Skip to content

Commit 8178d2b

Browse files
tmshorttmshort
committed
WIP: Remove generation of rbac and webhooks
Signed-off-by: Todd Short <[email protected]>
1 parent 6e61180 commit 8178d2b

File tree

6 files changed

+0
-81
lines changed

6 files changed

+0
-81
lines changed

‎Makefile

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -149,16 +149,6 @@ KUSTOMIZE_OPCON_RBAC_DIR := helm/olmv1/base/operator-controller/rbac
149149
manifests: $(CONTROLLER_GEN) $(HELM) #EXHELP Generate WebhookConfiguration, ClusterRole, and CustomResourceDefinition objects.
150150
# Generate CRDs via our own generator
151151
hack/tools/update-crds.sh
152-
# Generate the remaining operator-controller standard manifests
153-
$(CONTROLLER_GEN) --load-build-tags=$(GO_BUILD_TAGS),standard rbac:roleName=operator-controller-manager-role paths="./internal/operator-controller/..." output:rbac:artifacts:config=$(KUSTOMIZE_OPCON_RBAC_DIR)/standard
154-
# Generate the remaining operator-controller experimental manifests
155-
$(CONTROLLER_GEN) --load-build-tags=$(GO_BUILD_TAGS) rbac:roleName=operator-controller-manager-role paths="./internal/operator-controller/..." output:rbac:artifacts:config=$(KUSTOMIZE_OPCON_RBAC_DIR)/experimental
156-
# Generate the remaining catalogd standard manifests
157-
$(CONTROLLER_GEN) --load-build-tags=$(GO_BUILD_TAGS),standard rbac:roleName=catalogd-manager-role paths="./internal/catalogd/..." output:rbac:artifacts:config=$(KUSTOMIZE_CATD_RBAC_DIR)/standard
158-
$(CONTROLLER_GEN) --load-build-tags=$(GO_BUILD_TAGS),standard webhook paths="./internal/catalogd/..." output:webhook:artifacts:config=$(KUSTOMIZE_CATD_WEBHOOKS_DIR)/standard
159-
# Generate the remaining catalogd experimental manifests
160-
$(CONTROLLER_GEN) --load-build-tags=$(GO_BUILD_TAGS) rbac:roleName=catalogd-manager-role paths="./internal/catalogd/..." output:rbac:artifacts:config=$(KUSTOMIZE_CATD_RBAC_DIR)/experimental
161-
$(CONTROLLER_GEN) --load-build-tags=$(GO_BUILD_TAGS) webhook paths="./internal/catalogd/..." output:webhook:artifacts:config=$(KUSTOMIZE_CATD_WEBHOOKS_DIR)/experimental
162152
# Update base config to include helm templates
163153
./hack/tools/patch-base-for-helm.sh
164154
# Generate manifests stored in source-control

‎hack/tools/patch-base-for-helm.sh

Lines changed: 0 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -7,53 +7,11 @@
77
# YAML once helm templating has been added.
88

