Skip to content

Commit 069e014

Browse files
horis233horis233
authored
feat: enable CSV injector in NamespaceScope CR (#92)
* feat: enable CSV injector in NamespaceScope CR In order to make the NamespaceScope operator can be used in more situations, it should have the capability to patch CSVs of Operators to convert them can be managed by the NamespaceScope operator. "csvInjector.enable" is used to control if the NamespaceScope operator will patch the CSVs of specific operators. The default value is false. * Fix typo
1 parent 7f056e6 commit 069e014

14 files changed

+447
-132
lines changed

‎README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# NamspaceScope - Manage operator and operand authority across namespaces
1+
# namespaceScope - Manage operator and operand authority across namespaces
22

33
This operator automates the extension of operator watch and service account permission scope to other namespaces in an openshift cluster.
44

@@ -20,7 +20,7 @@ spec:
2020
# ConfigMap name that will contain the list of namespaces to be watched
2121
configmapName: namespace-scope
2222
23-
# Restart pods with the following labels when the namspace list changes
23+
# Restart pods with the following labels when the namespace list changes
2424
restartLabels:
2525
intent: projected
2626
```

‎api/v1/namespacescope_types.go

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,8 @@ import (
2020
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2121
)
2222

23-
// EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN!
24-
// NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized.
25-
2623
// NamespaceScopeSpec defines the desired state of NamespaceScope
2724
type NamespaceScopeSpec struct {
28-
// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
29-
// Important: Run "make" to regenerate code after modifying this file
3025

3126
// Namespaces that are part of this scope
3227
NamespaceMembers []string `json:"namespaceMembers,omitempty"`
@@ -37,20 +32,29 @@ type NamespaceScopeSpec struct {
3732
// ConfigMap name that will contain the list of namespaces to be watched
3833
ConfigmapName string `json:"configmapName,omitempty"`
3934

40-
// Restart pods with the following labels when the namspace list changes
35+
// Restart pods with the following labels when the namespace list changes
4136
RestartLabels map[string]string `json:"restartLabels,omitempty"`
4237

43-
// Set the following to true to manaually manage permissions for the NamespaceScope operator to extend control over other namespaces
38+
// Set the following to true to manually manage permissions for the NamespaceScope operator to extend control over other namespaces
4439
// The operator may fail when trying to extend permissions to other namespaces, but the cluster administrator can correct this using the
4540
// authorize-namespace command.
4641
ManualManagement bool `json:"manualManagement,omitempty"`
42+
43+
// When CSVInjector is enabled, operator will inject the watch namespace list into operator csv.
44+
CSVInjector CSVInjector `json:"csvInjector,omitempty"`
45+
}
46+
47+
// CSVInjector manages if operator will insert labels and WATCH_NAMESPACES in CSV automatically
48+
type CSVInjector struct {
49+
Enable bool `json:"enable"`
4750
}
4851

4952
// NamespaceScopeStatus defines the observed state of NamespaceScope
5053
type NamespaceScopeStatus struct {
51-
// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
52-
// Important: Run "make" to regenerate code after modifying this file
5354
ValidatedMembers []string `json:"validatedMembers,omitempty"`
55+
56+
ManagedCSVList []string `json:"managedCSVList,omitempty"`
57+
PatchedCSVList []string `json:"patchedCSVList,omitempty"`
5458
}
5559

5660
// +kubebuilder:object:root=true

‎api/v1/zz_generated.deepcopy.go

Lines changed: 26 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bundle-restricted/manifests/operator.ibm.com_namespacescopes.yaml

Lines changed: 66 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
apiVersion: apiextensions.k8s.io/v1beta1
1+
apiVersion: apiextensions.k8s.io/v1
22
kind: CustomResourceDefinition
33
metadata:
44
annotations:
5-
controller-gen.kubebuilder.io/version: v0.3.0
5+
controller-gen.kubebuilder.io/version: v0.4.0
66
creationTimestamp: null
