diff --git a/clusters/app.ci/crt/admin_generated_rbac.yaml b/clusters/app.ci/crt/admin_generated_rbac.yaml index 88fac9b76e7b0..88b238e23310f 100644 --- a/clusters/app.ci/crt/admin_generated_rbac.yaml +++ b/clusters/app.ci/crt/admin_generated_rbac.yaml @@ -478,3 +478,75 @@ subjects: - apiGroup: rbac.authorization.k8s.io kind: Group name: openshift-release-payload-modifiers +--- +#--------------------------------------------------------------------------------- +# rbac_resources.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: openshift-release-admins-binding + namespace: origin +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: openshift-release-admins +subjects: +- apiGroup: rbac.authorization.k8s.io + kind: Group + name: openshift-release-admins +--- +#--------------------------------------------------------------------------------- +# rbac_resources.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: openshift-release-payload-modifiers-binding + namespace: origin +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: openshift-release-payload-modifiers +subjects: +- apiGroup: rbac.authorization.k8s.io + kind: Group + name: openshift-release-payload-modifiers +--- +#--------------------------------------------------------------------------------- +# rbac_resources.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: openshift-release-admins-binding + namespace: origin-arm64 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: openshift-release-admins +subjects: +- apiGroup: rbac.authorization.k8s.io + kind: Group + name: openshift-release-admins +--- +#--------------------------------------------------------------------------------- +# rbac_resources.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: openshift-release-payload-modifiers-binding + namespace: origin-arm64 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: openshift-release-payload-modifiers +subjects: +- apiGroup: rbac.authorization.k8s.io + kind: Group + name: openshift-release-payload-modifiers diff --git a/clusters/app.ci/release-controller/admin-ocp-arm64-priv-rbac.yaml b/clusters/app.ci/release-controller/admin-ocp-arm64-priv-rbac.yaml index 33b7e8d02732f..a9b5a5678518a 100644 --- a/clusters/app.ci/release-controller/admin-ocp-arm64-priv-rbac.yaml +++ b/clusters/app.ci/release-controller/admin-ocp-arm64-priv-rbac.yaml @@ -63,7 +63,7 @@ metadata: namespace: ci-release-arm64-priv rules: - apiGroups: - - batch/v1 + - batch resources: - jobs verbs: diff --git a/clusters/app.ci/release-controller/admin-ocp-arm64-rbac.yaml b/clusters/app.ci/release-controller/admin-ocp-arm64-rbac.yaml index 5771e28d26f8b..b37ae87db68a0 100644 --- a/clusters/app.ci/release-controller/admin-ocp-arm64-rbac.yaml +++ b/clusters/app.ci/release-controller/admin-ocp-arm64-rbac.yaml @@ -63,7 +63,7 @@ metadata: namespace: ci-release-arm64 rules: - apiGroups: - - batch/v1 + - batch resources: - jobs verbs: diff --git a/clusters/app.ci/release-controller/admin-ocp-multi-priv-rbac.yaml b/clusters/app.ci/release-controller/admin-ocp-multi-priv-rbac.yaml index 249427332502f..c9236830a6a94 100644 --- a/clusters/app.ci/release-controller/admin-ocp-multi-priv-rbac.yaml +++ b/clusters/app.ci/release-controller/admin-ocp-multi-priv-rbac.yaml @@ -63,7 +63,7 @@ metadata: namespace: ci-release-multi-priv rules: - apiGroups: - - batch/v1 + - batch resources: - jobs verbs: diff --git a/clusters/app.ci/release-controller/admin-ocp-multi-rbac.yaml b/clusters/app.ci/release-controller/admin-ocp-multi-rbac.yaml index 6f0d1e02a7b68..6ec0aaf8ad3b7 100644 --- a/clusters/app.ci/release-controller/admin-ocp-multi-rbac.yaml +++ b/clusters/app.ci/release-controller/admin-ocp-multi-rbac.yaml @@ -63,7 +63,7 @@ metadata: namespace: ci-release-multi rules: - apiGroups: - - batch/v1 + - batch resources: - jobs verbs: diff --git a/clusters/app.ci/release-controller/admin-ocp-ppc64le-priv-rbac.yaml b/clusters/app.ci/release-controller/admin-ocp-ppc64le-priv-rbac.yaml index ed1a0a8f085fd..e5cac79b0a014 100644 --- a/clusters/app.ci/release-controller/admin-ocp-ppc64le-priv-rbac.yaml +++ b/clusters/app.ci/release-controller/admin-ocp-ppc64le-priv-rbac.yaml @@ -63,7 +63,7 @@ metadata: namespace: ci-release-ppc64le-priv rules: - apiGroups: - - batch/v1 + - batch resources: - jobs verbs: diff --git a/clusters/app.ci/release-controller/admin-ocp-ppc64le-rbac.yaml