|  | 
| 1 | 1 | package convert | 
| 2 | 2 | 
 | 
| 3 | 3 | import ( | 
| 4 |  | -    "cmp" | 
| 5 |  | -    "fmt" | 
| 6 |  | -    "strings" | 
|  | 4 | +	"cmp" | 
|  | 5 | +	"fmt" | 
|  | 6 | +	"strings" | 
| 7 | 7 | 
 | 
| 8 |  | -    corev1 "k8s.io/api/core/v1" | 
| 9 |  | -    rbacv1 "k8s.io/api/rbac/v1" | 
| 10 |  | -    "k8s.io/apimachinery/pkg/util/sets" | 
| 11 |  | -    "k8s.io/utils/ptr" | 
| 12 |  | -    "sigs.k8s.io/controller-runtime/pkg/client" | 
|  | 8 | +	corev1 "k8s.io/api/core/v1" | 
|  | 9 | +	rbacv1 "k8s.io/api/rbac/v1" | 
|  | 10 | +	"k8s.io/apimachinery/pkg/util/sets" | 
|  | 11 | +	"k8s.io/utils/ptr" | 
|  | 12 | +	"sigs.k8s.io/controller-runtime/pkg/client" | 
| 13 | 13 | 
 | 
| 14 |  | -    registrybundle "github.com/operator-framework/operator-registry/pkg/lib/bundle" | 
|  | 14 | +	registrybundle "github.com/operator-framework/operator-registry/pkg/lib/bundle" | 
| 15 | 15 | 
 | 
| 16 |  | -    "github.com/operator-framework/operator-controller/internal/operator-controller/rukpak/util" | 
|  | 16 | +	"github.com/operator-framework/operator-controller/internal/operator-controller/rukpak/util" | 
| 17 | 17 | ) | 
| 18 | 18 | 
 | 
| 19 | 19 | type UniqueNameGenerator func(string, interface{}) (string, error) | 
| 20 | 20 | 
 | 
| 21 | 21 | type Options struct { | 
| 22 |  | -    InstallNamespace    string | 
| 23 |  | -    TargetNamespaces    []string | 
| 24 |  | -    UniqueNameGenerator UniqueNameGenerator | 
|  | 22 | +	InstallNamespace    string | 
|  | 23 | +	TargetNamespaces    []string | 
|  | 24 | +	UniqueNameGenerator UniqueNameGenerator | 
| 25 | 25 | } | 
| 26 | 26 | 
 | 
| 27 | 27 | type ResourceGenerator func(rv1 *RegistryV1, opts Options) ([]client.Object, error) | 
| 28 | 28 | 
 | 
| 29 | 29 | func (g ResourceGenerator) GenerateResources(rv1 *RegistryV1, opts Options) ([]client.Object, error) { | 
| 30 |  | -    return g(rv1, opts) | 
|  | 30 | +	return g(rv1, opts) | 
| 31 | 31 | } | 
| 32 | 32 | 
 | 
| 33 | 33 | func ChainedResourceGenerator(resourceGenerators ...ResourceGenerator) ResourceGenerator { | 
| 34 |  | -    return func(rv1 *RegistryV1, opts Options) ([]client.Object, error) { | 
| 35 |  | -        //nolint:prealloc | 
| 36 |  | -        var renderedObjects []client.Object | 
| 37 |  | -        for _, generator := range resourceGenerators { | 
| 38 |  | -            objs, err := generator(rv1, opts) | 
| 39 |  | -            if err != nil { | 
| 40 |  | -                return nil, err | 
| 41 |  | -            } | 
| 42 |  | -            renderedObjects = append(renderedObjects, objs...) | 
| 43 |  | -        } | 
| 44 |  | -        return renderedObjects, nil | 
| 45 |  | -    } | 
|  | 34 | +	return func(rv1 *RegistryV1, opts Options) ([]client.Object, error) { | 
|  | 35 | +		//nolint:prealloc | 
|  | 36 | +		var renderedObjects []client.Object | 
|  | 37 | +		for _, generator := range resourceGenerators { | 
