yaml | 237 +++++++++++ .../v1/route-TechPreviewNoUpgrade.crd.yaml | 237 +++++++++++ .../route/v1/techpreview.route.testsuite.yaml | 103 +++++ .../openshift/api/route/v1/types.go | 21 + .../api/route/v1/zz_generated.deepcopy.go | 17 + .../v1/zz_generated.swagger_doc_generated.go | 10 + .../openshift/api/security/v1/consts.go | 3 + vendor/modules.txt | 3 +- 34 files changed, 1585 insertions(+), 108 deletions(-) create mode 100644 vendor/github.com/openshift/api/config/v1/custom.apiserver.testsuite.yaml create mode 100644 vendor/github.com/openshift/api/config/v1/custom.dns.testsuite.yaml create mode 100644 vendor/github.com/openshift/api/config/v1/custom.infrastructure.testsuite.yaml create mode 100644 vendor/github.com/openshift/api/operator/v1alpha1/0000_10_config-operator_01_olm-CustomNoUpgrade.crd.yaml rename vendor/github.com/openshift/api/operator/v1alpha1/{0000_10_config-operator_01_olm.crd.yaml => 0000_10_config-operator_01_olm-TechPreviewNoUpgrade.crd.yaml} (97%) create mode 100644 vendor/github.com/openshift/api/operator/v1alpha1/custom.olm.testsuite.yaml create mode 100644 vendor/github.com/openshift/api/route/v1/custom.route.testsuite.yaml create mode 100644 vendor/github.com/openshift/api/route/v1/route-CustomNoUpgrade.crd.yaml create mode 100644 vendor/github.com/openshift/api/route/v1/route-TechPreviewNoUpgrade.crd.yaml create mode 100644 vendor/github.com/openshift/api/route/v1/techpreview.route.testsuite.yaml diff --git a/go.mod b/go.mod index b2290bcf0..9d78fd9e9 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/openshift/cluster-olm-operator go 1.20 require ( - github.com/openshift/api v0.0.0-20230613151523-ba04973d3ed1 + github.com/openshift/api v0.0.0-20230703162140-6e9853e4c905 github.com/openshift/build-machinery-go v0.0.0-20220913142420-e25cf57ea46d github.com/openshift/client-go v0.0.0-20230503144108-75015d2347cb github.com/openshift/library-go v0.0.0-20230622115850-9596e367bcb4 @@ -19,12 +19,8 @@ require ( ) // TODO: drop these replaces as soon as the OLM Operator API and client-go PRs merge: -// - openshift/api: https://github.com/openshift/api/pull/1504 // - openshift/client-go: -replace ( - github.com/openshift/api => github.com/joelanford/openshift-api v0.0.0-20230623000109-9ea4be9d5d37 - github.com/openshift/client-go => github.com/joelanford/openshift-client-go v0.0.0-20230623015431-ff819c433917 -) +replace github.com/openshift/client-go => github.com/joelanford/openshift-client-go v0.0.0-20230623015431-ff819c433917 require ( cloud.google.com/go/compute/metadata v0.2.3 // indirect diff --git a/go.sum b/go.sum index 02fec4e34..8716cabb8 100644 --- a/go.sum +++ b/go.sum @@ -328,8 +328,6 @@ github.com/imdario/mergo v0.3.7/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJ github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/joelanford/openshift-api v0.0.0-20230623000109-9ea4be9d5d37 h1:N8WiLdmyAuGomb8E8JHs8exZKVDnuyQkZATl6SRv4rs= -github.com/joelanford/openshift-api v0.0.0-20230623000109-9ea4be9d5d37/go.mod h1:4VWG+W22wrB4HfBL88P40DxLEpSOaiBVxUnfalfJo9k= github.com/joelanford/openshift-client-go v0.0.0-20230623015431-ff819c433917 h1:Cghj3pXyNw/jcWTK9sa2a3c22tDvewkA+w0G8+J3PkU= github.com/joelanford/openshift-client-go v0.0.0-20230623015431-ff819c433917/go.mod h1:cBQ6BhVawsMKmI2wvuoTdQjbJCxjINQhW8wvE1inpLY= github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo= @@ -404,6 +402,8 @@ github.com/onsi/ginkgo/v2 v2.9.5 h1:+6Hr4uxzP4XIUyAkg61dWBw8lb/gc4/X5luuxN/EC+Q= github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA= github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY= github.com/onsi/gomega v1.27.7 h1:fVih9JD6ogIiHUN6ePK7HJidyEDpWGVB5mzM7cWNXoU= +github.com/openshift/api v0.0.0-20230703162140-6e9853e4c905 h1:zvzzN6z/QxwQ6KiHnGb/DuVSOhHkYX6SqkPILdwc/3s= +github.com/openshift/api v0.0.0-20230703162140-6e9853e4c905/go.mod h1:4VWG+W22wrB4HfBL88P40DxLEpSOaiBVxUnfalfJo9k= github.com/openshift/build-machinery-go v0.0.0-20220913142420-e25cf57ea46d h1:RR4ah7FfaPR1WePizm0jlrsbmPu91xQZnAsVVreQV1k= github.com/openshift/build-machinery-go v0.0.0-20220913142420-e25cf57ea46d/go.mod h1:b1BuldmJlbA/xYtdZvKi+7j5YGB44qJUJDZ9zwiNCfE= github.com/openshift/library-go v0.0.0-20230622115850-9596e367bcb4 h1:wPpKgf6vbnsCdPcuv3pzHcwjyxm60wHooZ0ZWpZhG3E= diff --git a/vendor/github.com/openshift/api/config/v1/custom.apiserver.testsuite.yaml b/vendor/github.com/openshift/api/config/v1/custom.apiserver.testsuite.yaml new file mode 100644 index 000000000..5e2dea3ea --- /dev/null +++ b/vendor/github.com/openshift/api/config/v1/custom.apiserver.testsuite.yaml @@ -0,0 +1,35 @@ +apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this +name: "[CustomNoUpgrade] APIServer" +crd: 0000_10_config-operator_01_apiserver-CustomNoUpgrade.crd.yaml +tests: + onCreate: + - name: Should be able to create encrypt with aescbc + initial: | + apiVersion: config.openshift.io/v1 + kind: APIServer + spec: + encryption: + type: aescbc + expected: | + apiVersion: config.openshift.io/v1 + kind: APIServer + spec: + audit: + profile: Default + encryption: + type: aescbc + - name: Should be able to create encrypt with aesgcm + initial: | + apiVersion: config.openshift.io/v1 + kind: APIServer + spec: + encryption: + type: aesgcm + expected: | + apiVersion: config.openshift.io/v1 + kind: APIServer + spec: + audit: + profile: Default + encryption: + type: aesgcm diff --git a/vendor/github.com/openshift/api/config/v1/custom.dns.testsuite.yaml b/vendor/github.com/openshift/api/config/v1/custom.dns.testsuite.yaml new file mode 100644 index 000000000..ab1a123b6 --- /dev/null +++ b/vendor/github.com/openshift/api/config/v1/custom.dns.testsuite.yaml @@ -0,0 +1,104 @@ +apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this +name: "[Custom] DNS" +crd: 0000_10_config-operator_01_dns-CustomNoUpgrade.crd.yaml +tests: + onCreate: + - name: Should be able to create a minimal DNS + initial: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: {} # No spec is required for a DNS + expected: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: {} + - name: Should be able to specify an AWS role ARN for a private hosted zone + initial: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: + platform: + type: AWS + aws: + privateZoneIAMRole: arn:aws:iam::123456789012:role/foo + expected: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: + platform: + type: AWS + aws: + privateZoneIAMRole: arn:aws:iam::123456789012:role/foo + - name: Should not be able to specify unsupported platform + initial: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: + platform: + type: Azure + azure: + privateZoneIAMRole: arn:aws:iam::123456789012:role/foo + expectedError: "Invalid value: \"string\": allowed values are '' and 'AWS'" + - name: Should not be able to specify invalid AWS role ARN + initial: | + apiVersion: config.openshift.io/v1 + kind: DNS + metadata: + name: cluster + spec: + platform: + type: AWS + aws: + privateZoneIAMRole: arn:aws:iam:bad:123456789012:role/foo + expectedError: "DNS.config.openshift.io \"cluster\" is invalid: spec.platform.aws.privateZoneIAMRole: Invalid value: \"arn:aws:iam:bad:123456789012:role/foo\": spec.platform.aws.privateZoneIAMRole in body should match '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\\/.*$'" + - name: Should not be able to specify different type and platform + initial: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: + platform: + type: "" + aws: + privateZoneIAMRole: arn:aws:iam::123456789012:role/foo + expectedError: "Invalid value: \"object\": aws configuration is required when platform is AWS, and forbidden otherwise" + onUpdate: + - name: Can switch from empty (default), to AWS + initial: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: + platform: + type: "" + updated: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: + platform: + type: AWS + aws: + privateZoneIAMRole: arn:aws:iam::123456789012:role/foo + expected: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: + platform: + type: AWS + aws: + privateZoneIAMRole: arn:aws:iam::123456789012:role/foo + - name: Upgrade case is valid + initial: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: {} # No spec is required for a DNS + updated: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: + platform: + type: "" + expected: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: + platform: + type: "" diff --git a/vendor/github.com/openshift/api/config/v1/custom.infrastructure.testsuite.yaml b/vendor/github.com/openshift/api/config/v1/custom.infrastructure.testsuite.yaml new file mode 100644 index 000000000..ab1a123b6 --- /dev/null +++ b/vendor/github.com/openshift/api/config/v1/custom.infrastructure.testsuite.yaml @@ -0,0 +1,104 @@ +apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this +name: "[Custom] DNS" +crd: 0000_10_config-operator_01_dns-CustomNoUpgrade.crd.yaml +tests: + onCreate: + - name: Should be able to create a minimal DNS + initial: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: {} # No spec is required for a DNS + expected: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: {} + - name: Should be able to specify an AWS role ARN for a private hosted zone + initial: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: + platform: + type: AWS + aws: + privateZoneIAMRole: arn:aws:iam::123456789012:role/foo + expected: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: + platform: + type: AWS + aws: + privateZoneIAMRole: arn:aws:iam::123456789012:role/foo + - name: Should not be able to specify unsupported platform + initial: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: + platform: + type: Azure + azure: + privateZoneIAMRole: arn:aws:iam::123456789012:role/foo + expectedError: "Invalid value: \"string\": allowed values are '' and 'AWS'" + - name: Should not be able to specify invalid AWS role ARN + initial: | + apiVersion: config.openshift.io/v1 + kind: DNS + metadata: + name: cluster + spec: + platform: + type: AWS + aws: + privateZoneIAMRole: arn:aws:iam:bad:123456789012:role/foo + expectedError: "DNS.config.openshift.io \"cluster\" is invalid: spec.platform.aws.privateZoneIAMRole: Invalid value: \"arn:aws:iam:bad:123456789012:role/foo\": spec.platform.aws.privateZoneIAMRole in body should match '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\\/.*$'" + - name: Should not be able to specify different type and platform + initial: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: + platform: + type: "" + aws: + privateZoneIAMRole: arn:aws:iam::123456789012:role/foo + expectedError: "Invalid value: \"object\": aws configuration is required when platform is AWS, and forbidden otherwise" + onUpdate: + - name: Can switch from empty (default), to AWS + initial: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: + platform: + type: "" + updated: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: + platform: + type: AWS + aws: + privateZoneIAMRole: arn:aws:iam::123456789012:role/foo + expected: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: + platform: + type: AWS + aws: + privateZoneIAMRole: arn:aws:iam::123456789012:role/foo + - name: Upgrade case is valid + initial: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: {} # No spec is required for a DNS + updated: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: + platform: + type: "" + expected: | + apiVersion: config.openshift.io/v1 + kind: DNS + spec: + platform: + type: "" diff --git a/vendor/github.com/openshift/api/config/v1/feature_gates.go b/vendor/github.com/openshift/api/config/v1/feature_gates.go index caa52c02d..82ca5d85a 100644 --- a/vendor/github.com/openshift/api/config/v1/feature_gates.go +++ b/vendor/github.com/openshift/api/config/v1/feature_gates.go @@ -271,4 +271,14 @@ var ( ResponsiblePerson: "rvanderp3", OwningProduct: ocpSpecific, } + + FeatureGateRouteExternalCertificate = FeatureGateName("RouteExternalCertificate") + routeExternalCertificate = FeatureGateDescription{ + FeatureGateAttributes: FeatureGateAttributes{ + Name: FeatureGateRouteExternalCertificate, + }, + OwningJiraComponent: "router", + ResponsiblePerson: "thejasn", + OwningProduct: ocpSpecific, + } ) diff --git a/vendor/github.com/openshift/api/config/v1/types_feature.go b/vendor/github.com/openshift/api/config/v1/types_feature.go index 184f95472..d445c345a 100644 --- a/vendor/github.com/openshift/api/config/v1/types_feature.go +++ b/vendor/github.com/openshift/api/config/v1/types_feature.go @@ -185,6 +185,7 @@ var FeatureSets = map[FeatureSet]*FeatureGateEnabledDisabled{ with(sigstoreImageVerification). with(gcpLabelsTags). with(vSphereStaticIPs). + with(routeExternalCertificate). toFeatures(defaultFeatures), LatencySensitive: newDefaultFeatures(). toFeatures(defaultFeatures), diff --git a/vendor/github.com/openshift/api/machine/v1/0000_10_controlplanemachineset.crd.yaml b/vendor/github.com/openshift/api/machine/v1/0000_10_controlplanemachineset.crd.yaml index 223ee948e..4c7470f9f 100644 --- a/vendor/github.com/openshift/api/machine/v1/0000_10_controlplanemachineset.crd.yaml +++ b/vendor/github.com/openshift/api/machine/v1/0000_10_controlplanemachineset.crd.yaml @@ -2,6 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + capability.openshift.io/name: MachineAPI api-approved.openshift.io: https://github.com/openshift/api/pull/1112 exclude.release.openshift.io/internal-openshift-hosted: "true" include.release.openshift.io/self-managed-high-availability: "true" diff --git a/vendor/github.com/openshift/api/machine/v1/stable.controlplanemachineset.openstack.testsuite.yaml b/vendor/github.com/openshift/api/machine/v1/stable.controlplanemachineset.openstack.testsuite.yaml index f8559c13c..53d3126d3 100644 --- a/vendor/github.com/openshift/api/machine/v1/stable.controlplanemachineset.openstack.testsuite.yaml +++ b/vendor/github.com/openshift/api/machine/v1/stable.controlplanemachineset.openstack.testsuite.yaml @@ -71,6 +71,51 @@ tests: platform: OpenStack openstack: {} expectedError: "spec.template.machines_v1beta1_machine_openshift_io.failureDomains.openstack in body must be of type array: \"object\"" + - name: Should accept no failureDomains + initial: | + apiVersion: machine.openshift.io/v1 + kind: ControlPlaneMachineSet + spec: + selector: + matchLabels: + machine.openshift.io/cluster-api-machine-role: master + machine.openshift.io/cluster-api-machine-type: master + template: + machineType: machines_v1beta1_machine_openshift_io + machines_v1beta1_machine_openshift_io: + metadata: + labels: + machine.openshift.io/cluster-api-machine-role: master + machine.openshift.io/cluster-api-machine-type: master + machine.openshift.io/cluster-api-cluster: cluster + spec: + providerSpec: {} + failureDomains: + platform: "" + expected: | + apiVersion: machine.openshift.io/v1 + kind: ControlPlaneMachineSet + spec: + replicas: 3 + state: Inactive + strategy: + type: RollingUpdate + selector: + matchLabels: + machine.openshift.io/cluster-api-machine-role: master + machine.openshift.io/cluster-api-machine-type: master + template: + machineType: machines_v1beta1_machine_openshift_io + machines_v1beta1_machine_openshift_io: + metadata: + labels: + machine.openshift.io/cluster-api-machine-role: master + machine.openshift.io/cluster-api-machine-type: master + machine.openshift.io/cluster-api-cluster: cluster + spec: + providerSpec: {} + failureDomains: + platform: "" - name: Should reject an OpenStack configured failure domain with the wrong platform type initial: | apiVersion: machine.openshift.io/v1 diff --git a/vendor/github.com/openshift/api/machine/v1beta1/0000_10_machine.crd.yaml b/vendor/github.com/openshift/api/machine/v1beta1/0000_10_machine.crd.yaml index d11c3c72b..6de9c06b2 100644 --- a/vendor/github.com/openshift/api/machine/v1beta1/0000_10_machine.crd.yaml +++ b/vendor/github.com/openshift/api/machine/v1beta1/0000_10_machine.crd.yaml @@ -2,6 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + capability.openshift.io/name: MachineAPI api-approved.openshift.io: https://github.com/openshift/api/pull/948 exclude.release.openshift.io/internal-openshift-hosted: "true" include.release.openshift.io/self-managed-high-availability: "true" diff --git a/vendor/github.com/openshift/api/machine/v1beta1/0000_10_machinehealthcheck.yaml b/vendor/github.com/openshift/api/machine/v1beta1/0000_10_machinehealthcheck.yaml index f15c6f044..614b7a724 100644 --- a/vendor/github.com/openshift/api/machine/v1beta1/0000_10_machinehealthcheck.yaml +++ b/vendor/github.com/openshift/api/machine/v1beta1/0000_10_machinehealthcheck.yaml @@ -2,6 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + capability.openshift.io/name: MachineAPI exclude.release.openshift.io/internal-openshift-hosted: "true" include.release.openshift.io/self-managed-high-availability: "true" include.release.openshift.io/single-node-developer: "true" diff --git a/vendor/github.com/openshift/api/machine/v1beta1/0000_10_machineset.crd.yaml b/vendor/github.com/openshift/api/machine/v1beta1/0000_10_machineset.crd.yaml index c4bcfef24..2145f033f 100644 --- a/vendor/github.com/openshift/api/machine/v1beta1/0000_10_machineset.crd.yaml +++ b/vendor/github.com/openshift/api/machine/v1beta1/0000_10_machineset.crd.yaml @@ -2,6 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: + capability.openshift.io/name: MachineAPI api-approved.openshift.io: https://github.com/openshift/api/pull/1032 exclude.release.openshift.io/internal-openshift-hosted: "true" include.release.openshift.io/self-managed-high-availability: "true" diff --git a/vendor/github.com/openshift/api/machine/v1beta1/types_awsprovider.go b/vendor/github.com/openshift/api/machine/v1beta1/types_awsprovider.go index e2eec1a6a..f3853579b 100644 --- a/vendor/github.com/openshift/api/machine/v1beta1/types_awsprovider.go +++ b/vendor/github.com/openshift/api/machine/v1beta1/types_awsprovider.go @@ -79,6 +79,11 @@ type AWSMachineProviderConfig struct { // https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_InstanceMetadataOptionsRequest.html // +optional MetadataServiceOptions MetadataServiceOptions `json:"metadataServiceOptions,omitempty"` + // PlacementGroupName specifies the name of the placement group in which to launch the instance. + // The placement group must already be created and may use any placement strategy. + // When omitted, no placement group is used when creating the EC2 instance. + // +optional + PlacementGroupName string `json:"placementGroupName,omitempty"` } // BlockDeviceMappingSpec describes a block device mapping diff --git a/vendor/github.com/openshift/api/machine/v1beta1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/machine/v1beta1/zz_generated.swagger_doc_generated.go index 71b2e826c..c6128a769 100644 --- a/vendor/github.com/openshift/api/machine/v1beta1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/machine/v1beta1/zz_generated.swagger_doc_generated.go @@ -30,6 +30,7 @@ var map_AWSMachineProviderConfig = map[string]string{ "blockDevices": "BlockDevices is the set of block device mapping associated to this instance, block device without a name will be used as a root device and only one device without a name is allowed https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/block-device-mapping-concepts.html", "spotMarketOptions": "SpotMarketOptions allows users to configure instances to be run using AWS Spot instances.", "metadataServiceOptions": "MetadataServiceOptions allows users to configure instance metadata service interaction options. If nothing specified, default AWS IMDS settings will be applied. https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_InstanceMetadataOptionsRequest.html", + "placementGroupName": "PlacementGroupName specifies the name of the placement group in which to launch the instance. The placement group must already be created and may use any placement strategy. When omitted, no placement group is used when creating the EC2 instance.", } func (AWSMachineProviderConfig) SwaggerDoc() map[string]string { diff --git a/vendor/github.com/openshift/api/operator/.codegen.yaml b/vendor/github.com/openshift/api/operator/.codegen.yaml index 61618a818..0791e8be7 100644 --- a/vendor/github.com/openshift/api/operator/.codegen.yaml +++ b/vendor/github.com/openshift/api/operator/.codegen.yaml @@ -1,6 +1,8 @@ schemapatch: requiredFeatureSets: - "" + - "Default" - "TechPreviewNoUpgrade" + - "CustomNoUpgrade" swaggerdocs: commentPolicy: Warn diff --git a/vendor/github.com/openshift/api/operator/v1alpha1/0000_10_config-operator_01_olm-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/operator/v1alpha1/0000_10_config-operator_01_olm-CustomNoUpgrade.crd.yaml new file mode 100644 index 000000000..4068a064f --- /dev/null +++ b/vendor/github.com/openshift/api/operator/v1alpha1/0000_10_config-operator_01_olm-CustomNoUpgrade.crd.yaml @@ -0,0 +1,140 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.openshift.io: https://github.com/openshift/api/pull/1504 + include.release.openshift.io/ibm-cloud-managed: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + release.openshift.io/feature-set: CustomNoUpgrade + name: olms.operator.openshift.io +spec: + group: operator.openshift.io + names: + kind: OLM + listKind: OLMList + plural: olms + singular: olm + scope: Cluster + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: "OLM provides information to configure an operator to manage the OLM controllers \n Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support." + type: object + required: + - metadata + - spec + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: spec holds user settable values for configuration + type: object + properties: + logLevel: + description: "logLevel is an intent based logging for an overall component. It does not give fine grained control, but it is a simple way to manage coarse grained logging choices that operators have to interpret for their operands. \n Valid values are: \"Normal\", \"Debug\", \"Trace\", \"TraceAll\". Defaults to \"Normal\"." + type: string + default: Normal + enum: + - "" + - Normal + - Debug + - Trace + - TraceAll + managementState: + description: managementState indicates whether and how the operator should manage the component + type: string + pattern: ^(Managed|Unmanaged|Force|Removed)$ + observedConfig: + description: observedConfig holds a sparse config that controller has observed from the cluster state. It exists in spec because it is an input to the level for the operator + type: object + nullable: true + x-kubernetes-preserve-unknown-fields: true + operatorLogLevel: + description: "operatorLogLevel is an intent based logging for the operator itself. It does not give fine grained control, but it is a simple way to manage coarse grained logging choices that operators have to interpret for themselves. \n Valid values are: \"Normal\", \"Debug\", \"Trace\", \"TraceAll\". Defaults to \"Normal\"." + type: string + default: Normal + enum: + - "" + - Normal + - Debug + - Trace + - TraceAll + unsupportedConfigOverrides: + description: unsupportedConfigOverrides overrides the final configuration that was computed by the operator. Red Hat does not support the use of this field. Misuse of this field could lead to unexpected behavior or conflict with other configuration options. Seek guidance from the Red Hat support before using this field. Use of this property blocks cluster upgrades, it must be removed before upgrading your cluster. + type: object + nullable: true + x-kubernetes-preserve-unknown-fields: true + status: + description: status holds observed values from the cluster. They may not be overridden. + type: object + properties: + conditions: + description: conditions is a list of conditions and their status + type: array + items: + description: OperatorCondition is just the standard condition fields. + type: object + properties: + lastTransitionTime: + type: string + format: date-time + message: + type: string + reason: + type: string + status: + type: string + type: + type: string + generations: + description: generations are used to determine when an item needs to be reconciled or has changed in a way that needs a reaction. + type: array + items: + description: GenerationStatus keeps track of the generation for a given resource so that decisions about forced updates can be made. + type: object + properties: + group: + description: group is the group of the thing you're tracking + type: string + hash: + description: hash is an optional field set for resources without generation that are content sensitive like secrets and configmaps + type: string + lastGeneration: + description: lastGeneration is the last generation of the workload controller involved + type: integer + format: int64 + name: + description: name is the name of the thing you're tracking + type: string + namespace: + description: namespace is where the thing you're tracking is + type: string + resource: + description: resource is the resource type of the thing you're tracking + type: string + observedGeneration: + description: observedGeneration is the last generation change you've dealt with + type: integer + format: int64 + readyReplicas: + description: readyReplicas indicates how many replicas are ready and at the desired state + type: integer + format: int32 + version: + description: version is the level this availability applies to + type: string + x-kubernetes-validations: + - rule: self.metadata.name == 'cluster' + message: olm is a singleton, .metadata.name must be 'cluster' + served: true + storage: true + subresources: + status: {} diff --git a/vendor/github.com/openshift/api/operator/v1alpha1/0000_10_config-operator_01_olm.crd.yaml b/vendor/github.com/openshift/api/operator/v1alpha1/0000_10_config-operator_01_olm-TechPreviewNoUpgrade.crd.yaml similarity index 97% rename from vendor/github.com/openshift/api/operator/v1alpha1/0000_10_config-operator_01_olm.crd.yaml rename to vendor/github.com/openshift/api/operator/v1alpha1/0000_10_config-operator_01_olm-TechPreviewNoUpgrade.crd.yaml index 4d8865260..0e08b5113 100644 --- a/vendor/github.com/openshift/api/operator/v1alpha1/0000_10_config-operator_01_olm.crd.yaml +++ b/vendor/github.com/openshift/api/operator/v1alpha1/0000_10_config-operator_01_olm-TechPreviewNoUpgrade.crd.yaml @@ -131,6 +131,9 @@ spec: version: description: version is the level this availability applies to type: string + x-kubernetes-validations: + - rule: self.metadata.name == 'cluster' + message: olm is a singleton, .metadata.name must be 'cluster' served: true storage: true subresources: diff --git a/vendor/github.com/openshift/api/operator/v1alpha1/custom.olm.testsuite.yaml b/vendor/github.com/openshift/api/operator/v1alpha1/custom.olm.testsuite.yaml new file mode 100644 index 000000000..233e73d18 --- /dev/null +++ b/vendor/github.com/openshift/api/operator/v1alpha1/custom.olm.testsuite.yaml @@ -0,0 +1,28 @@ +apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this +name: "[Custom] OLM" +crd: 0000_10_config-operator_01_olm-CustomNoUpgrade.crd.yaml +tests: + onCreate: + - name: Should be able to create a minimal OLM + initial: | + apiVersion: operator.openshift.io/v1alpha1 + kind: OLM + metadata: + name: cluster + spec: {} # No spec is required for an OLM + expected: | + apiVersion: operator.openshift.io/v1alpha1 + kind: OLM + metadata: + name: cluster + spec: + logLevel: Normal + operatorLogLevel: Normal + - name: Should reject an OLM with an invalid name + initial: | + apiVersion: operator.openshift.io/v1alpha1 + kind: OLM + metadata: + name: foo + spec: {} # No spec is required for an OLM + expectedError: "Invalid value: \"object\": olm is a singleton, .metadata.name must be 'cluster'" diff --git a/vendor/github.com/openshift/api/operator/v1alpha1/techpreview.olm.testsuite.yaml b/vendor/github.com/openshift/api/operator/v1alpha1/techpreview.olm.testsuite.yaml index e1ff41c26..99c85fe01 100644 --- a/vendor/github.com/openshift/api/operator/v1alpha1/techpreview.olm.testsuite.yaml +++ b/vendor/github.com/openshift/api/operator/v1alpha1/techpreview.olm.testsuite.yaml @@ -1,16 +1,28 @@ apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this name: "[Tech Preview] OLM" -crd: 0000_10_config-operator_01_olm.crd.yaml +crd: 0000_10_config-operator_01_olm-TechPreviewNoUpgrade.crd.yaml tests: onCreate: - name: Should be able to create a minimal OLM initial: | apiVersion: operator.openshift.io/v1alpha1 kind: OLM + metadata: + name: cluster spec: {} # No spec is required for an OLM expected: | apiVersion: operator.openshift.io/v1alpha1 kind: OLM + metadata: + name: cluster spec: logLevel: Normal operatorLogLevel: Normal + - name: Should reject an OLM with an invalid name + initial: | + apiVersion: operator.openshift.io/v1alpha1 + kind: OLM + metadata: + name: foo + spec: {} # No spec is required for an OLM + expectedError: "Invalid value: \"object\": olm is a singleton, .metadata.name must be 'cluster'" diff --git a/vendor/github.com/openshift/api/operator/v1alpha1/types.go b/vendor/github.com/openshift/api/operator/v1alpha1/types.go index 69eb004c1..4d5a207e6 100644 --- a/vendor/github.com/openshift/api/operator/v1alpha1/types.go +++ b/vendor/github.com/openshift/api/operator/v1alpha1/types.go @@ -6,19 +6,24 @@ import ( configv1 "github.com/openshift/api/config/v1" ) +// DEPRECATED: Use v1.ManagementState instead type ManagementState string const ( // Managed means that the operator is actively managing its resources and trying to keep the component active + // DEPRECATED: Use v1.Managed instead Managed ManagementState = "Managed" // Unmanaged means that the operator is not taking any action related to the component + // DEPRECATED: Use v1.Unmanaged instead Unmanaged ManagementState = "Unmanaged" // Removed means that the operator is actively managing its resources and trying to remove all traces of the component + // DEPRECATED: Use v1.Removed instead Removed ManagementState = "Removed" ) // OperatorSpec contains common fields for an operator to need. It is intended to be anonymous included // inside of the Spec struct for you particular operator. +// DEPRECATED: Use v1.OperatorSpec instead type OperatorSpec struct { // managementState indicates whether and how the operator should manage the component ManagementState ManagementState `json:"managementState"` @@ -38,6 +43,7 @@ type OperatorSpec struct { } // LoggingConfig holds information about configuring logging +// DEPRECATED: Use v1.LogLevel instead type LoggingConfig struct { // level is passed to glog. Level int64 `json:"level"` @@ -46,24 +52,34 @@ type LoggingConfig struct { Vmodule string `json:"vmodule"` } +// DEPRECATED: Use v1.ConditionStatus instead type ConditionStatus string const ( - ConditionTrue ConditionStatus = "True" - ConditionFalse ConditionStatus = "False" + // DEPRECATED: Use v1.ConditionTrue instead + ConditionTrue ConditionStatus = "True" + // DEPRECATED: Use v1.ConditionFalse instead + ConditionFalse ConditionStatus = "False" + // DEPRECATED: Use v1.ConditionUnknown instead ConditionUnknown ConditionStatus = "Unknown" // these conditions match the conditions for the ClusterOperator type. - OperatorStatusTypeAvailable = "Available" + // DEPRECATED: Use v1.OperatorStatusTypeAvailable instead + OperatorStatusTypeAvailable = "Available" + // DEPRECATED: Use v1.OperatorStatusTypeProgressing instead OperatorStatusTypeProgressing = "Progressing" - OperatorStatusTypeFailing = "Failing" + // DEPRECATED: Use v1.OperatorStatusTypeDegraded instead + OperatorStatusTypeFailing = "Failing" + // DEPRECATED: Use v1.OperatorStatusTypeProgressing instead OperatorStatusTypeMigrating = "Migrating" // TODO this is going to be removed + // DEPRECATED: Use v1.OperatorStatusTypeAvailable instead OperatorStatusTypeSyncSuccessful = "SyncSuccessful" ) // OperatorCondition is just the standard condition fields. +// DEPRECATED: Use v1.OperatorCondition instead type OperatorCondition struct { Type string `json:"type"` Status ConditionStatus `json:"status"` @@ -73,6 +89,7 @@ type OperatorCondition struct { } // VersionAvailability gives information about the synchronization and operational status of a particular version of the component +// DEPRECATED: Use fields in v1.OperatorStatus instead type VersionAvailability struct { // version is the level this availability applies to Version string `json:"version"` @@ -87,6 +104,7 @@ type VersionAvailability struct { } // GenerationHistory keeps track of the generation for a given resource so that decisions about forced updated can be made. +// DEPRECATED: Use fields in v1.GenerationStatus instead type GenerationHistory struct { // group is the group of the thing you're tracking Group string `json:"group"` @@ -102,6 +120,7 @@ type GenerationHistory struct { // OperatorStatus contains common fields for an operator to need. It is intended to be anonymous included // inside of the Status struct for you particular operator. +// DEPRECATED: Use v1.OperatorStatus instead type OperatorStatus struct { // observedGeneration is the last generation change you've dealt with ObservedGeneration int64 `json:"observedGeneration,omitempty"` @@ -156,6 +175,7 @@ type DelegatedAuthorization struct { // StaticPodOperatorStatus is status for controllers that manage static pods. There are different needs because individual // node status must be tracked. +// DEPRECATED: Use v1.StaticPodOperatorStatus instead type StaticPodOperatorStatus struct { OperatorStatus `json:",inline"` @@ -167,6 +187,7 @@ type StaticPodOperatorStatus struct { } // NodeStatus provides information about the current state of a particular node managed by this operator. +// Deprecated: Use v1.NodeStatus instead type NodeStatus struct { // nodeName is the name of the node NodeName string `json:"nodeName"` diff --git a/vendor/github.com/openshift/api/operator/v1alpha1/types_olm.go b/vendor/github.com/openshift/api/operator/v1alpha1/types_olm.go index 8f20f681d..8f20690ae 100644 --- a/vendor/github.com/openshift/api/operator/v1alpha1/types_olm.go +++ b/vendor/github.com/openshift/api/operator/v1alpha1/types_olm.go @@ -14,6 +14,7 @@ import ( // // Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support. // +openshift:compatibility-gen:level=4 +// +kubebuilder:validation:XValidation:rule="self.metadata.name == 'cluster'",message="olm is a singleton, .metadata.name must be 'cluster'" type OLM struct { metav1.TypeMeta `json:",inline"` @@ -23,7 +24,6 @@ type OLM struct { //spec holds user settable values for configuration // +kubebuilder:validation:Required - // +required Spec OLMSpec `json:"spec"` // status holds observed values from the cluster. They may not be overridden. // +optional diff --git a/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.swagger_doc_generated.go index 23d7cd96c..6982323a1 100644 --- a/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.swagger_doc_generated.go @@ -30,7 +30,7 @@ func (DelegatedAuthorization) SwaggerDoc() map[string]string { } var map_GenerationHistory = map[string]string{ - "": "GenerationHistory keeps track of the generation for a given resource so that decisions about forced updated can be made.", + "": "GenerationHistory keeps track of the generation for a given resource so that decisions about forced updated can be made. DEPRECATED: Use fields in v1.GenerationStatus instead", "group": "group is the group of the thing you're tracking", "resource": "resource is the resource type of the thing you're tracking", "namespace": "namespace is where the thing you're tracking is", @@ -55,7 +55,7 @@ func (GenericOperatorConfig) SwaggerDoc() map[string]string { } var map_LoggingConfig = map[string]string{ - "": "LoggingConfig holds information about configuring logging", + "": "LoggingConfig holds information about configuring logging DEPRECATED: Use v1.LogLevel instead", "level": "level is passed to glog.", "vmodule": "vmodule is passed to glog.", } @@ -65,7 +65,7 @@ func (LoggingConfig) SwaggerDoc() map[string]string { } var map_NodeStatus = map[string]string{ - "": "NodeStatus provides information about the current state of a particular node managed by this operator.", + "": "NodeStatus provides information about the current state of a particular node managed by this operator. Deprecated: Use v1.NodeStatus instead", "nodeName": "nodeName is the name of the node", "currentDeploymentGeneration": "currentDeploymentGeneration is the generation of the most recently successful deployment", "targetDeploymentGeneration": "targetDeploymentGeneration is the generation of the deployment we're trying to apply", @@ -78,7 +78,7 @@ func (NodeStatus) SwaggerDoc() map[string]string { } var map_OperatorCondition = map[string]string{ - "": "OperatorCondition is just the standard condition fields.", + "": "OperatorCondition is just the standard condition fields. DEPRECATED: Use v1.OperatorCondition instead", } func (OperatorCondition) SwaggerDoc() map[string]string { @@ -86,7 +86,7 @@ func (OperatorCondition) SwaggerDoc() map[string]string { } var map_OperatorSpec = map[string]string{ - "": "OperatorSpec contains common fields for an operator to need. It is intended to be anonymous included inside of the Spec struct for you particular operator.", + "": "OperatorSpec contains common fields for an operator to need. It is intended to be anonymous included inside of the Spec struct for you particular operator. DEPRECATED: Use v1.OperatorSpec instead", "managementState": "managementState indicates whether and how the operator should manage the component", "imagePullSpec": "imagePullSpec is the image to use for the component.", "imagePullPolicy": "imagePullPolicy specifies the image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.", @@ -99,7 +99,7 @@ func (OperatorSpec) SwaggerDoc() map[string]string { } var map_OperatorStatus = map[string]string{ - "": "OperatorStatus contains common fields for an operator to need. It is intended to be anonymous included inside of the Status struct for you particular operator.", + "": "OperatorStatus contains common fields for an operator to need. It is intended to be anonymous included inside of the Status struct for you particular operator. DEPRECATED: Use v1.OperatorStatus instead", "observedGeneration": "observedGeneration is the last generation change you've dealt with", "conditions": "conditions is a list of conditions and their status", "state": "state indicates what the operator has observed to be its current operational status.", @@ -113,7 +113,7 @@ func (OperatorStatus) SwaggerDoc() map[string]string { } var map_StaticPodOperatorStatus = map[string]string{ - "": "StaticPodOperatorStatus is status for controllers that manage static pods. There are different needs because individual node status must be tracked.", + "": "StaticPodOperatorStatus is status for controllers that manage static pods. There are different needs because individual node status must be tracked. DEPRECATED: Use v1.StaticPodOperatorStatus instead", "latestAvailableDeploymentGeneration": "latestAvailableDeploymentGeneration is the deploymentID of the most recent deployment", "nodeStatuses": "nodeStatuses track the deployment values and errors across individual nodes", } @@ -123,7 +123,7 @@ func (StaticPodOperatorStatus) SwaggerDoc() map[string]string { } var map_VersionAvailability = map[string]string{ - "": "VersionAvailability gives information about the synchronization and operational status of a particular version of the component", + "": "VersionAvailability gives information about the synchronization and operational status of a particular version of the component DEPRECATED: Use fields in v1.OperatorStatus instead", "version": "version is the level this availability applies to", "updatedReplicas": "updatedReplicas indicates how many replicas are at the desired state", "readyReplicas": "readyReplicas indicates how many replicas are ready and at the desired state", diff --git a/vendor/github.com/openshift/api/route/.codegen.yaml b/vendor/github.com/openshift/api/route/.codegen.yaml index ffa2c8d9b..d2791f7b5 100644 --- a/vendor/github.com/openshift/api/route/.codegen.yaml +++ b/vendor/github.com/openshift/api/route/.codegen.yaml @@ -1,2 +1,8 @@ +schemapatch: + requiredFeatureSets: + - '' + - 'Default' + - 'TechPreviewNoUpgrade' + - 'CustomNoUpgrade' swaggerdocs: commentPolicy: Warn diff --git a/vendor/github.com/openshift/api/route/v1/custom.route.testsuite.yaml b/vendor/github.com/openshift/api/route/v1/custom.route.testsuite.yaml new file mode 100644 index 000000000..4a8042fc1 --- /dev/null +++ b/vendor/github.com/openshift/api/route/v1/custom.route.testsuite.yaml @@ -0,0 +1,103 @@ +apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this +name: '[CustomNoUpgrade] Route' +crd: route-CustomNoUpgrade.crd.yaml +tests: + onCreate: + - name: Should be able to create a minimal Route + initial: | + apiVersion: route.openshift.io/v1 + kind: Route + spec: + to: + kind: Service + name: foo + expected: | + apiVersion: route.openshift.io/v1 + kind: Route + spec: + to: + kind: Service + name: foo + weight: 100 + wildcardPolicy: None + - name: 'cannot have both spec.tls.termination: passthrough and spec.tls.insecureEdgeTerminationPolicy: Allow' + initial: | + apiVersion: route.openshift.io/v1 + kind: Route + spec: + to: + kind: Service + name: foo + tls: + termination: passthrough + insecureEdgeTerminationPolicy: Allow + expectedError: 'cannot have both spec.tls.termination: passthrough and spec.tls.insecureEdgeTerminationPolicy: Allow' + - name: 'spec.tls.termination: passthrough is compatible with spec.tls.insecureEdgeTerminationPolicy: Redirect' + initial: | + apiVersion: route.openshift.io/v1 + kind: Route + spec: + host: test.foo + to: + kind: Service + name: foo + tls: + termination: passthrough + insecureEdgeTerminationPolicy: Redirect + expected: | + apiVersion: route.openshift.io/v1 + kind: Route + spec: + host: test.foo + to: + kind: Service + name: foo + weight: 100 + tls: + termination: passthrough + insecureEdgeTerminationPolicy: Redirect + wildcardPolicy: None + - name: 'spec.tls.termination: passthrough is compatible with spec.tls.insecureEdgeTerminationPolicy: None' + initial: | + apiVersion: route.openshift.io/v1 + kind: Route + spec: + host: test.foo + to: + kind: Service + name: foo + tls: + termination: passthrough + insecureEdgeTerminationPolicy: None + expected: | + apiVersion: route.openshift.io/v1 + kind: Route + spec: + host: test.foo + to: + kind: Service + name: foo + weight: 100 + tls: + termination: passthrough + insecureEdgeTerminationPolicy: None + wildcardPolicy: None + - name: 'cannot have both spec.tls.certificate and spec.tls.externalCertificate' + initial: | + apiVersion: route.openshift.io/v1 + kind: Route + spec: + to: + kind: Service + name: foo + tls: + termination: edge + key: |- + -----BEGIN RSA PRIVATE KEY----- + -----END RSA PRIVATE KEY----- + certificate: |- + -----BEGIN CERTIFICATE----- + -----END CERTIFICATE----- + externalCertificate: + name: "my-local-secret" + expectedError: 'Invalid value: "object": cannot have both spec.tls.certificate and spec.tls.externalCertificate' diff --git a/vendor/github.com/openshift/api/route/v1/generated.pb.go b/vendor/github.com/openshift/api/route/v1/generated.pb.go index c80012bc3..203b647e1 100644 --- a/vendor/github.com/openshift/api/route/v1/generated.pb.go +++ b/vendor/github.com/openshift/api/route/v1/generated.pb.go @@ -30,10 +30,38 @@ var _ = math.Inf // proto package needs to be updated. const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package +func (m *LocalObjectReference) Reset() { *m = LocalObjectReference{} } +func (*LocalObjectReference) ProtoMessage() {} +func (*LocalObjectReference) Descriptor() ([]byte, []int) { + return fileDescriptor_373b8fa7ff738721, []int{0} +} +func (m *LocalObjectReference) XXX_Unmarshal(b []byte) error { + return m.Unmarshal(b) +} +func (m *LocalObjectReference) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) { + b = b[:cap(b)] + n, err := m.MarshalToSizedBuffer(b) + if err != nil { + return nil, err + } + return b[:n], nil +} +func (m *LocalObjectReference) XXX_Merge(src proto.Message) { + xxx_messageInfo_LocalObjectReference.Merge(m, src) +} +func (m *LocalObjectReference) XXX_Size() int { + return m.Size() +} +func (m *LocalObjectReference) XXX_DiscardUnknown() { + xxx_messageInfo_LocalObjectReference.DiscardUnknown(m) +} + +var xxx_messageInfo_LocalObjectReference proto.InternalMessageInfo + func (m *Route) Reset() { *m = Route{} } func (*Route) ProtoMessage() {} func (*Route) Descriptor() ([]byte, []int) { - return fileDescriptor_373b8fa7ff738721, []int{0} + return fileDescriptor_373b8fa7ff738721, []int{1} } func (m *Route) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -61,7 +89,7 @@ var xxx_messageInfo_Route proto.InternalMessageInfo func (m *RouteIngress) Reset() { *m = RouteIngress{} } func (*RouteIngress) ProtoMessage() {} func (*RouteIngress) Descriptor() ([]byte, []int) { - return fileDescriptor_373b8fa7ff738721, []int{1} + return fileDescriptor_373b8fa7ff738721, []int{2} } func (m *RouteIngress) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -89,7 +117,7 @@ var xxx_messageInfo_RouteIngress proto.InternalMessageInfo func (m *RouteIngressCondition) Reset() { *m = RouteIngressCondition{} } func (*RouteIngressCondition) ProtoMessage() {} func (*RouteIngressCondition) Descriptor() ([]byte, []int) { - return fileDescriptor_373b8fa7ff738721, []int{2} + return fileDescriptor_373b8fa7ff738721, []int{3} } func (m *RouteIngressCondition) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -117,7 +145,7 @@ var xxx_messageInfo_RouteIngressCondition proto.InternalMessageInfo func (m *RouteList) Reset() { *m = RouteList{} } func (*RouteList) ProtoMessage() {} func (*RouteList) Descriptor() ([]byte, []int) { - return fileDescriptor_373b8fa7ff738721, []int{3} + return fileDescriptor_373b8fa7ff738721, []int{4} } func (m *RouteList) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -145,7 +173,7 @@ var xxx_messageInfo_RouteList proto.InternalMessageInfo func (m *RoutePort) Reset() { *m = RoutePort{} } func (*RoutePort) ProtoMessage() {} func (*RoutePort) Descriptor() ([]byte, []int) { - return fileDescriptor_373b8fa7ff738721, []int{4} + return fileDescriptor_373b8fa7ff738721, []int{5} } func (m *RoutePort) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -173,7 +201,7 @@ var xxx_messageInfo_RoutePort proto.InternalMessageInfo func (m *RouteSpec) Reset() { *m = RouteSpec{} } func (*RouteSpec) ProtoMessage() {} func (*RouteSpec) Descriptor() ([]byte, []int) { - return fileDescriptor_373b8fa7ff738721, []int{5} + return fileDescriptor_373b8fa7ff738721, []int{6} } func (m *RouteSpec) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -201,7 +229,7 @@ var xxx_messageInfo_RouteSpec proto.InternalMessageInfo func (m *RouteStatus) Reset() { *m = RouteStatus{} } func (*RouteStatus) ProtoMessage() {} func (*RouteStatus) Descriptor() ([]byte, []int) { - return fileDescriptor_373b8fa7ff738721, []int{6} + return fileDescriptor_373b8fa7ff738721, []int{7} } func (m *RouteStatus) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -229,7 +257,7 @@ var xxx_messageInfo_RouteStatus proto.InternalMessageInfo func (m *RouteTargetReference) Reset() { *m = RouteTargetReference{} } func (*RouteTargetReference) ProtoMessage() {} func (*RouteTargetReference) Descriptor() ([]byte, []int) { - return fileDescriptor_373b8fa7ff738721, []int{7} + return fileDescriptor_373b8fa7ff738721, []int{8} } func (m *RouteTargetReference) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -257,7 +285,7 @@ var xxx_messageInfo_RouteTargetReference proto.InternalMessageInfo func (m *RouterShard) Reset() { *m = RouterShard{} } func (*RouterShard) ProtoMessage() {} func (*RouterShard) Descriptor() ([]byte, []int) { - return fileDescriptor_373b8fa7ff738721, []int{8} + return fileDescriptor_373b8fa7ff738721, []int{9} } func (m *RouterShard) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -285,7 +313,7 @@ var xxx_messageInfo_RouterShard proto.InternalMessageInfo func (m *TLSConfig) Reset() { *m = TLSConfig{} } func (*TLSConfig) ProtoMessage() {} func (*TLSConfig) Descriptor() ([]byte, []int) { - return fileDescriptor_373b8fa7ff738721, []int{9} + return fileDescriptor_373b8fa7ff738721, []int{10} } func (m *TLSConfig) XXX_Unmarshal(b []byte) error { return m.Unmarshal(b) @@ -311,6 +339,7 @@ func (m *TLSConfig) XXX_DiscardUnknown() { var xxx_messageInfo_TLSConfig proto.InternalMessageInfo func init() { + proto.RegisterType((*LocalObjectReference)(nil), "github.com.openshift.api.route.v1.LocalObjectReference") proto.RegisterType((*Route)(nil), "github.com.openshift.api.route.v1.Route") proto.RegisterType((*RouteIngress)(nil), "github.com.openshift.api.route.v1.RouteIngress") proto.RegisterType((*RouteIngressCondition)(nil), "github.com.openshift.api.route.v1.RouteIngressCondition") @@ -328,80 +357,111 @@ func init() { } var fileDescriptor_373b8fa7ff738721 = []byte{ - // 1168 bytes of a gzipped FileDescriptorProto - 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x57, 0xcf, 0x6f, 0x1b, 0xc5, - 0x17, 0xcf, 0xfa, 0x57, 0xe2, 0x71, 0xdb, 0xef, 0xb7, 0x03, 0xa5, 0x6e, 0xa4, 0xd8, 0xc9, 0x1e, - 0x50, 0x8a, 0xca, 0x2e, 0x09, 0x05, 0x2a, 0x21, 0x0e, 0x75, 0x8a, 0x4a, 0x1a, 0x27, 0x8d, 0xc6, - 0x16, 0x15, 0x55, 0x0f, 0x4c, 0x76, 0xc7, 0xeb, 0xc1, 0xf6, 0xec, 0x32, 0x33, 0x4e, 0xf1, 0x05, - 0x55, 0xe2, 0x1f, 0x28, 0xff, 0x0d, 0x77, 0x2e, 0x39, 0xf6, 0xd8, 0x03, 0xb2, 0x88, 0x39, 0xf2, - 0x1f, 0xe4, 0x84, 0x66, 0x76, 0xec, 0x5d, 0x3b, 0x4e, 0xe2, 0xc2, 0xcd, 0xfb, 0xde, 0xe7, 0xf3, - 0x79, 0x6f, 0xde, 0x7b, 0xf3, 0x46, 0x06, 0x5b, 0x01, 0x95, 0xed, 0xfe, 0x91, 0xe3, 0x85, 0x3d, - 0x37, 0x8c, 0x08, 0x13, 0x6d, 0xda, 0x92, 0x2e, 0x8e, 0xa8, 0xcb, 0xc3, 0xbe, 0x24, 0xee, 0xf1, - 0x96, 0x1b, 0x10, 0x46, 0x38, 0x96, 0xc4, 0x77, 0x22, 0x1e, 0xca, 0x10, 0x6e, 0x24, 0x14, 0x67, - 0x42, 0x71, 0x70, 0x44, 0x1d, 0x4d, 0x71, 0x8e, 0xb7, 0x56, 0x3f, 0x4e, 0xa9, 0x06, 0x61, 0x10, - 0xba, 0x9a, 0x79, 0xd4, 0x6f, 0xe9, 0x2f, 0xfd, 0xa1, 0x7f, 0xc5, 0x8a, 0xab, 0x76, 0xe7, 0x81, - 0x70, 0x68, 0xa8, 0xc3, 0x7a, 0x21, 0x9f, 0x17, 0x75, 0xf5, 0x7e, 0x82, 0xe9, 0x61, 0xaf, 0x4d, - 0x19, 0xe1, 0x03, 0x37, 0xea, 0x04, 0xca, 0x20, 0xdc, 0x1e, 0x91, 0x78, 0x1e, 0xeb, 0xf3, 0x8b, - 0x58, 0xbc, 0xcf, 0x24, 0xed, 0x11, 0x57, 0x78, 0x6d, 0xd2, 0xc3, 0xe7, 0x78, 0x9f, 0x5e, 0xc4, - 0xeb, 0x4b, 0xda, 0x75, 0x29, 0x93, 0x42, 0xf2, 0x59, 0x92, 0xfd, 0x6b, 0x06, 0xe4, 0x91, 0x2a, - 0x01, 0xfc, 0x1e, 0xac, 0xa8, 0x8c, 0x7c, 0x2c, 0x71, 0xd9, 0x5a, 0xb7, 0x36, 0x4b, 0xdb, 0x9f, - 0x38, 0xb1, 0xa2, 0x93, 0x56, 0x74, 0xa2, 0x4e, 0xa0, 0x0c, 0xc2, 0x51, 0x68, 0xe7, 0x78, 0xcb, - 0x79, 0x7a, 0xf4, 0x03, 0xf1, 0xe4, 0x3e, 0x91, 0xb8, 0x06, 0x4f, 0x86, 0xd5, 0xa5, 0xd1, 0xb0, - 0x0a, 0x12, 0x1b, 0x9a, 0xa8, 0xc2, 0x03, 0x90, 0x13, 0x11, 0xf1, 0xca, 0x19, 0xad, 0x7e, 0xcf, - 0xb9, 0xb2, 0x27, 0x8e, 0xce, 0xac, 0x11, 0x11, 0xaf, 0x76, 0xcd, 0x28, 0xe7, 0xd4, 0x17, 0xd2, - 0x3a, 0xf0, 0x5b, 0x50, 0x10, 0x12, 0xcb, 0xbe, 0x28, 0x67, 0xb5, 0xa2, 0xb3, 0xb0, 0xa2, 0x66, - 0xd5, 0x6e, 0x18, 0xcd, 0x42, 0xfc, 0x8d, 0x8c, 0x9a, 0xfd, 0x4b, 0x16, 0x5c, 0xd3, 0xb8, 0x5d, - 0x16, 0x70, 0x22, 0x04, 0x5c, 0x07, 0xb9, 0x76, 0x28, 0xa4, 0x2e, 0x4b, 0x31, 0x49, 0xe5, 0x9b, - 0x50, 0x48, 0xa4, 0x3d, 0x70, 0x1b, 0x00, 0x1d, 0x82, 0x1f, 0xe0, 0x1e, 0xd1, 0x07, 0x2c, 0x26, - 0xc5, 0x40, 0x13, 0x0f, 0x4a, 0xa1, 0x60, 0x17, 0x00, 0x2f, 0x64, 0x3e, 0x95, 0x34, 0x64, 0xea, - 0x08, 0xd9, 0xcd, 0xd2, 0xf6, 0x83, 0x45, 0x8f, 0x60, 0x52, 0xdb, 0x19, 0x0b, 0x24, 0xd1, 0x26, - 0x26, 0x81, 0x52, 0xfa, 0xb0, 0x09, 0x6e, 0xbc, 0xa4, 0x5d, 0xdf, 0xc3, 0xdc, 0x3f, 0x0c, 0xbb, - 0xd4, 0x1b, 0x94, 0x73, 0x3a, 0xcb, 0x7b, 0x86, 0x77, 0xe3, 0xd9, 0x94, 0xf7, 0x6c, 0x58, 0x85, - 0xd3, 0x96, 0xe6, 0x20, 0x22, 0x68, 0x46, 0x03, 0x7e, 0x07, 0x6e, 0xc7, 0x27, 0xda, 0xc1, 0x2c, - 0x64, 0xd4, 0xc3, 0x5d, 0x55, 0x14, 0xa6, 0x8a, 0x90, 0xd7, 0xf2, 0x55, 0x23, 0x7f, 0x1b, 0xcd, - 0x87, 0xa1, 0x8b, 0xf8, 0xf6, 0xdf, 0x19, 0x70, 0x6b, 0xee, 0x51, 0xe1, 0x57, 0x20, 0x27, 0x07, - 0x11, 0x31, 0xed, 0xb8, 0x3b, 0x6e, 0x87, 0x4a, 0xf0, 0x6c, 0x58, 0xbd, 0x33, 0x97, 0xa4, 0xb3, - 0xd7, 0x34, 0x58, 0x9f, 0x8c, 0x4d, 0xdc, 0xa7, 0xfb, 0xd3, 0x63, 0x70, 0x36, 0xac, 0xce, 0xb9, - 0xdb, 0xce, 0x44, 0x69, 0x7a, 0x58, 0xe0, 0x87, 0xa0, 0xc0, 0x09, 0x16, 0x21, 0xd3, 0x43, 0x58, - 0x4c, 0x86, 0x0a, 0x69, 0x2b, 0x32, 0x5e, 0x78, 0x17, 0x2c, 0xf7, 0x88, 0x10, 0x38, 0x20, 0xa6, - 0xf0, 0xff, 0x33, 0xc0, 0xe5, 0xfd, 0xd8, 0x8c, 0xc6, 0x7e, 0xc8, 0x01, 0xec, 0x62, 0x21, 0x9b, - 0x1c, 0x33, 0x11, 0x27, 0x4f, 0x4d, 0x3d, 0x4b, 0xdb, 0x1f, 0x2d, 0x76, 0x27, 0x15, 0xa3, 0xf6, - 0xc1, 0x68, 0x58, 0x85, 0xf5, 0x73, 0x4a, 0x68, 0x8e, 0xba, 0xfd, 0x9b, 0x05, 0x8a, 0xba, 0x70, - 0x75, 0x2a, 0x24, 0x7c, 0x71, 0x6e, 0x17, 0x38, 0x8b, 0xc5, 0x55, 0x6c, 0xbd, 0x09, 0xfe, 0x6f, - 0x4e, 0xb7, 0x32, 0xb6, 0xa4, 0xf6, 0xc0, 0x3e, 0xc8, 0x53, 0x49, 0x7a, 0xaa, 0xfe, 0x6a, 0xe6, - 0x37, 0x17, 0x9d, 0xf9, 0xda, 0x75, 0x23, 0x9a, 0xdf, 0x55, 0x74, 0x14, 0xab, 0xd8, 0x3f, 0x9a, - 0xcc, 0x0f, 0x43, 0x2e, 0xa1, 0x0f, 0x80, 0xc4, 0x3c, 0x20, 0x52, 0x7d, 0x5d, 0xb9, 0xc7, 0xd4, - 0x66, 0x74, 0xe2, 0xcd, 0xe8, 0xec, 0x32, 0xf9, 0x94, 0x37, 0x24, 0xa7, 0x2c, 0x48, 0x2e, 0x53, - 0x73, 0xa2, 0x85, 0x52, 0xba, 0xf6, 0xef, 0x39, 0x13, 0x53, 0x6d, 0xa3, 0x05, 0xd6, 0x83, 0x0b, - 0x8a, 0xa2, 0x7f, 0xe4, 0x87, 0x3d, 0x4c, 0x59, 0x79, 0x45, 0xc3, 0x6e, 0x1a, 0x58, 0xb1, 0x31, - 0x76, 0xa0, 0x04, 0xa3, 0x24, 0x23, 0x2c, 0xdb, 0x66, 0x42, 0x27, 0x92, 0x87, 0x58, 0xb6, 0x91, - 0xf6, 0xc0, 0x06, 0xc8, 0xc8, 0xd0, 0x2c, 0xbe, 0x2f, 0x16, 0xad, 0x60, 0x7c, 0x1c, 0x44, 0x5a, - 0x84, 0x13, 0xe6, 0x91, 0x1a, 0x30, 0xc2, 0x99, 0x66, 0x88, 0x32, 0x32, 0x84, 0xaf, 0x2c, 0x70, - 0x13, 0x77, 0x25, 0xe1, 0x0c, 0x4b, 0x52, 0xc3, 0x5e, 0x87, 0x30, 0x5f, 0x94, 0x73, 0xba, 0x4d, - 0xff, 0x3a, 0xc8, 0x1d, 0x13, 0xe4, 0xe6, 0xc3, 0x59, 0x65, 0x74, 0x3e, 0x18, 0x7c, 0x02, 0x72, - 0x91, 0x6a, 0x5d, 0xfe, 0xdd, 0x1e, 0x09, 0xd5, 0x96, 0xda, 0x8a, 0xae, 0x91, 0x6a, 0x96, 0xd6, - 0x80, 0x8f, 0x41, 0x56, 0x76, 0x45, 0xb9, 0xb0, 0xb0, 0x54, 0xb3, 0xde, 0xd8, 0x09, 0x59, 0x8b, - 0x06, 0xb5, 0xe5, 0xd1, 0xb0, 0x9a, 0x6d, 0xd6, 0x1b, 0x48, 0x29, 0xcc, 0x59, 0x9e, 0xcb, 0xff, - 0x7d, 0x79, 0xda, 0x14, 0x94, 0x52, 0xcf, 0x11, 0x7c, 0x0e, 0x96, 0x69, 0xbc, 0xb5, 0xca, 0x96, - 0xae, 0xb8, 0xfb, 0x8e, 0x8f, 0x41, 0xb2, 0x52, 0x8c, 0x01, 0x8d, 0x05, 0xed, 0x9f, 0xc1, 0xfb, - 0xf3, 0x7a, 0xa3, 0xe6, 0xac, 0x43, 0x99, 0x3f, 0x3b, 0xba, 0x7b, 0x94, 0xf9, 0x48, 0x7b, 0x14, - 0x82, 0x25, 0x6f, 0xda, 0x04, 0xa1, 0x5f, 0x33, 0xed, 0x81, 0x36, 0x28, 0xbc, 0x24, 0x34, 0x68, - 0x4b, 0x3d, 0x8d, 0xf9, 0x1a, 0x50, 0xdb, 0xef, 0x99, 0xb6, 0x20, 0xe3, 0xb1, 0x43, 0x73, 0x54, - 0xde, 0x68, 0x63, 0xee, 0xeb, 0xfb, 0xa0, 0x7e, 0xe8, 0xd7, 0xd2, 0x9a, 0xb9, 0x0f, 0x63, 0x07, - 0x4a, 0x30, 0x8a, 0xe0, 0x33, 0xd1, 0xe8, 0xb7, 0x5a, 0xf4, 0x27, 0x93, 0xca, 0x84, 0xf0, 0xe8, - 0xa0, 0x11, 0x3b, 0x50, 0x82, 0xb1, 0xff, 0xc8, 0x82, 0xe2, 0xa4, 0x9b, 0x70, 0x0f, 0x94, 0x24, - 0xe1, 0x3d, 0xca, 0xb0, 0x5a, 0x78, 0x33, 0x0f, 0x47, 0xa9, 0x99, 0xb8, 0x54, 0xe7, 0x9a, 0xf5, - 0x46, 0xca, 0xa2, 0x3b, 0x97, 0x66, 0xc3, 0xcf, 0x40, 0xc9, 0x23, 0x5c, 0xd2, 0x16, 0xf5, 0xb0, - 0x1c, 0x17, 0xe6, 0xbd, 0xb1, 0xd8, 0x4e, 0xe2, 0x42, 0x69, 0x1c, 0x5c, 0x03, 0xd9, 0x0e, 0x19, - 0x98, 0x57, 0xa2, 0x64, 0xe0, 0xd9, 0x3d, 0x32, 0x40, 0xca, 0x0e, 0xbf, 0x04, 0xd7, 0x3d, 0x9c, - 0x22, 0x9b, 0x57, 0xe2, 0x96, 0x01, 0x5e, 0xdf, 0x79, 0x98, 0x56, 0x9e, 0xc6, 0xc2, 0x17, 0xa0, - 0xec, 0x13, 0x21, 0x4d, 0x86, 0x53, 0x50, 0xf3, 0x0e, 0xaf, 0x1b, 0x9d, 0xf2, 0xa3, 0x0b, 0x70, - 0xe8, 0x42, 0x05, 0xf8, 0xda, 0x02, 0x6b, 0x94, 0x09, 0xe2, 0xf5, 0x39, 0xf9, 0xda, 0x0f, 0x48, - 0xaa, 0x3a, 0xe6, 0x36, 0x14, 0x74, 0x8c, 0x27, 0x26, 0xc6, 0xda, 0xee, 0x65, 0xe0, 0xb3, 0x61, - 0x75, 0xe3, 0x52, 0x80, 0xae, 0xf8, 0xe5, 0x01, 0x6b, 0x8f, 0x4f, 0x4e, 0x2b, 0x4b, 0x6f, 0x4e, - 0x2b, 0x4b, 0x6f, 0x4f, 0x2b, 0x4b, 0xaf, 0x46, 0x15, 0xeb, 0x64, 0x54, 0xb1, 0xde, 0x8c, 0x2a, - 0xd6, 0xdb, 0x51, 0xc5, 0xfa, 0x73, 0x54, 0xb1, 0x5e, 0xff, 0x55, 0x59, 0x7a, 0xbe, 0x71, 0xe5, - 0x1f, 0x85, 0x7f, 0x02, 0x00, 0x00, 0xff, 0xff, 0x2a, 0x8e, 0xb3, 0x95, 0x4c, 0x0c, 0x00, 0x00, + // 1216 bytes of a gzipped FileDescriptorProto + 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x57, 0xcf, 0x8f, 0x13, 0xb7, + 0x17, 0xdf, 0x49, 0xb2, 0x3f, 0xe2, 0x00, 0xdf, 0x2f, 0x06, 0x4a, 0xa0, 0x22, 0x81, 0x39, 0x54, + 0x50, 0xd1, 0x99, 0xee, 0x96, 0xb6, 0x48, 0x55, 0x0f, 0xcc, 0x82, 0xe8, 0x42, 0x58, 0x90, 0x13, + 0x15, 0x15, 0x71, 0xa8, 0x77, 0xc6, 0x99, 0xb8, 0x9b, 0xd8, 0x53, 0xdb, 0x01, 0xf6, 0x52, 0x21, + 0x55, 0xea, 0x99, 0xfe, 0x37, 0xbd, 0xf7, 0xc2, 0x91, 0x23, 0xa7, 0xa8, 0xa4, 0xea, 0xa9, 0xff, + 0xc1, 0x9e, 0x2a, 0x7b, 0x9c, 0x99, 0x49, 0x36, 0x81, 0xd0, 0xde, 0xe2, 0xf7, 0xde, 0xe7, 0xf3, + 0x7e, 0xfa, 0x79, 0x02, 0x36, 0x63, 0xaa, 0x7a, 0xc3, 0x3d, 0x2f, 0xe4, 0x03, 0x9f, 0x27, 0x84, + 0xc9, 0x1e, 0xed, 0x2a, 0x1f, 0x27, 0xd4, 0x17, 0x7c, 0xa8, 0x88, 0xff, 0x64, 0xd3, 0x8f, 0x09, + 0x23, 0x02, 0x2b, 0x12, 0x79, 0x89, 0xe0, 0x8a, 0xc3, 0x4b, 0x39, 0xc4, 0xcb, 0x20, 0x1e, 0x4e, + 0xa8, 0x67, 0x20, 0xde, 0x93, 0xcd, 0xf3, 0x9f, 0x14, 0x58, 0x63, 0x1e, 0x73, 0xdf, 0x20, 0xf7, + 0x86, 0x5d, 0x73, 0x32, 0x07, 0xf3, 0x2b, 0x65, 0x3c, 0xef, 0xee, 0x5f, 0x97, 0x1e, 0xe5, 0xc6, + 0x6d, 0xc8, 0xc5, 0x3c, 0xaf, 0xe7, 0xaf, 0xe5, 0x36, 0x03, 0x1c, 0xf6, 0x28, 0x23, 0xe2, 0xc0, + 0x4f, 0xf6, 0x63, 0x2d, 0x90, 0xfe, 0x80, 0x28, 0x3c, 0x0f, 0xf5, 0xc5, 0x22, 0x94, 0x18, 0x32, + 0x45, 0x07, 0xc4, 0x97, 0x61, 0x8f, 0x0c, 0xf0, 0x11, 0xdc, 0x67, 0x8b, 0x70, 0x43, 0x45, 0xfb, + 0x3e, 0x65, 0x4a, 0x2a, 0x31, 0x0b, 0x72, 0xaf, 0x83, 0xd3, 0x2d, 0x1e, 0xe2, 0xfe, 0xfd, 0xbd, + 0x1f, 0x48, 0xa8, 0x10, 0xe9, 0x12, 0x41, 0x58, 0x48, 0xe0, 0x45, 0x50, 0x61, 0x78, 0x40, 0xea, + 0xce, 0x45, 0xe7, 0x72, 0x35, 0x38, 0xf6, 0x72, 0xd4, 0x5c, 0x19, 0x8f, 0x9a, 0x95, 0x5d, 0x3c, + 0x20, 0xc8, 0x68, 0xdc, 0x5f, 0x4b, 0x60, 0x15, 0xe9, 0xe2, 0xc1, 0xef, 0xc1, 0x86, 0xce, 0x25, + 0xc2, 0x0a, 0x1b, 0xfb, 0xda, 0xd6, 0xa7, 0x5e, 0x1a, 0x8b, 0x57, 0x8c, 0xc5, 0x4b, 0xf6, 0x63, + 0x2d, 0x90, 0x9e, 0xb6, 0xf6, 0x9e, 0x6c, 0x7a, 0xa9, 0xd3, 0x7b, 0x44, 0xe1, 0x00, 0x5a, 0x0f, + 0x20, 0x97, 0xa1, 0x8c, 0x15, 0xee, 0x82, 0x8a, 0x4c, 0x48, 0x58, 0x2f, 0x19, 0xf6, 0xab, 0xde, + 0x3b, 0xbb, 0xe9, 0x99, 0xc8, 0xda, 0x09, 0x09, 0xf3, 0xd8, 0xf5, 0x09, 0x19, 0x1e, 0xf8, 0x2d, + 0x58, 0x93, 0x0a, 0xab, 0xa1, 0xac, 0x97, 0x0d, 0xa3, 0xb7, 0x34, 0xa3, 0x41, 0x05, 0x27, 0x2c, + 0xe7, 0x5a, 0x7a, 0x46, 0x96, 0xcd, 0xfd, 0xb9, 0x0c, 0x8e, 0x19, 0xbb, 0x1d, 0x16, 0x0b, 0x22, + 0xa5, 0x2e, 0x63, 0x8f, 0x4b, 0x35, 0x5b, 0xc6, 0x6f, 0xb8, 0x54, 0xc8, 0x68, 0xe0, 0x16, 0x00, + 0xc6, 0x85, 0xd0, 0xa5, 0x35, 0x09, 0x56, 0xf3, 0x62, 0xa0, 0x4c, 0x83, 0x0a, 0x56, 0xb0, 0x0f, + 0x40, 0xc8, 0x59, 0x44, 0x15, 0xe5, 0x4c, 0xa7, 0x50, 0xbe, 0x5c, 0xdb, 0xba, 0xbe, 0x6c, 0x0a, + 0x36, 0xb4, 0xed, 0x09, 0x41, 0xee, 0x2d, 0x13, 0x49, 0x54, 0xe0, 0x87, 0x1d, 0x70, 0xe2, 0x29, + 0xed, 0x47, 0x21, 0x16, 0xd1, 0x03, 0xde, 0xa7, 0xe1, 0x41, 0xbd, 0x62, 0xa2, 0xbc, 0x6a, 0x71, + 0x27, 0x1e, 0x4e, 0x69, 0x0f, 0x47, 0x4d, 0x38, 0x2d, 0xe9, 0x1c, 0x24, 0x04, 0xcd, 0x70, 0xc0, + 0xef, 0xc0, 0xd9, 0x34, 0xa3, 0x6d, 0xcc, 0x38, 0xa3, 0x21, 0xee, 0xeb, 0xa2, 0x98, 0x99, 0x5b, + 0x35, 0xf4, 0x4d, 0x4b, 0x7f, 0x16, 0xcd, 0x37, 0x43, 0x8b, 0xf0, 0xee, 0xdf, 0x25, 0x70, 0x66, + 0x6e, 0xaa, 0xf0, 0x6b, 0x50, 0x51, 0x07, 0xc9, 0x64, 0xaa, 0xaf, 0x4c, 0xda, 0xa1, 0x03, 0x3c, + 0x1c, 0x35, 0xcf, 0xcd, 0x05, 0x99, 0xe8, 0x0d, 0x0c, 0xb6, 0xb2, 0xb1, 0x49, 0xfb, 0x74, 0x6d, + 0x7a, 0x0c, 0x0e, 0x47, 0xcd, 0x39, 0x5b, 0xc1, 0xcb, 0x98, 0xa6, 0x87, 0x05, 0x7e, 0x04, 0xd6, + 0x04, 0xc1, 0x92, 0x33, 0x33, 0x84, 0xd5, 0x7c, 0xa8, 0x90, 0x91, 0x22, 0xab, 0x85, 0x57, 0xc0, + 0xfa, 0x80, 0x48, 0x89, 0x63, 0x62, 0x0b, 0xff, 0x3f, 0x6b, 0xb8, 0x7e, 0x2f, 0x15, 0xa3, 0x89, + 0x1e, 0x0a, 0x00, 0xfb, 0x58, 0xaa, 0x8e, 0xc0, 0x4c, 0xa6, 0xc1, 0x53, 0x5b, 0xcf, 0xda, 0xd6, + 0xc7, 0xcb, 0xdd, 0x49, 0x8d, 0x08, 0x3e, 0x18, 0x8f, 0x9a, 0xb0, 0x75, 0x84, 0x09, 0xcd, 0x61, + 0x77, 0x7f, 0x73, 0x40, 0xd5, 0x14, 0xae, 0x45, 0xa5, 0x82, 0x8f, 0x8f, 0xec, 0x02, 0x6f, 0x39, + 0xbf, 0x1a, 0x6d, 0x36, 0xc1, 0xff, 0x6d, 0x76, 0x1b, 0x13, 0x49, 0x61, 0x0f, 0xdc, 0x03, 0xab, + 0x54, 0x91, 0x81, 0xae, 0xbf, 0x9e, 0xf9, 0xcb, 0xcb, 0xce, 0x7c, 0x70, 0xdc, 0x92, 0xae, 0xee, + 0x68, 0x38, 0x4a, 0x59, 0xdc, 0x1f, 0x6d, 0xe4, 0x0f, 0xb8, 0x50, 0x30, 0x02, 0x40, 0x61, 0x11, + 0x13, 0xa5, 0x4f, 0xef, 0xdc, 0x63, 0x7a, 0xa7, 0x7a, 0xe9, 0x4e, 0xf5, 0x76, 0x98, 0xba, 0x2f, + 0xda, 0x4a, 0x50, 0x16, 0xe7, 0x97, 0xa9, 0x93, 0x71, 0xa1, 0x02, 0xaf, 0xfb, 0x7b, 0xc5, 0xfa, + 0xd4, 0xdb, 0x68, 0x89, 0xf5, 0xe0, 0x83, 0xaa, 0x1c, 0xee, 0x45, 0x7c, 0x80, 0x29, 0xab, 0x6f, + 0x18, 0xb3, 0x93, 0xd6, 0xac, 0xda, 0x9e, 0x28, 0x50, 0x6e, 0xa3, 0x29, 0x13, 0xac, 0x7a, 0x76, + 0x42, 0x33, 0xca, 0x07, 0x58, 0xf5, 0x90, 0xd1, 0xc0, 0x36, 0x28, 0x29, 0x6e, 0x17, 0xdf, 0x97, + 0xcb, 0x56, 0x30, 0x4d, 0x27, 0x7b, 0x1f, 0x02, 0x60, 0x89, 0x4b, 0x1d, 0x8e, 0x4a, 0x8a, 0xc3, + 0xe7, 0x0e, 0x38, 0x89, 0xfb, 0x8a, 0x08, 0x86, 0x15, 0x09, 0x70, 0xb8, 0x4f, 0x58, 0x24, 0xeb, + 0x15, 0xd3, 0xa6, 0x7f, 0xed, 0xe4, 0x9c, 0x75, 0x72, 0xf2, 0xc6, 0x2c, 0x33, 0x3a, 0xea, 0x0c, + 0xde, 0x01, 0x95, 0x44, 0xb7, 0x6e, 0xf5, 0xfd, 0x1e, 0x09, 0xdd, 0x96, 0x60, 0xc3, 0xd4, 0x48, + 0x37, 0xcb, 0x70, 0xc0, 0xdb, 0xa0, 0xac, 0xfa, 0xb2, 0xbe, 0xb6, 0x34, 0x55, 0xa7, 0xd5, 0xde, + 0xe6, 0xac, 0x4b, 0xe3, 0x60, 0x7d, 0x3c, 0x6a, 0x96, 0x3b, 0xad, 0x36, 0xd2, 0x0c, 0x73, 0x96, + 0xe7, 0xfa, 0x7f, 0x5f, 0x9e, 0x2e, 0x05, 0xb5, 0xc2, 0x73, 0x04, 0x1f, 0x81, 0x75, 0x9a, 0x6e, + 0xad, 0xba, 0x63, 0x2a, 0xee, 0xbf, 0xe7, 0x63, 0x90, 0xaf, 0x14, 0x2b, 0x40, 0x13, 0x42, 0xf7, + 0x27, 0x70, 0x7a, 0x5e, 0x6f, 0xf4, 0x9c, 0xed, 0x53, 0x16, 0xcd, 0x8e, 0xee, 0x5d, 0xca, 0x22, + 0x64, 0x34, 0xd9, 0x27, 0x44, 0x69, 0xd1, 0x27, 0x04, 0x74, 0xc1, 0xda, 0x53, 0x42, 0xe3, 0x9e, + 0x32, 0xd3, 0xb8, 0x1a, 0x00, 0xbd, 0xfd, 0x1e, 0x1a, 0x09, 0xb2, 0x1a, 0x97, 0xdb, 0x54, 0x45, + 0xbb, 0x87, 0x45, 0x64, 0xee, 0x83, 0xfe, 0xb1, 0x9b, 0x7f, 0x9c, 0xe4, 0xf7, 0x61, 0xa2, 0x40, + 0xb9, 0x8d, 0x06, 0x44, 0x4c, 0xb6, 0x87, 0xdd, 0x2e, 0x7d, 0x66, 0x43, 0xc9, 0x00, 0x37, 0x77, + 0xdb, 0xa9, 0x02, 0xe5, 0x36, 0xee, 0x5f, 0x15, 0x50, 0xcd, 0xba, 0x09, 0xef, 0x82, 0x9a, 0x22, + 0x62, 0x40, 0x19, 0xd6, 0x0b, 0x6f, 0xe6, 0xe1, 0xa8, 0x75, 0x72, 0x95, 0xee, 0x5c, 0xa7, 0xd5, + 0x2e, 0x48, 0x4c, 0xe7, 0x8a, 0x68, 0xf8, 0x39, 0xa8, 0x85, 0x44, 0x28, 0xda, 0xa5, 0x21, 0x56, + 0x93, 0xc2, 0x9c, 0x9a, 0x90, 0x6d, 0xe7, 0x2a, 0x54, 0xb4, 0x83, 0x17, 0x40, 0x79, 0x9f, 0x1c, + 0xd8, 0x57, 0xa2, 0x66, 0xcd, 0xcb, 0x77, 0xc9, 0x01, 0xd2, 0x72, 0xf8, 0x15, 0x38, 0x1e, 0xe2, + 0x02, 0xd8, 0xbe, 0x12, 0x67, 0xac, 0xe1, 0xf1, 0xed, 0x1b, 0x45, 0xe6, 0x69, 0x5b, 0xf8, 0x18, + 0xd4, 0x23, 0x22, 0x95, 0x8d, 0x70, 0xca, 0xd4, 0xbe, 0xc3, 0x17, 0x2d, 0x4f, 0xfd, 0xe6, 0x02, + 0x3b, 0xb4, 0x90, 0x01, 0xbe, 0x70, 0xc0, 0x05, 0xca, 0x24, 0x09, 0x87, 0x82, 0xdc, 0x8a, 0x62, + 0x52, 0xa8, 