Skip to content

Commit 3b74442

Browse files
greyerofgreyerof
authored
OCP Deploy: removed certmanager dependency. (#24)
By default, "make deploy" should be used to manually deploy the operator in clusters where the cert-manager is already installed, but, in order to not mix that config params with the ones for the OLM-based manifests, a new config/default/manual-deploy folder has been created. The CERTMANAGER sections have been uncommented there only. This allows the make bundle && make bundle-build bundle-push targets to create the OLM-based bundle using the "config/default" folder without any cert-manager related field uncommented.
1 parent 80df383 commit 3b74442

12 files changed

+290
-41
lines changed

‎Makefile‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -175,7 +175,8 @@ deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in
175175
cd config/manager \
176176
&& $(KUSTOMIZE) edit set image controller=${IMG} \
177177
&& $(KUSTOMIZE) edit add patch --kind Deployment --patch "[{\"op\": \"replace\", \"path\": \"/spec/template/spec/containers/0/env/1\", \"value\": {\"name\": \"SIDECAR_APP_IMG\", \"value\": \"${SIDECAR_IMG}\"} }]"
178-
$(KUSTOMIZE) build config/default | kubectl apply -f -
178+
cd config/crd && $(KUSTOMIZE) edit add patch --path patches/cainjection_in_cnfcertificationsuiteruns.yaml
179+
$(KUSTOMIZE) build config/default/manual-deploy | kubectl apply -f -
179180

180181
.PHONY: undeploy
181182
undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
@@ -223,7 +224,9 @@ $(ENVTEST): $(LOCALBIN)
223224
.PHONY: bundle
224225
bundle: manifests kustomize ## Generate bundle manifests and metadata, then validate generated files.
225226
operator-sdk generate kustomize manifests -q
226-
cd config/manager && $(KUSTOMIZE) edit set image controller=$(IMG)
227+
cd config/manager \
228+
&& $(KUSTOMIZE) edit set image controller=${IMG} \
229+
&& $(KUSTOMIZE) edit add patch --kind Deployment --patch "[{\"op\": \"replace\", \"path\": \"/spec/template/spec/containers/0/env/1\", \"value\": {\"name\": \"SIDECAR_APP_IMG\", \"value\": \"${SIDECAR_IMG}\"} }]"
227230
$(KUSTOMIZE) build config/manifests | operator-sdk generate bundle $(BUNDLE_GEN_FLAGS) --extra-service-accounts cnf-certsuite-cluster-access
228231
operator-sdk bundle validate ./bundle
229232

‎bundle/manifests/cnf-certifications.redhat.com_cnfcertificationsuiteruns.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ metadata:
66
creationTimestamp: null
77
name: cnfcertificationsuiteruns.cnf-certifications.redhat.com
88
spec:
9+
conversion:
10+
strategy: None
911
group: cnf-certifications.redhat.com
1012
names:
1113
kind: CnfCertificationSuiteRun

‎bundle/manifests/cnf-certsuite-webhook-service_v1_service.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
creationTimestamp: null
5+
labels:
6+
app.kubernetes.io/component: webhook
7+
app.kubernetes.io/created-by: tnf-op
8+
app.kubernetes.io/instance: webhook-service
9+
app.kubernetes.io/managed-by: kustomize
10+
app.kubernetes.io/name: service
11+
app.kubernetes.io/part-of: tnf-op
12+
name: cnf-certsuite-webhook-service
13+
spec:
14+
ports:
15+
- port: 443
16+
protocol: TCP
17+
targetPort: 9443
18+
selector:
19+
control-plane: controller-manager
20+
status:
21+
loadBalancer: {}