b/clusters/app.ci/release-controller/admin-ocp-ppc64le-rbac.yaml index 8f1cf289edfc5..50df8aede85e8 100644 --- a/clusters/app.ci/release-controller/admin-ocp-ppc64le-rbac.yaml +++ b/clusters/app.ci/release-controller/admin-ocp-ppc64le-rbac.yaml @@ -63,7 +63,7 @@ metadata: namespace: ci-release-ppc64le rules: - apiGroups: - - batch/v1 + - batch resources: - jobs verbs: diff --git a/clusters/app.ci/release-controller/admin-ocp-priv-rbac.yaml b/clusters/app.ci/release-controller/admin-ocp-priv-rbac.yaml index dcbb8ae429632..95d3661931125 100644 --- a/clusters/app.ci/release-controller/admin-ocp-priv-rbac.yaml +++ b/clusters/app.ci/release-controller/admin-ocp-priv-rbac.yaml @@ -63,7 +63,7 @@ metadata: namespace: ci-release-priv rules: - apiGroups: - - batch/v1 + - batch resources: - jobs verbs: diff --git a/clusters/app.ci/release-controller/admin-ocp-rbac.yaml b/clusters/app.ci/release-controller/admin-ocp-rbac.yaml index 1dede5b9db2b7..2314c589293ec 100644 --- a/clusters/app.ci/release-controller/admin-ocp-rbac.yaml +++ b/clusters/app.ci/release-controller/admin-ocp-rbac.yaml @@ -63,7 +63,7 @@ metadata: namespace: ci-release rules: - apiGroups: - - batch/v1 + - batch resources: - jobs verbs: diff --git a/clusters/app.ci/release-controller/admin-ocp-s390x-priv-rbac.yaml b/clusters/app.ci/release-controller/admin-ocp-s390x-priv-rbac.yaml index e16e787cfdc7a..0d33f0bfeee71 100644 --- a/clusters/app.ci/release-controller/admin-ocp-s390x-priv-rbac.yaml +++ b/clusters/app.ci/release-controller/admin-ocp-s390x-priv-rbac.yaml @@ -63,7 +63,7 @@ metadata: namespace: ci-release-s390x-priv rules: - apiGroups: - - batch/v1 + - batch resources: - jobs verbs: diff --git a/clusters/app.ci/release-controller/admin-ocp-s390x-rbac.yaml b/clusters/app.ci/release-controller/admin-ocp-s390x-rbac.yaml index 855609e87e443..ac15a60abf824 100644 --- a/clusters/app.ci/release-controller/admin-ocp-s390x-rbac.yaml +++ b/clusters/app.ci/release-controller/admin-ocp-s390x-rbac.yaml @@ -63,7 +63,7 @@ metadata: namespace: ci-release-s390x rules: - apiGroups: - - batch/v1 + - batch resources: - jobs verbs: diff --git a/clusters/app.ci/release-controller/admin-origin-arm64-rbac.yaml b/clusters/app.ci/release-controller/admin-origin-arm64-rbac.yaml new file mode 100644 index 0000000000000..33a28f8428571 --- /dev/null +++ b/clusters/app.ci/release-controller/admin-origin-arm64-rbac.yaml @@ -0,0 +1,113 @@ +################################################################################## +# DO NOT EDIT +# File generated during execution of: generate-release-controllers.py +################################################################################## + + +#--------------------------------------------------------------------------------- +# development_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: release-controller-developers-read-only + namespace: origin-arm64 +rules: +- apiGroups: + - '' + resourceNames: + - release-upgrade-graph + resources: + - secrets + verbs: + - get + - list + - watch +- apiGroups: + - image.openshift.io + resources: + - imagestreams + - imagestreamtags + verbs: + - get + - list + - watch +--- +#--------------------------------------------------------------------------------- +# development_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: release-controller-developers-read-only-binding + namespace: origin-arm64 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: release-controller-developers-read-only +subjects: +- apiGroup: rbac.authorization.k8s.io + kind: Group + name: openshift-release-controller-developers +--- +#--------------------------------------------------------------------------------- +# development_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: release-controller-developers-monitoring + namespace: ci-release-arm64 +rules: +- apiGroups: + - batch + resources: + - jobs + verbs: + - get + - list + - watch +- apiGroups: + - '' + resources: + - pods/attach + - pods/exec + verbs: + - create +- apiGroups: + - '' + resources: + - pods + verbs: + - get + - list + - watch +- apiGroups: + - '' + resources: + - namespaces + verbs: + - get + - list + - watch +--- +#--------------------------------------------------------------------------------- +# development_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: release-controller-developers-monitoring-binding + namespace: ci-release-arm64 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: release-controller-developers-monitoring +subjects: +- apiGroup: rbac.authorization.k8s.io + kind: Group + name: openshift-release-controller-developers diff --git a/clusters/app.ci/release-controller/admin-origin-rbac.yaml b/clusters/app.ci/release-controller/admin-origin-rbac.yaml index 43c4be4f79dba..75dae0df90923 100644 --- a/clusters/app.ci/release-controller/admin-origin-rbac.yaml +++ b/clusters/app.ci/release-controller/admin-origin-rbac.yaml @@ -96,3 +96,63 @@ subjects: - apiGroup: rbac.authorization.k8s.io kind: Group name: openshift-release-controller-developers +--- +#--------------------------------------------------------------------------------- +# development_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: release-controller-developers-monitoring + namespace: ci-release +rules: +- apiGroups: + - batch + resources: + - jobs + verbs: + - get + - list + - watch +- apiGroups: + - '' + resources: + - pods/attach + - pods/exec + verbs: + - create +- apiGroups: + - '' + resources: + - pods + verbs: + - get + - list + - watch +- apiGroups: + - '' + resources: + - namespaces + verbs: + - get + - list + - watch +--- +#--------------------------------------------------------------------------------- +# development_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: release-controller-developers-monitoring-binding + namespace: ci-release +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: release-controller-developers-monitoring +subjects: +- apiGroup: rbac.authorization.k8s.io + kind: Group + name: openshift-release-controller-developers diff --git a/clusters/app.ci/release-controller/admin_deploy-origin-arm64-controller.yaml b/clusters/app.ci/release-controller/admin_deploy-origin-arm64-controller.yaml new file mode 100644 index 0000000000000..4e76e751e8162 --- /dev/null +++ b/clusters/app.ci/release-controller/admin_deploy-origin-arm64-controller.yaml @@ -0,0 +1,336 @@ +################################################################################## +# DO NOT EDIT +# File generated during execution of: generate-release-controllers.py +################################################################################## + + +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: image-puller + namespace: origin-arm64 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system:image-puller +subjects: +- apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:authenticated +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: user-viewer + namespace: origin-arm64 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: view +subjects: +- apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:authenticated +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: release-controller-modify + namespace: origin-arm64 +rules: +- apiGroups: + - '' + resourceNames: + - release-upgrade-graph + resources: + - secrets + verbs: + - get + - update + - patch +- apiGroups: + - image.openshift.io + resources: + - imagestreams + - imagestreamtags + verbs: + - get + - list + - watch + - create + - delete + - update + - patch +- apiGroups: + - release.openshift.io + resources: + - releasepayloads + verbs: + - get + - list + - watch + - create + - delete + - update + - patch +- apiGroups: + - '' + resources: + - events + verbs: + - create + - patch + - update +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: release-controller-import-okd + namespace: origin-arm64 +rules: +- apiGroups: + - image.openshift.io + resources: + - imagestreamimports + verbs: + - create +- apiGroups: + - image.openshift.io + resources: + - imagestreams + verbs: + - get + - list +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: release-controller-arm64-prowjob + namespace: ci +rules: +- apiGroups: + - prow.k8s.io + resources: + - prowjobs + verbs: + - get + - list + - watch + - create + - delete + - update + - patch +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: release-controller-binding-okd + namespace: origin-arm64 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: release-controller-modify +subjects: +- kind: ServiceAccount + name: release-controller-okd-arm64 + namespace: ci +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: release-controller-binding-view + namespace: origin-arm64 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: view +subjects: +- kind: ServiceAccount + name: release-controller-okd-arm64 + namespace: ci +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: release-controller-binding-prowjob-origin-arm64 + namespace: ci +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: release-controller-arm64-prowjob +subjects: +- kind: ServiceAccount + name: release-controller-okd-arm64 + namespace: ci +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: v1 +kind: Namespace +metadata: + name: ci-release-arm64 +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: release-controller-binding-okd + namespace: ci-release-arm64 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: edit +subjects: +- kind: ServiceAccount + name: release-controller-okd-arm64 + namespace: ci +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: release-controller-binding-promote + namespace: origin-arm64 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system:image-builder +subjects: +- kind: ServiceAccount + name: builder + namespace: ci-release-arm64 +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: release-controller-binding-import + namespace: origin-arm64 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: release-controller-import-okd +subjects: +- kind: ServiceAccount + name: builder + namespace: ci-release-arm64 +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: v1 +kind: Secret +metadata: + name: release-upgrade-graph + namespace: origin-arm64 +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: v1 +kind: ServiceAccount +metadata: + annotations: {} + name: release-controller-okd-arm64 + namespace: ci +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: release-controller-okd-arm64 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: release-controller +subjects: +- kind: ServiceAccount + name: release-controller-okd-arm64 + namespace: ci +--- +#--------------------------------------------------------------------------------- +# release_payload_modifier_resources.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: release-payload-modify + namespace: origin-arm64 +rules: +- apiGroups: + - release.openshift.io + resources: + - releasepayloads + verbs: + - get + - list + - watch + - update + - patch +--- +#--------------------------------------------------------------------------------- +# release_payload_modifier_resources.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: release-payload-modify-binding + namespace: origin-arm64 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: release-payload-modify +subjects: +- kind: ServiceAccount + name: release-payload-modifier + namespace: ci diff --git a/clusters/app.ci/release-controller/admin_deploy-origin-controller.yaml b/clusters/app.ci/release-controller/admin_deploy-origin-controller.yaml index 610f1b47a49dd..e93a734978696 100644 --- a/clusters/app.ci/release-controller/admin_deploy-origin-controller.yaml +++ b/clusters/app.ci/release-controller/admin_deploy-origin-controller.yaml @@ -5,7 +5,43 @@ #--------------------------------------------------------------------------------- -# origin_resources.py added the following resource +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: image-puller + namespace: origin +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system:image-puller +subjects: +- apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:authenticated +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: user-viewer + namespace: origin +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: view +subjects: +- apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:authenticated +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource #--------------------------------------------------------------------------------- apiVersion: rbac.authorization.k8s.io/v1 @@ -59,13 +95,60 @@ rules: - update --- #--------------------------------------------------------------------------------- -# origin_resources.py added the following resource +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: release-controller-import-okd + namespace: origin +rules: +- apiGroups: + - image.openshift.io + resources: + - imagestreamimports + verbs: + - create +- apiGroups: + - image.openshift.io + resources: + - imagestreams + verbs: + - get + - list +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: release-controller-prowjob + namespace: ci +rules: +- apiGroups: + - prow.k8s.io + resources: + - prowjobs + verbs: + - get + - list + - watch + - create + - delete + - update + - patch +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource #--------------------------------------------------------------------------------- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: - name: release-controller-binding + name: release-controller-binding-okd namespace: origin roleRef: apiGroup: rbac.authorization.k8s.io @@ -73,5 +156,181 @@ roleRef: name: release-controller-modify subjects: - kind: ServiceAccount + name: release-controller-okd + namespace: ci +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: release-controller-binding-view + namespace: origin +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: view +subjects: +- kind: ServiceAccount + name: release-controller-okd + namespace: ci +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: release-controller-binding-prowjob-origin + namespace: ci +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: release-controller-prowjob +subjects: +- kind: ServiceAccount + name: release-controller-okd + namespace: ci +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: v1 +kind: Namespace +metadata: + name: ci-release +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: release-controller-binding-okd + namespace: ci-release +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: edit +subjects: +- kind: ServiceAccount + name: release-controller-okd + namespace: ci +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: release-controller-binding-promote + namespace: origin +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system:image-builder +subjects: +- kind: ServiceAccount + name: builder + namespace: ci-release +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: release-controller-binding-import + namespace: origin +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: release-controller-import-okd +subjects: +- kind: ServiceAccount + name: builder + namespace: ci-release +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: v1 +kind: Secret +metadata: + name: release-upgrade-graph + namespace: origin +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: v1 +kind: ServiceAccount +metadata: + annotations: {} + name: release-controller-okd + namespace: ci +--- +#--------------------------------------------------------------------------------- +# art_namespaces_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: release-controller-okd +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole name: release-controller +subjects: +- kind: ServiceAccount + name: release-controller-okd + namespace: ci +--- +#--------------------------------------------------------------------------------- +# release_payload_modifier_resources.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: release-payload-modify + namespace: origin +rules: +- apiGroups: + - release.openshift.io + resources: + - releasepayloads + verbs: + - get + - list + - watch + - update + - patch +--- +#--------------------------------------------------------------------------------- +# release_payload_modifier_resources.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: release-payload-modify-binding + namespace: origin +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: release-payload-modify +subjects: +- kind: ServiceAccount + name: release-payload-modifier namespace: ci diff --git a/clusters/app.ci/release-controller/deploy-origin-arm64-controller.yaml b/clusters/app.ci/release-controller/deploy-origin-arm64-controller.yaml new file mode 100644 index 0000000000000..07319b0b9b514 --- /dev/null +++ b/clusters/app.ci/release-controller/deploy-origin-arm64-controller.yaml @@ -0,0 +1,307 @@ +################################################################################## +# DO NOT EDIT +# File generated during execution of: generate-release-controllers.py +################################################################################## + + +#--------------------------------------------------------------------------------- +# origin_resources.