Revert "Merge rukpak updates into main"

Makefile

@@ -60,7 +60,11 @@ RBAC_LIST = rbac.authorization.k8s.io_v1_clusterrole_platform-operators-manager-
 	rbac.authorization.k8s.io_v1_clusterrolebinding_platform-operators-manager-rolebinding.yaml \
 	rbac.authorization.k8s.io_v1_clusterrolebinding_platform-operators-proxy-rolebinding.yaml \
 	rbac.authorization.k8s.io_v1_role_platform-operators-leader-election-role.yaml \
-	rbac.authorization.k8s.io_v1_rolebinding_platform-operators-leader-election-rolebinding.yaml
+	rbac.authorization.k8s.io_v1_rolebinding_platform-operators-leader-election-rolebinding.yaml \
+	rbac.authorization.k8s.io_v1_clusterrole_platform-operators-rukpak-bundle-reader.yaml \
+	rbac.authorization.k8s.io_v1_clusterrole_platform-operators-rukpak-bundle-uploader.yaml \
+	rbac.authorization.k8s.io_v1_clusterrole_platform-operators-rukpak-core-admin.yaml \
+	rbac.authorization.k8s.io_v1_clusterrolebinding_platform-operators-rukpak-core-admin.yaml
 
 # Generate manifests e.g. CRD, RBAC etc.
 .PHONY: manifests
@@ -74,6 +78,19 @@ manifests: generate yq kustomize
 	@# Move the vendored PlatformOperator CRD from o/api to the manifests folder
 	cp $(ROOT_DIR)/vendor/github.com/openshift/api/platform/v1alpha1/platformoperators.crd.yaml manifests/0000_50_cluster-platform-operator-manager_00-platformoperator.crd.yaml
 
+	@# Move all of the rukpak manifests into the manifests folder
+	$(MV_TMP_DIR)/apiextensions.k8s.io_v1_customresourcedefinition_bundledeployments.core.rukpak.io.yaml manifests/0000_50_cluster-platform-operator-manager_00-rukpak-bundledeployments.crd.yaml
+	$(MV_TMP_DIR)/apiextensions.k8s.io_v1_customresourcedefinition_bundles.core.rukpak.io.yaml manifests/0000_50_cluster-platform-operator-manager_00-rukpak-bundles.crd.yaml
+	$(MV_TMP_DIR)/v1_configmap_platform-operators-rukpak-core-tls.yaml manifests/0000_50_cluster-platform-operator-manager_01-core-ca.cm.yaml
+	$(MV_TMP_DIR)/v1_configmap_platform-operators-rukpak-webhook-tls.yaml manifests/0000_50_cluster-platform-operator-manager_01-webhook-ca.cm.yaml
+	$(MV_TMP_DIR)/v1_serviceaccount_platform-operators-rukpak-core-admin.yaml manifests/0000_50_cluster-platform-operator-manager_01-rukpak-core-admin.sa.yaml
+	$(MV_TMP_DIR)/v1_serviceaccount_platform-operators-rukpak-webhooks-admin.yaml manifests/0000_50_cluster-platform-operator-manager_01-rukpak-webhooks-admin.sa.yaml
+	$(MV_TMP_DIR)/v1_service_platform-operators-rukpak-core.yaml manifests/0000_50_cluster-platform-operator-manager_02-rukpak-core.service.yaml
+	$(MV_TMP_DIR)/v1_service_platform-operators-rukpak-webhook-service.yaml manifests/0000_50_cluster-platform-operator-manager_02-rukpak-webhook.service.yaml
+	$(MV_TMP_DIR)/apps_v1_deployment_platform-operators-rukpak-webhooks.yaml manifests/0000_50_cluster-platform-operator-manager_04-rukpak-webhooks.deployment.yaml
+	$(MV_TMP_DIR)/apps_v1_deployment_platform-operators-rukpak-core.yaml manifests/0000_50_cluster-platform-operator-manager_04-rukpak-core.deployment.yaml
+	$(MV_TMP_DIR)/admissionregistration.k8s.io_v1_validatingwebhookconfiguration_platform-operators-rukpak-validating-webhook-configuration.yaml manifests/0000_50_cluster-platform-operator-manager_05-rukpak.validating-webhook-configuration.yaml
+
 	@# Move all of the platform operators manifests into the manifests folder
 	$(MV_TMP_DIR)/v1_namespace_openshift-platform-operators.yaml manifests/0000_50_cluster-platform-operator-manager_00-namespace.yaml
 	$(MV_TMP_DIR)/v1_serviceaccount_platform-operators-controller-manager.yaml manifests/0000_50_cluster-platform-operator-manager_01-serviceaccount.yaml