0x8e, 0xbd, 0x0d, 0x6b, 0xc6, 0xc7, 0x1d, 0xeb, 0xe3, 0xc2, 0xce, 0xdb, 0x8c, 0x0f, + 0x47, 0xcd, 0x4b, 0x6f, 0x35, 0x30, 0x15, 0x7f, 0xbb, 0x43, 0xf8, 0x8b, 0x03, 0x4e, 0x91, 0x67, + 0x66, 0x77, 0xf4, 0x8b, 0xc9, 0xae, 0x2f, 0xbd, 0x0f, 0xe7, 0x7d, 0x2f, 0x07, 0x1f, 0xda, 0x0c, + 0x4e, 0xdd, 0x3a, 0xca, 0x8d, 0xe6, 0x39, 0x0c, 0x6e, 0xbf, 0x7c, 0xd3, 0x58, 0x79, 0xf5, 0xa6, + 0xb1, 0xf2, 0xfa, 0x4d, 0x63, 0xe5, 0xf9, 0xb8, 0xe1, 0xbc, 0x1c, 0x37, 0x9c, 0x57, 0xe3, 0x86, + 0xf3, 0x7a, 0xdc, 0x70, 0xfe, 0x18, 0x37, 0x9c, 0x17, 0x7f, 0x36, 0x56, 0x1e, 0x5d, 0x7a, 0xe7, + 0x7f, 0x9d, 0x7f, 0x02, 0x00, 0x00, 0xff, 0xff, 0xa2, 0x48, 0x48, 0xf0, 0x0f, 0x0d, 0x00, 0x00, +} + +func (m *LocalObjectReference) Marshal() (dAtA []byte, err error) { + size := m.Size() + dAtA = make([]byte, size) + n, err := m.MarshalToSizedBuffer(dAtA[:size]) + if err != nil { + return nil, err + } + return dAtA[:n], nil +} + +func (m *LocalObjectReference) MarshalTo(dAtA []byte) (int, error) { + size := m.Size() + return m.MarshalToSizedBuffer(dAtA[:size]) +} + +func (m *LocalObjectReference) MarshalToSizedBuffer(dAtA []byte) (int, error) { + i := len(dAtA) + _ = i + var l int + _ = l + i -= len(m.Name) + copy(dAtA[i:], m.Name) + i = encodeVarintGenerated(dAtA, i, uint64(len(m.Name))) + i-- + dAtA[i] = 0xa + return len(dAtA) - i, nil } func (m *Route) Marshal() (dAtA []byte, err error) { @@ -868,6 +928,16 @@ func (m *TLSConfig) MarshalToSizedBuffer(dAtA []byte) (int, error) { _ = i var l int _ = l + { + size, err := m.ExternalCertificate.MarshalToSizedBuffer(dAtA[:i]) + if err != nil { + return 0, err + } + i -= size + i = encodeVarintGenerated(dAtA, i, uint64(size)) + } + i-- + dAtA[i] = 0x3a i -= len(m.InsecureEdgeTerminationPolicy) copy(dAtA[i:], m.InsecureEdgeTerminationPolicy) i = encodeVarintGenerated(dAtA, i, uint64(len(m.InsecureEdgeTerminationPolicy))) @@ -912,6 +982,17 @@ func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int { dAtA[offset] = uint8(v) return base } +func (m *LocalObjectReference) Size() (n int) { + if m == nil { + return 0 + } + var l int + _ = l + l = len(m.Name) + n += 1 + l + sovGenerated(uint64(l)) + return n +} + func (m *Route) Size() (n int) { if m == nil { return 0 @@ -1094,6 +1175,8 @@ func (m *TLSConfig) Size() (n int) { n += 1 + l + sovGenerated(uint64(l)) l = len(m.InsecureEdgeTerminationPolicy) n += 1 + l + sovGenerated(uint64(l)) + l = m.ExternalCertificate.Size() + n += 1 + l + sovGenerated(uint64(l)) return n } @@ -1103,6 +1186,16 @@ func sovGenerated(x uint64) (n int) { func sozGenerated(x uint64) (n int) { return sovGenerated(uint64((x << 1) ^ uint64((int64(x) >> 63)))) } +func (this *LocalObjectReference) String() string { + if this == nil { + return "nil" + } + s := strings.Join([]string{`&LocalObjectReference{`, + `Name:` + fmt.Sprintf("%v", this.Name) + `,`, + `}`, + }, "") + return s +} func (this *Route) String() string { if this == nil { return "nil" @@ -1245,6 +1338,7 @@ func (this *TLSConfig) String() string { `CACertificate:` + fmt.Sprintf("%v", this.CACertificate) + `,`, `DestinationCACertificate:` + fmt.Sprintf("%v", this.DestinationCACertificate) + `,`, `InsecureEdgeTerminationPolicy:` + fmt.Sprintf("%v", this.InsecureEdgeTerminationPolicy) + `,`, + `ExternalCertificate:` + strings.Replace(strings.Replace(this.ExternalCertificate.String(), "LocalObjectReference", "LocalObjectReference", 1), `&`, ``, 1) + `,`, `}`, }, "") return s @@ -1257,6 +1351,88 @@ func valueToStringGenerated(v interface{}) string { pv := reflect.Indirect(rv).Interface() return fmt.Sprintf("*%v", pv) } +func (m *LocalObjectReference) Unmarshal(dAtA []byte) error { + l := len(dAtA) + iNdEx := 0 + for iNdEx < l { + preIndex := iNdEx + var wire uint64 + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowGenerated + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + wire |= uint64(b&0x7F) << shift + if b < 0x80 { + break + } + } + fieldNum := int32(wire >> 3) + wireType := int(wire & 0x7) + if wireType == 4 { + return fmt.Errorf("proto: LocalObjectReference: wiretype end group for non-group") + } + if fieldNum <= 0 { + return fmt.Errorf("proto: LocalObjectReference: illegal tag %d (wire type %d)", fieldNum, wire) + } + switch fieldNum { + case 1: + if wireType != 2 { + return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType) + } + var stringLen uint64 + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowGenerated + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + stringLen |= uint64(b&0x7F) << shift + if b < 0x80 { + break + } + } + intStringLen := int(stringLen) + if intStringLen < 0 { + return ErrInvalidLengthGenerated + } + postIndex := iNdEx + intStringLen + if postIndex < 0 { + return ErrInvalidLengthGenerated + } + if postIndex > l { + return io.ErrUnexpectedEOF + } + m.Name = string(dAtA[iNdEx:postIndex]) + iNdEx = postIndex + default: + iNdEx = preIndex + skippy, err := skipGenerated(dAtA[iNdEx:]) + if err != nil { + return err + } + if (skippy < 0) || (iNdEx+skippy) < 0 { + return ErrInvalidLengthGenerated + } + if (iNdEx + skippy) > l { + return io.ErrUnexpectedEOF + } + iNdEx += skippy + } + } + + if iNdEx > l { + return io.ErrUnexpectedEOF + } + return nil +} func (m *Route) Unmarshal(dAtA []byte) error { l := len(dAtA) iNdEx := 0 @@ -2902,6 +3078,39 @@ func (m *TLSConfig) Unmarshal(dAtA []byte) error { } m.InsecureEdgeTerminationPolicy = InsecureEdgeTerminationPolicyType(dAtA[iNdEx:postIndex]) iNdEx = postIndex + case 7: + if wireType != 2 { + return fmt.Errorf("proto: wrong wireType = %d for field ExternalCertificate", wireType) + } + var msglen int + for shift := uint(0); ; shift += 7 { + if shift >= 64 { + return ErrIntOverflowGenerated + } + if iNdEx >= l { + return io.ErrUnexpectedEOF + } + b := dAtA[iNdEx] + iNdEx++ + msglen |= int(b&0x7F) << shift + if b < 0x80 { + break + } + } + if msglen < 0 { + return ErrInvalidLengthGenerated + } + postIndex := iNdEx + msglen + if postIndex < 0 { + return ErrInvalidLengthGenerated + } + if postIndex > l { + return io.ErrUnexpectedEOF + } + if err := m.ExternalCertificate.Unmarshal(dAtA[iNdEx:postIndex]); err != nil { + return err + } + iNdEx = postIndex default: iNdEx = preIndex skippy, err := skipGenerated(dAtA[iNdEx:]) diff --git a/vendor/github.com/openshift/api/route/v1/generated.proto b/vendor/github.com/openshift/api/route/v1/generated.proto index b6bfc1639..93d78bf19 100644 --- a/vendor/github.com/openshift/api/route/v1/generated.proto +++ b/vendor/github.com/openshift/api/route/v1/generated.proto @@ -13,6 +13,16 @@ import "k8s.io/apimachinery/pkg/util/intstr/generated.proto"; // Package-wide variables from generator "generated". option go_package = "github.com/openshift/api/route/v1"; +// LocalObjectReference contains enough information to let you locate the +// referenced object inside the same namespace. +// +structType=atomic +message LocalObjectReference { + // name of the referent. + // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + // +optional + optional string name = 1; +} + // A route allows developers to expose services through an HTTP(S) aware load balancing and proxy // layer via a public DNS entry. The route may further specify TLS options and a certificate, or // specify a public CNAME that the router should also accept for HTTP and HTTPS traffic. An @@ -244,6 +254,7 @@ message RouterShard { // TLSConfig defines config used to secure a route and provide termination // // +kubebuilder:validation:XValidation:rule="has(self.termination) && has(self.insecureEdgeTerminationPolicy) ? !((self.termination=='passthrough') && (self.insecureEdgeTerminationPolicy=='Allow')) : true", message="cannot have both spec.tls.termination: passthrough and spec.tls.insecureEdgeTerminationPolicy: Allow" +// +openshift:validation:FeatureSetAwareXValidation:featureSet=TechPreviewNoUpgrade;CustomNoUpgrade,rule="!(has(self.certificate) && has(self.externalCertificate))", message="cannot have both spec.tls.certificate and spec.tls.externalCertificate" message TLSConfig { // termination indicates termination type. // @@ -280,5 +291,15 @@ message TLSConfig { // // +kubebuilder:validation:Enum=Allow;None;Redirect;"" optional string insecureEdgeTerminationPolicy = 6; + + // externalCertificate provides certificate contents as a secret reference. + // This should be a single serving certificate, not a certificate + // chain. Do not include a CA certificate. The secret referenced should + // be present in the same namespace as that of the Route. + // Forbidden when `certificate` is set. + // + // +openshift:enable:FeatureSets=CustomNoUpgrade;TechPreviewNoUpgrade + // +optional + optional LocalObjectReference externalCertificate = 7; } diff --git a/vendor/github.com/openshift/api/route/v1/route-CustomNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/route/v1/route-CustomNoUpgrade.crd.yaml new file mode 100644 index 000000000..7e5ebd227 --- /dev/null +++ b/vendor/github.com/openshift/api/route/v1/route-CustomNoUpgrade.crd.yaml @@ -0,0 +1,237 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.openshift.io: https://github.com/openshift/api/pull/1228 + release.openshift.io/feature-set: CustomNoUpgrade + name: routes.route.openshift.io +spec: + group: route.openshift.io + names: + kind: Route + plural: routes + singular: route + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.ingress[0].host + name: Host + type: string + - jsonPath: .status.ingress[0].conditions[?(@.type=="Admitted")].status + name: Admitted + type: string + - jsonPath: .spec.to.name + name: Service + type: string + - jsonPath: .spec.tls.type + name: TLS + type: string + name: v1 + schema: + openAPIV3Schema: + description: "A route allows developers to expose services through an HTTP(S) aware load balancing and proxy layer via a public DNS entry. The route may further specify TLS options and a certificate, or specify a public CNAME that the router should also accept for HTTP and HTTPS traffic. An administrator typically configures their router to be visible outside the cluster firewall, and may also add additional security, caching, or traffic controls on the service content. Routers usually talk directly to the service endpoints. \n Once a route is created, the `host` field may not be changed. Generally, routers use the oldest route with a given host when resolving conflicts. \n Routers are subject to additional customization and may support additional controls via the annotations field. \n Because administrators may configure multiple routers, the route status field is used to return information to clients about the names and states of the route under each router. If a client chooses a duplicate name, for instance, the route status conditions are used to indicate the route cannot be chosen. \n To enable HTTP/2 ALPN on a route it requires a custom (non-wildcard) certificate. This prevents connection coalescing by clients, notably web browsers. We do not support HTTP/2 ALPN on routes that use the default certificate because of the risk of connection re-use/coalescing. Routes that do not have their own custom certificate will not be HTTP/2 ALPN-enabled on either the frontend or the backend. \n Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer)." + type: object + required: + - spec + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: spec is the desired state of the route + type: object + required: + - to + properties: + alternateBackends: + description: alternateBackends allows up to 3 additional backends to be assigned to the route. Only the Service kind is allowed, and it will be defaulted to Service. Use the weight field in RouteTargetReference object to specify relative preference. + type: array + maxItems: 3 + items: + description: RouteTargetReference specifies the target that resolve into endpoints. Only the 'Service' kind is allowed. Use 'weight' field to emphasize one over others. + type: object + required: + - kind + - name + properties: + kind: + description: The kind of target that the route is referring to. Currently, only 'Service' is allowed + type: string + default: Service + enum: + - Service + - "" + name: + description: name of the service/target that is being referred to. e.g. name of the service + type: string + minLength: 1 + weight: + description: weight as an integer between 0 and 256, default 100, that specifies the target's relative weight against other target reference objects. 0 suppresses requests to this backend. + type: integer + format: int32 + default: 100 + maximum: 256 + minimum: 0 + host: + description: host is an alias/DNS that points to the service. Optional. If not specified a route name will typically be automatically chosen. Must follow DNS952 subdomain conventions. + type: string + maxLength: 253 + pattern: ^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])(\.([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9]))*$ + path: + description: path that the router watches for, to route traffic for to the service. Optional + type: string + pattern: ^/ + port: + description: If specified, the port to be used by the router. Most routers will use all endpoints exposed by the service by default - set this value to instruct routers which port to use. + type: object + required: + - targetPort + properties: + targetPort: + description: The target port on pods selected by the service this route points to. If this is a string, it will be looked up as a named port in the target endpoints port list. Required + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + subdomain: + description: "subdomain is a DNS subdomain that is requested within the ingress controller's domain (as a subdomain). If host is set this field is ignored. An ingress controller may choose to ignore this suggested name, in which case the controller will report the assigned name in the status.ingress array or refuse to admit the route. If this value is set and the server does not support this field host will be populated automatically. Otherwise host is left empty. The field may have multiple parts separated by a dot, but not all ingress controllers may honor the request. This field may not be changed after creation except by a user with the update routes/custom-host permission. \n Example: subdomain `frontend` automatically receives the router subdomain `apps.mycluster.com` to have a full hostname `frontend.apps.mycluster.com`." + type: string + maxLength: 253 + pattern: ^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])(\.([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9]))*$ + tls: + description: The tls field provides the ability to configure certificates and termination for the route. + type: object + required: + - termination + properties: + caCertificate: + description: caCertificate provides the cert authority certificate contents + type: string + certificate: + description: certificate provides certificate contents. This should be a single serving certificate, not a certificate chain. Do not include a CA certificate. + type: string + destinationCACertificate: + description: destinationCACertificate provides the contents of the ca certificate of the final destination. When using reencrypt termination this file should be provided in order to have routers use it for health checks on the secure connection. If this field is not specified, the router may provide its own destination CA and perform hostname validation using the short service name (service.namespace.svc), which allows infrastructure generated certificates to automatically verify. + type: string + externalCertificate: + description: externalCertificate provides certificate contents as a secret reference. This should be a single serving certificate, not a certificate chain. Do not include a CA certificate. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set. + type: object + properties: + name: + description: 'name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + x-kubernetes-map-type: atomic + insecureEdgeTerminationPolicy: + description: "insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While each router may make its own decisions on which ports to expose, this is normally port 80. \n * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only) (default). * None - no traffic is allowed on the insecure port. * Redirect - clients are redirected to the secure port." + type: string + enum: + - Allow + - None + - Redirect + - "" + key: + description: key provides key file contents + type: string + termination: + description: "termination indicates termination type. \n * edge - TLS termination is done by the router and http is used to communicate with the backend (default) * passthrough - Traffic is sent straight to the destination without the router providing TLS termination * reencrypt - TLS termination is done by the router and https is used to communicate with the backend" + type: string + enum: + - edge + - reencrypt + - passthrough + x-kubernetes-validations: + - rule: 'has(self.termination) && has(self.insecureEdgeTerminationPolicy) ? !((self.termination==''passthrough'') && (self.insecureEdgeTerminationPolicy==''Allow'')) : true' + message: 'cannot have both spec.tls.termination: passthrough and spec.tls.insecureEdgeTerminationPolicy: Allow' + - rule: '!(has(self.certificate) && has(self.externalCertificate))' + message: cannot have both spec.tls.certificate and spec.tls.externalCertificate + to: + description: to is an object the route should use as the primary backend. Only the Service kind is allowed, and it will be defaulted to Service. If the weight field (0-256 default 100) is set to zero, no traffic will be sent to this backend. + type: object + required: + - kind + - name + properties: + kind: + description: The kind of target that the route is referring to. Currently, only 'Service' is allowed + type: string + default: Service + enum: + - Service + - "" + name: + description: name of the service/target that is being referred to. e.g. name of the service + type: string + minLength: 1 + weight: + description: weight as an integer between 0 and 256, default 100, that specifies the target's relative weight against other target reference objects. 0 suppresses requests to this backend. + type: integer + format: int32 + default: 100 + maximum: 256 + minimum: 0 + wildcardPolicy: + description: Wildcard policy if any for the route. Currently only 'Subdomain' or 'None' is allowed. + type: string + default: None + enum: + - None + - Subdomain + - "" + status: + description: status is the current state of the route + type: object + properties: + ingress: + description: ingress describes the places where the route may be exposed. The list of ingress points may contain duplicate Host or RouterName values. Routes are considered live once they are `Ready` + type: array + items: + description: RouteIngress holds information about the places where a route is exposed. + type: object + properties: + conditions: + description: Conditions is the state of the route, may be empty. + type: array + items: + description: RouteIngressCondition contains details for the current condition of this route on a particular router. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: RFC 3339 date and time when this condition last transitioned + type: string + format: date-time + message: + description: Human readable message indicating details about last transition. + type: string + reason: + description: (brief) reason for the condition's last transition, and is usually a machine and human readable constant + type: string + status: + description: Status is the status of the condition. Can be True, False, Unknown. + type: string + type: + description: Type is the type of the condition. Currently only Admitted. + type: string + host: + description: Host is the host string under which the route is exposed; this value is required + type: string + routerCanonicalHostname: + description: CanonicalHostname is the external host name for the router that can be used as a CNAME for the host requested for this route. This value is optional and may not be set in all cases. + type: string + routerName: + description: Name is a name chosen by the router to identify itself; this value is required + type: string + wildcardPolicy: + description: Wildcard policy is the wildcard policy that was allowed where this route is exposed. + type: string + served: true + storage: true + subresources: + status: {} diff --git a/vendor/github.com/openshift/api/route/v1/route-TechPreviewNoUpgrade.crd.yaml b/vendor/github.com/openshift/api/route/v1/route-TechPreviewNoUpgrade.crd.yaml new file mode 100644 index 000000000..d9b016564 --- /dev/null +++ b/vendor/github.com/openshift/api/route/v1/route-TechPreviewNoUpgrade.crd.yaml @@ -0,0 +1,237 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.openshift.io: https://github.com/openshift/api/pull/1228 + release.openshift.io/feature-set: TechPreviewNoUpgrade + name: routes.route.openshift.io +spec: + group: route.openshift.io + names: + kind: Route + plural: routes + singular: route + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.ingress[0].host + name: Host + type: string + - jsonPath: .status.ingress[0].conditions[?(@.type=="Admitted")].status + name: Admitted + type: string + - jsonPath: .spec.to.name + name: Service + type: string + - jsonPath: .spec.tls.type + name: TLS + type: string + name: v1 + schema: + openAPIV3Schema: + description: "A route allows developers to expose services through an HTTP(S) aware load balancing and proxy layer via a public DNS entry. The route may further specify TLS options and a certificate, or specify a public CNAME that the router should also accept for HTTP and HTTPS traffic. An administrator typically configures their router to be visible outside the cluster firewall, and may also add additional security, caching, or traffic controls on the service content. Routers usually talk directly to the service endpoints. \n Once a route is created, the `host` field may not be changed. Generally, routers use the oldest route with a given host when resolving conflicts. \n Routers are subject to additional customization and may support additional controls via the annotations field. \n Because administrators may configure multiple routers, the route status field is used to return information to clients about the names and states of the route under each router. If a client chooses a duplicate name, for instance, the route status conditions are used to indicate the route cannot be chosen. \n To enable HTTP/2 ALPN on a route it requires a custom (non-wildcard) certificate. This prevents connection coalescing by clients, notably web browsers. We do not support HTTP/2 ALPN on routes that use the default certificate because of the risk of connection re-use/coalescing. Routes that do not have their own custom certificate will not be HTTP/2 ALPN-enabled on either the frontend or the backend. \n Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer)." + type: object + required: + - spec + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: spec is the desired state of the route + type: object + required: + - to + properties: + alternateBackends: + description: alternateBackends allows up to 3 additional backends to be assigned to the route. Only the Service kind is allowed, and it will be defaulted to Service. Use the weight field in RouteTargetReference object to specify relative preference. + type: array + maxItems: 3 + items: + description: RouteTargetReference specifies the target that resolve into endpoints. Only the 'Service' kind is allowed. Use 'weight' field to emphasize one over others. + type: object + required: + - kind + - name + properties: + kind: + description: The kind of target that the route is referring to. Currently, only 'Service' is allowed + type: string + default: Service + enum: + - Service + - "" + name: + description: name of the service/target that is being referred to. e.g. name of the service + type: string + minLength: 1 + weight: + description: weight as an integer between 0 and 256, default 100, that specifies the target's relative weight against other target reference objects. 0 suppresses requests to this backend. + type: integer + format: int32 + default: 100 + maximum: 256 + minimum: 0 + host: + description: host is an alias/DNS that points to the service. Optional. If not specified a route name will typically be automatically chosen. Must follow DNS952 subdomain conventions. + type: string + maxLength: 253 + pattern: ^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])(\.([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9]))*$ + path: + description: path that the router watches for, to route traffic for to the service. Optional + type: string + pattern: ^/ + port: + description: If specified, the port to be used by the router. Most routers will use all endpoints exposed by the service by default - set this value to instruct routers which port to use. + type: object + required: + - targetPort + properties: + targetPort: + description: The target port on pods selected by the service this route points to. If this is a string, it will be looked up as a named port in the target endpoints port list. Required + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + subdomain: + description: "subdomain is a DNS subdomain that is requested within the ingress controller's domain (as a subdomain). If host is set this field is ignored. An ingress controller may choose to ignore this suggested name, in which case the controller will report the assigned name in the status.ingress array or refuse to admit the route. If this value is set and the server does not support this field host will be populated automatically. Otherwise host is left empty. The field may have multiple parts separated by a dot, but not all ingress controllers may honor the request. This field may not be changed after creation except by a user with the update routes/custom-host permission. \n Example: subdomain `frontend` automatically receives the router subdomain `apps.mycluster.com` to have a full hostname `frontend.apps.mycluster.com`." + type: string + maxLength: 253 + pattern: ^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])(\.([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9]))*$ + tls: + description: The tls field provides the ability to configure certificates and termination for the route. + type: object + required: + - termination + properties: + caCertificate: + description: caCertificate provides the cert authority certificate contents + type: string + certificate: + description: certificate provides certificate contents. This should be a single serving certificate, not a certificate chain. Do not include a CA certificate. + type: string + destinationCACertificate: + description: destinationCACertificate provides the contents of the ca certificate of the final destination. When using reencrypt termination this file should be provided in order to have routers use it for health checks on the secure connection. If this field is not specified, the router may provide its own destination CA and perform hostname validation using the short service name (service.namespace.svc), which allows infrastructure generated certificates to automatically verify. + type: string + externalCertificate: + description: externalCertificate provides certificate contents as a secret reference. This should be a single serving certificate, not a certificate chain. Do not include a CA certificate. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set. + type: object + properties: + name: + description: 'name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + x-kubernetes-map-type: atomic + insecureEdgeTerminationPolicy: + description: "insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While each router may make its own decisions on which ports to expose, this is normally port 80. \n * Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only) (default). * None - no traffic is allowed on the insecure port. * Redirect - clients are redirected to the secure port." + type: string + enum: + - Allow + - None + - Redirect + - "" + key: + description: key provides key file contents + type: string + termination: + description: "termination indicates termination type. \n * edge - TLS termination is done by the router and http is used to communicate with the backend (default) * passthrough - Traffic is sent straight to the destination without the router providing TLS termination * reencrypt - TLS termination is done by the router and https is used to communicate with the backend" + type: string + enum: + - edge + - reencrypt + - passthrough + x-kubernetes-validations: + - rule: 'has(self.termination) && has(self.insecureEdgeTerminationPolicy) ? !((self.termination==''passthrough'') && (self.insecureEdgeTerminationPolicy==''Allow'')) : true' + message: 'cannot have both spec.tls.termination: passthrough and spec.tls.insecureEdgeTerminationPolicy: Allow' + - rule: '!(has(self.certificate) && has(self.externalCertificate))' + message: cannot have both spec.tls.certificate and spec.tls.externalCertificate + to: + description: to is an object the route should use as the primary backend. Only the Service kind is allowed, and it will be defaulted to Service. If the weight field (0-256 default 100) is set to zero, no traffic will be sent to this backend. + type: object + required: + - kind + - name + properties: + kind: + description: The kind of target that the route is referring to. Currently, only 'Service' is allowed + type: string + default: Service + enum: + - Service + - "" + name: + description: name of the service/target that is being referred to. e.g. name of the service + type: string + minLength: 1 + weight: + description: weight as an integer between 0 and 256, default 100, that specifies the target's relative weight against other target reference objects. 0 suppresses requests to this backend. + type: integer + format: int32 + default: 100 + maximum: 256 + minimum: 0 + wildcardPolicy: + description: Wildcard policy if any for the route. Currently only 'Subdomain' or 'None' is allowed. + type: string + default: None + enum: + - None + - Subdomain + - "" + status: + description: status is the current state of the route + type: object + properties: + ingress: + description: ingress describes the places where the route may be exposed. The list of ingress points may contain duplicate Host or RouterName values. Routes are considered live once they are `Ready` + type: array + items: + description: RouteIngress holds information about the places where a route is exposed. + type: object + properties: + conditions: + description: Conditions is the state of the route, may be empty. + type: array + items: + description: RouteIngressCondition contains details for the current condition of this route on a particular router. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: RFC 3339 date and time when this condition last transitioned + type: string + format: date-time + message: + description: Human readable message indicating details about last transition. + type: string + reason: + description: (brief) reason for the condition's last transition, and is usually a machine and human readable constant + type: string + status: + description: Status is the status of the condition. Can be True, False, Unknown. + type: string + type: + description: Type is the type of the condition. Currently only Admitted. + type: string + host: + description: Host is the host string under which the route is exposed; this value is required + type: string + routerCanonicalHostname: + description: CanonicalHostname is the external host name for the router that can be used as a CNAME for the host requested for this route. This value is optional and may not be set in all cases. + type: string + routerName: + description: Name is a name chosen by the router to identify itself; this value is required + type: string + wildcardPolicy: + description: Wildcard policy is the wildcard policy that was allowed where this route is exposed. + type: string + served: true + storage: true + subresources: + status: {} diff --git a/vendor/github.com/openshift/api/route/v1/techpreview.route.testsuite.yaml b/vendor/github.com/openshift/api/route/v1/techpreview.route.testsuite.yaml new file mode 100644 index 000000000..0f0cdd11b --- /dev/null +++ b/vendor/github.com/openshift/api/route/v1/techpreview.route.testsuite.yaml @@ -0,0 +1,103 @@ +apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this +name: '[TechPreview] Route' +crd: route-TechPreviewNoUpgrade.crd.yaml +tests: + onCreate: + - name: Should be able to create a minimal Route + initial: | + apiVersion: route.openshift.io/v1 + kind: Route + spec: + to: + kind: Service + name: foo + expected: | + apiVersion: route.openshift.io/v1 + kind: Route + spec: + to: + kind: Service + name: foo + weight: 100 + wildcardPolicy: None + - name: 'cannot have both spec.tls.termination: passthrough and spec.tls.insecureEdgeTerminationPolicy: Allow' + initial: | + apiVersion: route.openshift.io/v1 + kind: Route + spec: + to: + kind: Service + name: foo + tls: + termination: passthrough + insecureEdgeTerminationPolicy: Allow + expectedError: 'cannot have both spec.tls.termination: passthrough and spec.tls.insecureEdgeTerminationPolicy: Allow' + - name: 'spec.tls.termination: passthrough is compatible with spec.tls.insecureEdgeTerminationPolicy: Redirect' + initial: | + apiVersion: route.openshift.io/v1 + kind: Route + spec: + host: test.foo + to: + kind: Service + name: foo + tls: + termination: passthrough + insecureEdgeTerminationPolicy: Redirect + expected: | + apiVersion: route.openshift.io/v1 + kind: Route + spec: + host: test.foo + to: + kind: Service + name: foo + weight: 100 + tls: + termination: passthrough + insecureEdgeTerminationPolicy: Redirect + wildcardPolicy: None + - name: 'spec.tls.termination: passthrough is compatible with spec.tls.insecureEdgeTerminationPolicy: None' + initial: | + apiVersion: route.openshift.io/v1 + kind: Route + spec: + host: test.foo + to: + kind: Service + name: foo + tls: + termination: passthrough + insecureEdgeTerminationPolicy: None + expected: | + apiVersion: route.openshift.io/v1 + kind: Route + spec: + host: test.foo + to: + kind: Service + name: foo + weight: 100 + tls: + termination: passthrough + insecureEdgeTerminationPolicy: None + wildcardPolicy: None + - name: 'cannot have both spec.tls.certificate and spec.tls.externalCertificate' + initial: | + apiVersion: route.openshift.io/v1 + kind: Route + spec: + to: + kind: Service + name: foo + tls: + termination: edge + key: |- + -----BEGIN RSA PRIVATE KEY----- + -----END RSA PRIVATE KEY----- + certificate: |- + -----BEGIN CERTIFICATE----- + -----END CERTIFICATE----- + externalCertificate: + name: "my-local-secret" + expectedError: 'Invalid value: "object": cannot have both spec.tls.certificate and spec.tls.externalCertificate' diff --git a/vendor/github.com/openshift/api/route/v1/types.go b/vendor/github.com/openshift/api/route/v1/types.go index a48161cf2..948a72aba 100644 --- a/vendor/github.com/openshift/api/route/v1/types.go +++ b/vendor/github.com/openshift/api/route/v1/types.go @@ -248,6 +248,7 @@ type RouterShard struct { // TLSConfig defines config used to secure a route and provide termination // // +kubebuilder:validation:XValidation:rule="has(self.termination) && has(self.insecureEdgeTerminationPolicy) ? !((self.termination=='passthrough') && (self.insecureEdgeTerminationPolicy=='Allow')) : true", message="cannot have both spec.tls.termination: passthrough and spec.tls.insecureEdgeTerminationPolicy: Allow" +// +openshift:validation:FeatureSetAwareXValidation:featureSet=TechPreviewNoUpgrade;CustomNoUpgrade,rule="!(has(self.certificate) && has(self.externalCertificate))", message="cannot have both spec.tls.certificate and spec.tls.externalCertificate" type TLSConfig struct { // termination indicates termination type. // @@ -284,6 +285,26 @@ type TLSConfig struct { // // +kubebuilder:validation:Enum=Allow;None;Redirect;"" InsecureEdgeTerminationPolicy InsecureEdgeTerminationPolicyType `json:"insecureEdgeTerminationPolicy,omitempty" protobuf:"bytes,6,opt,name=insecureEdgeTerminationPolicy,casttype=InsecureEdgeTerminationPolicyType"` + + // externalCertificate provides certificate contents as a secret reference. + // This should be a single serving certificate, not a certificate + // chain. Do not include a CA certificate. The secret referenced should + // be present in the same namespace as that of the Route. + // Forbidden when `certificate` is set. + // + // +openshift:enable:FeatureSets=CustomNoUpgrade;TechPreviewNoUpgrade + // +optional + ExternalCertificate LocalObjectReference `json:"externalCertificate,omitempty" protobuf:"bytes,7,opt,name=externalCertificate"` +} + +// LocalObjectReference contains enough information to let you locate the +// referenced object inside the same namespace. +// +structType=atomic +type LocalObjectReference struct { + // name of the referent. + // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + // +optional + Name string `json:"name,omitempty" protobuf:"bytes,1,opt,name=name"` } // TLSTerminationType dictates where the secure communication will stop diff --git a/vendor/github.com/openshift/api/route/v1/zz_generated.deepcopy.go b/vendor/github.com/openshift/api/route/v1/zz_generated.deepcopy.go index ad8aa77fc..bdb19ad7a 100644 --- a/vendor/github.com/openshift/api/route/v1/zz_generated.deepcopy.go +++ b/vendor/github.com/openshift/api/route/v1/zz_generated.deepcopy.go @@ -9,6 +9,22 @@ import ( runtime "k8s.io/apimachinery/pkg/runtime" ) +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *LocalObjectReference) DeepCopyInto(out *LocalObjectReference) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LocalObjectReference. +func (in *LocalObjectReference) DeepCopy() *LocalObjectReference { + if in == nil { + return nil + } + out := new(LocalObjectReference) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *Route) DeepCopyInto(out *Route) { *out = *in @@ -227,6 +243,7 @@ func (in *RouterShard) DeepCopy() *RouterShard { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *TLSConfig) DeepCopyInto(out *TLSConfig) { *out = *in + out.ExternalCertificate = in.ExternalCertificate return } diff --git a/vendor/github.com/openshift/api/route/v1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/route/v1/zz_generated.swagger_doc_generated.go index eb8971bd2..621b5d69b 100644 --- a/vendor/github.com/openshift/api/route/v1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/route/v1/zz_generated.swagger_doc_generated.go @@ -11,6 +11,15 @@ package v1 // Those methods can be generated by using hack/update-swagger-docs.sh // AUTO-GENERATED FUNCTIONS START HERE +var map_LocalObjectReference = map[string]string{ + "": "LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace.", + "name": "name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", +} + +func (LocalObjectReference) SwaggerDoc() map[string]string { + return map_LocalObjectReference +} + var map_Route = map[string]string{ "": "A route allows developers to expose services through an HTTP(S) aware load balancing and proxy layer via a public DNS entry. The route may further specify TLS options and a certificate, or specify a public CNAME that the router should also accept for HTTP and HTTPS traffic. An administrator typically configures their router to be visible outside the cluster firewall, and may also add additional security, caching, or traffic controls on the service content. Routers usually talk directly to the service endpoints.\n\nOnce a route is created, the `host` field may not be changed. Generally, routers use the oldest route with a given host when resolving conflicts.\n\nRouters are subject to additional customization and may support additional controls via the annotations field.\n\nBecause administrators may configure multiple routers, the route status field is used to return information to clients about the names and states of the route under each router. If a client chooses a duplicate name, for instance, the route status conditions are used to indicate the route cannot be chosen.\n\nTo enable HTTP/2 ALPN on a route it requires a custom (non-wildcard) certificate. This prevents connection coalescing by clients, notably web browsers. We do not support HTTP/2 ALPN on routes that use the default certificate because of the risk of connection re-use/coalescing. Routes that do not have their own custom certificate will not be HTTP/2 ALPN-enabled on either the frontend or the backend.\n\nCompatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).", "metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", @@ -121,6 +130,7 @@ var map_TLSConfig = map[string]string{ "caCertificate": "caCertificate provides the cert authority certificate contents", "destinationCACertificate": "destinationCACertificate provides the contents of the ca certificate of the final destination. When using reencrypt termination this file should be provided in order to have routers use it for health checks on the secure connection. If this field is not specified, the router may provide its own destination CA and perform hostname validation using the short service name (service.namespace.svc), which allows infrastructure generated certificates to automatically verify.", "insecureEdgeTerminationPolicy": "insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While each router may make its own decisions on which ports to expose, this is normally port 80.\n\n* Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only) (default). * None - no traffic is allowed on the insecure port. * Redirect - clients are redirected to the secure port.", + "externalCertificate": "externalCertificate provides certificate contents as a secret reference. This should be a single serving certificate, not a certificate chain. Do not include a CA certificate. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set.", } func (TLSConfig) SwaggerDoc() map[string]string { diff --git a/vendor/github.com/openshift/api/security/v1/consts.go b/vendor/github.com/openshift/api/security/v1/consts.go index 28f8e5ae6..3b686c31d 100644 --- a/vendor/github.com/openshift/api/security/v1/consts.go +++ b/vendor/github.com/openshift/api/security/v1/consts.go @@ -7,4 +7,7 @@ const ( SupplementalGroupsAnnotation = "openshift.io/sa.scc.supplemental-groups" MCSAnnotation = "openshift.io/sa.scc.mcs" ValidatedSCCAnnotation = "openshift.io/scc" + // This annotation pins required SCCs for core OpenShift workloads to prevent preemption of custom SCCs. + // It is being used in the SCC admission plugin. + RequiredSCCAnnotation = "openshift.io/required-scc" ) diff --git a/vendor/modules.txt b/vendor/modules.txt index 88a260435..329737194 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -162,7 +162,7 @@ github.com/modern-go/reflect2 # github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 ## explicit github.com/munnerz/goautoneg -# github.com/openshift/api v0.0.0-20230613151523-ba04973d3ed1 => github.com/joelanford/openshift-api v0.0.0-20230623000109-9ea4be9d5d37 +# github.com/openshift/api v0.0.0-20230703162140-6e9853e4c905 ## explicit; go 1.20 github.com/openshift/api github.com/openshift/api/apiserver @@ -1228,5 +1228,4 @@ sigs.k8s.io/structured-merge-diff/v4/value # sigs.k8s.io/yaml v1.3.0 ## explicit; go 1.12 sigs.k8s.io/yaml -# github.com/openshift/api => github.com/joelanford/openshift-api v0.0.0-20230623000109-9ea4be9d5d37 # github.com/openshift/client-go => github.com/joelanford/openshift-client-go v0.0.0-20230623015431-ff819c433917 From 2d35de3fb74c94983bb39dc72c3ff2318fb9fc60 Mon Sep 17 00:00:00 2001 From: Andy Goldstein Date: Mon, 3 Jul 2023 14:40:40 -0400 Subject: [PATCH 09/14] Copy olms CRD into image Copy the olms CRD from openshift/api into the image so the ClusterVersionOperator will install it. Otherwise, installation will fail because it won't be able to apply the singleton olms instance. Signed-off-by: Andy Goldstein --- Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/Dockerfile b/Dockerfile index da47ed67b..33ba64527 100644 --- a/Dockerfile +++ b/Dockerfile @@ -7,6 +7,7 @@ FROM registry.ci.openshift.org/ocp/4.14:base COPY --from=builder /build/bin/cluster-olm-operator / COPY manifests /manifests +COPY vendor/github.com/openshift/api/operator/v1alpha1/*_olm*.crd.yaml /manifests/ USER 1001 LABEL io.openshift.release.operator=true \ From 62b5a927e447646a24a98729db40584ed3d93142 Mon Sep 17 00:00:00 2001 From: Andy Goldstein Date: Mon, 3 Jul 2023 16:02:29 -0400 Subject: [PATCH 10/14] Tolerate node-role.kubernetes.io/master:NoSchedule We previously only had a toleration for node-role.kubernetes.io/control-plane, but at least in test 4.14 builds on AWS, we're seeing a taint for node-role.kubernetes.io/master. Signed-off-by: Andy Goldstein --- manifests/0000_51_olm_06_deployment.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/manifests/0000_51_olm_06_deployment.yaml b/manifests/0000_51_olm_06_deployment.yaml index 698ad6275..1c0764c11 100644 --- a/manifests/0000_51_olm_06_deployment.yaml +++ b/manifests/0000_51_olm_06_deployment.yaml @@ -71,6 +71,9 @@ spec: - effect: NoSchedule key: node-role.kubernetes.io/control-plane operator: Exists + - effect: NoSchedule + key: node-role.kubernetes.io/master + operator: Exists - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists From ac6958c0705a4d3d3d1c9490d8ec43cfbe10ac4a Mon Sep 17 00:00:00 2001 From: Andy Goldstein Date: Mon, 3 Jul 2023 16:11:34 -0400 Subject: [PATCH 11/14] More deployment manifest tweaking Remove toleration on node-role.kubernetes.io/control-plane. Change node selector to node-role.kubernetes.io/master to match what is currently used in 4.14. Signed-off-by: Andy Goldstein --- manifests/0000_51_olm_06_deployment.yaml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/manifests/0000_51_olm_06_deployment.yaml b/manifests/0000_51_olm_06_deployment.yaml index 1c0764c11..d9162bdeb 100644 --- a/manifests/0000_51_olm_06_deployment.yaml +++ b/manifests/0000_51_olm_06_deployment.yaml @@ -66,11 +66,8 @@ spec: optional: true nodeSelector: kubernetes.io/os: linux - node-role.kubernetes.io/control-plane: "" + node-role.kubernetes.io/master: "" tolerations: - - effect: NoSchedule - key: node-role.kubernetes.io/control-plane - operator: Exists - effect: NoSchedule key: node-role.kubernetes.io/master operator: Exists From 0340271544909ef548773e5e46a017f59cc87eb4 Mon Sep 17 00:00:00 2001 From: Andy Goldstein Date: Wed, 5 Jul 2023 10:15:48 -0400 Subject: [PATCH 12/14] Switch back to upstream openshift/client-go Signed-off-by: Andy Goldstein --- go.mod | 6 +---- go.sum | 4 +-- .../config/v1/cloudcontrollermanagerstatus.go | 27 +++++++++++++++++++ .../config/v1/externalplatformstatus.go | 23 ++++++++++++++++ .../config/v1/platformstatus.go | 6 ++--- .../applyconfigurations/internal/internal.go | 22 ++++++++------- vendor/modules.txt | 3 +-- 7 files changed, 69 insertions(+), 22 deletions(-) create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/cloudcontrollermanagerstatus.