|  | 38 | +			objs, err := generator(rv1, opts) | 
|  | 39 | +			if err != nil { | 
|  | 40 | +				return nil, err | 
|  | 41 | +			} | 
|  | 42 | +			renderedObjects = append(renderedObjects, objs...) | 
|  | 43 | +		} | 
|  | 44 | +		return renderedObjects, nil | 
|  | 45 | +	} | 
| 46 | 46 | } | 
| 47 | 47 | 
 | 
| 48 | 48 | func BundleDeploymentGenerator(rv1 *RegistryV1, opts Options) ([]client.Object, error) { | 
| 49 |  | -    objs := make([]client.Object, 0, len(rv1.CSV.Spec.InstallStrategy.StrategySpec.DeploymentSpecs)) | 
| 50 |  | -    for _, depSpec := range rv1.CSV.Spec.InstallStrategy.StrategySpec.DeploymentSpecs { | 
| 51 |  | -        annotations := util.MergeMaps(rv1.CSV.Annotations, depSpec.Spec.Template.Annotations) | 
| 52 |  | -        annotations["olm.targetNamespaces"] = strings.Join(opts.TargetNamespaces, ",") | 
| 53 |  | -        depSpec.Spec.Template.Annotations = annotations | 
| 54 |  | - | 
| 55 |  | -        // Hardcode the deployment with RevisionHistoryLimit=1 (something OLMv0 does, not sure why) | 
| 56 |  | -        depSpec.Spec.RevisionHistoryLimit = ptr.To(int32(1)) | 
| 57 |  | - | 
| 58 |  | -        objs = append(objs, | 
| 59 |  | -            GenerateDeploymentResource( | 
| 60 |  | -                depSpec.Name, | 
| 61 |  | -                opts.InstallNamespace, | 
| 62 |  | -                WithDeploymentSpec(depSpec.Spec), | 
| 63 |  | -                WithLabels(depSpec.Label), | 
| 64 |  | -            ), | 
| 65 |  | -        ) | 
| 66 |  | -    } | 
| 67 |  | -    return objs, nil | 
|  | 49 | +	if rv1 == nil { | 
|  | 50 | +		return nil, fmt.Errorf("bundle cannot be nil") | 
|  | 51 | +	} | 
|  | 52 | +	objs := make([]client.Object, 0, len(rv1.CSV.Spec.InstallStrategy.StrategySpec.DeploymentSpecs)) | 
|  | 53 | +	for _, depSpec := range rv1.CSV.Spec.InstallStrategy.StrategySpec.DeploymentSpecs { | 
|  | 54 | +		annotations := util.MergeMaps(rv1.CSV.Annotations, depSpec.Spec.Template.Annotations) | 
|  | 55 | +		annotations["olm.targetNamespaces"] = strings.Join(opts.TargetNamespaces, ",") | 
|  | 56 | +		depSpec.Spec.Template.Annotations = annotations | 
|  | 57 | + | 
|  | 58 | +		// Hardcode the deployment with RevisionHistoryLimit=1 (something OLMv0 does, not sure why) | 
|  | 59 | +		depSpec.Spec.RevisionHistoryLimit = ptr.To(int32(1)) | 
|  | 60 | + | 
|  | 61 | +		objs = append(objs, | 
|  | 62 | +			GenerateDeploymentResource( | 
|  | 63 | +				depSpec.Name, | 
|  | 64 | +				opts.InstallNamespace, | 
|  | 65 | +				WithDeploymentSpec(depSpec.Spec), | 
|  | 66 | +				WithLabels(depSpec.Label), | 
|  | 67 | +			), | 
|  | 68 | +		) | 
|  | 69 | +	} | 
|  | 70 | +	return objs, nil | 
| 68 | 71 | } | 
| 69 | 72 | 
 | 
| 70 | 73 | func BundlePermissionsGenerator(rv1 *RegistryV1, opts Options) ([]client.Object, error) { | 
| 71 |  | -    permissions := rv1.CSV.Spec.InstallStrategy.StrategySpec.Permissions | 
| 72 |  | - | 