config/clusteroperator/aggregated_clusteroperator.yaml

@@ -14,3 +14,9 @@ status:
   - group: platform.openshift.io
     name: ""
     resource: platformoperators
+  - group: core.rukpak.io
+    name: ""
+    resource: bundles
+  - group: core.rukpak.io
+    name: ""
+    resource: bundledeployments

config/default/kustomization.yaml

@@ -31,6 +31,7 @@ images:
 bases:
 - ../rbac
 - ../manager
+- ../rukpak
 - ../clusteroperator
 # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
 # crd/kustomization.yaml

config/rukpak/apis/crds/kustomization.yml

@@ -0,0 +1,17 @@
+
+resources:
+- core.rukpak.io_bundles.yaml
+- core.rukpak.io_bundledeployments.yaml
+patches:
+- path: patches/bundle_validation.yaml
+  target:
+    group: apiextensions.k8s.io
+    version: v1
+    kind: CustomResourceDefinition
+    name: bundles.core.rukpak.io
+- path: patches/bundledeployment_validation.yaml
+  target:
+    group: apiextensions.k8s.io
+    version: v1
+    kind: CustomResourceDefinition
+    name: bundledeployments.core.rukpak.io

config/rukpak/apis/crds/patches/bundle_validation.yaml

@@ -0,0 +1,33 @@
+# the max bundle name up to 52
+# it allows extra 11 letters for related resource names
+- op: add
+  path: /spec/versions/0/schema/openAPIV3Schema/properties/metadata/properties
+  value:
+    name:
+      type: string
+      maxLength: 52
+# Union source type
+- op: add
+  path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/source/oneOf
+  value:
+  - required:
+    - git
+  - required:
+    - image
+  - required:
+    - local
+  - required:
+    - upload
+  - required:
+    - http
+
+# Union git ref
+- op: add
+  path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/source/properties/git/properties/ref/oneOf
+  value:
+  - required:
+    - branch
+  - required:
+    - commit
+  - required:
+    - tag

config/rukpak/apis/crds/patches/bundledeployment_validation.yaml

@@ -0,0 +1,9 @@
+# limit bundledeployment name length up to 45
+# this limits the max bundle name up to 52 (allows 11 extra letters)
+# the length of the bundle name is the length of bundledeployment name plus 7
+- op: add
+  path: /spec/versions/0/schema/openAPIV3Schema/properties/metadata/properties
+  value:
+    name:
+      type: string
+      maxLength: 45

config/rukpak/apis/kustomization.yml

@@ -0,0 +1,3 @@
+bases:
+- ./crds
+- ./webhooks

config/rukpak/apis/webhooks/kustomization.yml

@@ -0,0 +1,27 @@
+resources:
+  - resources/serviceaccount.yaml
+  - resources/service.yaml
+  - resources/deployment.yaml
+  - resources/webhook.yaml
+  - resources/webhook_ca_configmap.yaml
+
+configurations:
+- kustomizeconfig.yaml
+
+patchesStrategicMerge:
+- patches/cainjection.yaml
+- patches/high-availability.yaml
+
+vars:
+- name: SERVICE_NAMESPACE # namespace of the service
+  objref:
+    kind: Service
+    version: v1
+    name: webhook-service
+  fieldref:
+    fieldpath: metadata.namespace
+- name: SERVICE_NAME
+  objref:
+    kind: Service
+    version: v1
+    name: webhook-service

config/rukpak/apis/webhooks/kustomizeconfig.yaml

@@ -0,0 +1,18 @@
+nameReference:
+- kind: Service
+  version: v1
+  fieldSpecs:
+  - kind: ValidatingWebhookConfiguration
+    group: admissionregistration.k8s.io
+    path: webhooks/clientConfig/service/name
+
+namespace:
+- kind: ValidatingWebhookConfiguration
+  group: admissionregistration.k8s.io
+  path: webhooks/clientConfig/service/namespace
+  create: true
+
+varReference:
+- kind: ValidatingWebhookConfiguration
+  group: admissionregistration.k8s.io
+  path: metadata/annotations