99
# Patch catalogd rbac
10-
catalogd_rbac_filelist=(
11-
helm/olmv1/base/catalogd/rbac/experimental/*.yaml
12-
helm/olmv1/base/catalogd/rbac/standard/*.yaml
13-
)
14-
for f in "${catalogd_rbac_filelist[@]}"; do
15-
yq -i '.metadata.labels["app.kubernetes.io/name"] = "catalogd"' "${f}"
16-
yq -i 'with(.; select(.kind == "Role") | .rules += { "replaceMe": "catalogd-role-rules"})' "${f}"
17-
yq -i 'with(.; select(.kind == "ClusterRole") | .rules += { "replaceMe": "catalogd-cluster-role-rules"})' "${f}"
18-
done
19-
20-
# Patch operator-controller rbac
21-
operator_controller_rbac_filelist=(
22-
helm/olmv1/base/operator-controller/rbac/experimental/*.yaml
23-
helm/olmv1/base/operator-controller/rbac/standard/*.yaml
24-
)
25-
for f in "${operator_controller_rbac_filelist[@]}"; do
26-
yq -i '.metadata.labels["app.kubernetes.io/name"] = "operator-controller"' "${f}"
27-
yq -i 'with(.; select(.kind == "Role") | .rules += { "replaceMe": "operator-controller-role-rules"})' "${f}"
28-
yq -i 'with(.; select(.kind == "ClusterRole") | .rules += { "replaceMe": "operator-controller-cluster-role-rules"})' "${f}"
29-
done
30-
31-
# Patch catalogd webhook
32-
catalogd_webhook_filelist=(
33-
helm/olmv1/base/catalogd/webhook/experimental/*.yaml
34-
helm/olmv1/base/catalogd/webhook/standard/*.yaml
35-
)
36-
for f in "${catalogd_webhook_filelist[@]}"; do
37-
yq -i '.metadata.labels["app.kubernetes.io/name"] = "catalogd"' "${f}"
38-
yq -i '.metadata.name = "catalogd-mutating-webhook-configuration"' "${f}"
39-
yq -i '.metadata.annotations["catalogd-webhook-annotations"] = "replaceMe"' "${f}"
40-
yq -i '.webhooks[0].clientConfig.service.namespace = "olmv1-system"' "${f}"
41-
yq -i '.webhooks[0].clientConfig.service.name = "catalogd-service"' "${f}"
42-
yq -i '.webhooks[0].clientConfig.service.port = 9443' "${f}"
43-
yq -i '.webhooks[0].matchConditions[0].name = "MissingOrIncorrectMetadataNameLabel"' "${f}"
44-
yq -i '.webhooks[0].matchConditions[0].expression = "\"name\" in object.metadata && (!has(object.metadata.labels) || !(\"olm.operatorframework.io/metadata.name\" in object.metadata.labels) || object.metadata.labels[\"olm.operatorframework.io/metadata.name\"] != object.metadata.name)"' "${f}"
45-
done
4610

4711
# Patch everything generically
4812
filelist=(
49-
helm/olmv1/base/catalogd/rbac/experimental/*.yaml
50-
helm/olmv1/base/catalogd/rbac/standard/*.yaml
5113
helm/olmv1/base/catalogd/crd/experimental/*.yaml
5214
helm/olmv1/base/catalogd/crd/standard/*.yaml
53-
helm/olmv1/base/catalogd/webhook/experimental/*.yaml
54-
helm/olmv1/base/catalogd/webhook/standard/*.yaml
55-
helm/olmv1/base/operator-controller/rbac/experimental/*.yaml
56-
helm/olmv1/base/operator-controller/rbac/standard/*.yaml
5715
helm/olmv1/base/operator-controller/crd/experimental/*.yaml
5816
helm/olmv1/base/operator-controller/crd/standard/*.yaml
5917
)
@@ -64,13 +22,7 @@ for f in "${filelist[@]}"; do
6422
yq -i '.metadata.labels.replaceMe = "labels"' "${f}"
6523
# Replace with helm template - must be done last or yq will complain about the file format
6624
sed -i.bak 's/replaceMe: annotations/{{- include "olmv1.annotations" . | nindent 4 }}/g' "${f}"
67-
sed -i.bak 's/catalogd-webhook-annotations: replaceMe/{{- include "olmv1.catalogd.webhook.annotations" . | nindent 4 }}/g' "${f}"
6825
sed -i.bak 's/replaceMe: labels/{{- include "olmv1.labels" . | nindent 4 }}/g' "${f}"
69-
sed -i.bak 's/olmv1-system/{{ .Values.namespaces.olmv1.name }}/g' "${f}"
70-
sed -i.bak 's/- replaceMe: catalogd-role-rules/{{- include "olmv1.catalogd.role.rules" . | nindent 2 }}/g' "${f}"
71-
sed -i.bak 's/- replaceMe: catalogd-cluster-role-rules/{{- include "olmv1.catalogd.clusterRole.rules" . | nindent 2 }}/g' "${f}"
72-
sed -i.bak 's/- replaceMe: operator-controller-role-rules/{{- include "olmv1.operatorController.role.rules" . | nindent 2 }}/g' "${f}"
73-
sed -i.bak 's/- replaceMe: operator-controller-cluster-role-rules/{{- include "olmv1.operatorController.clusterRole.rules" . | nindent 2 }}/g' "${f}"
7426
# Delete sed's backup file
7527
rm -f "${f}.bak"
7628
done