| 73 |  | -    // If we're in AllNamespaces mode permissions will be treated as clusterPermissions | 
| 74 |  | -    if len(opts.TargetNamespaces) == 1 && opts.TargetNamespaces[0] == "" { | 
| 75 |  | -        return nil, nil | 
| 76 |  | -    } | 
| 77 |  | - | 
| 78 |  | -    objs := make([]client.Object, 0, 2*len(opts.TargetNamespaces)*len(permissions)) | 
| 79 |  | -    for _, ns := range opts.TargetNamespaces { | 
| 80 |  | -        for _, permission := range permissions { | 
| 81 |  | -            saName := saNameOrDefault(permission.ServiceAccountName) | 
| 82 |  | -            name, err := opts.UniqueNameGenerator(fmt.Sprintf("%s-%s", rv1.CSV.Name, saName), permission) | 
| 83 |  | -            if err != nil { | 
| 84 |  | -                return nil, err | 
| 85 |  | -            } | 
| 86 |  | - | 
| 87 |  | -            objs = append(objs, | 
| 88 |  | -                GenerateRoleResource(name, ns, WithRules(permission.Rules...)), | 
| 89 |  | -                GenerateRoleBindingResource( | 
| 90 |  | -                    name, | 
| 91 |  | -                    ns, | 
| 92 |  | -                    WithSubjects(rbacv1.Subject{Kind: "ServiceAccount", Namespace: opts.InstallNamespace, Name: saName}), | 
| 93 |  | -                    WithRoleRef(rbacv1.RoleRef{APIGroup: rbacv1.GroupName, Kind: "Role", Name: name}), | 
| 94 |  | -                ), | 
| 95 |  | -            ) | 
| 96 |  | -        } | 
| 97 |  | -    } | 
| 98 |  | -    return objs, nil | 
|  | 74 | +	if rv1 == nil { | 
|  | 75 | +		return nil, fmt.Errorf("bundle cannot be nil") | 
|  | 76 | +	} | 
|  | 77 | + | 
|  | 78 | +	// If we're in AllNamespaces mode permissions will be treated as clusterPermissions | 
|  | 79 | +	if len(opts.TargetNamespaces) == 1 && opts.TargetNamespaces[0] == "" { | 
|  | 80 | +		return nil, nil | 
|  | 81 | +	} | 
|  | 82 | + | 
|  | 83 | +	permissions := rv1.CSV.Spec.InstallStrategy.StrategySpec.Permissions | 
|  | 84 | + | 
|  | 85 | +	objs := make([]client.Object, 0, 2*len(opts.TargetNamespaces)*len(permissions)) | 
|  | 86 | +	for _, ns := range opts.TargetNamespaces { | 
|  | 87 | +		for _, permission := range permissions { | 
|  | 88 | +			saName := saNameOrDefault(permission.ServiceAccountName) | 
|  | 89 | +			name, err := opts.UniqueNameGenerator(fmt.Sprintf("%s-%s", rv1.CSV.Name, saName), permission) | 
|  | 90 | +			if err != nil { | 
|  | 91 | +				return nil, err | 
|  | 92 | +			} | 
|  | 93 | + | 
|  | 94 | +			objs = append(objs, | 
|  | 95 | +				GenerateRoleResource(name, ns, WithRules(permission.Rules...)), | 
|  | 96 | +				GenerateRoleBindingResource( | 
|  | 97 | +					name, | 
|  | 98 | +					ns, | 
|  | 99 | +					WithSubjects(rbacv1.Subject{Kind: "ServiceAccount", Namespace: opts.InstallNamespace, Name: saName}), | 
|  | 100 | +					WithRoleRef(rbacv1.RoleRef{APIGroup: rbacv1.GroupName, Kind: "Role", Name: name}), | 
|  | 101 | +				), | 