‎bundle/manifests/tnf-op.clusterserviceversion.yaml‎

Lines changed: 44 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ metadata:
2828
}
2929
]
3030
capabilities: Basic Install
31-
createdAt: "2024-01-25T07:40:11Z"
31+
createdAt: "2024-02-28T14:55:50Z"
3232
operators.operatorframework.io/builder: operator-sdk-v1.33.0
3333
operators.operatorframework.io/project_layout: go.kubebuilder.io/v3
3434
name: tnf-op.v0.0.1
@@ -168,6 +168,10 @@ spec:
168168
initialDelaySeconds: 15
169169
periodSeconds: 20
170170
name: manager
171+
ports:
172+
- containerPort: 9443
173+
name: webhook-server
174+
protocol: TCP
171175
readinessProbe:
172176
httpGet:
173177
path: /readyz
@@ -186,10 +190,19 @@ spec:
186190
capabilities:
187191
drop:
188192
- ALL
193+
volumeMounts:
194+
- mountPath: /tmp/k8s-webhook-server/serving-certs
195+
name: cert
196+
readOnly: true
189197
securityContext:
190198
runAsNonRoot: true
191199
serviceAccountName: cnf-certsuite-controller-manager
192200
terminationGracePeriodSeconds: 10
201+
volumes:
202+
- name: cert
203+
secret:
204+
defaultMode: 420
205+
secretName: webhook-server-cert
193206
permissions:
194207
- rules:
195208
- apiGroups:
@@ -223,6 +236,15 @@ spec:
223236
verbs:
224237
- create
225238
- patch
239+
- apiGroups:
240+
- ""
241+
resources:
242+
- configMaps
243+
- secrets
244+
verbs:
245+
- get
246+
- list
247+
- watch
226248
- apiGroups:
227249
- ""
228250
resources:
@@ -310,3 +332,24 @@ spec:
310332
provider:
311333
name: RedHat
312334
version: 0.0.1
335+
webhookdefinitions:
336+
- admissionReviewVersions:
337+
- v1
338+
containerPort: 443
339+
deploymentName: cnf-certsuite-controller-manager
340+
failurePolicy: Fail
341+
generateName: vcnfcertificationsuiterun.kb.io
342+
rules:
343+
- apiGroups:
344+
- cnf-certifications.redhat.com
345+
apiVersions:
346+
- v1alpha1
347+
operations:
348+
- CREATE
349+
- UPDATE
350+
resources:
351+
- cnfcertificationsuiteruns
352+
sideEffects: None
353+
targetPort: 9443
354+
type: ValidatingAdmissionWebhook
355+
webhookPath: /validate-cnf-certifications-redhat-com-v1alpha1-cnfcertificationsuiterun

‎config/crd/kustomization.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ patchesStrategicMerge:
1515

1616
# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
1717
# patches here are for enabling the CA injection for each CRD
18-
- patches/cainjection_in_cnfcertificationsuiteruns.yaml
18+
#- patches/cainjection_in_cnfcertificationsuiteruns.yaml
1919
#- patches/cainjection_in_cnfcertificationsuitereports.yaml
2020
#+kubebuilder:scaffold:crdkustomizecainjectionpatch
2121

‎config/crd/patches/webhook_in_cnfcertificationsuiteruns.yaml‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,4 @@ metadata:
55
name: cnfcertificationsuiteruns.cnf-certifications.redhat.com
66
spec:
77
conversion:
8-
strategy: Webhook
9-
webhook:
10-
clientConfig:
11-
service:
12-
namespace: system
13-
name: webhook-service
14-
path: /convert
15-
conversionReviewVersions:
16-
- v1
8+
strategy: None

‎config/default/kustomization.yaml‎

Lines changed: 28 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ bases:
2121
# crd/kustomization.yaml
2222
- ../webhook
2323
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
24-
- ../certmanager
24+
#- ../certmanager
2525
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
2626
#- ../prometheus
2727

@@ -40,34 +40,34 @@ patchesStrategicMerge:
4040
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'.
4141
# Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA injection in the admission webhooks.
4242
# 'CERTMANAGER' needs to be enabled to use ca injection
43-
- webhookcainjection_patch.yaml
43+
#- webhookcainjection_patch.yaml
4444

4545
# the following config is for teaching kustomize how to do var substitution
4646
vars:
4747
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
48-
- name: CERTIFICATE_NAMESPACE # namespace of the certificate CR
49-
objref:
50-
kind: Certificate
51-
group: cert-manager.io
52-
version: v1
53-
name: serving-cert # this name should match the one in certificate.yaml
54-
fieldref:
55-
fieldpath: metadata.namespace
56-
- name: CERTIFICATE_NAME
57-
objref:
58-
kind: Certificate
59-
group: cert-manager.io
60-
version: v1
61-
name: serving-cert # this name should match the one in certificate.yaml
62-
- name: SERVICE_NAMESPACE # namespace of the service
63-
objref:
64-
kind: Service
65-
version: v1
66-
name: webhook-service
67-
fieldref:
68-
fieldpath: metadata.namespace
69-
- name: SERVICE_NAME
70-
objref:
71-
kind: Service
72-
version: v1
73-
name: webhook-service
48+
# - name: CERTIFICATE_NAMESPACE # namespace of the certificate CR
49+
# objref:
50+
# kind: Certificate
51+
# group: cert-manager.io
52+
# version: v1
53+
# name: serving-cert # this name should match the one in certificate.yaml
54+
# fieldref:
55+
# fieldpath: metadata.namespace
56+
# - name: CERTIFICATE_NAME
57+
# objref:
58+
# kind: Certificate
59+
# group: cert-manager.io
60+
# version: v1
61+
# name: serving-cert # this name should match the one in certificate.yaml
62+
# - name: SERVICE_NAMESPACE # namespace of the service
63+
# objref:
64+
# kind: Service
65+
# version: v1
66+
# name: webhook-service
67+
# fieldref:
68+
# fieldpath: metadata.namespace
69+
# - name: SERVICE_NAME
70+
# objref:
71+
# kind: Service
72+
# version: v1
73+
# name: webhook-service

