Skip to content

Commit 1f8d093

Browse files
sunsingerussunsingerus
committed
Merge remote-tracking branch 'altinity/0.25.0' into 0.25.0
2 parents e6de705 + 5ef4658 commit 1f8d093

13 files changed

+800
-25
lines changed

‎deploy/builder/build-clickhouse-operator-install-yaml.sh

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ CH_PASSWORD_PLAIN="" \
3434
CH_CREDENTIALS_SECRET_NAME="clickhouse-operator" \
3535
CH_USERNAME_SECRET_PLAIN="clickhouse_operator" \
3636
CH_PASSWORD_SECRET_PLAIN="clickhouse_operator_password" \
37+
MANIFEST_PRINT_RBAC_NAMESPACED=yes \
38+
MANIFEST_PRINT_RBAC_CLUSTERED=yes \
3739
"${CUR_DIR}/cat-clickhouse-operator-install-yaml.sh" > "${MANIFEST_ROOT}/operator/clickhouse-operator-install-bundle.yaml"
3840

3941
# Build templated installation .yaml manifest

‎deploy/builder/cat-clickhouse-operator-install-yaml.sh

Lines changed: 4 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -156,8 +156,7 @@ if [[ "${MANIFEST_PRINT_CRD}" == "yes" ]]; then
156156
envsubst
157157
fi
158158

159-
# Render RBAC section for ClusterRole
160-
if [[ "${MANIFEST_PRINT_RBAC_CLUSTERED}" == "yes" ]]; then
159+
if [[ "${MANIFEST_PRINT_RBAC_CLUSTERED}" == "yes" || "${MANIFEST_PRINT_RBAC_NAMESPACED}" == "yes" ]]; then
161160
# Render Account
162161
SECTION_FILE_NAME="clickhouse-operator-install-yaml-template-02-section-rbac-01-service-account.yaml"
163162
ensure_file "${TEMPLATES_DIR}" "${SECTION_FILE_NAME}" "${REPO_PATH_TEMPLATES_PATH}"
@@ -168,7 +167,10 @@ if [[ "${MANIFEST_PRINT_RBAC_CLUSTERED}" == "yes" ]]; then
168167
NAME="clickhouse-operator" \
169168
OPERATOR_VERSION="${OPERATOR_VERSION}" \
170169
envsubst
170+
fi
171171

172+
# Render RBAC section for ClusterRole
173+
if [[ "${MANIFEST_PRINT_RBAC_CLUSTERED}" == "yes" ]]; then
172174
# Render Role
173175
SECTION_FILE_NAME="clickhouse-operator-install-yaml-template-02-section-rbac-02-role.yaml"
174176
ensure_file "${TEMPLATES_DIR}" "${SECTION_FILE_NAME}" "${REPO_PATH_TEMPLATES_PATH}"
@@ -186,16 +188,6 @@ fi
186188

187189
# Render RBAC section for Role
188190
if [[ "${MANIFEST_PRINT_RBAC_NAMESPACED}" == "yes" ]]; then
189-
# Render Account
190-
SECTION_FILE_NAME="clickhouse-operator-install-yaml-template-02-section-rbac-01-service-account.yaml"
191-
ensure_file "${TEMPLATES_DIR}" "${SECTION_FILE_NAME}" "${REPO_PATH_TEMPLATES_PATH}"
192-
render_separator
193-
cat "${TEMPLATES_DIR}/${SECTION_FILE_NAME}" | \
194-
NAMESPACE="${OPERATOR_NAMESPACE}" \
195-
NAME="clickhouse-operator" \
196-
OPERATOR_VERSION="${OPERATOR_VERSION}" \
197-
envsubst
198-
199191
# Render Role
200192
SECTION_FILE_NAME="clickhouse-operator-install-yaml-template-02-section-rbac-02-role.yaml"
201193
ensure_file "${TEMPLATES_DIR}" "${SECTION_FILE_NAME}" "${REPO_PATH_TEMPLATES_PATH}"
@@ -211,7 +203,6 @@ if [[ "${MANIFEST_PRINT_RBAC_NAMESPACED}" == "yes" ]]; then
211203
envsubst
212204
fi
213205

