From e63d3fabbe4ec8c1aedbdff505f3b801482ca525 Mon Sep 17 00:00:00 2001 From: Dan Prince Date: Wed, 12 Nov 2025 13:43:42 -0500 Subject: [PATCH] Upgrade to operator-sdk 1.41.1 Rescaffold the keystone-operator to operator-sdk 1.41.1, which includes: - Reorganize project structure (pkg/ -> internal/) - Move webhook implementations to internal/webhook/v1beta1/ - Add new cmd/main.go entrypoint with updated controller initialization - Update RBAC, certmanager, and prometheus configurations - Enhance network policies for metrics and webhook traffic - Set keystone as defaulting resource in PROJECT file - Remove auto-generated test suite scaffolding - Update build workflow and Dockerfile to version 1.41.1 This upgrade modernizes the operator structure and aligns with the latest operator-sdk best practices. Jira: OSPRH-21924 Depends-On: openstack-k8s-operators/openstack-operator#1683 --- .ci-operator.yaml | 2 +- .../workflows/build-keystone-operator.yaml | 2 +- .github/workflows/force-bump-pr-manual.yaml | 2 +- .../workflows/force-bump-pr-scheduled.yaml | 2 +- Dockerfile | 2 +- Makefile | 10 +- PROJECT | 6 +- .../keystone.openstack.org_keystoneapis.yaml | 3 +- api/v1beta1/keystoneapi_types.go | 5 +- api/v1beta1/keystoneapi_webhook.go | 15 +- cmd/main.go | 314 ++++++++++++++++++ config/certmanager/certificate-metrics.yaml | 20 ++ config/certmanager/certificate-webhook.yaml | 20 ++ config/certmanager/certificate.yaml | 39 --- config/certmanager/issuer.yaml | 13 + config/certmanager/kustomization.yaml | 4 +- config/certmanager/kustomizeconfig.yaml | 10 +- .../keystone.openstack.org_keystoneapis.yaml | 3 +- config/crd/kustomization.yaml | 19 +- .../patches/cainjection_in_keystoneapis.yaml | 7 - .../cainjection_in_keystoneendpoints.yaml | 7 - .../cainjection_in_keystoneservices.yaml | 7 - .../crd/patches/webhook_in_keystoneapis.yaml | 16 - .../patches/webhook_in_keystoneendpoints.yaml | 16 - .../patches/webhook_in_keystoneservices.yaml | 16 - .../default/cert_metrics_manager_patch.yaml | 30 ++ config/default/kustomization.yaml | 308 ++++++++++------- config/default/manager_auth_proxy_patch.yaml | 34 -- config/default/manager_config_patch.yaml | 20 -- config/default/manager_default_images.yaml | 15 - config/default/manager_metrics_patch.yaml | 4 + config/default/manager_webhook_patch.yaml | 54 +-- .../metrics_service.yaml} | 7 +- config/default/webhookcainjection_patch.yaml | 29 -- config/manager/controller_manager_config.yaml | 11 - config/manager/kustomization.yaml | 8 - config/manager/manager.yaml | 48 ++- ...ystone-operator.clusterserviceversion.yaml | 1 + config/manifests/kustomization.yaml | 3 +- .../network-policy/allow-metrics-traffic.yaml | 27 ++ .../network-policy/allow-webhook-traffic.yaml | 27 ++ config/network-policy/kustomization.yaml | 3 + config/prometheus/kustomization.yaml | 9 + config/prometheus/monitor.yaml | 13 +- config/prometheus/monitor_tls_patch.yaml | 19 ++ config/rbac/keystoneapi_admin_role.yaml | 27 ++ config/rbac/keystoneapi_editor_role.yaml | 11 +- config/rbac/keystoneapi_viewer_role.yaml | 11 +- config/rbac/keystoneendpoint_admin_role.yaml | 27 ++ config/rbac/keystoneendpoint_editor_role.yaml | 11 +- config/rbac/keystoneendpoint_viewer_role.yaml | 11 +- config/rbac/keystoneservice_admin_role.yaml | 27 ++ config/rbac/keystoneservice_editor_role.yaml | 11 +- config/rbac/keystoneservice_viewer_role.yaml | 11 +- config/rbac/kustomization.yaml | 29 +- config/rbac/leader_election_role.yaml | 3 + config/rbac/leader_election_role_binding.yaml | 3 + ...proxy_role.yaml => metrics_auth_role.yaml} | 2 +- ...ng.yaml => metrics_auth_role_binding.yaml} | 4 +- ...sterrole.yaml => metrics_reader_role.yaml} | 0 config/rbac/role_binding.yaml | 3 + config/rbac/service_account.yaml | 3 + config/scorecard/kustomization.yaml | 8 +- config/scorecard/patches/basic.config.yaml | 2 +- config/scorecard/patches/olm.config.yaml | 10 +- config/webhook/kustomizeconfig.yaml | 5 +- config/webhook/manifests.yaml | 4 +- config/webhook/service.yaml | 10 +- go.mod | 27 ++ go.sum | 62 ++++ .../controller}/keystoneapi_controller.go | 6 +- .../keystoneendpoint_controller.go | 2 +- .../controller}/keystoneservice_controller.go | 2 +- {pkg => internal}/keystone/bootstrap.go | 0 {pkg => internal}/keystone/cloudconfig.go | 0 {pkg => internal}/keystone/const.go | 0 {pkg => internal}/keystone/cronjob.go | 0 {pkg => internal}/keystone/dbsync.go | 0 {pkg => internal}/keystone/deployment.go | 0 {pkg => internal}/keystone/federation.go | 0 {pkg => internal}/keystone/fernet.go | 0 {pkg => internal}/keystone/funcs.go | 0 {pkg => internal}/keystone/volumes.go | 0 .../webhook/v1beta1/keystoneapi_webhook.go | 131 ++++++++ kuttl-test.yaml | 21 -- main.go | 197 ----------- {tests => test}/functional/base_test.go | 2 +- .../functional/keystoneapi_controller_test.go | 0 .../functional/keystoneapi_webhook_test.go | 0 {tests => test}/functional/suite_test.go | 14 +- .../common/assert_sample_deployment.yaml | 2 +- .../kuttl/common/assert_tls_cert.yaml | 0 .../kuttl/common/cleanup-keystone.yaml | 0 .../kuttl/common/errors_cleanup_keystone.yaml | 0 .../kuttl/common/keystoneapi_deploy.yaml | 0 .../kuttl/common/keystoneapi_tls_deploy.yaml | 0 .../kuttl/common/patch_keystone_deploy.yaml | 0 .../check_debug_in_keystone_pod_logs.sh | 0 .../kuttl/common/scripts/create_test_token.sh | 0 .../kuttl/common/scripts/rotate_token.sh | 0 .../common/scripts/test_invalid_token.sh | 0 .../common/scripts/validate_test_token.sh | 0 .../kuttl/common/tls_ca_bundle.yaml | 0 .../tls_cert_keystone-internal-svc.yaml | 0 .../common/tls_cert_keystone-public-svc.yaml | 0 .../change_keystone_config/00-assert.yaml | 0 .../00-deploy_keystone.yaml | 0 .../change_keystone_config/01-assert.yaml | 0 .../change_keystone_config/02-assert.yaml | 0 .../02-change_keystone_config.yaml | 0 .../03-cleanup-keystone.yaml | 0 .../change_keystone_config/03-errors.yaml | 0 .../tests/fernet_rotation/00-assert.yaml | 0 .../fernet_rotation/00-deploy_keystone.yaml | 0 .../tests/fernet_rotation/01-assert.yaml | 0 .../01-deploy_openstackclient.yaml | 0 .../tests/fernet_rotation/02-assert.yaml | 0 .../tests/fernet_rotation/02-rotate_keys.yaml | 0 .../tests/fernet_rotation/03-assert.yaml | 0 .../03-rotate_keys_until_invalidate.yaml | 0 .../04-cleanup-openstackclient.yaml | 0 .../fernet_rotation/05-cleanup-keystone.yaml | 0 .../tests/fernet_rotation/05-errors.yaml | 0 .../tests/keystone_resources/00-assert.yaml | 0 .../00-deploy_keystone.yaml | 0 .../tests/keystone_resources/01-assert.yaml | 0 .../01-deploy-keystoneservice.yaml | 0 .../tests/keystone_resources/02-assert.yaml | 0 .../02-deploy-keystoneendpoint.yaml | 0 .../tests/keystone_resources/03-assert.yaml | 0 .../03-cleanup-keystoneendpoint.yaml | 0 .../tests/keystone_resources/03-errors.yaml | 0 .../tests/keystone_resources/04-assert.yaml | 0 .../04-cleanup-keystoneservice.yaml | 0 .../tests/keystone_resources/04-errors.yaml | 0 .../05-cleanup-keystone.yaml | 0 .../tests/keystone_resources/05-errors.yaml | 0 .../kuttl/tests/keystone_scale/00-assert.yaml | 0 .../keystone_scale/00-deploy_keystone.yaml | 0 .../kuttl/tests/keystone_scale/01-assert.yaml | 0 .../keystone_scale/01-scale-keystoneapi.yaml | 0 .../kuttl/tests/keystone_scale/02-assert.yaml | 0 .../02-scale-down-keystoneapi.yaml | 0 .../kuttl/tests/keystone_scale/03-assert.yaml | 0 .../kuttl/tests/keystone_scale/03-errors.yaml | 0 .../03-scale-down-zero-keystoneapi.yaml | 0 .../keystone_scale/04-cleanup-keystone.yaml | 0 .../kuttl/tests/keystone_scale/04-errors.yaml | 0 .../kuttl/tests/keystone_tls/00-assert.yaml | 0 .../tests/keystone_tls/00-tls_ca_bundle.yaml | 0 .../00-tls_cert_keystone-internal-svc.yaml | 0 .../00-tls_cert_keystone-public-svc.yaml | 0 .../kuttl/tests/keystone_tls/01-assert.yaml | 0 .../01-keystoneapi_tls_deploy.yaml | 0 .../keystone_tls/02-cleanup-keystone.yaml | 0 .../kuttl/tests/keystone_tls/02-errors.yaml | 0 zuul.d/projects.yaml | 4 +- 157 files changed, 1239 insertions(+), 694 deletions(-) create mode 100644 cmd/main.go create mode 100644 config/certmanager/certificate-metrics.yaml create mode 100644 config/certmanager/certificate-webhook.yaml delete mode 100644 config/certmanager/certificate.yaml create mode 100644 config/certmanager/issuer.yaml delete mode 100644 config/crd/patches/cainjection_in_keystoneapis.yaml delete mode 100644 config/crd/patches/cainjection_in_keystoneendpoints.yaml delete mode 100644 config/crd/patches/cainjection_in_keystoneservices.yaml delete mode 100644 config/crd/patches/webhook_in_keystoneapis.yaml delete mode 100644 config/crd/patches/webhook_in_keystoneendpoints.yaml delete mode 100644 config/crd/patches/webhook_in_keystoneservices.yaml create mode 100644 config/default/cert_metrics_manager_patch.yaml delete mode 100644 config/default/manager_auth_proxy_patch.yaml delete mode 100644 config/default/manager_config_patch.yaml delete mode 100644 config/default/manager_default_images.yaml create mode 100644 config/default/manager_metrics_patch.yaml rename config/{rbac/auth_proxy_service.yaml => default/metrics_service.yaml} (53%) delete mode 100644 config/default/webhookcainjection_patch.yaml delete mode 100644 config/manager/controller_manager_config.yaml create mode 100644 config/network-policy/allow-metrics-traffic.yaml create mode 100644 config/network-policy/allow-webhook-traffic.yaml create mode 100644 config/network-policy/kustomization.yaml create mode 100644 config/prometheus/monitor_tls_patch.yaml create mode 100644 config/rbac/keystoneapi_admin_role.yaml create mode 100644 config/rbac/keystoneendpoint_admin_role.yaml create mode 100644 config/rbac/keystoneservice_admin_role.yaml rename config/rbac/{auth_proxy_role.yaml => metrics_auth_role.yaml} (90%) rename config/rbac/{auth_proxy_role_binding.yaml => metrics_auth_role_binding.yaml} (79%) rename config/rbac/{auth_proxy_client_clusterrole.yaml => metrics_reader_role.yaml} (100%) rename {controllers => internal/controller}/keystoneapi_controller.go (99%) rename {controllers => internal/controller}/keystoneendpoint_controller.go (99%) rename {controllers => internal/controller}/keystoneservice_controller.go (99%) rename {pkg => internal}/keystone/bootstrap.go (100%) rename {pkg => internal}/keystone/cloudconfig.go (100%) rename {pkg => internal}/keystone/const.go (100%) rename {pkg => internal}/keystone/cronjob.go (100%) rename {pkg => internal}/keystone/dbsync.go (100%) rename {pkg => internal}/keystone/deployment.go (100%) rename {pkg => internal}/keystone/federation.go (100%) rename {pkg => internal}/keystone/fernet.go (100%) rename {pkg => internal}/keystone/funcs.go (100%) rename {pkg => internal}/keystone/volumes.go (100%) create mode 100644 internal/webhook/v1beta1/keystoneapi_webhook.go delete mode 100644 kuttl-test.yaml delete mode 100644 main.go rename {tests => test}/functional/base_test.go (99%) rename {tests => test}/functional/keystoneapi_controller_test.go (100%) rename {tests => test}/functional/keystoneapi_webhook_test.go (100%) rename {tests => test}/functional/suite_test.go (95%) rename {tests => test}/kuttl/common/assert_sample_deployment.yaml (98%) rename {tests => test}/kuttl/common/assert_tls_cert.yaml (100%) rename {tests => test}/kuttl/common/cleanup-keystone.yaml (100%) rename {tests => test}/kuttl/common/errors_cleanup_keystone.yaml (100%) rename {tests => test}/kuttl/common/keystoneapi_deploy.yaml (100%) rename {tests => test}/kuttl/common/keystoneapi_tls_deploy.yaml (100%) rename {tests => test}/kuttl/common/patch_keystone_deploy.yaml (100%) rename {tests => test}/kuttl/common/scripts/check_debug_in_keystone_pod_logs.sh (100%) rename {tests => test}/kuttl/common/scripts/create_test_token.sh (100%) rename {tests => test}/kuttl/common/scripts/rotate_token.sh (100%) rename {tests => test}/kuttl/common/scripts/test_invalid_token.sh (100%) rename {tests => test}/kuttl/common/scripts/validate_test_token.sh (100%) rename {tests => test}/kuttl/common/tls_ca_bundle.yaml (100%) rename {tests => test}/kuttl/common/tls_cert_keystone-internal-svc.yaml (100%) rename {tests => test}/kuttl/common/tls_cert_keystone-public-svc.yaml (100%) rename {tests => test}/kuttl/tests/change_keystone_config/00-assert.yaml (100%) rename {tests => test}/kuttl/tests/change_keystone_config/00-deploy_keystone.yaml (100%) rename {tests => test}/kuttl/tests/change_keystone_config/01-assert.yaml (100%) rename {tests => test}/kuttl/tests/change_keystone_config/02-assert.yaml (100%) rename {tests => test}/kuttl/tests/change_keystone_config/02-change_keystone_config.yaml (100%) rename {tests => test}/kuttl/tests/change_keystone_config/03-cleanup-keystone.yaml (100%) rename {tests => test}/kuttl/tests/change_keystone_config/03-errors.yaml (100%) rename {tests => test}/kuttl/tests/fernet_rotation/00-assert.yaml (100%) rename {tests => test}/kuttl/tests/fernet_rotation/00-deploy_keystone.yaml (100%) rename {tests => test}/kuttl/tests/fernet_rotation/01-assert.yaml (100%) rename {tests => test}/kuttl/tests/fernet_rotation/01-deploy_openstackclient.yaml (100%) rename {tests => test}/kuttl/tests/fernet_rotation/02-assert.yaml (100%) rename {tests => test}/kuttl/tests/fernet_rotation/02-rotate_keys.yaml (100%) rename {tests => test}/kuttl/tests/fernet_rotation/03-assert.yaml (100%) rename {tests => test}/kuttl/tests/fernet_rotation/03-rotate_keys_until_invalidate.yaml (100%) rename {tests => test}/kuttl/tests/fernet_rotation/04-cleanup-openstackclient.yaml (100%) rename {tests => test}/kuttl/tests/fernet_rotation/05-cleanup-keystone.yaml (100%) rename {tests => test}/kuttl/tests/fernet_rotation/05-errors.yaml (100%) rename {tests => test}/kuttl/tests/keystone_resources/00-assert.yaml (100%) rename {tests => test}/kuttl/tests/keystone_resources/00-deploy_keystone.yaml (100%) rename {tests => test}/kuttl/tests/keystone_resources/01-assert.yaml (100%) rename {tests => test}/kuttl/tests/keystone_resources/01-deploy-keystoneservice.yaml (100%) rename {tests => test}/kuttl/tests/keystone_resources/02-assert.yaml (100%) rename {tests => test}/kuttl/tests/keystone_resources/02-deploy-keystoneendpoint.yaml (100%) rename {tests => test}/kuttl/tests/keystone_resources/03-assert.yaml (100%) rename {tests => test}/kuttl/tests/keystone_resources/03-cleanup-keystoneendpoint.yaml (100%) rename {tests => test}/kuttl/tests/keystone_resources/03-errors.yaml (100%) rename {tests => test}/kuttl/tests/keystone_resources/04-assert.yaml (100%) rename {tests => test}/kuttl/tests/keystone_resources/04-cleanup-keystoneservice.yaml (100%) rename {tests => test}/kuttl/tests/keystone_resources/04-errors.yaml (100%) rename {tests => test}/kuttl/tests/keystone_resources/05-cleanup-keystone.yaml (100%) rename {tests => test}/kuttl/tests/keystone_resources/05-errors.yaml (100%) rename {tests => test}/kuttl/tests/keystone_scale/00-assert.yaml (100%) rename {tests => test}/kuttl/tests/keystone_scale/00-deploy_keystone.yaml (100%) rename {tests => test}/kuttl/tests/keystone_scale/01-assert.yaml (100%) rename {tests => test}/kuttl/tests/keystone_scale/01-scale-keystoneapi.yaml (100%) rename {tests => test}/kuttl/tests/keystone_scale/02-assert.yaml (100%) rename {tests => test}/kuttl/tests/keystone_scale/02-scale-down-keystoneapi.yaml (100%) rename {tests => test}/kuttl/tests/keystone_scale/03-assert.yaml (100%) rename {tests => test}/kuttl/tests/keystone_scale/03-errors.yaml (100%) rename {tests => test}/kuttl/tests/keystone_scale/03-scale-down-zero-keystoneapi.yaml (100%) rename {tests => test}/kuttl/tests/keystone_scale/04-cleanup-keystone.yaml (100%) rename {tests => test}/kuttl/tests/keystone_scale/04-errors.yaml (100%) rename {tests => test}/kuttl/tests/keystone_tls/00-assert.yaml (100%) rename {tests => test}/kuttl/tests/keystone_tls/00-tls_ca_bundle.yaml (100%) rename {tests => test}/kuttl/tests/keystone_tls/00-tls_cert_keystone-internal-svc.yaml (100%) rename {tests => test}/kuttl/tests/keystone_tls/00-tls_cert_keystone-public-svc.yaml (100%) rename {tests => test}/kuttl/tests/keystone_tls/01-assert.yaml (100%) rename {tests => test}/kuttl/tests/keystone_tls/01-keystoneapi_tls_deploy.yaml (100%) rename {tests => test}/kuttl/tests/keystone_tls/02-cleanup-keystone.yaml (100%) rename {tests => test}/kuttl/tests/keystone_tls/02-errors.yaml (100%) diff --git a/.ci-operator.yaml b/.ci-operator.yaml index 1a05e6069..df7900c64 100644 --- a/.ci-operator.yaml +++ b/.ci-operator.yaml @@ -1,4 +1,4 @@ build_root_image: name: tools namespace: openstack-k8s-operators - tag: ci-build-root-golang-1.24-sdk-1.31 + tag: ci-build-root-golang-1.24-sdk-1.41.1 diff --git a/.github/workflows/build-keystone-operator.yaml b/.github/workflows/build-keystone-operator.yaml index 0dc668f97..5c2256352 100644 --- a/.github/workflows/build-keystone-operator.yaml +++ b/.github/workflows/build-keystone-operator.yaml @@ -16,7 +16,7 @@ jobs: with: operator_name: keystone go_version: 1.24.x - operator_sdk_version: 1.31.0 + operator_sdk_version: 1.41.1 secrets: IMAGENAMESPACE: ${{ secrets.IMAGENAMESPACE }} QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }} diff --git a/.github/workflows/force-bump-pr-manual.yaml b/.github/workflows/force-bump-pr-manual.yaml index 82917fcbb..0d1e319be 100644 --- a/.github/workflows/force-bump-pr-manual.yaml +++ b/.github/workflows/force-bump-pr-manual.yaml @@ -9,6 +9,6 @@ jobs: with: operator_name: keystone branch_name: ${{ github.ref_name }} - custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.31 + custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.41.1 secrets: FORCE_BUMP_PULL_REQUEST_PAT: ${{ secrets.FORCE_BUMP_PULL_REQUEST_PAT }} diff --git a/.github/workflows/force-bump-pr-scheduled.yaml b/.github/workflows/force-bump-pr-scheduled.yaml index 0a2e7e979..aed953435 100644 --- a/.github/workflows/force-bump-pr-scheduled.yaml +++ b/.github/workflows/force-bump-pr-scheduled.yaml @@ -10,6 +10,6 @@ jobs: uses: openstack-k8s-operators/openstack-k8s-operators-ci/.github/workflows/force-bump-branches.yaml@main with: operator_name: keystone - custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.31 + custom_image: quay.io/openstack-k8s-operators/openstack-k8s-operators-ci-build-tools:golang-1.24-sdk-1.41.1 secrets: FORCE_BUMP_PULL_REQUEST_PAT: ${{ secrets.FORCE_BUMP_PULL_REQUEST_PAT }} diff --git a/Dockerfile b/Dockerfile index 0c487fda0..3f06e4cb3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -26,7 +26,7 @@ RUN mkdir -p ${DEST_ROOT}/usr/local/bin/ RUN if [ ! -f $CACHITO_ENV_FILE ]; then go mod download ; fi # Build manager -RUN if [ -f $CACHITO_ENV_FILE ] ; then source $CACHITO_ENV_FILE ; fi ; env ${GO_BUILD_EXTRA_ENV_ARGS} go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/manager main.go +RUN if [ -f $CACHITO_ENV_FILE ] ; then source $CACHITO_ENV_FILE ; fi ; env ${GO_BUILD_EXTRA_ENV_ARGS} go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/manager cmd/main.go RUN cp -r templates ${DEST_ROOT}/templates diff --git a/Makefile b/Makefile index 82e2539d4..8f6b4ca75 100644 --- a/Makefile +++ b/Makefile @@ -48,7 +48,7 @@ endif # Set the Operator SDK version to use. By default, what is installed on the system is used. # This is useful for CI or a project to utilize a specific version of the operator-sdk toolkit. -OPERATOR_SDK_VERSION ?