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalplatformstatus.go diff --git a/go.mod b/go.mod index 9d78fd9e9..a49db6680 100644 --- a/go.mod +++ b/go.mod @@ -5,7 +5,7 @@ go 1.20 require ( github.com/openshift/api v0.0.0-20230703162140-6e9853e4c905 github.com/openshift/build-machinery-go v0.0.0-20220913142420-e25cf57ea46d - github.com/openshift/client-go v0.0.0-20230503144108-75015d2347cb + github.com/openshift/client-go v0.0.0-20230705133330-7f808ad59404 github.com/openshift/library-go v0.0.0-20230622115850-9596e367bcb4 github.com/spf13/cobra v1.7.0 github.com/spf13/pflag v1.0.5 @@ -18,10 +18,6 @@ require ( sigs.k8s.io/yaml v1.3.0 ) -// TODO: drop these replaces as soon as the OLM Operator API and client-go PRs merge: -// - openshift/client-go: -replace github.com/openshift/client-go => github.com/joelanford/openshift-client-go v0.0.0-20230623015431-ff819c433917 - require ( cloud.google.com/go/compute/metadata v0.2.3 // indirect github.com/NYTimes/gziphandler v1.1.1 // indirect diff --git a/go.sum b/go.sum index 8716cabb8..2780ad1dd 100644 --- a/go.sum +++ b/go.sum @@ -328,8 +328,6 @@ github.com/imdario/mergo v0.3.7/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJ github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/joelanford/openshift-client-go v0.0.0-20230623015431-ff819c433917 h1:Cghj3pXyNw/jcWTK9sa2a3c22tDvewkA+w0G8+J3PkU= -github.com/joelanford/openshift-client-go v0.0.0-20230623015431-ff819c433917/go.mod h1:cBQ6BhVawsMKmI2wvuoTdQjbJCxjINQhW8wvE1inpLY= github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo= github.com/jonboulle/clockwork v0.2.2 h1:UOGuzwb1PwsrDAObMuhUnj0p5ULPj8V/xJ7Kx9qUBdQ= github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY= @@ -406,6 +404,8 @@ github.com/openshift/api v0.0.0-20230703162140-6e9853e4c905 h1:zvzzN6z/QxwQ6KiHn github.com/openshift/api v0.0.0-20230703162140-6e9853e4c905/go.mod h1:4VWG+W22wrB4HfBL88P40DxLEpSOaiBVxUnfalfJo9k= github.com/openshift/build-machinery-go v0.0.0-20220913142420-e25cf57ea46d h1:RR4ah7FfaPR1WePizm0jlrsbmPu91xQZnAsVVreQV1k= github.com/openshift/build-machinery-go v0.0.0-20220913142420-e25cf57ea46d/go.mod h1:b1BuldmJlbA/xYtdZvKi+7j5YGB44qJUJDZ9zwiNCfE= +github.com/openshift/client-go v0.0.0-20230705133330-7f808ad59404 h1:7Q/RkeK4UHpB25nu7z03tSFlWgWjcnAUbjwI1Ud22H4= +github.com/openshift/client-go v0.0.0-20230705133330-7f808ad59404/go.mod h1:8Hq3t7Ba02Z0sjDGtTCARPXylxbOyzFrbwiqb1ViWMA= github.com/openshift/library-go v0.0.0-20230622115850-9596e367bcb4 h1:wPpKgf6vbnsCdPcuv3pzHcwjyxm60wHooZ0ZWpZhG3E= github.com/openshift/library-go v0.0.0-20230622115850-9596e367bcb4/go.mod h1:PegtilvJPBJXjJG3AV8uL1a0SAnBr6K67ShNiWVb40M= github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k= diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/cloudcontrollermanagerstatus.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/cloudcontrollermanagerstatus.go new file mode 100644 index 000000000..2d7a55a78 --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/cloudcontrollermanagerstatus.go @@ -0,0 +1,27 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1 + +import ( + v1 "github.com/openshift/api/config/v1" +) + +// CloudControllerManagerStatusApplyConfiguration represents an declarative configuration of the CloudControllerManagerStatus type for use +// with apply. +type CloudControllerManagerStatusApplyConfiguration struct { + State *v1.CloudControllerManagerState `json:"state,omitempty"` +} + +// CloudControllerManagerStatusApplyConfiguration constructs an declarative configuration of the CloudControllerManagerStatus type for use with +// apply. +func CloudControllerManagerStatus() *CloudControllerManagerStatusApplyConfiguration { + return &CloudControllerManagerStatusApplyConfiguration{} +} + +// WithState sets the State field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the State field is set to the value of the last call. +func (b *CloudControllerManagerStatusApplyConfiguration) WithState(value v1.CloudControllerManagerState) *CloudControllerManagerStatusApplyConfiguration { + b.State = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalplatformstatus.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalplatformstatus.go new file mode 100644 index 000000000..12e246227 --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalplatformstatus.go @@ -0,0 +1,23 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1 + +// ExternalPlatformStatusApplyConfiguration represents an declarative configuration of the ExternalPlatformStatus type for use +// with apply. +type ExternalPlatformStatusApplyConfiguration struct { + CloudControllerManager *CloudControllerManagerStatusApplyConfiguration `json:"cloudControllerManager,omitempty"` +} + +// ExternalPlatformStatusApplyConfiguration constructs an declarative configuration of the ExternalPlatformStatus type for use with +// apply. +func ExternalPlatformStatus() *ExternalPlatformStatusApplyConfiguration { + return &ExternalPlatformStatusApplyConfiguration{} +} + +// WithCloudControllerManager sets the CloudControllerManager field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the CloudControllerManager field is set to the value of the last call. +func (b *ExternalPlatformStatusApplyConfiguration) WithCloudControllerManager(value *CloudControllerManagerStatusApplyConfiguration) *ExternalPlatformStatusApplyConfiguration { + b.CloudControllerManager = value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/platformstatus.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/platformstatus.go index 92c264062..b6afa04a6 100644 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/platformstatus.go +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/platformstatus.go @@ -23,7 +23,7 @@ type PlatformStatusApplyConfiguration struct { PowerVS *PowerVSPlatformStatusApplyConfiguration `json:"powervs,omitempty"` AlibabaCloud *AlibabaCloudPlatformStatusApplyConfiguration `json:"alibabaCloud,omitempty"` Nutanix *NutanixPlatformStatusApplyConfiguration `json:"nutanix,omitempty"` - External *v1.ExternalPlatformStatus `json:"external,omitempty"` + External *ExternalPlatformStatusApplyConfiguration `json:"external,omitempty"` } // PlatformStatusApplyConfiguration constructs an declarative configuration of the PlatformStatus type for use with @@ -147,7 +147,7 @@ func (b *PlatformStatusApplyConfiguration) WithNutanix(value *NutanixPlatformSta // WithExternal sets the External field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the External field is set to the value of the last call. -func (b *PlatformStatusApplyConfiguration) WithExternal(value v1.ExternalPlatformStatus) *PlatformStatusApplyConfiguration { - b.External = &value +func (b *PlatformStatusApplyConfiguration) WithExternal(value *ExternalPlatformStatusApplyConfiguration) *PlatformStatusApplyConfiguration { + b.External = value return b } diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.go index 8ec86a2ab..23dbd153d 100644 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.go +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.go @@ -488,6 +488,13 @@ var schemaYAML = typed.YAMLObject(`types: type: namedType: com.github.openshift.api.config.v1.BuildOverrides default: {} +- name: com.github.openshift.api.config.v1.CloudControllerManagerStatus + map: + fields: + - name: state + type: + scalar: string + default: "" - name: com.github.openshift.api.config.v1.ClusterCondition map: fields: @@ -1058,16 +1065,11 @@ var schemaYAML = typed.YAMLObject(`types: default: Unknown - name: com.github.openshift.api.config.v1.ExternalPlatformStatus map: - elementType: - scalar: untyped - list: - elementType: - namedType: __untyped_atomic_ - elementRelationship: atomic - map: - elementType: - namedType: __untyped_deduced_ - elementRelationship: separable + fields: + - name: cloudControllerManager + type: + namedType: com.github.openshift.api.config.v1.CloudControllerManagerStatus + default: {} - name: com.github.openshift.api.config.v1.FeatureGate map: fields: diff --git a/vendor/modules.txt b/vendor/modules.txt index 329737194..4d03cb70d 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -242,7 +242,7 @@ github.com/openshift/build-machinery-go/make/targets/golang github.com/openshift/build-machinery-go/make/targets/openshift github.com/openshift/build-machinery-go/make/targets/openshift/operator github.com/openshift/build-machinery-go/scripts -# github.com/openshift/client-go v0.0.0-20230503144108-75015d2347cb => github.com/joelanford/openshift-client-go v0.0.0-20230623015431-ff819c433917 +# github.com/openshift/client-go v0.0.0-20230705133330-7f808ad59404 ## explicit; go 1.20 github.com/openshift/client-go/config/applyconfigurations/config/v1 github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1 @@ -1228,4 +1228,3 @@ sigs.k8s.io/structured-merge-diff/v4/value # sigs.k8s.io/yaml v1.3.0 ## explicit; go 1.12 sigs.k8s.io/yaml -# github.com/openshift/client-go => github.com/joelanford/openshift-client-go v0.0.0-20230623015431-ff819c433917 From bbd6508cb1ae2288535a851eb29c44109dbeb3ec Mon Sep 17 00:00:00 2001 From: Andy Goldstein Date: Thu, 6 Jul 2023 10:41:32 -0400 Subject: [PATCH 13/14] Update catalogd manifests Signed-off-by: Andy Goldstein --- assets/catalogd/00-namespace-openshift-catalogd.yml | 2 ++ ...edefinition-bundlemetadata.catalogd.operatorframework.io.yml | 2 +- ...definition-catalogmetadata.catalogd.operatorframework.io.yml | 2 +- ...esourcedefinition-catalogs.catalogd.operatorframework.io.yml | 2 +- ...esourcedefinition-packages.catalogd.operatorframework.io.yml | 2 +- 5 files changed, 6 insertions(+), 4 deletions(-) diff --git a/assets/catalogd/00-namespace-openshift-catalogd.yml b/assets/catalogd/00-namespace-openshift-catalogd.yml index a6a4f119c..64ac642d1 100644 --- a/assets/catalogd/00-namespace-openshift-catalogd.yml +++ b/assets/catalogd/00-namespace-openshift-catalogd.yml @@ -9,4 +9,6 @@ metadata: app.kubernetes.io/name: namespace app.kubernetes.io/part-of: catalogd control-plane: controller-manager + pod-security.kubernetes.io/enforce: baseline + pod-security.kubernetes.io/enforce-version: latest name: openshift-catalogd diff --git a/assets/catalogd/01-customresourcedefinition-bundlemetadata.catalogd.operatorframework.io.yml b/assets/catalogd/01-customresourcedefinition-bundlemetadata.catalogd.operatorframework.io.yml index dee38600f..a0ec0a6a4 100644 --- a/assets/catalogd/01-customresourcedefinition-bundlemetadata.catalogd.operatorframework.io.yml +++ b/assets/catalogd/01-customresourcedefinition-bundlemetadata.catalogd.operatorframework.io.yml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.11.4 + controller-gen.kubebuilder.io/version: v0.12.0 name: bundlemetadata.catalogd.operatorframework.io spec: group: catalogd.operatorframework.io diff --git a/assets/catalogd/02-customresourcedefinition-catalogmetadata.catalogd.operatorframework.io.yml b/assets/catalogd/02-customresourcedefinition-catalogmetadata.catalogd.operatorframework.io.yml index 21dadf357..abce1494d 100644 --- a/assets/catalogd/02-customresourcedefinition-catalogmetadata.catalogd.operatorframework.io.yml +++ b/assets/catalogd/02-customresourcedefinition-catalogmetadata.catalogd.operatorframework.io.yml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.11.4 + controller-gen.kubebuilder.io/version: v0.12.0 name: catalogmetadata.catalogd.operatorframework.io spec: group: catalogd.operatorframework.io diff --git a/assets/catalogd/03-customresourcedefinition-catalogs.catalogd.operatorframework.io.yml b/assets/catalogd/03-customresourcedefinition-catalogs.catalogd.operatorframework.io.yml index 58b0aaf82..db7dea2e2 100644 --- a/assets/catalogd/03-customresourcedefinition-catalogs.catalogd.operatorframework.io.yml +++ b/assets/catalogd/03-customresourcedefinition-catalogs.catalogd.operatorframework.io.yml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.11.4 + controller-gen.kubebuilder.io/version: v0.12.0 name: catalogs.catalogd.operatorframework.io spec: group: catalogd.operatorframework.io diff --git a/assets/catalogd/04-customresourcedefinition-packages.catalogd.operatorframework.io.yml b/assets/catalogd/04-customresourcedefinition-packages.catalogd.operatorframework.io.yml index 89cafa415..6d6156712 100644 --- a/assets/catalogd/04-customresourcedefinition-packages.catalogd.operatorframework.io.yml +++ b/assets/catalogd/04-customresourcedefinition-packages.catalogd.operatorframework.io.yml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.11.4 + controller-gen.kubebuilder.io/version: v0.12.0 name: packages.catalogd.operatorframework.io spec: group: catalogd.operatorframework.io From 23d0b41ec60f44e8caf86298d9bf65b997c1189b Mon Sep 17 00:00:00 2001 From: Andy Goldstein Date: Thu, 6 Jul 2023 11:01:28 -0400 Subject: [PATCH 14/14] Update operator-controller assets Signed-off-by: Andy Goldstein --- .../00-namespace-openshift-operator-controller.yml | 2 ++ ...urcedefinition-operators.operators.operatorframework.io.yml | 3 +-- .../04-clusterrole-operator-controller-manager-role.yml | 1 - ...rator-controller-operator-controller-controller-manager.yml | 2 ++ 4 files changed, 5 insertions(+), 3 deletions(-) diff --git a/assets/operator-controller/00-namespace-openshift-operator-controller.yml b/assets/operator-controller/00-namespace-openshift-operator-controller.yml index 744ffb9c7..ebebe3901 100644 --- a/assets/operator-controller/00-namespace-openshift-operator-controller.yml +++ b/assets/operator-controller/00-namespace-openshift-operator-controller.yml @@ -9,4 +9,6 @@ metadata: app.kubernetes.io/name: namespace app.kubernetes.io/part-of: operator-controller control-plane: controller-manager + pod-security.kubernetes.io/enforce: restricted + pod-security.kubernetes.io/enforce-version: latest name: openshift-operator-controller diff --git a/assets/operator-controller/01-customresourcedefinition-operators.operators.operatorframework.io.yml b/assets/operator-controller/01-customresourcedefinition-operators.operators.operatorframework.io.yml index abf73e450..20cd669d9 100644 --- a/assets/operator-controller/01-customresourcedefinition-operators.operators.operatorframework.io.yml +++ b/assets/operator-controller/01-customresourcedefinition-operators.operators.operatorframework.io.yml @@ -3,8 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.10.0 - creationTimestamp: null + controller-gen.kubebuilder.io/version: v0.12.0 name: operators.operators.operatorframework.io spec: group: operators.operatorframework.io diff --git a/assets/operator-controller/04-clusterrole-operator-controller-manager-role.yml b/assets/operator-controller/04-clusterrole-operator-controller-manager-role.yml index be2881d36..07daade7f 100644 --- a/assets/operator-controller/04-clusterrole-operator-controller-manager-role.yml +++ b/assets/operator-controller/04-clusterrole-operator-controller-manager-role.yml @@ -2,7 +2,6 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - creationTimestamp: null name: operator-controller-manager-role rules: - apiGroups: diff --git a/assets/operator-controller/11-deployment-openshift-operator-controller-operator-controller-controller-manager.yml b/assets/operator-controller/11-deployment-openshift-operator-controller-operator-controller-controller-manager.yml index 93ecdfe6d..89b96a281 100644 --- a/assets/operator-controller/11-deployment-openshift-operator-controller-operator-controller-controller-manager.yml +++ b/assets/operator-controller/11-deployment-openshift-operator-controller-operator-controller-controller-manager.yml @@ -101,5 +101,7 @@ spec: - ALL securityContext: runAsNonRoot: true + seccompProfile: + type: RuntimeDefault serviceAccountName: operator-controller-controller-manager terminationGracePeriodSeconds: 10