77
name: namespacescopes.operator.ibm.com
88
spec:
@@ -15,60 +15,74 @@ spec:
1515
- nss
1616
singular: namespacescope
1717
scope: Namespaced
18-
subresources:
19-
status: {}
20-
validation:
21-
openAPIV3Schema:
22-
description: NamespaceScope is the Schema for the namespacescopes API
23-
properties:
24-
apiVersion:
25-
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
26-
type: string
27-
kind:
28-
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
29-
type: string
30-
metadata:
31-
type: object
32-
spec:
33-
description: NamespaceScopeSpec defines the desired state of NamespaceScope
34-
properties:
35-
configmapName:
36-
description: ConfigMap name that will contain the list of namespaces to be watched
37-
type: string
38-
manualManagement:
39-
description: Set the following to true to manaually manage permissions for the NamespaceScope operator to extend control over other namespaces The operator may fail when trying to extend permissions to other namespaces, but the cluster administrator can correct this using the authorize-namespace command.
40-
type: boolean
41-
namespaceMembers:
42-
description: Namespaces that are part of this scope
43-
items:
44-
type: string
45-
type: array
46-
restartLabels:
47-
additionalProperties:
48-
type: string
49-
description: Restart pods with the following labels when the namspace list changes
50-
type: object
51-
serviceAccountMembers:
52-
description: ServiceAccountMembers are extra service accounts will be bond the roles from other namespaces
53-
items:
54-
type: string
55-
type: array
56-
type: object
57-
status:
58-
description: NamespaceScopeStatus defines the observed state of NamespaceScope
59-
properties:
60-
validatedMembers:
61-
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state of cluster Important: Run "make" to regenerate code after modifying this file'
62-
items:
63-
type: string
64-
type: array
65-
type: object
66-
type: object
67-
version: v1
6818
versions:
6919
- name: v1
20+
schema:
21+
openAPIV3Schema:
22+
description: NamespaceScope is the Schema for the namespacescopes API
23+
properties:
24+
apiVersion:
25+
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
26+
type: string
27+
kind:
28+
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
29+
type: string
30+
metadata:
31+
type: object
32+
spec:
33+
description: NamespaceScopeSpec defines the desired state of NamespaceScope
34+
properties:
35+
configmapName:
36+
description: ConfigMap name that will contain the list of namespaces to be watched
37+
type: string
38+
csvInjector:
39+
description: When CSVInjector is enabled, operator will inject the watch namespace list into operator csv.
40+
properties:
41+
enable:
42+
type: boolean
43+
required:
44+
- enable
45+
type: object
46+
manualManagement:
47+
description: Set the following to true to manually manage permissions for the NamespaceScope operator to extend control over other namespaces The operator may fail when trying to extend permissions to other namespaces, but the cluster administrator can correct this using the authorize-namespace command.
48+
type: boolean
49+
namespaceMembers:
50+
description: Namespaces that are part of this scope
51+
items:
52+
type: string
53+
type: array
54+
restartLabels:
55+
additionalProperties:
56+
type: string
57+
description: Restart pods with the following labels when the namespace list changes
58+
type: object
59+
serviceAccountMembers:
60+
description: ServiceAccountMembers are extra service accounts will be bond the roles from other namespaces
61+
items:
62+
type: string
63+
type: array
64+
type: object
65+
status:
66+
description: NamespaceScopeStatus defines the observed state of NamespaceScope
67+
properties:
68+
managedCSVList:
69+
items:
70+
type: string
71+
type: array
72+
patchedCSVList:
73+
items:
74+
type: string
75+
type: array
76+
validatedMembers:
77+
items:
78+
type: string
79+
type: array
80+
type: object
81+
type: object
7082
served: true
7183
storage: true
84+
subresources:
85+
status: {}
7286
status:
7387
acceptedNames:
7488
kind: ""

‎bundle/manifests/operator.ibm.com_namespacescopes.yaml

Lines changed: 66 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
apiVersion: apiextensions.k8s.io/v1beta1
1+
apiVersion: apiextensions.k8s.io/v1
