Skip to content

Commit a6c7e5b

Browse files
YCShen1010YCShen1010
authored
Create singleton recipe for Cert Manager (#2328)
* create cert manager BR workflows Signed-off-by: YuChen <[email protected]> * update label script with adding cert manager config Signed-off-by: YuChen <[email protected]> * add condition check before backup and restore Signed-off-by: YuChen <[email protected]> * update full recipe for cert maanger changes Signed-off-by: YuChen <[email protected]> * create label cert manager script Signed-off-by: YuChen <[email protected]> * create job for labeling singleton cert manager Signed-off-by: YuChen <[email protected]> * add cluste role and rb for catalog Signed-off-by: YuChen <[email protected]> * including cert and issuer crd in label scripts Signed-off-by: YuChen <[email protected]> * bring back cert manager workload resources for 4.7 recipe Signed-off-by: YuChen <[email protected]> * remove webhook deployment check Signed-off-by: YuChen <[email protected]> * use singleton-subscription as cm sub label for backward compatibility Signed-off-by: YuChen <[email protected]> * use common label for cm ns, og and catalog Signed-off-by: YuChen <[email protected]> --------- Signed-off-by: YuChen <[email protected]>
1 parent e5d2f83 commit a6c7e5b

10 files changed

+568
-47
lines changed

‎velero/backup/cert-manager/label-singleton-cert-manager-clusterrole.yaml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: label-singleton-cert-manager-clusterrole
5+
rules:
6+
- verbs:
7+
- get
8+
- list
9+
- update
10+
- patch
11+
apiGroups:
12+
- operators.coreos.com
13+
resources:
14+
- catalogsources
15+
---
16+
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
kind: ClusterRoleBinding
19+
metadata:
20+
name: label-singleton-cert-manager-clusterrole
21+
roleRef:
22+
apiGroup: rbac.authorization.k8s.io
23+
kind: ClusterRole
24+
name: label-singleton-cert-manager-clusterrole
25+
subjects:
26+
- kind: ServiceAccount
27+
name: label-singleton-cert-manager-job
28+
namespace: <cert manager namespace>

‎velero/backup/cert-manager/label-singleton-cert-manager-job.yaml

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: label-singleton-cert-manager-job
5+
namespace: <cert manager namespace>
6+
---
7+
8+
apiVersion: rbac.authorization.k8s.io/v1
9+
kind: Role
10+
metadata:
11+
name: label-singleton-cert-manager-job
12+
rules:
13+
- verbs:
14+
- get
15+
- list
16+
- update
17+
- patch
18+
apiGroups:
19+
- operators.coreos.com
20+
- operator.ibm.com
21+
resources:
22+
- namespaces
23+
- catalogsources
24+
- operatorgroups
25+
- subscriptions
26+
- certmanagerconfigs
27+
---
28+
29+
apiVersion: rbac.authorization.k8s.io/v1
30+
kind: RoleBinding
31+
metadata:
32+
name: label-singleton-cert-manager-job
33+
roleRef:
34+
apiGroup: rbac.authorization.k8s.io
35+
kind: Role
36+
name: label-singleton-cert-manager-job
37+
subjects:
38+
- kind: ServiceAccount
39+
name: label-singleton-cert-manager-job
40+
namespace: <cert manager namespace>
41+
---
42+
43+
apiVersion: batch/v1
44+
kind: Job
45+
metadata:
46+
name: label-singleton-cert-manager-job
47+
namespace: <cert manager namespace>
48+
spec:
49+
template:
50+
metadata:
51+
name: label-singleton-cert-manager-job
52+
namespace: <cert manager namespace>
53+
spec:
54+
suspend: true
55+
restartPolicy: OnFailure
56+
containers:
57+
- command: ["/bin/bash", "-c", "/scripts/velero/backup/cert-manager/label-singleton-cert-manager.sh --namespaces <cert manager namespace>"]
58+
59+
image: icr.io/cpopen/cpfs/cpfs-utils:4.6.4
60+
imagePullPolicy: IfNotPresent
61+
name: cpfs-util
62+
resources:
63+
limits:
64+
cpu: 500m
65+
ephemeral-storage: 512Mi
66+
memory: 1536Mi
67+
requests:
68+
cpu: 200m
69+
ephemeral-storage: 128Mi
70+
memory: 512Mi
71+
terminationMessagePath: /dev/termination-log
72+
terminationMessagePolicy: File
73+
volumeMounts:
74+
- name: logs
75+
mountPath: /scripts/logs
76+
dnsPolicy: ClusterFirst
77+
schedulerName: default-scheduler
78+
securityContext:
79+
runAsNonRoot: true
80+
serviceAccount: label-singleton-cert-manager-job
81+
serviceAccountName: label-singleton-cert-manager-job
82+
terminationGracePeriodSeconds: 30
83+
volumes:
84+
- emptyDir: {}
85+
name: logs

