diff --git a/.ci-operator.yaml b/.ci-operator.yaml index 1a05e606..df7900c6 100644 --- a/.ci-operator.yaml +++ b/.ci-operator.yaml @@ -1,4 +1,4 @@ build_root_image: name: tools namespace: openstack-k8s-operators - tag: ci-build-root-golang-1.24-sdk-1.31 + tag: ci-build-root-golang-1.24-sdk-1.41.1 diff --git a/.github/workflows/build-designate-operator.yaml b/.github/workflows/build-designate-operator.yaml index b27a6060..276b06fe 100644 --- a/.github/workflows/build-designate-operator.yaml +++ b/.github/workflows/build-designate-operator.yaml @@ -16,7 +16,7 @@ jobs: with: operator_name: designate go_version: 1.24.x - operator_sdk_version: 1.31.0 + operator_sdk_version: 1.41.1 secrets: IMAGENAMESPACE: ${{ secrets.IMAGENAMESPACE }} QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }} diff --git a/.github/workflows/force-bump-pr-manual.yaml b/.github/workflows/force-bump-pr-manual.yaml index e0bb20f5..abbf7d09 100644 --- a/.github/workflows/force-bump-pr-manual.yaml +++ b/.github/workflows/force-bump-pr-manual.yaml @@ -9,6 +9,6 @@ jobs: with: operator_name: designate branch_name: ${{ github.ref_name }} - custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.31 + custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.41.1 secrets: FORCE_BUMP_PULL_REQUEST_PAT: ${{ secrets.FORCE_BUMP_PULL_REQUEST_PAT }} diff --git a/.github/workflows/force-bump-pr-scheduled.yaml b/.github/workflows/force-bump-pr-scheduled.yaml index 17654e67..e038f922 100644 --- a/.github/workflows/force-bump-pr-scheduled.yaml +++ b/.github/workflows/force-bump-pr-scheduled.yaml @@ -10,6 +10,6 @@ jobs: uses: openstack-k8s-operators/openstack-k8s-operators-ci/.github/workflows/force-bump-branches.yaml@main with: operator_name: designate - custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.31 + custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.41.1 secrets: FORCE_BUMP_PULL_REQUEST_PAT: ${{ secrets.FORCE_BUMP_PULL_REQUEST_PAT }} diff --git a/Dockerfile b/Dockerfile index 82129138..590dc673 100644 --- a/Dockerfile +++ b/Dockerfile @@ -24,7 +24,7 @@ RUN mkdir -p ${DEST_ROOT}/usr/local/bin/ RUN if [ ! -f $CACHITO_ENV_FILE ]; then go mod download ; fi # Build manager -RUN if [ -f $CACHITO_ENV_FILE ] ; then source $CACHITO_ENV_FILE ; fi ; env ${GO_BUILD_EXTRA_ENV_ARGS} go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/manager main.go +RUN if [ -f $CACHITO_ENV_FILE ] ; then source $CACHITO_ENV_FILE ; fi ; env ${GO_BUILD_EXTRA_ENV_ARGS} go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/manager cmd/main.go RUN cp -r templates ${DEST_ROOT}/templates diff --git a/Makefile b/Makefile index 4145a707..55c4e5cc 100644 --- a/Makefile +++ b/Makefile @@ -124,13 +124,13 @@ golangci-lint: .PHONY: test test: manifests generate fmt vet envtest ginkgo ## Run tests. - KUBEBUILDER_ASSETS="$(shell $(ENVTEST) -v debug --bin-dir $(LOCALBIN) use $(ENVTEST_K8S_VERSION) -p path)" OPERATOR_TEMPLATES="$(shell pwd)/templates" $(GINKGO) -v --trace --cover --coverpkg=../../pkg/,../../controllers,../../api/v1beta1 --coverprofile cover.out --covermode=atomic --randomize-all ${PROC_CMD} $(GINKGO_ARGS) ./tests/... + KUBEBUILDER_ASSETS="$(shell $(ENVTEST) -v debug --bin-dir $(LOCALBIN) use $(ENVTEST_K8S_VERSION) -p path)" OPERATOR_TEMPLATES="$(shell pwd)/templates" $(GINKGO) -v --trace --cover --coverpkg=../../internal/...,../../api/v1beta1/... --coverprofile cover.out --covermode=atomic --randomize-all ${PROC_CMD} $(GINKGO_ARGS) ./test/... ##@ Build .PHONY: build build: generate fmt vet ## Build manager binary. - go build -o bin/manager main.go + go build -o bin/manager cmd/main.go .PHONY: run run: export METRICS_PORT?=8080 @@ -140,7 +140,7 @@ run: export ENABLE_WEBHOOKS?=false run: export OPERATOR_TEMPLATES=./templates/ run: manifests generate fmt vet ## Run a controller from your host. /bin/bash hack/clean_local_webhook.sh - go run ./main.go -metrics-bind-address ":$(METRICS_PORT)" -health-probe-bind-address ":$(HEALTH_PORT)" -pprof-bind-address ":$(PPROF_PORT)" + go run ./cmd/main.go -metrics-bind-address ":$(METRICS_PORT)" -health-probe-bind-address ":$(HEALTH_PORT)" -pprof-bind-address ":$(PPROF_PORT)" .PHONY: docker-build docker-build: test ## Build docker image with the manager. @@ -188,9 +188,9 @@ OPERATOR_SDK ?= $(LOCALBIN)/operator-sdk GINKGO ?= $(LOCALBIN)/ginkgo ## Tool Versions -KUSTOMIZE_VERSION ?= v3.8.7 +KUSTOMIZE_VERSION ?= v5.6.0 CONTROLLER_TOOLS_VERSION ?= v0.18.0 -OPERATOR_SDK_VERSION ?= v1.31.0 +OPERATOR_SDK_VERSION ?= v1.41.1 GOTOOLCHAIN_VERSION ?= go1.24.0 KUSTOMIZE_INSTALL_SCRIPT ?= "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh" diff --git a/PROJECT b/PROJECT index b9c6b83a..7894f88d 100644 --- a/PROJECT +++ b/PROJECT @@ -1,6 +1,10 @@ +# Code generated by tool. DO NOT EDIT. +# This file is used to track the info used to scaffold your project +# and allow the plugins properly work. +# More info: https://book.kubebuilder.io/reference/project-config.html domain: openstack.org layout: -- go.kubebuilder.io/v3 +- go.kubebuilder.io/v4 plugins: manifests.sdk.operatorframework.io/v2: {} scorecard.sdk.operatorframework.io/v2: {} diff --git a/api/go.mod b/api/go.mod index 062472e0..8e6d4702 100644 --- a/api/go.mod +++ b/api/go.mod @@ -3,22 +3,17 @@ module github.com/openstack-k8s-operators/designate-operator/api go 1.24.4 require ( - github.com/onsi/ginkgo/v2 v2.27.2 github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20251103072528-9eb684fef4ef github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20251103072528-9eb684fef4ef k8s.io/api v0.31.13 k8s.io/apimachinery v0.31.13 - k8s.io/client-go v0.31.13 + k8s.io/client-go v0.31.13 // indirect sigs.k8s.io/controller-runtime v0.19.7 ) -require ( - github.com/onsi/gomega v1.38.2 - github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20251101153632-7b8179a60945 -) +require github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20251110170511-c2d4a351a7c3 require ( - github.com/Masterminds/semver/v3 v3.4.0 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect @@ -28,18 +23,15 @@ require ( github.com/fsnotify/fsnotify v1.9.0 // indirect github.com/fxamacker/cbor/v2 v2.9.0 // indirect github.com/go-logr/logr v1.4.3 // indirect - github.com/go-logr/zapr v1.3.0 // indirect github.com/go-openapi/jsonpointer v0.21.1 // indirect github.com/go-openapi/jsonreference v0.21.0 // indirect github.com/go-openapi/swag v0.23.1 // indirect - github.com/go-task/slim-sprig/v3 v3.0.0 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect github.com/golang/protobuf v1.5.4 // indirect github.com/google/gnostic-models v0.7.0 // indirect github.com/google/go-cmp v0.7.0 // indirect github.com/google/gofuzz v1.2.0 // indirect - github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect github.com/google/uuid v1.6.0 // indirect github.com/imdario/mergo v0.3.16 // indirect github.com/josharian/intern v1.0.0 // indirect @@ -53,22 +45,18 @@ require ( github.com/prometheus/client_model v0.6.2 // indirect github.com/prometheus/common v0.65.0 // indirect github.com/prometheus/procfs v0.16.1 // indirect + github.com/rogpeppe/go-internal v1.13.1 // indirect github.com/spf13/pflag v1.0.7 // indirect github.com/x448/float16 v0.8.4 // indirect - go.uber.org/multierr v1.11.0 // indirect - go.uber.org/zap v1.27.0 // indirect go.yaml.in/yaml/v2 v2.4.2 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67 // indirect - golang.org/x/mod v0.27.0 // indirect golang.org/x/net v0.43.0 // indirect golang.org/x/oauth2 v0.30.0 // indirect - golang.org/x/sync v0.17.0 // indirect golang.org/x/sys v0.36.0 // indirect golang.org/x/term v0.35.0 // indirect golang.org/x/text v0.29.0 // indirect golang.org/x/time v0.12.0 // indirect - golang.org/x/tools v0.36.0 // indirect gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect google.golang.org/protobuf v1.36.7 // indirect gopkg.in/inf.v0 v0.9.1 // indirect diff --git a/api/go.sum b/api/go.sum index 5bb65e4e..fd5ccf21 100644 --- a/api/go.sum +++ b/api/go.sum @@ -18,12 +18,6 @@ github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0= github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM= github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= -github.com/gkampitakis/ciinfo v0.3.2 h1:JcuOPk8ZU7nZQjdUhctuhQofk7BGHuIy0c9Ez8BNhXs= -github.com/gkampitakis/ciinfo v0.3.2/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo= -github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZdC4M= -github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6OPYerdAAS9tk= -github.com/gkampitakis/go-snaps v0.5.15 h1:amyJrvM1D33cPHwVrjo9jQxX8g/7E2wYdZ+01KS3zGE= -github.com/gkampitakis/go-snaps v0.5.15/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ= @@ -36,8 +30,6 @@ github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZ github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0= github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI= github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8= -github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw= -github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA= github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE= @@ -60,8 +52,6 @@ github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4= github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY= github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY= github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y= -github.com/joshdk/go-junit v1.0.0 h1:S86cUKIdwBHWwA6xCmFlf3RTLfVXYQfvanM5Uh+K6GE= -github.com/joshdk/go-junit v1.0.0/go.mod h1:TiiV0PqkaNfFXjEiyjWM3XXrhVyCa1K4Zfga6W52ung= github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM= github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= @@ -76,10 +66,6 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw= github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4= github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU= -github.com/maruel/natural v1.1.1 h1:Hja7XhhmvEFhcByqDoHz9QZbkWey+COd9xWfCfn1ioo= -github.com/maruel/natural v1.1.1/go.mod h1:v+Rfd79xlw1AgVBjbO0BEQmptqb5HvL/k9GRHB7ZKEg= -github.com/mfridman/tparse v0.18.0 h1:wh6dzOKaIwkUGyKgOntDW4liXSo37qg5AXbIhkMV3vE= -github.com/mfridman/tparse v0.18.0/go.mod h1:gEvqZTuCgEhPbYk/2lS3Kcxg1GmTxxU7kTC8DvP0i/A= github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= @@ -92,8 +78,8 @@ github.com/onsi/ginkgo/v2 v2.27.2 h1:LzwLj0b89qtIy6SSASkzlNvX6WktqurSHwkk2ipF/Ns github.com/onsi/ginkgo/v2 v2.27.2/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo= github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A= github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k= -github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20251101153632-7b8179a60945 h1:KIhwTggQV+vJtezk/FAeHH2nurq+v5b1tSdKI1OqyC4= -github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20251101153632-7b8179a60945/go.mod h1:u2rklI+ckD8yjjFgClqAWMwJXp0Rq7nkmTDinO8T6yg= +github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20251110170511-c2d4a351a7c3 h1:gKazSLpq0Ytn4OLzNtSKQpLswAdki8u8mXZgpJy83bE= +github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20251110170511-c2d4a351a7c3/go.mod h1:Y9LqOS1wYhn7RT4jFknINdWa+ziYEIOU1jLNxkxiCsw= github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20251103072528-9eb684fef4ef h1:1j7kk+D4ZdIXm6C/IwEjuTzIuvWUytxO39E/x94JY7k= github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20251103072528-9eb684fef4ef/go.mod h1:kUT/SyuxZiOcX8ZuvpFN3PaQa2V8uQon8YwY+1RoQWM= github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20251103072528-9eb684fef4ef h1:VMwP0988m1VCjpVn+MxHt7i3B0OuBhQnM5akKt4taVA= @@ -119,14 +105,6 @@ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA= github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= -github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY= -github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk= -github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA= -github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM= -github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4= -github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU= -github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY= -github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28= github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= diff --git a/api/v1beta1/designate_webhook.go b/api/v1beta1/designate_webhook.go index 0fec5098..0557329d 100644 --- a/api/v1beta1/designate_webhook.go +++ b/api/v1beta1/designate_webhook.go @@ -30,7 +30,6 @@ import ( "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/runtime/schema" "k8s.io/apimachinery/pkg/util/validation/field" - ctrl "sigs.k8s.io/controller-runtime" logf "sigs.k8s.io/controller-runtime/pkg/log" "sigs.k8s.io/controller-runtime/pkg/webhook" "sigs.k8s.io/controller-runtime/pkg/webhook/admission" @@ -60,15 +59,6 @@ func SetupDesignateDefaults(defaults DesignateDefaults) { designatelog.Info("Designate defaults initialized", "defaults", defaults) } -// SetupWebhookWithManager sets up the webhook with the Manager -func (r *Designate) SetupWebhookWithManager(mgr ctrl.Manager) error { - return ctrl.NewWebhookManagedBy(mgr). - For(r). - Complete() -} - -//+kubebuilder:webhook:path=/mutate-designate-openstack-org-v1beta1-designate,mutating=true,failurePolicy=fail,sideEffects=None,groups=designate.openstack.org,resources=designates,verbs=create;update,versions=v1beta1,name=mdesignate.kb.io,admissionReviewVersions=v1 - var _ webhook.Defaulter = &Designate{} // Default implements webhook.Defaulter so a webhook will be registered for the type @@ -108,13 +98,11 @@ func (spec *DesignateSpec) Default() { } } +// Default implements defaulting for DesignateSpecCore func (spec *DesignateSpecCore) Default() { // validations go here for the ControlPlane } -// TODO(user): change verbs to "verbs=create;update;delete" if you want to enable deletion validation. -//+kubebuilder:webhook:path=/validate-designate-openstack-org-v1beta1-designate,mutating=false,failurePolicy=fail,sideEffects=None,groups=designate.openstack.org,resources=designates,verbs=create;update,versions=v1beta1,name=vdesignate.kb.io,admissionReviewVersions=v1 - var _ webhook.Validator = &Designate{} // ValidateCreate implements webhook.Validator so a webhook will be registered for the type @@ -152,6 +140,8 @@ func (r *DesignateSpec) ValidateCreate(basePath *field.Path, namespace string) f return allErrs } +// ValidateCreate - Exported function wrapping non-exported validate functions, +// this function can be called externally to validate a designate spec core. func (r *DesignateSpecCore) ValidateCreate(basePath *field.Path, namespace string) field.ErrorList { var allErrs field.ErrorList @@ -204,6 +194,8 @@ func (r *DesignateSpec) ValidateUpdate(old DesignateSpec, basePath *field.Path, return allErrs } +// ValidateUpdate - Exported function wrapping non-exported validate functions, +// this function can be called externally to validate a designate spec core. func (r *DesignateSpecCore) ValidateUpdate(old DesignateSpecCore, basePath *field.Path, namespace string) field.ErrorList { var allErrs field.ErrorList @@ -224,6 +216,7 @@ func (r *Designate) ValidateDelete() (admission.Warnings, error) { return nil, nil } +// GetDefaultRouteAnnotations - Returns the default route annotations for the DesignateSpecCore func (spec *DesignateSpecCore) GetDefaultRouteAnnotations() (annotations map[string]string) { return map[string]string{ "haproxy.router.openshift.io/timeout": fmt.Sprintf("%ds", designateDefaults.DesignateAPIRouteTimeout), diff --git a/api/v1beta1/webhook_suite_test.go b/api/v1beta1/webhook_suite_test.go deleted file mode 100644 index 7e596b62..00000000 --- a/api/v1beta1/webhook_suite_test.go +++ /dev/null @@ -1,141 +0,0 @@ -/* -Copyright 2023. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package v1beta1 - -import ( - "context" - "crypto/tls" - "fmt" - "net" - "path/filepath" - "testing" - "time" - - . "github.com/onsi/ginkgo/v2" - . "github.com/onsi/gomega" - - admissionv1beta1 "k8s.io/api/admission/v1beta1" - //+kubebuilder:scaffold:imports - "k8s.io/apimachinery/pkg/runtime" - "k8s.io/client-go/rest" - ctrl "sigs.k8s.io/controller-runtime" - "sigs.k8s.io/controller-runtime/pkg/client" - "sigs.k8s.io/controller-runtime/pkg/envtest" - logf "sigs.k8s.io/controller-runtime/pkg/log" - "sigs.k8s.io/controller-runtime/pkg/log/zap" - "sigs.k8s.io/controller-runtime/pkg/webhook" - - metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server" -) - -// These tests use Ginkgo (BDD-style Go testing framework). Refer to -// http://onsi.github.io/ginkgo/ to learn more about Ginkgo. - -var ( - cfg *rest.Config - k8sClient client.Client - testEnv *envtest.Environment - ctx context.Context - cancel context.CancelFunc -) - -func TestAPIs(t *testing.T) { - RegisterFailHandler(Fail) - - RunSpecs(t, "Webhook Suite") -} - -var _ = BeforeSuite(func() { - logf.SetLogger(zap.New(zap.WriteTo(GinkgoWriter), zap.UseDevMode(true))) - - ctx, cancel = context.WithCancel(context.TODO()) - - By("bootstrapping test environment") - testEnv = &envtest.Environment{ - CRDDirectoryPaths: []string{filepath.Join("..", "..", "config", "crd", "bases")}, - ErrorIfCRDPathMissing: false, - WebhookInstallOptions: envtest.WebhookInstallOptions{ - Paths: []string{filepath.Join("..", "..", "config", "webhook")}, - }, - } - - var err error - // cfg is defined in this file globally. - cfg, err = testEnv.Start() - Expect(err).NotTo(HaveOccurred()) - Expect(cfg).NotTo(BeNil()) - - scheme := runtime.NewScheme() - err = AddToScheme(scheme) - Expect(err).NotTo(HaveOccurred()) - - err = admissionv1beta1.AddToScheme(scheme) - Expect(err).NotTo(HaveOccurred()) - - //+kubebuilder:scaffold:scheme - - k8sClient, err = client.New(cfg, client.Options{Scheme: scheme}) - Expect(err).NotTo(HaveOccurred()) - Expect(k8sClient).NotTo(BeNil()) - - // start webhook server using Manager - webhookInstallOptions := &testEnv.WebhookInstallOptions - mgr, err := ctrl.NewManager(cfg, ctrl.Options{ - Scheme: scheme, - Metrics: metricsserver.Options{ - BindAddress: "0", - }, - WebhookServer: webhook.NewServer( - webhook.Options{ - Host: webhookInstallOptions.LocalServingHost, - Port: webhookInstallOptions.LocalServingPort, - CertDir: webhookInstallOptions.LocalServingCertDir, - }), - LeaderElection: false, - }) - Expect(err).NotTo(HaveOccurred()) - - err = (&Designate{}).SetupWebhookWithManager(mgr) - Expect(err).NotTo(HaveOccurred()) - - //+kubebuilder:scaffold:webhook - - go func() { - defer GinkgoRecover() - err = mgr.Start(ctx) - Expect(err).NotTo(HaveOccurred()) - }() - - // wait for the webhook server to get ready - dialer := &net.Dialer{Timeout: time.Second} - addrPort := fmt.Sprintf("%s:%d", webhookInstallOptions.LocalServingHost, webhookInstallOptions.LocalServingPort) - Eventually(func() error { - conn, err := tls.DialWithDialer(dialer, "tcp", addrPort, &tls.Config{InsecureSkipVerify: true}) - if err != nil { - return err - } - conn.Close() - return nil - }).Should(Succeed()) -}) - -var _ = AfterSuite(func() { - cancel() - By("tearing down the test environment") - err := testEnv.Stop() - Expect(err).NotTo(HaveOccurred()) -}) diff --git a/cmd/main.go b/cmd/main.go new file mode 100644 index 00000000..122c2620 --- /dev/null +++ b/cmd/main.go @@ -0,0 +1,343 @@ +/* +Copyright 2025. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Package main is the entry point for the designate-operator. +package main + +import ( + "crypto/tls" + "flag" + "os" + "path/filepath" + + // Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.) + // to ensure that exec-entrypoint and run can make use of them. + _ "k8s.io/client-go/plugin/pkg/client/auth" + + "k8s.io/apimachinery/pkg/runtime" + utilruntime "k8s.io/apimachinery/pkg/util/runtime" + clientgoscheme "k8s.io/client-go/kubernetes/scheme" + ctrl "sigs.k8s.io/controller-runtime" + "sigs.k8s.io/controller-runtime/pkg/certwatcher" + "sigs.k8s.io/controller-runtime/pkg/healthz" + "sigs.k8s.io/controller-runtime/pkg/log/zap" + "sigs.k8s.io/controller-runtime/pkg/metrics/filters" + metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server" + "sigs.k8s.io/controller-runtime/pkg/webhook" + + designatev1beta1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" + "github.com/openstack-k8s-operators/designate-operator/internal/controller" + webhookv1beta1 "github.com/openstack-k8s-operators/designate-operator/internal/webhook/v1beta1" + + // +kubebuilder:scaffold:imports + "context" + + networkv1 "github.com/k8snetworkplumbingwg/network-attachment-definition-client/pkg/apis/k8s.cni.cncf.io/v1" + oshiftapi "github.com/openshift/api/operator/v1" + rabbitmqv1 "github.com/openstack-k8s-operators/infra-operator/apis/rabbitmq/v1beta1" + redisv1 "github.com/openstack-k8s-operators/infra-operator/apis/redis/v1beta1" + topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" + keystonev1 "github.com/openstack-k8s-operators/keystone-operator/api/v1beta1" + "github.com/openstack-k8s-operators/lib-common/modules/common/operator" + mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1" + "k8s.io/client-go/kubernetes" + "sigs.k8s.io/controller-runtime/pkg/client/config" +) + +var ( + scheme = runtime.NewScheme() + setupLog = ctrl.Log.WithName("setup") +) + +func init() { + utilruntime.Must(clientgoscheme.AddToScheme(scheme)) + utilruntime.Must(mariadbv1.AddToScheme(scheme)) + utilruntime.Must(keystonev1.AddToScheme(scheme)) + utilruntime.Must(designatev1beta1.AddToScheme(scheme)) + utilruntime.Must(rabbitmqv1.AddToScheme(scheme)) + utilruntime.Must(redisv1.AddToScheme(scheme)) + utilruntime.Must(networkv1.AddToScheme(scheme)) + utilruntime.Must(topologyv1.AddToScheme(scheme)) + utilruntime.Must(oshiftapi.AddToScheme(scheme)) + //+kubebuilder:scaffold:scheme +} + +// nolint:gocyclo +func main() { + var metricsAddr string + var metricsCertPath, metricsCertName, metricsCertKey string + var webhookCertPath, webhookCertName, webhookCertKey string + var enableLeaderElection bool + var probeAddr string + var secureMetrics bool + var enableHTTP2 bool + var tlsOpts []func(*tls.Config) + flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+ + "Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.") + flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.") + flag.BoolVar(&enableLeaderElection, "leader-elect", false, + "Enable leader election for controller manager. "+ + "Enabling this will ensure there is only one active controller manager.") + flag.BoolVar(&secureMetrics, "metrics-secure", true, + "If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.") + flag.StringVar(&webhookCertPath, "webhook-cert-path", "", "The directory that contains the webhook certificate.") + flag.StringVar(&webhookCertName, "webhook-cert-name", "tls.crt", "The name of the webhook certificate file.") + flag.StringVar(&webhookCertKey, "webhook-cert-key", "tls.key", "The name of the webhook key file.") + flag.StringVar(&metricsCertPath, "metrics-cert-path", "", + "The directory that contains the metrics server certificate.") + flag.StringVar(&metricsCertName, "metrics-cert-name", "tls.crt", "The name of the metrics server certificate file.") + flag.StringVar(&metricsCertKey, "metrics-cert-key", "tls.key", "The name of the metrics server key file.") + flag.BoolVar(&enableHTTP2, "enable-http2", false, + "If set, HTTP/2 will be enabled for the metrics and webhook servers") + opts := zap.Options{ + Development: true, + } + opts.BindFlags(flag.CommandLine) + flag.Parse() + + ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts))) + + // if the enable-http2 flag is false (the default), http/2 should be disabled + // due to its vulnerabilities. More specifically, disabling http/2 will + // prevent from being vulnerable to the HTTP/2 Stream Cancellation and + // Rapid Reset CVEs. For more information see: + // - https://github.com/advisories/GHSA-qppj-fm5r-hxr3 + // - https://github.com/advisories/GHSA-4374-p667-p6c8 + disableHTTP2 := func(c *tls.Config) { + setupLog.Info("disabling http/2") + c.NextProtos = []string{"http/1.1"} + } + + if !enableHTTP2 { + tlsOpts = append(tlsOpts, disableHTTP2) + } + + // Create watchers for metrics and webhooks certificates + var metricsCertWatcher, webhookCertWatcher *certwatcher.CertWatcher + + // Initial webhook TLS options + webhookTLSOpts := tlsOpts + + if len(webhookCertPath) > 0 { + setupLog.Info("Initializing webhook certificate watcher using provided certificates", + "webhook-cert-path", webhookCertPath, "webhook-cert-name", webhookCertName, "webhook-cert-key", webhookCertKey) + + var err error + webhookCertWatcher, err = certwatcher.New( + filepath.Join(webhookCertPath, webhookCertName), + filepath.Join(webhookCertPath, webhookCertKey), + ) + if err != nil { + setupLog.Error(err, "Failed to initialize webhook certificate watcher") + os.Exit(1) + } + + webhookTLSOpts = append(webhookTLSOpts, func(config *tls.Config) { + config.GetCertificate = webhookCertWatcher.GetCertificate + }) + } + + webhookServer := webhook.NewServer(webhook.Options{ + TLSOpts: webhookTLSOpts, + }) + + // Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server. + // More info: + // - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.21.0/pkg/metrics/server + // - https://book.kubebuilder.io/reference/metrics.html + metricsServerOptions := metricsserver.Options{ + BindAddress: metricsAddr, + SecureServing: secureMetrics, + TLSOpts: tlsOpts, + } + + if secureMetrics { + // FilterProvider is used to protect the metrics endpoint with authn/authz. + // These configurations ensure that only authorized users and service accounts + // can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info: + // https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.21.0/pkg/metrics/filters#WithAuthenticationAndAuthorization + metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization + } + + // If the certificate is not specified, controller-runtime will automatically + // generate self-signed certificates for the metrics server. While convenient for development and testing, + // this setup is not recommended for production. + // + // TODO(user): If you enable certManager, uncomment the following lines: + // - [METRICS-WITH-CERTS] at config/default/kustomization.yaml to generate and use certificates + // managed by cert-manager for the metrics server. + // - [PROMETHEUS-WITH-CERTS] at config/prometheus/kustomization.yaml for TLS certification. + if len(metricsCertPath) > 0 { + setupLog.Info("Initializing metrics certificate watcher using provided certificates", + "metrics-cert-path", metricsCertPath, "metrics-cert-name", metricsCertName, "metrics-cert-key", metricsCertKey) + + var err error + metricsCertWatcher, err = certwatcher.New( + filepath.Join(metricsCertPath, metricsCertName), + filepath.Join(metricsCertPath, metricsCertKey), + ) + if err != nil { + setupLog.Error(err, "to initialize metrics certificate watcher", "error", err) + os.Exit(1) + } + + metricsServerOptions.TLSOpts = append(metricsServerOptions.TLSOpts, func(config *tls.Config) { + config.GetCertificate = metricsCertWatcher.GetCertificate + }) + } + + // LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily + // when the Manager ends. This requires the binary to immediately end when the + // Manager is stopped, otherwise, this setting is unsafe. Setting this significantly + // speeds up voluntary leader transitions as the new leader don't have to wait + // LeaseDuration time first. + // + // In the default scaffold provided, the program ends immediately after + // the manager stops, so would be fine to enable this option. However, + // if you are doing or is intended to do any operation such as perform cleanups + // after the manager stops then its usage might be unsafe. + // LeaderElectionReleaseOnCancel: true, + options := ctrl.Options{ + Scheme: scheme, + Metrics: metricsServerOptions, + WebhookServer: webhookServer, + HealthProbeBindAddress: probeAddr, + LeaderElection: enableLeaderElection, + LeaderElectionID: "f9497e05.openstack.org", + } + + // apply common openstack operator manager options + err := operator.SetManagerOptions(&options, setupLog) + if err != nil { + setupLog.Error(err, "unable to set manager options") + os.Exit(1) + } + + mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), options) + if err != nil { + setupLog.Error(err, "unable to start manager") + os.Exit(1) + } + + cfg, err := config.GetConfig() + if err != nil { + setupLog.Error(err, "") + os.Exit(1) + } + kclient, err := kubernetes.NewForConfig(cfg) + if err != nil { + setupLog.Error(err, "") + os.Exit(1) + } + if err != nil { + setupLog.Error(err, "unable to start manager") + os.Exit(1) + } + + if err := (&controller.DesignateReconciler{ + Client: mgr.GetClient(), + Scheme: mgr.GetScheme(), + Kclient: kclient, + }).SetupWithManager(context.Background(), mgr); err != nil { + setupLog.Error(err, "unable to create controller", "controller", "Designate") + os.Exit(1) + } + if err := (&controller.DesignateAPIReconciler{ + Client: mgr.GetClient(), + Scheme: mgr.GetScheme(), + Kclient: kclient, + }).SetupWithManager(context.Background(), mgr); err != nil { + setupLog.Error(err, "unable to create controller", "controller", "DesignateAPI") + os.Exit(1) + } + if err := (&controller.DesignateCentralReconciler{ + Client: mgr.GetClient(), + Scheme: mgr.GetScheme(), + Kclient: kclient, + }).SetupWithManager(context.Background(), mgr); err != nil { + setupLog.Error(err, "unable to create controller", "controller", "DesignateCentral") + os.Exit(1) + } + if err := (&controller.DesignateMdnsReconciler{ + Client: mgr.GetClient(), + Scheme: mgr.GetScheme(), + Kclient: kclient, + }).SetupWithManager(context.Background(), mgr); err != nil { + setupLog.Error(err, "unable to create controller", "controller", "DesignateMdns") + os.Exit(1) + } + if err := (&controller.DesignateProducerReconciler{ + Client: mgr.GetClient(), + Scheme: mgr.GetScheme(), + Kclient: kclient, + }).SetupWithManager(context.Background(), mgr); err != nil { + setupLog.Error(err, "unable to create controller", "controller", "DesignateProducer") + os.Exit(1) + } + if err := (&controller.DesignateWorkerReconciler{ + Client: mgr.GetClient(), + Scheme: mgr.GetScheme(), + Kclient: kclient, + }).SetupWithManager(context.Background(), mgr); err != nil { + setupLog.Error(err, "unable to create controller", "controller", "DesignateWorker") + os.Exit(1) + } + + // Acquire environmental defaults and initialize operator defaults with them + designatev1beta1.SetupDefaults() + + // nolint:goconst + checker := healthz.Ping + if os.Getenv("ENABLE_WEBHOOKS") != "false" { + if err := webhookv1beta1.SetupDesignateWebhookWithManager(mgr); err != nil { + setupLog.Error(err, "unable to create webhook", "webhook", "Designate") + os.Exit(1) + } + checker = mgr.GetWebhookServer().StartedChecker() + } + // +kubebuilder:scaffold:builder + + if metricsCertWatcher != nil { + setupLog.Info("Adding metrics certificate watcher to manager") + if err := mgr.Add(metricsCertWatcher); err != nil { + setupLog.Error(err, "unable to add metrics certificate watcher to manager") + os.Exit(1) + } + } + + if webhookCertWatcher != nil { + setupLog.Info("Adding webhook certificate watcher to manager") + if err := mgr.Add(webhookCertWatcher); err != nil { + setupLog.Error(err, "unable to add webhook certificate watcher to manager") + os.Exit(1) + } + } + + if err := mgr.AddHealthzCheck("healthz", checker); err != nil { + setupLog.Error(err, "unable to set up health check") + os.Exit(1) + } + if err := mgr.AddReadyzCheck("readyz", checker); err != nil { + setupLog.Error(err, "unable to set up ready check") + os.Exit(1) + } + + setupLog.Info("starting manager") + if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil { + setupLog.Error(err, "problem running manager") + os.Exit(1) + } +} diff --git a/config/certmanager/certificate-metrics.yaml b/config/certmanager/certificate-metrics.yaml new file mode 100644 index 00000000..e8f70af8 --- /dev/null +++ b/config/certmanager/certificate-metrics.yaml @@ -0,0 +1,20 @@ +# The following manifests contain a self-signed issuer CR and a metrics certificate CR. +# More document can be found at https://docs.cert-manager.io +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: metrics-certs # this name should match the one appeared in kustomizeconfig.yaml + namespace: system +spec: + dnsNames: + # SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize + # replacements in the config/default/kustomization.yaml file. + - SERVICE_NAME.SERVICE_NAMESPACE.svc + - SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local + issuerRef: + kind: Issuer + name: selfsigned-issuer + secretName: metrics-server-cert diff --git a/config/certmanager/certificate-webhook.yaml b/config/certmanager/certificate-webhook.yaml new file mode 100644 index 00000000..f7ec5f77 --- /dev/null +++ b/config/certmanager/certificate-webhook.yaml @@ -0,0 +1,20 @@ +# The following manifests contain a self-signed issuer CR and a certificate CR. +# More document can be found at https://docs.cert-manager.io +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: serving-cert # this name should match the one appeared in kustomizeconfig.yaml + namespace: system +spec: + # SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize + # replacements in the config/default/kustomization.yaml file. + dnsNames: + - SERVICE_NAME.SERVICE_NAMESPACE.svc + - SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local + issuerRef: + kind: Issuer + name: selfsigned-issuer + secretName: webhook-server-cert diff --git a/config/certmanager/certificate.yaml b/config/certmanager/certificate.yaml deleted file mode 100644 index 817c1eb4..00000000 --- a/config/certmanager/certificate.yaml +++ /dev/null @@ -1,39 +0,0 @@ -# The following manifests contain a self-signed issuer CR and a certificate CR. -# More document can be found at https://docs.cert-manager.io -# WARNING: Targets CertManager v1.0. Check https://cert-manager.io/docs/installation/upgrading/ for breaking changes. -apiVersion: cert-manager.io/v1 -kind: Issuer -metadata: - labels: - app.kubernetes.io/name: issuer - app.kubernetes.io/instance: selfsigned-issuer - app.kubernetes.io/component: certificate - app.kubernetes.io/created-by: designate-operator - app.kubernetes.io/part-of: designate-operator - app.kubernetes.io/managed-by: kustomize - name: selfsigned-issuer - namespace: system -spec: - selfSigned: {} ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - labels: - app.kubernetes.io/name: certificate - app.kubernetes.io/instance: serving-cert - app.kubernetes.io/component: certificate - app.kubernetes.io/created-by: designate-operator - app.kubernetes.io/part-of: designate-operator - app.kubernetes.io/managed-by: kustomize - name: serving-cert # this name should match the one appeared in kustomizeconfig.yaml - namespace: system -spec: - # $(SERVICE_NAME) and $(SERVICE_NAMESPACE) will be substituted by kustomize - dnsNames: - - $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc - - $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc.cluster.local - issuerRef: - kind: Issuer - name: selfsigned-issuer - secretName: webhook-server-cert # this secret will not be prefixed, since it's not managed by kustomize diff --git a/config/certmanager/issuer.yaml b/config/certmanager/issuer.yaml new file mode 100644 index 00000000..84ec9566 --- /dev/null +++ b/config/certmanager/issuer.yaml @@ -0,0 +1,13 @@ +# The following manifest contains a self-signed issuer CR. +# More information can be found at https://docs.cert-manager.io +# WARNING: Targets CertManager v1.0. Check https://cert-manager.io/docs/installation/upgrading/ for breaking changes. +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: selfsigned-issuer + namespace: system +spec: + selfSigned: {} diff --git a/config/certmanager/kustomization.yaml b/config/certmanager/kustomization.yaml index bebea5a5..fcb7498e 100644 --- a/config/certmanager/kustomization.yaml +++ b/config/certmanager/kustomization.yaml @@ -1,5 +1,7 @@ resources: -- certificate.yaml +- issuer.yaml +- certificate-webhook.yaml +- certificate-metrics.yaml configurations: - kustomizeconfig.yaml diff --git a/config/certmanager/kustomizeconfig.yaml b/config/certmanager/kustomizeconfig.yaml index e631f777..cf6f89e8 100644 --- a/config/certmanager/kustomizeconfig.yaml +++ b/config/certmanager/kustomizeconfig.yaml @@ -1,4 +1,4 @@ -# This configuration is for teaching kustomize how to update name ref and var substitution +# This configuration is for teaching kustomize how to update name ref substitution nameReference: - kind: Issuer group: cert-manager.io @@ -6,11 +6,3 @@ nameReference: - kind: Certificate group: cert-manager.io path: spec/issuerRef/name - -varReference: -- kind: Certificate - group: cert-manager.io - path: spec/commonName -- kind: Certificate - group: cert-manager.io - path: spec/dnsNames diff --git a/config/crd/kustomization.yaml b/config/crd/kustomization.yaml index 10b9dcbd..af1ed715 100644 --- a/config/crd/kustomization.yaml +++ b/config/crd/kustomization.yaml @@ -2,28 +2,20 @@ # since it depends on service name and namespace that are out of this kustomize package. # It should be run by config/default resources: +- bases/designate.openstack.org_designates.yaml - bases/designate.openstack.org_designateapis.yaml - bases/designate.openstack.org_designatecentrals.yaml -- bases/designate.openstack.org_designates.yaml - bases/designate.openstack.org_designatemdnses.yaml -- bases/designate.openstack.org_designateworkers.yaml - bases/designate.openstack.org_designateproducers.yaml -- bases/designate.openstack.org_designatebackendbind9s.yaml -- bases/designate.openstack.org_designateunbounds.yaml - -#+kubebuilder:scaffold:crdkustomizeresource +- bases/designate.openstack.org_designateworkers.yaml +# +kubebuilder:scaffold:crdkustomizeresource patches: # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix. # patches here are for enabling the conversion webhook for each CRD -#- path: patches/webhook_in_designateapis.yaml -#+kubebuilder:scaffold:crdkustomizewebhookpatch - -# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix. -# patches here are for enabling the CA injection for each CRD -#- path: patches/cainjection_in_designateapis.yaml -#+kubebuilder:scaffold:crdkustomizecainjectionpatch +# +kubebuilder:scaffold:crdkustomizewebhookpatch +# [WEBHOOK] To enable webhook, uncomment the following section # the following config is for teaching kustomize how to do kustomization for CRDs. -configurations: -- kustomizeconfig.yaml +#configurations: +#- kustomizeconfig.yaml diff --git a/config/crd/patches/cainjection_in_designateapis.yaml b/config/crd/patches/cainjection_in_designateapis.yaml deleted file mode 100644 index bfac40f9..00000000 --- a/config/crd/patches/cainjection_in_designateapis.yaml +++ /dev/null @@ -1,7 +0,0 @@ -# The following patch adds a directive for certmanager to inject CA into the CRD -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME) - name: designateapis.designate.openstack.org diff --git a/config/crd/patches/webhook_in_designateapis.yaml b/config/crd/patches/webhook_in_designateapis.yaml deleted file mode 100644 index 91336b32..00000000 --- a/config/crd/patches/webhook_in_designateapis.yaml +++ /dev/null @@ -1,16 +0,0 @@ -# The following patch enables a conversion webhook for the CRD -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: designateapis.designate.openstack.org -spec: - conversion: - strategy: Webhook - webhook: - clientConfig: - service: - namespace: system - name: webhook-service - path: /convert - conversionReviewVersions: - - v1 diff --git a/config/default/cert_metrics_manager_patch.yaml b/config/default/cert_metrics_manager_patch.yaml new file mode 100644 index 00000000..d9750155 --- /dev/null +++ b/config/default/cert_metrics_manager_patch.yaml @@ -0,0 +1,30 @@ +# This patch adds the args, volumes, and ports to allow the manager to use the metrics-server certs. + +# Add the volumeMount for the metrics-server certs +- op: add + path: /spec/template/spec/containers/0/volumeMounts/- + value: + mountPath: /tmp/k8s-metrics-server/metrics-certs + name: metrics-certs + readOnly: true + +# Add the --metrics-cert-path argument for the metrics server +- op: add + path: /spec/template/spec/containers/0/args/- + value: --metrics-cert-path=/tmp/k8s-metrics-server/metrics-certs + +# Add the metrics-server certs volume configuration +- op: add + path: /spec/template/spec/volumes/- + value: + name: metrics-certs + secret: + secretName: metrics-server-cert + optional: false + items: + - key: ca.crt + path: ca.crt + - key: tls.crt + path: tls.crt + - key: tls.key + path: tls.key diff --git a/config/default/kustomization.yaml b/config/default/kustomization.yaml index e446590c..32eee82e 100644 --- a/config/default/kustomization.yaml +++ b/config/default/kustomization.yaml @@ -9,8 +9,10 @@ namespace: designate-operator-system namePrefix: designate-operator- # Labels to add to all resources and selectors. -#commonLabels: -# someName: someValue +#labels: +#- includeSelectors: true +# pairs: +# someName: someValue resources: - ../crd @@ -23,55 +25,212 @@ resources: #- ../certmanager # [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'. #- ../prometheus +# [METRICS] Expose the controller manager metrics service. +- metrics_service.yaml +# [NETWORK POLICY] Protect the /metrics endpoint and Webhook Server with NetworkPolicy. +# Only Pod(s) running a namespace labeled with 'metrics: enabled' will be able to gather the metrics. +# Only CR(s) which requires webhooks and are applied on namespaces labeled with 'webhooks: enabled' will +# be able to communicate with the Webhook Server. +#- ../network-policy +# Uncomment the patches line if you enable Metrics patches: -# Protect the /metrics endpoint by putting it behind auth. -# If you want your controller-manager to expose the /metrics -# endpoint w/o any authn/z, please comment the following line. -- path: manager_auth_proxy_patch.yaml +# Injects our custom images (ENV variable settings) +- path: manager_default_images.yaml +# [METRICS] The following patch will enable the metrics endpoint using HTTPS and the port :8443. +# More info: https://book.kubebuilder.io/reference/metrics +- path: manager_metrics_patch.yaml + target: + kind: Deployment -# Mount the controller config file for loading manager configurations -# through a ComponentConfig type -#- manager_config_patch.yaml +# Uncomment the patches line if you enable Metrics and CertManager +# [METRICS-WITH-CERTS] To enable metrics protected with certManager, uncomment the following line. +# This patch will protect the metrics with certManager self-signed certs. +#- path: cert_metrics_manager_patch.yaml +# target: +# kind: Deployment # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in # crd/kustomization.yaml - path: manager_webhook_patch.yaml + target: + kind: Deployment -# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. -# Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA injection in the admission webhooks. -# 'CERTMANAGER' needs to be enabled to use ca injection -#- path: webhookcainjection_patch.yaml - -# Injects our custom images (ENV variable settings) -- path: manager_default_images.yaml - -# the following config is for teaching kustomize how to do var substitution -vars: # [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix. -#- name: CERTIFICATE_NAMESPACE # namespace of the certificate CR -# objref: -# kind: Certificate -# group: cert-manager.io -# version: v1 -# name: serving-cert # this name should match the one in certificate.yaml -# fieldref: -# fieldpath: metadata.namespace -#- name: CERTIFICATE_NAME -# objref: -# kind: Certificate -# group: cert-manager.io -# version: v1 -# name: serving-cert # this name should match the one in certificate.yaml -#- name: SERVICE_NAMESPACE # namespace of the service -# objref: -# kind: Service -# version: v1 -# name: webhook-service -# fieldref: -# fieldpath: metadata.namespace -#- name: SERVICE_NAME -# objref: -# kind: Service -# version: v1 -# name: webhook-service +# Uncomment the following replacements to add the cert-manager CA injection annotations +#replacements: +# - source: # Uncomment the following block to enable certificates for metrics +# kind: Service +# version: v1 +# name: controller-manager-metrics-service +# fieldPath: metadata.name +# targets: +# - select: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: metrics-certs +# fieldPaths: +# - spec.dnsNames.0 +# - spec.dnsNames.1 +# options: +# delimiter: '.' +# index: 0 +# create: true +# - select: # Uncomment the following to set the Service name for TLS config in Prometheus ServiceMonitor +# kind: ServiceMonitor +# group: monitoring.coreos.com +# version: v1 +# name: controller-manager-metrics-monitor +# fieldPaths: +# - spec.endpoints.0.tlsConfig.serverName +# options: +# delimiter: '.' +# index: 0 +# create: true +# +# - source: +# kind: Service +# version: v1 +# name: controller-manager-metrics-service +# fieldPath: metadata.namespace +# targets: +# - select: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: metrics-certs +# fieldPaths: +# - spec.dnsNames.0 +# - spec.dnsNames.1 +# options: +# delimiter: '.' +# index: 1 +# create: true +# - select: # Uncomment the following to set the Service namespace for TLS in Prometheus ServiceMonitor +# kind: ServiceMonitor +# group: monitoring.coreos.com +# version: v1 +# name: controller-manager-metrics-monitor +# fieldPaths: +# - spec.endpoints.0.tlsConfig.serverName +# options: +# delimiter: '.' +# index: 1 +# create: true +# +# - source: # Uncomment the following block if you have any webhook +# kind: Service +# version: v1 +# name: webhook-service +# fieldPath: .metadata.name # Name of the service +# targets: +# - select: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPaths: +# - .spec.dnsNames.0 +# - .spec.dnsNames.1 +# options: +# delimiter: '.' +# index: 0 +# create: true +# - source: +# kind: Service +# version: v1 +# name: webhook-service +# fieldPath: .metadata.namespace # Namespace of the service +# targets: +# - select: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPaths: +# - .spec.dnsNames.0 +# - .spec.dnsNames.1 +# options: +# delimiter: '.' +# index: 1 +# create: true +# +# - source: # Uncomment the following block if you have a ValidatingWebhook (--programmatic-validation) +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert # This name should match the one in certificate.yaml +# fieldPath: .metadata.namespace # Namespace of the certificate CR +# targets: +# - select: +# kind: ValidatingWebhookConfiguration +# fieldPaths: +# - .metadata.annotations.[cert-manager.io/inject-ca-from] +# options: +# delimiter: '/' +# index: 0 +# create: true +# - source: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPath: .metadata.name +# targets: +# - select: +# kind: ValidatingWebhookConfiguration +# fieldPaths: +# - .metadata.annotations.[cert-manager.io/inject-ca-from] +# options: +# delimiter: '/' +# index: 1 +# create: true +# +# - source: # Uncomment the following block if you have a DefaultingWebhook (--defaulting ) +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPath: .metadata.namespace # Namespace of the certificate CR +# targets: +# - select: +# kind: MutatingWebhookConfiguration +# fieldPaths: +# - .metadata.annotations.[cert-manager.io/inject-ca-from] +# options: +# delimiter: '/' +# index: 0 +# create: true +# - source: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPath: .metadata.name +# targets: +# - select: +# kind: MutatingWebhookConfiguration +# fieldPaths: +# - .metadata.annotations.[cert-manager.io/inject-ca-from] +# options: +# delimiter: '/' +# index: 1 +# create: true +# +# - source: # Uncomment the following block if you have a ConversionWebhook (--conversion) +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPath: .metadata.namespace # Namespace of the certificate CR +# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD. +# +kubebuilder:scaffold:crdkustomizecainjectionns +# - source: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPath: .metadata.name +# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD. +# +kubebuilder:scaffold:crdkustomizecainjectionname diff --git a/config/default/manager_auth_proxy_patch.yaml b/config/default/manager_auth_proxy_patch.yaml deleted file mode 100644 index 0f3d583a..00000000 --- a/config/default/manager_auth_proxy_patch.yaml +++ /dev/null @@ -1,40 +0,0 @@ -# This patch inject a sidecar container which is a HTTP proxy for the -# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews. -apiVersion: apps/v1 -kind: Deployment -metadata: - name: controller-manager - namespace: system -spec: - template: - spec: - containers: - - name: kube-rbac-proxy - securityContext: - allowPrivilegeEscalation: false - # TODO(user): uncomment for common cases that do not require escalating privileges - # capabilities: - # drop: - # - "ALL" - image: quay.io/openstack-k8s-operators/kube-rbac-proxy:v0.16.0 - args: - - "--secure-listen-address=0.0.0.0:8443" - - "--upstream=http://127.0.0.1:8080/" - - "--logtostderr=true" - - "--v=0" - ports: - - containerPort: 8443 - protocol: TCP - name: https - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 5m - memory: 64Mi - - name: manager - args: - - "--health-probe-bind-address=:8081" - - "--metrics-bind-address=127.0.0.1:8080" - - "--leader-elect" diff --git a/config/default/manager_config_patch.yaml b/config/default/manager_config_patch.yaml deleted file mode 100644 index 6c400155..00000000 --- a/config/default/manager_config_patch.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: controller-manager - namespace: system -spec: - template: - spec: - containers: - - name: manager - args: - - "--config=controller_manager_config.yaml" - volumeMounts: - - name: manager-config - mountPath: /controller_manager_config.yaml - subPath: controller_manager_config.yaml - volumes: - - name: manager-config - configMap: - name: manager-config diff --git a/config/default/manager_metrics_patch.yaml b/config/default/manager_metrics_patch.yaml new file mode 100644 index 00000000..2aaef653 --- /dev/null +++ b/config/default/manager_metrics_patch.yaml @@ -0,0 +1,4 @@ +# This patch adds the args to allow exposing the metrics endpoint using HTTPS +- op: add + path: /spec/template/spec/containers/0/args/0 + value: --metrics-bind-address=:8443 diff --git a/config/default/manager_webhook_patch.yaml b/config/default/manager_webhook_patch.yaml index 738de350..963c8a4c 100644 --- a/config/default/manager_webhook_patch.yaml +++ b/config/default/manager_webhook_patch.yaml @@ -1,23 +1,31 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: controller-manager - namespace: system -spec: - template: - spec: - containers: - - name: manager - ports: - - containerPort: 9443 - name: webhook-server - protocol: TCP - volumeMounts: - - mountPath: /tmp/k8s-webhook-server/serving-certs - name: cert - readOnly: true - volumes: - - name: cert - secret: - defaultMode: 420 - secretName: webhook-server-cert +# This patch ensures the webhook certificates are properly mounted in the manager container. +# It configures the necessary arguments, volumes, volume mounts, and container ports. + +# Add the --webhook-cert-path argument for configuring the webhook certificate path +- op: add + path: /spec/template/spec/containers/0/args/- + value: --webhook-cert-path=/tmp/k8s-webhook-server/serving-certs + +# Add the volumeMount for the webhook certificates +- op: add + path: /spec/template/spec/containers/0/volumeMounts/- + value: + mountPath: /tmp/k8s-webhook-server/serving-certs + name: webhook-certs + readOnly: true + +# Add the port configuration for the webhook server +- op: add + path: /spec/template/spec/containers/0/ports/- + value: + containerPort: 9443 + name: webhook-server + protocol: TCP + +# Add the volume configuration for the webhook certificates +- op: add + path: /spec/template/spec/volumes/- + value: + name: webhook-certs + secret: + secretName: webhook-server-cert diff --git a/config/rbac/auth_proxy_service.yaml b/config/default/metrics_service.yaml similarity index 53% rename from config/rbac/auth_proxy_service.yaml rename to config/default/metrics_service.yaml index 5c9b74a1..f2faf624 100644 --- a/config/rbac/auth_proxy_service.yaml +++ b/config/default/metrics_service.yaml @@ -3,6 +3,8 @@ kind: Service metadata: labels: control-plane: controller-manager + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize name: controller-manager-metrics-service namespace: system spec: @@ -10,6 +12,7 @@ spec: - name: https port: 8443 protocol: TCP - targetPort: https + targetPort: 8443 selector: - openstack.org/operator-name: designate + control-plane: controller-manager + app.kubernetes.io/name: designate-operator diff --git a/config/default/webhookcainjection_patch.yaml b/config/default/webhookcainjection_patch.yaml deleted file mode 100644 index 829791f6..00000000 --- a/config/default/webhookcainjection_patch.yaml +++ /dev/null @@ -1,29 +0,0 @@ -# This patch add annotation to admission webhook config and -# the variables $(CERTIFICATE_NAMESPACE) and $(CERTIFICATE_NAME) will be substituted by kustomize. -apiVersion: admissionregistration.k8s.io/v1 -kind: MutatingWebhookConfiguration -metadata: - labels: - app.kubernetes.io/name: mutatingwebhookconfiguration - app.kubernetes.io/instance: mutating-webhook-configuration - app.kubernetes.io/component: webhook - app.kubernetes.io/created-by: designate-operator - app.kubernetes.io/part-of: designate-operator - app.kubernetes.io/managed-by: kustomize - name: mutating-webhook-configuration - annotations: - cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME) ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: - labels: - app.kubernetes.io/name: validatingwebhookconfiguration - app.kubernetes.io/instance: validating-webhook-configuration - app.kubernetes.io/component: webhook - app.kubernetes.io/created-by: designate-operator - app.kubernetes.io/part-of: designate-operator - app.kubernetes.io/managed-by: kustomize - name: validating-webhook-configuration - annotations: - cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME) diff --git a/config/manager/controller_manager_config.yaml b/config/manager/controller_manager_config.yaml deleted file mode 100644 index 65d2957e..00000000 --- a/config/manager/controller_manager_config.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: controller-runtime.sigs.k8s.io/v1alpha1 -kind: ControllerManagerConfig -health: - healthProbeBindAddress: :8081 -metrics: - bindAddress: 127.0.0.1:8080 -webhook: - port: 9443 -leaderElection: - leaderElect: true - resourceName: f9497e05.openstack.org diff --git a/config/manager/kustomization.yaml b/config/manager/kustomization.yaml index 40512a0b..5c5f0b84 100644 --- a/config/manager/kustomization.yaml +++ b/config/manager/kustomization.yaml @@ -1,16 +1,2 @@ resources: - manager.yaml - -generatorOptions: - disableNameSuffixHash: true - -configMapGenerator: -- files: - - controller_manager_config.yaml - name: manager-config -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -images: -- name: controller - newName: quay.io/openstack-k8s-operators/designate-operator - newTag: latest diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml index 9a485042..f83ddc74 100644 --- a/config/manager/manager.yaml +++ b/config/manager/manager.yaml @@ -3,6 +3,8 @@ kind: Namespace metadata: labels: control-plane: controller-manager + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize name: system --- apiVersion: apps/v1 @@ -12,11 +14,13 @@ metadata: namespace: system labels: control-plane: controller-manager - openstack.org/operator-name: designate + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize spec: selector: matchLabels: - openstack.org/operator-name: designate + control-plane: controller-manager + app.kubernetes.io/name: designate-operator replicas: 1 template: metadata: @@ -24,30 +28,49 @@ spec: kubectl.kubernetes.io/default-container: manager labels: control-plane: controller-manager - openstack.org/operator-name: designate + app.kubernetes.io/name: designate-operator spec: + # TODO(user): Uncomment the following code to configure the nodeAffinity expression + # according to the platforms which are supported by your solution. + # It is considered best practice to support multiple architectures. You can + # build your manager image using the makefile target docker-buildx. + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: kubernetes.io/arch + # operator: In + # values: + # - amd64 + # - arm64 + # - ppc64le + # - s390x + # - key: kubernetes.io/os + # operator: In + # values: + # - linux securityContext: + # Projects are configured by default to adhere to the "restricted" Pod Security Standards. + # This ensures that deployments meet the highest security requirements for Kubernetes. + # For more details, see: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted runAsNonRoot: true - # TODO(user): For common cases that do not require escalating privileges - # it is recommended to ensure that all your Pods/Containers are restrictive. - # More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted - # Please uncomment the following code if your project does NOT have to work on old Kubernetes - # versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ). - # seccompProfile: - # type: RuntimeDefault + seccompProfile: + type: RuntimeDefault containers: - command: - /manager args: - - --leader-elect + - --leader-elect + - --health-probe-bind-address=:8081 image: controller:latest name: manager + ports: [] securityContext: allowPrivilegeEscalation: false - # TODO(user): uncomment for common cases that do not require escalating privileges - # capabilities: - # drop: - # - "ALL" + capabilities: + drop: + - "ALL" livenessProbe: httpGet: path: /healthz @@ -65,9 +88,11 @@ spec: resources: limits: cpu: 500m - memory: 256Mi + memory: 128Mi requests: cpu: 10m - memory: 128Mi + memory: 64Mi + volumeMounts: [] + volumes: [] serviceAccountName: controller-manager terminationGracePeriodSeconds: 10 diff --git a/config/manifests/bases/designate-operator.clusterserviceversion.yaml b/config/manifests/bases/designate-operator.clusterserviceversion.yaml index b7c666f2..453e9616 100644 --- a/config/manifests/bases/designate-operator.clusterserviceversion.yaml +++ b/config/manifests/bases/designate-operator.clusterserviceversion.yaml @@ -119,6 +119,7 @@ spec: - name: Designate Operator url: https://github.com/openstack-k8s-operators/designate-operator maturity: alpha + minKubeVersion: 0.0.0 provider: name: Red Hat Inc. url: https://redhat.com/ diff --git a/config/manifests/kustomization.yaml b/config/manifests/kustomization.yaml index 9496feda..95c40fea 100644 --- a/config/manifests/kustomization.yaml +++ b/config/manifests/kustomization.yaml @@ -20,7 +20,8 @@ resources: # # Remove the manager container's "cert" volumeMount, since OLM will create and mount a set of certs. # # Update the indices in this path if adding or removing containers/volumeMounts in the manager's Deployment. # - op: remove -# path: /spec/template/spec/containers/1/volumeMounts/0 + +# path: /spec/template/spec/containers/0/volumeMounts/0 # # Remove the "cert" volume, since OLM will create and mount a set of certs. # # Update the indices in this path if adding or removing volumes in the manager's Deployment. # - op: remove diff --git a/config/network-policy/allow-metrics-traffic.yaml b/config/network-policy/allow-metrics-traffic.yaml new file mode 100644 index 00000000..221e7ee5 --- /dev/null +++ b/config/network-policy/allow-metrics-traffic.yaml @@ -0,0 +1,27 @@ +# This NetworkPolicy allows ingress traffic +# with Pods running on namespaces labeled with 'metrics: enabled'. Only Pods on those +# namespaces are able to gather data from the metrics endpoint. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: allow-metrics-traffic + namespace: system +spec: + podSelector: + matchLabels: + control-plane: controller-manager + app.kubernetes.io/name: designate-operator + policyTypes: + - Ingress + ingress: + # This allows ingress traffic from any namespace with the label metrics: enabled + - from: + - namespaceSelector: + matchLabels: + metrics: enabled # Only from namespaces with this label + ports: + - port: 8443 + protocol: TCP diff --git a/config/network-policy/allow-webhook-traffic.yaml b/config/network-policy/allow-webhook-traffic.yaml new file mode 100644 index 00000000..1d6737f0 --- /dev/null +++ b/config/network-policy/allow-webhook-traffic.yaml @@ -0,0 +1,27 @@ +# This NetworkPolicy allows ingress traffic to your webhook server running +# as part of the controller-manager from specific namespaces and pods. CR(s) which uses webhooks +# will only work when applied in namespaces labeled with 'webhook: enabled' +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: allow-webhook-traffic + namespace: system +spec: + podSelector: + matchLabels: + control-plane: controller-manager + app.kubernetes.io/name: designate-operator + policyTypes: + - Ingress + ingress: + # This allows ingress traffic from any namespace with the label webhook: enabled + - from: + - namespaceSelector: + matchLabels: + webhook: enabled # Only from namespaces with this label + ports: + - port: 443 + protocol: TCP diff --git a/config/network-policy/kustomization.yaml b/config/network-policy/kustomization.yaml new file mode 100644 index 00000000..0872bee1 --- /dev/null +++ b/config/network-policy/kustomization.yaml @@ -0,0 +1,3 @@ +resources: +- allow-webhook-traffic.yaml +- allow-metrics-traffic.yaml diff --git a/config/prometheus/kustomization.yaml b/config/prometheus/kustomization.yaml index ed137168..fdc5481b 100644 --- a/config/prometheus/kustomization.yaml +++ b/config/prometheus/kustomization.yaml @@ -1,2 +1,11 @@ resources: - monitor.yaml + +# [PROMETHEUS-WITH-CERTS] The following patch configures the ServiceMonitor in ../prometheus +# to securely reference certificates created and managed by cert-manager. +# Additionally, ensure that you uncomment the [METRICS WITH CERTMANAGER] patch under config/default/kustomization.yaml +# to mount the "metrics-server-cert" secret in the Manager Deployment. +#patches: +# - path: monitor_tls_patch.yaml +# target: +# kind: ServiceMonitor diff --git a/config/prometheus/monitor.yaml b/config/prometheus/monitor.yaml index 19950682..c576df75 100644 --- a/config/prometheus/monitor.yaml +++ b/config/prometheus/monitor.yaml @@ -1,20 +1,27 @@ - # Prometheus Monitor Service (Metrics) apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: labels: control-plane: controller-manager + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize name: controller-manager-metrics-monitor namespace: system spec: endpoints: - path: /metrics - port: https + port: https # Ensure this is the name of the port that exposes HTTPS metrics scheme: https bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token tlsConfig: + # TODO(user): The option insecureSkipVerify: true is not recommended for production since it disables + # certificate verification, exposing the system to potential man-in-the-middle attacks. + # For production environments, it is recommended to use cert-manager for automatic TLS certificate management. + # To apply this configuration, enable cert-manager and use the patch located at config/prometheus/servicemonitor_tls_patch.yaml, + # which securely references the certificate from the 'metrics-server-cert' secret. insecureSkipVerify: true selector: matchLabels: - openstack.org/operator-name: designate + control-plane: controller-manager + app.kubernetes.io/name: designate-operator diff --git a/config/prometheus/monitor_tls_patch.yaml b/config/prometheus/monitor_tls_patch.yaml new file mode 100644 index 00000000..5bf84ce0 --- /dev/null +++ b/config/prometheus/monitor_tls_patch.yaml @@ -0,0 +1,19 @@ +# Patch for Prometheus ServiceMonitor to enable secure TLS configuration +# using certificates managed by cert-manager +- op: replace + path: /spec/endpoints/0/tlsConfig + value: + # SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize + serverName: SERVICE_NAME.SERVICE_NAMESPACE.svc + insecureSkipVerify: false + ca: + secret: + name: metrics-server-cert + key: ca.crt + cert: + secret: + name: metrics-server-cert + key: tls.crt + keySecret: + name: metrics-server-cert + key: tls.key diff --git a/config/rbac/designate_admin_role.yaml b/config/rbac/designate_admin_role.yaml new file mode 100644 index 00000000..3f84ae3e --- /dev/null +++ b/config/rbac/designate_admin_role.yaml @@ -0,0 +1,27 @@ +# This rule is not used by the project designate-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants full permissions ('*') over designate.openstack.org. +# This role is intended for users authorized to modify roles and bindings within the cluster, +# enabling them to delegate specific permissions to other users or groups as needed. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: designate-admin-role +rules: +- apiGroups: + - designate.openstack.org + resources: + - designates + verbs: + - '*' +- apiGroups: + - designate.openstack.org + resources: + - designates/status + verbs: + - get diff --git a/config/rbac/designate_editor_role.yaml b/config/rbac/designate_editor_role.yaml new file mode 100644 index 00000000..ed81cdfd --- /dev/null +++ b/config/rbac/designate_editor_role.yaml @@ -0,0 +1,33 @@ +# This rule is not used by the project designate-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants permissions to create, update, and delete resources within the designate.openstack.org. +# This role is intended for users who need to manage these resources +# but should not control RBAC or manage permissions for others. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: designate-editor-role +rules: +- apiGroups: + - designate.openstack.org + resources: + - designates + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - designate.openstack.org + resources: + - designates/status + verbs: + - get diff --git a/config/rbac/designate_viewer_role.yaml b/config/rbac/designate_viewer_role.yaml new file mode 100644 index 00000000..f9b3c1bf --- /dev/null +++ b/config/rbac/designate_viewer_role.yaml @@ -0,0 +1,29 @@ +# This rule is not used by the project designate-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants read-only access to designate.openstack.org resources. +# This role is intended for users who need visibility into these resources +# without permissions to modify them. It is ideal for monitoring purposes and limited-access viewing. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: designate-viewer-role +rules: +- apiGroups: + - designate.openstack.org + resources: + - designates + verbs: + - get + - list + - watch +- apiGroups: + - designate.openstack.org + resources: + - designates/status + verbs: + - get diff --git a/config/rbac/designateapi_admin_role.yaml b/config/rbac/designateapi_admin_role.yaml new file mode 100644 index 00000000..761c4f86 --- /dev/null +++ b/config/rbac/designateapi_admin_role.yaml @@ -0,0 +1,27 @@ +# This rule is not used by the project designate-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants full permissions ('*') over designate.openstack.org. +# This role is intended for users authorized to modify roles and bindings within the cluster, +# enabling them to delegate specific permissions to other users or groups as needed. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: designateapi-admin-role +rules: +- apiGroups: + - designate.openstack.org + resources: + - designateapis + verbs: + - '*' +- apiGroups: + - designate.openstack.org + resources: + - designateapis/status + verbs: + - get diff --git a/config/rbac/designateapi_editor_role.yaml b/config/rbac/designateapi_editor_role.yaml index 2dbe8b4a..8d8f9a56 100644 --- a/config/rbac/designateapi_editor_role.yaml +++ b/config/rbac/designateapi_editor_role.yaml @@ -1,7 +1,16 @@ -# permissions for end users to edit designateapis. +# This rule is not used by the project designate-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants permissions to create, update, and delete resources within the designate.openstack.org. +# This role is intended for users who need to manage these resources +# but should not control RBAC or manage permissions for others. + apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize name: designateapi-editor-role rules: - apiGroups: diff --git a/config/rbac/designateapi_viewer_role.yaml b/config/rbac/designateapi_viewer_role.yaml index 45e89a4b..b83f900c 100644 --- a/config/rbac/designateapi_viewer_role.yaml +++ b/config/rbac/designateapi_viewer_role.yaml @@ -1,7 +1,16 @@ -# permissions for end users to view designateapis. +# This rule is not used by the project designate-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants read-only access to designate.openstack.org resources. +# This role is intended for users who need visibility into these resources +# without permissions to modify them. It is ideal for monitoring purposes and limited-access viewing. + apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize name: designateapi-viewer-role rules: - apiGroups: diff --git a/config/rbac/designatecentral_admin_role.yaml b/config/rbac/designatecentral_admin_role.yaml new file mode 100644 index 00000000..eb9f8d7a --- /dev/null +++ b/config/rbac/designatecentral_admin_role.yaml @@ -0,0 +1,27 @@ +# This rule is not used by the project designate-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants full permissions ('*') over designate.openstack.org. +# This role is intended for users authorized to modify roles and bindings within the cluster, +# enabling them to delegate specific permissions to other users or groups as needed. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: designatecentral-admin-role +rules: +- apiGroups: + - designate.openstack.org + resources: + - designatecentrals + verbs: + - '*' +- apiGroups: + - designate.openstack.org + resources: + - designatecentrals/status + verbs: + - get diff --git a/config/rbac/designatecentral_editor_role.yaml b/config/rbac/designatecentral_editor_role.yaml new file mode 100644 index 00000000..7fbbb7ce --- /dev/null +++ b/config/rbac/designatecentral_editor_role.yaml @@ -0,0 +1,33 @@ +# This rule is not used by the project designate-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants permissions to create, update, and delete resources within the designate.openstack.org. +# This role is intended for users who need to manage these resources +# but should not control RBAC or manage permissions for others. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: designatecentral-editor-role +rules: +- apiGroups: + - designate.openstack.org + resources: + - designatecentrals + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - designate.openstack.org + resources: + - designatecentrals/status + verbs: + - get diff --git a/config/rbac/designatecentral_viewer_role.yaml b/config/rbac/designatecentral_viewer_role.yaml new file mode 100644 index 00000000..f2c48a97 --- /dev/null +++ b/config/rbac/designatecentral_viewer_role.yaml @@ -0,0 +1,29 @@ +# This rule is not used by the project designate-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants read-only access to designate.openstack.org resources. +# This role is intended for users who need visibility into these resources +# without permissions to modify them. It is ideal for monitoring purposes and limited-access viewing. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: designatecentral-viewer-role +rules: +- apiGroups: + - designate.openstack.org + resources: + - designatecentrals + verbs: + - get + - list + - watch +- apiGroups: + - designate.openstack.org + resources: + - designatecentrals/status + verbs: + - get diff --git a/config/rbac/designatemdns_admin_role.yaml b/config/rbac/designatemdns_admin_role.yaml new file mode 100644 index 00000000..5fb7bde2 --- /dev/null +++ b/config/rbac/designatemdns_admin_role.yaml @@ -0,0 +1,27 @@ +# This rule is not used by the project designate-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants full permissions ('*') over designate.openstack.org. +# This role is intended for users authorized to modify roles and bindings within the cluster, +# enabling them to delegate specific permissions to other users or groups as needed. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: designatemdns-admin-role +rules: +- apiGroups: + - designate.openstack.org + resources: + - designatemdns + verbs: + - '*' +- apiGroups: + - designate.openstack.org + resources: + - designatemdns/status + verbs: + - get diff --git a/config/rbac/designatemdns_editor_role.yaml b/config/rbac/designatemdns_editor_role.yaml new file mode 100644 index 00000000..e784986d --- /dev/null +++ b/config/rbac/designatemdns_editor_role.yaml @@ -0,0 +1,33 @@ +# This rule is not used by the project designate-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants permissions to create, update, and delete resources within the designate.openstack.org. +# This role is intended for users who need to manage these resources +# but should not control RBAC or manage permissions for others. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: designatemdns-editor-role +rules: +- apiGroups: + - designate.openstack.org + resources: + - designatemdns + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - designate.openstack.org + resources: + - designatemdns/status + verbs: + - get diff --git a/config/rbac/designatemdns_viewer_role.yaml b/config/rbac/designatemdns_viewer_role.yaml new file mode 100644 index 00000000..7ea8635f --- /dev/null +++ b/config/rbac/designatemdns_viewer_role.yaml @@ -0,0 +1,29 @@ +# This rule is not used by the project designate-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants read-only access to designate.openstack.org resources. +# This role is intended for users who need visibility into these resources +# without permissions to modify them. It is ideal for monitoring purposes and limited-access viewing. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: designatemdns-viewer-role +rules: +- apiGroups: + - designate.openstack.org + resources: + - designatemdns + verbs: + - get + - list + - watch +- apiGroups: + - designate.openstack.org + resources: + - designatemdns/status + verbs: + - get diff --git a/config/rbac/designateproducer_admin_role.yaml b/config/rbac/designateproducer_admin_role.yaml new file mode 100644 index 00000000..8523cd04 --- /dev/null +++ b/config/rbac/designateproducer_admin_role.yaml @@ -0,0 +1,27 @@ +# This rule is not used by the project designate-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants full permissions ('*') over designate.openstack.org. +# This role is intended for users authorized to modify roles and bindings within the cluster, +# enabling them to delegate specific permissions to other users or groups as needed. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: designateproducer-admin-role +rules: +- apiGroups: + - designate.openstack.org + resources: + - designateproducers + verbs: + - '*' +- apiGroups: + - designate.openstack.org + resources: + - designateproducers/status + verbs: + - get diff --git a/config/rbac/designateproducer_editor_role.yaml b/config/rbac/designateproducer_editor_role.yaml new file mode 100644 index 00000000..dd112bc2 --- /dev/null +++ b/config/rbac/designateproducer_editor_role.yaml @@ -0,0 +1,33 @@ +# This rule is not used by the project designate-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants permissions to create, update, and delete resources within the designate.openstack.org. +# This role is intended for users who need to manage these resources +# but should not control RBAC or manage permissions for others. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: designateproducer-editor-role +rules: +- apiGroups: + - designate.openstack.org + resources: + - designateproducers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - designate.openstack.org + resources: + - designateproducers/status + verbs: + - get diff --git a/config/rbac/designateproducer_viewer_role.yaml b/config/rbac/designateproducer_viewer_role.yaml new file mode 100644 index 00000000..ff626c10 --- /dev/null +++ b/config/rbac/designateproducer_viewer_role.yaml @@ -0,0 +1,29 @@ +# This rule is not used by the project designate-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants read-only access to designate.openstack.org resources. +# This role is intended for users who need visibility into these resources +# without permissions to modify them. It is ideal for monitoring purposes and limited-access viewing. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: designateproducer-viewer-role +rules: +- apiGroups: + - designate.openstack.org + resources: + - designateproducers + verbs: + - get + - list + - watch +- apiGroups: + - designate.openstack.org + resources: + - designateproducers/status + verbs: + - get diff --git a/config/rbac/designateworker_admin_role.yaml b/config/rbac/designateworker_admin_role.yaml new file mode 100644 index 00000000..a2476d75 --- /dev/null +++ b/config/rbac/designateworker_admin_role.yaml @@ -0,0 +1,27 @@ +# This rule is not used by the project designate-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants full permissions ('*') over designate.openstack.org. +# This role is intended for users authorized to modify roles and bindings within the cluster, +# enabling them to delegate specific permissions to other users or groups as needed. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: designateworker-admin-role +rules: +- apiGroups: + - designate.openstack.org + resources: + - designateworkers + verbs: + - '*' +- apiGroups: + - designate.openstack.org + resources: + - designateworkers/status + verbs: + - get diff --git a/config/rbac/designateworker_editor_role.yaml b/config/rbac/designateworker_editor_role.yaml new file mode 100644 index 00000000..315fc3f4 --- /dev/null +++ b/config/rbac/designateworker_editor_role.yaml @@ -0,0 +1,33 @@ +# This rule is not used by the project designate-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants permissions to create, update, and delete resources within the designate.openstack.org. +# This role is intended for users who need to manage these resources +# but should not control RBAC or manage permissions for others. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: designateworker-editor-role +rules: +- apiGroups: + - designate.openstack.org + resources: + - designateworkers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - designate.openstack.org + resources: + - designateworkers/status + verbs: + - get diff --git a/config/rbac/designateworker_viewer_role.yaml b/config/rbac/designateworker_viewer_role.yaml new file mode 100644 index 00000000..62518d3f --- /dev/null +++ b/config/rbac/designateworker_viewer_role.yaml @@ -0,0 +1,29 @@ +# This rule is not used by the project designate-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants read-only access to designate.openstack.org resources. +# This role is intended for users who need visibility into these resources +# without permissions to modify them. It is ideal for monitoring purposes and limited-access viewing. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize + name: designateworker-viewer-role +rules: +- apiGroups: + - designate.openstack.org + resources: + - designateworkers + verbs: + - get + - list + - watch +- apiGroups: + - designate.openstack.org + resources: + - designateworkers/status + verbs: + - get diff --git a/config/rbac/kustomization.yaml b/config/rbac/kustomization.yaml index 731832a6..18120933 100644 --- a/config/rbac/kustomization.yaml +++ b/config/rbac/kustomization.yaml @@ -9,10 +9,34 @@ resources: - role_binding.yaml - leader_election_role.yaml - leader_election_role_binding.yaml -# Comment the following 4 lines if you want to disable -# the auth proxy (https://github.com/brancz/kube-rbac-proxy) -# which protects your /metrics endpoint. -- auth_proxy_service.yaml -- auth_proxy_role.yaml -- auth_proxy_role_binding.yaml -- auth_proxy_client_clusterrole.yaml +# The following RBAC configurations are used to protect +# the metrics endpoint with authn/authz. These configurations +# ensure that only authorized users and service accounts +# can access the metrics endpoint. Comment the following +# permissions if you want to disable this protection. +# More info: https://book.kubebuilder.io/reference/metrics.html +- metrics_auth_role.yaml +- metrics_auth_role_binding.yaml +- metrics_reader_role.yaml +# For each CRD, "Admin", "Editor" and "Viewer" roles are scaffolded by +# default, aiding admins in cluster management. Those roles are +# not used by the designate-operator itself. You can comment the following lines +# if you do not want those helpers be installed with your Project. +- designateworker_admin_role.yaml +- designateworker_editor_role.yaml +- designateworker_viewer_role.yaml +- designateproducer_admin_role.yaml +- designateproducer_editor_role.yaml +- designateproducer_viewer_role.yaml +- designatemdns_admin_role.yaml +- designatemdns_editor_role.yaml +- designatemdns_viewer_role.yaml +- designatecentral_admin_role.yaml +- designatecentral_editor_role.yaml +- designatecentral_viewer_role.yaml +- designateapi_admin_role.yaml +- designateapi_editor_role.yaml +- designateapi_viewer_role.yaml +- designate_admin_role.yaml +- designate_editor_role.yaml +- designate_viewer_role.yaml diff --git a/config/rbac/leader_election_role.yaml b/config/rbac/leader_election_role.yaml index 4190ec80..6cf25d7d 100644 --- a/config/rbac/leader_election_role.yaml +++ b/config/rbac/leader_election_role.yaml @@ -2,6 +2,9 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize name: leader-election-role rules: - apiGroups: diff --git a/config/rbac/leader_election_role_binding.yaml b/config/rbac/leader_election_role_binding.yaml index 1d1321ed..f4b2d1f1 100644 --- a/config/rbac/leader_election_role_binding.yaml +++ b/config/rbac/leader_election_role_binding.yaml @@ -1,6 +1,9 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize name: leader-election-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/config/rbac/auth_proxy_role.yaml b/config/rbac/metrics_auth_role.yaml similarity index 90% rename from config/rbac/auth_proxy_role.yaml rename to config/rbac/metrics_auth_role.yaml index 80e1857c..32d2e4ec 100644 --- a/config/rbac/auth_proxy_role.yaml +++ b/config/rbac/metrics_auth_role.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: proxy-role + name: metrics-auth-role rules: - apiGroups: - authentication.k8s.io diff --git a/config/rbac/auth_proxy_role_binding.yaml b/config/rbac/metrics_auth_role_binding.yaml similarity index 79% rename from config/rbac/auth_proxy_role_binding.yaml rename to config/rbac/metrics_auth_role_binding.yaml index ec7acc0a..e775d67f 100644 --- a/config/rbac/auth_proxy_role_binding.yaml +++ b/config/rbac/metrics_auth_role_binding.yaml @@ -1,11 +1,11 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: proxy-rolebinding + name: metrics-auth-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: proxy-role + name: metrics-auth-role subjects: - kind: ServiceAccount name: controller-manager diff --git a/config/rbac/auth_proxy_client_clusterrole.yaml b/config/rbac/metrics_reader_role.yaml similarity index 100% rename from config/rbac/auth_proxy_client_clusterrole.yaml rename to config/rbac/metrics_reader_role.yaml diff --git a/config/rbac/role_binding.yaml b/config/rbac/role_binding.yaml index 2070ede4..7586f332 100644 --- a/config/rbac/role_binding.yaml +++ b/config/rbac/role_binding.yaml @@ -1,6 +1,9 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize name: manager-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/config/rbac/service_account.yaml b/config/rbac/service_account.yaml index 7cd6025b..1cd47ad9 100644 --- a/config/rbac/service_account.yaml +++ b/config/rbac/service_account.yaml @@ -1,5 +1,8 @@ apiVersion: v1 kind: ServiceAccount metadata: + labels: + app.kubernetes.io/name: designate-operator + app.kubernetes.io/managed-by: kustomize name: controller-manager namespace: system diff --git a/config/scorecard/kustomization.yaml b/config/scorecard/kustomization.yaml index a9a84a85..54e8aa50 100644 --- a/config/scorecard/kustomization.yaml +++ b/config/scorecard/kustomization.yaml @@ -1,16 +1,18 @@ resources: - bases/config.yaml +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization patches: - path: patches/basic.config.yaml target: group: scorecard.operatorframework.io - version: v1alpha3 kind: Configuration name: config + version: v1alpha3 - path: patches/olm.config.yaml target: group: scorecard.operatorframework.io - version: v1alpha3 kind: Configuration name: config -#+kubebuilder:scaffold:patches + version: v1alpha3 +# +kubebuilder:scaffold:patches diff --git a/config/scorecard/patches/basic.config.yaml b/config/scorecard/patches/basic.config.yaml index 4a6c8167..8237b70d 100644 --- a/config/scorecard/patches/basic.config.yaml +++ b/config/scorecard/patches/basic.config.yaml @@ -4,7 +4,7 @@ entrypoint: - scorecard-test - basic-check-spec - image: quay.io/operator-framework/scorecard-test:v1.22.2 + image: quay.io/operator-framework/scorecard-test:v1.41.1 labels: suite: basic test: basic-check-spec-test diff --git a/config/scorecard/patches/olm.config.yaml b/config/scorecard/patches/olm.config.yaml index c342410a..416660a7 100644 --- a/config/scorecard/patches/olm.config.yaml +++ b/config/scorecard/patches/olm.config.yaml @@ -4,7 +4,7 @@ entrypoint: - scorecard-test - olm-bundle-validation - image: quay.io/operator-framework/scorecard-test:v1.22.2 + image: quay.io/operator-framework/scorecard-test:v1.41.1 labels: suite: olm test: olm-bundle-validation-test @@ -14,7 +14,7 @@ entrypoint: - scorecard-test - olm-crds-have-validation - image: quay.io/operator-framework/scorecard-test:v1.22.2 + image: quay.io/operator-framework/scorecard-test:v1.41.1 labels: suite: olm test: olm-crds-have-validation-test @@ -24,7 +24,7 @@ entrypoint: - scorecard-test - olm-crds-have-resources - image: quay.io/operator-framework/scorecard-test:v1.22.2 + image: quay.io/operator-framework/scorecard-test:v1.41.1 labels: suite: olm test: olm-crds-have-resources-test @@ -34,7 +34,7 @@ entrypoint: - scorecard-test - olm-spec-descriptors - image: quay.io/operator-framework/scorecard-test:v1.22.2 + image: quay.io/operator-framework/scorecard-test:v1.41.1 labels: suite: olm test: olm-spec-descriptors-test @@ -44,7 +44,7 @@ entrypoint: - scorecard-test - olm-status-descriptors - image: quay.io/operator-framework/scorecard-test:v1.22.2 + image: quay.io/operator-framework/scorecard-test:v1.41.1 labels: suite: olm test: olm-status-descriptors-test diff --git a/config/webhook/kustomizeconfig.yaml b/config/webhook/kustomizeconfig.yaml index 25e21e3c..206316e5 100644 --- a/config/webhook/kustomizeconfig.yaml +++ b/config/webhook/kustomizeconfig.yaml @@ -1,4 +1,4 @@ -# the following config is for teaching kustomize where to look at when substituting vars. +# the following config is for teaching kustomize where to look at when substituting nameReference. # It requires kustomize v2.1.0 or newer to work properly. nameReference: - kind: Service @@ -20,6 +20,3 @@ namespace: group: admissionregistration.k8s.io path: webhooks/clientConfig/service/namespace create: true - -varReference: -- path: metadata/annotations diff --git a/config/webhook/manifests.yaml b/config/webhook/manifests.yaml index ad67ac69..b8166abc 100644 --- a/config/webhook/manifests.yaml +++ b/config/webhook/manifests.yaml @@ -12,7 +12,7 @@ webhooks: namespace: system path: /mutate-designate-openstack-org-v1beta1-designate failurePolicy: Fail - name: mdesignate.kb.io + name: mdesignate-v1beta1.kb.io rules: - apiGroups: - designate.openstack.org @@ -38,7 +38,7 @@ webhooks: namespace: system path: /validate-designate-openstack-org-v1beta1-designate failurePolicy: Fail - name: vdesignate.kb.io + name: vdesignate-v1beta1.kb.io rules: - apiGroups: - designate.openstack.org diff --git a/config/webhook/service.yaml b/config/webhook/service.yaml index 2dc5c79d..71984fd2 100644 --- a/config/webhook/service.yaml +++ b/config/webhook/service.yaml @@ -1,13 +1,8 @@ - apiVersion: v1 kind: Service metadata: labels: - app.kubernetes.io/name: service - app.kubernetes.io/instance: webhook-service - app.kubernetes.io/component: webhook - app.kubernetes.io/created-by: designate-operator - app.kubernetes.io/part-of: designate-operator + app.kubernetes.io/name: designate-operator app.kubernetes.io/managed-by: kustomize name: webhook-service namespace: system @@ -17,4 +12,5 @@ spec: protocol: TCP targetPort: 9443 selector: - openstack.org/operator-name: designate + control-plane: controller-manager + app.kubernetes.io/name: designate-operator diff --git a/controllers/suite_test.go b/controllers/suite_test.go deleted file mode 100644 index ac019be4..00000000 --- a/controllers/suite_test.go +++ /dev/null @@ -1,80 +0,0 @@ -/* -Copyright 2022. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package controllers - -import ( - "path/filepath" - "testing" - - . "github.com/onsi/ginkgo/v2" //revive:disable:dot-imports - . "github.com/onsi/gomega" //revive:disable:dot-imports - - "k8s.io/client-go/kubernetes/scheme" - "k8s.io/client-go/rest" - "sigs.k8s.io/controller-runtime/pkg/client" - "sigs.k8s.io/controller-runtime/pkg/envtest" - logf "sigs.k8s.io/controller-runtime/pkg/log" - "sigs.k8s.io/controller-runtime/pkg/log/zap" - - designatev1beta1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" - //+kubebuilder:scaffold:imports -) - -// These tests use Ginkgo (BDD-style Go testing framework). Refer to -// http://onsi.github.io/ginkgo/ to learn more about Ginkgo. - -var cfg *rest.Config -var k8sClient client.Client -var testEnv *envtest.Environment - -func TestAPIs(t *testing.T) { - RegisterFailHandler(Fail) - - RunSpecs(t, "Controller Suite") -} - -var _ = BeforeSuite(func() { - logf.SetLogger(zap.New(zap.WriteTo(GinkgoWriter), zap.UseDevMode(true))) - - By("bootstrapping test environment") - testEnv = &envtest.Environment{ - CRDDirectoryPaths: []string{filepath.Join("..", "config", "crd", "bases")}, - ErrorIfCRDPathMissing: true, - } - - var err error - // cfg is defined in this file globally. - cfg, err = testEnv.Start() - Expect(err).NotTo(HaveOccurred()) - Expect(cfg).NotTo(BeNil()) - - err = designatev1beta1.AddToScheme(scheme.Scheme) - Expect(err).NotTo(HaveOccurred()) - - //+kubebuilder:scaffold:scheme - - k8sClient, err = client.New(cfg, client.Options{Scheme: scheme.Scheme}) - Expect(err).NotTo(HaveOccurred()) - Expect(k8sClient).NotTo(BeNil()) - -}) - -var _ = AfterSuite(func() { - By("tearing down the test environment") - err := testEnv.Stop() - Expect(err).NotTo(HaveOccurred()) -}) diff --git a/go.mod b/go.mod index 34513234..3222ed95 100644 --- a/go.mod +++ b/go.mod @@ -12,7 +12,7 @@ require ( github.com/onsi/gomega v1.38.2 github.com/openshift/api v3.9.0+incompatible github.com/openstack-k8s-operators/designate-operator/api v0.1.1-0.20240807132522-6c2eca7c6bbb - github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20251101153632-7b8179a60945 + github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20251110170511-c2d4a351a7c3 github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20251027074845-ed8154b20ad1 github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20251103072528-9eb684fef4ef github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20251103072528-9eb684fef4ef @@ -27,14 +27,20 @@ require ( require ( github.com/Masterminds/semver/v3 v3.4.0 // indirect + github.com/antlr4-go/antlr/v4 v4.13.0 // indirect + github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect github.com/beorn7/perks v1.0.1 // indirect + github.com/blang/semver/v4 v4.0.0 // indirect + github.com/cenkalti/backoff/v4 v4.3.0 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/emicklei/go-restful/v3 v3.12.2 // indirect github.com/evanphx/json-patch/v5 v5.9.11 // indirect + github.com/felixge/httpsnoop v1.0.4 // indirect github.com/fsnotify/fsnotify v1.9.0 // indirect github.com/fxamacker/cbor/v2 v2.9.0 // indirect github.com/gabriel-vasile/mimetype v1.4.10 // indirect + github.com/go-logr/stdr v1.2.2 // indirect github.com/go-logr/zapr v1.3.0 // indirect github.com/go-openapi/jsonpointer v0.21.1 // indirect github.com/go-openapi/jsonreference v0.21.0 // indirect @@ -45,11 +51,14 @@ require ( github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect github.com/golang/protobuf v1.5.4 // indirect + github.com/google/cel-go v0.20.1 // indirect github.com/google/gnostic-models v0.7.0 // indirect github.com/google/go-cmp v0.7.0 // indirect github.com/google/gofuzz v1.2.0 // indirect github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect + github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 // indirect github.com/imdario/mergo v0.3.16 // indirect + github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/josharian/intern v1.0.0 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/leodido/go-urn v1.4.0 // indirect @@ -57,7 +66,7 @@ require ( github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect - github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20251021145236-2b84ec9fd9bb // indirect + github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20251103072528-9eb684fef4ef // indirect github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20251103072528-9eb684fef4ef // indirect github.com/pkg/errors v0.9.1 // indirect github.com/prometheus/client_golang v1.22.0 // indirect @@ -65,8 +74,19 @@ require ( github.com/prometheus/common v0.65.0 // indirect github.com/prometheus/procfs v0.16.1 // indirect github.com/rabbitmq/cluster-operator/v2 v2.16.0 // indirect + github.com/spf13/cobra v1.9.1 // indirect github.com/spf13/pflag v1.0.7 // indirect + github.com/stoewer/go-strcase v1.2.0 // indirect github.com/x448/float16 v0.8.4 // indirect + go.opentelemetry.io/auto/sdk v1.1.0 // indirect + go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect + go.opentelemetry.io/otel v1.34.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 // indirect + go.opentelemetry.io/otel/metric v1.34.0 // indirect + go.opentelemetry.io/otel/sdk v1.34.0 // indirect + go.opentelemetry.io/otel/trace v1.34.0 // indirect + go.opentelemetry.io/proto/otlp v1.3.1 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.27.0 // indirect go.yaml.in/yaml/v2 v2.4.2 // indirect @@ -83,13 +103,19 @@ require ( golang.org/x/time v0.12.0 // indirect golang.org/x/tools v0.36.0 // indirect gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f // indirect + google.golang.org/grpc v1.71.1 // indirect google.golang.org/protobuf v1.36.7 // indirect gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect k8s.io/apiextensions-apiserver v0.33.2 // indirect + k8s.io/apiserver v0.33.2 // indirect + k8s.io/component-base v0.33.2 // indirect k8s.io/klog/v2 v2.130.1 // indirect k8s.io/kube-openapi v0.0.0-20250902184714-7fc278399c7f // indirect + sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3 // indirect sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect sigs.k8s.io/randfill v1.0.0 // indirect sigs.k8s.io/structured-merge-diff/v4 v4.7.0 // indirect diff --git a/go.sum b/go.sum index cf68e8fc..0ea6b1f1 100644 --- a/go.sum +++ b/go.sum @@ -1,9 +1,18 @@ github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0= github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= +github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI= +github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g= +github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so= +github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= +github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM= +github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ= +github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8= +github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= +github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= @@ -14,6 +23,8 @@ github.com/evanphx/json-patch v5.9.11+incompatible h1:ixHHqfcGvxhWkniF1tWxBHA0yb github.com/evanphx/json-patch v5.9.11+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk= github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU= github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM= +github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= +github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k= github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0= github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM= @@ -26,8 +37,11 @@ github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZ github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6OPYerdAAS9tk= github.com/gkampitakis/go-snaps v0.5.15 h1:amyJrvM1D33cPHwVrjo9jQxX8g/7E2wYdZ+01KS3zGE= github.com/gkampitakis/go-snaps v0.5.15/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc= +github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= +github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ= github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg= github.com/go-openapi/jsonpointer v0.21.1 h1:whnzv/pNXtK2FbX/W9yJfRmE2gsmkfahjMKB0fZvcic= @@ -54,6 +68,8 @@ github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= +github.com/google/cel-go v0.20.1 h1:nDx9r8S3L4pE61eDdt8igGj8rf5kjYR3ILxWIpWNi84= +github.com/google/cel-go v0.20.1/go.mod h1:kWcIzTsPX0zmQ+H3TirHstLLf9ep5QTsZBN9u4dOYLg= github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo= github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ= github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= @@ -68,8 +84,12 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/gophercloud/gophercloud/v2 v2.8.0 h1:of2+8tT6+FbEYHfYC8GBu8TXJNsXYSNm9KuvpX7Neqo= github.com/gophercloud/gophercloud/v2 v2.8.0/go.mod h1:Ki/ILhYZr/5EPebrPL9Ej+tUg4lqx71/YH2JWVeU+Qk= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 h1:bkypFPDjIYGfCYD5mRBvpqxfYX1YCS1PXdKYWi8FsN0= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0/go.mod h1:P+Lt/0by1T8bfcF3z737NnSbmxQAppXMRziHUxPOC8k= github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4= github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY= +github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= +github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY= github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y= github.com/joshdk/go-junit v1.0.0 h1:S86cUKIdwBHWwA6xCmFlf3RTLfVXYQfvanM5Uh+K6GE= @@ -110,14 +130,14 @@ github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A= github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k= github.com/openshift/api v0.0.0-20250711200046-c86d80652a9e h1:E1OdwSpqWuDPCedyUt0GEdoAE+r5TXy7YS21yNEo+2U= github.com/openshift/api v0.0.0-20250711200046-c86d80652a9e/go.mod h1:Shkl4HanLwDiiBzakv+con/aMGnVE2MAGvoKp5oyYUo= -github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20251101153632-7b8179a60945 h1:KIhwTggQV+vJtezk/FAeHH2nurq+v5b1tSdKI1OqyC4= -github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20251101153632-7b8179a60945/go.mod h1:u2rklI+ckD8yjjFgClqAWMwJXp0Rq7nkmTDinO8T6yg= +github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20251110170511-c2d4a351a7c3 h1:gKazSLpq0Ytn4OLzNtSKQpLswAdki8u8mXZgpJy83bE= +github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20251110170511-c2d4a351a7c3/go.mod h1:Y9LqOS1wYhn7RT4jFknINdWa+ziYEIOU1jLNxkxiCsw= github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20251027074845-ed8154b20ad1 h1:QohvX44nxoV2GwvvOURGXYyDuCn4SCrnwubTKJtzehY= github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20251027074845-ed8154b20ad1/go.mod h1:FMFoO4MjEQ85JpdLtDHxYSZxvJ9KzHua+HdKhpl0KRI= github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20251103072528-9eb684fef4ef h1:1j7kk+D4ZdIXm6C/IwEjuTzIuvWUytxO39E/x94JY7k= github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20251103072528-9eb684fef4ef/go.mod h1:kUT/SyuxZiOcX8ZuvpFN3PaQa2V8uQon8YwY+1RoQWM= -github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20251021145236-2b84ec9fd9bb h1:wToXqX7AS1JV3Kna7RcJfkRart8rSGun2biKNfyY6Zg= -github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20251021145236-2b84ec9fd9bb/go.mod h1:yf13jWb60XV26eA7A8o86ZCXNWBLNK9dPkTSWFaTPCw= +github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20251103072528-9eb684fef4ef h1:Ql4G7sRHpqWFGwXypN7MorDGUWv4jz5n34ayzVt3R9E= +github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20251103072528-9eb684fef4ef/go.mod h1:yf13jWb60XV26eA7A8o86ZCXNWBLNK9dPkTSWFaTPCw= github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20251103072528-9eb684fef4ef