Skip to content

Commit 4e33392

Browse files
author
Per Goncalves da Silva
committed
Revert API changes
Signed-off-by: Per Goncalves da Silva <[email protected]>
1 parent e89394b commit 4e33392

File tree

12 files changed

+237
-206
lines changed

12 files changed

+237
-206
lines changed

‎api/v1/clusterextension_types.go‎

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -66,19 +66,10 @@ type ClusterExtensionSpec struct {
6666
// with the cluster that are required to manage the extension.
6767
// The ServiceAccount must be configured with the necessary permissions to perform these interactions.
6868
// The ServiceAccount must exist in the namespace referenced in the spec.
69+
// serviceAccount is required.
6970
//
70-
// serviceAccount is optional. If a service account is not defined, requests to the apiserver will instead use
71-
// username "olmv1:clusterextensions:<clusterExtension.metadata.name>:admin" and groups
72-
// "olmv1:clusterextensions:admin" and "system:authenticated"
73-
//
74-
// Deprecated: Use of serviceAccount is not recommended. Instead, administrators are encouraged
75-
// to use the synthetic user/groups described above. All of the same RBAC setup is still required with these
76-
// synthetic user/groups. However, this mode is preferred because it requires administrators to specifically
77-
// configure RBAC for extension management, rather than enabling piggybacking on existing highly privileged
78-
// service accounts that already exist on the cluster.
79-
//
80-
// +optional
81-
ServiceAccount *ServiceAccountReference `json:"serviceAccount"`
71+
// +kubebuilder:validation:Required
72+
ServiceAccount ServiceAccountReference `json:"serviceAccount"`
8273

8374
// source is a required field which selects the installation source of content
8475
// for this ClusterExtension. Selection is performed by setting the sourceType.

‎api/v1/zz_generated.deepcopy.go‎

Lines changed: 1 addition & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/base/operator-controller/crd/bases/olm.operatorframework.io_clusterextensions.yaml‎

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -135,16 +135,7 @@ spec:
135135
with the cluster that are required to manage the extension.
136136
The ServiceAccount must be configured with the necessary permissions to perform these interactions.
137137
The ServiceAccount must exist in the namespace referenced in the spec.
138-
139-
serviceAccount is optional. If a service account is not defined, requests to the apiserver will instead use
140-
username "olmv1:clusterextensions:<clusterExtension.metadata.name>:admin" and groups
141-
"olmv1:clusterextensions:admin" and "system:authenticated"
142-
143-
Deprecated: Use of serviceAccount is not recommended. Instead, administrators are encouraged
144-
to use the synthetic user/groups described above. All of the same RBAC setup is still required with these
145-
synthetic user/groups. However, this mode is preferred because it requires administrators to specifically
146-
configure RBAC for extension management, rather than enabling piggybacking on existing highly privileged
147-
service accounts that already exist on the cluster.
138+
serviceAccount is required.
148139
properties:
149140
name:
150141
description: |-
@@ -467,6 +458,7 @@ spec:
467458
has(self.catalog) : !has(self.catalog)'
468459
required:
469460
- namespace
461+
- serviceAccount
470462
- source
471463
type: object
472464
status:

‎config/base/operator-controller/rbac/role.yaml‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,6 @@ kind: ClusterRole
44
metadata:
55
name: manager-role
66
rules:
7-
- apiGroups:
8-
- ""
9-
resources:
10-
- groups
11-
- users
12-
verbs:
13-
- impersonate
147
- apiGroups:
158
- ""
169
resources:

‎config/samples/olm_v1_clusterextension.yaml‎

Lines changed: 22 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,13 @@
22
apiVersion: v1
33
kind: Namespace
44
metadata:
5-
name: argocd-system
5+
name: argocd
6+
---
7+
apiVersion: v1
8+
kind: ServiceAccount
9+
metadata:
10+
name: argocd-installer
11+
namespace: argocd
612
---
713
apiVersion: rbac.authorization.k8s.io/v1
814
kind: ClusterRoleBinding
@@ -13,8 +19,9 @@ roleRef:
1319
kind: ClusterRole
1420
name: argocd-installer-clusterrole
1521
subjects:
16-
- kind: User
17-
name: "olmv1:clusterextensions:argocd-operator:admin"
22+
- kind: ServiceAccount
23+
name: argocd-installer
24+
namespace: argocd
1825
---
1926
apiVersion: rbac.authorization.k8s.io/v1
2027
kind: ClusterRole
@@ -69,8 +76,9 @@ roleRef:
6976
kind: ClusterRole
7077
name: argocd-installer-rbac-clusterrole
7178
subjects:
72-
- kind: User
73-
name: "olmv1:clusterextensions:argocd-operator:admin"
79+
- kind: ServiceAccount
80+
name: argocd-installer
81+
namespace: argocd
7482
---
7583
apiVersion: rbac.authorization.k8s.io/v1
7684
kind: ClusterRole
@@ -214,7 +222,7 @@ apiVersion: rbac.authorization.k8s.io/v1
214222
kind: Role
215223
metadata:
216224
name: argocd-installer-role
217-
namespace: argocd-system
225+
namespace: argocd
218226
rules:
219227
- apiGroups: [""]
220228
resources: [serviceaccounts]
@@ -252,21 +260,24 @@ apiVersion: rbac.authorization.k8s.io/v1
252260
kind: RoleBinding
253261
metadata:
254262
name: argocd-installer-binding
255-
namespace: argocd-system
263+
namespace: argocd
256264
roleRef:
257265
apiGroup: rbac.authorization.k8s.io
258266
kind: Role
259267
name: argocd-installer-role
260268
subjects:
261-
- kind: User
262-
name: "olmv1:clusterextensions:argocd-operator:admin"
269+
- kind: ServiceAccount
270+
name: argocd-installer
271+
namespace: argocd
263272
---
264273
apiVersion: olm.operatorframework.io/v1
265274
kind: ClusterExtension
266275
metadata:
267-
name: argocd-operator
276+
name: argocd
268277
spec:
269-
namespace: argocd-system
278+
namespace: argocd
279+
serviceAccount:
280+
name: argocd-installer
270281
source:
271282
sourceType: Catalog
272283
catalog:

‎docs/api-reference/operator-controller-api-reference.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -306,7 +306,7 @@ _Appears in:_
306306
| Field | Description | Default | Validation |
307307
| --- | --- | --- | --- |
308308
| `namespace` _string_ | namespace is a reference to a Kubernetes namespace.<br />This is the namespace in which the provided ServiceAccount must exist.<br />It also designates the default namespace where namespace-scoped resources<br />for the extension are applied to the cluster.<br />Some extensions may contain namespace-scoped resources to be applied in other namespaces.<br />This namespace must exist.<br /><br />namespace is required, immutable, and follows the DNS label standard<br />as defined in [RFC 1123]. It must contain only lowercase alphanumeric characters or hyphens (-),<br />start and end with an alphanumeric character, and be no longer than 63 characters<br /><br />[RFC 1123]: https://tools.ietf.org/html/rfc1123 | | MaxLength: 63 <br />Required: \{\} <br /> |
309-
| `serviceAccount` _[ServiceAccountReference](#serviceaccountreference)_ | serviceAccount is a reference to a ServiceAccount used to perform all interactions<br />with the cluster that are required to manage the extension.<br />The ServiceAccount must be configured with the necessary permissions to perform these interactions.<br />The ServiceAccount must exist in the namespace referenced in the spec.<br /><br />serviceAccount is optional. If a service account is not defined, requests to the apiserver will instead use<br />username "olmv1:clusterextensions:<clusterExtension.metadata.name>:admin" and groups<br />"olmv1:clusterextensions:admin" and "system:authenticated"<br /><br />Deprecated: Use of serviceAccount is not recommended. Instead, administrators are encouraged<br />to use the synthetic user/groups described above. All of the same RBAC setup is still required with these<br />synthetic user/groups. However, this mode is preferred because it requires administrators to specifically<br />configure RBAC for extension management, rather than enabling piggybacking on existing highly privileged<br />service accounts that already exist on the cluster. | | |
309+
| `serviceAccount` _[ServiceAccountReference](#serviceaccountreference)_ | serviceAccount is a reference to a ServiceAccount used to perform all interactions<br />with the cluster that are required to manage the extension.<br />The ServiceAccount must be configured with the necessary permissions to perform these interactions.<br />The ServiceAccount must exist in the namespace referenced in the spec.<br />serviceAccount is required. | | Required: \{\} <br /> |
310310
| `source` _[SourceConfig](#sourceconfig)_ | source is a required field which selects the installation source of content<br />for this ClusterExtension. Selection is performed by setting the sourceType.<br /><br />Catalog is currently the only implemented sourceType, and setting the<br />sourcetype to "Catalog" requires the catalog field to also be defined.<br /><br />Below is a minimal example of a source definition (in yaml):<br /><br />source:<br /> sourceType: Catalog<br /> catalog:<br /> packageName: example-package | | Required: \{\} <br /> |
311311
| `install` _[ClusterExtensionInstallConfig](#clusterextensioninstallconfig)_ | install is an optional field used to configure the installation options<br />for the ClusterExtension such as the pre-flight check configuration. | | |
312312