‎internal/catalogd/controllers/core/clustercatalog_controller.go

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -76,12 +76,6 @@ type storedCatalogData struct {
7676
observedGeneration int64
7777
}
7878

79-
//+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clustercatalogs,verbs=get;list;watch;create;update;patch;delete
80-
//+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clustercatalogs/status,verbs=get;update;patch
81-
//+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clustercatalogs/finalizers,verbs=update
82-
//+kubebuilder:rbac:namespace=olmv1-system,groups=core,resources=secrets,verbs=get;list;watch
83-
//+kubebuilder:rbac:namespace=olmv1-system,groups=core,resources=serviceaccounts,verbs=get;list;watch
84-
8579
// Reconcile is part of the main kubernetes reconciliation loop which aims to
8680
// move the current state of the cluster closer to the desired state.
8781
//

‎internal/catalogd/webhook/cluster_catalog_webhook.go

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,6 @@ import (
1111
ocv1 "github.com/operator-framework/operator-controller/api/v1"
1212
)
1313

14-
// +kubebuilder:webhook:admissionReviewVersions={v1},failurePolicy=Fail,groups=olm.operatorframework.io,mutating=true,name=inject-metadata-name.olm.operatorframework.io,path=/mutate-olm-operatorframework-io-v1-clustercatalog,resources=clustercatalogs,verbs=create;update,versions=v1,sideEffects=None,timeoutSeconds=10
15-
16-
// +kubebuilder:rbac:groups=olm.operatorframework.io,resources=clustercatalogs,verbs=get;list;watch;patch;update
17-
1814
// ClusterCatalog wraps the external v1.ClusterCatalog type and implements admission.Defaulter
1915
type ClusterCatalog struct{}
2016

‎internal/operator-controller/controllers/clustercatalog_controller.go

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,6 @@ type ClusterCatalogReconciler struct {
4545
CatalogCachePopulator CatalogCachePopulator
4646
}
4747

48-
//+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clustercatalogs,verbs=get;list;watch
49-
5048
func (r *ClusterCatalogReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
5149
l := log.FromContext(ctx).WithName("cluster-catalog")
5250
ctx = log.IntoContext(ctx, l)

‎internal/operator-controller/controllers/clusterextension_controller.go

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -90,17 +90,6 @@ type InstalledBundleGetter interface {
9090
GetInstalledBundle(ctx context.Context, ext *ocv1.ClusterExtension) (*InstalledBundle, error)
9191
}
9292

93-
//+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clusterextensions,verbs=get;list;watch;update;patch
94-
//+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clusterextensions/status,verbs=update;patch
95-
//+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clusterextensions/finalizers,verbs=update
96-
//+kubebuilder:rbac:namespace=olmv1-system,groups=core,resources=secrets,verbs=create;update;patch;delete;deletecollection;get;list;watch
97-
//+kubebuilder:rbac:groups=core,resources=serviceaccounts/token,verbs=create
98-
//+kubebuilder:rbac:namespace=olmv1-system,groups=core,resources=serviceaccounts,verbs=get;list;watch
99-
//+kubebuilder:rbac:groups=apiextensions.k8s.io,resources=customresourcedefinitions,verbs=get
100-
//+kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles;clusterrolebindings;roles;rolebindings,verbs=list;watch
101-
102-
//+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clustercatalogs,verbs=list;watch
103-
10493
// The operator controller needs to watch all the bundle objects and reconcile accordingly. Though not ideal, but these permissions are required.
10594
// This has been taken from rukpak, and an issue was created before to discuss it: https://github.com/operator-framework/rukpak/issues/800.
10695
func (r *ClusterExtensionReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {

0 commit comments

Comments
 (0)