Update RBAC + other stuff so operator actually works

oadp-operator/Makefile

@@ -36,7 +36,7 @@ IMAGE_TAG_BASE ?= openshift.io/oadp-operator
 BUNDLE_IMG ?= $(IMAGE_TAG_BASE)-bundle:v$(VERSION)
 
 # Image URL to use all building/pushing image targets
-IMG ?= controller:latest
+IMG ?= quay.io/konveyor/oadp-operator:golang-operator
 # Produce CRDs that work back to Kubernetes 1.11 (no version conversion)
 CRD_OPTIONS ?= "crd:trivialVersions=true,preserveUnknownFields=false"
 

oadp-operator/api/v1alpha1/velero_types.go

@@ -50,11 +50,15 @@ type VeleroSpec struct {
 	OlmManaged *bool `json:"olmManaged,omitempty"`
 
 	// Velero configuration
-	BackupStorageLocations  []velero.BackupStorageLocationSpec  `json:"backupStorageLocations"`
+	BackupStorageLocations []velero.BackupStorageLocationSpec `json:"backupStorageLocations"`
+	// +optional
 	VolumeSnapshotLocations []velero.VolumeSnapshotLocationSpec `json:"volumeSnapshotLocations"`
-	VeleroFeatureFlags      []string                            `json:"veleroFeatureFlags,omitempty"`
+	// +optional
+	VeleroFeatureFlags []string `json:"veleroFeatureFlags,omitempty"`
 	// We do not currently support setting tolerations for Velero
-	VeleroTolerations         []corev1.Toleration         `json:"veleroTolerations,omitempty"`
+	// +optional
+	VeleroTolerations []corev1.Toleration `json:"veleroTolerations,omitempty"`
+	// +optional
 	VeleroResourceAllocations corev1.ResourceRequirements `json:"veleroResourceAllocations,omitempty"`
 
 	// Plugin configuration
@@ -67,10 +71,15 @@ type VeleroSpec struct {
 	Noobaa bool `json:"noobaa,omitempty"`
 
 	// Restic options
-	EnableRestic              *bool                       `json:"enableRestic,omitempty"`
-	ResticSupplementalGroups  []string                    `json:"resticSupplementalGroups,omitempty"`
-	ResticNodeSelector        map[string]string           `json:"resticNodeSelector,omitempty"`
-	ResticTolerations         []corev1.Toleration         `json:"resticTolerations,omitempty"`
+	// +optional
+	EnableRestic *bool `json:"enableRestic,omitempty"`
+	// +optional
+	ResticSupplementalGroups []string `json:"resticSupplementalGroups,omitempty"`
+	// +optional
+	ResticNodeSelector map[string]string `json:"resticNodeSelector,omitempty"`
+	// +optional
+	ResticTolerations []corev1.Toleration `json:"resticTolerations,omitempty"`
+	// +optional
 	ResticResourceAllocations corev1.ResourceRequirements `json:"resticResourceAllocations,omitempty"`
 }
 

oadp-operator/config/crd/bases/oadp.openshift.io_veleroes.yaml

@@ -305,7 +305,6 @@ spec:
                 type: array
             required:
             - backupStorageLocations
-            - volumeSnapshotLocations
             type: object
           status:
             description: VeleroStatus defines the observed state of Velero

oadp-operator/config/manager/kustomization.yaml

@@ -5,6 +5,12 @@ generatorOptions:
   disableNameSuffixHash: true
 
 configMapGenerator:
-- name: manager-config
-  files:
+- files:
   - controller_manager_config.yaml
+  name: manager-config
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+images:
+- name: controller
+  newName: quay.io/konveyor/oadp-operator
+  newTag: golang-operator

oadp-operator/config/manager/manager.yaml

@@ -30,6 +30,7 @@ spec:
         args:
         - --leader-elect
         image: controller:latest
+        imagePullPolicy: Always
         name: manager
         securityContext:
           allowPrivilegeEscalation: false
@@ -48,9 +49,9 @@ spec:
         resources:
           limits:
             cpu: 100m
-            memory: 30Mi
+            memory: 200Mi
           requests:
             cpu: 100m
-            memory: 20Mi
+            memory: 100Mi
       serviceAccountName: controller-manager
       terminationGracePeriodSeconds: 10