= v1.31.0 +OPERATOR_SDK_VERSION ?= v1.41.1 # Image URL to use all building/pushing image targets DEFAULT_IMG ?= quay.io/openstack-k8s-operators/keystone-operator:latest @@ -129,13 +129,13 @@ PROC_CMD = --procs ${PROCS} .PHONY: test test: manifests generate fmt vet envtest ginkgo ## Run tests. - KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" $(GINKGO) --trace --cover --coverpkg=../../pkg/keystone,../../controllers,../../api/v1beta1 --coverprofile cover.out --covermode=atomic ${PROC_CMD} $(GINKGO_ARGS) ./tests/... + KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" $(GINKGO) --trace --cover --coverpkg=../../internal/keystone,../../internal/controller,../../api/v1beta1 --coverprofile cover.out --covermode=atomic ${PROC_CMD} $(GINKGO_ARGS) ./test/... ##@ Build .PHONY: build build: generate fmt vet ## Build manager binary. - go build -o bin/manager main.go + go build -o bin/manager cmd/main.go .PHONY: run run: export METRICS_PORT?=8080 @@ -144,7 +144,7 @@ run: export PPROF_PORT?=8082 run: export ENABLE_WEBHOOKS?=false run: manifests generate fmt vet ## Run a controller from your host. /bin/bash hack/clean_local_webhook.sh - go run ./main.go -metrics-bind-address ":$(METRICS_PORT)" -health-probe-bind-address ":$(HEALTH_PORT)" -pprof-bind-address ":$(PPROF_PORT)" + go run ./cmd/main.go -metrics-bind-address ":$(METRICS_PORT)" -health-probe-bind-address ":$(HEALTH_PORT)" -pprof-bind-address ":$(PPROF_PORT)" .PHONY: docker-build docker-build: test ## Build docker image with the manager. @@ -208,7 +208,7 @@ ENVTEST ?= $(LOCALBIN)/setup-envtest GINKGO ?= $(LOCALBIN)/ginkgo ## Tool Versions -KUSTOMIZE_VERSION ?= v3.8.7 +KUSTOMIZE_VERSION ?= v5.6.0 CONTROLLER_TOOLS_VERSION ?= v0.18.0 GOTOOLCHAIN_VERSION ?= go1.24.0 diff --git a/PROJECT b/PROJECT index 9a880b5ba..ca80028ed 100644 --- a/PROJECT +++ b/PROJECT @@ -1,6 +1,10 @@ +# Code generated by tool. DO NOT EDIT. +# This file is used to track the info used to scaffold your project +# and allow the plugins properly work. +# More info: https://book.kubebuilder.io/reference/project-config.html domain: openstack.org layout: -- go.kubebuilder.io/v3 +- go.kubebuilder.io/v4 plugins: manifests.sdk.operatorframework.io/v2: {} scorecard.sdk.operatorframework.io/v2: {} diff --git a/api/bases/keystone.openstack.org_keystoneapis.yaml b/api/bases/keystone.openstack.org_keystoneapis.yaml index 71aa4b6d9..3e57d2e9a 100644 --- a/api/bases/keystone.openstack.org_keystoneapis.yaml +++ b/api/bases/keystone.openstack.org_keystoneapis.yaml @@ -50,6 +50,7 @@ spec: metadata: type: object spec: + description: KeystoneAPISpec defines the desired state of KeystoneAPI properties: adminProject: default: admin @@ -102,7 +103,7 @@ spec: description: ExtraMounts containing conf files items: description: |- - KeystoneExtraVolMounts exposes additional parameters processed by keystone-operator + KeystoneExtraMounts exposes additional parameters processed by keystone-operator and defines the common VolMounts structure provided by the main storage module properties: extraVol: diff --git a/api/v1beta1/keystoneapi_types.go b/api/v1beta1/keystoneapi_types.go index 3f57c98c9..c65ab6c7f 100644 --- a/api/v1beta1/keystoneapi_types.go +++ b/api/v1beta1/keystoneapi_types.go @@ -53,6 +53,7 @@ const ( APIDefaultTimeout = 60 ) +// KeystoneAPISpec defines the desired state of KeystoneAPI type KeystoneAPISpec struct { KeystoneAPISpecCore `json:",inline"` @@ -61,7 +62,7 @@ type KeystoneAPISpec struct { ContainerImage string `json:"containerImage"` } -// KeystoneAPISpec defines the desired state of KeystoneAPI +// KeystoneAPISpecCore defines the desired state of KeystoneAPI core spec type KeystoneAPISpecCore struct { // +kubebuilder:validation:Required // MariaDB instance name @@ -348,7 +349,7 @@ func SetupDefaults() { SetupKeystoneAPIDefaults(keystoneDefaults) } -// KeystoneExtraVolMounts exposes additional parameters processed by keystone-operator +// KeystoneExtraMounts exposes additional parameters processed by keystone-operator // and defines the common VolMounts structure provided by the main storage module type KeystoneExtraMounts struct { // +kubebuilder:validation:Optional diff --git a/api/v1beta1/keystoneapi_webhook.go b/api/v1beta1/keystoneapi_webhook.go index b22fc1ad0..1fc812d19 100644 --- a/api/v1beta1/keystoneapi_webhook.go +++ b/api/v1beta1/keystoneapi_webhook.go @@ -29,7 +29,6 @@ import ( apierrors "k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/util/validation/field" - ctrl "sigs.k8s.io/controller-runtime" logf "sigs.k8s.io/controller-runtime/pkg/log" "sigs.k8s.io/controller-runtime/pkg/webhook" "sigs.k8s.io/controller-runtime/pkg/webhook/admission" @@ -53,15 +52,6 @@ func SetupKeystoneAPIDefaults(defaults KeystoneAPIDefaults) { keystoneapilog.Info("KeystoneAPI defaults initialized", "defaults", defaults) } -// SetupWebhookWithManager sets up the webhook with the Manager -func (r *KeystoneAPI) SetupWebhookWithManager(mgr ctrl.Manager) error { - return ctrl.NewWebhookManagedBy(mgr). - For(r). - Complete() -} - -//+kubebuilder:webhook:path=/mutate-keystone-openstack-org-v1beta1-keystoneapi,mutating=true,failurePolicy=fail,sideEffects=None,groups=keystone.openstack.org,resources=keystoneapis,verbs=create;update,versions=v1beta1,name=mkeystoneapi.kb.io,admissionReviewVersions=v1 - var _ webhook.Defaulter = &KeystoneAPI{} // Default implements webhook.Defaulter so a webhook will be registered for the type @@ -88,9 +78,6 @@ func (spec *KeystoneAPISpecCore) Default() { } } -// TODO(user): change verbs to "verbs=create;update;delete" if you want to enable deletion validation. -//+kubebuilder:webhook:path=/validate-keystone-openstack-org-v1beta1-keystoneapi,mutating=false,failurePolicy=fail,sideEffects=None,groups=keystone.openstack.org,resources=keystoneapis,verbs=create;update,versions=v1beta1,name=vkeystoneapi.kb.io,admissionReviewVersions=v1 - var _ webhook.Validator = &KeystoneAPI{} // ValidateCreate implements webhook.Validator so a webhook will be registered for the type @@ -117,6 +104,7 @@ func (spec *KeystoneAPISpec) ValidateCreate(basePath *field.Path, namespace stri return spec.KeystoneAPISpecCore.ValidateCreate(basePath, namespace) } +// ValidateCreate validates the KeystoneAPISpecCore spec during creation func (spec *KeystoneAPISpecCore) ValidateCreate(basePath *field.Path, namespace string) field.ErrorList { var allErrs field.ErrorList @@ -159,6 +147,7 @@ func (spec *KeystoneAPISpec) ValidateUpdate(old KeystoneAPISpec, basePath *field return spec.KeystoneAPISpecCore.ValidateUpdate(old.KeystoneAPISpecCore, basePath, namespace) } +// ValidateUpdate validates the KeystoneAPISpecCore spec during update func (spec *KeystoneAPISpecCore) ValidateUpdate(_ KeystoneAPISpecCore, basePath *field.Path, namespace string) field.ErrorList { var allErrs field.ErrorList diff --git a/cmd/main.go b/cmd/main.go new file mode 100644 index 000000000..e6133c058 --- /dev/null +++ b/cmd/main.go @@ -0,0 +1,314 @@ +/* +Copyright 2025. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Package main is the entry point for the Keystone operator. +package main + +import ( + "crypto/tls" + "flag" + "os" + "path/filepath" + + // Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.) + // to ensure that exec-entrypoint and run can make use of them. + _ "k8s.io/client-go/plugin/pkg/client/auth" + + "k8s.io/apimachinery/pkg/runtime" + utilruntime "k8s.io/apimachinery/pkg/util/runtime" + clientgoscheme "k8s.io/client-go/kubernetes/scheme" + ctrl "sigs.k8s.io/controller-runtime" + "sigs.k8s.io/controller-runtime/pkg/certwatcher" + "sigs.k8s.io/controller-runtime/pkg/healthz" + "sigs.k8s.io/controller-runtime/pkg/log/zap" + "sigs.k8s.io/controller-runtime/pkg/metrics/filters" + metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server" + "sigs.k8s.io/controller-runtime/pkg/webhook" + + "github.com/openstack-k8s-operators/keystone-operator/internal/controller" + webhookv1beta1 "github.com/openstack-k8s-operators/keystone-operator/internal/webhook/v1beta1" + + // +kubebuilder:scaffold:imports + "context" + + networkv1 "github.com/k8snetworkplumbingwg/network-attachment-definition-client/pkg/apis/k8s.cni.cncf.io/v1" + memcachedv1 "github.com/openstack-k8s-operators/infra-operator/apis/memcached/v1beta1" + rabbitmqv1 "github.com/openstack-k8s-operators/infra-operator/apis/rabbitmq/v1beta1" + topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" + keystonev1 "github.com/openstack-k8s-operators/keystone-operator/api/v1beta1" + "github.com/openstack-k8s-operators/lib-common/modules/common/operator" + mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1" + "k8s.io/client-go/kubernetes" + "sigs.k8s.io/controller-runtime/pkg/client/config" +) + +var ( + scheme = runtime.NewScheme() + setupLog = ctrl.Log.WithName("setup") +) + +func init() { + utilruntime.Must(clientgoscheme.AddToScheme(scheme)) + utilruntime.Must(keystonev1.AddToScheme(scheme)) + utilruntime.Must(mariadbv1.AddToScheme(scheme)) + utilruntime.Must(rabbitmqv1.AddToScheme(scheme)) + utilruntime.Must(memcachedv1.AddToScheme(scheme)) + utilruntime.Must(networkv1.AddToScheme(scheme)) + utilruntime.Must(topologyv1.AddToScheme(scheme)) + //+kubebuilder:scaffold:scheme +} + +// nolint:gocyclo +func main() { + var metricsAddr string + var metricsCertPath, metricsCertName, metricsCertKey string + var webhookCertPath, webhookCertName, webhookCertKey string + var enableLeaderElection bool + var probeAddr string + var secureMetrics bool + var enableHTTP2 bool + var tlsOpts []func(*tls.Config) + flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+ + "Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.") + flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.") + flag.BoolVar(&enableLeaderElection, "leader-elect", false, + "Enable leader election for controller manager. "+ + "Enabling this will ensure there is only one active controller manager.") + flag.BoolVar(&secureMetrics, "metrics-secure", true, + "If set, the metrics endpoint is served securely via HTTPS. Use --metrics-secure=false to use HTTP instead.") + flag.StringVar(&webhookCertPath, "webhook-cert-path", "", "The directory that contains the webhook certificate.") + flag.StringVar(&webhookCertName, "webhook-cert-name", "tls.crt", "The name of the webhook certificate file.") + flag.StringVar(&webhookCertKey, "webhook-cert-key", "tls.key", "The name of the webhook key file.") + flag.StringVar(&metricsCertPath, "metrics-cert-path", "", + "The directory that contains the metrics server certificate.") + flag.StringVar(&metricsCertName, "metrics-cert-name", "tls.crt", "The name of the metrics server certificate file.") + flag.StringVar(&metricsCertKey, "metrics-cert-key", "tls.key", "The name of the metrics server key file.") + flag.BoolVar(&enableHTTP2, "enable-http2", false, + "If set, HTTP/2 will be enabled for the metrics and webhook servers") + opts := zap.Options{ + Development: true, + } + opts.BindFlags(flag.CommandLine) + flag.Parse() + + ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts))) + + // if the enable-http2 flag is false (the default), http/2 should be disabled + // due to its vulnerabilities. More specifically, disabling http/2 will + // prevent from being vulnerable to the HTTP/2 Stream Cancellation and + // Rapid Reset CVEs. For more information see: + // - https://github.com/advisories/GHSA-qppj-fm5r-hxr3 + // - https://github.com/advisories/GHSA-4374-p667-p6c8 + disableHTTP2 := func(c *tls.Config) { + setupLog.Info("disabling http/2") + c.NextProtos = []string{"http/1.1"} + } + + if !enableHTTP2 { + tlsOpts = append(tlsOpts, disableHTTP2) + } + + // Create watchers for metrics and webhooks certificates + var metricsCertWatcher, webhookCertWatcher *certwatcher.CertWatcher + + // Initial webhook TLS options + webhookTLSOpts := tlsOpts + + if len(webhookCertPath) > 0 { + setupLog.Info("Initializing webhook certificate watcher using provided certificates", + "webhook-cert-path", webhookCertPath, "webhook-cert-name", webhookCertName, "webhook-cert-key", webhookCertKey) + + var err error + webhookCertWatcher, err = certwatcher.New( + filepath.Join(webhookCertPath, webhookCertName), + filepath.Join(webhookCertPath, webhookCertKey), + ) + if err != nil { + setupLog.Error(err, "Failed to initialize webhook certificate watcher") + os.Exit(1) + } + + webhookTLSOpts = append(webhookTLSOpts, func(config *tls.Config) { + config.GetCertificate = webhookCertWatcher.GetCertificate + }) + } + + webhookServer := webhook.NewServer(webhook.Options{ + TLSOpts: webhookTLSOpts, + }) + + // Metrics endpoint is enabled in 'config/default/kustomization.yaml'. The Metrics options configure the server. + // More info: + // - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.21.0/pkg/metrics/server + // - https://book.kubebuilder.io/reference/metrics.html + metricsServerOptions := metricsserver.Options{ + BindAddress: metricsAddr, + SecureServing: secureMetrics, + TLSOpts: tlsOpts, + } + + if secureMetrics { + // FilterProvider is used to protect the metrics endpoint with authn/authz. + // These configurations ensure that only authorized users and service accounts + // can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info: + // https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.21.0/pkg/metrics/filters#WithAuthenticationAndAuthorization + metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization + } + + // If the certificate is not specified, controller-runtime will automatically + // generate self-signed certificates for the metrics server. While convenient for development and testing, + // this setup is not recommended for production. + // + // TODO(user): If you enable certManager, uncomment the following lines: + // - [METRICS-WITH-CERTS] at config/default/kustomization.yaml to generate and use certificates + // managed by cert-manager for the metrics server. + // - [PROMETHEUS-WITH-CERTS] at config/prometheus/kustomization.yaml for TLS certification. + if len(metricsCertPath) > 0 { + setupLog.Info("Initializing metrics certificate watcher using provided certificates", + "metrics-cert-path", metricsCertPath, "metrics-cert-name", metricsCertName, "metrics-cert-key", metricsCertKey) + + var err error + metricsCertWatcher, err = certwatcher.New( + filepath.Join(metricsCertPath, metricsCertName), + filepath.Join(metricsCertPath, metricsCertKey), + ) + if err != nil { + setupLog.Error(err, "to initialize metrics certificate watcher", "error", err) + os.Exit(1) + } + + metricsServerOptions.TLSOpts = append(metricsServerOptions.TLSOpts, func(config *tls.Config) { + config.GetCertificate = metricsCertWatcher.GetCertificate + }) + } + + // LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily + // when the Manager ends. This requires the binary to immediately end when the + // Manager is stopped, otherwise, this setting is unsafe. Setting this significantly + // speeds up voluntary leader transitions as the new leader don't have to wait + // LeaseDuration time first. + // + // In the default scaffold provided, the program ends immediately after + // the manager stops, so would be fine to enable this option. However, + // if you are doing or is intended to do any operation such as perform cleanups + // after the manager stops then its usage might be unsafe. + // LeaderElectionReleaseOnCancel: true, + options := ctrl.Options{ + Scheme: scheme, + Metrics: metricsServerOptions, + WebhookServer: webhookServer, + HealthProbeBindAddress: probeAddr, + LeaderElection: enableLeaderElection, + LeaderElectionID: "6012128b.openstack.org", + } + + // apply common openstack operator manager options + err := operator.SetManagerOptions(&options, setupLog) + if err != nil { + setupLog.Error(err, "unable to set manager options") + os.Exit(1) + } + + mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), options) + if err != nil { + setupLog.Error(err, "unable to start manager") + os.Exit(1) + } + + cfg, err := config.GetConfig() + if err != nil { + setupLog.Error(err, "") + os.Exit(1) + } + kclient, err := kubernetes.NewForConfig(cfg) + if err != nil { + setupLog.Error(err, "") + os.Exit(1) + } + if err != nil { + setupLog.Error(err, "unable to start manager") + os.Exit(1) + } + + // Setup webhook defaults + keystonev1.SetupDefaults() + + if err := (&controller.KeystoneAPIReconciler{ + Client: mgr.GetClient(), + Scheme: mgr.GetScheme(), + Kclient: kclient, + }).SetupWithManager(context.Background(), mgr); err != nil { + setupLog.Error(err, "unable to create controller", "controller", "KeystoneAPI") + os.Exit(1) + } + if err := (&controller.KeystoneServiceReconciler{ + Client: mgr.GetClient(), + Scheme: mgr.GetScheme(), + Kclient: kclient, + }).SetupWithManager(mgr); err != nil { + setupLog.Error(err, "unable to create controller", "controller", "KeystoneService") + os.Exit(1) + } + if err := (&controller.KeystoneEndpointReconciler{ + Client: mgr.GetClient(), + Scheme: mgr.GetScheme(), + Kclient: kclient, + }).SetupWithManager(mgr); err != nil { + setupLog.Error(err, "unable to create controller", "controller", "KeystoneEndpoint") + os.Exit(1) + } + // nolint:goconst + checker := healthz.Ping + if os.Getenv("ENABLE_WEBHOOKS") != "false" { + if err := webhookv1beta1.SetupKeystoneAPIWebhookWithManager(mgr); err != nil { + setupLog.Error(err, "unable to create webhook", "webhook", "KeystoneAPI") + os.Exit(1) + } + checker = mgr.GetWebhookServer().StartedChecker() + } + // +kubebuilder:scaffold:builder + + if metricsCertWatcher != nil { + setupLog.Info("Adding metrics certificate watcher to manager") + if err := mgr.Add(metricsCertWatcher); err != nil { + setupLog.Error(err, "unable to add metrics certificate watcher to manager") + os.Exit(1) + } + } + + if webhookCertWatcher != nil { + setupLog.Info("Adding webhook certificate watcher to manager") + if err := mgr.Add(webhookCertWatcher); err != nil { + setupLog.Error(err, "unable to add webhook certificate watcher to manager") + os.Exit(1) + } + } + + if err := mgr.AddHealthzCheck("healthz", checker); err != nil { + setupLog.Error(err, "unable to set up health check") + os.Exit(1) + } + if err := mgr.AddReadyzCheck("readyz", checker); err != nil { + setupLog.Error(err, "unable to set up ready check") + os.Exit(1) + } + + setupLog.Info("starting manager") + if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil { + setupLog.Error(err, "problem running manager") + os.Exit(1) + } +} diff --git a/config/certmanager/certificate-metrics.yaml b/config/certmanager/certificate-metrics.yaml new file mode 100644 index 000000000..2f83d049e --- /dev/null +++ b/config/certmanager/certificate-metrics.yaml @@ -0,0 +1,20 @@ +# The following manifests contain a self-signed issuer CR and a metrics certificate CR. +# More document can be found at https://docs.cert-manager.io +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize + name: metrics-certs # this name should match the one appeared in kustomizeconfig.yaml + namespace: system +spec: + dnsNames: + # SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize + # replacements in the config/default/kustomization.yaml file. + - SERVICE_NAME.SERVICE_NAMESPACE.svc + - SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local + issuerRef: + kind: Issuer + name: selfsigned-issuer + secretName: metrics-server-cert diff --git a/config/certmanager/certificate-webhook.yaml b/config/certmanager/certificate-webhook.yaml new file mode 100644 index 000000000..fc5267466 --- /dev/null +++ b/config/certmanager/certificate-webhook.yaml @@ -0,0 +1,20 @@ +# The following manifests contain a self-signed issuer CR and a certificate CR. +# More document can be found at https://docs.cert-manager.io +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize + name: serving-cert # this name should match the one appeared in kustomizeconfig.yaml + namespace: system +spec: + # SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize + # replacements in the config/default/kustomization.yaml file. + dnsNames: + - SERVICE_NAME.SERVICE_NAMESPACE.svc + - SERVICE_NAME.SERVICE_NAMESPACE.svc.cluster.local + issuerRef: + kind: Issuer + name: selfsigned-issuer + secretName: webhook-server-cert diff --git a/config/certmanager/certificate.yaml b/config/certmanager/certificate.yaml deleted file mode 100644 index b5b6d8bab..000000000 --- a/config/certmanager/certificate.yaml +++ /dev/null @@ -1,39 +0,0 @@ -# The following manifests contain a self-signed issuer CR and a certificate CR. -# More document can be found at https://docs.cert-manager.io -# WARNING: Targets CertManager v1.0. Check https://cert-manager.io/docs/installation/upgrading/ for breaking changes. -apiVersion: cert-manager.io/v1 -kind: Issuer -metadata: - labels: - app.kubernetes.io/name: issuer - app.kubernetes.io/instance: selfsigned-issuer - app.kubernetes.io/component: certificate - app.kubernetes.io/created-by: keystone-operator - app.kubernetes.io/part-of: keystone-operator - app.kubernetes.io/managed-by: kustomize - name: selfsigned-issuer - namespace: system -spec: - selfSigned: {} ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - labels: - app.kubernetes.io/name: certificate - app.kubernetes.io/instance: serving-cert - app.kubernetes.io/component: certificate - app.kubernetes.io/created-by: keystone-operator - app.kubernetes.io/part-of: keystone-operator - app.kubernetes.io/managed-by: kustomize - name: serving-cert # this name should match the one appeared in kustomizeconfig.yaml - namespace: system -spec: - # $(SERVICE_NAME) and $(SERVICE_NAMESPACE) will be substituted by kustomize - dnsNames: - - $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc - - $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc.cluster.local - issuerRef: - kind: Issuer - name: selfsigned-issuer - secretName: webhook-server-cert # this secret will not be prefixed, since it's not managed by kustomize diff --git a/config/certmanager/issuer.yaml b/config/certmanager/issuer.yaml new file mode 100644 index 000000000..205f67c0d --- /dev/null +++ b/config/certmanager/issuer.yaml @@ -0,0 +1,13 @@ +# The following manifest contains a self-signed issuer CR. +# More information can be found at https://docs.cert-manager.io +# WARNING: Targets CertManager v1.0. Check https://cert-manager.io/docs/installation/upgrading/ for breaking changes. +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + labels: + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize + name: selfsigned-issuer + namespace: system +spec: + selfSigned: {} diff --git a/config/certmanager/kustomization.yaml b/config/certmanager/kustomization.yaml index bebea5a59..fcb7498e4 100644 --- a/config/certmanager/kustomization.yaml +++ b/config/certmanager/kustomization.yaml @@ -1,5 +1,7 @@ resources: -- certificate.yaml +- issuer.yaml +- certificate-webhook.yaml +- certificate-metrics.yaml configurations: - kustomizeconfig.yaml diff --git a/config/certmanager/kustomizeconfig.yaml b/config/certmanager/kustomizeconfig.yaml index e631f7773..cf6f89e88 100644 --- a/config/certmanager/kustomizeconfig.yaml +++ b/config/certmanager/kustomizeconfig.yaml @@ -1,4 +1,4 @@ -# This configuration is for teaching kustomize how to update name ref and var substitution +# This configuration is for teaching kustomize how to update name ref substitution nameReference: - kind: Issuer group: cert-manager.io @@ -6,11 +6,3 @@ nameReference: - kind: Certificate group: cert-manager.io path: spec/issuerRef/name - -varReference: -- kind: Certificate - group: cert-manager.io - path: spec/commonName -- kind: Certificate - group: cert-manager.io - path: spec/dnsNames diff --git a/config/crd/bases/keystone.openstack.org_keystoneapis.yaml b/config/crd/bases/keystone.openstack.org_keystoneapis.yaml index 71aa4b6d9..3e57d2e9a 100644 --- a/config/crd/bases/keystone.openstack.org_keystoneapis.yaml +++ b/config/crd/bases/keystone.openstack.org_keystoneapis.yaml @@ -50,6 +50,7 @@ spec: metadata: type: object spec: + description: KeystoneAPISpec defines the desired state of KeystoneAPI properties: adminProject: default: admin @@ -102,7 +103,7 @@ spec: description: ExtraMounts containing conf files items: description: |- - KeystoneExtraVolMounts exposes additional parameters processed by keystone-operator + KeystoneExtraMounts exposes additional parameters processed by keystone-operator and defines the common VolMounts structure provided by the main storage module properties: extraVol: diff --git a/config/crd/kustomization.yaml b/config/crd/kustomization.yaml index 05c6675eb..90edf0b4a 100644 --- a/config/crd/kustomization.yaml +++ b/config/crd/kustomization.yaml @@ -5,23 +5,14 @@ resources: - bases/keystone.openstack.org_keystoneapis.yaml - bases/keystone.openstack.org_keystoneservices.yaml - bases/keystone.openstack.org_keystoneendpoints.yaml -#+kubebuilder:scaffold:crdkustomizeresource +# +kubebuilder:scaffold:crdkustomizeresource patches: # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix. # patches here are for enabling the conversion webhook for each CRD -#- patches/webhook_in_keystoneapis.yaml -#- patches/webhook_in_keystoneservices.yaml -#- patches/webhook_in_keystoneendpoints.yaml -#+kubebuilder:scaffold:crdkustomizewebhookpatch - -# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix. -# patches here are for enabling the CA injection for each CRD -#- patches/cainjection_in_keystoneapis.yaml -#- patches/cainjection_in_keystoneservices.yaml -#- patches/cainjection_in_keystoneendpoints.yaml -#+kubebuilder:scaffold:crdkustomizecainjectionpatch +# +kubebuilder:scaffold:crdkustomizewebhookpatch +# [WEBHOOK] To enable webhook, uncomment the following section # the following config is for teaching kustomize how to do kustomization for CRDs. -configurations: -- kustomizeconfig.yaml +#configurations: +#- kustomizeconfig.yaml diff --git a/config/crd/patches/cainjection_in_keystoneapis.yaml b/config/crd/patches/cainjection_in_keystoneapis.yaml deleted file mode 100644 index 4c1d84955..000000000 --- a/config/crd/patches/cainjection_in_keystoneapis.yaml +++ /dev/null @@ -1,7 +0,0 @@ -# The following patch adds a directive for certmanager to inject CA into the CRD -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME) - name: keystoneapis.keystone.openstack.org diff --git a/config/crd/patches/cainjection_in_keystoneendpoints.yaml b/config/crd/patches/cainjection_in_keystoneendpoints.yaml deleted file mode 100644 index dbb018d5c..000000000 --- a/config/crd/patches/cainjection_in_keystoneendpoints.yaml +++ /dev/null @@ -1,7 +0,0 @@ -# The following patch adds a directive for certmanager to inject CA into the CRD -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME) - name: keystoneendpoints.keystone.openstack.org diff --git a/config/crd/patches/cainjection_in_keystoneservices.yaml b/config/crd/patches/cainjection_in_keystoneservices.yaml deleted file mode 100644 index a31c72f78..000000000 --- a/config/crd/patches/cainjection_in_keystoneservices.yaml +++ /dev/null @@ -1,7 +0,0 @@ -# The following patch adds a directive for certmanager to inject CA into the CRD -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME) - name: keystoneservices.keystone.openstack.org diff --git a/config/crd/patches/webhook_in_keystoneapis.yaml b/config/crd/patches/webhook_in_keystoneapis.yaml deleted file mode 100644 index b2e29e084..000000000 --- a/config/crd/patches/webhook_in_keystoneapis.yaml +++ /dev/null @@ -1,16 +0,0 @@ -# The following patch enables a conversion webhook for the CRD -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: keystoneapis.keystone.openstack.org -spec: - conversion: - strategy: Webhook - webhook: - clientConfig: - service: - namespace: system - name: webhook-service - path: /convert - conversionReviewVersions: - - v1 diff --git a/config/crd/patches/webhook_in_keystoneendpoints.yaml b/config/crd/patches/webhook_in_keystoneendpoints.yaml deleted file mode 100644 index dca542344..000000000 --- a/config/crd/patches/webhook_in_keystoneendpoints.yaml +++ /dev/null @@ -1,16 +0,0 @@ -# The following patch enables a conversion webhook for the CRD -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: keystoneendpoints.keystone.openstack.org -spec: - conversion: - strategy: Webhook - webhook: - clientConfig: - service: - namespace: system - name: webhook-service - path: /convert - conversionReviewVersions: - - v1 diff --git a/config/crd/patches/webhook_in_keystoneservices.yaml b/config/crd/patches/webhook_in_keystoneservices.yaml deleted file mode 100644 index b34df4586..000000000 --- a/config/crd/patches/webhook_in_keystoneservices.yaml +++ /dev/null @@ -1,16 +0,0 @@ -# The following patch enables a conversion webhook for the CRD -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: keystoneservices.keystone.openstack.org -spec: - conversion: - strategy: Webhook - webhook: - clientConfig: - service: - namespace: system - name: webhook-service - path: /convert - conversionReviewVersions: - - v1 diff --git a/config/default/cert_metrics_manager_patch.yaml b/config/default/cert_metrics_manager_patch.yaml new file mode 100644 index 000000000..d97501553 --- /dev/null +++ b/config/default/cert_metrics_manager_patch.yaml @@ -0,0 +1,30 @@ +# This patch adds the args, volumes, and ports to allow the manager to use the metrics-server certs. + +# Add the volumeMount for the metrics-server certs +- op: add + path: /spec/template/spec/containers/0/volumeMounts/- + value: + mountPath: /tmp/k8s-metrics-server/metrics-certs + name: metrics-certs + readOnly: true + +# Add the --metrics-cert-path argument for the metrics server +- op: add + path: /spec/template/spec/containers/0/args/- + value: --metrics-cert-path=/tmp/k8s-metrics-server/metrics-certs + +# Add the metrics-server certs volume configuration +- op: add + path: /spec/template/spec/volumes/- + value: + name: metrics-certs + secret: + secretName: metrics-server-cert + optional: false + items: + - key: ca.crt + path: ca.crt + - key: tls.crt + path: tls.crt + - key: tls.key + path: tls.key diff --git a/config/default/kustomization.yaml b/config/default/kustomization.yaml index e74b4e106..a1b1b0fe6 100644 --- a/config/default/kustomization.yaml +++ b/config/default/kustomization.yaml @@ -11,7 +11,6 @@ namePrefix: keystone-operator- # Labels to add to all resources and selectors. #labels: #- includeSelectors: true -# includeTemplates: true # pairs: # someName: someValue @@ -26,125 +25,210 @@ resources: #- ../certmanager # [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'. #- ../prometheus +# [METRICS] Expose the controller manager metrics service. +- metrics_service.yaml +# [NETWORK POLICY] Protect the /metrics endpoint and Webhook Server with NetworkPolicy. +# Only Pod(s) running a namespace labeled with 'metrics: enabled' will be able to gather the metrics. +# Only CR(s) which requires webhooks and are applied on namespaces labeled with 'webhooks: enabled' will +# be able to communicate with the Webhook Server. +#- ../network-policy +# Uncomment the patches line if you enable Metrics patches: -# Protect the /metrics endpoint by putting it behind auth. -# If you want your controller-manager to expose the /metrics -# endpoint w/o any authn/z, please comment the following line. -- path: manager_auth_proxy_patch.yaml +# [METRICS] The following patch will enable the metrics endpoint using HTTPS and the port :8443. +# More info: https://book.kubebuilder.io/reference/metrics +- path: manager_metrics_patch.yaml + target: + kind: Deployment -# Mount the controller config file for loading manager configurations -# through a ComponentConfig type -#- path: manager_config_patch.yaml +# Uncomment the patches line if you enable Metrics and CertManager +# [METRICS-WITH-CERTS] To enable metrics protected with certManager, uncomment the following line. +# This patch will protect the metrics with certManager self-signed certs. +#- path: cert_metrics_manager_patch.yaml +# target: +# kind: Deployment # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in # crd/kustomization.yaml - path: manager_webhook_patch.yaml - -# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. -# Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA injection in the admission webhooks. -# 'CERTMANAGER' needs to be enabled to use ca injection -#- path: webhookcainjection_patch.yaml - -# Injects our custom images (ENV variable settings) -- path: manager_default_images.yaml + target: + kind: Deployment # [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix. # Uncomment the following replacements to add the cert-manager CA injection annotations #replacements: -# - source: # Add cert-manager annotation to ValidatingWebhookConfiguration, MutatingWebhookConfiguration and CRDs -# kind: Certificate -# group: cert-manager.io -# version: v1 -# name: serving-cert # this name should match the one in certificate.yaml -# fieldPath: .metadata.namespace # namespace of the certificate CR -# targets: -# - select: -# kind: ValidatingWebhookConfiguration -# fieldPaths: -# - .metadata.annotations.[cert-manager.io/inject-ca-from] -# options: -# delimiter: '/' -# index: 0 -# create: true -# - select: -# kind: MutatingWebhookConfiguration -# fieldPaths: -# - .metadata.annotations.[cert-manager.io/inject-ca-from] -# options: -# delimiter: '/' -# index: 0 -# create: true -# - select: -# kind: CustomResourceDefinition -# fieldPaths: -# - .metadata.annotations.[cert-manager.io/inject-ca-from] -# options: -# delimiter: '/' -# index: 0 -# create: true -# - source: -# kind: Certificate -# group: cert-manager.io -# version: v1 -# name: serving-cert # this name should match the one in certificate.yaml -# fieldPath: .metadata.name -# targets: -# - select: -# kind: ValidatingWebhookConfiguration -# fieldPaths: -# - .metadata.annotations.[cert-manager.io/inject-ca-from] -# options: -# delimiter: '/' -# index: 1 -# create: true -# - select: -# kind: MutatingWebhookConfiguration -# fieldPaths: -# - .metadata.annotations.[cert-manager.io/inject-ca-from] -# options: -# delimiter: '/' -# index: 1 -# create: true -# - select: -# kind: CustomResourceDefinition -# fieldPaths: -# - .metadata.annotations.