diff --git a/config/base/catalogd/kustomization.yaml b/config/base/catalogd/kustomization.yaml index b30ee2540..d4ebee2d5 100644 --- a/config/base/catalogd/kustomization.yaml +++ b/config/base/catalogd/kustomization.yaml @@ -1,7 +1,6 @@ # Does not include the CRD, which must be added separately (it's non-namespaced) apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization -namespace: olmv1-system namePrefix: catalogd- resources: - rbac diff --git a/config/base/catalogd/manager/manager.yaml b/config/base/catalogd/manager/manager.yaml index 370813592..06199f293 100644 --- a/config/base/catalogd/manager/manager.yaml +++ b/config/base/catalogd/manager/manager.yaml @@ -2,7 +2,7 @@ apiVersion: apps/v1 kind: Deployment metadata: name: controller-manager - namespace: system + namespace: olmv1-system annotations: kubectl.kubernetes.io/default-logs-container: manager labels: diff --git a/config/base/catalogd/manager/network_policy.yaml b/config/base/catalogd/manager/network_policy.yaml index 853b54a37..27df08193 100644 --- a/config/base/catalogd/manager/network_policy.yaml +++ b/config/base/catalogd/manager/network_policy.yaml @@ -2,7 +2,7 @@ apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: controller-manager - namespace: system + namespace: olmv1-system spec: podSelector: matchLabels: diff --git a/config/base/catalogd/manager/service.yaml b/config/base/catalogd/manager/service.yaml index 693b687f3..4f423ae42 100644 --- a/config/base/catalogd/manager/service.yaml +++ b/config/base/catalogd/manager/service.yaml @@ -5,7 +5,7 @@ metadata: app.kubernetes.io/part-of: olm app.kubernetes.io/name: catalogd name: service - namespace: system + namespace: olmv1-system spec: selector: control-plane: catalogd-controller-manager diff --git a/config/base/catalogd/rbac/auth_proxy_role_binding.yaml b/config/base/catalogd/rbac/auth_proxy_role_binding.yaml index 2efcf8dd8..1c44eec98 100644 --- a/config/base/catalogd/rbac/auth_proxy_role_binding.yaml +++ b/config/base/catalogd/rbac/auth_proxy_role_binding.yaml @@ -12,4 +12,4 @@ roleRef: subjects: - kind: ServiceAccount name: controller-manager - namespace: system + namespace: olmv1-system diff --git a/config/base/catalogd/rbac/leader_election_role.yaml b/config/base/catalogd/rbac/leader_election_role.yaml index 37564d084..1b89e50a7 100644 --- a/config/base/catalogd/rbac/leader_election_role.yaml +++ b/config/base/catalogd/rbac/leader_election_role.yaml @@ -6,6 +6,7 @@ metadata: app.kubernetes.io/part-of: olm app.kubernetes.io/name: catalogd name: leader-election-role + namespace: olmv1-system rules: - apiGroups: - "" diff --git a/config/base/catalogd/rbac/leader_election_role_binding.yaml b/config/base/catalogd/rbac/leader_election_role_binding.yaml index 6ad0ccf99..2f198acfa 100644 --- a/config/base/catalogd/rbac/leader_election_role_binding.yaml +++ b/config/base/catalogd/rbac/leader_election_role_binding.yaml @@ -5,6 +5,7 @@ metadata: app.kubernetes.io/part-of: olm app.kubernetes.io/name: catalogd name: leader-election-rolebinding + namespace: olmv1-system roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -12,4 +13,4 @@ roleRef: subjects: - kind: ServiceAccount name: controller-manager - namespace: system + namespace: olmv1-system diff --git a/config/base/catalogd/rbac/role.yaml b/config/base/catalogd/rbac/role.yaml index 0b15af0c6..c887c7c4f 100644 --- a/config/base/catalogd/rbac/role.yaml +++ b/config/base/catalogd/rbac/role.yaml @@ -35,7 +35,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: manager-role - namespace: system + namespace: olmv1-system rules: - apiGroups: - "" diff --git a/config/base/catalogd/rbac/role_binding.yaml b/config/base/catalogd/rbac/role_binding.yaml index 41dc229bc..5ebca546b 100644 --- a/config/base/catalogd/rbac/role_binding.yaml +++ b/config/base/catalogd/rbac/role_binding.yaml @@ -12,7 +12,7 @@ roleRef: subjects: - kind: ServiceAccount name: controller-manager - namespace: system + namespace: olmv1-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -21,7 +21,7 @@ metadata: app.kubernetes.io/part-of: olm app.kubernetes.io/name: catalogd name: manager-rolebinding - namespace: system + namespace: olmv1-system roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -29,4 +29,4 @@ roleRef: subjects: - kind: ServiceAccount name: controller-manager - namespace: system + namespace: olmv1-system diff --git a/config/base/catalogd/rbac/service_account.yaml b/config/base/catalogd/rbac/service_account.yaml index 3f0e7af74..102667ae4 100644 --- a/config/base/catalogd/rbac/service_account.yaml +++ b/config/base/catalogd/rbac/service_account.yaml @@ -5,4 +5,4 @@ metadata: app.kubernetes.io/part-of: olm app.kubernetes.io/name: catalogd name: controller-manager - namespace: system + namespace: olmv1-system diff --git a/config/base/common/namespace.yaml b/config/base/common/namespace.yaml index 99d47415f..ede0bfd8f 100644 --- a/config/base/common/namespace.yaml +++ b/config/base/common/namespace.yaml @@ -5,4 +5,4 @@ metadata: app.kubernetes.io/part-of: olm pod-security.kubernetes.io/enforce: restricted pod-security.kubernetes.io/enforce-version: latest - name: system + name: olmv1-system diff --git a/config/base/common/network_policy.yaml b/config/base/common/network_policy.yaml index 86d352975..e63015da3 100644 --- a/config/base/common/network_policy.yaml +++ b/config/base/common/network_policy.yaml @@ -2,7 +2,7 @@ apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: default-deny-all-traffic - namespace: system + namespace: olmv1-system spec: podSelector: { } policyTypes: diff --git a/config/base/operator-controller/kustomization.yaml b/config/base/operator-controller/kustomization.yaml index e10e2bbaa..500860cf6 100644 --- a/config/base/operator-controller/kustomization.yaml +++ b/config/base/operator-controller/kustomization.yaml @@ -1,7 +1,6 @@ # Does not include the CRD, which must be added separately (it's non-namespaced) apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization -namespace: olmv1-system namePrefix: operator-controller- resources: - rbac diff --git a/config/base/operator-controller/manager/manager.yaml b/config/base/operator-controller/manager/manager.yaml index 611c5816c..dda835cf3 100644 --- a/config/base/operator-controller/manager/manager.yaml +++ b/config/base/operator-controller/manager/manager.yaml @@ -2,7 +2,7 @@ apiVersion: apps/v1 kind: Deployment metadata: name: controller-manager - namespace: system + namespace: olmv1-system annotations: kubectl.kubernetes.io/default-logs-container: manager labels: diff --git a/config/base/operator-controller/manager/network_policy.yaml b/config/base/operator-controller/manager/network_policy.yaml index 2e68beabe..1659cea05 100644 --- a/config/base/operator-controller/manager/network_policy.yaml +++ b/config/base/operator-controller/manager/network_policy.yaml @@ -2,7 +2,7 @@ apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: controller-manager - namespace: system + namespace: olmv1-system spec: podSelector: matchLabels: diff --git a/config/base/operator-controller/manager/service.yaml b/config/base/operator-controller/manager/service.yaml index b352a0aa1..752f62f8f 100644 --- a/config/base/operator-controller/manager/service.yaml +++ b/config/base/operator-controller/manager/service.