Skip to content

Commit cbdaed5

Browse files
petr-mullerpetr-muller
committed
OTA-1269: Add DevPreviewNoUpgrade-gated manifests
- Namespace - ServiceAccount - Role that allows read, watch & update ConfigMaps (+binding) - ClusterRole that allows read & watch ConfigVersions (+rolebinding) - Deployment Squashed review commits: USC: Do not tolerate taints The original Deployment was copied from CVO which contained a bunch of strong tolerations. It does not seem USC needs to be this robust against node conditions and can be easily evicted if necessary. https://github.com/openshift/enhancements/blob/master/CONVENTIONS.md#taints-and-tolerations USC: Use `openshift-user-critical` priority class The original USC deployment was copied from CVO which is obviously very important component and should be protected from OOM kills and preemption but USC does not seem to need it. https://github.com/openshift/enhancements/blob/master/CONVENTIONS.md#priority-classes > If it is fine for your operator/operand to be preempted by user-workload and OOMKilled use openshift-user-critical priority class
1 parent b6b7345 commit cbdaed5

4 files changed

+251
-0
lines changed

‎install/0000_00_update-status-controller_00_namespace-DevPreviewNoUpgrade.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: openshift-update-status-controller
5+
annotations:
6+
kubernetes.io/description: The update status controller manages OpenShift UpdateStatus API from insights collected from cluster components.
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
openshift.io/node-selector: ""
9+
workload.openshift.io/allowed: "management"
10+
release.openshift.io/feature-set: DevPreviewNoUpgrade
11+
labels:
12+
name: openshift-update-status-controller
13+
openshift.io/run-level: "" # specify no run-level turns it off on install and upgrades
14+
openshift.io/cluster-monitoring: "true"

‎install/0000_00_update-status-controller_01_serviceaccount-DevPreviewNoUpgrade.yaml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
annotations:
5+
kubernetes.io/description: SA used by the Update Status Controller.
6+
include.release.openshift.io/self-managed-high-availability: "true"
7+
release.openshift.io/feature-set: DevPreviewNoUpgrade
8+
name: update-status-controller
9+
namespace: openshift-update-status-controller