‎internal/operator-controller/controllers/clusterextension_admission_test.go‎

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,9 @@ func TestClusterExtensionSourceConfig(t *testing.T) {
4444
},
4545
},
4646
Namespace: "default",
47+
ServiceAccount: ocv1.ServiceAccountReference{
48+
Name: "default",
49+
},
4750
}))
4851
}
4952
if tc.unionField == "" {
@@ -52,6 +55,9 @@ func TestClusterExtensionSourceConfig(t *testing.T) {
5255
SourceType: tc.sourceType,
5356
},
5457
Namespace: "default",
58+
ServiceAccount: ocv1.ServiceAccountReference{
59+
Name: "default",
60+
},
5561
}))
5662
}
5763

@@ -108,6 +114,9 @@ func TestClusterExtensionAdmissionPackageName(t *testing.T) {
108114
},
109115
},
110116
Namespace: "default",
117+
ServiceAccount: ocv1.ServiceAccountReference{
118+
Name: "default",
119+
},
111120
}))
112121
if tc.errMsg == "" {
113122
require.NoError(t, err, "unexpected error for package name %q: %w", tc.pkgName, err)
@@ -203,6 +212,9 @@ func TestClusterExtensionAdmissionVersion(t *testing.T) {
203212
},
204213
},
205214
Namespace: "default",
215+
ServiceAccount: ocv1.ServiceAccountReference{
216+
Name: "default",
217+
},
206218
}))
207219
if tc.errMsg == "" {
208220
require.NoError(t, err, "unexpected error for version %q: %w", tc.version, err)
@@ -255,6 +267,9 @@ func TestClusterExtensionAdmissionChannel(t *testing.T) {
255267
},
256268
},
257269
Namespace: "default",
270+
ServiceAccount: ocv1.ServiceAccountReference{
271+
Name: "default",
272+
},
258273
}))
259274
if tc.errMsg == "" {
260275
require.NoError(t, err, "unexpected error for channel %q: %w", tc.channels, err)
@@ -305,6 +320,9 @@ func TestClusterExtensionAdmissionInstallNamespace(t *testing.T) {
305320
},
306321
},
307322
Namespace: tc.namespace,
323+
ServiceAccount: ocv1.ServiceAccountReference{
324+
Name: "default",
325+
},
308326
}))
309327
if tc.errMsg == "" {
310328
require.NoError(t, err, "unexpected error for namespace %q: %w", tc.namespace, err)
@@ -356,7 +374,7 @@ func TestClusterExtensionAdmissionServiceAccount(t *testing.T) {
356374
},
357375
},
358376
Namespace: "default",
359-
ServiceAccount: &ocv1.ServiceAccountReference{
377+
ServiceAccount: ocv1.ServiceAccountReference{
360378
Name: tc.serviceAccount,
361379
},
362380
}))
@@ -415,7 +433,10 @@ func TestClusterExtensionAdmissionInstall(t *testing.T) {
415433
},
416434
},
417435
Namespace: "default",
418-
Install: tc.installConfig,
436+
ServiceAccount: ocv1.ServiceAccountReference{
437+
Name: "default",
438+
},
439+
Install: tc.installConfig,
419440
}))
420441
if tc.errMsg == "" {
421442
require.NoError(t, err, "unexpected error for install configuration %v: %w", tc.installConfig, err)