h1:VMwP0988m1VCjpVn+MxHt7i3B0OuBhQnM5akKt4taVA= github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20251103072528-9eb684fef4ef/go.mod h1:jl+SNs7K7XBx5jVbUJwWV0NRDfM8LyeV4AsGAroP8XA= github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20251103072528-9eb684fef4ef h1:U9cgXJs/GuO6/0bRn6oaS7ovDrabyGPZpmZyAWksUuQ= @@ -141,10 +161,17 @@ github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzM github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is= github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII= github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o= +github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= +github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo= +github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0= +github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M= github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/stoewer/go-strcase v1.2.0 h1:Z2iHWqGXH00XYgqDmNgQbIBxf3wrNq0F3feEy0ainaU= +github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= +github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA= github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY= @@ -159,6 +186,26 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= +go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA= +go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 h1:yd02MEjBdJkG3uabWP9apV+OuWRIXGDuJEUJbOHmCFU= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0/go.mod h1:umTcuxiv1n/s/S6/c2AT/g2CQ7u5C59sHDNmfSwgz7Q= +go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY= +go.opentelemetry.io/otel v1.34.0/go.mod h1:OWFPOQ+h4G8xpyjgqo4SxJYdDQ/qmRH+wivy7zzx9oI= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 h1:3Q/xZUyC1BBkualc9ROb4G8qkH90LXEIICcs5zv1OYY= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0/go.mod h1:s75jGIWA9OfCMzF0xr+ZgfrB5FEbbV7UuYo32ahUiFI= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 h1:qFffATk0X+HD+f1Z8lswGiOQYKHRlzfmdJm0wEaVrFA= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0/go.mod h1:MOiCmryaYtc+V0Ei+Tx9o5S1ZjA7kzLucuVuyzBZloQ= +go.opentelemetry.io/otel/metric v1.34.0 h1:+eTR3U0MyfWjRDhmFMxe2SsW64QrZ84AOhvqS7Y+PoQ= +go.opentelemetry.io/otel/metric v1.34.0/go.mod h1:CEDrp0fy2D0MvkXE+dPV7cMi8tWZwX3dmaIhwPOaqHE= +go.opentelemetry.io/otel/sdk v1.34.0 h1:95zS4k/2GOy069d321O8jWgYsW3MzVV+KuSPKp7Wr1A= +go.opentelemetry.io/otel/sdk v1.34.0/go.mod h1:0e/pNiaMAqaykJGKbi+tSjWfNNHMTxoC9qANsCzbyxU= +go.opentelemetry.io/otel/sdk/metric v1.34.0 h1:5CeK9ujjbFVL5c1PhLuStg1wxA7vQv7ce1EK0Gyvahk= +go.opentelemetry.io/otel/sdk/metric v1.34.0/go.mod h1:jQ/r8Ze28zRKoNRdkjCZxfs6YvBTG1+YIqyFVFYec5w= +go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC8mh/k= +go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE= +go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0= +go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= @@ -218,6 +265,12 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gomodules.xyz/jsonpatch/v2 v2.5.0 h1:JELs8RLM12qJGXU4u/TO3V25KW8GreMKl9pdkk14RM0= gomodules.xyz/jsonpatch/v2 v2.5.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY= +google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422 h1:GVIKPyP/kLIyVOgOnTwFOrvQaQUzOzGMCxgFUOEmm24= +google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422/go.mod h1:b6h1vNKhxaSoEI+5jc3PJUCustfli/mRab7295pY7rw= +google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f h1:OxYkA3wjPsZyBylwymxSHa7ViiW1Sml4ToBrncvFehI= +google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f/go.mod h1:+2Yz8+CLJbIfL9z73EW45avw8Lmge3xVElCP9zEKi50= +google.golang.org/grpc v1.71.1 h1:ffsFWr7ygTUscGPI0KKK6TLrGz0476KUvvsbqWK0rPI= +google.golang.org/grpc v1.71.1/go.mod h1:H0GRtasmQOh9LkFoCPDu3ZrwUtD1YGE+b2vYBYd/8Ec= google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A= google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= @@ -227,6 +280,7 @@ gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSP gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M= gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc= gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw= +gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= @@ -237,14 +291,20 @@ k8s.io/apiextensions-apiserver v0.31.13 h1:8xtWKVpV/YbYX0UX2k6w+cgxfxKhX0UNGuo/V k8s.io/apiextensions-apiserver v0.31.13/go.mod h1:zxpMLWXBxnJqKUIruJ+ulP+Xlfe5lPZPxq1z0cLwA2U= k8s.io/apimachinery v0.31.13 h1:rkG0EiBkBkEzURo/8dKGx/oBF202Z2LqHuSD8Cm3bG4= k8s.io/apimachinery v0.31.13/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo= +k8s.io/apiserver v0.31.13 h1:Ke9/X2m3vHSgsminpAbUxULDNMbvAfjrRX73Gqx6CZc= +k8s.io/apiserver v0.31.13/go.mod h1:5nBPhL2g7am/CS+/OI5A6+olEbo0C7tQ8QNDODLd+WY= k8s.io/client-go v0.31.13 h1:Q0LG51uFbzNd9fzIj5ilA0Sm1wUholHvDaNwVKzqdCA= k8s.io/client-go v0.31.13/go.mod h1:UB4yTzQeRAv+vULOKp2jdqA5LSwV55bvc3RQ5tM48LM= +k8s.io/component-base v0.31.13 h1:/uVLq7yHk9azReqeCFAZSr/8NXydzpz7yDZ6p/yiwBQ= +k8s.io/component-base v0.31.13/go.mod h1:uMXtKNyDqeNdZYL6SRCr9wB6FutL9pOlQmkK2dRVAKQ= k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk= k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE= k8s.io/kube-openapi v0.0.0-20250627150254-e9823e99808e h1:UGI9rv1A2cV87NhXr4s+AUBxIuoo/SME/IyJ3b6KztE= k8s.io/kube-openapi v0.0.0-20250627150254-e9823e99808e/go.mod h1:GLOk5B+hDbRROvt0X2+hqX64v/zO3vXN7J78OUmBSKw= k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d h1:wAhiDyZ4Tdtt7e46e9M5ZSAJ/MnPGPs+Ki1gHw4w1R0= k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= +sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3 h1:2770sDpzrjjsAtVhSeUFseziht227YAWYHLGNM8QPwY= +sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw= sigs.k8s.io/controller-runtime v0.19.7 h1:DLABZfMr20A+AwCZOHhcbcu+TqBXnJZaVBri9K3EO48= sigs.k8s.io/controller-runtime v0.19.7/go.mod h1:iRmWllt8IlaLjvTTDLhRBXIEtkCK6hwVBJJsYS9Ajf4= sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE= diff --git a/controllers/designate_common.go b/internal/controller/designate_common.go similarity index 95% rename from controllers/designate_common.go rename to internal/controller/designate_common.go index 133c6244..76c8e18b 100644 --- a/controllers/designate_common.go +++ b/internal/controller/designate_common.go @@ -11,8 +11,8 @@ See the License for the specific language governing permissions and limitations under the License. */ -// Package controllers implements the designate-operator Kubernetes controllers. -package controllers +// Package controller implements the designate-operator Kubernetes controllers. +package controller import ( "context" diff --git a/controllers/designate_controller.go b/internal/controller/designate_controller.go similarity index 99% rename from controllers/designate_controller.go rename to internal/controller/designate_controller.go index 03e922d9..46381758 100644 --- a/controllers/designate_controller.go +++ b/internal/controller/designate_controller.go @@ -14,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package controllers +package controller import ( "context" @@ -36,7 +36,7 @@ import ( "github.com/go-logr/logr" designatev1beta1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" - "github.com/openstack-k8s-operators/designate-operator/pkg/designate" + "github.com/openstack-k8s-operators/designate-operator/internal/designate" rabbitmqv1 "github.com/openstack-k8s-operators/infra-operator/apis/rabbitmq/v1beta1" redisv1 "github.com/openstack-k8s-operators/infra-operator/apis/redis/v1beta1" "github.com/openstack-k8s-operators/lib-common/modules/common" diff --git a/controllers/designateapi_controller.go b/internal/controller/designateapi_controller.go similarity index 99% rename from controllers/designateapi_controller.go rename to internal/controller/designateapi_controller.go index 249eedf6..5f3dc085 100644 --- a/controllers/designateapi_controller.go +++ b/internal/controller/designateapi_controller.go @@ -15,7 +15,7 @@ limitations under the License. */ // FIXME(dkehn): Adjust this file. -package controllers +package controller import ( "context" @@ -42,8 +42,8 @@ import ( "github.com/go-logr/logr" networkv1 "github.com/k8snetworkplumbingwg/network-attachment-definition-client/pkg/apis/k8s.cni.cncf.io/v1" designatev1beta1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" - "github.com/openstack-k8s-operators/designate-operator/pkg/designate" - designateapi "github.com/openstack-k8s-operators/designate-operator/pkg/designateapi" + "github.com/openstack-k8s-operators/designate-operator/internal/designate" + designateapi "github.com/openstack-k8s-operators/designate-operator/internal/designateapi" topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" keystonev1 "github.com/openstack-k8s-operators/keystone-operator/api/v1beta1" "github.com/openstack-k8s-operators/lib-common/modules/common" diff --git a/controllers/designatebackendbind9_controller.go b/internal/controller/designatebackendbind9_controller.go similarity index 99% rename from controllers/designatebackendbind9_controller.go rename to internal/controller/designatebackendbind9_controller.go index 696d60ab..71cbc153 100644 --- a/controllers/designatebackendbind9_controller.go +++ b/internal/controller/designatebackendbind9_controller.go @@ -13,7 +13,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package controllers +package controller import ( "context" @@ -39,8 +39,8 @@ import ( "github.com/go-logr/logr" networkv1 "github.com/k8snetworkplumbingwg/network-attachment-definition-client/pkg/apis/k8s.cni.cncf.io/v1" designatev1beta1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" - "github.com/openstack-k8s-operators/designate-operator/pkg/designate" - designatebackendbind9 "github.com/openstack-k8s-operators/designate-operator/pkg/designatebackendbind9" + "github.com/openstack-k8s-operators/designate-operator/internal/designate" + designatebackendbind9 "github.com/openstack-k8s-operators/designate-operator/internal/designatebackendbind9" topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" "github.com/openstack-k8s-operators/lib-common/modules/common" "github.com/openstack-k8s-operators/lib-common/modules/common/condition" diff --git a/controllers/designatecentral_controller.go b/internal/controller/designatecentral_controller.go similarity index 99% rename from controllers/designatecentral_controller.go rename to internal/controller/designatecentral_controller.go index ad8ea90b..6ec1c37e 100644 --- a/controllers/designatecentral_controller.go +++ b/internal/controller/designatecentral_controller.go @@ -14,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package controllers +package controller import ( "context" @@ -39,8 +39,8 @@ import ( "github.com/go-logr/logr" designatev1beta1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" - "github.com/openstack-k8s-operators/designate-operator/pkg/designate" - designatecentral "github.com/openstack-k8s-operators/designate-operator/pkg/designatecentral" + "github.com/openstack-k8s-operators/designate-operator/internal/designate" + designatecentral "github.com/openstack-k8s-operators/designate-operator/internal/designatecentral" topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" "github.com/openstack-k8s-operators/lib-common/modules/common" "github.com/openstack-k8s-operators/lib-common/modules/common/condition" diff --git a/controllers/designatemdns_controller.go b/internal/controller/designatemdns_controller.go similarity index 99% rename from controllers/designatemdns_controller.go rename to internal/controller/designatemdns_controller.go index 2693f82a..cf904c05 100644 --- a/controllers/designatemdns_controller.go +++ b/internal/controller/designatemdns_controller.go @@ -14,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package controllers +package controller import ( "context" @@ -40,8 +40,8 @@ import ( "github.com/go-logr/logr" networkv1 "github.com/k8snetworkplumbingwg/network-attachment-definition-client/pkg/apis/k8s.cni.cncf.io/v1" designatev1beta1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" - "github.com/openstack-k8s-operators/designate-operator/pkg/designate" - designatemdns "github.com/openstack-k8s-operators/designate-operator/pkg/designatemdns" + "github.com/openstack-k8s-operators/designate-operator/internal/designate" + designatemdns "github.com/openstack-k8s-operators/designate-operator/internal/designatemdns" topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" "github.com/openstack-k8s-operators/lib-common/modules/common" "github.com/openstack-k8s-operators/lib-common/modules/common/condition" diff --git a/controllers/designateproducer_controller.go b/internal/controller/designateproducer_controller.go similarity index 99% rename from controllers/designateproducer_controller.go rename to internal/controller/designateproducer_controller.go index 514f20a5..7c060e53 100644 --- a/controllers/designateproducer_controller.go +++ b/internal/controller/designateproducer_controller.go @@ -14,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package controllers +package controller import ( "context" @@ -24,8 +24,8 @@ import ( "github.com/go-logr/logr" networkv1 "github.com/k8snetworkplumbingwg/network-attachment-definition-client/pkg/apis/k8s.cni.cncf.io/v1" designatev1beta1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" - "github.com/openstack-k8s-operators/designate-operator/pkg/designate" - designateproducer "github.com/openstack-k8s-operators/designate-operator/pkg/designateproducer" + "github.com/openstack-k8s-operators/designate-operator/internal/designate" + designateproducer "github.com/openstack-k8s-operators/designate-operator/internal/designateproducer" topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" "github.com/openstack-k8s-operators/lib-common/modules/common" "github.com/openstack-k8s-operators/lib-common/modules/common/condition" diff --git a/controllers/designateunbound_controller.go b/internal/controller/designateunbound_controller.go similarity index 99% rename from controllers/designateunbound_controller.go rename to internal/controller/designateunbound_controller.go index 46812a41..ec84798b 100644 --- a/controllers/designateunbound_controller.go +++ b/internal/controller/designateunbound_controller.go @@ -14,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package controllers +package controller import ( "context" @@ -26,8 +26,8 @@ import ( networkv1 "github.com/k8snetworkplumbingwg/network-attachment-definition-client/pkg/apis/k8s.cni.cncf.io/v1" operatorv1 "github.com/openshift/api/operator/v1" designatev1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" - "github.com/openstack-k8s-operators/designate-operator/pkg/designate" - "github.com/openstack-k8s-operators/designate-operator/pkg/designateunbound" + "github.com/openstack-k8s-operators/designate-operator/internal/designate" + "github.com/openstack-k8s-operators/designate-operator/internal/designateunbound" topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" appsv1 "k8s.io/api/apps/v1" corev1 "k8s.io/api/core/v1" diff --git a/controllers/designateunbound_controller_test.go b/internal/controller/designateunbound_controller_test.go similarity index 98% rename from controllers/designateunbound_controller_test.go rename to internal/controller/designateunbound_controller_test.go index b9b6545c..6429c94f 100644 --- a/controllers/designateunbound_controller_test.go +++ b/internal/controller/designateunbound_controller_test.go @@ -14,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package controllers +package controller import ( "context" @@ -23,7 +23,7 @@ import ( networkv1 "github.com/k8snetworkplumbingwg/network-attachment-definition-client/pkg/apis/k8s.cni.cncf.io/v1" operatorv1 "github.com/openshift/api/operator/v1" - "github.com/openstack-k8s-operators/designate-operator/pkg/designateunbound" + "github.com/openstack-k8s-operators/designate-operator/internal/designateunbound" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/runtime" "sigs.k8s.io/controller-runtime/pkg/client" diff --git a/controllers/designateworker_controller.go b/internal/controller/designateworker_controller.go similarity index 99% rename from controllers/designateworker_controller.go rename to internal/controller/designateworker_controller.go index c3c98cdd..c4623247 100644 --- a/controllers/designateworker_controller.go +++ b/internal/controller/designateworker_controller.go @@ -14,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package controllers +package controller import ( "context" @@ -40,8 +40,8 @@ import ( "github.com/go-logr/logr" networkv1 "github.com/k8snetworkplumbingwg/network-attachment-definition-client/pkg/apis/k8s.cni.cncf.io/v1" designatev1beta1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" - "github.com/openstack-k8s-operators/designate-operator/pkg/designate" - designateworker "github.com/openstack-k8s-operators/designate-operator/pkg/designateworker" + "github.com/openstack-k8s-operators/designate-operator/internal/designate" + designateworker "github.com/openstack-k8s-operators/designate-operator/internal/designateworker" topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" "github.com/openstack-k8s-operators/lib-common/modules/common" "github.com/openstack-k8s-operators/lib-common/modules/common/condition" diff --git a/pkg/designate/bind_ctrl_network.go b/internal/designate/bind_ctrl_network.go similarity index 100% rename from pkg/designate/bind_ctrl_network.go rename to internal/designate/bind_ctrl_network.go diff --git a/pkg/designate/common.go b/internal/designate/common.go similarity index 100% rename from pkg/designate/common.go rename to internal/designate/common.go diff --git a/pkg/designate/const.go b/internal/designate/const.go similarity index 100% rename from pkg/designate/const.go rename to internal/designate/const.go diff --git a/pkg/designate/dbsync.go b/internal/designate/dbsync.go similarity index 100% rename from pkg/designate/dbsync.go rename to internal/designate/dbsync.go diff --git a/pkg/designate/dnsservice.go b/internal/designate/dnsservice.go similarity index 100% rename from pkg/designate/dnsservice.go rename to internal/designate/dnsservice.go diff --git a/pkg/designate/func.go b/internal/designate/func.go similarity index 100% rename from pkg/designate/func.go rename to internal/designate/func.go diff --git a/pkg/designate/generate_bind9_pools_yaml.go b/internal/designate/generate_bind9_pools_yaml.go similarity index 100% rename from pkg/designate/generate_bind9_pools_yaml.go rename to internal/designate/generate_bind9_pools_yaml.go diff --git a/pkg/designate/initcontainer.go b/internal/designate/initcontainer.go similarity index 100% rename from pkg/designate/initcontainer.go rename to internal/designate/initcontainer.go diff --git a/pkg/designate/network_consts.go b/internal/designate/network_consts.go similarity index 100% rename from pkg/designate/network_consts.go rename to internal/designate/network_consts.go diff --git a/pkg/designate/network_parameters.go b/internal/designate/network_parameters.go similarity index 100% rename from pkg/designate/network_parameters.go rename to internal/designate/network_parameters.go diff --git a/pkg/designate/network_parameters_test.go b/internal/designate/network_parameters_test.go similarity index 100% rename from pkg/designate/network_parameters_test.go rename to internal/designate/network_parameters_test.go diff --git a/pkg/designate/pool_update.go b/internal/designate/pool_update.go similarity index 100% rename from pkg/designate/pool_update.go rename to internal/designate/pool_update.go diff --git a/pkg/designate/predipcontainer.go b/internal/designate/predipcontainer.go similarity index 100% rename from pkg/designate/predipcontainer.go rename to internal/designate/predipcontainer.go diff --git a/pkg/designate/rndckeygenerator.go b/internal/designate/rndckeygenerator.go similarity index 100% rename from pkg/designate/rndckeygenerator.go rename to internal/designate/rndckeygenerator.go diff --git a/pkg/designate/rndckeygenerator_test.go b/internal/designate/rndckeygenerator_test.go similarity index 100% rename from pkg/designate/rndckeygenerator_test.go rename to