config/rukpak/apis/webhooks/patches/cainjection.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: validating-webhook-configuration
+  annotations:
+    service.beta.openshift.io/inject-cabundle: "true"

config/rukpak/apis/webhooks/patches/high-availability.yaml

@@ -0,0 +1,18 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: webhooks
+spec:
+  replicas: 2
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 25%
+  template:
+    spec:
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchLabels:
+                app: webhooks
+            topologyKey: kubernetes.io/hostname

config/rukpak/apis/webhooks/resources/deployment.yaml

@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: webhooks
+  labels:
+    app: webhooks
+spec:
+  selector:
+    matchLabels:
+      app: webhooks
+  template:
+    metadata:
+      labels:
+        app: webhooks
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      priorityClassName: "system-cluster-critical"
+      serviceAccountName: webhooks-admin
+      containers:
+        - name: webhooks
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ "ALL" ]
+          command: ["/webhooks"]
+          image: quay.io/operator-framework/rukpak:main
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8080
+            - containerPort: 9443
+              name: webhook-server
+              protocol: TCP
+          resources:
+            requests:
+              cpu: 10m
+              memory: 50Mi
+          volumeMounts:
+          - mountPath: /tmp/k8s-webhook-server/serving-certs
+            name: cert
+            readOnly: true
+      volumes:
+        - name: cert
+          secret:
+            defaultMode: 420
+            secretName: platform-operators-rukpak-webhook-tls

config/rukpak/apis/webhooks/resources/service.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: webhook-service
+  annotations:
+    service.beta.openshift.io/serving-cert-secret-name: platform-operators-rukpak-webhook-tls
+spec:
+  ports:
+    - port: 443
+      protocol: TCP
+      targetPort: 9443
+  selector:
+    app: webhooks

config/rukpak/apis/webhooks/resources/serviceaccount.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: webhooks-admin

config/rukpak/apis/webhooks/resources/webhook.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  creationTimestamp: null
+  name: validating-webhook-configuration
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: webhook-service
+      path: /validate-core-rukpak-io-v1alpha1-bundle
+  failurePolicy: Fail
+  name: vbundles.core.rukpak.io
+  rules:
+  - apiGroups:
+    - core.rukpak.io
+    apiVersions:
+    - v1alpha1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - bundles
+  sideEffects: None

config/rukpak/apis/webhooks/resources/webhook_ca_configmap.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  annotations:
+    service.beta.openshift.io/inject-cabundle: "true"
+  name: webhook-tls
+data: {}

config/rukpak/core/kustomization.yaml

@@ -0,0 +1,28 @@
+resources:
+  - resources/bundle_reader_client_clusterrole.yaml
+  - resources/bundle_uploader_client_clusterrole.yaml
+  - resources/cluster_role.yaml
+  - resources/cluster_role_binding.yaml
+  - resources/deployment.yaml
+  - resources/service.yaml
+  - resources/serviceaccount.yaml
+  - resources/core_ca_configmap.yaml
+
+images:
+- name: kube-rbac-proxy
+  newName: gcr.io/kubebuilder/kube-rbac-proxy
+  newTag: v0.8.0
+
+vars:
+ - name: CORE_SERVICE_NAMESPACE # namespace of the service
+   objref:
+    kind: Service
+    version: v1
+    name: core
+   fieldref:
+    fieldpath: metadata.namespace
+ - name: CORE_SERVICE_NAME
+   objref:
+    kind: Service
+    version: v1
+    name: core

config/rukpak/core/resources/bundle_reader_client_clusterrole.yaml

@@ -0,0 +1,9 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: bundle-reader
+rules:
+  - nonResourceURLs:
+      - /bundles/*
+    verbs:
+      - get

config/rukpak/core/resources/bundle_uploader_client_clusterrole.yaml

@@ -0,0 +1,9 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: bundle-uploader
+rules:
+  - nonResourceURLs:
+      - /bundles/*
+    verbs:
+      - put