|  | 102 | +			) | 
|  | 103 | +		} | 
|  | 104 | +	} | 
|  | 105 | +	return objs, nil | 
| 99 | 106 | } | 
| 100 | 107 | 
 | 
| 101 | 108 | func BundleClusterPermissionsGenerator(rv1 *RegistryV1, opts Options) ([]client.Object, error) { | 
| 102 |  | -    clusterPermissions := rv1.CSV.Spec.InstallStrategy.StrategySpec.ClusterPermissions | 
| 103 |  | - | 
| 104 |  | -    // If we're in AllNamespaces mode, promote the permissions to clusterPermissions | 
| 105 |  | -    if len(opts.TargetNamespaces) == 1 && opts.TargetNamespaces[0] == "" { | 
| 106 |  | -        for _, p := range rv1.CSV.Spec.InstallStrategy.StrategySpec.Permissions { | 
| 107 |  | -            p.Rules = append(p.Rules, rbacv1.PolicyRule{ | 
| 108 |  | -                Verbs:     []string{"get", "list", "watch"}, | 
| 109 |  | -                APIGroups: []string{corev1.GroupName}, | 
| 110 |  | -                Resources: []string{"namespaces"}, | 
| 111 |  | -            }) | 
| 112 |  | -            clusterPermissions = append(clusterPermissions, p) | 
| 113 |  | -        } | 
| 114 |  | -    } | 
| 115 |  | - | 
| 116 |  | -    objs := make([]client.Object, 0, 2*len(clusterPermissions)) | 
| 117 |  | -    for _, permission := range clusterPermissions { | 
| 118 |  | -        saName := saNameOrDefault(permission.ServiceAccountName) | 
| 119 |  | -        name, err := opts.UniqueNameGenerator(fmt.Sprintf("%s-%s", rv1.CSV.Name, saName), permission) | 
| 120 |  | -        if err != nil { | 
| 121 |  | -            return nil, err | 
| 122 |  | -        } | 
| 123 |  | -        objs = append(objs, | 
| 124 |  | -            GenerateClusterRoleResource(name, WithRules(permission.Rules...)), | 
| 125 |  | -            GenerateClusterRoleBindingResource( | 
| 126 |  | -                name, | 
| 127 |  | -                WithSubjects(rbacv1.Subject{Kind: "ServiceAccount", Namespace: opts.InstallNamespace, Name: saName}), | 
| 128 |  | -                WithRoleRef(rbacv1.RoleRef{APIGroup: rbacv1.GroupName, Kind: "ClusterRole", Name: name}), | 
| 129 |  | -            ), | 
| 130 |  | -        ) | 
| 131 |  | -    } | 
| 132 |  | -    return objs, nil | 
|  | 109 | +	if rv1 == nil { | 
|  | 110 | +		return nil, fmt.Errorf("bundle cannot be nil") | 
|  | 111 | +	} | 
|  | 112 | +	clusterPermissions := rv1.CSV.Spec.InstallStrategy.StrategySpec.ClusterPermissions | 
|  | 113 | + | 
|  | 114 | +	// If we're in AllNamespaces mode, promote the permissions to clusterPermissions | 
|  | 115 | +	if len(opts.TargetNamespaces) == 1 && opts.TargetNamespaces[0] == "" { | 
|  | 116 | +		for _, p := range rv1.CSV.Spec.InstallStrategy.StrategySpec.Permissions { | 
|  | 117 | +			p.Rules = append(p.Rules, rbacv1.PolicyRule{ | 
|  | 118 | +				Verbs:     []string{"get", "list", "watch"}, | 
|  | 119 | +				APIGroups: []string{corev1.GroupName}, | 
|  | 120 | +				Resources: []string{"namespaces"}, | 
|  | 121 | +			}) | 
