Skip to content

Commit b7fd939

Browse files
amitai-devopsamitai-devops
committed
🎉 initial project
new file: .dockerignore; new file: .gitignore; new file: Dockerfile; new file: Makefile; new file: PROJECT; new file: config/certmanager/certificate.yaml; new file: config/certmanager/kustomization.yaml; new file: config/certmanager/kustomizeconfig.yaml; new file: config/default/kustomization.yaml; new file: config/default/manager_auth_proxy_patch.yaml; new file: config/default/manager_config_patch.yaml; new file: config/manager/controller_manager_config.yaml; new file: config/manager/kustomization.yaml; new file: config/manager/manager.yaml; new file: config/prometheus/kustomization.yaml; new file: config/prometheus/monitor.yaml; new file: config/rbac/auth_proxy_client_clusterrole.yaml; new file: config/rbac/auth_proxy_role.yaml; new file: config/rbac/auth_proxy_role_binding.yaml; new file: config/rbac/auth_proxy_service.yaml; new file: config/rbac/kustomization.yaml; new file: config/rbac/leader_election_role.yaml; new file: config/rbac/leader_election_role_binding.yaml; new file: config/rbac/role.yaml; new file: config/rbac/role_binding.yaml; new file: config/scorecard/bases/config.yaml; new file: config/scorecard/kustomization.yaml; new file: config/scorecard/patches/basic.config.yaml; new file: config/scorecard/patches/olm.config.yaml; new file: controllers/pod_controller.go; new file: go copy.mod; new file: go.mod; new file: go.sum; new file: hack/boilerplate.go.txt; new file: main.go
1 parent aea9f73 commit b7fd939

35 files changed

+2322
-0
lines changed

‎.dockerignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# More info: https://docs.docker.com/engine/reference/builder/#dockerignore-file
2+
# Ignore build and test binaries.
3+
bin/
4+
testbin/

‎.gitignore‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
2+
# Binaries for programs and plugins
3+
*.exe
4+
*.exe~
5+
*.dll
6+
*.so
7+
*.dylib
8+
bin
9+
testbin/*
10+
Dockerfile.cross
11+
12+
# Test binary, build with `go test -c`
13+
*.test
14+
15+
# Output of the go coverage tool, specifically when used with LiteIDE
16+
*.out
17+
18+
# Kubernetes Generated files - skip generated files, except for vendored files
19+
20+
!vendor/**/zz_generated.*
21+
22+
# editor and IDE paraphernalia
23+
.idea
24+
*.swp
25+
*.swo
26+
*~

‎Dockerfile‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Build the manager binary
2+
FROM golang:1.19 as builder
3+
ARG TARGETOS
4+
ARG TARGETARCH
5+
6+
WORKDIR /workspace
7+
# Copy the Go Modules manifests
8+
COPY go.mod go.mod
9+
COPY go.sum go.sum
10+
# cache deps before building and copying source so that we don't need to re-download as much
11+
# and so that source changes don't invalidate our downloaded layer
12+
RUN go mod download
13+
14+
# Copy the go source
15+
COPY main.go main.go
16+
COPY api/ api/
17+
COPY controllers/ controllers/
18+
19+
# Build
20+
# the GOARCH has not a default value to allow the binary be built according to the host where the command
21+
# was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO
22+
# the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
23+
# by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
24+
RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager main.go
25+
26+
# Use distroless as minimal base image to package the manager binary
27+
# Refer to https://github.com/GoogleContainerTools/distroless for more details
28+
FROM gcr.io/distroless/static:nonroot
29+
WORKDIR /
30+
COPY --from=builder /workspace/manager .
31+
USER 65532:65532
32+
33+
ENTRYPOINT ["/manager"]