internal/designate/rndckeygenerator_test.go diff --git a/pkg/designate/volumes.go b/internal/designate/volumes.go similarity index 100% rename from pkg/designate/volumes.go rename to internal/designate/volumes.go diff --git a/pkg/designateapi/const.go b/internal/designateapi/const.go similarity index 100% rename from pkg/designateapi/const.go rename to internal/designateapi/const.go diff --git a/pkg/designateapi/deployment.go b/internal/designateapi/deployment.go similarity index 99% rename from pkg/designateapi/deployment.go rename to internal/designateapi/deployment.go index 0cf05168..f6b8354a 100644 --- a/pkg/designateapi/deployment.go +++ b/internal/designateapi/deployment.go @@ -19,7 +19,7 @@ import ( "fmt" designatev1beta1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" - designate "github.com/openstack-k8s-operators/designate-operator/pkg/designate" + designate "github.com/openstack-k8s-operators/designate-operator/internal/designate" topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" common "github.com/openstack-k8s-operators/lib-common/modules/common" "github.com/openstack-k8s-operators/lib-common/modules/common/affinity" diff --git a/pkg/designatebackendbind9/const.go b/internal/designatebackendbind9/const.go similarity index 100% rename from pkg/designatebackendbind9/const.go rename to internal/designatebackendbind9/const.go diff --git a/pkg/designatebackendbind9/deployment.go b/internal/designatebackendbind9/deployment.go similarity index 99% rename from pkg/designatebackendbind9/deployment.go rename to internal/designatebackendbind9/deployment.go index 8079859b..87f1e9a6 100644 --- a/pkg/designatebackendbind9/deployment.go +++ b/internal/designatebackendbind9/deployment.go @@ -19,7 +19,7 @@ import ( "fmt" designatev1beta1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" - designate "github.com/openstack-k8s-operators/designate-operator/pkg/designate" + designate "github.com/openstack-k8s-operators/designate-operator/internal/designate" topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" common "github.com/openstack-k8s-operators/lib-common/modules/common" "github.com/openstack-k8s-operators/lib-common/modules/common/affinity" diff --git a/pkg/designatebackendbind9/volumes.go b/internal/designatebackendbind9/volumes.go similarity index 99% rename from pkg/designatebackendbind9/volumes.go rename to internal/designatebackendbind9/volumes.go index 2680502c..132edd25 100644 --- a/pkg/designatebackendbind9/volumes.go +++ b/internal/designatebackendbind9/volumes.go @@ -17,7 +17,7 @@ limitations under the License. package designatebackendbind9 import ( - designate "github.com/openstack-k8s-operators/designate-operator/pkg/designate" + designate "github.com/openstack-k8s-operators/designate-operator/internal/designate" corev1 "k8s.io/api/core/v1" ) diff --git a/pkg/designatecentral/const.go b/internal/designatecentral/const.go similarity index 100% rename from pkg/designatecentral/const.go rename to internal/designatecentral/const.go diff --git a/pkg/designatecentral/deployment.go b/internal/designatecentral/deployment.go similarity index 99% rename from pkg/designatecentral/deployment.go rename to internal/designatecentral/deployment.go index 1a91c4ae..d774340b 100644 --- a/pkg/designatecentral/deployment.go +++ b/internal/designatecentral/deployment.go @@ -19,7 +19,7 @@ import ( "fmt" designatev1beta1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" - designate "github.com/openstack-k8s-operators/designate-operator/pkg/designate" + designate "github.com/openstack-k8s-operators/designate-operator/internal/designate" topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" common "github.com/openstack-k8s-operators/lib-common/modules/common" "github.com/openstack-k8s-operators/lib-common/modules/common/affinity" diff --git a/pkg/designatemdns/const.go b/internal/designatemdns/const.go similarity index 100% rename from pkg/designatemdns/const.go rename to internal/designatemdns/const.go diff --git a/pkg/designatemdns/statefulset.go b/internal/designatemdns/statefulset.go similarity index 99% rename from pkg/designatemdns/statefulset.go rename to internal/designatemdns/statefulset.go index 40928e08..3c51c0a8 100644 --- a/pkg/designatemdns/statefulset.go +++ b/internal/designatemdns/statefulset.go @@ -17,7 +17,7 @@ package designatemdns import ( designatev1beta1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" - designate "github.com/openstack-k8s-operators/designate-operator/pkg/designate" + designate "github.com/openstack-k8s-operators/designate-operator/internal/designate" topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" common "github.com/openstack-k8s-operators/lib-common/modules/common" "github.com/openstack-k8s-operators/lib-common/modules/common/affinity" diff --git a/pkg/designateproducer/const.go b/internal/designateproducer/const.go similarity index 100% rename from pkg/designateproducer/const.go rename to internal/designateproducer/const.go diff --git a/pkg/designateproducer/deployment.go b/internal/designateproducer/deployment.go similarity index 99% rename from pkg/designateproducer/deployment.go rename to internal/designateproducer/deployment.go index ce34bd67..2a406c55 100644 --- a/pkg/designateproducer/deployment.go +++ b/internal/designateproducer/deployment.go @@ -19,7 +19,7 @@ import ( "fmt" designatev1beta1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" - designate "github.com/openstack-k8s-operators/designate-operator/pkg/designate" + designate "github.com/openstack-k8s-operators/designate-operator/internal/designate" topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" common "github.com/openstack-k8s-operators/lib-common/modules/common" "github.com/openstack-k8s-operators/lib-common/modules/common/affinity" diff --git a/pkg/designateunbound/const.go b/internal/designateunbound/const.go similarity index 100% rename from pkg/designateunbound/const.go rename to internal/designateunbound/const.go diff --git a/pkg/designateunbound/statefulset.go b/internal/designateunbound/statefulset.go similarity index 99% rename from pkg/designateunbound/statefulset.go rename to internal/designateunbound/statefulset.go index c1af3d23..62096715 100644 --- a/pkg/designateunbound/statefulset.go +++ b/internal/designateunbound/statefulset.go @@ -19,7 +19,7 @@ import ( "fmt" designatev1beta1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" - designate "github.com/openstack-k8s-operators/designate-operator/pkg/designate" + designate "github.com/openstack-k8s-operators/designate-operator/internal/designate" topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" common "github.com/openstack-k8s-operators/lib-common/modules/common" "github.com/openstack-k8s-operators/lib-common/modules/common/affinity" diff --git a/pkg/designateworker/const.go b/internal/designateworker/const.go similarity index 100% rename from pkg/designateworker/const.go rename to internal/designateworker/const.go diff --git a/pkg/designateworker/deployment.go b/internal/designateworker/deployment.go similarity index 99% rename from pkg/designateworker/deployment.go rename to internal/designateworker/deployment.go index 11ec8760..cc37f52e 100644 --- a/pkg/designateworker/deployment.go +++ b/internal/designateworker/deployment.go @@ -19,7 +19,7 @@ import ( "fmt" designatev1beta1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" - designate "github.com/openstack-k8s-operators/designate-operator/pkg/designate" + designate "github.com/openstack-k8s-operators/designate-operator/internal/designate" topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" common "github.com/openstack-k8s-operators/lib-common/modules/common" "github.com/openstack-k8s-operators/lib-common/modules/common/affinity" diff --git a/internal/webhook/v1beta1/designate_webhook.go b/internal/webhook/v1beta1/designate_webhook.go new file mode 100644 index 00000000..268d58b9 --- /dev/null +++ b/internal/webhook/v1beta1/designate_webhook.go @@ -0,0 +1,129 @@ +/* +Copyright 2025. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Package v1beta1 implements webhook handlers for Designate v1beta1 API resources. +package v1beta1 + +import ( + "context" + "errors" + "fmt" + + "k8s.io/apimachinery/pkg/runtime" + ctrl "sigs.k8s.io/controller-runtime" + logf "sigs.k8s.io/controller-runtime/pkg/log" + "sigs.k8s.io/controller-runtime/pkg/webhook" + "sigs.k8s.io/controller-runtime/pkg/webhook/admission" + + designatev1beta1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" +) + +var ( + // ErrInvalidObjectType is returned when an unexpected object type is provided + ErrInvalidObjectType = errors.New("invalid object type") +) + +// nolint:unused +// log is for logging in this package. +var designatelog = logf.Log.WithName("designate-resource") + +// SetupDesignateWebhookWithManager registers the webhook for Designate in the manager. +func SetupDesignateWebhookWithManager(mgr ctrl.Manager) error { + return ctrl.NewWebhookManagedBy(mgr).For(&designatev1beta1.Designate{}). + WithValidator(&DesignateCustomValidator{}). + WithDefaulter(&DesignateCustomDefaulter{}). + Complete() +} + +// +kubebuilder:webhook:path=/mutate-designate-openstack-org-v1beta1-designate,mutating=true,failurePolicy=fail,sideEffects=None,groups=designate.openstack.org,resources=designates,verbs=create;update,versions=v1beta1,name=mdesignate-v1beta1.kb.io,admissionReviewVersions=v1 + +// DesignateCustomDefaulter struct is responsible for setting default values on the custom resource of the +// Kind Designate when those are created or updated. +// +// NOTE: The +kubebuilder:object:generate=false marker prevents controller-gen from generating DeepCopy methods, +// as it is used only for temporary operations and does not need to be deeply copied. +type DesignateCustomDefaulter struct { + // TODO(user): Add more fields as needed for defaulting +} + +var _ webhook.CustomDefaulter = &DesignateCustomDefaulter{} + +// Default implements webhook.CustomDefaulter so a webhook will be registered for the Kind Designate. +func (d *DesignateCustomDefaulter) Default(_ context.Context, obj runtime.Object) error { + designate, ok := obj.(*designatev1beta1.Designate) + + if !ok { + return fmt.Errorf("expected an Designate object but got %T: %w", obj, ErrInvalidObjectType) + } + designatelog.Info("Defaulting for Designate", "name", designate.GetName()) + + // Call the Default method on the Designate type + designate.Default() + + return nil +} + +// TODO(user): change verbs to "verbs=create;update;delete" if you want to enable deletion validation. +// NOTE: The 'path' attribute must follow a specific pattern and should not be modified directly here. +// Modifying the path for an invalid path can cause API server errors; failing to locate the webhook. +// +kubebuilder:webhook:path=/validate-designate-openstack-org-v1beta1-designate,mutating=false,failurePolicy=fail,sideEffects=None,groups=designate.openstack.org,resources=designates,verbs=create;update,versions=v1beta1,name=vdesignate-v1beta1.kb.io,admissionReviewVersions=v1 + +// DesignateCustomValidator struct is responsible for validating the Designate resource +// when it is created, updated, or deleted. +// +// NOTE: The +kubebuilder:object:generate=false marker prevents controller-gen from generating DeepCopy methods, +// as this struct is used only for temporary operations and does not need to be deeply copied. +type DesignateCustomValidator struct { + // TODO(user): Add more fields as needed for validation +} + +var _ webhook.CustomValidator = &DesignateCustomValidator{} + +// ValidateCreate implements webhook.CustomValidator so a webhook will be registered for the type Designate. +func (v *DesignateCustomValidator) ValidateCreate(_ context.Context, obj runtime.Object) (admission.Warnings, error) { + designate, ok := obj.(*designatev1beta1.Designate) + if !ok { + return nil, fmt.Errorf("expected a Designate object but got %T: %w", obj, ErrInvalidObjectType) + } + designatelog.Info("Validation for Designate upon creation", "name", designate.GetName()) + + // Call the ValidateCreate method on the Designate type + return designate.ValidateCreate() +} + +// ValidateUpdate implements webhook.CustomValidator so a webhook will be registered for the type Designate. +func (v *DesignateCustomValidator) ValidateUpdate(_ context.Context, oldObj, newObj runtime.Object) (admission.Warnings, error) { + designate, ok := newObj.(*designatev1beta1.Designate) + if !ok { + return nil, fmt.Errorf("expected a Designate object for the newObj but got %T: %w", newObj, ErrInvalidObjectType) + } + designatelog.Info("Validation for Designate upon update", "name", designate.GetName()) + + // Call the ValidateUpdate method on the Designate type + return designate.ValidateUpdate(oldObj) +} + +// ValidateDelete implements webhook.CustomValidator so a webhook will be registered for the type Designate. +func (v *DesignateCustomValidator) ValidateDelete(_ context.Context, obj runtime.Object) (admission.Warnings, error) { + designate, ok := obj.(*designatev1beta1.Designate) + if !ok { + return nil, fmt.Errorf("expected a Designate object but got %T: %w", obj, ErrInvalidObjectType) + } + designatelog.Info("Validation for Designate upon deletion", "name", designate.GetName()) + + // Call the ValidateDelete method on the Designate type + return designate.ValidateDelete() +} diff --git a/main.go b/main.go deleted file mode 100644 index 769446ba..00000000 --- a/main.go +++ /dev/null @@ -1,256 +0,0 @@ -/* -Copyright 2022. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Package main implements the designate-operator controller manager. -package main - -import ( - "context" - "crypto/tls" - "flag" - "os" - "strings" - - // Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.) - // to ensure that exec-entrypoint and run can make use of them. - "k8s.io/client-go/kubernetes" - _ "k8s.io/client-go/plugin/pkg/client/auth" - - "k8s.io/apimachinery/pkg/runtime" - utilruntime "k8s.io/apimachinery/pkg/util/runtime" - clientgoscheme "k8s.io/client-go/kubernetes/scheme" - ctrl "sigs.k8s.io/controller-runtime" - "sigs.k8s.io/controller-runtime/pkg/client/config" - "sigs.k8s.io/controller-runtime/pkg/healthz" - "sigs.k8s.io/controller-runtime/pkg/log/zap" - "sigs.k8s.io/controller-runtime/pkg/webhook" - - metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server" - - networkv1 "github.com/k8snetworkplumbingwg/network-attachment-definition-client/pkg/apis/k8s.cni.cncf.io/v1" - rabbitmqv1 "github.com/openstack-k8s-operators/infra-operator/apis/rabbitmq/v1beta1" - redisv1 "github.com/openstack-k8s-operators/infra-operator/apis/redis/v1beta1" - keystonev1 "github.com/openstack-k8s-operators/keystone-operator/api/v1beta1" - "github.com/openstack-k8s-operators/lib-common/modules/common/operator" - mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1" - - oshiftapi "github.com/openshift/api/operator/v1" - designatev1beta1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" - "github.com/openstack-k8s-operators/designate-operator/controllers" - topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" - //+kubebuilder:scaffold:imports -) - -var ( - scheme = runtime.NewScheme() - setupLog = ctrl.Log.WithName("setup") -) - -func init() { - utilruntime.Must(clientgoscheme.AddToScheme(scheme)) - utilruntime.Must(mariadbv1.AddToScheme(scheme)) - utilruntime.Must(keystonev1.AddToScheme(scheme)) - utilruntime.Must(designatev1beta1.AddToScheme(scheme)) - utilruntime.Must(rabbitmqv1.AddToScheme(scheme)) - utilruntime.Must(redisv1.AddToScheme(scheme)) - utilruntime.Must(networkv1.AddToScheme(scheme)) - utilruntime.Must(topologyv1.AddToScheme(scheme)) - utilruntime.Must(oshiftapi.AddToScheme(scheme)) - //+kubebuilder:scaffold:scheme -} - -func main() { - var metricsAddr string - var enableLeaderElection bool - var probeAddr string - var pprofBindAddress string - var webhookPort int - var enableHTTP2 bool - flag.BoolVar(&enableHTTP2, "enable-http2", enableHTTP2, "If HTTP/2 should be enabled for the metrics and webhook servers.") - flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.") - flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.") - flag.StringVar(&pprofBindAddress, "pprof-bind-address", "", "The address the pprof endpoint binds to. Set to empty to disable pprof.") - flag.IntVar(&webhookPort, "webhook-bind-address", 9443, "The port the webhook server binds to.") - flag.BoolVar(&enableLeaderElection, "leader-elect", false, - "Enable leader election for controller manager. "+ - "Enabling this will ensure there is only one active controller manager.") - opts := zap.Options{ - Development: true, - } - opts.BindFlags(flag.CommandLine) - flag.Parse() - - ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts))) - - disableHTTP2 := func(c *tls.Config) { - if enableHTTP2 { - return - } - c.NextProtos = []string{"http/1.1"} - } - - options := ctrl.Options{ - Scheme: scheme, - Metrics: metricsserver.Options{ - BindAddress: metricsAddr, - }, - HealthProbeBindAddress: probeAddr, - LeaderElection: enableLeaderElection, - LeaderElectionID: "f9497e05.openstack.org", - PprofBindAddress: pprofBindAddress, - WebhookServer: webhook.NewServer( - webhook.Options{ - Port: webhookPort, - TLSOpts: []func(config *tls.Config){disableHTTP2}, - }), - } - - err := operator.SetManagerOptions(&options, setupLog) - if err != nil { - setupLog.Error(err, "unable to set manager options") - os.Exit(1) - } - - mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), options) - if err != nil { - setupLog.Error(err, "unable to start manager") - os.Exit(1) - } - - cfg, err := config.GetConfig() - if err != nil { - setupLog.Error(err, "") - os.Exit(1) - } - kclient, err := kubernetes.NewForConfig(cfg) - if err != nil { - setupLog.Error(err, "") - os.Exit(1) - } - - // setup for all the reconcilers in the controllers - // designate main controller - if err = (&controllers.DesignateReconciler{ - Client: mgr.GetClient(), - Scheme: mgr.GetScheme(), - Kclient: kclient, - }).SetupWithManager(context.Background(), mgr); err != nil { - setupLog.Error(err, "unable to create controller", "controller", "Designate") - os.Exit(1) - } - - // designate-api - if err = (&controllers.DesignateAPIReconciler{ - Client: mgr.GetClient(), - Scheme: mgr.GetScheme(), - Kclient: kclient, - }).SetupWithManager(context.Background(), mgr); err != nil { - setupLog.Error(err, "unable to create controller", "controller", "DesignateAPI") - os.Exit(1) - } - - // designate-central - if err = (&controllers.DesignateCentralReconciler{ - Client: mgr.GetClient(), - Scheme: mgr.GetScheme(), - Kclient: kclient, - }).SetupWithManager(context.Background(), mgr); err != nil { - setupLog.Error(err, "unable to create controller", "controller", "DesignateCentral") - os.Exit(1) - } - - // designate-producer - if err = (&controllers.DesignateProducerReconciler{ - Client: mgr.GetClient(), - Scheme: mgr.GetScheme(), - Kclient: kclient, - }).SetupWithManager(context.Background(), mgr); err != nil { - setupLog.Error(err, "unable to create controller", "controller", "DesignateProducer") - os.Exit(1) - } - - // designate-worker - if err = (&controllers.DesignateWorkerReconciler{ - Client: mgr.GetClient(), - Scheme: mgr.GetScheme(), - Kclient: kclient, - }).SetupWithManager(context.Background(), mgr); err != nil { - setupLog.Error(err, "unable to create controller", "controller", "DesignateWork") - os.Exit(1) - } - - // designate-mdns - if err = (&controllers.DesignateMdnsReconciler{ - Client: mgr.GetClient(), - Scheme: mgr.GetScheme(), - Kclient: kclient, - }).SetupWithManager(context.Background(), mgr); err != nil { - setupLog.Error(err, "unable to create controller", "controller", "DesignateMdns") - os.Exit(1) - } - - // // designate-backendbind9 - if err = (&controllers.DesignateBackendbind9Reconciler{ - Client: mgr.GetClient(), - Scheme: mgr.GetScheme(), - Kclient: kclient, - }).SetupWithManager(context.Background(), mgr); err != nil { - setupLog.Error(err, "unable to create controller", "controller", "DesignateBackendbind9") - os.Exit(1) - } - - // // designate-backendbind9 - if err = (&controllers.UnboundReconciler{ - Client: mgr.GetClient(), - Scheme: mgr.GetScheme(), - Kclient: kclient, - }).SetupWithManager(mgr); err != nil { - setupLog.Error(err, "unable to create controller", "controller", "DesignateUnbound") - os.Exit(1) - } - - // Acquire environmental defaults and initialize operator defaults with them - designatev1beta1.SetupDefaults() - - checker := healthz.Ping - // Setup webhooks if requested - if strings.ToLower(os.Getenv("ENABLE_WEBHOOKS")) != "false" { - - if err = (&designatev1beta1.Designate{}).SetupWebhookWithManager(mgr); err != nil { - setupLog.Error(err, "unable to create webhook", "webhook", "Designate") - os.Exit(1) - } - - checker = mgr.GetWebhookServer().StartedChecker() - } - - //+kubebuilder:scaffold:builder - - if err := mgr.AddHealthzCheck("healthz", checker); err != nil { - setupLog.Error(err, "unable to set up health check") - os.Exit(1) - } - if err := mgr.AddReadyzCheck("readyz", checker); err != nil { - setupLog.Error(err, "unable to set up ready check") - os.Exit(1) - } - - setupLog.Info("starting manager") - if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil { - setupLog.Error(err, "problem running manager") - os.Exit(1) - } -} diff --git a/tests/functional/api_fixture.go b/test/functional/api_fixture.go similarity index 100% rename from tests/functional/api_fixture.go rename to test/functional/api_fixture.go diff --git a/tests/functional/base_test.go b/test/functional/base_test.go similarity index 99% rename from tests/functional/base_test.go rename to test/functional/base_test.go index a11d50ba..750e15c7 100644 --- a/tests/functional/base_test.go +++ b/test/functional/base_test.go @@ -33,7 +33,7 @@ import ( "sigs.k8s.io/controller-runtime/pkg/client" designatev1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" - "github.com/openstack-k8s-operators/designate-operator/pkg/designate" + "github.com/openstack-k8s-operators/designate-operator/internal/designate" rabbitmqv1 "github.com/openstack-k8s-operators/infra-operator/apis/rabbitmq/v1beta1" redisv1 "github.com/openstack-k8s-operators/infra-operator/apis/redis/v1beta1" condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition" diff --git a/tests/functional/designate_controller_test.go b/test/functional/designate_controller_test.go similarity index 99% rename from tests/functional/designate_controller_test.go rename to test/functional/designate_controller_test.go index 220df417..4b5d79c6 100644 --- a/tests/functional/designate_controller_test.go +++ b/test/functional/designate_controller_test.go @@ -37,10 +37,10 @@ import ( //revive:disable-next-line:dot-imports validator "github.com/go-playground/validator/v10" designatev1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" - "github.com/openstack-k8s-operators/designate-operator/pkg/designate" - "github.com/openstack-k8s-operators/designate-operator/pkg/designatecentral" - "github.com/openstack-k8s-operators/designate-operator/pkg/designateproducer" - "github.com/openstack-k8s-operators/designate-operator/pkg/designateunbound" + "github.com/openstack-k8s-operators/designate-operator/internal/designate" + "github.com/openstack-k8s-operators/designate-operator/internal/designatecentral" + "github.com/openstack-k8s-operators/designate-operator/internal/designateproducer" + "github.com/openstack-k8s-operators/designate-operator/internal/designateunbound" topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" . "github.com/openstack-k8s-operators/lib-common/modules/common/test/helpers" mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1" diff --git a/tests/functional/designateapi_controller_test.go b/test/functional/designateapi_controller_test.go similarity index 99% rename from tests/functional/designateapi_controller_test.go rename to test/functional/designateapi_controller_test.go index 2fd455a3..69b6c881 100644 --- a/tests/functional/designateapi_controller_test.go +++ b/test/functional/designateapi_controller_test.go @@ -28,7 +28,7 @@ import ( "github.com/openstack-k8s-operators/lib-common/modules/common/condition" //revive:disable-next-line:dot-imports - "github.com/openstack-k8s-operators/designate-operator/pkg/designate" + "github.com/openstack-k8s-operators/designate-operator/internal/designate" . "github.com/openstack-k8s-operators/lib-common/modules/common/test/helpers" mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1" diff --git a/tests/functional/designatebackendbind9_controller_test.go b/test/functional/designatebackendbind9_controller_test.go similarity index 98% rename from tests/functional/designatebackendbind9_controller_test.go rename to test/functional/designatebackendbind9_controller_test.go index 41e02ffd..ba7b89b6 100644 --- a/tests/functional/designatebackendbind9_controller_test.go +++ b/test/functional/designatebackendbind9_controller_test.go @@ -27,7 +27,7 @@ import ( "k8s.io/apimachinery/pkg/types" // revive:disable-next-line:dot-imports - "github.com/openstack-k8s-operators/designate-operator/pkg/designate" + "github.com/openstack-k8s-operators/designate-operator/internal/designate" . "github.com/openstack-k8s-operators/lib-common/modules/common/test/helpers" mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1" ) diff --git a/tests/functional/designatecentral_controller_test.go b/test/functional/designatecentral_controller_test.go similarity index 98% rename from tests/functional/designatecentral_controller_test.go rename to test/functional/designatecentral_controller_test.go index da33736b..a4300652 100644 --- a/tests/functional/designatecentral_controller_test.go +++ b/test/functional/designatecentral_controller_test.go @@ -28,7 +28,7 @@ import ( // "sigs.k8s.io/controller-runtime/pkg/client" // revive:disable-next-line:dot-imports - "github.com/openstack-k8s-operators/designate-operator/pkg/designate" + "github.com/openstack-k8s-operators/designate-operator/internal/designate" . "github.com/openstack-k8s-operators/lib-common/modules/common/test/helpers" mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1" ) diff --git a/tests/functional/designateproducer_controller_test.go b/test/functional/designateproducer_controller_test.go similarity index 98% rename from tests/functional/designateproducer_controller_test.go rename to test/functional/designateproducer_controller_test.go index e9b88018..e0597420 100644 --- a/tests/functional/designateproducer_controller_test.go +++ b/test/functional/designateproducer_controller_test.go @@ -28,7 +28,7 @@ import ( // "sigs.k8s.io/controller-runtime/pkg/client" // revive:disable-next-line:dot-imports - "github.com/openstack-k8s-operators/designate-operator/pkg/designate" + "github.com/openstack-k8s-operators/designate-operator/internal/designate" . "github.com/openstack-k8s-operators/lib-common/modules/common/test/helpers" mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1" ) diff --git a/tests/functional/suite_test.go b/test/functional/suite_test.go similarity index 97% rename from tests/functional/suite_test.go rename to test/functional/suite_test.go index 7138ec07..0de22e9f 100644 --- a/tests/functional/suite_test.go +++ b/test/functional/suite_test.go @@ -47,7 +47,8 @@ import ( networkv1 "github.com/k8snetworkplumbingwg/network-attachment-definition-client/pkg/apis/k8s.cni.cncf.io/v1" designatev1 "github.com/openstack-k8s-operators/designate-operator/api/v1beta1" - "github.com/openstack-k8s-operators/designate-operator/controllers" + controllers "github.com/openstack-k8s-operators/designate-operator/internal/controller" + webhooks "github.com/openstack-k8s-operators/designate-operator/internal/webhook/v1beta1" memcachedv1 "github.com/openstack-k8s-operators/infra-operator/apis/memcached/v1beta1" rabbitmqv1 "github.com/openstack-k8s-operators/infra-operator/apis/rabbitmq/v1beta1" redisv1 "github.com/openstack-k8s-operators/infra-operator/apis/redis/v1beta1" @@ -187,7 +188,7 @@ var _ = BeforeSuite(func() { }) Expect(err).ToNot(HaveOccurred()) - err = (&designatev1.Designate{}).SetupWebhookWithManager(k8sManager) + err = webhooks.SetupDesignateWebhookWithManager(k8sManager) Expect(err).NotTo(HaveOccurred()) kclient, err := kubernetes.NewForConfig(cfg) diff --git a/tests/kuttl/common/assert-sample-deployment.yaml b/test/kuttl/common/assert-sample-deployment.yaml similarity index 98% rename from tests/kuttl/common/assert-sample-deployment.yaml rename to test/kuttl/common/assert-sample-deployment.yaml index eea32c2b..232ed6c1 100644 --- a/tests/kuttl/common/assert-sample-deployment.yaml +++ b/test/kuttl/common/assert-sample-deployment.yaml @@ -145,7 +145,7 @@ commands: fi exit 0 - script: | - tupleTemplate='{{ range (index .spec.template.spec.containers 1).env }}{{ .name }}{{ "#" }}{{ .value}}{{"\n"}}{{ end }}' + tupleTemplate='{{ range (index .spec.template.spec.containers 0).env }}{{ .name }}{{ "#" }}{{ .value}}{{"\n"}}{{ end }}' imageTuples=$(oc get -n openstack-operators deployment designate-operator-controller-manager -o go-template="$tupleTemplate") for ITEM in $(echo $imageTuples); do # it is an image diff --git a/tests/kuttl/common/designate_nad.yaml b/test/kuttl/common/designate_nad.yaml similarity index 100% rename from tests/kuttl/common/designate_nad.yaml rename to test/kuttl/common/designate_nad.yaml diff --git a/tests/kuttl/common/validate-pools-yaml.sh b/test/kuttl/common/validate-pools-yaml.sh similarity index 100% rename from tests/kuttl/common/validate-pools-yaml.sh rename to test/kuttl/common/validate-pools-yaml.sh diff --git a/tests/kuttl/common/validate-predictable-ips.sh b/test/kuttl/common/validate-predictable-ips.sh similarity index 100% rename from tests/kuttl/common/validate-predictable-ips.sh rename to test/kuttl/common/validate-predictable-ips.sh diff --git a/tests/kuttl/tests/basic/01-assert.yaml b/test/kuttl/tests/basic/01-assert.yaml similarity index 98% rename from tests/kuttl/tests/basic/01-assert.yaml rename to test/kuttl/tests/basic/01-assert.yaml index a0fcc115..83596ee8 100644 --- a/tests/kuttl/tests/basic/01-assert.yaml +++ b/test/kuttl/tests/basic/01-assert.yaml @@ -132,7 +132,7 @@ apiVersion: kuttl.dev/v1beta1 kind: TestAssert commands: - script: | - tupleTemplate='{{ range (index .spec.template.spec.containers 1).env }}{{ .name }}{{ "#" }}{{ .value}}{{"\n"}}{{ end }}' + tupleTemplate='{{ range (index .spec.template.spec.containers 0).env }}{{ .name }}{{ "#" }}{{ .value}}{{"\n"}}{{ end }}' imageTuples=$(oc get -n openstack-operators deployment designate-operator-controller-manager -o go-template="$tupleTemplate") for ITEM in $(echo $imageTuples); do # it is an image diff --git a/tests/kuttl/tests/basic/01-deploy-designate.yaml b/test/kuttl/tests/basic/01-deploy-designate.yaml similarity index 100% rename from tests/kuttl/tests/basic/01-deploy-designate.yaml rename to test/kuttl/tests/basic/01-deploy-designate.yaml diff --git a/tests/kuttl/tests/basic/02-assert.yaml b/test/kuttl/tests/basic/02-assert.yaml similarity index 100% rename from tests/kuttl/tests/basic/02-assert.yaml rename to test/kuttl/tests/basic/02-assert.yaml diff --git a/tests/kuttl/tests/basic/03-cleanup.yaml b/test/kuttl/tests/basic/03-cleanup.yaml similarity index 100% rename from tests/kuttl/tests/basic/03-cleanup.yaml rename to test/kuttl/tests/basic/03-cleanup.yaml diff --git a/tests/kuttl/tests/basic/deploy/designate_v1beta1_designate.yaml b/test/kuttl/tests/basic/deploy/designate_v1beta1_designate.yaml similarity index 100% rename from tests/kuttl/tests/basic/deploy/designate_v1beta1_designate.yaml rename to test/kuttl/tests/basic/deploy/designate_v1beta1_designate.yaml diff --git a/tests/kuttl/tests/basic/deploy/kustomization.yaml b/test/kuttl/tests/basic/deploy/kustomization.yaml similarity index 100% rename from tests/kuttl/tests/basic/deploy/kustomization.yaml rename to test/kuttl/tests/basic/deploy/kustomization.yaml diff --git a/tests/kuttl/tests/basic/ns-records-configmap/02-assert.yaml b/test/kuttl/tests/basic/ns-records-configmap/02-assert.yaml similarity index 100% rename from tests/kuttl/tests/basic/ns-records-configmap/02-assert.yaml rename to test/kuttl/tests/basic/ns-records-configmap/02-assert.yaml diff --git a/tests/kuttl/tests/basic/ns-records-configmap/02-deploy.yaml b/test/kuttl/tests/basic/ns-records-configmap/02-deploy.yaml similarity index 100% rename from tests/kuttl/tests/basic/ns-records-configmap/02-deploy.yaml rename to test/kuttl/tests/basic/ns-records-configmap/02-deploy.yaml diff --git a/tests/kuttl/tests/basic/redis.yaml b/test/kuttl/tests/basic/redis.yaml similarity index 100% rename from tests/kuttl/tests/basic/redis.yaml rename to test/kuttl/tests/basic/redis.yaml diff --git a/tests/kuttl/tests/designate_scale/00-assert.yaml b/test/kuttl/tests/designate_scale/00-assert.yaml similarity index 100% rename from tests/kuttl/tests/designate_scale/00-assert.yaml rename to test/kuttl/tests/designate_scale/00-assert.yaml diff --git a/tests/kuttl/tests/designate_scale/00-test-resources.yaml b/test/kuttl/tests/designate_scale/00-test-resources.yaml similarity index 100% rename from tests/kuttl/tests/designate_scale/00-test-resources.yaml rename to test/kuttl/tests/designate_scale/00-test-resources.yaml diff --git a/tests/kuttl/tests/designate_scale/01-assert.yaml b/test/kuttl/tests/designate_scale/01-assert.yaml similarity index 98% rename from tests/kuttl/tests/designate_scale/01-assert.yaml rename to test/kuttl/tests/designate_scale/01-assert.yaml index c38768a6..70567689 100644 --- a/tests/kuttl/tests/designate_scale/01-assert.yaml +++ b/test/kuttl/tests/designate_scale/01-assert.yaml @@ -133,7 +133,7 @@ apiVersion: kuttl.dev/v1beta1 kind: TestAssert commands: - script: | - tupleTemplate='{{ range (index .spec.template.spec.containers 1).env }}{{ .name }}{{ "#" }}{{ .value}}{{"\n"}}{{ end }}' + tupleTemplate='{{ range (index .spec.template.spec.containers 0).env }}{{ .name }}{{ "#" }}{{ .value}}{{"\n"}}{{ end }}' imageTuples=$(oc get -n openstack-operators deployment designate-operator-controller-manager -o go-template="$tupleTemplate") for ITEM in $(echo $imageTuples); do # it is an image diff --git a/tests/kuttl/tests/designate_scale/01-deploy-designate.yaml b/test/kuttl/tests/designate_scale/01-deploy-designate.yaml similarity index 100% rename from tests/kuttl/tests/designate_scale/01-deploy-designate.yaml rename to test/kuttl/tests/designate_scale/01-deploy-designate.yaml diff --git a/tests/kuttl/tests/designate_scale/02-assert.yaml b/test/kuttl/tests/designate_scale/02-assert.yaml similarity index 100% rename from tests/kuttl/tests/designate_scale/02-assert.yaml rename to test/kuttl/tests/designate_scale/02-assert.yaml diff --git a/tests/kuttl/tests/designate_scale/02-scale-designate.yaml b/test/kuttl/tests/designate_scale/02-scale-designate.yaml similarity index 100% rename from tests/kuttl/tests/designate_scale/02-scale-designate.yaml rename to test/kuttl/tests/designate_scale/02-scale-designate.yaml diff --git a/tests/kuttl/tests/designate_scale/03-assert.yaml b/test/kuttl/tests/designate_scale/03-assert.yaml similarity index 100% rename from tests/kuttl/tests/designate_scale/03-assert.yaml rename to test/kuttl/tests/designate_scale/03-assert.yaml diff --git a/tests/kuttl/tests/designate_scale/03-scale-down-designate.yaml b/test/kuttl/tests/designate_scale/03-scale-down-designate.yaml similarity index 100% rename from tests/kuttl/tests/designate_scale/03-scale-down-designate.yaml rename to test/kuttl/tests/designate_scale/03-scale-down-designate.yaml diff --git a/tests/kuttl/tests/designate_scale/04-assert.yaml b/test/kuttl/tests/designate_scale/04-assert.yaml similarity index 100% rename from tests/kuttl/tests/designate_scale/04-assert.yaml rename to test/kuttl/tests/designate_scale/04-assert.yaml diff --git a/tests/kuttl/tests/designate_scale/04-scale-designate-up-again.yaml b/test/kuttl/tests/designate_scale/04-scale-designate-up-again.yaml similarity index 100% rename from tests/kuttl/tests/designate_scale/04-scale-designate-up-again.yaml rename to test/kuttl/tests/designate_scale/04-scale-designate-up-again.yaml diff --git a/tests/kuttl/tests/designate_scale/05-assert.yaml b/test/kuttl/tests/designate_scale/05-assert.yaml similarity index 100% rename from tests/kuttl/tests/designate_scale/05-assert.yaml rename to test/kuttl/tests/designate_scale/05-assert.yaml diff --git a/tests/kuttl/tests/designate_scale/05-errors.yaml b/test/kuttl/tests/designate_scale/05-errors.yaml similarity index 100% rename from tests/kuttl/tests/designate_scale/05-errors.yaml rename to test/kuttl/tests/designate_scale/05-errors.yaml diff --git a/tests/kuttl/tests/designate_scale/05-scale-down-zero-designate.yaml b/test/kuttl/tests/designate_scale/05-scale-down-zero-designate.yaml similarity index 100% rename from tests/kuttl/tests/designate_scale/05-scale-down-zero-designate.yaml rename to test/kuttl/tests/designate_scale/05-scale-down-zero-designate.yaml diff --git a/tests/kuttl/tests/designate_scale/06-cleanup-designate.yaml b/test/kuttl/tests/designate_scale/06-cleanup-designate.yaml similarity index 100% rename from tests/kuttl/tests/designate_scale/06-cleanup-designate.yaml rename to test/kuttl/tests/designate_scale/06-cleanup-designate.yaml diff --git a/tests/kuttl/tests/designate_scale/06-errors.yaml b/test/kuttl/tests/designate_scale/06-errors.yaml similarity index 100% rename from tests/kuttl/tests/designate_scale/06-errors.yaml rename to test/kuttl/tests/designate_scale/06-errors.yaml diff --git a/tests/kuttl/tests/designate_scale/redis.yaml b/test/kuttl/tests/designate_scale/redis.yaml similarity index 100% rename from tests/kuttl/tests/designate_scale/redis.yaml rename to test/kuttl/tests/designate_scale/redis.yaml diff --git a/tests/kuttl/tests/designate_tls/01-assert.yaml b/test/kuttl/tests/designate_tls/01-assert.yaml similarity index 100% rename from tests/kuttl/tests/designate_tls/01-assert.yaml rename to test/kuttl/tests/designate_tls/01-assert.yaml diff --git a/tests/kuttl/tests/designate_tls/01-nad.yaml b/test/kuttl/tests/designate_tls/01-nad.yaml similarity index 100% rename from tests/kuttl/tests/designate_tls/01-nad.yaml rename to test/kuttl/tests/designate_tls/01-nad.yaml diff --git a/tests/kuttl/tests/designate_tls/02-assert.yaml b/test/kuttl/tests/designate_tls/02-assert.yaml similarity index 100% rename from tests/kuttl/tests/designate_tls/02-assert.yaml rename to test/kuttl/tests/designate_tls/02-assert.yaml diff --git a/tests/kuttl/tests/designate_tls/02-redis-tls-certs.yaml b/test/kuttl/tests/designate_tls/02-redis-tls-certs.yaml similarity index 100% rename from tests/kuttl/tests/designate_tls/02-redis-tls-certs.yaml rename to test/kuttl/tests/designate_tls/02-redis-tls-certs.yaml diff --git a/tests/kuttl/tests/designate_tls/03-deploy-redis-tls.yaml b/test/kuttl/tests/designate_tls/03-deploy-redis-tls.yaml similarity index 100% rename from tests/kuttl/tests/designate_tls/03-deploy-redis-tls.yaml rename to test/kuttl/tests/designate_tls/03-deploy-redis-tls.yaml diff --git a/tests/kuttl/tests/designate_tls/04-assert.yaml b/test/kuttl/tests/designate_tls/04-assert.yaml similarity index 100% rename from tests/kuttl/tests/designate_tls/04-assert.yaml rename to test/kuttl/tests/designate_tls/04-assert.yaml diff --git a/tests/kuttl/tests/designate_tls/04-tls-certs.yaml b/test/kuttl/tests/designate_tls/04-tls-certs.yaml similarity index 100% rename from tests/kuttl/tests/designate_tls/04-tls-certs.yaml rename to test/kuttl/tests/designate_tls/04-tls-certs.yaml diff --git a/tests/kuttl/tests/designate_tls/05-assert.yaml b/test/kuttl/tests/designate_tls/05-assert.yaml similarity index 100% rename from tests/kuttl/tests/designate_tls/05-assert.yaml rename to test/kuttl/tests/designate_tls/05-assert.yaml diff --git a/tests/kuttl/tests/designate_tls/05-deploy.yaml b/test/kuttl/tests/designate_tls/05-deploy.yaml similarity index 100% rename from tests/kuttl/tests/designate_tls/05-deploy.yaml rename to test/kuttl/tests/designate_tls/05-deploy.yaml diff --git a/tests/kuttl/tests/designate_tls/06-cleanup.yaml b/test/kuttl/tests/designate_tls/06-cleanup.yaml similarity index 100% rename from tests/kuttl/tests/designate_tls/06-cleanup.yaml rename to test/kuttl/tests/designate_tls/06-cleanup.yaml