|  | 122 | +			clusterPermissions = append(clusterPermissions, p) | 
|  | 123 | +		} | 
|  | 124 | +	} | 
|  | 125 | + | 
|  | 126 | +	objs := make([]client.Object, 0, 2*len(clusterPermissions)) | 
|  | 127 | +	for _, permission := range clusterPermissions { | 
|  | 128 | +		saName := saNameOrDefault(permission.ServiceAccountName) | 
|  | 129 | +		name, err := opts.UniqueNameGenerator(fmt.Sprintf("%s-%s", rv1.CSV.Name, saName), permission) | 
|  | 130 | +		if err != nil { | 
|  | 131 | +			return nil, err | 
|  | 132 | +		} | 
|  | 133 | +		objs = append(objs, | 
|  | 134 | +			GenerateClusterRoleResource(name, WithRules(permission.Rules...)), | 
|  | 135 | +			GenerateClusterRoleBindingResource( | 
|  | 136 | +				name, | 
|  | 137 | +				WithSubjects(rbacv1.Subject{Kind: "ServiceAccount", Namespace: opts.InstallNamespace, Name: saName}), | 
|  | 138 | +				WithRoleRef(rbacv1.RoleRef{APIGroup: rbacv1.GroupName, Kind: "ClusterRole", Name: name}), | 
|  | 139 | +			), | 
|  | 140 | +		) | 
|  | 141 | +	} | 
|  | 142 | +	return objs, nil | 
| 133 | 143 | } | 
| 134 | 144 | 
 | 
| 135 | 145 | func BundleServiceAccountGenerator(rv1 *RegistryV1, opts Options) ([]client.Object, error) { | 
| 136 |  | -    allPermissions := append( | 
| 137 |  | -        rv1.CSV.Spec.InstallStrategy.StrategySpec.Permissions, | 
| 138 |  | -        rv1.CSV.Spec.InstallStrategy.StrategySpec.ClusterPermissions..., | 
| 139 |  | -    ) | 
| 140 |  | - | 
| 141 |  | -    serviceAccountNames := sets.Set[string]{} | 
| 142 |  | -    for _, permission := range allPermissions { | 
| 143 |  | -        serviceAccountNames.Insert(saNameOrDefault(permission.ServiceAccountName)) | 
| 144 |  | -    } | 
| 145 |  | - | 
| 146 |  | -    objs := make([]client.Object, 0, len(serviceAccountNames)) | 
| 147 |  | -    for _, serviceAccountName := range serviceAccountNames.UnsortedList() { | 
| 148 |  | -        // no need to generate the default service account | 
| 149 |  | -        if serviceAccountName != "default" { | 
| 150 |  | -            objs = append(objs, GenerateServiceAccountResource(serviceAccountName, opts.InstallNamespace)) | 
| 151 |  | -        } | 
| 152 |  | -    } | 
| 153 |  | -    return objs, nil | 
|  | 146 | +	if rv1 == nil { | 
|  | 147 | +		return nil, fmt.Errorf("bundle cannot be nil") | 
|  | 148 | +	} | 
|  | 149 | +	allPermissions := append( | 
|  | 150 | +		rv1.CSV.Spec.InstallStrategy.StrategySpec.Permissions, | 
|  | 151 | +		rv1.CSV.Spec.InstallStrategy.StrategySpec.ClusterPermissions..., | 
|  | 152 | +	) | 
|  | 153 | + | 
|  | 154 | +	serviceAccountNames := sets.Set[string]{} | 
|  | 155 | +	for _, permission := range allPermissions { | 
|  | 156 | +		serviceAccountNames.Insert(saNameOrDefault(permission.ServiceAccountName)) | 
|  | 157 | +	} | 
|  | 158 | + | 
|  | 159 | +	objs := make([]client.Object, 0, len(serviceAccountNames)) | 
|  | 160 | +	for _, serviceAccountName := range serviceAccountNames.UnsortedList() { | 