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: Service metadata: name: service - namespace: system + namespace: olmv1-system labels: control-plane: operator-controller-controller-manager spec: diff --git a/config/base/operator-controller/rbac/auth_proxy_role_binding.yaml b/config/base/operator-controller/rbac/auth_proxy_role_binding.yaml index ec7acc0a1..976e53bcd 100644 --- a/config/base/operator-controller/rbac/auth_proxy_role_binding.yaml +++ b/config/base/operator-controller/rbac/auth_proxy_role_binding.yaml @@ -9,4 +9,4 @@ roleRef: subjects: - kind: ServiceAccount name: controller-manager - namespace: system + namespace: olmv1-system diff --git a/config/base/operator-controller/rbac/leader_election_role.yaml b/config/base/operator-controller/rbac/leader_election_role.yaml index 4190ec805..ef2d330fd 100644 --- a/config/base/operator-controller/rbac/leader_election_role.yaml +++ b/config/base/operator-controller/rbac/leader_election_role.yaml @@ -3,6 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: leader-election-role + namespace: olmv1-system rules: - apiGroups: - "" diff --git a/config/base/operator-controller/rbac/leader_election_role_binding.yaml b/config/base/operator-controller/rbac/leader_election_role_binding.yaml index 1d1321ed4..f0c49d7fd 100644 --- a/config/base/operator-controller/rbac/leader_election_role_binding.yaml +++ b/config/base/operator-controller/rbac/leader_election_role_binding.yaml @@ -2,6 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: leader-election-rolebinding + namespace: olmv1-system roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -9,4 +10,4 @@ roleRef: subjects: - kind: ServiceAccount name: controller-manager - namespace: system + namespace: olmv1-system diff --git a/config/base/operator-controller/rbac/role.yaml b/config/base/operator-controller/rbac/role.yaml index d18eb4c6c..bb1cbe626 100644 --- a/config/base/operator-controller/rbac/role.yaml +++ b/config/base/operator-controller/rbac/role.yaml @@ -62,7 +62,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: manager-role - namespace: system + namespace: olmv1-system rules: - apiGroups: - "" diff --git a/config/base/operator-controller/rbac/role_binding.yaml b/config/base/operator-controller/rbac/role_binding.yaml index fa331e3d4..430b599b3 100644 --- a/config/base/operator-controller/rbac/role_binding.yaml +++ b/config/base/operator-controller/rbac/role_binding.yaml @@ -9,13 +9,13 @@ roleRef: subjects: - kind: ServiceAccount name: controller-manager - namespace: system + namespace: olmv1-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: manager-rolebinding - namespace: system + namespace: olmv1-system roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -23,4 +23,4 @@ roleRef: subjects: - kind: ServiceAccount name: controller-manager - namespace: system + namespace: olmv1-system diff --git a/config/base/operator-controller/rbac/service_account.yaml b/config/base/operator-controller/rbac/service_account.yaml index 7cd6025bf..22f830f73 100644 --- a/config/base/operator-controller/rbac/service_account.yaml +++ b/config/base/operator-controller/rbac/service_account.yaml @@ -2,4 +2,4 @@ apiVersion: v1 kind: ServiceAccount metadata: name: controller-manager - namespace: system + namespace: olmv1-system diff --git a/config/components/cert-manager/catalogd/kustomization.yaml b/config/components/cert-manager/catalogd/kustomization.yaml index f603a0099..1e14d0abf 100644 --- a/config/components/cert-manager/catalogd/kustomization.yaml +++ b/config/components/cert-manager/catalogd/kustomization.yaml @@ -1,6 +1,5 @@ apiVersion: kustomize.config.k8s.io/v1alpha1 kind: Component -namespace: olmv1-system resources: - resources/certificate.yaml patches: diff --git a/config/components/cert-manager/catalogd/resources/certificate.yaml b/config/components/cert-manager/catalogd/resources/certificate.yaml index cacb0bc9b..63375760c 100644 --- a/config/components/cert-manager/catalogd/resources/certificate.yaml +++ b/config/components/cert-manager/catalogd/resources/certificate.yaml @@ -2,7 +2,7 @@ apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: catalogd-service-cert - namespace: system + namespace: olmv1-system spec: secretName: catalogd-service-cert-git-version dnsNames: diff --git a/config/components/cert-manager/operator-controller/kustomization.yaml b/config/components/cert-manager/operator-controller/kustomization.yaml index 6c4e13975..9f276280f 100644 --- a/config/components/cert-manager/operator-controller/kustomization.yaml +++ b/config/components/cert-manager/operator-controller/kustomization.yaml @@ -1,6 +1,5 @@ apiVersion: kustomize.config.k8s.io/v1alpha1 kind: Component -namespace: olmv1-system resources: - resources/manager_cert.yaml patches: diff --git a/config/components/cert-manager/operator-controller/resources/manager_cert.yaml b/config/components/cert-manager/operator-controller/resources/manager_cert.yaml index 96f131b7e..c001d946a 100644 --- a/config/components/cert-manager/operator-controller/resources/manager_cert.yaml +++ b/config/components/cert-manager/operator-controller/resources/manager_cert.yaml @@ -2,6 +2,7 @@ apiVersion: cert-manager.io/v1 kind: Certificate metadata: name: olmv1-cert + namespace: olmv1-system spec: secretName: olmv1-cert dnsNames: diff --git a/config/components/e2e/coverage/kustomization.yaml b/config/components/e2e/coverage/kustomization.yaml index 6d3084989..7679914bd 100644 --- a/config/components/e2e/coverage/kustomization.yaml +++ b/config/components/e2e/coverage/kustomization.yaml @@ -1,6 +1,5 @@ apiVersion: kustomize.config.k8s.io/v1alpha1 kind: Component -namespace: olmv1-system resources: - manager_e2e_coverage_pvc.yaml - manager_e2e_coverage_copy_pod.yaml diff --git a/config/components/e2e/coverage/manager_e2e_coverage_copy_pod.yaml b/config/components/e2e/coverage/manager_e2e_coverage_copy_pod.yaml index 7794ba97d..5c5c97bf7 100644 --- a/config/components/e2e/coverage/manager_e2e_coverage_copy_pod.yaml +++ b/config/components/e2e/coverage/manager_e2e_coverage_copy_pod.yaml @@ -2,6 +2,7 @@ apiVersion: v1 kind: Pod metadata: name: e2e-coverage-copy-pod + namespace: olmv1-system spec: restartPolicy: Never securityContext: diff --git a/config/components/e2e/coverage/manager_e2e_coverage_pvc.yaml b/config/components/e2e/coverage/manager_e2e_coverage_pvc.yaml index 126d4d4e6..02c84acfd 100644 --- a/config/components/e2e/coverage/manager_e2e_coverage_pvc.yaml +++ b/config/components/e2e/coverage/manager_e2e_coverage_pvc.yaml @@ -2,6 +2,7 @@ apiVersion: v1 kind: PersistentVolumeClaim metadata: name: e2e-coverage + namespace: olmv1-system spec: accessModes: - ReadWriteOnce diff --git a/config/components/e2e/registries-conf/kustomization.yaml b/config/components/e2e/registries-conf/kustomization.yaml index e48262429..ecb6bd1ba 100644 --- a/config/components/e2e/registries-conf/kustomization.yaml +++ b/config/components/e2e/registries-conf/kustomization.yaml @@ -1,6 +1,5 @@ apiVersion: kustomize.config.k8s.io/v1alpha1 kind: Component -namespace: olmv1-system resources: - registries_conf_configmap.yaml patches: diff --git a/config/components/e2e/registries-conf/registries_conf_configmap.yaml b/config/components/e2e/registries-conf/registries_conf_configmap.yaml index 2604c78f5..e216113a7 100644 --- a/config/components/e2e/registries-conf/registries_conf_configmap.yaml +++ b/config/components/e2e/registries-conf/registries_conf_configmap.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: ConfigMap metadata: name: e2e-registries-conf - namespace: system + namespace: olmv1-system data: registries.conf: | [[registry]] diff --git a/internal/catalogd/controllers/core/clustercatalog_controller.go b/internal/catalogd/controllers/core/clustercatalog_controller.go index ec3dc525d..32ed52e0a 100644 --- a/internal/catalogd/controllers/core/clustercatalog_controller.go +++ b/internal/catalogd/controllers/core/clustercatalog_controller.go @@ -79,8 +79,8 @@ type storedCatalogData struct { //+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clustercatalogs,verbs=get;list;watch;create;update;patch;delete //+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clustercatalogs/status,verbs=get;update;patch //+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clustercatalogs/finalizers,verbs=update -//+kubebuilder:rbac:namespace=system,groups=core,resources=secrets,verbs=get;list;watch -//+kubebuilder:rbac:namespace=system,groups=core,resources=serviceaccounts,verbs=get;list;watch +//+kubebuilder:rbac:namespace=olmv1-system,groups=core,resources=secrets,verbs=get;list;watch +//+kubebuilder:rbac:namespace=olmv1-system,groups=core,resources=serviceaccounts,verbs=get;list;watch // Reconcile is part of the main kubernetes reconciliation loop which aims to // move the current state of the cluster closer to the desired state. diff --git a/internal/operator-controller/controllers/clusterextension_controller.go b/internal/operator-controller/controllers/clusterextension_controller.go index 5b180d9cc..24824bfd1 100644 --- a/internal/operator-controller/controllers/clusterextension_controller.go +++ b/internal/operator-controller/controllers/clusterextension_controller.go @@ -93,9 +93,9 @@ type InstalledBundleGetter interface { //+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clusterextensions,verbs=get;list;watch;update;patch //+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clusterextensions/status,verbs=update;patch //+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clusterextensions/finalizers,verbs=update -//+kubebuilder:rbac:namespace=system,groups=core,resources=secrets,verbs=create;update;patch;delete;deletecollection;get;list;watch +//+kubebuilder:rbac:namespace=olmv1-system,groups=core,resources=secrets,verbs=create;update;patch;delete;deletecollection;get;list;watch //+kubebuilder:rbac:groups=core,resources=serviceaccounts/token,verbs=create -//+kubebuilder:rbac:namespace=system,groups=core,resources=serviceaccounts,verbs=get;list;watch +//+kubebuilder:rbac:namespace=olmv1-system,groups=core,resources=serviceaccounts,verbs=get;list;watch //+kubebuilder:rbac:groups=apiextensions.k8s.io,resources=customresourcedefinitions,verbs=get //+kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles;clusterrolebindings;roles;rolebindings,verbs=list;watch diff --git a/scripts/install.tpl.sh b/scripts/install.tpl.sh index 8088a2515..2ddf79856 100644 --- a/scripts/install.tpl.sh +++ b/scripts/install.tpl.sh @@ -3,6 +3,39 @@ set -euo pipefail IFS=$'\n\t' olmv1_manifest=$MANIFEST +olmv1_namespace=olmv1-system + +usage() { + cmd=$(basename $0) + cat <] [-h] + +DESCRIPTION + Installs OLMv1 in the provided with cert-manager. + A kubernetes configuration must already be present. + + -n + install OLMv1 in the given . Defaults to olmv1-system. + + -h + help (this text) +EOF + exit 0 +} + + +while getopts n:h opt; do + case ${opt} in + n) olmv1_namespace=${OPTARG} ;; + h) usage ;; + *) echo "Unknown option" >&2 + exit 1 + esac +done if [[ -z "$olmv1_manifest" ]]; then echo "Error: Missing required MANIFEST variable" @@ -69,11 +102,16 @@ kubectl_wait "cert-manager" "deployment/cert-manager" "60s" kubectl_wait_for_query "mutatingwebhookconfigurations/cert-manager-webhook" '{.webhooks[0].clientConfig.caBundle}' 60 5 kubectl_wait_for_query "validatingwebhookconfigurations/cert-manager-webhook" '{.webhooks[0].clientConfig.caBundle}' 60 5 -kubectl apply -f "${olmv1_manifest}" +# Change the file into a file:// url +if [ -f "${olmv1_manifest}" ]; then + olmv1_manifest=file://localhost$(realpath ${olmv1_manifest}) +fi + +curl -L -s "${olmv1_manifest}" | sed "s/olmv1-system/${olmv1_namespace}/g" | kubectl apply -f - # Wait for the rollout, and then wait for the deployment to be Available -kubectl_wait_rollout "olmv1-system" "deployment/catalogd-controller-manager" "60s" -kubectl_wait "olmv1-system" "deployment/catalogd-controller-manager" "60s" -kubectl_wait "olmv1-system" "deployment/operator-controller-controller-manager" "60s" +kubectl_wait_rollout "${olmv1_namespace}" "deployment/catalogd-controller-manager" "60s" +kubectl_wait "${olmv1_namespace}" "deployment/catalogd-controller-manager" "60s" +kubectl_wait "${olmv1_namespace}" "deployment/operator-controller-controller-manager" "60s" if [[ "${install_default_catalogs}" != "false" ]]; then kubectl apply -f "${default_catalogs_manifest}"