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: route.openshift.io/v1 +kind: Route +metadata: + name: release-controller-okd-arm64 + namespace: ci +spec: + host: origin-release-arm64.apps.ci.l2s4.p1.openshiftapps.com + tls: + insecureEdgeTerminationPolicy: Redirect + termination: edge + to: + kind: Service + name: release-controller-api-okd-arm64 +--- +#--------------------------------------------------------------------------------- +# origin_resources.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: v1 +kind: Service +metadata: + name: release-controller-okd-arm64 + namespace: ci +spec: + ports: + - port: 80 + targetPort: 8080 + selector: + app: release-controller-okd-arm64 +--- +#--------------------------------------------------------------------------------- +# origin_resources.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: v1 +kind: Service +metadata: + name: release-controller-api-okd-arm64 + namespace: ci +spec: + ports: + - port: 80 + targetPort: 8080 + selector: + app: release-controller-api-okd-arm64 +--- +#--------------------------------------------------------------------------------- +# origin_resources.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + keel.sh/matchTag: 'true' + keel.sh/policy: force + keel.sh/pollSchedule: '@every 5m' + keel.sh/trigger: poll + name: release-controller-okd-arm64 + namespace: ci +spec: + replicas: 1 + selector: + matchLabels: + app: release-controller-okd-arm64 + template: + metadata: + labels: + app: release-controller-okd-arm64 + spec: + containers: + - args: + - --repo=https://github.com/openshift/release.git + - --ref=main + - --period=30s + - --root=/tmp/git-sync + - --max-failures=3 + command: + - /git-sync + env: + - name: GIT_SYNC_DEST + value: release + image: quay-proxy.ci.openshift.org/openshift/ci:ci_git-sync_v4.3.0 + name: git-sync + resources: + requests: + cpu: '0.5' + memory: 1Gi + volumeMounts: + - mountPath: /tmp/git-sync + name: release + - command: + - /usr/bin/release-controller + - --release-namespace=origin-arm64 + - --prow-config=/etc/config/config.yaml + - --supplemental-prow-config-dir=/etc/config + - --job-config=/var/repo/release/ci-operator/jobs + - --prow-namespace=ci + - --job-namespace=ci-release-arm64 + - --tools-image-stream-tag=release-controller-bootstrap:tools + - --release-architecture=arm64 + - -v=4 + - --manifest-list-mode + image: quay-proxy.ci.openshift.org/openshift/ci:ci_release-controller_latest + imagePullPolicy: Always + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 3 + periodSeconds: 3 + name: controller + readinessProbe: + httpGet: + path: /healthz/ready + port: 8081 + initialDelaySeconds: 10 + periodSeconds: 3 + timeoutSeconds: 600 + volumeMounts: + - mountPath: /etc/config + name: config + readOnly: true + - mountPath: /var/repo + name: release + - mountPath: /etc/github + name: oauth + readOnly: true + - mountPath: /etc/jira + name: jira + readOnly: true + - mountPath: /etc/kubeconfigs + name: release-controller-kubeconfigs + readOnly: true + - mountPath: /tmp/home + name: home + - mountPath: /tmp/git + name: oc-cache + - mountPath: /tmp/home/.git-credentials + name: git-credentials + subPath: .git-credentials + - mountPath: /tmp/pull-secret + name: pull-secret + initContainers: + - args: + - --repo=https://github.com/openshift/release.git + - --ref=main + - --root=/tmp/git-sync + - --one-time=true + - --depth=1 + command: + - /git-sync + env: + - name: GIT_SYNC_DEST + value: release + image: quay-proxy.ci.openshift.org/openshift/ci:ci_git-sync_v4.3.0 + name: git-sync-init + volumeMounts: + - mountPath: /tmp/git-sync + name: release + serviceAccountName: release-controller-okd-arm64 + volumes: + - configMap: + defaultMode: 420 + name: config + name: config + - emptyDir: {} + name: release + - name: oauth + secret: + defaultMode: 420 + secretName: github-credentials-openshift-merge-robot + - name: jira + secret: + defaultMode: 420 + secretName: jira-credentials-openshift-jira-robot + - name: release-controller-kubeconfigs + secret: + defaultMode: 420 + secretName: release-controller-kubeconfigs + - emptyDir: {} + name: home + - emptyDir: {} + name: oc-cache + - name: git-credentials + secret: + defaultMode: 420 + items: + - key: git_url_with_credentials + path: .git-credentials + secretName: release-controller-oc-git-credentials + - name: pull-secret + secret: + defaultMode: 420 + secretName: release-controller-oc-pull-secret +--- +#--------------------------------------------------------------------------------- +# origin_resources.