diff --git a/cmd/main.go b/cmd/main.go index fdf13132..5e12df07 100644 --- a/cmd/main.go +++ b/cmd/main.go @@ -16,6 +16,7 @@ import ( routeApi "github.com/openshift/api/route/v1" tektonpipelineApi "github.com/tektoncd/pipeline/pkg/apis/pipeline/v1" tektonTriggersApi "github.com/tektoncd/triggers/pkg/apis/triggers/v1beta1" + corev1 "k8s.io/api/core/v1" networkingV1 "k8s.io/api/networking/v1" k8sruntime "k8s.io/apimachinery/pkg/runtime" utilruntime "k8s.io/apimachinery/pkg/util/runtime" @@ -23,6 +24,7 @@ import ( ctrl "sigs.k8s.io/controller-runtime" "sigs.k8s.io/controller-runtime/pkg/cache" "sigs.k8s.io/controller-runtime/pkg/certwatcher" + "sigs.k8s.io/controller-runtime/pkg/client" "sigs.k8s.io/controller-runtime/pkg/healthz" "sigs.k8s.io/controller-runtime/pkg/log/zap" "sigs.k8s.io/controller-runtime/pkg/metrics/filters" @@ -67,6 +69,26 @@ const ( branchStaleCheckDefaultInterval = time.Hour * 24 ) +// No list/watch in the Role for these types. Secret is dual-listed: watched via the +// cache ByObject below, read live here. +// +// client.MatchingFields is served by the cache only. Never field-index a type listed +// here (pkg/codebase/index.go), and never list an indexed type here. +var uncachedTypes = []client.Object{ + &corev1.Secret{}, + &corev1.ConfigMap{}, + &codebaseApiV1.QuickLink{}, + &cdPipeApi.CDPipeline{}, + &cdPipeApi.Stage{}, + &tektonTriggersApi.TriggerTemplate{}, + &networkingV1.Ingress{}, + &gatewayv1.HTTPRoute{}, + &routeApi.Route{}, +} + +// Verbs track resourcelock.LeasesLock; revisit if LeaderElectionResourceLock changes. +// +kubebuilder:rbac:groups=coordination.k8s.io,namespace=placeholder,resources=leases,verbs=get;create;update + func main() { var ( metricsAddr string @@ -224,6 +246,13 @@ func main() { os.Exit(1) } + secretCacheSelector := integrationsecret.CacheSelector() + + setupLog.Info("Restricting the cache", + "namespace", ns, + "secretLabelSelector", secretCacheSelector.String(), + ) + cfg := ctrl.GetConfigOrDie() mgr, err := ctrl.NewManager(cfg, ctrl.Options{ @@ -235,6 +264,14 @@ func main() { LeaderElectionID: codebaseOperatorLock, Cache: cache.Options{ DefaultNamespaces: map[string]cache.Config{ns: {}}, + DefaultTransform: cache.TransformStripManagedFields(), + ByObject: map[client.Object]cache.ByObject{ + // Widen this if a second controller starts watching Secrets. + &corev1.Secret{}: {Label: secretCacheSelector}, + }, + }, + Client: client.Options{ + Cache: &client.CacheOptions{DisableFor: uncachedTypes}, }, }) if err != nil { diff --git a/config/rbac/kustomization.yaml b/config/rbac/kustomization.yaml index 8db5b34d..089e7719 100644 --- a/config/rbac/kustomization.yaml +++ b/config/rbac/kustomization.yaml @@ -7,8 +7,6 @@ resources: - service_account.yaml - role.yaml - role_binding.yaml -- leader_election_role.yaml -- leader_election_role_binding.yaml # The following RBAC configurations are used to protect # the metrics endpoint with authn/authz. These configurations # ensure that only authorized users and service accounts diff --git a/config/rbac/leader_election_role.yaml b/config/rbac/leader_election_role.yaml deleted file mode 100644 index 758a4cf3..00000000 --- a/config/rbac/leader_election_role.yaml +++ /dev/null @@ -1,44 +0,0 @@ -# permissions to do leader election. -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - labels: - app.kubernetes.io/name: role - app.kubernetes.io/instance: leader-election-role - app.kubernetes.io/component: rbac - app.kubernetes.io/created-by: edp-codebase-operator - app.kubernetes.io/part-of: edp-codebase-operator - app.kubernetes.io/managed-by: kustomize - name: leader-election-role -rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch diff --git a/config/rbac/leader_election_role_binding.yaml b/config/rbac/leader_election_role_binding.yaml deleted file mode 100644 index 4fecb444..00000000 --- a/config/rbac/leader_election_role_binding.