Skip to content

Commit b76bb2c

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request openshift#2389 from neisw/revert-2138-remove-rbr-crd-from-payload
Revert "CNTRLPLANE-72: remove RoleBindingRestriction CRD from payload"
2 parents 9bbe393 + 712062c commit b76bb2c

File tree

2 files changed

+226
-0
lines changed

2 files changed

+226
-0
lines changed

‎hack/update-payload-crds.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
source "$(dirname "${BASH_SOURCE}")/lib/init.sh"
44

55
crd_globs="\
6+
authorization/v1/zz_generated.crd-manifests/*_config-operator_*.crd*yaml\
67
machine/v1/zz_generated.crd-manifests/*.crd*yaml\
78
operator/v1/zz_generated.crd-manifests//*_config-operator_*.crd*yaml\
89
operator/v1alpha1/zz_generated.crd-manifests//*_config-operator_*.crd*yaml\

‎payload-manifests/crds/0000_03_config-operator_01_rolebindingrestrictions.crd.yaml

Lines changed: 225 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,225 @@
1+
apiVersion: apiextensions.k8s.io/v1
2+
kind: CustomResourceDefinition
3+
metadata:
4+
annotations:
5+
api-approved.openshift.io: https://github.com/openshift/api/pull/470
6+
api.openshift.io/merged-by-featuregates: "true"
7+
include.release.openshift.io/ibm-cloud-managed: "true"
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
release.openshift.io/bootstrap-required: "true"
10+
name: rolebindingrestrictions.authorization.openshift.io
11+
spec:
12+
group: authorization.openshift.io
13+
names:
14+
kind: RoleBindingRestriction
15+
listKind: RoleBindingRestrictionList
16+
plural: rolebindingrestrictions
17+
singular: rolebindingrestriction
18+
scope: Namespaced
19+
versions:
20+
- name: v1
21+
schema:
22+
openAPIV3Schema:
23+
description: |-
24+
RoleBindingRestriction is an object that can be matched against a subject
25+
(user, group, or service account) to determine whether rolebindings on that
26+
subject are allowed in the namespace to which the RoleBindingRestriction
27+
belongs. If any one of those RoleBindingRestriction objects matches
28+
a subject, rolebindings on that subject in the namespace are allowed.
29+
30+
Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
31+
properties:
32+
apiVersion:
33+
description: |-
34+
APIVersion defines the versioned schema of this representation of an object.
35+
Servers should convert recognized schemas to the latest internal value, and
36+
may reject unrecognized values.
37+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
38+
type: string
39+
kind:
40+
description: |-
41+
Kind is a string value representing the REST resource this object represents.
42+
Servers may infer this from the endpoint the client submits requests to.
43+
Cannot be updated.
44+
In CamelCase.
45+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
46+
type: string
47+
metadata:
48+
type: object
49+
spec:
50+
description: spec defines the matcher.
51+
properties:
52+
grouprestriction:
53+
description: grouprestriction matches against group subjects.
54+
nullable: true
55+
properties:
56+
groups:
57+
description: |-
58+
groups is a list of groups used to match against an individual user's
59+
groups. If the user is a member of one of the whitelisted groups, the user
60+
is allowed to be bound to a role.
61+
items:
62+
type: string
63+
nullable: true
64+
type: array
65+
labels:
66+
description: Selectors specifies a list of label selectors over
67+
group labels.
68+
items:
69+
description: |-
70+
A label selector is a label query over a set of resources. The result of matchLabels and
71+
matchExpressions are ANDed. An empty label selector matches all objects. A null
72+
label selector matches no objects.
73+
properties:
74+
matchExpressions:
75+
description: matchExpressions is a list of label selector
76+
requirements. The requirements are ANDed.
77+
items:
78+
description: |-
79+
A label selector requirement is a selector that contains values, a key, and an operator that
80+
relates the key and values.
81+
properties:
82+
key:
83+
description: key is the label key that the selector
84+
applies to.
85+
type: string
86+
operator:
87+
description: |-
88+
operator represents a key's relationship to a set of values.
89+
Valid operators are In, NotIn, Exists and DoesNotExist.
90+
type: string
91+
values:
92+
description: |-
93+