214-
215206
# Render header/beginning of ConfigMap yaml specification:
216207
# apiVersion: v1
217208
# kind: ConfigMap

‎deploy/helm/clickhouse-operator/README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,8 @@ For upgrade please install CRDs separately:
5656
| podAnnotations | object | check the `values.yaml` file | annotations to add to the clickhouse-operator pod, check `kubectl explain pod.spec.annotations` for details |
5757
| podLabels | object | `{}` | labels to add to the clickhouse-operator pod |
5858
| podSecurityContext | object | `{}` | |
59-
| rbac.create | bool | `true` | specifies whether cluster roles and cluster role bindings should be created |
59+
| rbac.create | bool | `true` | specifies whether rbac resources should be created |
60+
| rbac.namespaceScoped | bool | `false` | specifies whether to create roles and rolebindings at the cluster level or namespace level |
6061
| secret.create | bool | `true` | create a secret with operator credentials |
6162
| secret.password | string | `"clickhouse_operator_password"` | operator credentials password |
6263
| secret.username | string | `"clickhouse_operator"` | operator credentials username |

‎deploy/helm/clickhouse-operator/templates/generated/ClusterRole-clickhouse-operator-kube-system.yaml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if .Values.rbac.create -}}
1+
{{- if (and .Values.rbac.create (not .Values.rbac.namespaceScoped)) -}}
22
# Specifies either
33
# ClusterRole
44
# or
@@ -12,7 +12,6 @@ metadata:
1212
name: {{ include "altinity-clickhouse-operator.fullname" . }}
1313
#namespace: kube-system
1414
labels: {{ include "altinity-clickhouse-operator.labels" . | nindent 4 }}
15-
namespace: {{ include "altinity-clickhouse-operator.namespace" . }}
1615
annotations: {{ include "altinity-clickhouse-operator.annotations" . | nindent 4 }}
1716
rules:
1817
#

‎deploy/helm/clickhouse-operator/templates/generated/ClusterRoleBinding-clickhouse-operator-kube-system.yaml

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if .Values.rbac.create -}}
1+
{{- if (and .Values.rbac.create (not .Values.rbac.namespaceScoped)) -}}
22
# Specifies either
33
# ClusterRoleBinding between ClusterRole and ServiceAccount.
44
# or
@@ -11,7 +11,6 @@ metadata:
1111
name: {{ include "altinity-clickhouse-operator.fullname" . }}
1212
#namespace: kube-system
1313
labels: {{ include "altinity-clickhouse-operator.labels" . | nindent 4 }}
14-
namespace: {{ include "altinity-clickhouse-operator.namespace" . }}
1514
annotations: {{ include "altinity-clickhouse-operator.annotations" . | nindent 4 }}
1615
roleRef:
1716
apiGroup: rbac.authorization.k8s.io
@@ -21,4 +20,13 @@ subjects:
2120
- kind: ServiceAccount
2221
name: {{ include "altinity-clickhouse-operator.serviceAccountName" . }}
2322
namespace: {{ include "altinity-clickhouse-operator.namespace" . }}
23+
# Template Parameters:
24+
#
25+
# NAMESPACE=kube-system
26+
# COMMENT=
27+
# ROLE_KIND=Role
28+
# ROLE_NAME=clickhouse-operator
29+
# ROLE_BINDING_KIND=RoleBinding
30+
# ROLE_BINDING_NAME=clickhouse-operator
31+
#
2432
{{- end }}

‎deploy/helm/clickhouse-operator/templates/generated/Role-clickhouse-operator.yaml

