Add release-scoped RBAC and an overridable image tag

Makefile

@@ -114,7 +114,7 @@ check: FORCE static-check build/cover.html build-all
 
 generate: install-controller-gen
 	@printf "\e[1;36m>> controller-gen\e[0m\n"
-	@controller-gen crd:allowDangerousTypes=true rbac:roleName=hypervisor-operator-manager-role webhook paths="./..." output:crd:artifacts:config=charts/openstack-hypervisor-operator/crds output:rbac:artifacts:config=charts/openstack-hypervisor-operator/templates
+	@controller-gen crd:allowDangerousTypes=true rbac:roleName='"{{ include \"openstack-hypervisor-operator.fullname\" . }}-manager-role"' webhook paths="./..." output:crd:artifacts:config=charts/openstack-hypervisor-operator/crds output:rbac:artifacts:config=charts/openstack-hypervisor-operator/templates
 	@controller-gen object:headerFile="hack/boilerplate.go.txt",year=$(YEAR) paths="./..."
 	@controller-gen applyconfiguration paths="./..."
 

Makefile.maker.yaml

@@ -9,7 +9,9 @@ controllerGen:
   enabled: true
   crdOutputPath: charts/openstack-hypervisor-operator/crds
   objectHeaderFile: hack/boilerplate.go.txt
-  rbacRoleName: hypervisor-operator-manager-role
+  # Release-scoped ClusterRole name (Helm template): multiple instances of
+  # this operator must not share RBAC objects in the same cluster.
+  rbacRoleName: '{{ include "openstack-hypervisor-operator.fullname" . }}-manager-role'
   rbacOutputPath: charts/openstack-hypervisor-operator/templates
   allowDangerousTypes: true
 

charts/openstack-hypervisor-operator/crds/kvm.cloud.sap_evictions.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: evictions.kvm.cloud.sap
 spec:
   group: kvm.cloud.sap

charts/openstack-hypervisor-operator/crds/kvm.cloud.sap_hypervisors.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.22.0
+    controller-gen.kubebuilder.io/version: v0.23.0
   name: hypervisors.kvm.cloud.sap
 spec:
   group: kvm.cloud.sap

charts/openstack-hypervisor-operator/templates/deployment.yaml

@@ -58,7 +58,7 @@ spec:
             resourceFieldRef:
               resource: limits.memory
               divisor: "1"
-        image: {{ .Values.controllerManager.manager.image.repository }}:{{ .Chart.AppVersion }}
+        image: {{ .Values.controllerManager.manager.image.repository }}:{{ .Values.controllerManager.manager.image.tag | default .Chart.AppVersion }}
         livenessProbe:
           httpGet:
             path: /healthz

charts/openstack-hypervisor-operator/templates/manager-clusterrolebinding.yaml

@@ -7,7 +7,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: hypervisor-operator-manager-role
+  name: {{ include "openstack-hypervisor-operator.fullname" . }}-manager-role
 subjects:
 - kind: ServiceAccount
   name: '{{ include "openstack-hypervisor-operator.serviceAccountName" . }}'

charts/openstack-hypervisor-operator/templates/role.yaml

@@ -2,7 +2,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: hypervisor-operator-manager-role
+  name: '{{ include "openstack-hypervisor-operator.fullname" . }}-manager-role'
 rules:
 - apiGroups:
   - ""

charts/openstack-hypervisor-operator/values.yaml

@@ -34,6 +34,8 @@ controllerManager:
       osUsername: ""
     image:
       repository: ghcr.io/cobaltcore-dev/openstack-hypervisor-operator
+      # Defaults to Chart.AppVersion.
+      tag: null
     resources:
       limits:
         cpu: 500m