[cert-manager.io/inject-ca-from] -# options: -# delimiter: '/' -# index: 1 -# create: true -# - source: # Add cert-manager annotation to the webhook Service -# kind: Service -# version: v1 -# name: webhook-service -# fieldPath: .metadata.name # namespace of the service -# targets: -# - select: -# kind: Certificate -# group: cert-manager.io -# version: v1 -# fieldPaths: -# - .spec.dnsNames.0 -# - .spec.dnsNames.1 -# options: -# delimiter: '.' -# index: 0 -# create: true -# - source: -# kind: Service -# version: v1 -# name: webhook-service -# fieldPath: .metadata.namespace # namespace of the service -# targets: -# - select: -# kind: Certificate -# group: cert-manager.io -# version: v1 -# fieldPaths: -# - .spec.dnsNames.0 -# - .spec.dnsNames.1 -# options: -# delimiter: '.' -# index: 1 -# create: true +# - source: # Uncomment the following block to enable certificates for metrics +# kind: Service +# version: v1 +# name: controller-manager-metrics-service +# fieldPath: metadata.name +# targets: +# - select: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: metrics-certs +# fieldPaths: +# - spec.dnsNames.0 +# - spec.dnsNames.1 +# options: +# delimiter: '.' +# index: 0 +# create: true +# - select: # Uncomment the following to set the Service name for TLS config in Prometheus ServiceMonitor +# kind: ServiceMonitor +# group: monitoring.coreos.com +# version: v1 +# name: controller-manager-metrics-monitor +# fieldPaths: +# - spec.endpoints.0.tlsConfig.serverName +# options: +# delimiter: '.' +# index: 0 +# create: true +# +# - source: +# kind: Service +# version: v1 +# name: controller-manager-metrics-service +# fieldPath: metadata.namespace +# targets: +# - select: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: metrics-certs +# fieldPaths: +# - spec.dnsNames.0 +# - spec.dnsNames.1 +# options: +# delimiter: '.' +# index: 1 +# create: true +# - select: # Uncomment the following to set the Service namespace for TLS in Prometheus ServiceMonitor +# kind: ServiceMonitor +# group: monitoring.coreos.com +# version: v1 +# name: controller-manager-metrics-monitor +# fieldPaths: +# - spec.endpoints.0.tlsConfig.serverName +# options: +# delimiter: '.' +# index: 1 +# create: true +# +# - source: # Uncomment the following block if you have any webhook +# kind: Service +# version: v1 +# name: webhook-service +# fieldPath: .metadata.name # Name of the service +# targets: +# - select: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPaths: +# - .spec.dnsNames.0 +# - .spec.dnsNames.1 +# options: +# delimiter: '.' +# index: 0 +# create: true +# - source: +# kind: Service +# version: v1 +# name: webhook-service +# fieldPath: .metadata.namespace # Namespace of the service +# targets: +# - select: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPaths: +# - .spec.dnsNames.0 +# - .spec.dnsNames.1 +# options: +# delimiter: '.' +# index: 1 +# create: true +# +# - source: # Uncomment the following block if you have a ValidatingWebhook (--programmatic-validation) +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert # This name should match the one in certificate.yaml +# fieldPath: .metadata.namespace # Namespace of the certificate CR +# targets: +# - select: +# kind: ValidatingWebhookConfiguration +# fieldPaths: +# - .metadata.annotations.[cert-manager.io/inject-ca-from] +# options: +# delimiter: '/' +# index: 0 +# create: true +# - source: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPath: .metadata.name +# targets: +# - select: +# kind: ValidatingWebhookConfiguration +# fieldPaths: +# - .metadata.annotations.[cert-manager.io/inject-ca-from] +# options: +# delimiter: '/' +# index: 1 +# create: true +# +# - source: # Uncomment the following block if you have a DefaultingWebhook (--defaulting ) +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPath: .metadata.namespace # Namespace of the certificate CR +# targets: +# - select: +# kind: MutatingWebhookConfiguration +# fieldPaths: +# - .metadata.annotations.[cert-manager.io/inject-ca-from] +# options: +# delimiter: '/' +# index: 0 +# create: true +# - source: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPath: .metadata.name +# targets: +# - select: +# kind: MutatingWebhookConfiguration +# fieldPaths: +# - .metadata.annotations.[cert-manager.io/inject-ca-from] +# options: +# delimiter: '/' +# index: 1 +# create: true +# +# - source: # Uncomment the following block if you have a ConversionWebhook (--conversion) +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPath: .metadata.namespace # Namespace of the certificate CR +# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD. +# +kubebuilder:scaffold:crdkustomizecainjectionns +# - source: +# kind: Certificate +# group: cert-manager.io +# version: v1 +# name: serving-cert +# fieldPath: .metadata.name +# targets: # Do not remove or uncomment the following scaffold marker; required to generate code for target CRD. +# +kubebuilder:scaffold:crdkustomizecainjectionname diff --git a/config/default/manager_auth_proxy_patch.yaml b/config/default/manager_auth_proxy_patch.yaml deleted file mode 100644 index d875a08ae..000000000 --- a/config/default/manager_auth_proxy_patch.yaml +++ /dev/null @@ -1,34 +0,0 @@ -# This patch inject a sidecar container which is a HTTP proxy for the -# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews. -apiVersion: apps/v1 -kind: Deployment -metadata: - name: controller-manager - namespace: system -spec: - template: - spec: - containers: - - name: kube-rbac-proxy - image: quay.io/openstack-k8s-operators/kube-rbac-proxy:v0.16.0 - args: - - "--secure-listen-address=0.0.0.0:8443" - - "--upstream=http://127.0.0.1:8080/" - - "--logtostderr=true" - - "--v=0" - ports: - - containerPort: 8443 - protocol: TCP - name: https - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 5m - memory: 64Mi - - name: manager - args: - - "--health-probe-bind-address=:8081" - - "--metrics-bind-address=127.0.0.1:8080" - - "--leader-elect" diff --git a/config/default/manager_config_patch.yaml b/config/default/manager_config_patch.yaml deleted file mode 100644 index 6c400155c..000000000 --- a/config/default/manager_config_patch.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: controller-manager - namespace: system -spec: - template: - spec: - containers: - - name: manager - args: - - "--config=controller_manager_config.yaml" - volumeMounts: - - name: manager-config - mountPath: /controller_manager_config.yaml - subPath: controller_manager_config.yaml - volumes: - - name: manager-config - configMap: - name: manager-config diff --git a/config/default/manager_default_images.yaml b/config/default/manager_default_images.yaml deleted file mode 100644 index 64a4b87c2..000000000 --- a/config/default/manager_default_images.yaml +++ /dev/null @@ -1,15 +0,0 @@ -# This patch inject custom ENV settings to the manager container -# Used to set our default image locations -apiVersion: apps/v1 -kind: Deployment -metadata: - name: controller-manager - namespace: system -spec: - template: - spec: - containers: - - name: manager - env: - - name: RELATED_IMAGE_KEYSTONE_API_IMAGE_URL_DEFAULT - value: quay.io/podified-antelope-centos9/openstack-keystone:current-podified diff --git a/config/default/manager_metrics_patch.yaml b/config/default/manager_metrics_patch.yaml new file mode 100644 index 000000000..2aaef6536 --- /dev/null +++ b/config/default/manager_metrics_patch.yaml @@ -0,0 +1,4 @@ +# This patch adds the args to allow exposing the metrics endpoint using HTTPS +- op: add + path: /spec/template/spec/containers/0/args/0 + value: --metrics-bind-address=:8443 diff --git a/config/default/manager_webhook_patch.yaml b/config/default/manager_webhook_patch.yaml index 738de350b..963c8a4cc 100644 --- a/config/default/manager_webhook_patch.yaml +++ b/config/default/manager_webhook_patch.yaml @@ -1,23 +1,31 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: controller-manager - namespace: system -spec: - template: - spec: - containers: - - name: manager - ports: - - containerPort: 9443 - name: webhook-server - protocol: TCP - volumeMounts: - - mountPath: /tmp/k8s-webhook-server/serving-certs - name: cert - readOnly: true - volumes: - - name: cert - secret: - defaultMode: 420 - secretName: webhook-server-cert +# This patch ensures the webhook certificates are properly mounted in the manager container. +# It configures the necessary arguments, volumes, volume mounts, and container ports. + +# Add the --webhook-cert-path argument for configuring the webhook certificate path +- op: add + path: /spec/template/spec/containers/0/args/- + value: --webhook-cert-path=/tmp/k8s-webhook-server/serving-certs + +# Add the volumeMount for the webhook certificates +- op: add + path: /spec/template/spec/containers/0/volumeMounts/- + value: + mountPath: /tmp/k8s-webhook-server/serving-certs + name: webhook-certs + readOnly: true + +# Add the port configuration for the webhook server +- op: add + path: /spec/template/spec/containers/0/ports/- + value: + containerPort: 9443 + name: webhook-server + protocol: TCP + +# Add the volume configuration for the webhook certificates +- op: add + path: /spec/template/spec/volumes/- + value: + name: webhook-certs + secret: + secretName: webhook-server-cert diff --git a/config/rbac/auth_proxy_service.yaml b/config/default/metrics_service.yaml similarity index 53% rename from config/rbac/auth_proxy_service.yaml rename to config/default/metrics_service.yaml index aae07dbac..7c235df3f 100644 --- a/config/rbac/auth_proxy_service.yaml +++ b/config/default/metrics_service.yaml @@ -3,6 +3,8 @@ kind: Service metadata: labels: control-plane: controller-manager + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize name: controller-manager-metrics-service namespace: system spec: @@ -10,6 +12,7 @@ spec: - name: https port: 8443 protocol: TCP - targetPort: https + targetPort: 8443 selector: - openstack.org/operator-name: keystone + control-plane: controller-manager + app.kubernetes.io/name: keystone-operator diff --git a/config/default/webhookcainjection_patch.yaml b/config/default/webhookcainjection_patch.yaml deleted file mode 100644 index 72a8b90a6..000000000 --- a/config/default/webhookcainjection_patch.yaml +++ /dev/null @@ -1,29 +0,0 @@ -# This patch add annotation to admission webhook config and -# the variables $(CERTIFICATE_NAMESPACE) and $(CERTIFICATE_NAME) will be substituted by kustomize. -apiVersion: admissionregistration.k8s.io/v1 -kind: MutatingWebhookConfiguration -metadata: - labels: - app.kubernetes.io/name: mutatingwebhookconfiguration - app.kubernetes.io/instance: mutating-webhook-configuration - app.kubernetes.io/component: webhook - app.kubernetes.io/created-by: keystone-operator - app.kubernetes.io/part-of: keystone-operator - app.kubernetes.io/managed-by: kustomize - name: mutating-webhook-configuration - annotations: - cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME) ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: - labels: - app.kubernetes.io/name: validatingwebhookconfiguration - app.kubernetes.io/instance: validating-webhook-configuration - app.kubernetes.io/component: webhook - app.kubernetes.io/created-by: keystone-operator - app.kubernetes.io/part-of: keystone-operator - app.kubernetes.io/managed-by: kustomize - name: validating-webhook-configuration - annotations: - cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME) diff --git a/config/manager/controller_manager_config.yaml b/config/manager/controller_manager_config.yaml deleted file mode 100644 index 15c16b9c4..000000000 --- a/config/manager/controller_manager_config.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: controller-runtime.sigs.k8s.io/v1alpha1 -kind: ControllerManagerConfig -health: - healthProbeBindAddress: :8081 -metrics: - bindAddress: 127.0.0.1:8080 -webhook: - port: 9443 -leaderElection: - leaderElect: true - resourceName: 6012128b.openstack.org diff --git a/config/manager/kustomization.yaml b/config/manager/kustomization.yaml index ac2b11533..dbb0a708f 100644 --- a/config/manager/kustomization.yaml +++ b/config/manager/kustomization.yaml @@ -1,13 +1,5 @@ resources: - manager.yaml - -generatorOptions: - disableNameSuffixHash: true - -configMapGenerator: -- files: - - controller_manager_config.yaml - name: manager-config apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization images: diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml index a54c4f5c3..57bf2ef07 100644 --- a/config/manager/manager.yaml +++ b/config/manager/manager.yaml @@ -3,6 +3,8 @@ kind: Namespace metadata: labels: control-plane: controller-manager + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize name: system --- apiVersion: apps/v1 @@ -12,11 +14,13 @@ metadata: namespace: system labels: control-plane: controller-manager - openstack.org/operator-name: keystone + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize spec: selector: matchLabels: - openstack.org/operator-name: keystone + control-plane: controller-manager + app.kubernetes.io/name: keystone-operator replicas: 1 template: metadata: @@ -24,19 +28,49 @@ spec: kubectl.kubernetes.io/default-container: manager labels: control-plane: controller-manager - openstack.org/operator-name: keystone + app.kubernetes.io/name: keystone-operator spec: + # TODO(user): Uncomment the following code to configure the nodeAffinity expression + # according to the platforms which are supported by your solution. + # It is considered best practice to support multiple architectures. You can + # build your manager image using the makefile target docker-buildx. + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: kubernetes.io/arch + # operator: In + # values: + # - amd64 + # - arm64 + # - ppc64le + # - s390x + # - key: kubernetes.io/os + # operator: In + # values: + # - linux securityContext: + # Projects are configured by default to adhere to the "restricted" Pod Security Standards. + # This ensures that deployments meet the highest security requirements for Kubernetes. + # For more details, see: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted runAsNonRoot: true + seccompProfile: + type: RuntimeDefault containers: - command: - /manager args: - - --leader-elect + - --leader-elect + - --health-probe-bind-address=:8081 image: controller:latest name: manager + ports: [] securityContext: allowPrivilegeEscalation: false + capabilities: + drop: + - "ALL" livenessProbe: httpGet: path: /healthz @@ -54,9 +88,11 @@ spec: resources: limits: cpu: 500m - memory: 256Mi + memory: 128Mi requests: cpu: 10m - memory: 128Mi + memory: 64Mi + volumeMounts: [] + volumes: [] serviceAccountName: controller-manager terminationGracePeriodSeconds: 10 diff --git a/config/manifests/bases/keystone-operator.clusterserviceversion.yaml b/config/manifests/bases/keystone-operator.clusterserviceversion.yaml index 995177a6c..27ed75a8f 100644 --- a/config/manifests/bases/keystone-operator.clusterserviceversion.yaml +++ b/config/manifests/bases/keystone-operator.clusterserviceversion.yaml @@ -65,3 +65,4 @@ spec: name: Red Hat Inc. url: https://redhat.com/ version: 0.0.0 + minKubeVersion: 0.0.0 diff --git a/config/manifests/kustomization.yaml b/config/manifests/kustomization.yaml index 02e1be617..7227e7e56 100644 --- a/config/manifests/kustomization.yaml +++ b/config/manifests/kustomization.yaml @@ -20,7 +20,8 @@ resources: # # Remove the manager container's "cert" volumeMount, since OLM will create and mount a set of certs. # # Update the indices in this path if adding or removing containers/volumeMounts in the manager's Deployment. # - op: remove -# path: /spec/template/spec/containers/1/volumeMounts/0 + +# path: /spec/template/spec/containers/0/volumeMounts/0 # # Remove the "cert" volume, since OLM will create and mount a set of certs. # # Update the indices in this path if adding or removing volumes in the manager's Deployment. # - op: remove diff --git a/config/network-policy/allow-metrics-traffic.yaml b/config/network-policy/allow-metrics-traffic.yaml new file mode 100644 index 000000000..ca7e75bde --- /dev/null +++ b/config/network-policy/allow-metrics-traffic.yaml @@ -0,0 +1,27 @@ +# This NetworkPolicy allows ingress traffic +# with Pods running on namespaces labeled with 'metrics: enabled'. Only Pods on those +# namespaces are able to gather data from the metrics endpoint. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize + name: allow-metrics-traffic + namespace: system +spec: + podSelector: + matchLabels: + control-plane: controller-manager + app.kubernetes.io/name: keystone-operator + policyTypes: + - Ingress + ingress: + # This allows ingress traffic from any namespace with the label metrics: enabled + - from: + - namespaceSelector: + matchLabels: + metrics: enabled # Only from namespaces with this label + ports: + - port: 8443 + protocol: TCP diff --git a/config/network-policy/allow-webhook-traffic.yaml b/config/network-policy/allow-webhook-traffic.yaml new file mode 100644 index 000000000..545ba6247 --- /dev/null +++ b/config/network-policy/allow-webhook-traffic.yaml @@ -0,0 +1,27 @@ +# This NetworkPolicy allows ingress traffic to your webhook server running +# as part of the controller-manager from specific namespaces and pods. CR(s) which uses webhooks +# will only work when applied in namespaces labeled with 'webhook: enabled' +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize + name: allow-webhook-traffic + namespace: system +spec: + podSelector: + matchLabels: + control-plane: controller-manager + app.kubernetes.io/name: keystone-operator + policyTypes: + - Ingress + ingress: + # This allows ingress traffic from any namespace with the label webhook: enabled + - from: + - namespaceSelector: + matchLabels: + webhook: enabled # Only from namespaces with this label + ports: + - port: 443 + protocol: TCP diff --git a/config/network-policy/kustomization.yaml b/config/network-policy/kustomization.yaml new file mode 100644 index 000000000..0872bee12 --- /dev/null +++ b/config/network-policy/kustomization.yaml @@ -0,0 +1,3 @@ +resources: +- allow-webhook-traffic.yaml +- allow-metrics-traffic.yaml diff --git a/config/prometheus/kustomization.yaml b/config/prometheus/kustomization.yaml index ed137168a..fdc5481b1 100644 --- a/config/prometheus/kustomization.yaml +++ b/config/prometheus/kustomization.yaml @@ -1,2 +1,11 @@ resources: - monitor.yaml + +# [PROMETHEUS-WITH-CERTS] The following patch configures the ServiceMonitor in ../prometheus +# to securely reference certificates created and managed by cert-manager. +# Additionally, ensure that you uncomment the [METRICS WITH CERTMANAGER] patch under config/default/kustomization.yaml +# to mount the "metrics-server-cert" secret in the Manager Deployment. +#patches: +# - path: monitor_tls_patch.yaml +# target: +# kind: ServiceMonitor diff --git a/config/prometheus/monitor.yaml b/config/prometheus/monitor.yaml index 0c203de44..befe8edbc 100644 --- a/config/prometheus/monitor.yaml +++ b/config/prometheus/monitor.yaml @@ -1,20 +1,27 @@ - # Prometheus Monitor Service (Metrics) apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: labels: control-plane: controller-manager + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize name: controller-manager-metrics-monitor namespace: system spec: endpoints: - path: /metrics - port: https + port: https # Ensure this is the name of the port that exposes HTTPS metrics scheme: https bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token tlsConfig: + # TODO(user): The option insecureSkipVerify: true is not recommended for production since it disables + # certificate verification, exposing the system to potential man-in-the-middle attacks. + # For production environments, it is recommended to use cert-manager for automatic TLS certificate management. + # To apply this configuration, enable cert-manager and use the patch located at config/prometheus/servicemonitor_tls_patch.yaml, + # which securely references the certificate from the 'metrics-server-cert' secret. insecureSkipVerify: true selector: matchLabels: - openstack.org/operator-name: keystone + control-plane: controller-manager + app.kubernetes.io/name: keystone-operator diff --git a/config/prometheus/monitor_tls_patch.yaml b/config/prometheus/monitor_tls_patch.yaml new file mode 100644 index 000000000..5bf84ce0d --- /dev/null +++ b/config/prometheus/monitor_tls_patch.yaml @@ -0,0 +1,19 @@ +# Patch for Prometheus ServiceMonitor to enable secure TLS configuration +# using certificates managed by cert-manager +- op: replace + path: /spec/endpoints/0/tlsConfig + value: + # SERVICE_NAME and SERVICE_NAMESPACE will be substituted by kustomize + serverName: SERVICE_NAME.SERVICE_NAMESPACE.svc + insecureSkipVerify: false + ca: + secret: + name: metrics-server-cert + key: ca.crt + cert: + secret: + name: metrics-server-cert + key: tls.crt + keySecret: + name: metrics-server-cert + key: tls.key diff --git a/config/rbac/keystoneapi_admin_role.yaml b/config/rbac/keystoneapi_admin_role.yaml new file mode 100644 index 000000000..2ba9ea3bd --- /dev/null +++ b/config/rbac/keystoneapi_admin_role.yaml @@ -0,0 +1,27 @@ +# This rule is not used by the project keystone-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants full permissions ('*') over keystone.openstack.org. +# This role is intended for users authorized to modify roles and bindings within the cluster, +# enabling them to delegate specific permissions to other users or groups as needed. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize + name: keystoneapi-admin-role +rules: +- apiGroups: + - keystone.openstack.org + resources: + - keystoneapis + verbs: + - '*' +- apiGroups: + - keystone.openstack.org + resources: + - keystoneapis/status + verbs: + - get diff --git a/config/rbac/keystoneapi_editor_role.yaml b/config/rbac/keystoneapi_editor_role.yaml index 294c5b13d..8bdda2fd6 100644 --- a/config/rbac/keystoneapi_editor_role.yaml +++ b/config/rbac/keystoneapi_editor_role.yaml @@ -1,7 +1,16 @@ -# permissions for end users to edit keystoneapis. +# This rule is not used by the project keystone-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants permissions to create, update, and delete resources within the keystone.openstack.org. +# This role is intended for users who need to manage these resources +# but should not control RBAC or manage permissions for others. + apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: + labels: + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize name: keystoneapi-editor-role rules: - apiGroups: diff --git a/config/rbac/keystoneapi_viewer_role.yaml b/config/rbac/keystoneapi_viewer_role.yaml index f602a7c96..322abeac9 100644 --- a/config/rbac/keystoneapi_viewer_role.yaml +++ b/config/rbac/keystoneapi_viewer_role.yaml @@ -1,7 +1,16 @@ -# permissions for end users to view keystoneapis. +# This rule is not used by the project keystone-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants read-only access to keystone.openstack.org resources. +# This role is intended for users who need visibility into these resources +# without permissions to modify them. It is ideal for monitoring purposes and limited-access viewing. + apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: + labels: + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize name: keystoneapi-viewer-role rules: - apiGroups: diff --git a/config/rbac/keystoneendpoint_admin_role.yaml b/config/rbac/keystoneendpoint_admin_role.yaml new file mode 100644 index 000000000..cae8d09d4 --- /dev/null +++ b/config/rbac/keystoneendpoint_admin_role.yaml @@ -0,0 +1,27 @@ +# This rule is not used by the project keystone-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants full permissions ('*') over keystone.openstack.org. +# This role is intended for users authorized to modify roles and bindings within the cluster, +# enabling them to delegate specific permissions to other users or groups as needed. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize + name: keystoneendpoint-admin-role +rules: +- apiGroups: + - keystone.openstack.org + resources: + - keystoneendpoints + verbs: + - '*' +- apiGroups: + - keystone.openstack.org + resources: + - keystoneendpoints/status + verbs: + - get diff --git a/config/rbac/keystoneendpoint_editor_role.yaml b/config/rbac/keystoneendpoint_editor_role.yaml index e5129b6b4..080ce7b45 100644 --- a/config/rbac/keystoneendpoint_editor_role.yaml +++ b/config/rbac/keystoneendpoint_editor_role.yaml @@ -1,7 +1,16 @@ -# permissions for end users to edit keystoneendpoints. +# This rule is not used by the project keystone-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants permissions to create, update, and delete resources within the keystone.openstack.org. +# This role is intended for users who need to manage these resources +# but should not control RBAC or manage permissions for others. + apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: + labels: + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize name: keystoneendpoint-editor-role rules: - apiGroups: diff --git a/config/rbac/keystoneendpoint_viewer_role.yaml b/config/rbac/keystoneendpoint_viewer_role.yaml index 14b145b8c..74953bb8d 100644 --- a/config/rbac/keystoneendpoint_viewer_role.yaml +++ b/config/rbac/keystoneendpoint_viewer_role.yaml @@ -1,7 +1,16 @@ -# permissions for end users to view keystoneendpoints. +# This rule is not used by the project keystone-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants read-only access to keystone.openstack.org resources. +# This role is intended for users who need visibility into these resources +# without permissions to modify them. It is ideal for monitoring purposes and limited-access viewing. + apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: + labels: + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize name: keystoneendpoint-viewer-role rules: - apiGroups: diff --git a/config/rbac/keystoneservice_admin_role.yaml b/config/rbac/keystoneservice_admin_role.yaml new file mode 100644 index 000000000..ddf1fd695 --- /dev/null +++ b/config/rbac/keystoneservice_admin_role.yaml @@ -0,0 +1,27 @@ +# This rule is not used by the project keystone-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants full permissions ('*') over keystone.openstack.org. +# This role is intended for users authorized to modify roles and bindings within the cluster, +# enabling them to delegate specific permissions to other users or groups as needed. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize + name: keystoneservice-admin-role +rules: +- apiGroups: + - keystone.openstack.org + resources: + - keystoneservices + verbs: + - '*' +- apiGroups: + - keystone.openstack.org + resources: + - keystoneservices/status + verbs: + - get diff --git a/config/rbac/keystoneservice_editor_role.yaml b/config/rbac/keystoneservice_editor_role.yaml index f4cda6934..7f1d034d6 100644 --- a/config/rbac/keystoneservice_editor_role.yaml +++ b/config/rbac/keystoneservice_editor_role.yaml @@ -1,7 +1,16 @@ -# permissions for end users to edit keystoneservices. +# This rule is not used by the project keystone-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants permissions to create, update, and delete resources within the keystone.openstack.org. +# This role is intended for users who need to manage these resources +# but should not control RBAC or manage permissions for others. + apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: + labels: + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize name: keystoneservice-editor-role rules: - apiGroups: diff --git a/config/rbac/keystoneservice_viewer_role.yaml b/config/rbac/keystoneservice_viewer_role.yaml index 94b44b68c..472998834 100644 --- a/config/rbac/keystoneservice_viewer_role.yaml +++ b/config/rbac/keystoneservice_viewer_role.yaml @@ -1,7 +1,16 @@ -# permissions for end users to view keystoneservices. +# This rule is not used by the project keystone-operator itself. +# It is provided to allow the cluster admin to help manage permissions for users. +# +# Grants read-only access to keystone.openstack.org resources. +# This role is intended for users who need visibility into these resources +# without permissions to modify them. It is ideal for monitoring purposes and limited-access viewing. + apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: + labels: + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize name: keystoneservice-viewer-role rules: - apiGroups: diff --git a/config/rbac/kustomization.yaml b/config/rbac/kustomization.yaml index 731832a6a..0c42dae29 100644 --- a/config/rbac/kustomization.yaml +++ b/config/rbac/kustomization.yaml @@ -9,10 +9,25 @@ resources: - role_binding.yaml - leader_election_role.yaml - leader_election_role_binding.yaml -# Comment the following 4 lines if you want to disable -# the auth proxy (https://github.com/brancz/kube-rbac-proxy) -# which protects your /metrics endpoint. -- auth_proxy_service.yaml -- auth_proxy_role.yaml -- auth_proxy_role_binding.yaml -- auth_proxy_client_clusterrole.yaml +# The following RBAC configurations are used to protect +# the metrics endpoint with authn/authz. These configurations +# ensure that only authorized users and service accounts +# can access the metrics endpoint. Comment the following +# permissions if you want to disable this protection. +# More info: https://book.kubebuilder.io/reference/metrics.html +- metrics_auth_role.yaml +- metrics_auth_role_binding.yaml +- metrics_reader_role.yaml +# For each CRD, "Admin", "Editor" and "Viewer" roles are scaffolded by +# default, aiding admins in cluster management. Those roles are +# not used by the keystone-operator itself. You can comment the following lines +# if you do not want those helpers be installed with your Project. +- keystoneendpoint_admin_role.yaml +- keystoneendpoint_editor_role.yaml +- keystoneendpoint_viewer_role.yaml +- keystoneservice_admin_role.yaml +- keystoneservice_editor_role.yaml +- keystoneservice_viewer_role.yaml +- keystoneapi_admin_role.yaml +- keystoneapi_editor_role.yaml +- keystoneapi_viewer_role.yaml diff --git a/config/rbac/leader_election_role.yaml b/config/rbac/leader_election_role.yaml index 4190ec805..136bc3e03 100644 --- a/config/rbac/leader_election_role.yaml +++ b/config/rbac/leader_election_role.yaml @@ -2,6 +2,9 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: + labels: + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize name: leader-election-role rules: - apiGroups: diff --git a/config/rbac/leader_election_role_binding.yaml b/config/rbac/leader_election_role_binding.yaml index 1d1321ed4..57a1dc785 100644 --- a/config/rbac/leader_election_role_binding.yaml +++ b/config/rbac/leader_election_role_binding.yaml @@ -1,6 +1,9 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: + labels: + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize name: leader-election-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/config/rbac/auth_proxy_role.yaml b/config/rbac/metrics_auth_role.yaml similarity index 90% rename from config/rbac/auth_proxy_role.yaml rename to config/rbac/metrics_auth_role.yaml index 80e1857c5..32d2e4ec6 100644 --- a/config/rbac/auth_proxy_role.yaml +++ b/config/rbac/metrics_auth_role.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: proxy-role + name: metrics-auth-role rules: - apiGroups: - authentication.k8s.io diff --git a/config/rbac/auth_proxy_role_binding.yaml b/config/rbac/metrics_auth_role_binding.yaml similarity index 79% rename from config/rbac/auth_proxy_role_binding.yaml rename to config/rbac/metrics_auth_role_binding.yaml index ec7acc0a1..e775d67ff 100644 --- a/config/rbac/auth_proxy_role_binding.yaml +++ b/config/rbac/metrics_auth_role_binding.yaml @@ -1,11 +1,11 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: proxy-rolebinding + name: metrics-auth-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: proxy-role + name: metrics-auth-role subjects: - kind: ServiceAccount name: controller-manager diff --git a/config/rbac/auth_proxy_client_clusterrole.yaml b/config/rbac/metrics_reader_role.yaml similarity index 100% rename from config/rbac/auth_proxy_client_clusterrole.yaml rename to config/rbac/metrics_reader_role.yaml diff --git a/config/rbac/role_binding.yaml b/config/rbac/role_binding.yaml index 2070ede44..a52ef55df 100644 --- a/config/rbac/role_binding.yaml +++ b/config/rbac/role_binding.yaml @@ -1,6 +1,9 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: + labels: + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize name: manager-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/config/rbac/service_account.yaml b/config/rbac/service_account.yaml index 7cd6025bf..9b3fd7e96 100644 --- a/config/rbac/service_account.yaml +++ b/config/rbac/service_account.yaml @@ -1,5 +1,8 @@ apiVersion: v1 kind: ServiceAccount metadata: + labels: + app.kubernetes.io/name: keystone-operator + app.kubernetes.io/managed-by: kustomize name: controller-manager namespace: system diff --git a/config/scorecard/kustomization.yaml b/config/scorecard/kustomization.yaml index a9a84a85a..54e8aa507 100644 --- a/config/scorecard/kustomization.yaml +++ b/config/scorecard/kustomization.yaml @@ -1,16 +1,18 @@ resources: - bases/config.yaml +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization patches: - path: patches/basic.config.yaml target: group: scorecard.operatorframework.io - version: v1alpha3 kind: Configuration name: config + version: v1alpha3 - path: patches/olm.config.yaml target: group: scorecard.operatorframework.io - version: v1alpha3 kind: Configuration name: config -#+kubebuilder:scaffold:patches + version: v1alpha3 +# +kubebuilder:scaffold:patches diff --git a/config/scorecard/patches/basic.config.yaml b/config/scorecard/patches/basic.config.yaml index 91a183c61..8237b70d8 100644 --- a/config/scorecard/patches/basic.config.yaml +++ b/config/scorecard/patches/basic.config.yaml @@ -4,7 +4,7 @@ entrypoint: - scorecard-test - basic-check-spec - image: quay.io/operator-framework/scorecard-test:v1.18.1 + image: quay.io/operator-framework/scorecard-test:v1.41.1 labels: suite: basic test: basic-check-spec-test diff --git a/config/scorecard/patches/olm.config.yaml b/config/scorecard/patches/olm.config.yaml index d88ca2cbd..416660a77 100644 --- a/config/scorecard/patches/olm.config.yaml +++ b/config/scorecard/patches/olm.config.yaml @@ -4,7 +4,7 @@ entrypoint: - scorecard-test - olm-bundle-validation - image: quay.io/operator-framework/scorecard-test:v1.18.1 + image: quay.io/operator-framework/scorecard-test:v1.41.1 labels: suite: olm test: olm-bundle-validation-test @@ -14,7 +14,7 @@ entrypoint: - scorecard-test - olm-crds-have-validation - image: quay.io/operator-framework/scorecard-test:v1.18.1 + image: quay.io/operator-framework/scorecard-test:v1.41.1 labels: suite: olm test: olm-crds-have-validation-test @@ -24,7 +24,7 @@ entrypoint: - scorecard-test - olm-crds-have-resources - image: quay.io/operator-framework/scorecard-test:v1.18.1 + image: quay.io/operator-framework/scorecard-test:v1.41.1 labels: suite: olm test: olm-crds-have-resources-test @@ -34,7 +34,7 @@ entrypoint: - scorecard-test - olm-spec-descriptors - image: quay.io/operator-framework/scorecard-test:v1.18.1 + image: quay.io/operator-framework/scorecard-test:v1.41.1 labels: suite: olm test: olm-spec-descriptors-test @@ -44,7 +44,7 @@ entrypoint: - scorecard-test - olm-status-descriptors - image: quay.io/operator-framework/scorecard-test:v1.18.1 + image: quay.io/operator-framework/scorecard-test:v1.41.1 