oadp-operator/config/rbac/role.yaml

@@ -6,6 +6,33 @@ metadata:
   creationTimestamp: null
   name: manager-role
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  - serviceaccounts
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - daemonsets
+  - deployments
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - oadp.openshift.io
   resources:
@@ -32,3 +59,45 @@ rules:
   - get
   - patch
   - update
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterrolebindings
+  - clusterroles
+  - rolebindings
+  - roles
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - security.openshift.io
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - velero.io
+  resources:
+  - backups
+  - backupstoragelocations
+  - restores
+  - volumesnapshotlocations
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch

oadp-operator/config/samples/oadp_v1alpha1_velero.yaml

@@ -4,4 +4,11 @@ metadata:
   name: velero-sample
 spec:
   # Add fields here
-  foo: bar
+  backupStorageLocations:
+  - provider: aws
+    objectStorage:
+      bucket: foobar
+  defaultVeleroPlugins:
+  - csi
+  - openshift
+  - aws

oadp-operator/controllers/registry.go

@@ -8,6 +8,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"k8s.io/utils/pointer"
 
+	oadpv1alpha1 "github.com/openshift/oadp-operator/api/v1alpha1"
 	velerov1 "github.com/vmware-tanzu/velero/pkg/apis/velero/v1"
 	corev1 "k8s.io/api/core/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -125,6 +126,10 @@ var cloudProviderEnvVarMap = map[string][]corev1.EnvVar{
 }
 
 func (r *VeleroReconciler) ReconcileRegistries(log logr.Logger) (bool, error) {
+	velero := oadpv1alpha1.Velero{}
+	if err := r.Get(r.Context, r.NamespacedName, &velero); err != nil {
+		return false, err
+	}
 
 	bslLabels := map[string]string{
 		"app.kubernetes.io/name":       "oadp-operator-velero",
@@ -144,7 +149,7 @@ func (r *VeleroReconciler) ReconcileRegistries(log logr.Logger) (bool, error) {
 		registryDeployment := &appsv1.Deployment{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      registryName(&bsl),
-				Namespace: VeleoNamespace,
+				Namespace: bsl.Namespace,
 			},
 		}
 
@@ -159,8 +164,12 @@ func (r *VeleroReconciler) ReconcileRegistries(log logr.Logger) (bool, error) {
 				}
 			}
 
+			err := controllerutil.SetControllerReference(&velero, registryDeployment, r.Scheme)
+			if err != nil {
+				return err
+			}
 			// update the Registry Deployment template
-			err := r.buildRegistryDeployment(registryDeployment, &bsl)
+			err = r.buildRegistryDeployment(registryDeployment, &bsl)
 			return err
 		})
 
@@ -188,14 +197,10 @@ func (r *VeleroReconciler) ReconcileRegistries(log logr.Logger) (bool, error) {
 func (r *VeleroReconciler) buildRegistryDeployment(registryDeployment *appsv1.Deployment, bsl *velerov1.BackupStorageLocation) error {
 
 	// Setting controller owner reference on the registry deployment
-	err := controllerutil.SetControllerReference(bsl, registryDeployment, r.Scheme)
-	if err != nil {
-		return err
-	}
-
 	registryDeployment.Labels = r.getRegistryBSLLabels(bsl)
 
 	registryDeployment.Spec = appsv1.DeploymentSpec{
+		Selector: registryDeployment.Spec.Selector,
 		Replicas: pointer.Int32(1),
 		Template: corev1.PodTemplateSpec{
 			ObjectMeta: metav1.ObjectMeta{

oadp-operator/controllers/velero.go

@@ -15,7 +15,6 @@ import (
 
 const (
 	Velero             = "velero"
-	VeleoNamespace     = "oadp-operator"
 	OADPOperator       = "oadp-operator"
 	OADPOperatorVelero = "oadp-operator-velero"
 	Server             = "server"
@@ -70,7 +69,7 @@ func (r *VeleroReconciler) ReconcileVeleroDeployment(log logr.Logger) (bool, err
 	veleroDeployment := &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      Velero,
-			Namespace: VeleoNamespace,
+			Namespace: velero.Namespace,
 		},
 	}
 