‎velero/backup/cert-manager/label-singleton-cert-manager.sh

Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
#!/usr/bin/env bash
2+
3+
# Licensed Materials - Property of IBM
4+
# Copyright IBM Corporation 2023. All Rights Reserved
5+
# US Government Users Restricted Rights -
6+
# Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.
7+
#
8+
# This is an internal component, bundled with an official IBM product.
9+
# Please refer to that particular license for additional information.
10+
11+
set -o errtrace
12+
set -o nounset
13+
14+
# ---------- Command arguments ----------
15+
OC=oc
16+
CERT_MANAGER_NAMESPACE="ibm-cert-manager"
17+
18+
# Catalog sources and namespace
19+
ENABLE_PRIVATE_CATALOG=0
20+
CM_SOURCE="ibm-cert-manager-catalog"
21+
CM_SOURCE_NS="openshift-marketplace"
22+
23+
# ---------- Command variables ----------
24+
25+
# script base directory
26+
BASE_DIR=$(cd $(dirname "$0")/$(dirname "$(readlink $0)") && pwd -P)
27+
28+
# ---------- Main functions ----------
29+
30+
function main() {
31+
parse_arguments "$@"
32+
pre_req
33+
label_catalogsource
34+
label_ns_and_related
35+
label_subscription
36+
label_cert_manager_resources
37+
success "Successfully labeled all the resources"
38+
}
39+
40+
function print_usage(){ #TODO update usage definition
41+
script_name=`basename ${0}`
42+
echo "Usage: ${script_name} [OPTIONS]"
43+
echo ""
44+
echo "Label Cert Manager resources to prepare for Backup."
45+
echo "Cert Manager namespace is always required."
46+
echo ""
47+
echo "Options:"
48+
echo " --oc string Optional. File path to oc CLI. Default uses oc in your PATH. Can also be set in env.properties."
49+
echo " --cert-manager-ns Optional. Specifying will enable labeling of the cert manager operator. Permissions may need to be updated to include the namespace."
50+
echo " --enable-private-catalog Optional. Specifying will look for catalog sources in the operator namespace. If enabled, will look for cert manager in its respective namespaces."
51+
echo " --cert-manager-catalog Optional. Specifying will look for the cert manager catalog source name."
52+
echo " --cert-manager-catalog-ns Optional. Specifying will look for the cert manager catalog source namespace."
53+
echo " -h, --help Print usage information"
54+
echo ""
55+
56+
}
57+
58+
function parse_arguments() {
59+
script_name=`basename ${0}`
60+
echo "All arguments passed into the ${script_name}: $@"
61+
echo ""
62+
63+
# process options
64+
while [[ "$@" != "" ]]; do
65+
case "$1" in
66+
--oc)
67+
shift
68+
OC=$1
69+
;;
70+
--cert-manager-ns)
71+
shift
72+
CERT_MANAGER_NAMESPACE=$1
73+
;;
74+
--enable-private-catalog)
75+
ENABLE_PRIVATE_CATALOG=1
76+
;;
77+
--cert-manager-catalog)
78+
shift
79+
CM_SOURCE=$1
80+
;;
81+
--cert-manager-catalog-ns)
82+
shift
83+
CM_SOURCE_NS=$1
84+
;;
85+
-h | --help)
86+
print_usage
87+
exit 1
88+
;;
89+
*)
90+
echo "Entered option $1 not supported. Run ./${script_name} -h for script usage info."
91+
;;
92+
esac
93+
shift
94+
done
95+
echo ""
96+
}
97+
98+
function pre_req(){
99+
100+
title "Start to validate the parameters passed into script... "
101+
# Checking oc command logged in
102+
user=$($OC whoami 2> /dev/null)
103+
if [ $? -ne 0 ]; then
104+
error "You must be logged into the OpenShift Cluster from the oc command line"
105+
else
106+
success "oc command logged in as ${user}"
107+
fi
108+
}
109+
110+
function label_catalogsource() {
111+
112+
title "Start to label the Cert Manager catalog sources... "
113+
# Label the Private CatalogSources in provided namespaces
114+
if [ $ENABLE_PRIVATE_CATALOG -eq 1 ]; then
115+
CM_SOURCE_NS=$CERT_MANAGER_NAMESPACE
116+
fi
117+
${OC} label catalogsource "$CM_SOURCE" foundationservices.cloudpak.ibm.com=catalog -n "$CM_SOURCE_NS" --overwrite=true 2>/dev/null
118+
echo ""
119+
}
120+
121+
function label_ns_and_related() {
122+
123+
title "Start to label the namespaces, operatorgroups... "
124+
125+
# Label the cert manager namespace
126+
${OC} label namespace "$CERT_MANAGER_NAMESPACE" foundationservices.cloudpak.ibm.com=namespace --overwrite=true 2>/dev/null
127+
128+
# Label the cert manager OperatorGroup
129+
operator_group=$(${OC} get operatorgroup -n "$CERT_MANAGER_NAMESPACE" -o jsonpath='{.items[*].metadata.name}')
130+
${OC} label operatorgroup "$operator_group" foundationservices.cloudpak.ibm.com=operatorgroup -n "$CERT_MANAGER_NAMESPACE" --overwrite=true 2>/dev/null
131+
132+
echo ""
133+
}
134+
135+
136+
function label_subscription() {
137+
138+
title "Start to label the Subscriptions... "
139+
local cm_pm="ibm-cert-manager-operator"
140+
${OC} label subscriptions.operators.coreos.com $cm_pm foundationservices.cloudpak.ibm.com=singleton-subscription -n $CERT_MANAGER_NAMESPACE --overwrite=true 2>/dev/null
141+
echo ""
142+
}
143+
144+
function label_cert_manager_resources(){
145+
title "Start to label the Cert Manager resources... "
146+
${OC} label customresourcedefinition certmanagerconfigs.operator.ibm.com foundationservices.cloudpak.ibm.com=cert-manager --overwrite=true 2>/dev/null
147+
${OC} label customresourcedefinition certificates.cert-manager.io foundationservices.cloudpak.ibm.com=cert-manager --overwrite=true 2>/dev/null
148+
${OC} label customresourcedefinition issuers.cert-manager.io foundationservices.cloudpak.ibm.com=cert-manager --overwrite=true 2>/dev/null
149+
info "Start to label the Cert Manager Configs"
150+
cert_manager_configs=$(${OC} get certmanagerconfigs.operator.ibm.com -n $CERT_MANAGER_NAMESPACE -o jsonpath='{.items[*].metadata.name}')
151+
while IFS= read -r cert_manager_config; do
152+
${OC} label certmanagerconfigs.operator.ibm.com $cert_manager_config foundationservices.cloudpak.ibm.com=cert-manager -n $CERT_MANAGER_NAMESPACE --overwrite=true 2>/dev/null
153+
done <<< "$cert_manager_configs"
154+
}
155+
156+
# ---------- Info functions ----------#
157+
158+
function msg() {
159+
printf '%b\n' "$1"
160+
}
161+
162+
function success() {
163+
msg "\33[32m[✔] ${1}\33[0m"
164+
}
165+
166+
function error() {
167+
msg "\33[31m[✘] ${1}\33[0m"
168+
exit 1
169+
}
170+
171+
function title() {
172+
msg "\33[34m# ${1}\33[0m"
173+
}
174+
175+
function info() {
176+
msg "[INFO] ${1}"
177+
}
178+
179+
function warning() {
180+
msg "\33[33m[✗] ${1}\33[0m"
181+
}
182+
183+
main $*
184+
185+
# ---------------- finish ----------------