‎internal/operator-controller/controllers/clusterextension_controller.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,6 @@ type InstalledBundleGetter interface {
9595
//+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clusterextensions/finalizers,verbs=update
9696
//+kubebuilder:rbac:namespace=system,groups=core,resources=secrets,verbs=create;update;patch;delete;deletecollection;get;list;watch
9797
//+kubebuilder:rbac:groups=core,resources=serviceaccounts/token,verbs=create
98-
//+kubebuilder:rbac:groups=core,resources=users;groups,verbs=impersonate
9998
//+kubebuilder:rbac:groups=apiextensions.k8s.io,resources=customresourcedefinitions,verbs=get
10099

101100
//+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clustercatalogs,verbs=list;watch

‎internal/operator-controller/controllers/clusterextension_controller_test.go‎

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,9 @@ func TestClusterExtensionResolutionFails(t *testing.T) {
6969
},
7070
},
7171
Namespace: "default",
72+
ServiceAccount: ocv1.ServiceAccountReference{
73+
Name: "default",
74+
},
7275
},
7376
}
7477
require.NoError(t, cl.Create(ctx, clusterExtension))
@@ -128,6 +131,7 @@ func TestClusterExtensionResolutionSuccessfulUnpackFails(t *testing.T) {
128131
pkgVer := "1.0.0"
129132
pkgChan := "beta"
130133
namespace := fmt.Sprintf("test-ns-%s", rand.String(8))
134+
serviceAccount := fmt.Sprintf("test-sa-%s", rand.String(8))
131135

132136
clusterExtension := &ocv1.ClusterExtension{
133137
ObjectMeta: metav1.ObjectMeta{Name: extKey.Name},
@@ -141,6 +145,9 @@ func TestClusterExtensionResolutionSuccessfulUnpackFails(t *testing.T) {
141145
},
142146
},
143147
Namespace: namespace,
148+
ServiceAccount: ocv1.ServiceAccountReference{
149+
Name: serviceAccount,
150+
},
144151
},
145152
}
146153
err := cl.Create(ctx, clusterExtension)
@@ -204,6 +211,7 @@ func TestClusterExtensionResolutionAndUnpackSuccessfulApplierFails(t *testing.T)
204211
pkgVer := "1.0.0"
205212
pkgChan := "beta"
206213
namespace := fmt.Sprintf("test-ns-%s", rand.String(8))
214+
serviceAccount := fmt.Sprintf("test-sa-%s", rand.String(8))
207215

208216
clusterExtension := &ocv1.ClusterExtension{
209217
ObjectMeta: metav1.ObjectMeta{Name: extKey.Name},
@@ -217,6 +225,9 @@ func TestClusterExtensionResolutionAndUnpackSuccessfulApplierFails(t *testing.T)
217225
},
218226
},
219227
Namespace: namespace,
228+
ServiceAccount: ocv1.ServiceAccountReference{
229+
Name: serviceAccount,
230+
},
220231
},
221232
}
222233
err := cl.Create(ctx, clusterExtension)
@@ -284,7 +295,7 @@ func TestClusterExtensionServiceAccountNotFound(t *testing.T) {
284295
},
285296
},
286297
Namespace: "default",
287-
ServiceAccount: &ocv1.ServiceAccountReference{
298+
ServiceAccount: ocv1.ServiceAccountReference{
288299
Name: "missing-sa",
289300
},
290301
},
@@ -331,6 +342,7 @@ func TestClusterExtensionApplierFailsWithBundleInstalled(t *testing.T) {
331342
pkgVer := "1.0.0"
332343
pkgChan := "beta"
333344
namespace := fmt.Sprintf("test-ns-%s", rand.String(8))
345+
serviceAccount := fmt.Sprintf("test-sa-%s", rand.String(8))
334346