@@ -92,8 +91,7 @@ func (r *VeleroReconciler) ReconcileVeleroDeployment(log logr.Logger) (bool, err
 		}
 
 		// update the Deployment template
-		veleroDeployment = r.buildVeleroDeployment(veleroDeployment, &velero)
-		return nil
+		return r.buildVeleroDeployment(veleroDeployment, &velero)
 	})
 
 	if err != nil {
@@ -114,12 +112,13 @@ func (r *VeleroReconciler) ReconcileVeleroDeployment(log logr.Logger) (bool, err
 }
 
 // Build VELERO Deployment
-func (r *VeleroReconciler) buildVeleroDeployment(veleroDeployment *appsv1.Deployment, velero *oadpv1alpha1.Velero) *appsv1.Deployment {
+func (r *VeleroReconciler) buildVeleroDeployment(veleroDeployment *appsv1.Deployment, velero *oadpv1alpha1.Velero) error {
 
 	veleroDeployment.Labels = r.getAppLabels(velero)
 
 	veleroDeployment.Spec = appsv1.DeploymentSpec{
 		//TODO: add velero nodeselector, needs to be added to the VELERO CR first
+		Selector: veleroDeployment.Spec.Selector,
 		Replicas: pointer.Int32(1),
 		Template: corev1.PodTemplateSpec{
 			ObjectMeta: metav1.ObjectMeta{
@@ -161,7 +160,7 @@ func (r *VeleroReconciler) buildVeleroDeployment(veleroDeployment *appsv1.Deploy
 			},
 		},
 	}
-	return veleroDeployment
+	return nil
 }
 
 func (r *VeleroReconciler) getAppLabels(velero *oadpv1alpha1.Velero) map[string]string {
@@ -272,7 +271,7 @@ func (r *VeleroReconciler) getVeleroEnv(velero *oadpv1alpha1.Velero) []corev1.En
 		},
 		{
 			Name:  VeleroNamespaceEnvKey,
-			Value: VeleoNamespace,
+			Value: velero.Namespace,
 		},
 		{
 			Name:  VeleroScratchDirEnvKey,

oadp-operator/controllers/velero_controller.go

@@ -48,6 +48,11 @@ type VeleroReconciler struct {
 }
 
 //+kubebuilder:rbac:groups=oadp.openshift.io,resources=veleroes,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles;clusterroles;rolebindings;clusterrolebindings,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups="",resources=serviceaccounts;secrets;configmaps,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups=apps,resources=deployments;daemonsets,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups=security.openshift.io,resources=securitycontextconstraints,verbs=get;list;watch;create;update;patch;delete
+//+kubebuilder:rbac:groups=velero.io,resources=backups;restores;backupstoragelocations;volumesnapshotlocations,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=oadp.openshift.io,resources=veleroes/status,verbs=get;update;patch
 //+kubebuilder:rbac:groups=oadp.openshift.io,resources=veleroes/finalizers,verbs=update
 

oadp-operator/main.go

@@ -31,8 +31,10 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 
+	security "github.com/openshift/api/security/v1"
 	oadpv1alpha1 "github.com/openshift/oadp-operator/api/v1alpha1"
 	"github.com/openshift/oadp-operator/controllers"
+	velerov1 "github.com/vmware-tanzu/velero/pkg/apis/velero/v1"
 	//+kubebuilder:scaffold:imports
 )
 
@@ -78,6 +80,16 @@ func main() {
 		os.Exit(1)
 	}
 
+	// Setup scheme for OCP resources
+	if err := security.AddToScheme(mgr.GetScheme()); err != nil {
+		setupLog.Error(err, "unable to add OpenShift security APIs to scheme")
+		os.Exit(1)
+	}
+	if err := velerov1.AddToScheme(mgr.GetScheme()); err != nil {
+		setupLog.Error(err, "unable to add Velero APIs to scheme")
+		os.Exit(1)
+	}
+
 	if err = (&controllers.VeleroReconciler{
 		Client:        mgr.GetClient(),
 		Scheme:        mgr.GetScheme(),