From ec24b10eba69476bcb78d112200cca6f3d1103fe Mon Sep 17 00:00:00 2001 From: dymurray Date: Thu, 5 Aug 2021 16:55:28 -0400 Subject: [PATCH 1/2] Update RBAC + other stuff so operator actually works --- oadp-operator/Makefile | 2 +- oadp-operator/api/v1alpha1/velero_types.go | 23 +++++-- .../crd/bases/oadp.openshift.io_veleroes.yaml | 1 - .../config/manager/kustomization.yaml | 10 ++- oadp-operator/config/manager/manager.yaml | 5 +- oadp-operator/config/rbac/role.yaml | 69 +++++++++++++++++++ .../config/samples/oadp_v1alpha1_velero.yaml | 9 ++- oadp-operator/controllers/registry.go | 19 +++-- oadp-operator/controllers/velero.go | 13 ++-- .../controllers/velero_controller.go | 5 ++ oadp-operator/main.go | 12 ++++ 11 files changed, 140 insertions(+), 28 deletions(-) diff --git a/oadp-operator/Makefile b/oadp-operator/Makefile index d5f3663269b..ad33f712c2d 100644 --- a/oadp-operator/Makefile +++ b/oadp-operator/Makefile @@ -36,7 +36,7 @@ IMAGE_TAG_BASE ?= openshift.io/oadp-operator BUNDLE_IMG ?= $(IMAGE_TAG_BASE)-bundle:v$(VERSION) # Image URL to use all building/pushing image targets -IMG ?= controller:latest +IMG ?= quay.io/konveyor/oadp-operator:golang-operator # Produce CRDs that work back to Kubernetes 1.11 (no version conversion) CRD_OPTIONS ?= "crd:trivialVersions=true,preserveUnknownFields=false" diff --git a/oadp-operator/api/v1alpha1/velero_types.go b/oadp-operator/api/v1alpha1/velero_types.go index ab14168c921..36a73fa6d19 100644 --- a/oadp-operator/api/v1alpha1/velero_types.go +++ b/oadp-operator/api/v1alpha1/velero_types.go @@ -50,11 +50,15 @@ type VeleroSpec struct { OlmManaged *bool `json:"olmManaged,omitempty"` // Velero configuration - BackupStorageLocations []velero.BackupStorageLocationSpec `json:"backupStorageLocations"` + BackupStorageLocations []velero.BackupStorageLocationSpec `json:"backupStorageLocations"` + // +optional VolumeSnapshotLocations []velero.VolumeSnapshotLocationSpec `json:"volumeSnapshotLocations"` - VeleroFeatureFlags []string `json:"veleroFeatureFlags,omitempty"` + // +optional + VeleroFeatureFlags []string `json:"veleroFeatureFlags,omitempty"` // We do not currently support setting tolerations for Velero - VeleroTolerations []corev1.Toleration `json:"veleroTolerations,omitempty"` + // +optional + VeleroTolerations []corev1.Toleration `json:"veleroTolerations,omitempty"` + // +optional VeleroResourceAllocations corev1.ResourceRequirements `json:"veleroResourceAllocations,omitempty"` // Plugin configuration @@ -67,10 +71,15 @@ type VeleroSpec struct { Noobaa bool `json:"noobaa,omitempty"` // Restic options - EnableRestic *bool `json:"enableRestic,omitempty"` - ResticSupplementalGroups []string `json:"resticSupplementalGroups,omitempty"` - ResticNodeSelector map[string]string `json:"resticNodeSelector,omitempty"` - ResticTolerations []corev1.Toleration `json:"resticTolerations,omitempty"` + // +optional + EnableRestic *bool `json:"enableRestic,omitempty"` + // +optional + ResticSupplementalGroups []string `json:"resticSupplementalGroups,omitempty"` + // +optional + ResticNodeSelector map[string]string `json:"resticNodeSelector,omitempty"` + // +optional + ResticTolerations []corev1.Toleration `json:"resticTolerations,omitempty"` + // +optional ResticResourceAllocations corev1.ResourceRequirements `json:"resticResourceAllocations,omitempty"` } diff --git a/oadp-operator/config/crd/bases/oadp.openshift.io_veleroes.yaml b/oadp-operator/config/crd/bases/oadp.openshift.io_veleroes.yaml