Skip to content

Commit 0e7ec5a

Browse files
YCShen1010YCShen1010
authored
Update NSS metadata to pass RH certification (#364)
* update NSS metadata to pass RH certification Signed-off-by: YuChen <[email protected]> * add opernshift annotation Signed-off-by: YuChen <[email protected]> * update image in config manager Signed-off-by: YuChen <[email protected]> --------- Signed-off-by: YuChen <[email protected]>
1 parent fdf1677 commit 0e7ec5a

10 files changed

+94
-56
lines changed

‎Dockerfile

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ FROM docker-na-public.artifactory.swg-devops.com/hyc-cloud-private-edge-docker-l
2525

2626
ARG VCS_REF
2727
ARG VCS_URL
28+
ARG RELEASE_VERSION
2829

2930
LABEL org.label-schema.vendor="IBM" \
3031
org.label-schema.name="IBM Namespace Scope Operator" \
@@ -34,7 +35,10 @@ LABEL org.label-schema.vendor="IBM" \
3435
org.label-schema.license="Licensed Materials - Property of IBM" \
3536
org.label-schema.schema-version="1.0" \
3637
name="IBM Namespace Scope Operator" \
38+
maintainer="IBM" \
3739
vendor="IBM" \
40+
version=$RELEASE_VERSION \
41+
release=$RELEASE_VERSION \
3842
description="This operator automates the extension of operator watch and service account permission scope to other namespaces in an openshift cluster." \
3943
summary="This operator automates the extension of operator watch and service account permission scope to other namespaces in an openshift cluster."
4044

‎Makefile

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ KUSTOMIZE ?= $(shell which kustomize)
2222
YQ_VERSION=3.4.0
2323
KUSTOMIZE_VERSION=v3.8.7
2424
OPERATOR_SDK_VERSION=v1.32.0
25+
OPENSHIFT_VERSIONS ?= v4.12-v4.17
2526

2627
GOPATH=$(HOME)/go/bin/
2728

@@ -64,6 +65,7 @@ endif
6465

6566
# Default image repo
6667
QUAY_REGISTRY ?= quay.io/opencloudio
68+
ICR_REIGSTRY ?= icr.io/cpopen
6769

6870
ifeq ($(BUILD_LOCALLY),0)
6971
ARTIFACTORYA_REGISTRY ?= "docker-na-public.artifactory.swg-devops.com/hyc-cloud-private-integration-docker-local/ibmcom"
@@ -75,11 +77,9 @@ endif
7577
OPERATOR_IMAGE_NAME ?= ibm-namespace-scope-operator
7678
# Current Operator bundle image name
7779
BUNDLE_IMAGE_NAME ?= ibm-namespace-scope-operator-bundle
78-
# Current Operator version
79-
OPERATOR_VERSION ?= 4.2.13
8080

8181
# Options for 'bundle-build'
82-
CHANNELS ?= v4.0
82+
CHANNELS ?= v4.2
8383
DEFAULT_CHANNEL ?= v4.0
8484
ifneq ($(origin CHANNELS), undefined)
8585
BUNDLE_CHANNELS := --channels=$(CHANNELS)
@@ -89,8 +89,8 @@ BUNDLE_DEFAULT_CHANNEL := --default-channel=$(DEFAULT_CHANNEL)
8989
endif
9090
BUNDLE_METADATA_OPTS ?= $(BUNDLE_CHANNELS) $(BUNDLE_DEFAULT_CHANNEL)
9191

92-
# Produce CRDs that work back to Kubernetes 1.11 (no version conversion)
93-
CRD_OPTIONS ?= "crd:trivialVersions=true"
92+
# Generate CRDs using v1, which is the recommended version for Kubernetes 1.16+.
93+
CRD_OPTIONS ?= "crd:crdVersions=v1"
9494

9595
ifeq ($(BUILD_LOCALLY),0)
9696
export CONFIG_DOCKER_TARGET = config-docker
@@ -125,11 +125,11 @@ uninstall: manifests ## Uninstall CRDs from a cluster
125125
$(KUSTOMIZE) build config/crd | kubectl delete -f -
126126