‎Makefile‎

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
2+
# Image URL to use all building/pushing image targets
3+
IMG ?= controller:latest
4+
# ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
5+
ENVTEST_K8S_VERSION = 1.25.0
6+
7+
# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
8+
ifeq (,$(shell go env GOBIN))
9+
GOBIN=$(shell go env GOPATH)/bin
10+
else
11+
GOBIN=$(shell go env GOBIN)
12+
endif
13+
14+
# Setting SHELL to bash allows bash commands to be executed by recipes.
15+
# Options are set to exit when a recipe line exits non-zero or a piped command fails.
16+
SHELL = /usr/bin/env bash -o pipefail
17+
.SHELLFLAGS = -ec
18+
19+
.PHONY: all
20+
all: build
21+
22+
##@ General
23+
24+
# The help target prints out all targets with their descriptions organized
25+
# beneath their categories. The categories are represented by '##@' and the
26+
# target descriptions by '##'. The awk commands is responsible for reading the
27+
# entire set of makefiles included in this invocation, looking for lines of the
28+
# file as xyz: ## something, and then pretty-format the target and help. Then,
29+
# if there's a line with ##@ something, that gets pretty-printed as a category.
30+
# More info on the usage of ANSI control characters for terminal formatting:
31+
# https://en.wikipedia.org/wiki/ANSI_escape_code#SGR_parameters
32+
# More info on the awk command:
33+
# http://linuxcommand.org/lc3_adv_awk.php
34+
35+
.PHONY: help
36+
help: ## Display this help.
37+
@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf " \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
38+
39+
##@ Development
40+
41+
.PHONY: manifests
42+
manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
43+
$(CONTROLLER_GEN) rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases
44+
45+
.PHONY: generate
46+
generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
47+
$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..."
48+
49+
.PHONY: fmt
50+
fmt: ## Run go fmt against code.
51+
go fmt ./...
52+
53+
.PHONY: vet
54+
vet: ## Run go vet against code.
55+
go vet ./...
56+
57+
.PHONY: test
58+
test: manifests generate fmt vet envtest ## Run tests.
59+
KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test ./... -coverprofile cover.out
60+
61+
##@ Build
62+
63+
.PHONY: build
64+
build: manifests generate fmt vet ## Build manager binary.
65+
go build -o bin/manager main.go
66+
67+
.PHONY: run
68+
run: manifests generate fmt vet ## Run a controller from your host.
69+
go run ./main.go
70+
71+
# If you wish built the manager image targeting other platforms you can use the --platform flag.
72+
# (i.e. docker build --platform linux/arm64 ). However, you must enable docker buildKit for it.
73+
# More info: https://docs.docker.com/develop/develop-images/build_enhancements/
74+
.PHONY: docker-build
75+
docker-build: test ## Build docker image with the manager.
76+
docker build -t ${IMG} .
77+
78+
.PHONY: docker-push
79+
docker-push: ## Push docker image with the manager.
80+
docker push ${IMG}
81+
82+
# PLATFORMS defines the target platforms for the manager image be build to provide support to multiple
83+
# architectures. (i.e. make docker-buildx IMG=myregistry/mypoperator:0.0.1). To use this option you need to:
84+
# - able to use docker buildx . More info: https://docs.docker.com/build/buildx/
85+
# - have enable BuildKit, More info: https://docs.docker.com/develop/develop-images/build_enhancements/
86+
# - be able to push the image for your registry (i.e. if you do not inform a valid value via IMG=<myregistry/image:<tag>> then the export will fail)
87+
# To properly provided solutions that supports more than one platform you should use this option.
88+
PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
89+
.PHONY: docker-buildx
90+
docker-buildx: test ## Build and push docker image for the manager for cross-platform support
91+
# copy existing Dockerfile and insert --platform=${BUILDPLATFORM} into Dockerfile.cross, and preserve the original Dockerfile
92+
sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Dockerfile > Dockerfile.cross
93+
- docker buildx create --name project-v3-builder
94+
docker buildx use project-v3-builder
95+
- docker buildx build --push --platform=$(PLATFORMS) --tag ${IMG} -f Dockerfile.cross .
96+
- docker buildx rm project-v3-builder
97+
rm Dockerfile.cross
98+
99+
##@ Deployment
100+
101+
ifndef ignore-not-found
102+
ignore-not-found = false
103+
endif
104+
105+
.PHONY: install
106+
install: manifests kustomize ## Install CRDs into the K8s cluster specified in ~/.kube/config.
107+
$(KUSTOMIZE) build config/crd | kubectl apply -f -
108+
109+
.PHONY: uninstall
110+
uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
111+
$(KUSTOMIZE) build config/crd | kubectl delete --ignore-not-found=$(ignore-not-found) -f -
112+
113+
.PHONY: deploy
114+
deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
115+
cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
116+
$(KUSTOMIZE) build config/default | kubectl apply -f -
117+
118+
.PHONY: undeploy
119+
undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
120+
$(KUSTOMIZE) build config/default | kubectl delete --ignore-not-found=$(ignore-not-found) -f -
121+
122+
##@ Build Dependencies
123+
124+
## Location to install dependencies to
125+
LOCALBIN ?= $(shell pwd)/bin
126+
$(LOCALBIN):
127+
mkdir -p $(LOCALBIN)
128+
129+
## Tool Binaries
130+
KUSTOMIZE ?= $(LOCALBIN)/kustomize
131+
CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
132+
ENVTEST ?= $(LOCALBIN)/setup-envtest
133+
134+
## Tool Versions
135+
KUSTOMIZE_VERSION ?= v3.8.7
136+
CONTROLLER_TOOLS_VERSION ?= v0.10.0
137+
138+
KUSTOMIZE_INSTALL_SCRIPT ?= "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"
139+
.PHONY: kustomize
140+
kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary. If wrong version is installed, it will be removed before downloading.
141+
$(KUSTOMIZE): $(LOCALBIN)
142+
@if test -x $(LOCALBIN)/kustomize && ! $(LOCALBIN)/kustomize version | grep -q $(KUSTOMIZE_VERSION); then \
143+
echo "$(LOCALBIN)/kustomize version is not expected $(KUSTOMIZE_VERSION). Removing it before installing."; \
144+
rm -rf $(LOCALBIN)/kustomize; \
145+
fi
146+
test -s $(LOCALBIN)/kustomize || { curl -Ss $(KUSTOMIZE_INSTALL_SCRIPT) | bash -s -- $(subst v,,$(KUSTOMIZE_VERSION)) $(LOCALBIN); }
147+
148+
.PHONY: controller-gen
149+
controller-gen: $(CONTROLLER_GEN) ## Download controller-gen locally if necessary. If wrong version is installed, it will be overwritten.
150+
$(CONTROLLER_GEN): $(LOCALBIN)
151+
test -s $(LOCALBIN)/controller-gen && $(LOCALBIN)/controller-gen --version | grep -q $(CONTROLLER_TOOLS_VERSION) || \
152+
GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-tools/cmd/controller-gen@$(CONTROLLER_TOOLS_VERSION)
153+
154+
.PHONY: envtest
155+
envtest: $(ENVTEST) ## Download envtest-setup locally if necessary.
156+
$(ENVTEST): $(LOCALBIN)
157+
test -s $(LOCALBIN)/setup-envtest || GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest

‎PROJECT‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
domain: auto.request.operator
2+
layout:
3+
- go.kubebuilder.io/v3
4+
projectName: auto-request-operator
5+
repo: github.com/jatalocks/auto-request-operator
6+
version: "3"

‎config/certmanager/certificate.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# The following manifests contain a self-signed issuer CR and a certificate CR.
2+
# More document can be found at https://docs.cert-manager.io
3+
# WARNING: Targets CertManager v1.0. Check https://cert-manager.io/docs/installation/upgrading/ for breaking changes.
4+
apiVersion: cert-manager.io/v1
5+
kind: Issuer
6+
metadata:
7+
name: selfsigned-issuer
8+
namespace: system
9+
spec:
10+
selfSigned: {}
11+
---
12+
apiVersion: cert-manager.io/v1
13+
kind: Certificate
14+
metadata:
15+
name: serving-cert # this name should match the one appeared in kustomizeconfig.yaml
16+
namespace: system
17+
spec:
18+
# $(SERVICE_NAME) and $(SERVICE_NAMESPACE) will be substituted by kustomize
19+
dnsNames:
20+
- $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc
21+
- $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc.cluster.local
22+
issuerRef:
23+
kind: Issuer
24+
name: selfsigned-issuer
25+
secretName: webhook-server-cert # this secret will not be prefixed, since it's not managed by kustomize