|  | 161 | +		// no need to generate the default service account | 
|  | 162 | +		if serviceAccountName != "default" { | 
|  | 163 | +			objs = append(objs, GenerateServiceAccountResource(serviceAccountName, opts.InstallNamespace)) | 
|  | 164 | +		} | 
|  | 165 | +	} | 
|  | 166 | +	return objs, nil | 
| 154 | 167 | } | 
| 155 | 168 | 
 | 
| 156 | 169 | func BundleCRDGenerator(rv1 *RegistryV1, _ Options) ([]client.Object, error) { | 
| 157 |  | -    objs := make([]client.Object, 0, len(rv1.CRDs)) | 
| 158 |  | -    for _, crd := range rv1.CRDs { | 
| 159 |  | -        objs = append(objs, crd.DeepCopy()) | 
| 160 |  | -    } | 
| 161 |  | -    return objs, nil | 
|  | 170 | +	if rv1 == nil { | 
|  | 171 | +		return nil, fmt.Errorf("bundle cannot be nil") | 
|  | 172 | +	} | 
|  | 173 | +	objs := make([]client.Object, 0, len(rv1.CRDs)) | 
|  | 174 | +	for _, crd := range rv1.CRDs { | 
|  | 175 | +		objs = append(objs, crd.DeepCopy()) | 
|  | 176 | +	} | 
|  | 177 | +	return objs, nil | 
| 162 | 178 | } | 
| 163 | 179 | 
 | 
| 164 | 180 | func BundleAdditionalResourcesGenerator(rv1 *RegistryV1, opts Options) ([]client.Object, error) { | 
| 165 |  | -    objs := make([]client.Object, 0, len(rv1.Others)) | 
| 166 |  | -    for _, res := range rv1.Others { | 
| 167 |  | -        supported, namespaced := registrybundle.IsSupported(res.GetKind()) | 
| 168 |  | -        if !supported { | 
| 169 |  | -            return nil, fmt.Errorf("bundle contains unsupported resource: Name: %v, Kind: %v", res.GetName(), res.GetKind()) | 
| 170 |  | -        } | 
| 171 |  | - | 
| 172 |  | -        obj := res.DeepCopy() | 
| 173 |  | -        if namespaced { | 
| 174 |  | -            obj.SetNamespace(opts.InstallNamespace) | 
| 175 |  | -        } | 
| 176 |  | - | 
| 177 |  | -        objs = append(objs, obj) | 
| 178 |  | -    } | 
| 179 |  | -    return objs, nil | 
|  | 181 | +	if rv1 == nil { | 
|  | 182 | +		return nil, fmt.Errorf("bundle cannot be nil") | 
|  | 183 | +	} | 
|  | 184 | +	objs := make([]client.Object, 0, len(rv1.Others)) | 
|  | 185 | +	for _, res := range rv1.Others { | 
|  | 186 | +		supported, namespaced := registrybundle.IsSupported(res.GetKind()) | 
|  | 187 | +		if !supported { | 
|  | 188 | +			return nil, fmt.Errorf("bundle contains unsupported resource: Name: %v, Kind: %v", res.GetName(), res.GetKind()) | 
|  | 189 | +		} | 
|  | 190 | + | 
|  | 191 | +		obj := res.DeepCopy() | 
|  | 192 | +		if namespaced { | 
|  | 193 | +			obj.SetNamespace(opts.InstallNamespace) | 
|  | 194 | +		} | 
|  | 195 | + | 
|  | 196 | +		objs = append(objs, obj) | 
|  | 197 | +	} | 
|  | 198 | +	return objs, nil | 
| 180 | 199 | } | 
| 181 | 200 | 
 | 
| 182 | 201 | func saNameOrDefault(saName string) string { | 
| 183 |  | -    return cmp.Or(saName, "default") | 
|  | 202 | +	return cmp.Or(saName, "default") | 
| 184 | 203 | } | 
0 commit comments