Skip to content

Commit 0768a32

Browse files
ivanstanevivanstanev
committed
chore: add new templates for certifying the Snyk Operator
The certification is for the Red Hat Marketplace, as described in their documentation. The files are currently stored in a separate directory to avoid conflicts with the existing snyk-operator directory (which is used by tests and CI/CD). Some notable changes from the previous/existing Operator: - Fixing permissions - the ClusterRole and ClusterRoleBindings are no longer applied via the Helm chart but instead are listed in the Operator metadata (the ClusterServiceVersion) - New breaking change base image for the Operator (based on the Helm template Operator) - Using RBAC proxy provided by Red Hat - Different name for the Operator - snyk-operator-certified There are still several TODOs not covered by this change: - moving the certified images over to Quay - tests should use and test the certified Operator - CI/CD should use the certified Operator - build, test, push the image for publishing
1 parent f1653e7 commit 0768a32

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

52 files changed

+2111
-1
lines changed

‎snyk-monitor/templates/deployment.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ spec:
4343
initContainers:
4444
- name: volume-permissions
4545
image: "{{ .Values.initContainerImage.repository }}:{{ .Values.initContainerImage.tag }}"
46-
command : ['sh', '-c', 'chmod -R go+rwX /var/tmp || true']
46+
command: ['sh', '-c', 'chmod -R go+rwX /var/tmp || true']
4747
volumeMounts:
4848
- name: temporary-storage
4949
mountPath: "/var/tmp"

‎snyk-operator-certified/Dockerfile‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Build the manager binary
2+
FROM quay.io/operator-framework/helm-operator:v1.8.0
3+
4+
LABEL name="Snyk Operator" \
5+
maintainer="[email protected]" \
6+
vendor="Snyk Ltd" \
7+
summary="Snyk Operator for Snyk Controller" \
8+
description="Snyk Controller enables you to import and test your running workloads and identify vulnerabilities in their associated images and configurations that might make those workloads less secure."
9+
10+
ENV HOME=/opt/helm
11+
12+
COPY LICENSE /licenses/LICENSE
13+
COPY watches.yaml ${HOME}/watches.yaml
14+
COPY helm-charts ${HOME}/helm-charts
15+
WORKDIR ${HOME}

‎snyk-operator-certified/LICENSE‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
Copyright 2019 Snyk Ltd.
2+
3+
Licensed under the Apache License, Version 2.0 (the "License");
4+
you may not use this file except in compliance with the License.
5+
You may obtain a copy of the License at
6+
7+
http://www.apache.org/licenses/LICENSE-2.0
8+
9+
Unless required by applicable law or agreed to in writing, software
10+
distributed under the License is distributed on an "AS IS" BASIS,
11+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
See the License for the specific language governing permissions and
13+
limitations under the License.
14+