22
kind: CustomResourceDefinition
33
metadata:
44
annotations:
5-
controller-gen.kubebuilder.io/version: v0.3.0
5+
controller-gen.kubebuilder.io/version: v0.4.0
66
creationTimestamp: null
77
name: namespacescopes.operator.ibm.com
88
spec:
@@ -15,60 +15,74 @@ spec:
1515
- nss
1616
singular: namespacescope
1717
scope: Namespaced
18-
subresources:
19-
status: {}
20-
validation:
21-
openAPIV3Schema:
22-
description: NamespaceScope is the Schema for the namespacescopes API
23-
properties:
24-
apiVersion:
25-
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
26-
type: string
27-
kind:
28-
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
29-
type: string
30-
metadata:
31-
type: object
32-
spec:
33-
description: NamespaceScopeSpec defines the desired state of NamespaceScope
34-
properties:
35-
configmapName:
36-
description: ConfigMap name that will contain the list of namespaces to be watched
37-
type: string
38-
manualManagement:
39-
description: Set the following to true to manaually manage permissions for the NamespaceScope operator to extend control over other namespaces The operator may fail when trying to extend permissions to other namespaces, but the cluster administrator can correct this using the authorize-namespace command.
40-
type: boolean
41-
namespaceMembers:
42-
description: Namespaces that are part of this scope
43-
items:
44-
type: string
45-
type: array
46-
restartLabels:
47-
additionalProperties:
48-
type: string
49-
description: Restart pods with the following labels when the namspace list changes
50-
type: object
51-
serviceAccountMembers:
52-
description: ServiceAccountMembers are extra service accounts will be bond the roles from other namespaces
53-
items:
54-
type: string
55-
type: array
56-
type: object
57-
status:
58-
description: NamespaceScopeStatus defines the observed state of NamespaceScope
59-
properties:
60-
validatedMembers:
61-
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state of cluster Important: Run "make" to regenerate code after modifying this file'
62-
items:
63-
type: string
64-
type: array
65-
type: object
66-
type: object
67-
version: v1
6818
versions:
6919
- name: v1
20+
schema:
21+
openAPIV3Schema:
22+
description: NamespaceScope is the Schema for the namespacescopes API
23+
properties:
24+
apiVersion:
25+
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
26+
type: string
27+
kind:
28+
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
29+
type: string
30+
metadata:
31+
type: object
32+
spec:
33+
description: NamespaceScopeSpec defines the desired state of NamespaceScope
34+
properties:
35+
configmapName:
36+
description: ConfigMap name that will contain the list of namespaces to be watched
37+
type: string
38+
csvInjector:
39+
description: When CSVInjector is enabled, operator will inject the watch namespace list into operator csv.
40+
properties:
41+
enable:
42+
type: boolean
43+
required:
44+
- enable
45+
type: object
46+
manualManagement:
47+
description: Set the following to true to manually manage permissions for the NamespaceScope operator to extend control over other namespaces The operator may fail when trying to extend permissions to other namespaces, but the cluster administrator can correct this using the authorize-namespace command.
48+
type: boolean
49+
namespaceMembers:
50+
description: Namespaces that are part of this scope
51+
items:
52+
type: string
53+
type: array
54+
restartLabels:
55+
additionalProperties:
56+
type: string
57+
description: Restart pods with the following labels when the namespace list changes
58+
type: object
59+
serviceAccountMembers:
60+
description: ServiceAccountMembers are extra service accounts will be bond the roles from other namespaces
61+
items:
62+
type: string
63+
type: array
64+
type: object
65+
status:
66+
description: NamespaceScopeStatus defines the observed state of NamespaceScope
67+
properties:
68+
managedCSVList:
69+
items:
70+
type: string
71+
type: array
72+
patchedCSVList:
73+
items:
74+
type: string
75+
type: array
76+
validatedMembers:
77+
items:
78+
type: string
79+
type: array
80+
type: object
81+
type: object
7082
served: true
7183
storage: true
84+
subresources:
85+
status: {}
7286
status:
7387
acceptedNames:
7488
kind: ""

0 commit comments

Comments
 (0)