Add velero RBAC resources

oadp-operator/Dockerfile

@@ -12,6 +12,7 @@ RUN go mod download
 # Copy the go source
 COPY main.go main.go
 COPY api/ api/
+COPY pkg/ pkg/
 COPY controllers/ controllers/
 
 # Build

oadp-operator/config/crd/bases/oadp.openshift.io_veleroes.yaml

@@ -175,7 +175,8 @@ spec:
                 type: object
               resticSupplementalGroups:
                 items:
-                  type: string
+                  format: int64
+                  type: integer
                 type: array
               resticTolerations:
                 items:

oadp-operator/config/manager/manager.yaml

@@ -27,6 +27,47 @@ spec:
       containers:
       - command:
         - /manager
+        env:
+          - name: REGISTRY
+            value: quay.io
+          - name: PROJECT
+            value: konveyor
+          - name: VELERO_REGISTRY_REPO
+            value: registry
+          - name: VELERO_REGISTRY_TAG
+            value: latest
+          - name: VELERO_REPO
+            value: velero
+          - name: VELERO_OPENSHIFT_PLUGIN_REPO
+            value: openshift-velero-plugin
+          - name: VELERO_OPENSHIFT_PLUGIN_TAG
+            value: oadp-dev
+          - name: VELERO_RESTIC_RESTORE_HELPER_REPO
+            value: velero-restic-restore-helper
+          - name: VELERO_AWS_PLUGIN_REPO
+            value: velero-plugin-for-aws
+          - name: VELERO_GCP_PLUGIN_REPO
+            value: velero-plugin-for-gcp
+          - name: VELERO_AZURE_PLUGIN_REPO
+            value: velero-plugin-for-microsoft-azure
+          - name: VELERO_CSI_PLUGIN_REPO
+            value: velero-plugin-for-csi
+          - name: VELERO_VSPHERE_PLUGIN_REPO
+            value: velero-plugin-for-vsphere
+          - name: VELERO_TAG
+            value: konveyor-oadp
+          - name: VELERO_RESTIC_RESTORE_HELPER_TAG
+            value: latest
+          - name: VELERO_AWS_PLUGIN_TAG
+            value: konveyor-oadp
+          - name: VELERO_GCP_PLUGIN_TAG
+            value: konveyor-oadp
+          - name: VELERO_AZURE_PLUGIN_TAG
+            value: konveyor-oadp
+          - name: VELERO_CSI_PLUGIN_TAG
+            value: main
+          - name: VELERO_VSPHERE_PLUGIN_TAG
+            value: 1.1.0
         args:
         - --leader-elect
         image: controller:latest

oadp-operator/config/rbac/role.yaml

@@ -20,6 +20,12 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - '*'
+  resources:
+  - '*'
+  verbs:
+  - '*'
 - apiGroups:
   - apps
   resources:

oadp-operator/controllers/restic.go

@@ -118,13 +118,14 @@ func (r *VeleroReconciler) buildResticDaemonset(velero *oadpv1alpha1.Velero, ds
 		return nil, fmt.Errorf("ds cannot be nil")
 	}
 	ds.Spec = appsv1.DaemonSetSpec{
+		Selector: ds.Spec.Selector,
 		UpdateStrategy: appsv1.DaemonSetUpdateStrategy{
 			Type: appsv1.RollingUpdateDaemonSetStrategyType,
 		},
 		Template: v1.PodTemplateSpec{
 			ObjectMeta: metav1.ObjectMeta{
 				Labels: map[string]string{
-					"name": Restic,
+					"component": Restic,
 				},
 			},
 			Spec: v1.PodSpec{
@@ -226,12 +227,8 @@ func (r *VeleroReconciler) buildResticDaemonset(velero *oadpv1alpha1.Velero, ds
 								},
 							},
 							{
-								Name: "VELERO_SCRATCH_DIR",
-								ValueFrom: &v1.EnvVarSource{
-									FieldRef: &v1.ObjectFieldSelector{
-										FieldPath: "/scratch",
-									},
-								},
+								Name:  "VELERO_SCRATCH_DIR",
+								Value: "/scratch",
 							},
 						},
 					},

oadp-operator/controllers/velero.go

@@ -4,12 +4,16 @@ import (
 	"fmt"
 
 	"github.com/go-logr/logr"
+	security "github.com/openshift/api/security/v1"
 	oadpv1alpha1 "github.com/openshift/oadp-operator/api/v1alpha1"
 	"github.com/openshift/oadp-operator/pkg/common"
+	"github.com/vmware-tanzu/velero/pkg/install"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
+	rbacv1 "k8s.io/api/rbac/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/utils/pointer"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 )
@@ -58,6 +62,135 @@ const (
 	VeleroPluginForOpenshift = "openshift-velero-plugin"
 )
 