‎velero/backup/common-service/label-common-service.sh

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -72,13 +72,17 @@ function main() {
7272
fi
7373
label_ns_and_related
7474
label_configmap
75-
label_cs
76-
if [[ $SERVICES_NS != "" ]]; then
77-
label_nss
75+
label_subscription
76+
if [[ $ENABLE_CERT_MANAGER -eq 1 ]]; then
77+
label_cert_manager
7878
fi
7979
if [[ $ENABLE_LSR -eq 1 ]]; then
8080
label_lsr
8181
fi
82+
label_cs
83+
if [[ $SERVICES_NS != "" ]]; then
84+
label_nss
85+
fi
8286
label_mcsp
8387
success "Successfully labeled all the resources"
8488
}
@@ -367,6 +371,18 @@ function label_subscription() {
367371
echo ""
368372
}
369373

374+
function label_cert_manager(){
375+
title "Start to label the Cert Manager resources... "
376+
${OC} label customresourcedefinition certmanagerconfigs.operator.ibm.com foundationservices.cloudpak.ibm.com=cert-manager --overwrite=true 2>/dev/null
377+
${OC} label customresourcedefinition certificates.cert-manager.io foundationservices.cloudpak.ibm.com=cert-manager --overwrite=true 2>/dev/null
378+
${OC} label customresourcedefinition issuers.cert-manager.io foundationservices.cloudpak.ibm.com=cert-manager --overwrite=true 2>/dev/null
379+
info "Start to label the Cert Manager Configs"
380+
cert_manager_configs=$(${OC} get certmanagerconfigs.operator.ibm.com -n $CERT_MANAGER_NAMESPACE -o jsonpath='{.items[*].metadata.name}')
381+
while IFS= read -r cert_manager_config; do
382+
${OC} label certmanagerconfigs.operator.ibm.com $cert_manager_config foundationservices.cloudpak.ibm.com=cert-manager -n $CERT_MANAGER_NAMESPACE --overwrite=true 2>/dev/null
383+
done <<< "$cert_manager_configs"
384+
}
385+
370386
function label_lsr() {
371387

372388
title "Start to label the License Service Reporter... "

0 commit comments

Comments
 (0)