127127
deploy: manifests ## Deploy controller in the configured Kubernetes cluster in ~/.kube/config
128-
cd config/manager && $(KUSTOMIZE) edit set image ibm-namespace-scope-operator=$(QUAY_REGISTRY)/$(OPERATOR_IMAGE_NAME):$(OPERATOR_VERSION)
128+
cd config/manager && $(KUSTOMIZE) edit set image icr.io/cpopen/ibm-namespace-scope-operator=$(QUAY_REGISTRY)/$(OPERATOR_IMAGE_NAME):$(RELEASE_VERSION)
129129
$(KUSTOMIZE) build config/default | kubectl apply -f -
130130

131131
undeploy: ## Undeploy controller in the configured Kubernetes cluster in ~/.kube/config
132-
cd config/manager && $(KUSTOMIZE) edit set image ibm-namespace-scope-operator=$(QUAY_REGISTRY)/$(OPERATOR_IMAGE_NAME):$(OPERATOR_VERSION)
132+
cd config/manager && $(KUSTOMIZE) edit set image icr.io/cpopen/ibm-namespace-scope-operator=$(QUAY_REGISTRY)/$(OPERATOR_IMAGE_NAME):$(RELEASE_VERSION)
133133
$(KUSTOMIZE) build config/default | kubectl delete -f -
134134

135135
kustomize: ## Install kustomize
@@ -190,10 +190,12 @@ generate: controller-gen ## Generate code e.g. API etc.
190190
generate-csv-manifests: operator-sdk ## Generate CSV manifests
191191
$(OPERATOR_SDK) generate kustomize manifests
192192

193-
bundle: clis generate manifests ## Generate bundle manifests
193+
bundle: clis generate manifests ## Generate bundle manifests
194194
# Generate bundle manifests
195-
- $(KUSTOMIZE) build config/manifests | $(OPERATOR_SDK) generate bundle \
196-
-q --version $(OPERATOR_VERSION) $(BUNDLE_METADATA_OPTS)
195+
cd config/manager && $(KUSTOMIZE) edit set image icr.io/cpopen/ibm-namespace-scope-operator=$(ICR_REIGSTRY)/$(OPERATOR_IMAGE_NAME):$(RELEASE_VERSION)
196+
$(KUSTOMIZE) build config/manifests | $(OPERATOR_SDK) generate bundle \
197+
-q --version $(RELEASE_VERSION) $(BUNDLE_METADATA_OPTS)
198+
- sed -i '$$a\\n# OpenShift annotations.\n com.redhat.openshift.versions: $(OPENSHIFT_VERSIONS)' bundle/metadata/annotations.yaml
197199
- $(OPERATOR_SDK) bundle validate ./bundle
198200

199201
##@ Test

‎bundle.Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ LABEL operators.operatorframework.io.bundle.manifests.v1=manifests/
66
LABEL operators.operatorframework.io.bundle.metadata.v1=metadata/
77
LABEL operators.operatorframework.io.bundle.package.v1=ibm-namespace-scope-operator
88
LABEL operators.operatorframework.io.bundle.channels.v1=v4.2
9-
LABEL operators.operatorframework.io.bundle.channel.default.v1=v4.2
9+
LABEL operators.operatorframework.io.bundle.channel.default.v1=v4.0
1010
LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.32.0
1111
LABEL operators.operatorframework.io.metrics.mediatype.v1=metrics+v1
1212
LABEL operators.operatorframework.io.metrics.project_layout=go.kubebuilder.io/v2