+func (r *VeleroReconciler) ReconcileVeleroServiceAccount(log logr.Logger) (bool, error) {
+	velero := oadpv1alpha1.Velero{}
+	if err := r.Get(r.Context, r.NamespacedName, &velero); err != nil {
+		return false, err
+	}
+	veleroSa := &corev1.ServiceAccount{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      common.Velero,
+			Namespace: velero.Namespace,
+		},
+	}
+	op, err := controllerutil.CreateOrUpdate(r.Context, r.Client, veleroSa, func() error {
+		// Setting controller owner reference on the velero SA
+		err := controllerutil.SetControllerReference(&velero, veleroSa, r.Scheme)
+		if err != nil {
+			return err
+		}
+
+		// update the SA template
+		veleroSaUpdate, err := r.veleroServiceAccount(&velero)
+		veleroSa = veleroSaUpdate
+		return err
+	})
+
+	if err != nil {
+		return false, err
+	}
+
+	//TODO: Review velero SA status and report errors and conditions
+
+	if op == controllerutil.OperationResultCreated || op == controllerutil.OperationResultUpdated {
+		// Trigger event to indicate velero SA was created or updated
+		r.EventRecorder.Event(veleroSa,
+			corev1.EventTypeNormal,
+			"VeleroServiceAccountReconciled",
+			fmt.Sprintf("performed %s on velero service account %s/%s", op, veleroSa.Namespace, veleroSa.Name),
+		)
+	}
+	return true, nil
+}
+
+func (r *VeleroReconciler) ReconcileVeleroClusterRoleBinding(log logr.Logger) (bool, error) {
+	velero := oadpv1alpha1.Velero{}
+	if err := r.Get(r.Context, r.NamespacedName, &velero); err != nil {
+		return false, err
+	}
+	veleroCRB, err := r.veleroClusterRoleBinding(&velero)
+	if err != nil {
+		return false, err
+	}
+	op, err := controllerutil.CreateOrUpdate(r.Context, r.Client, veleroCRB, func() error {
+		// Setting controller owner reference on the velero CRB
+		// TODO: HOW DO I DO THIS?? ALAY HALP PLZ
+		/*err := controllerutil.SetControllerReference(&velero, veleroCRB, r.Scheme)
+		if err != nil {
+			return err
+		}*/
+
+		// update the CRB template
+		veleroCRBUpdate, err := r.veleroClusterRoleBinding(&velero)
+		veleroCRB = veleroCRBUpdate
+		return err
+	})
+
+	if err != nil {
+		return false, err
+	}
+
+	//TODO: Review velero CRB status and report errors and conditions
+
+	if op == controllerutil.OperationResultCreated || op == controllerutil.OperationResultUpdated {
+		// Trigger event to indicate velero SA was created or updated
+		r.EventRecorder.Event(veleroCRB,
+			corev1.EventTypeNormal,
+			"VeleroClusterRoleBindingReconciled",
+			fmt.Sprintf("performed %s on velero clusterrolebinding %s", op, veleroCRB.Name),
+		)
+	}
+	return true, nil
+}
+
+func (r *VeleroReconciler) ReconcileVeleroSecurityContextConstraint(log logr.Logger) (bool, error) {
+	velero := oadpv1alpha1.Velero{}
+	if err := r.Get(r.Context, r.NamespacedName, &velero); err != nil {
+		return false, err
+	}
+	sa := corev1.ServiceAccount{}
+	nsName := types.NamespacedName{
+		Namespace: velero.Namespace,
+		Name:      common.Velero,
+	}
+	if err := r.Get(r.Context, nsName, &sa); err != nil {
+		return false, err
+	}
+
+	veleroSCC := &security.SecurityContextConstraints{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "velero-privileged",
+		},
+	}
+	op, err := controllerutil.CreateOrUpdate(r.Context, r.Client, veleroSCC, func() error {
+		// Setting controller owner reference on the velero SCC
+		// TODO: HOW DO I DO THIS?? ALAY HALP PLZ
+		/*err := controllerutil.SetControllerReference(&velero, veleroSCC, r.Scheme)
+		if err != nil {
+			return err
+		}*/
+
+		// update the SCC template
+		return r.privilegedSecurityContextConstraints(veleroSCC, &velero, &sa)
+	})
+
+	if err != nil {
+		return false, err
+	}
+
+	//TODO: Review velero SCC status and report errors and conditions
+
+	if op == controllerutil.OperationResultCreated || op == controllerutil.OperationResultUpdated {
+		// Trigger event to indicate velero SCC was created or updated
+		r.EventRecorder.Event(veleroSCC,
+			corev1.EventTypeNormal,
+			"VeleroSecurityContextConstraintsReconciled",
+			fmt.Sprintf("performed %s on velero scc %s", op, veleroSCC.Name),
+		)
+	}
+	return true, nil
+}
+
 func (r *VeleroReconciler) ReconcileVeleroDeployment(log logr.Logger) (bool, error) {
 	velero := oadpv1alpha1.Velero{}
 	if err := r.Get(r.Context, r.NamespacedName, &velero); err != nil {
@@ -109,6 +242,68 @@ func (r *VeleroReconciler) ReconcileVeleroDeployment(log logr.Logger) (bool, err
 	return true, nil
 }
 