labels: suite: olm test: olm-status-descriptors-test diff --git a/config/webhook/kustomizeconfig.yaml b/config/webhook/kustomizeconfig.yaml index 25e21e3c9..206316e54 100644 --- a/config/webhook/kustomizeconfig.yaml +++ b/config/webhook/kustomizeconfig.yaml @@ -1,4 +1,4 @@ -# the following config is for teaching kustomize where to look at when substituting vars. +# the following config is for teaching kustomize where to look at when substituting nameReference. # It requires kustomize v2.1.0 or newer to work properly. nameReference: - kind: Service @@ -20,6 +20,3 @@ namespace: group: admissionregistration.k8s.io path: webhooks/clientConfig/service/namespace create: true - -varReference: -- path: metadata/annotations diff --git a/config/webhook/manifests.yaml b/config/webhook/manifests.yaml index c7b03581f..7590db527 100644 --- a/config/webhook/manifests.yaml +++ b/config/webhook/manifests.yaml @@ -12,7 +12,7 @@ webhooks: namespace: system path: /mutate-keystone-openstack-org-v1beta1-keystoneapi failurePolicy: Fail - name: mkeystoneapi.kb.io + name: mkeystoneapi-v1beta1.kb.io rules: - apiGroups: - keystone.openstack.org @@ -38,7 +38,7 @@ webhooks: namespace: system path: /validate-keystone-openstack-org-v1beta1-keystoneapi failurePolicy: Fail - name: vkeystoneapi.kb.io + name: vkeystoneapi-v1beta1.kb.io rules: - apiGroups: - keystone.openstack.org diff --git a/config/webhook/service.yaml b/config/webhook/service.yaml index 97f4dfe83..f8673dc91 100644 --- a/config/webhook/service.yaml +++ b/config/webhook/service.yaml @@ -1,13 +1,8 @@ - apiVersion: v1 kind: Service metadata: labels: - app.kubernetes.io/name: service - app.kubernetes.io/instance: webhook-service - app.kubernetes.io/component: webhook - app.kubernetes.io/created-by: keystone-operator - app.kubernetes.io/part-of: keystone-operator + app.kubernetes.io/name: keystone-operator app.kubernetes.io/managed-by: kustomize name: webhook-service namespace: system @@ -17,4 +12,5 @@ spec: protocol: TCP targetPort: 9443 selector: - openstack.org/operator-name: keystone + control-plane: controller-manager + app.kubernetes.io/name: keystone-operator diff --git a/go.mod b/go.mod index 72e94bbdf..457fd31ab 100644 --- a/go.mod +++ b/go.mod @@ -26,13 +26,19 @@ require ( require ( github.com/Masterminds/semver/v3 v3.4.0 // indirect + github.com/antlr4-go/antlr/v4 v4.13.0 // indirect + github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect github.com/beorn7/perks v1.0.1 // indirect + github.com/blang/semver/v4 v4.0.0 // indirect + github.com/cenkalti/backoff/v4 v4.3.0 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/emicklei/go-restful/v3 v3.12.2 // indirect github.com/evanphx/json-patch/v5 v5.9.11 // indirect + github.com/felixge/httpsnoop v1.0.4 // indirect github.com/fsnotify/fsnotify v1.9.0 // indirect github.com/fxamacker/cbor/v2 v2.9.0 // indirect + github.com/go-logr/stdr v1.2.2 // indirect github.com/go-logr/zapr v1.3.0 // indirect github.com/go-openapi/jsonpointer v0.21.1 // indirect github.com/go-openapi/jsonreference v0.21.0 // indirect @@ -41,12 +47,15 @@ require ( github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect github.com/golang/protobuf v1.5.4 // indirect + github.com/google/cel-go v0.20.1 // indirect github.com/google/gnostic-models v0.7.0 // indirect github.com/google/go-cmp v0.7.0 // indirect github.com/google/gofuzz v1.2.0 // indirect github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect github.com/gophercloud/gophercloud/v2 v2.8.0 // indirect + github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 // indirect github.com/imdario/mergo v0.3.16 // indirect + github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/josharian/intern v1.0.0 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/mailru/easyjson v0.9.0 // indirect @@ -60,8 +69,19 @@ require ( github.com/prometheus/common v0.65.0 // indirect github.com/prometheus/procfs v0.16.1 // indirect github.com/rabbitmq/cluster-operator/v2 v2.16.0 // indirect + github.com/spf13/cobra v1.9.1 // indirect github.com/spf13/pflag v1.0.7 // indirect + github.com/stoewer/go-strcase v1.2.0 // indirect github.com/x448/float16 v0.8.4 // indirect + go.opentelemetry.io/auto/sdk v1.1.0 // indirect + go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect + go.opentelemetry.io/otel v1.34.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 // indirect + go.opentelemetry.io/otel/metric v1.34.0 // indirect + go.opentelemetry.io/otel/sdk v1.34.0 // indirect + go.opentelemetry.io/otel/trace v1.34.0 // indirect + go.opentelemetry.io/proto/otlp v1.3.1 // indirect go.uber.org/multierr v1.11.0 // indirect go.yaml.in/yaml/v2 v2.4.2 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect @@ -76,11 +96,18 @@ require ( golang.org/x/time v0.12.0 // indirect golang.org/x/tools v0.36.0 // indirect gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f // indirect + google.golang.org/grpc v1.71.1 // indirect google.golang.org/protobuf v1.36.7 // indirect gopkg.in/inf.v0 v0.9.1 // indirect + gopkg.in/yaml.v2 v2.4.0 // indirect k8s.io/apiextensions-apiserver v0.33.2 // indirect + k8s.io/apiserver v0.33.2 // indirect + k8s.io/component-base v0.33.2 // indirect k8s.io/klog/v2 v2.130.1 // indirect k8s.io/kube-openapi v0.0.0-20250902184714-7fc278399c7f // indirect + sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3 // indirect sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect sigs.k8s.io/randfill v1.0.0 // indirect sigs.k8s.io/structured-merge-diff/v4 v4.7.0 // indirect diff --git a/go.sum b/go.sum index 5fed842e7..d226bdb3b 100644 --- a/go.sum +++ b/go.sum @@ -1,9 +1,18 @@ github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0= github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= +github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI= +github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g= +github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so= +github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= +github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM= +github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ= +github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8= +github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= +github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= @@ -14,6 +23,8 @@ github.com/evanphx/json-patch v5.9.11+incompatible h1:ixHHqfcGvxhWkniF1tWxBHA0yb github.com/evanphx/json-patch v5.9.11+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk= github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU= github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM= +github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= +github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k= github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0= github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM= @@ -24,8 +35,11 @@ github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZ github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6OPYerdAAS9tk= github.com/gkampitakis/go-snaps v0.5.15 h1:amyJrvM1D33cPHwVrjo9jQxX8g/7E2wYdZ+01KS3zGE= github.com/gkampitakis/go-snaps v0.5.15/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc= +github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= +github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ= github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg= github.com/go-openapi/jsonpointer v0.21.1 h1:whnzv/pNXtK2FbX/W9yJfRmE2gsmkfahjMKB0fZvcic= @@ -44,6 +58,8 @@ github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= +github.com/google/cel-go v0.20.1 h1:nDx9r8S3L4pE61eDdt8igGj8rf5kjYR3ILxWIpWNi84= +github.com/google/cel-go v0.20.1/go.mod h1:kWcIzTsPX0zmQ+H3TirHstLLf9ep5QTsZBN9u4dOYLg= github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo= github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ= github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= @@ -58,8 +74,12 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/gophercloud/gophercloud/v2 v2.8.0 h1:of2+8tT6+FbEYHfYC8GBu8TXJNsXYSNm9KuvpX7Neqo= github.com/gophercloud/gophercloud/v2 v2.8.0/go.mod h1:Ki/ILhYZr/5EPebrPL9Ej+tUg4lqx71/YH2JWVeU+Qk= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 h1:bkypFPDjIYGfCYD5mRBvpqxfYX1YCS1PXdKYWi8FsN0= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0/go.mod h1:P+Lt/0by1T8bfcF3z737NnSbmxQAppXMRziHUxPOC8k= github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4= github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY= +github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= +github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY= github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y= github.com/joshdk/go-junit v1.0.0 h1:S86cUKIdwBHWwA6xCmFlf3RTLfVXYQfvanM5Uh+K6GE= @@ -127,10 +147,17 @@ github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzM github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is= github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII= github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o= +github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= +github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo= +github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0= +github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M= github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/stoewer/go-strcase v1.2.0 h1:Z2iHWqGXH00XYgqDmNgQbIBxf3wrNq0F3feEy0ainaU= +github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= +github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA= github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY= @@ -145,6 +172,26 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= +go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA= +go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 h1:yd02MEjBdJkG3uabWP9apV+OuWRIXGDuJEUJbOHmCFU= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0/go.mod h1:umTcuxiv1n/s/S6/c2AT/g2CQ7u5C59sHDNmfSwgz7Q= +go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY= +go.opentelemetry.io/otel v1.34.0/go.mod h1:OWFPOQ+h4G8xpyjgqo4SxJYdDQ/qmRH+wivy7zzx9oI= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 h1:3Q/xZUyC1BBkualc9ROb4G8qkH90LXEIICcs5zv1OYY= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0/go.mod h1:s75jGIWA9OfCMzF0xr+ZgfrB5FEbbV7UuYo32ahUiFI= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 h1:qFffATk0X+HD+f1Z8lswGiOQYKHRlzfmdJm0wEaVrFA= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0/go.mod h1:MOiCmryaYtc+V0Ei+Tx9o5S1ZjA7kzLucuVuyzBZloQ= +go.opentelemetry.io/otel/metric v1.34.0 h1:+eTR3U0MyfWjRDhmFMxe2SsW64QrZ84AOhvqS7Y+PoQ= +go.opentelemetry.io/otel/metric v1.34.0/go.mod h1:CEDrp0fy2D0MvkXE+dPV7cMi8tWZwX3dmaIhwPOaqHE= +go.opentelemetry.io/otel/sdk v1.34.0 h1:95zS4k/2GOy069d321O8jWgYsW3MzVV+KuSPKp7Wr1A= +go.opentelemetry.io/otel/sdk v1.34.0/go.mod h1:0e/pNiaMAqaykJGKbi+tSjWfNNHMTxoC9qANsCzbyxU= +go.opentelemetry.io/otel/sdk/metric v1.34.0 h1:5CeK9ujjbFVL5c1PhLuStg1wxA7vQv7ce1EK0Gyvahk= +go.opentelemetry.io/otel/sdk/metric v1.34.0/go.mod h1:jQ/r8Ze28zRKoNRdkjCZxfs6YvBTG1+YIqyFVFYec5w= +go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC8mh/k= +go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE= +go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0= +go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= @@ -202,6 +249,12 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gomodules.xyz/jsonpatch/v2 v2.5.0 h1:JELs8RLM12qJGXU4u/TO3V25KW8GreMKl9pdkk14RM0= gomodules.xyz/jsonpatch/v2 v2.5.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY= +google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422 h1:GVIKPyP/kLIyVOgOnTwFOrvQaQUzOzGMCxgFUOEmm24= +google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422/go.mod h1:b6h1vNKhxaSoEI+5jc3PJUCustfli/mRab7295pY7rw= +google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f h1:OxYkA3wjPsZyBylwymxSHa7ViiW1Sml4ToBrncvFehI= +google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f/go.mod h1:+2Yz8+CLJbIfL9z73EW45avw8Lmge3xVElCP9zEKi50= +google.golang.org/grpc v1.71.1 h1:ffsFWr7ygTUscGPI0KKK6TLrGz0476KUvvsbqWK0rPI= +google.golang.org/grpc v1.71.1/go.mod h1:H0GRtasmQOh9LkFoCPDu3ZrwUtD1YGE+b2vYBYd/8Ec= google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A= google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= @@ -211,6 +264,9 @@ gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSP gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M= gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc= gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw= +gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= +gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= k8s.io/api v0.31.13 h1:sco9Cq2pY4Ysv9qZiWzcR97MmA/35nwYQ/VCTzOcWmc= @@ -219,14 +275,20 @@ k8s.io/apiextensions-apiserver v0.31.13 h1:8xtWKVpV/YbYX0UX2k6w+cgxfxKhX0UNGuo/V k8s.io/apiextensions-apiserver v0.31.13/go.mod h1:zxpMLWXBxnJqKUIruJ+ulP+Xlfe5lPZPxq1z0cLwA2U= k8s.io/apimachinery v0.31.13 h1:rkG0EiBkBkEzURo/8dKGx/oBF202Z2LqHuSD8Cm3bG4= k8s.io/apimachinery v0.31.13/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo= +k8s.io/apiserver v0.31.13 h1:Ke9/X2m3vHSgsminpAbUxULDNMbvAfjrRX73Gqx6CZc= +k8s.io/apiserver v0.31.13/go.mod h1:5nBPhL2g7am/CS+/OI5A6+olEbo0C7tQ8QNDODLd+WY= k8s.io/client-go v0.31.13 h1:Q0LG51uFbzNd9fzIj5ilA0Sm1wUholHvDaNwVKzqdCA= k8s.io/client-go v0.31.13/go.mod h1:UB4yTzQeRAv+vULOKp2jdqA5LSwV55bvc3RQ5tM48LM= +k8s.io/component-base v0.31.13 h1:/uVLq7yHk9azReqeCFAZSr/8NXydzpz7yDZ6p/yiwBQ= +k8s.io/component-base v0.31.13/go.mod h1:uMXtKNyDqeNdZYL6SRCr9wB6FutL9pOlQmkK2dRVAKQ= k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk= k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE= k8s.io/kube-openapi v0.0.0-20250627150254-e9823e99808e h1:UGI9rv1A2cV87NhXr4s+AUBxIuoo/SME/IyJ3b6KztE= k8s.io/kube-openapi v0.0.0-20250627150254-e9823e99808e/go.mod h1:GLOk5B+hDbRROvt0X2+hqX64v/zO3vXN7J78OUmBSKw= k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d h1:wAhiDyZ4Tdtt7e46e9M5ZSAJ/MnPGPs+Ki1gHw4w1R0= k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= +sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3 h1:2770sDpzrjjsAtVhSeUFseziht227YAWYHLGNM8QPwY= +sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw= sigs.k8s.io/controller-runtime v0.19.7 h1:DLABZfMr20A+AwCZOHhcbcu+TqBXnJZaVBri9K3EO48= sigs.k8s.io/controller-runtime v0.19.7/go.mod h1:iRmWllt8IlaLjvTTDLhRBXIEtkCK6hwVBJJsYS9Ajf4= sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE= diff --git a/controllers/keystoneapi_controller.go b/internal/controller/keystoneapi_controller.go similarity index 99% rename from controllers/keystoneapi_controller.go rename to internal/controller/keystoneapi_controller.go index fc6c56204..6f0771e71 100644 --- a/controllers/keystoneapi_controller.go +++ b/internal/controller/keystoneapi_controller.go @@ -13,8 +13,8 @@ See the License for the specific language governing permissions and limitations under the License. */ -// Package controllers implements the keystone-operator Kubernetes controllers. -package controllers +// Package controller implements the keystone-operator Kubernetes controllers. +package controller import ( "context" @@ -30,7 +30,7 @@ import ( rabbitmqv1 "github.com/openstack-k8s-operators/infra-operator/apis/rabbitmq/v1beta1" topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" keystonev1 "github.com/openstack-k8s-operators/keystone-operator/api/v1beta1" - keystone "github.com/openstack-k8s-operators/keystone-operator/pkg/keystone" + keystone "github.com/openstack-k8s-operators/keystone-operator/internal/keystone" "github.com/openstack-k8s-operators/lib-common/modules/common" condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition" configmap "github.com/openstack-k8s-operators/lib-common/modules/common/configmap" diff --git a/controllers/keystoneendpoint_controller.go b/internal/controller/keystoneendpoint_controller.go similarity index 99% rename from controllers/keystoneendpoint_controller.go rename to internal/controller/keystoneendpoint_controller.go index 67a34379c..990bda97a 100644 --- a/controllers/keystoneendpoint_controller.go +++ b/internal/controller/keystoneendpoint_controller.go @@ -14,7 +14,7 @@ limitations under the License. */ -package controllers +package controller import ( "context" diff --git a/controllers/keystoneservice_controller.go b/internal/controller/keystoneservice_controller.go similarity index 99% rename from controllers/keystoneservice_controller.go rename to internal/controller/keystoneservice_controller.go index ada89afe4..8433d397d 100644 --- a/controllers/keystoneservice_controller.go +++ b/internal/controller/keystoneservice_controller.go @@ -14,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package controllers +package controller import ( "context" diff --git a/pkg/keystone/bootstrap.go b/internal/keystone/bootstrap.go similarity index 100% rename from pkg/keystone/bootstrap.go rename to internal/keystone/bootstrap.go diff --git a/pkg/keystone/cloudconfig.go b/internal/keystone/cloudconfig.go similarity index 100% rename from pkg/keystone/cloudconfig.go rename to internal/keystone/cloudconfig.go diff --git a/pkg/keystone/const.go b/internal/keystone/const.go similarity index 100% rename from pkg/keystone/const.go rename to internal/keystone/const.go diff --git a/pkg/keystone/cronjob.go b/internal/keystone/cronjob.go similarity index 100% rename from pkg/keystone/cronjob.go rename to internal/keystone/cronjob.go diff --git a/pkg/keystone/dbsync.go b/internal/keystone/dbsync.go similarity index 100% rename from pkg/keystone/dbsync.go rename to internal/keystone/dbsync.go diff --git a/pkg/keystone/deployment.go b/internal/keystone/deployment.go similarity index 100% rename from pkg/keystone/deployment.go rename to internal/keystone/deployment.go diff --git a/pkg/keystone/federation.go b/internal/keystone/federation.go similarity index 100% rename from pkg/keystone/federation.go rename to internal/keystone/federation.go diff --git a/pkg/keystone/fernet.go b/internal/keystone/fernet.go similarity index 100% rename from pkg/keystone/fernet.go rename to internal/keystone/fernet.go diff --git a/pkg/keystone/funcs.go b/internal/keystone/funcs.go similarity index 100% rename from pkg/keystone/funcs.go rename to internal/keystone/funcs.go diff --git a/pkg/keystone/volumes.go b/internal/keystone/volumes.go similarity index 100% rename from pkg/keystone/volumes.go rename to internal/keystone/volumes.go diff --git a/internal/webhook/v1beta1/keystoneapi_webhook.go b/internal/webhook/v1beta1/keystoneapi_webhook.go new file mode 100644 index 000000000..1e90f0d35 --- /dev/null +++ b/internal/webhook/v1beta1/keystoneapi_webhook.go @@ -0,0 +1,131 @@ +/* +Copyright 2025. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Package v1beta1 contains webhook implementations for KeystoneAPI v1beta1 resources. +package v1beta1 + +import ( + "context" + "errors" + "fmt" + + "k8s.io/apimachinery/pkg/runtime" + ctrl "sigs.k8s.io/controller-runtime" + logf "sigs.k8s.io/controller-runtime/pkg/log" + "sigs.k8s.io/controller-runtime/pkg/webhook" + "sigs.k8s.io/controller-runtime/pkg/webhook/admission" + + keystonev1beta1 "github.com/openstack-k8s-operators/keystone-operator/api/v1beta1" +) + +// Static errors for type assertions +var ( + errUnexpectedObjectType = errors.New("unexpected object type") +) + +// nolint:unused +// log is for logging in this package. +var keystoneapilog = logf.Log.WithName("keystoneapi-resource") + +// SetupKeystoneAPIWebhookWithManager registers the webhook for KeystoneAPI in the manager. +func SetupKeystoneAPIWebhookWithManager(mgr ctrl.Manager) error { + return ctrl.NewWebhookManagedBy(mgr).For(&keystonev1beta1.KeystoneAPI{}). + WithValidator(&KeystoneAPICustomValidator{}). + WithDefaulter(&KeystoneAPICustomDefaulter{}). + Complete() +} + +// TODO(user): EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN! + +// +kubebuilder:webhook:path=/mutate-keystone-openstack-org-v1beta1-keystoneapi,mutating=true,failurePolicy=fail,sideEffects=None,groups=keystone.openstack.org,resources=keystoneapis,verbs=create;update,versions=v1beta1,name=mkeystoneapi-v1beta1.kb.io,admissionReviewVersions=v1 + +// KeystoneAPICustomDefaulter struct is responsible for setting default values on the custom resource of the +// Kind KeystoneAPI when those are created or updated. +// +// NOTE: The +kubebuilder:object:generate=false marker prevents controller-gen from generating DeepCopy methods, +// as it is used only for temporary operations and does not need to be deeply copied. +type KeystoneAPICustomDefaulter struct { + // TODO(user): Add more fields as needed for defaulting +} + +var _ webhook.CustomDefaulter = &KeystoneAPICustomDefaulter{} + +// Default implements webhook.CustomDefaulter so a webhook will be registered for the Kind KeystoneAPI. +func (d *KeystoneAPICustomDefaulter) Default(_ context.Context, obj runtime.Object) error { + keystoneapi, ok := obj.(*keystonev1beta1.KeystoneAPI) + + if !ok { + return fmt.Errorf("%w: expected an KeystoneAPI object but got %T", errUnexpectedObjectType, obj) + } + keystoneapilog.Info("Defaulting for KeystoneAPI", "name", keystoneapi.GetName()) + + // Call the defaulting logic from api/v1beta1 + keystoneapi.Default() + + return nil +} + +// TODO(user): change verbs to "verbs=create;update;delete" if you want to enable deletion validation. +// NOTE: The 'path' attribute must follow a specific pattern and should not be modified directly here. +// Modifying the path for an invalid path can cause API server errors; failing to locate the webhook. +// +kubebuilder:webhook:path=/validate-keystone-openstack-org-v1beta1-keystoneapi,mutating=false,failurePolicy=fail,sideEffects=None,groups=keystone.openstack.org,resources=keystoneapis,verbs=create;update,versions=v1beta1,name=vkeystoneapi-v1beta1.kb.io,admissionReviewVersions=v1 + +// KeystoneAPICustomValidator struct is responsible for validating the KeystoneAPI resource +// when it is created, updated, or deleted. +// +// NOTE: The +kubebuilder:object:generate=false marker prevents controller-gen from generating DeepCopy methods, +// as this struct is used only for temporary operations and does not need to be deeply copied. +type KeystoneAPICustomValidator struct { + // TODO(user): Add more fields as needed for validation +} + +var _ webhook.CustomValidator = &KeystoneAPICustomValidator{} + +// ValidateCreate implements webhook.CustomValidator so a webhook will be registered for the type KeystoneAPI. +func (v *KeystoneAPICustomValidator) ValidateCreate(_ context.Context, obj runtime.Object) (admission.Warnings, error) { + keystoneapi, ok := obj.(*keystonev1beta1.KeystoneAPI) + if !ok { + return nil, fmt.Errorf("%w: expected a KeystoneAPI object but got %T", errUnexpectedObjectType, obj) + } + keystoneapilog.Info("Validation for KeystoneAPI upon creation", "name", keystoneapi.GetName()) + + // Call the validation logic from api/v1beta1 + return keystoneapi.ValidateCreate() +} + +// ValidateUpdate implements webhook.CustomValidator so a webhook will be registered for the type KeystoneAPI. +func (v *KeystoneAPICustomValidator) ValidateUpdate(_ context.Context, oldObj, newObj runtime.Object) (admission.Warnings, error) { + keystoneapi, ok := newObj.(*keystonev1beta1.KeystoneAPI) + if !ok { + return nil, fmt.Errorf("%w: expected a KeystoneAPI object for the newObj but got %T", errUnexpectedObjectType, newObj) + } + keystoneapilog.Info("Validation for KeystoneAPI upon update", "name", keystoneapi.GetName()) + + // Call the validation logic from api/v1beta1 + return keystoneapi.ValidateUpdate(oldObj) +} + +// ValidateDelete implements webhook.CustomValidator so a webhook will be registered for the type KeystoneAPI. +func (v *KeystoneAPICustomValidator) ValidateDelete(_ context.Context, obj runtime.Object) (admission.Warnings, error) { + keystoneapi, ok := obj.(*keystonev1beta1.KeystoneAPI) + if !ok { + return nil, fmt.Errorf("%w: expected a KeystoneAPI object but got %T", errUnexpectedObjectType, obj) + } + keystoneapilog.Info("Validation for KeystoneAPI upon deletion", "name", keystoneapi.GetName()) + + // Call the validation logic from api/v1beta1 + return keystoneapi.ValidateDelete() +} diff --git a/kuttl-test.yaml b/kuttl-test.yaml deleted file mode 100644 index 95c4b8c78..000000000 --- a/kuttl-test.yaml +++ /dev/null @@ -1,21 +0,0 @@ -# -# EXECUTION (from install_yamls repo root): -# -# make keystone_kuttl -# -# ASSUMPTIONS: -# -# 1. Latest version of kuttl is installed at /usr/local/bin/kubectl-kuttl -# 2. An OCP 4.10+ CRC cluster with Podified Operators has been deployed -# 3. CLI user has access to $KUBECONFIG - -apiVersion: kuttl.dev/v1beta1 -kind: TestSuite -reportFormat: xml -reportName: kuttl-report-keystone -reportGranularity: test -timeout: 800 -namespace: keystone-kuttl-tests -parallel: 1 -suppress: - - events # Remove spammy event logs diff --git a/main.go b/main.go deleted file mode 100644 index 52e81cf08..000000000 --- a/main.go +++ /dev/null @@ -1,197 +0,0 @@ -/* -Copyright 2022. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// Package main implements the keystone-operator controller manager. -package main - -import ( - "context" - "crypto/tls" - "flag" - "os" - "strings" - - // Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.) - // to ensure that exec-entrypoint and run can make use of them. - _ "k8s.io/client-go/plugin/pkg/client/auth" - - "k8s.io/apimachinery/pkg/runtime" - utilruntime "k8s.io/apimachinery/pkg/util/runtime" - "k8s.io/client-go/kubernetes" - clientgoscheme "k8s.io/client-go/kubernetes/scheme" - ctrl "sigs.k8s.io/controller-runtime" - "sigs.k8s.io/controller-runtime/pkg/client/config" - "sigs.k8s.io/controller-runtime/pkg/healthz" - "sigs.k8s.io/controller-runtime/pkg/log/zap" - "sigs.k8s.io/controller-runtime/pkg/webhook" - - metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server" - - networkv1 "github.com/k8snetworkplumbingwg/network-attachment-definition-client/pkg/apis/k8s.cni.cncf.io/v1" - memcachedv1 "github.com/openstack-k8s-operators/infra-operator/apis/memcached/v1beta1" - rabbitmqv1 "github.com/openstack-k8s-operators/infra-operator/apis/rabbitmq/v1beta1" - topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" - keystonev1 "github.com/openstack-k8s-operators/keystone-operator/api/v1beta1" - mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1" - - "github.com/openstack-k8s-operators/keystone-operator/controllers" - "github.com/openstack-k8s-operators/lib-common/modules/common/operator" - //+kubebuilder:scaffold:imports -) - -var ( - scheme = runtime.NewScheme() - setupLog = ctrl.Log.WithName("setup") -) - -func init() { - utilruntime.Must(clientgoscheme.AddToScheme(scheme)) - utilruntime.Must(keystonev1.AddToScheme(scheme)) - utilruntime.Must(mariadbv1.AddToScheme(scheme)) - utilruntime.Must(rabbitmqv1.AddToScheme(scheme)) - utilruntime.Must(memcachedv1.AddToScheme(scheme)) - utilruntime.Must(networkv1.AddToScheme(scheme)) - utilruntime.Must(topologyv1.AddToScheme(scheme)) - //+kubebuilder:scaffold:scheme -} - -func main() { - var metricsAddr string - var enableLeaderElection bool - var probeAddr string - var pprofBindAddress string - var webhookPort int - var enableHTTP2 bool - flag.BoolVar(&enableHTTP2, "enable-http2", enableHTTP2, "If HTTP/2 should be enabled for the metrics and webhook servers.") - flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.") - flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.") - flag.StringVar(&pprofBindAddress, "pprof-bind-address", "", "The address the pprof endpoint binds to. Set to empty to disable pprof.") - flag.IntVar(&webhookPort, "webhook-bind-address", 9443, "The port the webhook server binds to.") - flag.BoolVar(&enableLeaderElection, "leader-elect", false, - "Enable leader election for controller manager. "+ - "Enabling this will ensure there is only one active controller manager.") - opts := zap.Options{ - Development: true, - } - opts.BindFlags(flag.CommandLine) - flag.Parse() - - ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts))) - - disableHTTP2 := func(c *tls.Config) { - if enableHTTP2 { - return - } - c.NextProtos = []string{"http/1.1"} - } - - options := ctrl.Options{ - Scheme: scheme, - Metrics: metricsserver.Options{ - BindAddress: metricsAddr, - }, - HealthProbeBindAddress: probeAddr, - LeaderElection: enableLeaderElection, - LeaderElectionID: "6012128b.openstack.org", - PprofBindAddress: pprofBindAddress, - WebhookServer: webhook.NewServer( - webhook.Options{ - Port: webhookPort, - TLSOpts: []func(config *tls.Config){disableHTTP2}, - }), - } - - err := operator.SetManagerOptions(&options, setupLog) - if err != nil { - setupLog.Error(err, "unable to set manager options") - os.Exit(1) - } - - mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), options) - if err != nil { - setupLog.Error(err, "unable to start manager") - os.Exit(1) - } - - cfg, err := config.GetConfig() - if err != nil { - setupLog.Error(err, "") - os.Exit(1) - } - kclient, err := kubernetes.NewForConfig(cfg) - if err != nil { - setupLog.Error(err, "") - os.Exit(1) - } - - if err = (&controllers.KeystoneAPIReconciler{ - Client: mgr.GetClient(), - Scheme: mgr.GetScheme(), - Kclient: kclient, - }).SetupWithManager(context.Background(), mgr); err != nil { - setupLog.Error(err, "unable to create controller", "controller", "KeystoneAPI") - os.Exit(1) - } - - if err = (&controllers.KeystoneServiceReconciler{ - Client: mgr.GetClient(), - Scheme: mgr.GetScheme(), - Kclient: kclient, - }).SetupWithManager(mgr); err != nil { - setupLog.Error(err, "unable to create controller", "controller", "KeystoneService") - os.Exit(1) - } - - if err = (&controllers.KeystoneEndpointReconciler{ - Client: mgr.GetClient(), - Scheme: mgr.GetScheme(), - Kclient: kclient, - }).SetupWithManager(mgr); err != nil { - setupLog.Error(err, "unable to create controller", "controller", "KeystoneEndpoint") - os.Exit(1) - } - - // Acquire environmental defaults and initialize operator defaults with them - keystonev1.SetupDefaults() - - checker := healthz.Ping - // Setup webhooks if requested - if strings.ToLower(os.Getenv("ENABLE_WEBHOOKS")) != "false" { - - if err = (&keystonev1.KeystoneAPI{}).SetupWebhookWithManager(mgr); err != nil { - setupLog.Error(err, "unable to create webhook", "webhook", "KeystoneAPI") - os.Exit(1) - } - checker = mgr.GetWebhookServer().StartedChecker() - } - - //+kubebuilder:scaffold:builder - - if err := mgr.AddHealthzCheck("healthz", checker); err != nil { - setupLog.Error(err, "unable to set up health check") - os.Exit(1) - } - if err := mgr.AddReadyzCheck("readyz", checker); err != nil { - setupLog.Error(err, "unable to set up ready check") - os.Exit(1) - } - - setupLog.Info("starting manager") - if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil { - setupLog.Error(err, "problem running manager") - os.Exit(1) - } -} diff --git a/tests/functional/base_test.go b/test/functional/base_test.go similarity index 99% rename from tests/functional/base_test.go rename to test/functional/base_test.go index c09684e2b..f49bfdd9c 100644 --- a/tests/functional/base_test.go +++ b/test/functional/base_test.go @@ -27,7 +27,7 @@ import ( "sigs.k8s.io/controller-runtime/pkg/client" keystonev1 "github.com/openstack-k8s-operators/keystone-operator/api/v1beta1" - keystone_base "github.com/openstack-k8s-operators/keystone-operator/pkg/keystone" + keystone_base "github.com/openstack-k8s-operators/keystone-operator/internal/keystone" condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) diff --git a/tests/functional/keystoneapi_controller_test.go b/test/functional/keystoneapi_controller_test.go similarity index 100% rename from tests/functional/keystoneapi_controller_test.go rename to test/functional/keystoneapi_controller_test.go diff --git a/tests/functional/keystoneapi_webhook_test.go b/test/functional/keystoneapi_webhook_test.go similarity index 100% rename from tests/functional/keystoneapi_webhook_test.go rename to test/functional/keystoneapi_webhook_test.go diff --git a/tests/functional/suite_test.go b/test/functional/suite_test.go similarity index 95% rename from tests/functional/suite_test.go rename to test/functional/suite_test.go index 722e1e5b1..ac56afa7a 100644 --- a/tests/functional/suite_test.go +++ b/test/functional/suite_test.go @@ -33,8 +33,9 @@ import ( topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1" keystone_test "github.com/openstack-k8s-operators/keystone-operator/api/test/helpers" keystonev1 "github.com/openstack-k8s-operators/keystone-operator/api/v1beta1" - "github.com/openstack-k8s-operators/keystone-operator/controllers" - keystone_base "github.com/openstack-k8s-operators/keystone-operator/pkg/keystone" + "github.com/openstack-k8s-operators/keystone-operator/internal/controller" + keystone_base "github.com/openstack-k8s-operators/keystone-operator/internal/keystone" + webhookv1beta1 "github.com/openstack-k8s-operators/keystone-operator/internal/webhook/v1beta1" common_test "github.com/openstack-k8s-operators/lib-common/modules/common/test/helpers" test "github.com/openstack-k8s-operators/lib-common/modules/test" mariadb_test "github.com/openstack-k8s-operators/mariadb-operator/api/test/helpers" @@ -167,12 +168,13 @@ var _ = BeforeSuite(func() { kclient, err := kubernetes.NewForConfig(cfg) Expect(err).ToNot(HaveOccurred(), "failed to create kclient") - err = (&keystonev1.KeystoneAPI{}).SetupWebhookWithManager(k8sManager) - Expect(err).NotTo(HaveOccurred()) - + // Setup webhook defaults keystonev1.SetupDefaults() - err = (&controllers.KeystoneAPIReconciler{ + err = webhookv1beta1.SetupKeystoneAPIWebhookWithManager(k8sManager) + Expect(err).NotTo(HaveOccurred()) + + err = (&controller.KeystoneAPIReconciler{ Client: k8sManager.GetClient(), Scheme: k8sManager.GetScheme(), Kclient: kclient, diff --git a/tests/kuttl/common/assert_sample_deployment.yaml b/test/kuttl/common/assert_sample_deployment.yaml similarity index 98% rename from tests/kuttl/common/assert_sample_deployment.yaml rename to test/kuttl/common/assert_sample_deployment.yaml index 02d3c6c72..c5c387463 100644 --- a/tests/kuttl/common/assert_sample_deployment.yaml +++ b/test/kuttl/common/assert_sample_deployment.yaml @@ -156,7 +156,7 @@ commands: fi # when using image digests the containerImage URLs are SHA's so we verify them with a script - tupleTemplate='{{ range (index .spec.template.spec.containers 1).env }}{{ .name }}{{ "#" }}{{ .value}}{{"\n"}}{{ end }}' + tupleTemplate='{{ range (index .spec.template.spec.containers 0).env }}{{ .name }}{{ "#" }}{{ .value}}{{"\n"}}{{ end }}' imageTuples=$(oc get -n openstack-operators deployment keystone-operator-controller-manager -o go-template="$tupleTemplate") # format of imageTuple is: RELATED_IMAGE_KEYSTONE_# separated by newlines for ITEM in $(echo $imageTuples); do diff --git a/tests/kuttl/common/assert_tls_cert.yaml b/test/kuttl/common/assert_tls_cert.yaml similarity index 100% rename from tests/kuttl/common/assert_tls_cert.yaml rename to test/kuttl/common/assert_tls_cert.yaml diff --git a/tests/kuttl/common/cleanup-keystone.yaml b/test/kuttl/common/cleanup-keystone.yaml similarity index 100% rename from tests/kuttl/common/cleanup-keystone.yaml rename to test/kuttl/common/cleanup-keystone.yaml diff --git a/tests/kuttl/common/errors_cleanup_keystone.yaml b/test/kuttl/common/errors_cleanup_keystone.yaml similarity index 100% rename from tests/kuttl/common/errors_cleanup_keystone.yaml rename to test/kuttl/common/errors_cleanup_keystone.yaml