index 8c027e0d24a..4da25b21717 100644 --- a/oadp-operator/config/crd/bases/oadp.openshift.io_veleroes.yaml +++ b/oadp-operator/config/crd/bases/oadp.openshift.io_veleroes.yaml @@ -305,7 +305,6 @@ spec: type: array required: - backupStorageLocations - - volumeSnapshotLocations type: object status: description: VeleroStatus defines the observed state of Velero diff --git a/oadp-operator/config/manager/kustomization.yaml b/oadp-operator/config/manager/kustomization.yaml index 2bcd3eeaa94..8dbb75ba281 100644 --- a/oadp-operator/config/manager/kustomization.yaml +++ b/oadp-operator/config/manager/kustomization.yaml @@ -5,6 +5,12 @@ generatorOptions: disableNameSuffixHash: true configMapGenerator: -- name: manager-config - files: +- files: - controller_manager_config.yaml + name: manager-config +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +images: +- name: controller + newName: docker.io/dymurray/oadp-operator + newTag: golang-operator diff --git a/oadp-operator/config/manager/manager.yaml b/oadp-operator/config/manager/manager.yaml index 79adfe72a55..e14c5f8449b 100644 --- a/oadp-operator/config/manager/manager.yaml +++ b/oadp-operator/config/manager/manager.yaml @@ -30,6 +30,7 @@ spec: args: - --leader-elect image: controller:latest + imagePullPolicy: Always name: manager securityContext: allowPrivilegeEscalation: false @@ -48,9 +49,9 @@ spec: resources: limits: cpu: 100m - memory: 30Mi + memory: 200Mi requests: cpu: 100m - memory: 20Mi + memory: 100Mi serviceAccountName: controller-manager terminationGracePeriodSeconds: 10 diff --git a/oadp-operator/config/rbac/role.yaml b/oadp-operator/config/rbac/role.yaml index 87a36c339ad..deecf5d6f9e 100644 --- a/oadp-operator/config/rbac/role.yaml +++ b/oadp-operator/config/rbac/role.yaml @@ -6,6 +6,33 @@ metadata: creationTimestamp: null name: manager-role rules: +- apiGroups: + - "" + resources: + - configmaps + - secrets + - serviceaccounts + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - apps + resources: + - daemonsets + - deployments + verbs: + - create + - delete + - get + - list + - patch + - update + - watch - apiGroups: - oadp.openshift.io resources: @@ -32,3 +59,45 @@ rules: - get - patch - update +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + - clusterroles + - rolebindings + - roles + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - velero.io + resources: + - backups + - backupstoragelocations + - restores + - volumesnapshotlocations + verbs: + - create + - delete + - get + - list + - patch + - update + - watch diff --git a/oadp-operator/config/samples/oadp_v1alpha1_velero.yaml b/oadp-operator/config/samples/oadp_v1alpha1_velero.yaml index 5b29d692aa8..d24a02f6f48 100644 --- a/oadp-operator/config/samples/oadp_v1alpha1_velero.yaml +++ b/oadp-operator/config/samples/oadp_v1alpha1_velero.yaml @@ -4,4 +4,11 @@ metadata: name: velero-sample spec: # Add fields here - foo: bar + backupStorageLocations: + - provider: aws + objectStorage: + bucket: foobar + defaultVeleroPlugins: + - csi + - openshift + - aws diff --git a/oadp-operator/controllers/registry.go b/oadp-operator/controllers/registry.go index a86a276ecd0..fdef6806531 100644 --- a/oadp-operator/controllers/registry.go +++ b/oadp-operator/controllers/registry.go @@ -8,6 +8,7 @@ import ( "k8s.io/apimachinery/pkg/util/intstr" "k8s.io/utils/pointer" + oadpv1alpha1 "github.com/openshift/oadp-operator/api/v1alpha1" velerov1 "github.com/vmware-tanzu/velero/pkg/apis/velero/v1" corev1 "k8s.io/api/core/v1" "sigs.k8s.io/controller-runtime/pkg/client" @@ -125,6 +126,10 @@ var cloudProviderEnvVarMap = map[string][]corev1.EnvVar{ } func (r *VeleroReconciler) ReconcileRegistries(log logr.Logger) (bool, error) { + velero := oadpv1alpha1.Velero{} + if err := r.Get(r.Context, r.NamespacedName, &velero); err != nil { + return false, err + } bslLabels := map[string]string{ "app.kubernetes.io/name": "oadp-operator-velero", @@ -144,7 +149,7 @@ func (r *VeleroReconciler) ReconcileRegistries(log logr.Logger) (bool, error) { registryDeployment := &appsv1.Deployment{ ObjectMeta: metav1.ObjectMeta{ Name: registryName(&bsl), - Namespace: VeleoNamespace, + Namespace: bsl.Namespace, }, } @@ -159,8 +164,12 @@ func (r *VeleroReconciler) ReconcileRegistries(log logr.Logger) (bool, error) { } } + err := controllerutil.SetControllerReference(&velero, registryDeployment, r.Scheme) + if err != nil { + return err + } // update the Registry Deployment template - err := r.buildRegistryDeployment(registryDeployment, &bsl) + err = r.buildRegistryDeployment(registryDeployment, &bsl) return err }) @@ -188,14 +197,10 @@ func (r *VeleroReconciler) ReconcileRegistries(log logr.Logger) (bool, error) { func (r *VeleroReconciler) buildRegistryDeployment(registryDeployment *appsv1.Deployment, bsl *velerov1.BackupStorageLocation) error { // Setting controller owner reference on the registry deployment - err := controllerutil.SetControllerReference(bsl, registryDeployment, r.Scheme) - if err != nil { - return err - } - registryDeployment.Labels = r.getRegistryBSLLabels(bsl) registryDeployment.Spec = appsv1.DeploymentSpec{ + Selector: registryDeployment.Spec.Selector, Replicas: pointer.Int32(1), Template: corev1.PodTemplateSpec{ ObjectMeta: metav1.ObjectMeta{ diff --git a/oadp-operator/controllers/velero.go b/oadp-operator/controllers/velero.go index de254a96816..c8c3d953972 100644 --- a/oadp-operator/controllers/velero.go +++ b/oadp-operator/controllers/velero.go @@ -15,7 +15,6 @@ import ( const ( Velero = "velero" - VeleoNamespace = "oadp-operator" OADPOperator = "oadp-operator" OADPOperatorVelero = "oadp-operator-velero" Server = "server" @@ -70,7 +69,7 @@ func (r *VeleroReconciler) ReconcileVeleroDeployment(log logr.Logger) (bool, err veleroDeployment := &appsv1.Deployment{ ObjectMeta: metav1.ObjectMeta{ Name: Velero, - Namespace: VeleoNamespace, + Namespace: velero.Namespace, }, } @@ -92,8 +91,7 @@ func (r *VeleroReconciler) ReconcileVeleroDeployment(log logr.Logger) (bool, err } // update the Deployment template - veleroDeployment = r.buildVeleroDeployment(veleroDeployment, &velero) - return nil + return r.buildVeleroDeployment(veleroDeployment, &velero) }) if err != nil { @@ -114,12 +112,13 @@ func (r *VeleroReconciler) ReconcileVeleroDeployment(log logr.Logger) (bool, err } // Build VELERO Deployment -func (r *VeleroReconciler) buildVeleroDeployment(veleroDeployment *appsv1.Deployment, velero *oadpv1alpha1.Velero) *appsv1.Deployment { +func (r *VeleroReconciler) buildVeleroDeployment(veleroDeployment *appsv1.Deployment, velero *oadpv1alpha1.Velero) error { veleroDeployment.Labels = r.getAppLabels(velero) veleroDeployment.Spec = appsv1.DeploymentSpec{ //TODO: add velero nodeselector, needs to be added to the VELERO CR first + Selector: veleroDeployment.Spec.Selector, Replicas: pointer.Int32(1), Template: corev1.PodTemplateSpec{ ObjectMeta: metav1.ObjectMeta{ @@ -161,7 +160,7 @@ func (r *VeleroReconciler) buildVeleroDeployment(veleroDeployment *appsv1.Deploy }, }, } - return veleroDeployment + return nil } func (r *VeleroReconciler) getAppLabels(velero *oadpv1alpha1.Velero) map[string]string { @@ -272,7 +271,7 @@ func (r *VeleroReconciler) getVeleroEnv(velero *oadpv1alpha1.Velero) []corev1.En }, { Name: VeleroNamespaceEnvKey, - Value: VeleoNamespace, + Value: velero.Namespace, }, { Name: VeleroScratchDirEnvKey, diff --git a/oadp-operator/controllers/velero_controller.go b/oadp-operator/controllers/velero_controller.go index 8768d17b891..8134bbe4ee8 100644 --- a/oadp-operator/controllers/velero_controller.go +++ b/oadp-operator/controllers/velero_controller.go @@ -48,6 +48,11 @@ type VeleroReconciler struct { } //+kubebuilder:rbac:groups=oadp.openshift.io,resources=veleroes,verbs=get;list;watch;create;update;patch;delete +//+kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles;clusterroles;rolebindings;clusterrolebindings,verbs=get;list;watch;create;update;patch;delete +//+kubebuilder:rbac:groups="",resources=serviceaccounts;secrets;configmaps,verbs=get;list;watch;create;update;patch;delete +//+kubebuilder:rbac:groups=apps,resources=deployments;daemonsets,verbs=get;list;watch;create;update;patch;delete +//+kubebuilder:rbac:groups=security.openshift.io,resources=securitycontextconstraints,verbs=get;list;watch;create;update;patch;delete +//+kubebuilder:rbac:groups=velero.io,resources=backups;restores;backupstoragelocations;volumesnapshotlocations,verbs=get;list;watch;create;update;patch;delete //+kubebuilder:rbac:groups=oadp.openshift.io,resources=veleroes/status,verbs=get;update;patch //+kubebuilder:rbac:groups=oadp.openshift.io,resources=veleroes/finalizers,verbs=update diff --git a/oadp-operator/main.go b/oadp-operator/main.go index 436f72a26ca..61f38596d34 100644 --- a/oadp-operator/main.go +++ b/oadp-operator/main.go @@ -31,8 +31,10 @@ import ( "sigs.k8s.io/controller-runtime/pkg/healthz" "sigs.k8s.io/controller-runtime/pkg/log/zap" + security "github.com/openshift/api/security/v1" oadpv1alpha1 "github.com/openshift/oadp-operator/api/v1alpha1" "github.com/openshift/oadp-operator/controllers" + velerov1 "github.com/vmware-tanzu/velero/pkg/apis/velero/v1" //+kubebuilder:scaffold:imports ) @@ -78,6 +80,16 @@ func main() { os.Exit(1) } + // Setup scheme for OCP resources + if err := security.AddToScheme(mgr.GetScheme()); err != nil { + setupLog.Error(err, "unable to add OpenShift security APIs to scheme") + os.Exit(1) + } + if err := velerov1.AddToScheme(mgr.GetScheme()); err != nil { + setupLog.Error(err, "unable to add Velero APIs to scheme") + os.Exit(1) + } + if err = (&controllers.VeleroReconciler{ Client: mgr.GetClient(), Scheme: mgr.GetScheme(), From 22c9493f5280322eb7cd8bbc4c5f65c8e8e3d028 Mon Sep 17 00:00:00 2001 From: dymurray Date: Thu, 5 Aug 2021 16:56:44 -0400 Subject: [PATCH 2/2] Fix image ref --- oadp-operator/config/manager/kustomization.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/oadp-operator/config/manager/kustomization.yaml b/oadp-operator/config/manager/kustomization.yaml index 8dbb75ba281..f220f114806 100644 --- a/oadp-operator/config/manager/kustomization.yaml +++ b/oadp-operator/config/manager/kustomization.yaml @@ -12,5 +12,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization images: - name: controller - newName: docker.io/dymurray/oadp-operator + newName: quay.io/konveyor/oadp-operator newTag: golang-operator