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - app.kubernetes.io/name: rolebinding - app.kubernetes.io/instance: leader-election-rolebinding - app.kubernetes.io/component: rbac - app.kubernetes.io/created-by: edp-codebase-operator - app.kubernetes.io/part-of: edp-codebase-operator - app.kubernetes.io/managed-by: kustomize - name: leader-election-rolebinding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: leader-election-role -subjects: -- kind: ServiceAccount - name: controller-manager - namespace: system diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index 5bdf4355..ad70900e 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -1,55 +1,41 @@ --- apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole +kind: Role metadata: name: manager-role + namespace: placeholder rules: - apiGroups: - - v2.edp.epam.com + - "" resources: - - jiraissuemetadatas - - jiraservers + - configmaps verbs: - - create - - delete - get - - list - - patch - - update - - watch -- apiGroups: - - v2.edp.epam.com - resources: - - jiraissuemetadatas/finalizers - - jiraservers/finalizers - verbs: - - update - apiGroups: - - v2.edp.epam.com + - "" resources: - - jiraissuemetadatas/status - - jiraservers/status + - events verbs: - - get + - create - patch - - update ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: manager-role - namespace: placeholder -rules: - apiGroups: - "" resources: - secrets verbs: + - delete - get - list - - patch - update - watch +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - get + - update - apiGroups: - gateway.networking.k8s.io resources: @@ -57,8 +43,6 @@ rules: verbs: - create - get - - list - - watch - apiGroups: - networking.k8s.io resources: @@ -66,8 +50,6 @@ rules: verbs: - create - get - - list - - watch - apiGroups: - route.openshift.io resources: @@ -75,27 +57,36 @@ rules: verbs: - create - get - - list - - watch - apiGroups: - tekton.dev resources: - pipelineruns verbs: - create - - get - list - - patch - - update - watch +- apiGroups: + - triggers.tekton.dev + resources: + - eventlisteners + verbs: + - create + - get + - patch - apiGroups: - triggers.tekton.dev resources: - triggertemplates verbs: - get +- apiGroups: + - v2.edp.epam.com + resources: + - cdpipelines + - stages + verbs: + - get - list - - watch - apiGroups: - v2.edp.epam.com resources: @@ -104,6 +95,8 @@ rules: - codebaseimagestreams - codebases - gitservers + - jiraissuemetadatas + - jiraservers verbs: - create - delete @@ -120,6 +113,8 @@ rules: - codebaseimagestreams/finalizers - codebases/finalizers - gitservers/finalizers + - jiraissuemetadatas/finalizers + - jiraservers/finalizers verbs: - update - apiGroups: @@ -130,7 +125,15 @@ rules: - codebaseimagestreams/status - codebases/status - gitservers/status + - jiraissuemetadatas/status + - jiraservers/status verbs: - get - patch - update +- apiGroups: + - v2.edp.epam.com + resources: + - quicklinks + verbs: + - get diff --git a/config/rbac/role_binding.yaml b/config/rbac/role_binding.yaml index c9e62613..1b329d4b 100644 --- a/config/rbac/role_binding.yaml +++ b/config/rbac/role_binding.yaml @@ -1,8 +1,8 @@ apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding +kind: RoleBinding metadata: labels: - app.kubernetes.io/name: clusterrolebinding + app.kubernetes.io/name: rolebinding app.kubernetes.io/instance: manager-rolebinding app.kubernetes.io/component: rbac app.kubernetes.io/created-by: edp-codebase-operator @@ -11,7 +11,7 @@ metadata: name: manager-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io - kind: ClusterRole + kind: Role name: manager-role subjects: - kind: ServiceAccount diff --git a/controllers/cdstagedeploy/cdstagedeploy_controller.go b/controllers/cdstagedeploy/cdstagedeploy_controller.go index 8538c278..48466214 