‎install/0000_00_update-status-controller_02_rbac-DevPreviewNoUpgrade.yaml

+176
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: Role
3+
metadata:
4+
name: update-status-controller-library
5+
namespace: openshift-update-status-controller
6+
annotations:
7+
# TODO(USC: TechPreview): Investigate if we really need all this, maybe we can make o/library-go
8+
# functionality optional?
9+
# https://github.com/openshift/cluster-version-operator/pull/1091#discussion_r1810586011
10+
kubernetes.io/description: Role that allows the USC binary to operate local resources needed by shared controller code from openshift/library-go
11+
include.release.openshift.io/self-managed-high-availability: "true"
12+
release.openshift.io/feature-set: DevPreviewNoUpgrade
13+
rules:
14+
- apiGroups:
15+
- ""
16+
resources:
17+
- pods
18+
verbs:
19+
- list
20+
- apiGroups:
21+
- ""
22+
resources:
23+
- events
24+
verbs:
25+
- create
26+
- apiGroups:
27+
- apps
28+
resources:
29+
- replicasets
30+
verbs:
31+
- get
32+
- apiGroups:
33+
- coordination.k8s.io
34+
resources:
35+
- leases
36+
verbs:
37+
- get
38+
- create
39+
- update
40+
---
41+
apiVersion: rbac.authorization.k8s.io/v1
42+
kind: ClusterRole
43+
metadata:
44+
name: update-status-controller-library
45+
annotations:
46+
# TODO(USC: TechPreview): Investigate if we really need all this, maybe we can make o/library-go
47+
# functionality optional?
48+
# https://github.com/openshift/cluster-version-operator/pull/1091#discussion_r1810586011
49+
kubernetes.io/description: Role that allows the USC binary to operate cluster resources needed by shared controller code from openshift/library-go
50+
include.release.openshift.io/self-managed-high-availability: "true"
51+
release.openshift.io/feature-set: DevPreviewNoUpgrade
52+
rules:
53+
- apiGroups:
54+
- config.openshift.io
55+
resources:
56+
- infrastructures
57+
resourceNames:
58+
- cluster
59+
verbs:
60+
- get
61+
---
62+
apiVersion: rbac.authorization.k8s.io/v1
63+
kind: Role
64+
metadata:
65+
name: update-status-controller
66+
namespace: openshift-update-status-controller
67+
annotations:
68+
kubernetes.io/description: Grant the update status controller permission to read and observe ConfigMaps, and modify the ConfigMap that serves as UpdateStatus API
69+
include.release.openshift.io/self-managed-high-availability: "true"
70+
release.openshift.io/feature-set: DevPreviewNoUpgrade
71+
rules:
72+
- apiGroups:
73+
- ""
74+
resources:
75+
- configmaps
76+
verbs:
77+
- get
78+
- list
79+
- watch
80+
- apiGroups:
81+
- ""
82+
resources:
83+
- configmaps
84+
resourceNames:
85+
- status-api-cm-prototype
86+
verbs:
87+
- patch
88+
- update
89+
---
90+
apiVersion: rbac.authorization.k8s.io/v1
91+
kind: ClusterRole
92+
metadata:
93+
name: update-status-controller-control-plane-informer
94+
annotations:
95+
kubernetes.io/description: Role that allows the update status controller to watch and read control plane resources
96+
include.release.openshift.io/self-managed-high-availability: "true"
97+
release.openshift.io/feature-set: DevPreviewNoUpgrade
98+
rules:
99+
- apiGroups:
100+
- config.openshift.io
101+
resources:
102+
- clusterversions
103+
verbs:
104+
- get
105+
- list
106+
- watch
107+
---
108+
apiVersion: rbac.authorization.k8s.io/v1
109+
kind: RoleBinding
110+
metadata:
111+
name: update-status-controller-library
112+
namespace: openshift-update-status-controller
113+
annotations:
114+
kubernetes.io/description: Grant the USC permissions to operate resource needed by shared controller code from openshift/library-go
115+
include.release.openshift.io/self-managed-high-availability: "true"
116+
release.openshift.io/feature-set: DevPreviewNoUpgrade
117+
subjects:
118+
- kind: ServiceAccount
119+
name: update-status-controller
120+
namespace: openshift-update-status-controller
121+
roleRef:
122+
kind: Role
123+
name: update-status-controller-library
124+
apiGroup: rbac.authorization.k8s.io
125+
---
126+
apiVersion: rbac.authorization.k8s.io/v1
127+
kind: ClusterRoleBinding
128+
metadata:
129+
name: update-status-controller-library
130+
annotations:
131+
kubernetes.io/description: Grant the USC permissions to operate cluster resources needed by shared controller code from openshift/library-go
132+
include.release.openshift.io/self-managed-high-availability: "true"
133+
release.openshift.io/feature-set: DevPreviewNoUpgrade
134+
roleRef:
135+
apiGroup: rbac.authorization.k8s.io
136+
kind: ClusterRole
137+
name: update-status-controller-library
138+
subjects:
139+
- kind: ServiceAccount
140+
name: update-status-controller
141+
namespace: openshift-update-status-controller
142+
---
143+
apiVersion: rbac.authorization.k8s.io/v1
144+
kind: RoleBinding
145+
metadata:
146+
name: update-status-controller-updatestatus-api-manager
147+
namespace: openshift-update-status-controller
148+
annotations:
149+
kubernetes.io/description: Grant the update status controller permission to manage the ConfigMap that serves as UpdateStatus API
150+
include.release.openshift.io/self-managed-high-availability: "true"
151+
release.openshift.io/feature-set: DevPreviewNoUpgrade
152+
subjects:
153+
- kind: ServiceAccount
154+
name: update-status-controller
155+
namespace: openshift-update-status-controller
156+
roleRef:
157+
kind: Role
158+
name: update-status-controller
159+
apiGroup: rbac.authorization.k8s.io
160+
---
161+
apiVersion: rbac.authorization.k8s.io/v1
162+
kind: ClusterRoleBinding
163+
metadata:
164+
name: update-status-controller-control-plane-informer
165+
annotations:
166+
kubernetes.io/description: Grant the update status controller permission to read cluster resources (temporary, until we have UpdateInformer producers)
167+
include.release.openshift.io/self-managed-high-availability: "true"
168+
release.openshift.io/feature-set: DevPreviewNoUpgrade
169+
subjects:
170+
- kind: ServiceAccount
171+
name: update-status-controller
172+
namespace: openshift-update-status-controller
173+
roleRef:
174+
kind: ClusterRole
175+
name: update-status-controller-control-plane-informer
176+
apiGroup: rbac.authorization.k8s.io

‎install/0000_00_update-status-controller_03_deployment-DevPreviewNoUpgrade.yaml

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: update-status-controller
5+
namespace: openshift-update-status-controller
6+
annotations:
7+
kubernetes.io/description: The update status controller manages OpenShift UpdateStatus API from insights collected from cluster components.
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
release.openshift.io/feature-set: DevPreviewNoUpgrade
10+
spec:
11+
selector:
12+
matchLabels:
13+
k8s-app: update-status-controller
14+
strategy:
15+
type: Recreate
16+
template:
17+
metadata:
18+
name: update-status-controller
19+
annotations:
20+
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
21+
openshift.io/required-scc: restricted-v2
22+
labels:
23+
k8s-app: update-status-controller
24+
spec:
25+
securityContext:
26+
runAsNonRoot: true
27+
containers:
28+
- name: update-status-controller
29+
image: {{.ReleaseImage}}
30+
imagePullPolicy: IfNotPresent
31+
args:
32+
- "update-status-controller"
33+
- -v=5 # High while in DevPreview, lower for GA
34+
securityContext:
35+
capabilities:
36+
drop:
37+
- ALL
38+
allowPrivilegeEscalation: false
39+
resources:
40+
requests:
41+
cpu: 20m
42+
memory: 50Mi
43+
terminationMessagePolicy: FallbackToLogsOnError
44+
nodeSelector:
45+
node-role.kubernetes.io/master: ""
46+
priorityClassName: "openshift-user-critical"
47+
serviceAccountName: update-status-controller
48+
terminationGracePeriodSeconds: 130
49+
tolerations:
50+
- key: "node-role.kubernetes.io/master"
51+
operator: Exists
52+
effect: "NoSchedule"

0 commit comments

Comments
 (0)