Add rukpak

assets/rukpak/00-namespace--openshift-rukpak.yml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/enforce-version: latest
+  name: openshift-rukpak

assets/rukpak/03-serviceaccount-openshift-rukpak-core-admin.yml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: core-admin
+  namespace: openshift-rukpak

assets/rukpak/04-serviceaccount-openshift-rukpak-helm-provisioner-admin.yml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: helm-provisioner-admin
+  namespace: openshift-rukpak

assets/rukpak/05-serviceaccount-openshift-rukpak-rukpak-webhooks-admin.yml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: rukpak-webhooks-admin
+  namespace: openshift-rukpak

assets/rukpak/06-clusterrole--bundle-reader.yml

@@ -0,0 +1,10 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: bundle-reader
+rules:
+  - nonResourceURLs:
+      - /bundles/*
+    verbs:
+      - get

assets/rukpak/07-clusterrole--bundle-uploader.yml

@@ -0,0 +1,10 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: bundle-uploader
+rules:
+  - nonResourceURLs:
+      - /bundles/*
+    verbs:
+      - put

assets/rukpak/08-clusterrole--core-admin.yml

@@ -0,0 +1,93 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: core-admin
+rules:
+  - nonResourceURLs:
+      - /bundles/*
+      - /uploads/*
+    verbs:
+      - get
+  - apiGroups:
+      - '*'
+    resources:
+      - '*'
+    verbs:
+      - '*'
+  - apiGroups:
+      - authentication.k8s.io
+    resources:
+      - tokenreviews
+    verbs:
+      - create
+  - apiGroups:
+      - authorization.k8s.io
+    resources:
+      - subjectaccessreviews
+    verbs:
+      - create
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - create
+      - delete
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - pods/log
+    verbs:
+      - get
+  - apiGroups:
+      - core.rukpak.io
+    resources:
+      - bundledeployments
+    verbs:
+      - list
+      - watch
+  - apiGroups:
+      - core.rukpak.io
+    resources:
+      - bundledeployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - core.rukpak.io
+    resources:
+      - bundledeployments/status
+    verbs:
+      - patch
+      - update
+  - apiGroups:
+      - core.rukpak.io
+    resources:
+      - bundles
+    verbs:
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - core.rukpak.io
+    resources:
+      - bundles/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - core.rukpak.io
+    resources:
+      - bundles/status
+    verbs:
+      - patch
+      - update

assets/rukpak/09-clusterrole--helm-provisioner-admin.yml

@@ -0,0 +1,93 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: helm-provisioner-admin
+rules:
+  - nonResourceURLs:
+      - /bundles/*
+      - /uploads/*
+    verbs:
+      - get
+  - apiGroups:
+      - '*'
+    resources:
+      - '*'
+    verbs:
+      - '*'
+  - apiGroups:
+      - authentication.k8s.io
+    resources:
+      - tokenreviews
+    verbs:
+      - create
+  - apiGroups:
+      - authorization.k8s.io
+    resources:
+      - subjectaccessreviews
+    verbs:
+      - create
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - create
+      - delete
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - pods/log
+    verbs:
+      - get
+  - apiGroups:
+      - core.rukpak.io
+    resources:
+      - bundledeployments
+    verbs:
+      - list
+      - watch
+  - apiGroups:
+      - core.rukpak.io
+    resources:
+      - bundledeployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - core.rukpak.io
+    resources:
+      - bundledeployments/status
+    verbs:
+      - patch
+      - update
+  - apiGroups:
+      - core.rukpak.io
+    resources:
+      - bundles
+    verbs:
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - core.rukpak.io
+    resources:
+      - bundles/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - core.rukpak.io
+    resources:
+      - bundles/status
+    verbs:
+      - patch
+      - update

assets/rukpak/10-clusterrole--rukpak-webhooks-admin.yml

@@ -0,0 +1,20 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: rukpak-webhooks-admin
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - list
+      - watch
+  - apiGroups:
+      - core.rukpak.io
+    resources:
+      - bundles
+    verbs:
+      - list
+      - watch

assets/rukpak/11-clusterrolebinding--core-admin.yml

@@ -0,0 +1,14 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: core-admin
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: core-admin
+subjects:
+  - apiGroup: ""
+    kind: ServiceAccount
+    name: core-admin
+    namespace: openshift-rukpak

assets/rukpak/12-clusterrolebinding--helm-provisioner-admin.yml

@@ -0,0 +1,14 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: helm-provisioner-admin
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: helm-provisioner-admin
+subjects:
+  - apiGroup: ""
+    kind: ServiceAccount
+    name: helm-provisioner-admin
+    namespace: openshift-rukpak

assets/rukpak/13-clusterrolebinding--rukpak-webhooks-admin.yml

@@ -0,0 +1,14 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: rukpak-webhooks-admin
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: rukpak-webhooks-admin
+subjects:
+  - apiGroup: ""
+    kind: ServiceAccount
+    name: rukpak-webhooks-admin
+    namespace: openshift-rukpak

assets/rukpak/14-service-openshift-rukpak-core.yml

@@ -0,0 +1,16 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    service.beta.openshift.io/serving-cert-secret-name: core-cert
+  name: core
+  namespace: openshift-rukpak
+spec:
+  ports:
+    - name: https
+      port: 443
+      protocol: TCP
+      targetPort: 8443
+  selector:
+    app: core

assets/rukpak/15-service-openshift-rukpak-helm-provisioner.yml

@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    service.beta.openshift.io/serving-cert-secret-name: helm-provisioner-cert
+  name: helm-provisioner
+  namespace: openshift-rukpak
+spec:
+  ports:
+    - port: 443
+      protocol: TCP
+      targetPort: 8443
+  selector:
+    app: helm-provisioner

assets/rukpak/16-service-openshift-rukpak-rukpak-webhook-service.yml

@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    service.beta.openshift.io/serving-cert-secret-name: rukpak-webhook-certificate
+  name: rukpak-webhook-service
+  namespace: openshift-rukpak
+spec:
+  ports:
+    - port: 443
+      protocol: TCP
+      targetPort: 9443
+  selector:
+    app: webhooks