335347
clusterExtension := &ocv1.ClusterExtension{
336348
ObjectMeta: metav1.ObjectMeta{Name: extKey.Name},
@@ -344,6 +356,9 @@ func TestClusterExtensionApplierFailsWithBundleInstalled(t *testing.T) {
344356
},
345357
},
346358
Namespace: namespace,
359+
ServiceAccount: ocv1.ServiceAccountReference{
360+
Name: serviceAccount,
361+
},
347362
},
348363
}
349364
err := cl.Create(ctx, clusterExtension)
@@ -423,6 +438,7 @@ func TestClusterExtensionManagerFailed(t *testing.T) {
423438
pkgVer := "1.0.0"
424439
pkgChan := "beta"
425440
namespace := fmt.Sprintf("test-ns-%s", rand.String(8))
441+
serviceAccount := fmt.Sprintf("test-sa-%s", rand.String(8))
426442

427443
clusterExtension := &ocv1.ClusterExtension{
428444
ObjectMeta: metav1.ObjectMeta{Name: extKey.Name},
@@ -436,6 +452,9 @@ func TestClusterExtensionManagerFailed(t *testing.T) {
436452
},
437453
},
438454
Namespace: namespace,
455+
ServiceAccount: ocv1.ServiceAccountReference{
456+
Name: serviceAccount,
457+
},
439458
},
440459
}
441460
err := cl.Create(ctx, clusterExtension)
@@ -497,6 +516,7 @@ func TestClusterExtensionManagedContentCacheWatchFail(t *testing.T) {
497516
pkgVer := "1.0.0"
498517
pkgChan := "beta"
499518
installNamespace := fmt.Sprintf("test-ns-%s", rand.String(8))
519+
serviceAccount := fmt.Sprintf("test-sa-%s", rand.String(8))
500520

501521
clusterExtension := &ocv1.ClusterExtension{
502522
ObjectMeta: metav1.ObjectMeta{Name: extKey.Name},
@@ -511,6 +531,9 @@ func TestClusterExtensionManagedContentCacheWatchFail(t *testing.T) {
511531
},
512532
},
513533
Namespace: installNamespace,
534+
ServiceAccount: ocv1.ServiceAccountReference{
535+
Name: serviceAccount,
536+
},
514537
},
515538
}
516539
err := cl.Create(ctx, clusterExtension)
@@ -574,6 +597,7 @@ func TestClusterExtensionInstallationSucceeds(t *testing.T) {
574597
pkgVer := "1.0.0"
575598
pkgChan := "beta"
576599
namespace := fmt.Sprintf("test-ns-%s", rand.String(8))
600+
serviceAccount := fmt.Sprintf("test-sa-%s", rand.String(8))
577601

578602
clusterExtension := &ocv1.ClusterExtension{
579603
ObjectMeta: metav1.ObjectMeta{Name: extKey.Name},
@@ -587,6 +611,9 @@ func TestClusterExtensionInstallationSucceeds(t *testing.T) {
587611
},
588612
},
589613
Namespace: namespace,
614+
ServiceAccount: ocv1.ServiceAccountReference{
615+
Name: serviceAccount,
616+
},
590617
},
591618
}
592619
err := cl.Create(ctx, clusterExtension)
@@ -648,6 +675,7 @@ func TestClusterExtensionDeleteFinalizerFails(t *testing.T) {
648675
pkgVer := "1.0.0"
649676
pkgChan := "beta"
650677
namespace := fmt.Sprintf("test-ns-%s", rand.String(8))
678+
serviceAccount := fmt.Sprintf("test-sa-%s", rand.String(8))
651679

652680
clusterExtension := &ocv1.ClusterExtension{
653681
ObjectMeta: metav1.ObjectMeta{Name: extKey.Name},
@@ -661,6 +689,9 @@ func TestClusterExtensionDeleteFinalizerFails(t *testing.T) {
661689
},
662690
},
663691
Namespace: namespace,
692+
ServiceAccount: ocv1.ServiceAccountReference{
693+
Name: serviceAccount,
694+
},
664695
},
665696
}
666697
err := cl.Create(ctx, clusterExtension)

0 commit comments

Comments
 (0)