+func (r *VeleroReconciler) veleroServiceAccount(velero *oadpv1alpha1.Velero) (*corev1.ServiceAccount, error) {
+	annotations := make(map[string]string)
+	sa := install.ServiceAccount(velero.Namespace, annotations)
+	sa.Labels = r.getAppLabels(velero)
+	return sa, nil
+}
+
+func (r *VeleroReconciler) veleroClusterRoleBinding(velero *oadpv1alpha1.Velero) (*rbacv1.ClusterRoleBinding, error) {
+	crb := install.ClusterRoleBinding(velero.Namespace)
+	crb.Labels = r.getAppLabels(velero)
+	return crb, nil
+}
+
+func (r *VeleroReconciler) privilegedSecurityContextConstraints(scc *security.SecurityContextConstraints, velero *oadpv1alpha1.Velero, sa *corev1.ServiceAccount) error {
+	scc = &security.SecurityContextConstraints{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:   "velero-privileged",
+			Labels: r.getAppLabels(velero),
+		},
+		AllowHostDirVolumePlugin: true,
+		AllowHostIPC:             true,
+		AllowHostNetwork:         true,
+		AllowHostPID:             true,
+		AllowHostPorts:           true,
+		AllowPrivilegeEscalation: pointer.BoolPtr(true),
+		AllowPrivilegedContainer: true,
+		AllowedCapabilities: []corev1.Capability{
+			security.AllowAllCapabilities,
+		},
+		AllowedUnsafeSysctls: []string{
+			"*",
+		},
+		DefaultAddCapabilities: nil,
+		FSGroup: security.FSGroupStrategyOptions{
+			Type: security.FSGroupStrategyRunAsAny,
+		},
+		Priority:                 nil,
+		ReadOnlyRootFilesystem:   false,
+		RequiredDropCapabilities: nil,
+		RunAsUser: security.RunAsUserStrategyOptions{
+			Type: security.RunAsUserStrategyRunAsAny,
+		},
+		SELinuxContext: security.SELinuxContextStrategyOptions{
+			Type: security.SELinuxStrategyRunAsAny,
+		},
+		SeccompProfiles: []string{
+			"*",
+		},
+		SupplementalGroups: security.SupplementalGroupsStrategyOptions{
+			Type: security.SupplementalGroupsStrategyRunAsAny,
+		},
+		Users: []string{
+			"system:admin",
+			fmt.Sprintf("system:serviceaccount:%s:%s", sa.Namespace, sa.Name),
+		},
+		Volumes: []security.FSType{
+			security.FSTypeAll,
+		},
+	}
+	return nil
+}
+
 // Build VELERO Deployment
 func (r *VeleroReconciler) buildVeleroDeployment(veleroDeployment *appsv1.Deployment, velero *oadpv1alpha1.Velero) error {
 

oadp-operator/controllers/velero_controller.go

@@ -47,6 +47,9 @@ type VeleroReconciler struct {
 	EventRecorder  record.EventRecorder
 }
 
+//TODO!!! FIX THIS!!!!
+
+//+kubebuilder:rbac:groups=*,resources=*,verbs=*
 //+kubebuilder:rbac:groups=oadp.openshift.io,resources=veleroes,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles;clusterroles;rolebindings;clusterrolebindings,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups="",resources=serviceaccounts;secrets;configmaps,verbs=get;list;watch;create;update;patch;delete
@@ -84,8 +87,11 @@ func (r *VeleroReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctr
 		r.ReconcileRegistries,
 		r.ValidateVolumeSnapshotLocations,
 		r.ReconcileVolumeSnapshotLocations,
-		r.ReconcileResticDaemonset,
+		r.ReconcileVeleroServiceAccount,
+		r.ReconcileVeleroClusterRoleBinding,
+		r.ReconcileVeleroSecurityContextConstraint,
 		r.ReconcileVeleroDeployment,
+		r.ReconcileResticDaemonset,
 	)
 
 	if err != nil {

oadp-operator/go.mod

@@ -8,7 +8,7 @@ require (
 	github.com/onsi/ginkgo v1.16.4
 	github.com/onsi/gomega v1.13.0
 	github.com/openshift/api v0.0.0-20210729133136-d870cea76006
-	github.com/vmware-tanzu/velero v1.6.2
+	github.com/vmware-tanzu/velero v1.6.1-0.20210806003158-ed5809b7fc22
 	golang.org/x/tools v0.1.2 // indirect
 	k8s.io/api v0.21.2
 	k8s.io/apimachinery v0.21.2