diff --git a/Dockerfile b/Dockerfile index 48c55d6f..580914df 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,6 +16,7 @@ COPY api/ api/ COPY controllers/ controllers/ COPY config/ config/ COPY pkg/ pkg/ +COPY service/ service/ # Run tests and linting RUN make go-test @@ -27,6 +28,7 @@ RUN make go-build FROM gcr.io/distroless/static:nonroot WORKDIR / COPY --from=builder /workspace/bin/manager . +COPY --from=builder /workspace/bin/status-reporter . COPY --from=builder /workspace/images.yaml /etc/ocs-client-operator/images.yaml USER 65532:65532 diff --git a/Makefile b/Makefile index f594be41..f946b1e4 100644 --- a/Makefile +++ b/Makefile @@ -108,7 +108,7 @@ bundle: manifests kustomize operator-sdk ## Generate bundle manifests and metada cd config/manifests/bases && $(KUSTOMIZE) edit add annotation --force 'olm.skipRange':"$(SKIP_RANGE)" && \ $(KUSTOMIZE) edit add patch --name ocs-client-operator.v0.0.0 --kind ClusterServiceVersion\ --patch '[{"op": "replace", "path": "/spec/replaces", "value": "$(REPLACES)"}]' - $(KUSTOMIZE) build config/manifests | $(OPERATOR_SDK) generate bundle -q --overwrite --version $(VERSION) $(BUNDLE_METADATA_OPTS) --extra-service-accounts=ocs-client-operator-csi-cephfs-provisioner-sa,ocs-client-operator-csi-cephfs-plugin-sa,ocs-client-operator-csi-rbd-provisioner-sa,ocs-client-operator-csi-rbd-plugin-sa + $(KUSTOMIZE) build config/manifests | $(OPERATOR_SDK) generate bundle -q --overwrite --version $(VERSION) $(BUNDLE_METADATA_OPTS) --extra-service-accounts=ocs-client-operator-csi-cephfs-provisioner-sa,ocs-client-operator-csi-cephfs-plugin-sa,ocs-client-operator-csi-rbd-provisioner-sa,ocs-client-operator-csi-rbd-plugin-sa,ocs-client-operator-status-reporter $(OPERATOR_SDK) bundle validate ./bundle .PHONY: bundle-build diff --git a/bundle/manifests/ocs-client-operator.clusterserviceversion.yaml b/bundle/manifests/ocs-client-operator.clusterserviceversion.yaml index b08897d2..857f2d34 100644 --- a/bundle/manifests/ocs-client-operator.clusterserviceversion.yaml +++ b/bundle/manifests/ocs-client-operator.clusterserviceversion.yaml @@ -462,6 +462,13 @@ spec: - --leader-elect command: - /manager + env: + - name: OPERATOR_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: STATUS_REPORTER_IMAGE + value: quay.io/ocs-dev/ocs-client-operator:latest image: quay.io/ocs-dev/ocs-client-operator:latest livenessProbe: httpGet: @@ -563,6 +570,23 @@ spec: verbs: - create serviceAccountName: ocs-client-operator-csi-rbd-provisioner-sa + - rules: + - apiGroups: + - ocs.openshift.io + resources: + - storageclients + verbs: + - get + - list + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - update + serviceAccountName: ocs-client-operator-status-reporter strategy: deployment installModes: - supported: false diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml index cf11cecc..5036590c 100644 --- a/config/manager/manager.yaml +++ b/config/manager/manager.yaml @@ -33,6 +33,13 @@ spec: - --leader-elect image: controller:latest name: manager + env: + - name: OPERATOR_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: STATUS_REPORTER_IMAGE + value: quay.io/ocs-dev/ocs-client-operator:latest securityContext: allowPrivilegeEscalation: false livenessProbe: diff --git a/config/rbac/kustomization.yaml b/config/rbac/kustomization.yaml index e290fec8..803e46b0 100644 --- a/config/rbac/kustomization.yaml +++ b/config/rbac/kustomization.yaml @@ -17,6 +17,10 @@ resources: - auth_proxy_role_binding.yaml - auth_proxy_client_clusterrole.yaml +# status reporter RBAC +- status-reporter-sa.yaml +- status-reporter-role.yaml +- status-reporter-role_binding.yaml # CSI RBAC - csi_cephfs_plugin_service_account.yaml - csi_cephfs_provisioner_clusterrole.yaml diff --git a/config/rbac/status-reporter-role.yaml b/config/rbac/status-reporter-role.yaml new file mode 100644 index 00000000..a58fdc20 --- /dev/null +++ b/config/rbac/status-reporter-role.yaml @@ -0,0 +1,20 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: status-reporter +rules: + - apiGroups: + - ocs.openshift.io + resources: + - storageclients + verbs: + - get + - list + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - update diff --git a/config/rbac/status-reporter-role_binding.yaml b/config/rbac/status-reporter-role_binding.yaml new file mode 100644 index 00000000..45607dbf --- /dev/null +++ b/config/rbac/status-reporter-role_binding.yaml @@ -0,0 +1,11 @@ +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: ocs-status-reporter +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: ocs-client-operator-status-reporter +subjects: + - kind: ServiceAccount + name: ocs-client-operator-status-reporter diff --git a/config/rbac/status-reporter-sa.yaml b/config/rbac/status-reporter-sa.yaml new file mode 100644 index 00000000..315c6d82 --- /dev/null +++ b/config/rbac/status-reporter-sa.yaml @@ -0,0 +1,4 @@ +kind: ServiceAccount +apiVersion: v1 +metadata: + name: status-reporter diff --git a/hack/go-build.sh b/hack/go-build.sh index 4197d85a..d297064a 100755 --- a/hack/go-build.sh +++ b/hack/go-build.sh @@ -8,3 +8,4 @@ export GO111MODULE=${GO111MODULE:-on} set -x go build -a -o ${GOBIN:-bin}/manager main.go +go build -a -o ${GOBIN:-bin}/status-reporter ./service/status-report/main.go