‎bundle/manifests/ibm-namespace-scope-operator.clusterserviceversion.yaml

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -22,21 +22,21 @@ metadata:
2222
}
2323
]
2424
capabilities: Seamless Upgrades
25-
containerImage: icr.io/cpopen/ibm-namespace-scope-operator:latest
26-
createdAt: "2024-05-23T08:24:14Z"
27-
olm.skipRange: '<4.2.13'
28-
operators.openshift.io/infrastructure-features: '["disconnected"]'
29-
operators.operatorframework.io/builder: operator-sdk-v1.32.0
30-
operators.operatorframework.io/project_layout: go.kubebuilder.io/v2
31-
repository: https://github.com/IBM/ibm-namespace-scope-operator
32-
support: IBM
25+
containerImage: icr.io/cpopen/ibm-namespace-scope-operator:4.2.13
26+
createdAt: "2025-02-18T22:27:02Z"
3327
features.operators.openshift.io/disconnected: "true"
3428
features.operators.openshift.io/fips-compliant: "true"
3529
features.operators.openshift.io/proxy-aware: "false"
3630
features.operators.openshift.io/tls-profiles: "false"
3731
features.operators.openshift.io/token-auth-aws: "false"
3832
features.operators.openshift.io/token-auth-azure: "false"
3933
features.operators.openshift.io/token-auth-gcp: "false"
34+
olm.skipRange: <4.2.13
35+
operators.openshift.io/infrastructure-features: '["disconnected"]'
36+
operators.operatorframework.io/builder: operator-sdk-v1.32.0
37+
operators.operatorframework.io/project_layout: go.kubebuilder.io/v2
38+
repository: https://github.com/IBM/ibm-namespace-scope-operator
39+
support: IBM
4040
labels:
4141
operatorframework.io/arch.amd64: supported
4242
operatorframework.io/arch.ppc64le: supported
@@ -132,7 +132,7 @@ spec:
132132
fieldRef:
133133
apiVersion: v1
134134
fieldPath: metadata.namespace
135-
image: icr.io/cpopen/ibm-namespace-scope-operator:latest
135+
image: icr.io/cpopen/ibm-namespace-scope-operator:4.2.13
136136
imagePullPolicy: IfNotPresent
137137
name: ibm-namespace-scope-operator
138138
resources:
@@ -144,15 +144,15 @@ spec:
144144
ephemeral-storage: 256Mi
145145
memory: 200Mi
146146
securityContext:
147-
seccompProfile:
148-
type: RuntimeDefault
149147
allowPrivilegeEscalation: false
150148
capabilities:
151149
drop:
152150
- ALL
153151
privileged: false
154152
readOnlyRootFilesystem: true
155153
runAsNonRoot: true
154+
seccompProfile:
155+
type: RuntimeDefault
156156
serviceAccountName: ibm-namespace-scope-operator
157157
terminationGracePeriodSeconds: 10
158158
permissions:

‎bundle/manifests/operator.ibm.com_namespacescopes.yaml

Lines changed: 22 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
22
kind: CustomResourceDefinition
33
metadata:
44
annotations:
5-
controller-gen.kubebuilder.io/version: v0.5.0
5+
controller-gen.kubebuilder.io/version: v0.17.2
66
creationTimestamp: null
77
name: namespacescopes.operator.ibm.com
88
spec:
@@ -22,14 +22,19 @@ spec:
2222
description: NamespaceScope is the Schema for the namespacescopes API
2323
properties:
2424
apiVersion:
25-
description: 'APIVersion defines the versioned schema of this representation
26-
of an object. Servers should convert recognized schemas to the latest
27-
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
25+
description: |-
26+
APIVersion defines the versioned schema of this representation of an object.
27+
Servers should convert recognized schemas to the latest internal value, and
28+
may reject unrecognized values.
29+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
2830
type: string
2931
kind:
30-
description: 'Kind is a string value representing the REST resource this
31-
object represents. Servers may infer this from the endpoint the client
32-
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
32+
description: |-
33+
Kind is a string value representing the REST resource this object represents.
34+
Servers may infer this from the endpoint the client submits requests to.
35+
Cannot be updated.
36+
In CamelCase.
37+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
3338
type: string
3439
metadata:
3540
type: object
@@ -51,7 +56,8 @@ spec:
5156
- enable
5257
type: object
5358
license:
54-
description: LicenseAcceptance defines the license specification in CSV
59+
description: LicenseAcceptance defines the license specification in
60+
CSV
5561
properties:
5662
accept:
5763
description: 'Accepting the license - URL: https://ibm.biz/integration-licenses'
@@ -60,18 +66,18 @@ spec:
6066
description: The license key for this deployment.
6167
type: string
6268
license:
63-
description: The license being accepted where the component has multiple.
69+
description: The license being accepted where the component has
70+
multiple.
6471
type: string
6572
use:
6673
description: The type of license being accepted.
6774
type: string
6875
type: object
6976
manualManagement:
70-
description: Set the following to true to manually manage permissions
71-
for the NamespaceScope operator to extend control over other namespaces
72-
The operator may fail when trying to extend permissions to other
73-
namespaces, but the cluster administrator can correct this using
74-
the authorize-namespace command.
77+
description: |-
78+
Set the following to true to manually manage permissions for the NamespaceScope operator to extend control over other namespaces
79+
The operator may fail when trying to extend permissions to other namespaces, but the cluster administrator can correct this using the
80+
authorize-namespace command.
7581
type: boolean
7682
namespaceMembers:
7783
description: Namespaces that are part of this scope
@@ -126,5 +132,5 @@ status:
126132
acceptedNames:
127133
kind: ""
128134
plural: ""
129-
conditions: []
130-
storedVersions: []
135+
conditions: null
136+
storedVersions: null