100644 --- a/controllers/cdstagedeploy/cdstagedeploy_controller.go +++ b/controllers/cdstagedeploy/cdstagedeploy_controller.go @@ -80,8 +80,10 @@ func (r *ReconcileCDStageDeploy) SetupWithManager(mgr ctrl.Manager) error { // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=cdstagedeployments,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=cdstagedeployments/status,verbs=get;update;patch // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=cdstagedeployments/finalizers,verbs=update -// +kubebuilder:rbac:groups=triggers.tekton.dev,namespace=placeholder,resources=triggertemplates,verbs=get;list;watch; -// +kubebuilder:rbac:groups=tekton.dev,namespace=placeholder,resources=pipelineruns,verbs=get;list;watch;create;update;patch +// +kubebuilder:rbac:groups=triggers.tekton.dev,namespace=placeholder,resources=triggertemplates,verbs=get +// Cached List, hence list+watch. +// +kubebuilder:rbac:groups=tekton.dev,namespace=placeholder,resources=pipelineruns,verbs=list;watch;create +// +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=cdpipelines;stages,verbs=get;list // Reconcile reads that state of the cluster for a CDStageDeploy object and makes changes based on the state. func (r *ReconcileCDStageDeploy) Reconcile(ctx context.Context, request reconcile.Request) (reconcile.Result, error) { diff --git a/controllers/codebase/codebase_controller.go b/controllers/codebase/codebase_controller.go index 4ecef3f5..7775eae2 100644 --- a/controllers/codebase/codebase_controller.go +++ b/controllers/codebase/codebase_controller.go @@ -91,7 +91,13 @@ func (r *ReconcileCodebase) SetupWithManager(mgr ctrl.Manager) error { // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=codebases,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=codebases/status,verbs=get;update;patch // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=codebases/finalizers,verbs=update -// +kubebuilder:rbac:groups=route.openshift.io,namespace=placeholder,resources=routes,verbs=get;list;watch +// +kubebuilder:rbac:groups=route.openshift.io,namespace=placeholder,resources=routes,verbs=get +// +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=quicklinks,verbs=get +// +kubebuilder:rbac:groups="",namespace=placeholder,resources=configmaps,verbs=get +// update: webhook secret written into the GitServer Secret. +// delete: clone credentials, when Codebase.spec.cloneRepositoryCredentials +// .clearSecretAfterUse is set. +// +kubebuilder:rbac:groups="",namespace=placeholder,resources=secrets,verbs=get;update;delete // Reconcile reads that state of the cluster for a Codebase object and makes changes based on the state. func (r *ReconcileCodebase) Reconcile(ctx context.Context, request reconcile.Request) (reconcile.Result, error) { diff --git a/controllers/codebasebranch/codebasebranch_controller.go b/controllers/codebasebranch/codebasebranch_controller.go index be5a7f36..898711ad 100644 --- a/controllers/codebasebranch/codebasebranch_controller.go +++ b/controllers/codebasebranch/codebasebranch_controller.go @@ -99,6 +99,9 @@ func (r *ReconcileCodebaseBranch) SetupWithManager(mgr ctrl.Manager, maxConcurre // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=codebasebranches,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=codebasebranches/status,verbs=get;update;patch // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=codebasebranches/finalizers,verbs=update +// +kubebuilder:rbac:groups="",namespace=placeholder,resources=secrets,verbs=get +// +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=cdpipelines;stages,verbs=get;list +// +kubebuilder:rbac:groups="",namespace=placeholder,resources=events,verbs=create;patch // Reconcile reads that state of the cluster for a CodebaseBranch object and makes changes based on the state. func (r *ReconcileCodebaseBranch) Reconcile(ctx