Lines changed: 211 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,211 @@
1+
{{- if (and .Values.rbac.create .Values.rbac.namespaceScoped) -}}
2+
# Specifies either
3+
# ClusterRole
4+
# or
5+
# Role
6+
# to be bound to ServiceAccount.
7+
# ClusterRole is namespace-less and must have unique name
8+
# Role is namespace-bound
9+
apiVersion: rbac.authorization.k8s.io/v1
10+
kind: Role
11+
metadata:
12+
name: {{ include "altinity-clickhouse-operator.fullname" . }}
13+
namespace: {{ include "altinity-clickhouse-operator.namespace" . }}
14+
labels: {{ include "altinity-clickhouse-operator.labels" . | nindent 4 }}
15+
annotations: {{ include "altinity-clickhouse-operator.annotations" . | nindent 4 }}
16+
rules:
17+
#
18+
# Core API group
19+
#
20+
- apiGroups:
21+
- ""
22+
resources:
23+
- configmaps
24+
- services
25+
- persistentvolumeclaims
26+
- secrets
27+
verbs:
28+
- get
29+
- list
30+
- patch
31+
- update
32+
- watch
33+
- create
34+
- delete
35+
- apiGroups:
36+
- ""
37+
resources:
38+
- endpoints
39+
verbs:
40+
- get
41+
- list
42+
- watch
43+
- apiGroups:
44+
- ""
45+
resources:
46+
- events
47+
verbs:
48+
- create
49+
- apiGroups:
50+
- ""
51+
resources:
52+
- persistentvolumes
53+
verbs:
54+
- get
55+
- list
56+
- patch
57+
- update
58+
- watch
59+
- apiGroups:
60+
- ""
61+
resources:
62+
- pods
63+
verbs:
64+
- get
65+
- list
66+
- patch
67+
- update
68+
- watch
69+
- delete
70+
- apiGroups:
71+
- ""
72+
resources:
73+
- secrets
74+
verbs:
75+
- get
76+
- list
77+
#
78+
# apps.* resources
79+
#
80+
- apiGroups:
81+
- apps
82+
resources:
83+
- statefulsets
84+
verbs:
85+
- get
86+
- list
87+
- patch
88+
- update
89+
- watch
90+
- create
91+
- delete
92+
- apiGroups:
93+
- apps
94+
resources:
95+
- replicasets
96+
verbs:
97+
- get
98+
- patch
99+
- update
100+
- delete
101+
# The operator deployment personally, identified by name
102+
- apiGroups:
103+
- apps
104+
resources:
105+
- deployments
106+
resourceNames:
107+
- {{ include "altinity-clickhouse-operator.fullname" . }}
108+
verbs:
109+
- get
110+
- patch
111+
- update
112+
- delete
113+
#
114+
# policy.* resources
115+
#
116+
- apiGroups:
117+
- policy
118+
resources:
119+
- poddisruptionbudgets
120+
verbs:
121+
- get
122+
- list
123+
- patch
124+
- update
125+
- watch
126+
- create
127+
- delete
128+
#
129+
# apiextensions
130+
#
131+
- apiGroups:
132+
- apiextensions.k8s.io
133+
resources:
134+
- customresourcedefinitions
135+
verbs:
136+
- get
137+
- list
138+
# clickhouse - related resources
139+
- apiGroups:
140+
- clickhouse.altinity.com
141+
#
142+
# The operators specific Custom Resources
143+
#
144+
145+
resources:
146+
- clickhouseinstallations
147+
verbs:
148+
- get
149+
- list
150+
- watch
151+
- patch
152+
- update
153+
- delete
154+
- apiGroups:
155+
- clickhouse.altinity.com
156+
resources:
157+
- clickhouseinstallationtemplates
158+
- clickhouseoperatorconfigurations
159+
verbs:
160+
- get
161+
- list
162+
- watch
163+
- apiGroups:
164+
- clickhouse.altinity.com
165+
resources:
166+
- clickhouseinstallations/finalizers
167+
- clickhouseinstallationtemplates/finalizers
168+
- clickhouseoperatorconfigurations/finalizers
169+
verbs:
170+
- update
171+
- apiGroups:
172+
- clickhouse.altinity.com
173+
resources:
174+
- clickhouseinstallations/status
175+
- clickhouseinstallationtemplates/status
176+
- clickhouseoperatorconfigurations/status
177+
verbs:
178+
- get
179+
- update
180+
- patch
181+
- create
182+
- delete
183+
# clickhouse-keeper - related resources
184+
- apiGroups:
185+
- clickhouse-keeper.altinity.com
186+
resources:
187+
- clickhousekeeperinstallations
188+
verbs:
189+
- get
190+
- list
191+
- watch
192+
- patch
193+
- update
194+
- delete
195+
- apiGroups:
196+
- clickhouse-keeper.altinity.com
197+
resources:
198+
- clickhousekeeperinstallations/finalizers
199+
verbs:
200+
- update
201+
- apiGroups:
202+
- clickhouse-keeper.altinity.com
203+
resources:
204+
- clickhousekeeperinstallations/status
205+
verbs:
206+
- get
207+
- update
208+
- patch
209+
- create
210+
- delete
211+
{{- end }}