diff --git a/tests/kuttl/common/keystoneapi_deploy.yaml b/test/kuttl/common/keystoneapi_deploy.yaml similarity index 100% rename from tests/kuttl/common/keystoneapi_deploy.yaml rename to test/kuttl/common/keystoneapi_deploy.yaml diff --git a/tests/kuttl/common/keystoneapi_tls_deploy.yaml b/test/kuttl/common/keystoneapi_tls_deploy.yaml similarity index 100% rename from tests/kuttl/common/keystoneapi_tls_deploy.yaml rename to test/kuttl/common/keystoneapi_tls_deploy.yaml diff --git a/tests/kuttl/common/patch_keystone_deploy.yaml b/test/kuttl/common/patch_keystone_deploy.yaml similarity index 100% rename from tests/kuttl/common/patch_keystone_deploy.yaml rename to test/kuttl/common/patch_keystone_deploy.yaml diff --git a/tests/kuttl/common/scripts/check_debug_in_keystone_pod_logs.sh b/test/kuttl/common/scripts/check_debug_in_keystone_pod_logs.sh similarity index 100% rename from tests/kuttl/common/scripts/check_debug_in_keystone_pod_logs.sh rename to test/kuttl/common/scripts/check_debug_in_keystone_pod_logs.sh diff --git a/tests/kuttl/common/scripts/create_test_token.sh b/test/kuttl/common/scripts/create_test_token.sh similarity index 100% rename from tests/kuttl/common/scripts/create_test_token.sh rename to test/kuttl/common/scripts/create_test_token.sh diff --git a/tests/kuttl/common/scripts/rotate_token.sh b/test/kuttl/common/scripts/rotate_token.sh similarity index 100% rename from tests/kuttl/common/scripts/rotate_token.sh rename to test/kuttl/common/scripts/rotate_token.sh diff --git a/tests/kuttl/common/scripts/test_invalid_token.sh b/test/kuttl/common/scripts/test_invalid_token.sh similarity index 100% rename from tests/kuttl/common/scripts/test_invalid_token.sh rename to test/kuttl/common/scripts/test_invalid_token.sh diff --git a/tests/kuttl/common/scripts/validate_test_token.sh b/test/kuttl/common/scripts/validate_test_token.sh similarity index 100% rename from tests/kuttl/common/scripts/validate_test_token.sh rename to test/kuttl/common/scripts/validate_test_token.sh diff --git a/tests/kuttl/common/tls_ca_bundle.yaml b/test/kuttl/common/tls_ca_bundle.yaml similarity index 100% rename from tests/kuttl/common/tls_ca_bundle.yaml rename to test/kuttl/common/tls_ca_bundle.yaml diff --git a/tests/kuttl/common/tls_cert_keystone-internal-svc.yaml b/test/kuttl/common/tls_cert_keystone-internal-svc.yaml similarity index 100% rename from tests/kuttl/common/tls_cert_keystone-internal-svc.yaml rename to test/kuttl/common/tls_cert_keystone-internal-svc.yaml diff --git a/tests/kuttl/common/tls_cert_keystone-public-svc.yaml b/test/kuttl/common/tls_cert_keystone-public-svc.yaml similarity index 100% rename from tests/kuttl/common/tls_cert_keystone-public-svc.yaml rename to test/kuttl/common/tls_cert_keystone-public-svc.yaml diff --git a/tests/kuttl/tests/change_keystone_config/00-assert.yaml b/test/kuttl/tests/change_keystone_config/00-assert.yaml similarity index 100% rename from tests/kuttl/tests/change_keystone_config/00-assert.yaml rename to test/kuttl/tests/change_keystone_config/00-assert.yaml diff --git a/tests/kuttl/tests/change_keystone_config/00-deploy_keystone.yaml b/test/kuttl/tests/change_keystone_config/00-deploy_keystone.yaml similarity index 100% rename from tests/kuttl/tests/change_keystone_config/00-deploy_keystone.yaml rename to test/kuttl/tests/change_keystone_config/00-deploy_keystone.yaml diff --git a/tests/kuttl/tests/change_keystone_config/01-assert.yaml b/test/kuttl/tests/change_keystone_config/01-assert.yaml similarity index 100% rename from tests/kuttl/tests/change_keystone_config/01-assert.yaml rename to test/kuttl/tests/change_keystone_config/01-assert.yaml diff --git a/tests/kuttl/tests/change_keystone_config/02-assert.yaml b/test/kuttl/tests/change_keystone_config/02-assert.yaml similarity index 100% rename from tests/kuttl/tests/change_keystone_config/02-assert.yaml rename to test/kuttl/tests/change_keystone_config/02-assert.yaml diff --git a/tests/kuttl/tests/change_keystone_config/02-change_keystone_config.yaml b/test/kuttl/tests/change_keystone_config/02-change_keystone_config.yaml similarity index 100% rename from tests/kuttl/tests/change_keystone_config/02-change_keystone_config.yaml rename to test/kuttl/tests/change_keystone_config/02-change_keystone_config.yaml diff --git a/tests/kuttl/tests/change_keystone_config/03-cleanup-keystone.yaml b/test/kuttl/tests/change_keystone_config/03-cleanup-keystone.yaml similarity index 100% rename from tests/kuttl/tests/change_keystone_config/03-cleanup-keystone.yaml rename to test/kuttl/tests/change_keystone_config/03-cleanup-keystone.yaml diff --git a/tests/kuttl/tests/change_keystone_config/03-errors.yaml b/test/kuttl/tests/change_keystone_config/03-errors.yaml similarity index 100% rename from tests/kuttl/tests/change_keystone_config/03-errors.yaml rename to test/kuttl/tests/change_keystone_config/03-errors.yaml diff --git a/tests/kuttl/tests/fernet_rotation/00-assert.yaml b/test/kuttl/tests/fernet_rotation/00-assert.yaml similarity index 100% rename from tests/kuttl/tests/fernet_rotation/00-assert.yaml rename to test/kuttl/tests/fernet_rotation/00-assert.yaml diff --git a/tests/kuttl/tests/fernet_rotation/00-deploy_keystone.yaml b/test/kuttl/tests/fernet_rotation/00-deploy_keystone.yaml similarity index 100% rename from tests/kuttl/tests/fernet_rotation/00-deploy_keystone.yaml rename to test/kuttl/tests/fernet_rotation/00-deploy_keystone.yaml diff --git a/tests/kuttl/tests/fernet_rotation/01-assert.yaml b/test/kuttl/tests/fernet_rotation/01-assert.yaml similarity index 100% rename from tests/kuttl/tests/fernet_rotation/01-assert.yaml rename to test/kuttl/tests/fernet_rotation/01-assert.yaml diff --git a/tests/kuttl/tests/fernet_rotation/01-deploy_openstackclient.yaml b/test/kuttl/tests/fernet_rotation/01-deploy_openstackclient.yaml similarity index 100% rename from tests/kuttl/tests/fernet_rotation/01-deploy_openstackclient.yaml rename to test/kuttl/tests/fernet_rotation/01-deploy_openstackclient.yaml diff --git a/tests/kuttl/tests/fernet_rotation/02-assert.yaml b/test/kuttl/tests/fernet_rotation/02-assert.yaml similarity index 100% rename from tests/kuttl/tests/fernet_rotation/02-assert.yaml rename to test/kuttl/tests/fernet_rotation/02-assert.yaml diff --git a/tests/kuttl/tests/fernet_rotation/02-rotate_keys.yaml b/test/kuttl/tests/fernet_rotation/02-rotate_keys.yaml similarity index 100% rename from tests/kuttl/tests/fernet_rotation/02-rotate_keys.yaml rename to test/kuttl/tests/fernet_rotation/02-rotate_keys.yaml diff --git a/tests/kuttl/tests/fernet_rotation/03-assert.yaml b/test/kuttl/tests/fernet_rotation/03-assert.yaml similarity index 100% rename from tests/kuttl/tests/fernet_rotation/03-assert.yaml rename to test/kuttl/tests/fernet_rotation/03-assert.yaml diff --git a/tests/kuttl/tests/fernet_rotation/03-rotate_keys_until_invalidate.yaml b/test/kuttl/tests/fernet_rotation/03-rotate_keys_until_invalidate.yaml similarity index 100% rename from tests/kuttl/tests/fernet_rotation/03-rotate_keys_until_invalidate.yaml rename to test/kuttl/tests/fernet_rotation/03-rotate_keys_until_invalidate.yaml diff --git a/tests/kuttl/tests/fernet_rotation/04-cleanup-openstackclient.yaml b/test/kuttl/tests/fernet_rotation/04-cleanup-openstackclient.yaml similarity index 100% rename from tests/kuttl/tests/fernet_rotation/04-cleanup-openstackclient.yaml rename to test/kuttl/tests/fernet_rotation/04-cleanup-openstackclient.yaml diff --git a/tests/kuttl/tests/fernet_rotation/05-cleanup-keystone.yaml b/test/kuttl/tests/fernet_rotation/05-cleanup-keystone.yaml similarity index 100% rename from tests/kuttl/tests/fernet_rotation/05-cleanup-keystone.yaml rename to test/kuttl/tests/fernet_rotation/05-cleanup-keystone.yaml diff --git a/tests/kuttl/tests/fernet_rotation/05-errors.yaml b/test/kuttl/tests/fernet_rotation/05-errors.yaml similarity index 100% rename from tests/kuttl/tests/fernet_rotation/05-errors.yaml rename to test/kuttl/tests/fernet_rotation/05-errors.yaml diff --git a/tests/kuttl/tests/keystone_resources/00-assert.yaml b/test/kuttl/tests/keystone_resources/00-assert.yaml similarity index 100% rename from tests/kuttl/tests/keystone_resources/00-assert.yaml rename to test/kuttl/tests/keystone_resources/00-assert.yaml diff --git a/tests/kuttl/tests/keystone_resources/00-deploy_keystone.yaml b/test/kuttl/tests/keystone_resources/00-deploy_keystone.yaml similarity index 100% rename from tests/kuttl/tests/keystone_resources/00-deploy_keystone.yaml rename to test/kuttl/tests/keystone_resources/00-deploy_keystone.yaml diff --git a/tests/kuttl/tests/keystone_resources/01-assert.yaml b/test/kuttl/tests/keystone_resources/01-assert.yaml similarity index 100% rename from tests/kuttl/tests/keystone_resources/01-assert.yaml rename to test/kuttl/tests/keystone_resources/01-assert.yaml diff --git a/tests/kuttl/tests/keystone_resources/01-deploy-keystoneservice.yaml b/test/kuttl/tests/keystone_resources/01-deploy-keystoneservice.yaml similarity index 100% rename from tests/kuttl/tests/keystone_resources/01-deploy-keystoneservice.yaml rename to test/kuttl/tests/keystone_resources/01-deploy-keystoneservice.yaml diff --git a/tests/kuttl/tests/keystone_resources/02-assert.yaml b/test/kuttl/tests/keystone_resources/02-assert.yaml similarity index 100% rename from tests/kuttl/tests/keystone_resources/02-assert.yaml rename to test/kuttl/tests/keystone_resources/02-assert.yaml diff --git a/tests/kuttl/tests/keystone_resources/02-deploy-keystoneendpoint.yaml b/test/kuttl/tests/keystone_resources/02-deploy-keystoneendpoint.yaml similarity index 100% rename from tests/kuttl/tests/keystone_resources/02-deploy-keystoneendpoint.yaml rename to test/kuttl/tests/keystone_resources/02-deploy-keystoneendpoint.yaml diff --git a/tests/kuttl/tests/keystone_resources/03-assert.yaml b/test/kuttl/tests/keystone_resources/03-assert.yaml similarity index 100% rename from tests/kuttl/tests/keystone_resources/03-assert.yaml rename to test/kuttl/tests/keystone_resources/03-assert.yaml diff --git a/tests/kuttl/tests/keystone_resources/03-cleanup-keystoneendpoint.yaml b/test/kuttl/tests/keystone_resources/03-cleanup-keystoneendpoint.yaml similarity index 100% rename from tests/kuttl/tests/keystone_resources/03-cleanup-keystoneendpoint.yaml rename to test/kuttl/tests/keystone_resources/03-cleanup-keystoneendpoint.yaml diff --git a/tests/kuttl/tests/keystone_resources/03-errors.yaml b/test/kuttl/tests/keystone_resources/03-errors.yaml similarity index 100% rename from tests/kuttl/tests/keystone_resources/03-errors.yaml rename to test/kuttl/tests/keystone_resources/03-errors.yaml diff --git a/tests/kuttl/tests/keystone_resources/04-assert.yaml b/test/kuttl/tests/keystone_resources/04-assert.yaml similarity index 100% rename from tests/kuttl/tests/keystone_resources/04-assert.yaml rename to test/kuttl/tests/keystone_resources/04-assert.yaml diff --git a/tests/kuttl/tests/keystone_resources/04-cleanup-keystoneservice.yaml b/test/kuttl/tests/keystone_resources/04-cleanup-keystoneservice.yaml similarity index 100% rename from tests/kuttl/tests/keystone_resources/04-cleanup-keystoneservice.yaml rename to test/kuttl/tests/keystone_resources/04-cleanup-keystoneservice.yaml diff --git a/tests/kuttl/tests/keystone_resources/04-errors.yaml b/test/kuttl/tests/keystone_resources/04-errors.yaml similarity index 100% rename from tests/kuttl/tests/keystone_resources/04-errors.yaml rename to test/kuttl/tests/keystone_resources/04-errors.yaml diff --git a/tests/kuttl/tests/keystone_resources/05-cleanup-keystone.yaml b/test/kuttl/tests/keystone_resources/05-cleanup-keystone.yaml similarity index 100% rename from tests/kuttl/tests/keystone_resources/05-cleanup-keystone.yaml rename to test/kuttl/tests/keystone_resources/05-cleanup-keystone.yaml diff --git a/tests/kuttl/tests/keystone_resources/05-errors.yaml b/test/kuttl/tests/keystone_resources/05-errors.yaml similarity index 100% rename from tests/kuttl/tests/keystone_resources/05-errors.yaml rename to test/kuttl/tests/keystone_resources/05-errors.yaml diff --git a/tests/kuttl/tests/keystone_scale/00-assert.yaml b/test/kuttl/tests/keystone_scale/00-assert.yaml similarity index 100% rename from tests/kuttl/tests/keystone_scale/00-assert.yaml rename to test/kuttl/tests/keystone_scale/00-assert.yaml diff --git a/tests/kuttl/tests/keystone_scale/00-deploy_keystone.yaml b/test/kuttl/tests/keystone_scale/00-deploy_keystone.yaml similarity index 100% rename from tests/kuttl/tests/keystone_scale/00-deploy_keystone.yaml rename to test/kuttl/tests/keystone_scale/00-deploy_keystone.yaml diff --git a/tests/kuttl/tests/keystone_scale/01-assert.yaml b/test/kuttl/tests/keystone_scale/01-assert.yaml similarity index 100% rename from tests/kuttl/tests/keystone_scale/01-assert.yaml rename to test/kuttl/tests/keystone_scale/01-assert.yaml diff --git a/tests/kuttl/tests/keystone_scale/01-scale-keystoneapi.yaml b/test/kuttl/tests/keystone_scale/01-scale-keystoneapi.yaml similarity index 100% rename from tests/kuttl/tests/keystone_scale/01-scale-keystoneapi.yaml rename to test/kuttl/tests/keystone_scale/01-scale-keystoneapi.yaml diff --git a/tests/kuttl/tests/keystone_scale/02-assert.yaml b/test/kuttl/tests/keystone_scale/02-assert.yaml similarity index 100% rename from tests/kuttl/tests/keystone_scale/02-assert.yaml rename to test/kuttl/tests/keystone_scale/02-assert.yaml diff --git a/tests/kuttl/tests/keystone_scale/02-scale-down-keystoneapi.yaml b/test/kuttl/tests/keystone_scale/02-scale-down-keystoneapi.yaml similarity index 100% rename from tests/kuttl/tests/keystone_scale/02-scale-down-keystoneapi.yaml rename to test/kuttl/tests/keystone_scale/02-scale-down-keystoneapi.yaml diff --git a/tests/kuttl/tests/keystone_scale/03-assert.yaml b/test/kuttl/tests/keystone_scale/03-assert.yaml similarity index 100% rename from tests/kuttl/tests/keystone_scale/03-assert.yaml rename to test/kuttl/tests/keystone_scale/03-assert.yaml diff --git a/tests/kuttl/tests/keystone_scale/03-errors.yaml b/test/kuttl/tests/keystone_scale/03-errors.yaml similarity index 100% rename from tests/kuttl/tests/keystone_scale/03-errors.yaml rename to test/kuttl/tests/keystone_scale/03-errors.yaml diff --git a/tests/kuttl/tests/keystone_scale/03-scale-down-zero-keystoneapi.yaml b/test/kuttl/tests/keystone_scale/03-scale-down-zero-keystoneapi.yaml similarity index 100% rename from tests/kuttl/tests/keystone_scale/03-scale-down-zero-keystoneapi.yaml rename to test/kuttl/tests/keystone_scale/03-scale-down-zero-keystoneapi.yaml diff --git a/tests/kuttl/tests/keystone_scale/04-cleanup-keystone.yaml b/test/kuttl/tests/keystone_scale/04-cleanup-keystone.yaml similarity index 100% rename from tests/kuttl/tests/keystone_scale/04-cleanup-keystone.yaml rename to test/kuttl/tests/keystone_scale/04-cleanup-keystone.yaml diff --git a/tests/kuttl/tests/keystone_scale/04-errors.yaml b/test/kuttl/tests/keystone_scale/04-errors.yaml similarity index 100% rename from tests/kuttl/tests/keystone_scale/04-errors.yaml rename to test/kuttl/tests/keystone_scale/04-errors.yaml diff --git a/tests/kuttl/tests/keystone_tls/00-assert.yaml b/test/kuttl/tests/keystone_tls/00-assert.yaml similarity index 100% rename from tests/kuttl/tests/keystone_tls/00-assert.yaml rename to test/kuttl/tests/keystone_tls/00-assert.yaml diff --git a/tests/kuttl/tests/keystone_tls/00-tls_ca_bundle.yaml b/test/kuttl/tests/keystone_tls/00-tls_ca_bundle.yaml similarity index 100% rename from tests/kuttl/tests/keystone_tls/00-tls_ca_bundle.yaml rename to test/kuttl/tests/keystone_tls/00-tls_ca_bundle.yaml diff --git a/tests/kuttl/tests/keystone_tls/00-tls_cert_keystone-internal-svc.yaml b/test/kuttl/tests/keystone_tls/00-tls_cert_keystone-internal-svc.yaml similarity index 100% rename from tests/kuttl/tests/keystone_tls/00-tls_cert_keystone-internal-svc.yaml rename to test/kuttl/tests/keystone_tls/00-tls_cert_keystone-internal-svc.yaml diff --git a/tests/kuttl/tests/keystone_tls/00-tls_cert_keystone-public-svc.yaml b/test/kuttl/tests/keystone_tls/00-tls_cert_keystone-public-svc.yaml similarity index 100% rename from tests/kuttl/tests/keystone_tls/00-tls_cert_keystone-public-svc.yaml rename to test/kuttl/tests/keystone_tls/00-tls_cert_keystone-public-svc.yaml diff --git a/tests/kuttl/tests/keystone_tls/01-assert.yaml b/test/kuttl/tests/keystone_tls/01-assert.yaml similarity index 100% rename from tests/kuttl/tests/keystone_tls/01-assert.yaml rename to test/kuttl/tests/keystone_tls/01-assert.yaml diff --git a/tests/kuttl/tests/keystone_tls/01-keystoneapi_tls_deploy.yaml b/test/kuttl/tests/keystone_tls/01-keystoneapi_tls_deploy.yaml similarity index 100% rename from tests/kuttl/tests/keystone_tls/01-keystoneapi_tls_deploy.yaml rename to test/kuttl/tests/keystone_tls/01-keystoneapi_tls_deploy.yaml diff --git a/tests/kuttl/tests/keystone_tls/02-cleanup-keystone.yaml b/test/kuttl/tests/keystone_tls/02-cleanup-keystone.yaml similarity index 100% rename from tests/kuttl/tests/keystone_tls/02-cleanup-keystone.yaml rename to test/kuttl/tests/keystone_tls/02-cleanup-keystone.yaml diff --git a/tests/kuttl/tests/keystone_tls/02-errors.yaml b/test/kuttl/tests/keystone_tls/02-errors.yaml similarity index 100% rename from tests/kuttl/tests/keystone_tls/02-errors.yaml rename to test/kuttl/tests/keystone_tls/02-errors.yaml diff --git a/zuul.d/projects.yaml b/zuul.d/projects.yaml index 873aafa5f..168e8830d 100644 --- a/zuul.d/projects.yaml +++ b/zuul.d/projects.yaml @@ -3,7 +3,9 @@ name: openstack-k8s-operators/keystone-operator github-check: jobs: - - openstack-k8s-operators-content-provider + - openstack-k8s-operators-content-provider: + vars: + cifmw_install_yamls_sdk_version: v1.41.1 - keystone-operator-kuttl: dependencies: - openstack-k8s-operators-content-provider