context.Context, request reconcile.Request) (reconcile.Result, error) { diff --git a/controllers/codebaseimagestream/codebaseimagestream_controller.go b/controllers/codebaseimagestream/codebaseimagestream_controller.go index d5e77f36..bf18c8d1 100644 --- a/controllers/codebaseimagestream/codebaseimagestream_controller.go +++ b/controllers/codebaseimagestream/codebaseimagestream_controller.go @@ -74,6 +74,7 @@ func (r *ReconcileCodebaseImageStream) SetupWithManager(mgr ctrl.Manager) error // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=codebaseimagestreams,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=codebaseimagestreams/status,verbs=get;update;patch // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=codebaseimagestreams/finalizers,verbs=update +// +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=cdpipelines;stages,verbs=get;list // Reconcile reads that state of the cluster for a CodebaseImageStream object and makes changes based on the state. func (r *ReconcileCodebaseImageStream) Reconcile( diff --git a/controllers/gitserver/gitserver_controller.go b/controllers/gitserver/gitserver_controller.go index 13247979..6cc0df6f 100644 --- a/controllers/gitserver/gitserver_controller.go +++ b/controllers/gitserver/gitserver_controller.go @@ -51,10 +51,13 @@ func (r *ReconcileGitServer) SetupWithManager(mgr ctrl.Manager) error { // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=gitservers,verbs=get;list;watch;create;update;patch;delete // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=gitservers/status,verbs=get;update;patch // +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=gitservers/finalizers,verbs=update -// +kubebuilder:rbac:groups="",namespace=placeholder,resources=secrets,verbs=get;list;watch;update;patch -// +kubebuilder:rbac:groups="networking.k8s.io",namespace=placeholder,resources=ingresses,verbs=get;list;watch;create -// +kubebuilder:rbac:groups="gateway.networking.k8s.io",namespace=placeholder,resources=httproutes,verbs=get;list;watch;create -// +kubebuilder:rbac:groups="route.openshift.io",namespace=placeholder,resources=routes,verbs=get;list;watch;create +// update sets the GitServer ownerReference on its credential Secret. +// +kubebuilder:rbac:groups="",namespace=placeholder,resources=secrets,verbs=get;update +// +kubebuilder:rbac:groups="networking.k8s.io",namespace=placeholder,resources=ingresses,verbs=get;create +// +kubebuilder:rbac:groups="gateway.networking.k8s.io",namespace=placeholder,resources=httproutes,verbs=get;create +// +kubebuilder:rbac:groups="route.openshift.io",namespace=placeholder,resources=routes,verbs=get;create +// EventListener is unstructured, hence uncached. +// +kubebuilder:rbac:groups="triggers.tekton.dev",namespace=placeholder,resources=eventlisteners,verbs=get;create;patch // Reconcile reads that state of the cluster for a GitServer object and makes changes based on the state. func (r *ReconcileGitServer) Reconcile(ctx context.Context, request reconcile.Request) (reconcile.Result, error) { diff --git a/controllers/integrationsecret/integrationsecret_controller.go b/controllers/integrationsecret/integrationsecret_controller.go index def23704..351d5729 100644 --- a/controllers/integrationsecret/integrationsecret_controller.go +++ b/controllers/integrationsecret/integrationsecret_controller.go @@ -14,6 +14,7 @@ import ( "github.com/go-resty/resty/v2" corev1 "k8s.io/api/core/v1" k8sErrors "k8s.io/apimachinery/pkg/api/errors" + "k8s.io/apimachinery/pkg/labels" ctrl "sigs.k8s.io/controller-runtime" "sigs.k8s.io/controller-runtime/pkg/builder" "sigs.k8s.io/controller-runtime/pkg/client" @@ -70,7 +71,9 @@ func (r *ReconcileIntegrationSecret) SetupWithManager(mgr ctrl.Manager) error { return nil } -// +kubebuilder:rbac:groups="",namespace=placeholder,resources=secrets,verbs=get;list;watch;update;patch +// list/watch cannot be narrowed to CacheSelector: label selectors scope the informer, +// not authorization. update writes the connection-status annotation. +// +kubebuilder:rbac:groups="",namespace=placeholder,resources=secrets,verbs=get;list;watch;update // Reconcile reads secrets with integration-secret label and set connection status to the annotation. func (r *ReconcileIntegrationSecret) Reconcile( @@ -312,7 +315,12 @@ func (r *ReconcileIntegrationSecret) checkGitHubRegistry(ctx context.Context, au } func hasIntegrationSecretLabelLabel(object client.Object) bool { - label := object.GetLabels()[integrationSecretLabel] + return cacheSelector.Matches(labels.Set(object.GetLabels())) +} + +var cacheSelector = labels.SelectorFromSet(labels.Set{integrationSecretLabel: "true"}) - return label == "true" +// CacheSelector scopes the manager cache to the same Secrets as the event predicate. +func CacheSelector() labels.Selector { + return cacheSelector } diff --git a/controllers/jiraissuemetadata/jiraissuemetadata_controller.go b/controllers/jiraissuemetadata/jiraissuemetadata_controller.go index ce2f9378..a15b1c64 100644 --- a/controllers/jiraissuemetadata/jiraissuemetadata_controller.go +++ b/controllers/jiraissuemetadata/jiraissuemetadata_controller.go @@ -86,9 +86,10 @@ func (r *ReconcileJiraIssueMetadata) SetupWithManager(mgr ctrl.Manager) error { return nil } -// +kubebuilder:rbac:groups=v2.edp.epam.com,resources=jiraissuemetadatas,verbs=get;list;watch;create;update;patch;delete -// +kubebuilder:rbac:groups=v2.edp.epam.com,resources=jiraissuemetadatas/status,verbs=get;update;patch -// +kubebuilder:rbac:groups=v2.edp.epam.com,resources=jiraissuemetadatas/finalizers,verbs=update +// +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=jiraissuemetadatas,verbs=get;list;watch;create;update;patch;delete +// +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=jiraissuemetadatas/status,verbs=get;update;patch +// +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=jiraissuemetadatas/finalizers,verbs=update +// +kubebuilder:rbac:groups="",namespace=placeholder,resources=secrets,verbs=get // Reconcile reads that state of the cluster for a JiraIssueMetadata object and makes changes based on the state. func (r *ReconcileJiraIssueMetadata) Reconcile( diff --git a/controllers/jiraserver/jiraserver_controller.go b/controllers/jiraserver/jiraserver_controller.go index 37b5b8b4..36f03d74 100644 --- a/controllers/jiraserver/jiraserver_controller.go +++ b/controllers/jiraserver/jiraserver_controller.go @@ -75,9 +75,10 @@ func (r *ReconcileJiraServer) SetupWithManager(mgr ctrl.Manager) error { return nil } -// +kubebuilder:rbac:groups=v2.edp.epam.com,resources=jiraservers,verbs=get;list;watch;create;update;patch;delete -// +kubebuilder:rbac:groups=v2.edp.epam.com,resources=jiraservers/status,verbs=get;update;patch -// +kubebuilder:rbac:groups=v2.edp.epam.com,resources=jiraservers/finalizers,verbs=update +// +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=jiraservers,verbs=get;list;watch;create;update;patch;delete +// +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=jiraservers/status,verbs=get;update;patch +// +kubebuilder:rbac:groups=v2.edp.epam.com,namespace=placeholder,resources=jiraservers/finalizers,verbs=update +// +kubebuilder:rbac:groups="",namespace=placeholder,resources=secrets,verbs=get // Reconcile reads that state of the cluster for a JiraServer object and makes changes based on the state. func (r *ReconcileJiraServer) Reconcile(ctx context.Context, request reconcile.Request) (reconcile.Result, error) { diff --git a/deploy-templates/templates/role_kubernetes.yaml b/deploy-templates/templates/role.yaml similarity index 70% rename from deploy-templates/templates/role_kubernetes.yaml rename to deploy-templates/templates/role.yaml