Skip to content

Commit 5f7afd5

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #1107 from petr-muller/scaffold-update-status-operator-manifests
OTA-1269: USC: Add `DevPreviewNoUpgrade`-gated manifests
2 parents 88299de + cbdaed5 commit 5f7afd5

4 files changed

+251
-0
lines changed

‎install/0000_00_update-status-controller_00_namespace-DevPreviewNoUpgrade.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: openshift-update-status-controller
5+
annotations:
6+
kubernetes.io/description: The update status controller manages OpenShift UpdateStatus API from insights collected from cluster components.
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
openshift.io/node-selector: ""
9+
workload.openshift.io/allowed: "management"
10+
release.openshift.io/feature-set: DevPreviewNoUpgrade
11+
labels:
12+
name: openshift-update-status-controller
13+
openshift.io/run-level: "" # specify no run-level turns it off on install and upgrades
14+
openshift.io/cluster-monitoring: "true"

‎install/0000_00_update-status-controller_01_serviceaccount-DevPreviewNoUpgrade.yaml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
annotations:
5+
kubernetes.io/description: SA used by the Update Status Controller.
6+
include.release.openshift.io/self-managed-high-availability: "true"
7+
release.openshift.io/feature-set: DevPreviewNoUpgrade
8+
name: update-status-controller
9+
namespace: openshift-update-status-controller

‎install/0000_00_update-status-controller_02_rbac-DevPreviewNoUpgrade.yaml

+176
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: Role
3+
metadata:
4+
name: update-status-controller-library
5+
namespace: openshift-update-status-controller
6+
annotations:
7+
# TODO(USC: TechPreview): Investigate if we really need all this, maybe we can make o/library-go
8+
# functionality optional?
9+
# https://github.com/openshift/cluster-version-operator/pull/1091#discussion_r1810586011
10+
kubernetes.io/description: Role that allows the USC binary to operate local resources needed by shared controller code from openshift/library-go
11+
include.release.openshift.io/self-managed-high-availability: "true"
12+
release.openshift.io/feature-set: DevPreviewNoUpgrade
13+
rules:
14+
- apiGroups:
15+
- ""
16+
resources:
17+
- pods
18+
verbs:
19+
- list
20+
- apiGroups:
21+
- ""
22+
resources:
23+
- events
24+
verbs:
25+
- create
26+
- apiGroups:
27+
- apps
28+
resources:
29+
- replicasets
30+
verbs:
31+
- get
32+
- apiGroups:
33+
- coordination.k8s.io
34+
resources:
35+
- leases
36+
verbs:
37+
- get
38+
- create
39+
- update
40+
---
41+
apiVersion: rbac.authorization.k8s.io/v1
42+
kind: ClusterRole
43+
metadata:
44+
name: update-status-controller-library
45+
annotations:
46+
# TODO(USC: TechPreview): Investigate if we really need all this, maybe we can make o/library-go
47+
# functionality optional?
48+
# https://github.com/openshift/cluster-version-operator/pull/1091#discussion_r1810586011
49+
kubernetes.io/description: Role that allows the USC binary to operate cluster resources needed by shared controller code from openshift/library-go
50+
include.release.openshift.io/self-managed-high-availability: "true"
51+
release.openshift.io/feature-set: DevPreviewNoUpgrade
52+
rules:
53+
- apiGroups:
54+
- config.openshift.io
55+
resources:
56+
- infrastructures
57+
resourceNames:
58+
- cluster
59+
verbs:
60+
- get
61+
---
62+
apiVersion: rbac.authorization.k8s.io/v1
63+
kind: Role
64+
metadata:
65+
name: update-status-controller
66+
namespace: openshift-update-status-controller
67+
annotations:
68+
kubernetes.io/description: Grant the update status controller permission to read and observe ConfigMaps, and modify the ConfigMap that serves as UpdateStatus API
69+
include.release.openshift.io/self-managed-high-availability: "true"
70+
release.openshift.io/feature-set: DevPreviewNoUpgrade
71+
rules:
72+
- apiGroups:
73+
- ""
74+
resources:
75+
- configmaps
76+
verbs:
77+
- get
78+
- list
79+
- watch
80+
- apiGroups:
81+
- ""
82+
resources:
83+
- configmaps
84+
resourceNames:
85+
- status-api-cm-prototype
86+
verbs:
87+
- patch
88+
- update
89+
---
90+
apiVersion: rbac.authorization.k8s.io/v1
91+
kind: ClusterRole
92+
metadata:
93+
name: update-status-controller-control-plane-informer
94+
annotations:
95+
kubernetes.io/description: Role that allows the update status controller to watch and read control plane resources
96+
include.release.openshift.io/self-managed-high-availability: "true"
97+
release.openshift.io/feature-set: DevPreviewNoUpgrade
98+
rules:
99+
- apiGroups:
100+
- config.openshift.io
101+
resources:
102+
- clusterversions
103+
verbs:
104+
- get
105+
- list
106+
- watch
107+
---
108+
apiVersion: rbac.authorization.k8s.io/v1
109+
kind: RoleBinding
110+
metadata:
111+
name: update-status-controller-library
112+
namespace: openshift-update-status-controller
113+
annotations:
114+
kubernetes.io/description: Grant the USC permissions to operate resource needed by shared controller code from openshift/library-go
115+
include.release.openshift.io/self-managed-high-availability: "true"
116+
release.openshift.io/feature-set: DevPreviewNoUpgrade
117+
subjects:
118+
- kind: ServiceAccount
119+
name: update-status-controller
120+
namespace: openshift-update-status-controller
121+
roleRef:
122+
kind: Role
123+
name: update-status-controller-library
124+
apiGroup: rbac.authorization.k8s.io
125+
---
126+
apiVersion: rbac.authorization.k8s.io/v1
127+
kind: ClusterRoleBinding
128+
metadata:
129+
name: update-status-controller-library
130+
annotations:
131+
kubernetes.io/description: Grant the USC permissions to operate cluster resources needed by shared controller code from openshift/library-go
132+
include.release.openshift.io/self-managed-high-availability: "true"
133+
release.openshift.io/feature-set: DevPreviewNoUpgrade
134+
roleRef:
135+
apiGroup: rbac.authorization.k8s.io
136+
kind: ClusterRole
137+
name: update-status-controller-library
138+
subjects:
139+
- kind: ServiceAccount
140+
name: update-status-controller
141+
namespace: openshift-update-status-controller
142+
---
143+
apiVersion: rbac.authorization.k8s.io/v1
144+
kind: RoleBinding
145+
metadata:
146+
name: update-status-controller-updatestatus-api-manager
147+
namespace: openshift-update-status-controller
148+
annotations:
149+
kubernetes.io/description: Grant the update status controller permission to manage the ConfigMap that serves as UpdateStatus API
150+
include.release.openshift.io/self-managed-high-availability: "true"
151+
release.openshift.io/feature-set: DevPreviewNoUpgrade
152+
subjects:
153+
- kind: ServiceAccount
154+
name: update-status-controller
155+
namespace: openshift-update-status-controller
156+
roleRef:
157+
kind: Role
158+
name: update-status-controller
159+
apiGroup: rbac.authorization.k8s.io
160+
---
161+
apiVersion: rbac.authorization.k8s.io/v1
162+
kind: ClusterRoleBinding
163+
metadata:
164+
name: update-status-controller-control-plane-informer
165+
annotations:
166+
kubernetes.io/description: Grant the update status controller permission to read cluster resources (temporary, until we have UpdateInformer producers)
167+
include.release.openshift.io/self-managed-high-availability: "true"
168+
release.openshift.io/feature-set: DevPreviewNoUpgrade
169+
subjects:
170+
- kind: ServiceAccount
171+
name: update-status-controller
172+
namespace: openshift-update-status-controller
173+
roleRef:
174+
kind: ClusterRole
175+
name: update-status-controller-control-plane-informer
176+
apiGroup: rbac.authorization.k8s.io