‎snyk-operator-certified/Makefile‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
# Current Operator version
2+
VERSION ?= 1.64.1
3+
# Default bundle image tag
4+
BUNDLE_IMG ?= snyk/snyk-operator-bundle:$(VERSION)
5+
# Options for 'bundle-build'
6+
ifneq ($(origin CHANNELS), undefined)
7+
BUNDLE_CHANNELS := --channels=$(CHANNELS)
8+
endif
9+
ifneq ($(origin DEFAULT_CHANNEL), undefined)
10+
BUNDLE_DEFAULT_CHANNEL := --default-channel=$(DEFAULT_CHANNEL)
11+
endif
12+
BUNDLE_METADATA_OPTS ?= $(BUNDLE_CHANNELS) $(BUNDLE_DEFAULT_CHANNEL)
13+
14+
# Image URL to use all building/pushing image targets
15+
IMG ?= snyk/snyk-operator:$(VERSION)
16+
17+
all: docker-build
18+
19+
# Run against the configured Kubernetes cluster in ~/.kube/config
20+
run: helm-operator
21+
$(HELM_OPERATOR) run
22+
23+
# Install CRDs into a cluster
24+
install: kustomize
25+
$(KUSTOMIZE) build config/crd | kubectl apply -f -
26+
27+
# Uninstall CRDs from a cluster
28+
uninstall: kustomize
29+
$(KUSTOMIZE) build config/crd | kubectl delete -f -
30+
31+
# Deploy controller in the configured Kubernetes cluster in ~/.kube/config
32+
deploy: kustomize
33+
cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
34+
$(KUSTOMIZE) build config/default | kubectl apply -f -
35+
36+
# Undeploy controller in the configured Kubernetes cluster in ~/.kube/config
37+
undeploy: kustomize
38+
$(KUSTOMIZE) build config/default | kubectl delete -f -
39+
40+
# Build the docker image
41+
docker-build:
42+
docker build . -t ${IMG}
43+
44+
# Push the docker image
45+
docker-push:
46+
docker push ${IMG}
47+
48+
PATH := $(PATH):$(PWD)/bin
49+
# SHELL := env PATH=$(PATH) /bin/sh
50+
OS = $(shell uname -s | tr '[:upper:]' '[:lower:]')
51+
ARCH = $(shell uname -m | sed 's/x86_64/amd64/')
52+
OSOPER = $(shell uname -s | tr '[:upper:]' '[:lower:]' | sed 's/darwin/apple-darwin/' | sed 's/linux/linux-gnu/')
53+
ARCHOPER = $(shell uname -m )
54+
55+
kustomize:
56+
ifeq (, $(shell which kustomize 2>/dev/null))
57+
@{ \
58+
set -e ;\
59+
mkdir -p bin ;\
60+
curl -sSLo - https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v3.5.4/kustomize_v3.5.4_$(OS)_$(ARCH).tar.gz | tar xzf - -C bin/ ;\
61+
}
62+
KUSTOMIZE=$(realpath ./bin/kustomize)
63+
else
64+
KUSTOMIZE=$(shell which kustomize)
65+
endif
66+
67+
helm-operator:
68+
ifeq (, $(shell which helm-operator 2>/dev/null))
69+
@{ \
70+
set -e ;\
71+
mkdir -p bin ;\
72+
curl -LO https://github.com/operator-framework/operator-sdk/releases/download/v1.8.0/helm-operator-v1.8.0-$(ARCHOPER)-$(OSOPER) ;\
73+
mv helm-operator-v1.1.0-$(ARCHOPER)-$(OSOPER) ./bin/helm-operator ;\
74+
chmod +x ./bin/helm-operator ;\
75+
}
76+
HELM_OPERATOR=$(realpath ./bin/helm-operator)
77+
else
78+
HELM_OPERATOR=$(shell which helm-operator)
79+
endif
80+
81+
# Generate bundle manifests and metadata, then validate generated files.
82+
.PHONY: bundle
83+
bundle: kustomize
84+
operator-sdk generate kustomize manifests -q
85+
cd config/manager && $(KUSTOMIZE) edit set image controller=$(IMG)
86+
$(KUSTOMIZE) build config/manifests | operator-sdk generate bundle -q --overwrite --version $(VERSION) $(BUNDLE_METADATA_OPTS)
87+
operator-sdk bundle validate ./bundle
88+
89+
# Build the bundle image.
90+
.PHONY: bundle-build
91+
bundle-build:
92+
docker build -f bundle.Dockerfile -t $(BUNDLE_IMG) .

‎snyk-operator-certified/PROJECT‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
domain: snyk.io
2+
layout: helm.sdk.operatorframework.io/v1
3+
projectName: snyk-monitor
4+
resources:
5+
- group: charts.snyk.io/v1alpha1
6+
kind: SnykMonitor
7+
version: v1alpha1
8+
version: 3-alpha

‎snyk-operator-certified/README.md‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# snyk-operator
2+
3+
```sh
4+
curl -Lo opm https://github.com/operator-framework/operator-registry/releases/download/v1.17.3/darwin-amd64-opm
5+
chmod +x opm
6+
```
7+
8+
```sh
9+
export VERSION=1.64.1-pre0
10+
make docker-build
11+
docker tag snyk/snyk-operator-bundle:$VERSION <operator-certification-repo>:$VERSION
12+
docker push registry.connect.redhat.com/snyk/kubernetes-operator:$VERSION
13+
14+
make bundle-build
15+
docker tag snyk/snyk-operator-bundle:$VERSION <bundle-certification-repo>:$VERSION
16+
docker push <bundle-certification-repo>:$VERSION
17+
18+
./opm index add -c docker --bundles snyk/snyk-operator-bundle:$VERSION --tag snyk/snyk-operator-index:$VERSION
19+
```
20+
21+
```yaml
22+
apiVersion: operators.coreos.com/v1alpha1
23+
kind: CatalogSource
24+
metadata:
25+
name: snyk-operator
26+
namespace: openshift-marketplace
27+
spec:
28+
sourceType: grpc
29+
image: docker.io/snyk/snyk-operator-index:1.64.1
30+
displayName: Snyk Operator Bundle
31+
publisher: Snyk Ltd.
32+
updateStrategy:
33+
registryPoll:
34+
interval: 1m
35+
```
36+
37+
```yaml
38+
apiVersion: charts.snyk.io/v1alpha1 # this has changed, used to be "charts.helm.k8s.io/v1alpha1"
39+
kind: SnykMonitor
40+
metadata:
41+
name: snyk-monitor
42+
namespace: snyk-monitor
43+
spec:
44+
integrationApi: https://kubernetes-upstream.dev.snyk.io
45+
temporaryStorageSize: 20Gi
46+
pvc:
47+
enabled: true
48+
---
49+
apiVersion: operators.coreos.com/v1
50+
kind: OperatorGroup
51+
metadata:
52+
name: snyk-operator
53+
namespace: snyk-monitor
54+
spec:
55+
targetNamespaces:
56+
- snyk-monitor
57+
---
58+
apiVersion: operators.coreos.com/v1alpha1
59+
kind: Subscription
60+
metadata:
61+
name: snyk-operator
62+
namespace: snyk-monitor
63+
spec:
64+
channel: stable
65+
name: snyk-operator-marketplace # this has changed, used to be "snyk-operator"
66+
installPlanApproval: Automatic
67+
source: snyk-operator
68+
sourceNamespace: openshift-marketplace
69+
```