index 9c371bde..d11b35b0 100644 --- a/deploy-templates/templates/role_kubernetes.yaml +++ b/deploy-templates/templates/role.yaml @@ -1,4 +1,3 @@ -{{- if eq .Values.global.platform "kubernetes" -}} apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: @@ -6,115 +5,141 @@ metadata: labels: {{- include "codebase-operator.labels" . | nindent 4 }} name: edp-{{ .Values.name }} +# Hand-maintained. Mirrors config/rbac/role.yaml (`make manifests`). +# Not enforced: copy marker changes across by hand. rules: - apiGroups: - - argoproj.io + - "" resources: - - applications + - configmaps verbs: - get - - list +- apiGroups: + - "" + resources: + - events + verbs: + - create - patch - - update - - watch - apiGroups: - - '*' + - "" resources: - - gitservers - - gitservers/status - - gitservers/finalizers - - codebases - - codebases/status - - codebases/finalizers - - codebasebranches - - codebasebranches/status - - codebasebranches/finalizers - - codebaseimagestreams - - codebaseimagestreams/status - - codebaseimagestreams/finalizers - - configmaps - - quicklinks - - jiraservers - - jiraservers/finalizers - - jiraservers/status - - jirafixversions - - jirafixversions/status - - jiraissuemetadatas - - jiraissuemetadatas/finalizers - - jiraissuemetadatas/status - - cdstagedeployments - - cdstagedeployments/finalizers - - cdstagedeployments/status - - stages - - stages/finalizers - - stages/status - - cdpipelines + - secrets verbs: - - '*' + - delete + - get + - list + - update + - watch - apiGroups: - coordination.k8s.io resources: - leases verbs: + - create - get + - update +- apiGroups: + - tekton.dev + resources: + - pipelineruns + verbs: + - create - list - watch +- apiGroups: + - triggers.tekton.dev + resources: + - eventlisteners + verbs: - create - - update + - get - patch - - delete - apiGroups: - - networking.k8s.io + - triggers.tekton.dev resources: - - ingresses + - triggertemplates verbs: - get - - list - - watch - - create - apiGroups: - - gateway.networking.k8s.io + - v2.edp.epam.com resources: - - httproutes + - cdpipelines + - stages verbs: - get - list - - watch - - create - apiGroups: - - "" + - v2.edp.epam.com resources: - - events + - cdstagedeployments + - codebasebranches + - codebaseimagestreams + - codebases + - gitservers + - jiraissuemetadatas + - jiraservers verbs: - create + - delete + - get + - list - patch + - update + - watch - apiGroups: - - '' + - v2.edp.epam.com + resources: + - cdstagedeployments/finalizers + - codebasebranches/finalizers + - codebaseimagestreams/finalizers + - codebases/finalizers + - gitservers/finalizers + - jiraissuemetadatas/finalizers + - jiraservers/finalizers + verbs: + - update +- apiGroups: + - v2.edp.epam.com + resources: + - cdstagedeployments/status + - codebasebranches/status + - codebaseimagestreams/status + - codebases/status + - gitservers/status + - jiraissuemetadatas/status + - jiraservers/status verbs: - get - - watch - - list - patch - update +- apiGroups: + - v2.edp.epam.com resources: - - secrets + - quicklinks + verbs: + - get +{{- if eq .Values.global.platform "openshift" }} - apiGroups: - - tekton.dev + - route.openshift.io resources: - - pipelineruns + - routes verbs: - create - get - - list - - patch - - update - - watch +{{- else }} - apiGroups: - - triggers.tekton.dev + - gateway.networking.k8s.io resources: - - triggertemplates + - httproutes verbs: + - create - get - - list - - watch -{{ end }} +- apiGroups: + - networking.k8s.io + resources: + - ingresses + verbs: + - create + - get +{{- end }} diff --git a/deploy-templates/templates/role_openshift.yaml b/deploy-templates/templates/role_openshift.yaml deleted file mode 100644 index 7a16f09e..00000000 --- a/deploy-templates/templates/role_openshift.yaml +++ /dev/null @@ -1,100 +0,0 @@ -{{- if eq .Values.global.platform "openshift" -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - namespace: {{ .Release.Namespace }} - labels: - {{- include "codebase-operator.labels" . | nindent 4 }} - name: edp-{{ .Values.name }} -rules: -- apiGroups: - - argoproj.io - resources: - - applications - verbs: - - get - - list - - patch - - update - - watch -- apiGroups: - - '*' - resources: - - cdpipelines - - cdstagedeployments - - cdstagedeployments/finalizers - - cdstagedeployments/status - - codebasebranches - - codebasebranches/finalizers - - codebasebranches/status - - codebaseimagestreams - - codebaseimagestreams/finalizers - - codebaseimagestreams/status - - codebases - - codebases/finalizers - - codebases/status - - configmaps - - gitservers - - gitservers/finalizers - - gitservers/status - - jirafixversions - - jirafixversions/status - - jiraissuemetadatas - - jiraissuemetadatas/finalizers - - jiraissuemetadatas/status - - jiraservers - - jiraservers/finalizers - - jiraservers/status - - stages - - stages/finalizers - - stages/status - verbs: - - '*' -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - route.openshift.io - resources: - - routes - verbs: - - get - - list - - watch - - create -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch -- apiGroups: - - tekton.dev - resources: - - pipelineruns - verbs: - - create - - get - - list - - patch - - update - - watch -- apiGroups: - - triggers.tekton.dev - resources: - - triggertemplates - verbs: - - get - - list - - watch -{{ end }} diff --git a/deploy-templates/templates/rolebinding_admin_kubernetes.yaml b/deploy-templates/templates/rolebinding_admin_kubernetes.yaml deleted file mode 100644 index 70c75dab..00000000 --- a/deploy-templates/templates/rolebinding_admin_kubernetes.yaml +++ /dev/null @@ -1,16 +0,0 @@ -{{- if eq .Values.global.platform "kubernetes" -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - {{- include "codebase-operator.labels" . | nindent 4 }} - name: edp-{{ .Values.name }}-admin -roleRef: - name: admin - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole -subjects: - - kind: ServiceAccount - name: edp-{{ .Values.name }} - namespace: {{ .Release.Namespace }} -{{- end -}} diff --git a/deploy-templates/templates/rolebinding_admin_openshift.yaml b/deploy-templates/templates/rolebinding_admin_openshift.yaml deleted file mode 100644 index 34b781bd..00000000 --- a/deploy-templates/templates/rolebinding_admin_openshift.yaml +++ /dev/null @@ -1,16 +0,0 @@ -{{- if eq .Values.global.platform "openshift" -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - {{- include "codebase-operator.labels" . | nindent 4 }} - name: edp-{{ .Values.name }}-admin -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: admin -subjects: - - kind: ServiceAccount - name: edp-{{ .Values.name }} - namespace: {{ .Release.Namespace }} -{{- end -}} diff --git a/deploy-templates/templates/validation_webhook_rbac.yaml b/deploy-templates/templates/validation_webhook_rbac.yaml deleted file mode 100644 index 5f30a66c..00000000 --- a/deploy-templates/templates/validation_webhook_rbac.yaml +++ /dev/null @@ -1,34 +0,0 @@ -{{- if .Values.enableWebhooks }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - {{- include "codebase-operator.labels" . | nindent 4 }} - name: edp-{{ .Values.name }}-{{ .Release.Namespace }}-validation-webhook -rules: -- apiGroups: - - "" - resources: - - namespaces - verbs: - - get - - list - - watch - ---- - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - {{- include "codebase-operator.labels" . | nindent 4 }} - name: edp-{{ .Values.name }}-{{ .Release.Namespace }}-validation-webhook -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: edp-{{ .Values.name }}-{{ .Release.Namespace }}-validation-webhook -subjects: - - kind: ServiceAccount - name: edp-{{ .Values.name }} - namespace: {{ .Release.Namespace }} -{{- end }}