‎install/0000_00_update-status-controller_03_deployment-DevPreviewNoUpgrade.yaml

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: update-status-controller
5+
namespace: openshift-update-status-controller
6+
annotations:
7+
kubernetes.io/description: The update status controller manages OpenShift UpdateStatus API from insights collected from cluster components.
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
release.openshift.io/feature-set: DevPreviewNoUpgrade
10+
spec:
11+
selector:
12+
matchLabels:
13+
k8s-app: update-status-controller
14+
strategy:
15+
type: Recreate
16+
template:
17+
metadata:
18+
name: update-status-controller
19+
annotations:
20+
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
21+
openshift.io/required-scc: restricted-v2
22+
labels:
23+
k8s-app: update-status-controller
24+
spec:
25+
securityContext:
26+
runAsNonRoot: true
27+
containers:
28+
- name: update-status-controller
29+
image: {{.ReleaseImage}}
30+
imagePullPolicy: IfNotPresent
31+
args:
32+
- "update-status-controller"
33+
- -v=5 # High while in DevPreview, lower for GA
34+
securityContext:
35+
capabilities:
36+
drop:
37+
- ALL
38+
allowPrivilegeEscalation: false
39+
resources:
40+
requests:
41+
cpu: 20m
42+
memory: 50Mi
43+
terminationMessagePolicy: FallbackToLogsOnError
44+
nodeSelector:
45+
node-role.kubernetes.io/master: ""
46+
priorityClassName: "openshift-user-critical"
47+
serviceAccountName: update-status-controller
48+
terminationGracePeriodSeconds: 130
49+
tolerations:
50+
- key: "node-role.kubernetes.io/master"
51+
operator: Exists
52+
effect: "NoSchedule"

0 commit comments

Comments
 (0)