values is an array of string values. If the operator is In or NotIn,
94+
the values array must be non-empty. If the operator is Exists or DoesNotExist,
95+
the values array must be empty. This array is replaced during a strategic
96+
merge patch.
97+
items:
98+
type: string
99+
type: array
100+
x-kubernetes-list-type: atomic
101+
required:
102+
- key
103+
- operator
104+
type: object
105+
type: array
106+
x-kubernetes-list-type: atomic
107+
matchLabels:
108+
additionalProperties:
109+
type: string
110+
description: |-
111+
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
112+
map is equivalent to an element of matchExpressions, whose key field is "key", the
113+
operator is "In", and the values array contains only "value". The requirements are ANDed.
114+
type: object
115+
type: object
116+
x-kubernetes-map-type: atomic
117+
nullable: true
118+
type: array
119+
type: object
120+
serviceaccountrestriction:
121+
description: serviceaccountrestriction matches against service-account
122+
subjects.
123+
nullable: true
124+
properties:
125+
namespaces:
126+
description: namespaces specifies a list of literal namespace
127+
names.
128+
items:
129+
type: string
130+
type: array
131+
serviceaccounts:
132+
description: serviceaccounts specifies a list of literal service-account
133+
names.
134+
items:
135+
description: |-
136+
ServiceAccountReference specifies a service account and namespace by their
137+
names.
138+
properties:
139+
name:
140+
description: name is the name of the service account.
141+
type: string
142+
namespace:
143+
description: |-
144+
namespace is the namespace of the service account. Service accounts from
145+
inside the whitelisted namespaces are allowed to be bound to roles. If
146+
Namespace is empty, then the namespace of the RoleBindingRestriction in
147+
which the ServiceAccountReference is embedded is used.
148+
type: string
149+
type: object
150+
type: array
151+
type: object
152+
userrestriction:
153+
description: userrestriction matches against user subjects.
154+
nullable: true
155+
properties:
156+
groups:
157+
description: groups specifies a list of literal group names.
158+
items:
159+
type: string
160+
nullable: true
161+
type: array
162+
labels:
163+
description: Selectors specifies a list of label selectors over
164+
user labels.
165+
items:
166+
description: |-
167+
A label selector is a label query over a set of resources. The result of matchLabels and
168+
matchExpressions are ANDed. An empty label selector matches all objects. A null
169+
label selector matches no objects.
170+
properties:
171+
matchExpressions:
172+
description: matchExpressions is a list of label selector
173+
requirements. The requirements are ANDed.
174+
items:
175+
description: |-
176+
A label selector requirement is a selector that contains values, a key, and an operator that
177+
relates the key and values.
178+
properties:
179+
key:
180+
description: key is the label key that the selector
181+
applies to.
182+
type: string
183+
operator:
184+
description: |-
185+
operator represents a key's relationship to a set of values.
186+
Valid operators are In, NotIn, Exists and DoesNotExist.
187+
type: string
188+
values:
189+
description: |-
190+
values is an array of string values. If the operator is In or NotIn,
191+
the values array must be non-empty. If the operator is Exists or DoesNotExist,
192+
the values array must be empty. This array is replaced during a strategic
193+
merge patch.
194+
items:
195+
type: string
196+
type: array
197+
x-kubernetes-list-type: atomic
198+
required:
199+
- key
200+
- operator
201+
type: object
202+
type: array
203+
x-kubernetes-list-type: atomic
204+
matchLabels:
205+
additionalProperties:
206+
type: string
207+
description: |-
208+
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
209+
map is equivalent to an element of matchExpressions, whose key field is "key", the
210+
operator is "In", and the values array contains only "value". The requirements are ANDed.
211+
type: object
212+
type: object
213+
x-kubernetes-map-type: atomic
214+
nullable: true
215+
type: array
216+
users:
217+
description: users specifies a list of literal user names.
218+
items:
219+
type: string
220+
type: array
221+
type: object
222+
type: object
223+
type: object
224+
served: true
225+
storage: true

0 commit comments

Comments
 (0)