‎config/default/manual-deploy/kustomization.yaml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
# Adds namespace to all resources.
2+
namespace: cnf-certsuite-operator
3+
4+
# Value of this field is prepended to the
5+
# names of all resources, e.g. a deployment named
6+
# "wordpress" becomes "alices-wordpress".
7+
# Note that it should also match with the prefix (text before '-') of the namespace
8+
# field above.
9+
namePrefix: cnf-certsuite-
10+
11+
# Labels to add to all resources and selectors.
12+
#commonLabels:
13+
# someName: someValue
14+
15+
bases:
16+
- ../../crd
17+
- ../../rbac
18+
- ../../manager
19+
- ../../manifests/bases/cnfpod-permissions
20+
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
21+
# crd/kustomization.yaml
22+
- ../../webhook
23+
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
24+
- ../../certmanager
25+
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
26+
#- ../prometheus
27+
28+
patchesStrategicMerge:
29+
# Protect the /metrics endpoint by putting it behind auth.
30+
# If you want your controller-manager to expose the /metrics
31+
# endpoint w/o any authn/z, please comment the following line.
32+
- manager_auth_proxy_patch.yaml
33+
34+
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
35+
# crd/kustomization.yaml
36+
- manager_webhook_patch.yaml
37+
38+
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'.
39+
# Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA injection in the admission webhooks.
40+
# 'CERTMANAGER' needs to be enabled to use ca injection
41+
- webhookcainjection_patch.yaml
42+
43+
# the following config is for teaching kustomize how to do var substitution
44+
vars:
45+
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
46+
- name: CERTIFICATE_NAMESPACE # namespace of the certificate CR
47+
objref:
48+
kind: Certificate
49+
group: cert-manager.io
50+
version: v1
51+
name: serving-cert # this name should match the one in certificate.yaml
52+
fieldref:
53+
fieldpath: metadata.namespace
54+
- name: CERTIFICATE_NAME
55+
objref:
56+
kind: Certificate
57+
group: cert-manager.io
58+
version: v1
59+
name: serving-cert # this name should match the one in certificate.yaml
60+
- name: SERVICE_NAMESPACE # namespace of the service
61+
objref:
62+
kind: Service
63+
version: v1
64+
name: webhook-service
65+
fieldref:
66+
fieldpath: metadata.namespace
67+
- name: SERVICE_NAME
68+
objref:
69+
kind: Service
70+
version: v1
71+
name: webhook-service

‎config/default/manual-deploy/manager_auth_proxy_patch.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# This patch inject a sidecar container which is a HTTP proxy for the
2+
# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
3+
apiVersion: apps/v1
4+
kind: Deployment
5+
metadata:
6+
name: controller-manager
7+
namespace: system
8+
spec:
9+
template:
10+
spec:
11+
affinity:
12+
nodeAffinity:
13+
requiredDuringSchedulingIgnoredDuringExecution:
14+
nodeSelectorTerms:
15+
- matchExpressions:
16+
- key: kubernetes.io/arch
17+
operator: In
18+
values:
19+
- amd64
20+
- arm64
21+
- ppc64le
22+
- s390x
23+
- key: kubernetes.io/os
24+
operator: In
25+
values:
26+
- linux
27+
containers:
28+
- name: kube-rbac-proxy
29+
securityContext:
30+
allowPrivilegeEscalation: false
31+
capabilities:
32+
drop:
33+
- "ALL"
34+
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.13.1
35+
args:
36+
- "--secure-listen-address=0.0.0.0:8443"
37+
- "--upstream=http://127.0.0.1:8080/"
38+
- "--logtostderr=true"
39+
- "--v=0"
40+
ports:
41+
- containerPort: 8443
42+
protocol: TCP
43+
name: https
44+
resources:
45+
limits:
46+
cpu: 500m
47+
memory: 128Mi
48+
requests:
49+
cpu: 5m
50+
memory: 64Mi
51+
- name: manager
52+
args:
53+
- "--health-probe-bind-address=:8081"
54+
- "--metrics-bind-address=127.0.0.1:8080"
55+
- "--leader-elect"

‎config/default/manual-deploy/manager_config_patch.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: controller-manager
5+
namespace: system
6+
spec:
7+
template:
8+
spec:
9+
containers:
10+
- name: manager

0 commit comments

Comments
 (0)