‎bundle/metadata/annotations.yaml

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,15 @@ annotations:
44
operators.operatorframework.io.bundle.manifests.v1: manifests/
55
operators.operatorframework.io.bundle.metadata.v1: metadata/
66
operators.operatorframework.io.bundle.package.v1: ibm-namespace-scope-operator
7-
operators.operatorframework.io.bundle.channels.v1: v4.0
7+
operators.operatorframework.io.bundle.channels.v1: v4.2
88
operators.operatorframework.io.bundle.channel.default.v1: v4.0
9-
operators.operatorframework.io.metrics.builder: operator-sdk-v1.32.0
9+
operators.operatorframework.io.metrics.builder: operator-sdk-v1.31.0
1010
operators.operatorframework.io.metrics.mediatype.v1: metrics+v1
1111
operators.operatorframework.io.metrics.project_layout: go.kubebuilder.io/v2
1212

1313
# Annotations for testing.
1414
operators.operatorframework.io.test.mediatype.v1: scorecard+v1
1515
operators.operatorframework.io.test.config.v1: tests/scorecard/
16+
17+
# OpenShift annotations.
18+
com.redhat.openshift.versions: v4.12-v4.17

‎config/crd/bases/operator.ibm.com_namespacescopes.yaml

Lines changed: 30 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,9 @@
1-
21
---
32
apiVersion: apiextensions.k8s.io/v1
43
kind: CustomResourceDefinition
54
metadata:
65
annotations:
7-
controller-gen.kubebuilder.io/version: v0.5.0
8-
creationTimestamp: null
6+
controller-gen.kubebuilder.io/version: v0.17.2
97
name: namespacescopes.operator.ibm.com
108
spec:
119
group: operator.ibm.com
@@ -24,21 +22,32 @@ spec:
2422
description: NamespaceScope is the Schema for the namespacescopes API
2523
properties:
2624
apiVersion:
27-
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
25+
description: |-
26+
APIVersion defines the versioned schema of this representation of an object.
27+
Servers should convert recognized schemas to the latest internal value, and
28+
may reject unrecognized values.
29+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
2830
type: string
2931
kind:
30-
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
32+
description: |-
33+
Kind is a string value representing the REST resource this object represents.
34+
Servers may infer this from the endpoint the client submits requests to.
35+
Cannot be updated.
36+
In CamelCase.
37+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
3138
type: string
3239
metadata:
3340
type: object
3441
spec:
3542
description: NamespaceScopeSpec defines the desired state of NamespaceScope
3643
properties:
3744
configmapName:
38-
description: ConfigMap name that will contain the list of namespaces to be watched
45+
description: ConfigMap name that will contain the list of namespaces
46+
to be watched
3947
type: string
4048
csvInjector:
41-
description: When CSVInjector is enabled, operator will inject the watch namespace list into operator csv.
49+
description: When CSVInjector is enabled, operator will inject the
50+
watch namespace list into operator csv.
4251
properties:
4352
enable:
4453
default: true
@@ -47,7 +56,8 @@ spec:
4756
- enable
4857
type: object
4958
license:
50-
description: LicenseAcceptance defines the license specification in CSV
59+
description: LicenseAcceptance defines the license specification in
60+
CSV
5161
properties:
5262
accept:
5363
description: 'Accepting the license - URL: https://ibm.biz/integration-licenses'