‎deploy/helm/clickhouse-operator/templates/generated/RoleBinding-clickhouse-operator.yaml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{{- if (and .Values.rbac.create .Values.rbac.namespaceScoped) -}}
2+
# Specifies either
3+
# ClusterRoleBinding between ClusterRole and ServiceAccount.
4+
# or
5+
# RoleBinding between Role and ServiceAccount.
6+
# ClusterRoleBinding is namespace-less and must have unique name
7+
# RoleBinding is namespace-bound
8+
apiVersion: rbac.authorization.k8s.io/v1
9+
kind: RoleBinding
10+
metadata:
11+
name: {{ include "altinity-clickhouse-operator.fullname" . }}
12+
namespace: {{ include "altinity-clickhouse-operator.namespace" . }}
13+
labels: {{ include "altinity-clickhouse-operator.labels" . | nindent 4 }}
14+
annotations: {{ include "altinity-clickhouse-operator.annotations" . | nindent 4 }}
15+
roleRef:
16+
apiGroup: rbac.authorization.k8s.io
17+
kind: Role
18+
name: {{ include "altinity-clickhouse-operator.fullname" . }}
19+
subjects:
20+
- kind: ServiceAccount
21+
name: {{ include "altinity-clickhouse-operator.serviceAccountName" . }}
22+
namespace: {{ include "altinity-clickhouse-operator.namespace" . }}
23+
{{- end }}

‎deploy/helm/clickhouse-operator/templates/generated/ServiceAccount-clickhouse-operator.yaml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ metadata:
1313
namespace: {{ include "altinity-clickhouse-operator.namespace" . }}
1414
labels: {{ include "altinity-clickhouse-operator.labels" . | nindent 4 }}
1515
annotations: {{ include "altinity-clickhouse-operator.annotations" . | nindent 4 }}{{ if .Values.serviceAccount.annotations }}{{ toYaml .Values.serviceAccount.annotations | nindent 4 }}{{ end }}
16-
1716
# Template Parameters:
1817
#
1918
# NAMESPACE=kube-system

‎deploy/helm/clickhouse-operator/values.yaml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,8 +71,10 @@ serviceAccount:
7171
# serviceAccount.name -- the name of the service account to use; if not set and create is true, a name is generated using the fullname template
7272
name:
7373
rbac:
74-
# rbac.create -- specifies whether cluster roles and cluster role bindings should be created
74+
# rbac.create -- specifies whether rbac resources should be created
7575
create: true
76+
# rbac.namespaceScoped -- specifies whether to create roles and rolebindings at the cluster level or namespace level
77+
namespaceScoped: false
7678
secret:
7779
# secret.create -- create a secret with operator credentials
7880
create: true

0 commit comments

Comments
 (0)