‎snyk-operator-certified/bundle.Dockerfile‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
FROM scratch
2+
3+
LABEL operators.operatorframework.io.bundle.mediatype.v1=registry+v1
4+
LABEL operators.operatorframework.io.bundle.manifests.v1=manifests/
5+
LABEL operators.operatorframework.io.bundle.metadata.v1=metadata/
6+
LABEL operators.operatorframework.io.bundle.package.v1=snyk-operator-marketplace
7+
LABEL operators.operatorframework.io.bundle.channels.v1=stable
8+
LABEL operators.operatorframework.io.bundle.channel.default.v1=stable
9+
LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.3.0
10+
LABEL operators.operatorframework.io.metrics.mediatype.v1=metrics+v1
11+
LABEL operators.operatorframework.io.metrics.project_layout=helm.sdk.operatorframework.io/v1
12+
LABEL operators.operatorframework.io.test.config.v1=tests/scorecard/
13+
LABEL operators.operatorframework.io.test.mediatype.v1=scorecard+v1
14+
15+
# Labels added in accord with the documentation
16+
# https://redhat-connect.gitbook.io/certified-operator-guide/ocp-deployment/operator-metadata/bundle-directory/managing-openshift-versions
17+
LABEL com.redhat.openshift.versions="v4.5-v4.7"
18+
LABEL com.redhat.delivery.operator.bundle=true
19+
LABEL com.redhat.delivery.backport=true
20+
21+
COPY bundle/manifests /manifests/
22+
COPY bundle/metadata /metadata/
23+
COPY bundle/tests/scorecard /tests/scorecard/

‎snyk-operator-certified/bundle/manifests/charts.snyk.io_snykmonitors.yaml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
apiVersion: apiextensions.k8s.io/v1beta1
2+
kind: CustomResourceDefinition
3+
metadata:
4+
name: snykmonitors.charts.snyk.io
5+
spec:
6+
group: charts.snyk.io
7+
names:
8+
kind: SnykMonitor
9+
listKind: SnykMonitorList
10+
plural: snykmonitors
11+
singular: snykmonitor
12+
scope: Namespaced
13+
subresources:
14+
status: {}
15+
validation:
16+
openAPIV3Schema:
17+
description: SnykMonitor is the Schema for the snykmonitors API
18+
type: object
19+
properties:
20+
apiVersion:
21+
description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
22+
type: string
23+
kind:
24+
description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
25+
type: string
26+
metadata:
27+
type: object
28+
spec:
29+
description: Spec defines the desired state of SnykMonitor
30+
type: object
31+
x-kubernetes-preserve-unknown-fields: true
32+
properties:
33+
monitorSecrets:
34+
description: >-
35+
The name of the secret object that stores the Snyk controller secrets.
36+
The secret needs to contain the following data fields:
37+
- integrationId
38+
- dockercfg.json
39+
type: string
40+
image:
41+
properties:
42+
pullPolicy:
43+
type: string
44+
image:
45+
type: string
46+
type: object
47+
scope:
48+
type: string
49+
clusterName:
50+
type: string
51+
integrationApi:
52+
type: string
53+
temporaryStorageSize:
54+
type: string
55+
pvc:
56+
properties:
57+
enabled:
58+
type: boolean
59+
name:
60+
type: string
61+
type: object
62+
initContainerImage:
63+
properties:
64+
image:
65+
type: string
66+
pullPolicy:
67+
type: string
68+
type: object
69+
status:
70+
description: Status defines the observed state of SnykMonitor
71+
type: object
72+
x-kubernetes-preserve-unknown-fields: true
73+
versions:
74+
- name: v1alpha1
75+
served: true
76+
storage: true
77+
status:
78+
acceptedNames:
79+
kind: ""
80+
plural: ""
81+
conditions: null
82+
storedVersions: null

‎snyk-operator-certified/bundle/manifests/snyk-monitor-controller-manager-metrics-service_v1_service.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
creationTimestamp: null
5+
labels:
6+
control-plane: controller-manager
7+
name: snyk-monitor-controller-manager-metrics-service
8+
spec:
9+
ports:
10+
- name: https
11+
port: 8443
12+
targetPort: https
13+
selector:
14+
control-plane: controller-manager
15+
status:
16+
loadBalancer: {}

‎snyk-operator-certified/bundle/manifests/snyk-monitor-metrics-reader_rbac.authorization.k8s.io_v1beta1_clusterrole.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: rbac.authorization.k8s.io/v1beta1
2+
kind: ClusterRole
3+
metadata:
4+
creationTimestamp: null
5+
name: snyk-monitor-metrics-reader
6+
rules:
7+
- nonResourceURLs:
8+
- /metrics
9+
verbs:
10+
- get

0 commit comments

Comments
 (0)