@@ -56,14 +66,18 @@ spec:
5666
description: The license key for this deployment.
5767
type: string
5868
license:
59-
description: The license being accepted where the component has multiple.
69+
description: The license being accepted where the component has
70+
multiple.
6071
type: string
6172
use:
6273
description: The type of license being accepted.
6374
type: string
6475
type: object
6576
manualManagement:
66-
description: Set the following to true to manually manage permissions for the NamespaceScope operator to extend control over other namespaces The operator may fail when trying to extend permissions to other namespaces, but the cluster administrator can correct this using the authorize-namespace command.
77+
description: |-
78+
Set the following to true to manually manage permissions for the NamespaceScope operator to extend control over other namespaces
79+
The operator may fail when trying to extend permissions to other namespaces, but the cluster administrator can correct this using the
80+
authorize-namespace command.
6781
type: boolean
6882
namespaceMembers:
6983
description: Namespaces that are part of this scope
@@ -73,10 +87,12 @@ spec:
7387
restartLabels:
7488
additionalProperties:
7589
type: string
76-
description: Restart pods with the following labels when the namespace list changes
90+
description: Restart pods with the following labels when the namespace
91+
list changes
7792
type: object
7893
serviceAccountMembers:
79-
description: ServiceAccountMembers are extra service accounts will be bond the roles from other namespaces
94+
description: ServiceAccountMembers are extra service accounts will
95+
be bond the roles from other namespaces
8096
items:
8197
type: string
8298
type: array
@@ -116,5 +132,5 @@ status:
116132
acceptedNames:
117133
kind: ""
118134
plural: ""
119-
conditions: []
120-
storedVersions: []
135+
conditions: null
136+
storedVersions: null

‎config/manager/kustomization.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,8 @@
11
resources:
22
- manager.yaml
3+
apiVersion: kustomize.config.k8s.io/v1beta1
4+
kind: Kustomization
5+
images:
6+
- name: icr.io/cpopen/ibm-namespace-scope-operator
7+
newName: icr.io/cpopen/ibm-namespace-scope-operator
8+
newTag: 4.2.13

‎config/manager/manager.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ spec:
4646
containers:
4747
- command:
4848
- /namespace-scope-operator-manager
49-
image: icr.io/cpopen/ibm-namespace-scope-operator:latest
49+
image: icr.io/cpopen/ibm-namespace-scope-operator:4.2.13
5050
imagePullPolicy: IfNotPresent
5151
name: ibm-namespace-scope-operator
5252
env:

‎config/manifests/bases/ibm-namespace-scope-operator.clusterserviceversion.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,9 @@ metadata:
44
annotations:
55
alm-examples: '[]'
66
capabilities: Seamless Upgrades
7-
containerImage: icr.io/cpopen/ibm-namespace-scope-operator:latest
7+
containerImage: icr.io/cpopen/ibm-namespace-scope-operator:4.2.13
88
createdAt: "2020-11-2T15:38:33Z"
9+
olm.skipRange: '<4.2.13'
910
operators.openshift.io/infrastructure-features: '["disconnected"]'
1011
operators.operatorframework.io/builder: operator-sdk-v1.1.0
1112
operators.operatorframework.io/project_layout: go.kubebuilder.io/v2

0 commit comments

Comments
 (0)