‎config/certmanager/kustomization.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
resources:
2+
- certificate.yaml
3+
4+
configurations:
5+
- kustomizeconfig.yaml

‎config/certmanager/kustomizeconfig.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# This configuration is for teaching kustomize how to update name ref and var substitution
2+
nameReference:
3+
- kind: Issuer
4+
group: cert-manager.io
5+
fieldSpecs:
6+
- kind: Certificate
7+
group: cert-manager.io
8+
path: spec/issuerRef/name
9+
10+
varReference:
11+
- kind: Certificate
12+
group: cert-manager.io
13+
path: spec/commonName
14+
- kind: Certificate
15+
group: cert-manager.io
16+
path: spec/dnsNames

‎config/default/kustomization.yaml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# Adds namespace to all resources.
2+
namespace: operator-system
3+
4+
# Value of this field is prepended to the
5+
# names of all resources, e.g. a deployment named
6+
# "wordpress" becomes "alices-wordpress".
7+
# Note that it should also match with the prefix (text before '-') of the namespace
8+
# field above.
9+
namePrefix: operator-
10+
11+
# Labels to add to all resources and selectors.
12+
#commonLabels:
13+
# someName: someValue
14+
15+
bases:
16+
# - ../crd
17+
- ../rbac
18+
- ../manager
19+
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
20+
# crd/kustomization.yaml
21+
#- ../webhook
22+
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
23+
#- ../certmanager
24+
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
25+
#- ../prometheus
26+
27+
patchesStrategicMerge:
28+
# Protect the /metrics endpoint by putting it behind auth.
29+
# If you want your controller-manager to expose the /metrics
30+
# endpoint w/o any authn/z, please comment the following line.
31+
- manager_auth_proxy_patch.yaml
32+
33+
# Mount the controller config file for loading manager configurations
34+
# through a ComponentConfig type
35+
#- manager_config_patch.yaml
36+
37+
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
38+
# crd/kustomization.yaml
39+
#- manager_webhook_patch.yaml
40+
41+
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'.
42+
# Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA injection in the admission webhooks.
43+
# 'CERTMANAGER' needs to be enabled to use ca injection
44+
#- webhookcainjection_patch.yaml
45+
46+
# the following config is for teaching kustomize how to do var substitution
47+
vars:
48+
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
49+
#- name: CERTIFICATE_NAMESPACE # namespace of the certificate CR
50+
# objref:
51+
# kind: Certificate
52+
# group: cert-manager.io
53+
# version: v1
54+
# name: serving-cert # this name should match the one in certificate.yaml
55+
# fieldref:
56+
# fieldpath: metadata.namespace
57+
#- name: CERTIFICATE_NAME
58+
# objref:
59+
# kind: Certificate
60+
# group: cert-manager.io
61+
# version: v1
62+
# name: serving-cert # this name should match the one in certificate.yaml
63+
#- name: SERVICE_NAMESPACE # namespace of the service
64+
# objref:
65+
# kind: Service
66+
# version: v1
67+
# name: webhook-service
68+
# fieldref:
69+
# fieldpath: metadata.namespace
70+
#- name: SERVICE_NAME
71+
# objref:
72+
# kind: Service
73+
# version: v1
74+
# name: webhook-service

‎config/default/manager_auth_proxy_patch.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# This patch inject a sidecar container which is a HTTP proxy for the
2+
# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
3+
apiVersion: apps/v1
4+
kind: Deployment
5+
metadata:
6+
name: controller-manager
7+
namespace: system
8+
spec:
9+
template:
10+
spec:
11+
containers:
12+
- name: kube-rbac-proxy
13+
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.5.0
14+
args:
15+
- "--secure-listen-address=0.0.0.0:8443"
16+
- "--upstream=http://127.0.0.1:8080/"
17+
- "--logtostderr=true"
18+
- "--v=10"
19+
ports:
20+
- containerPort: 8443
21+
name: https
22+
- name: manager
23+
args:
24+
- "--health-probe-bind-address=:8081"
25+
- "--metrics-bind-address=127.0.0.1:8080"
26+
- "--leader-elect"

0 commit comments

Comments
 (0)