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + keel.sh/matchTag: 'true' + keel.sh/policy: force + keel.sh/pollSchedule: '@every 5m' + keel.sh/trigger: poll + name: release-controller-api-okd-arm64 + namespace: ci +spec: + replicas: 3 + selector: + matchLabels: + app: release-controller-api-okd-arm64 + template: + metadata: + labels: + app: release-controller-api-okd-arm64 + spec: + containers: + - command: + - /usr/bin/release-controller-api + - --release-namespace=origin-arm64 + - --prow-namespace=ci + - --job-namespace=ci-release-arm64 + - --tools-image-stream-tag=release-controller-bootstrap:tools + - --release-architecture=arm64 + - --enable-jira + - --jira-endpoint=https://redhat.atlassian.net + - --jira-username=openshift-release-controller-jira-bot@redhat.com + - --jira-password-file=/etc/jira/bot-password + - --release-qualifiers-config-path=/etc/qualifiers-config/release-qualifiers.yaml + - -v=4 + image: quay-proxy.ci.openshift.org/openshift/ci:ci_release-controller-api_latest + imagePullPolicy: Always + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 3 + periodSeconds: 3 + name: controller + readinessProbe: + httpGet: + path: /healthz/ready + port: 8081 + initialDelaySeconds: 10 + periodSeconds: 3 + timeoutSeconds: 600 + volumeMounts: + - mountPath: /etc/jira + name: jira + readOnly: true + - mountPath: /etc/qualifiers-config + name: qualifiers-config + readOnly: true + - mountPath: /etc/kubeconfigs + name: release-controller-kubeconfigs + readOnly: true + - mountPath: /tmp/home + name: home + - mountPath: /tmp/git + name: oc-cache + - mountPath: /tmp/home/.git-credentials + name: git-credentials + subPath: .git-credentials + - mountPath: /tmp/pull-secret + name: pull-secret + serviceAccountName: release-controller-okd-arm64 + volumes: + - name: jira + secret: + defaultMode: 420 + secretName: jira-credentials-openshift-jira-robot + - configMap: + name: release-controller-release-qualifiers + name: qualifiers-config + - name: release-controller-kubeconfigs + secret: + defaultMode: 420 + secretName: release-controller-kubeconfigs + - emptyDir: {} + name: home + - emptyDir: {} + name: oc-cache + - name: git-credentials + secret: + defaultMode: 420 + items: + - key: git_url_with_credentials + path: .git-credentials + secretName: release-controller-oc-git-credentials + - name: pull-secret + secret: + defaultMode: 420 + secretName: release-controller-oc-pull-secret diff --git a/clusters/app.ci/release-controller/deploy-origin-controller.yaml b/clusters/app.ci/release-controller/deploy-origin-controller.yaml index abd7237aa470d..d7730a028611f 100644 --- a/clusters/app.ci/release-controller/deploy-origin-controller.yaml +++ b/clusters/app.ci/release-controller/deploy-origin-controller.yaml @@ -11,7 +11,7 @@ apiVersion: route.openshift.io/v1 kind: Route metadata: - name: release-controller + name: release-controller-okd namespace: ci spec: host: origin-release.apps.ci.l2s4.p1.openshiftapps.com @@ -20,7 +20,7 @@ spec: termination: edge to: kind: Service - name: release-controller-api + name: release-controller-api-okd --- #--------------------------------------------------------------------------------- # origin_resources.py added the following resource @@ -29,14 +29,14 @@ spec: apiVersion: v1 kind: Service metadata: - name: release-controller + name: release-controller-okd namespace: ci spec: ports: - port: 80 targetPort: 8080 selector: - app: release-controller + app: release-controller-okd --- #--------------------------------------------------------------------------------- # origin_resources.py added the following resource @@ -45,14 +45,14 @@ spec: apiVersion: v1 kind: Service metadata: - name: release-controller-api + name: release-controller-api-okd namespace: ci spec: ports: - port: 80 targetPort: 8080 selector: - app: release-controller-api + app: release-controller-api-okd --- #--------------------------------------------------------------------------------- # origin_resources.py added the following resource @@ -66,17 +66,17 @@ metadata: keel.sh/policy: force keel.sh/pollSchedule: '@every 5m' keel.sh/trigger: poll - name: release-controller + name: release-controller-okd namespace: ci spec: replicas: 1 selector: matchLabels: - app: release-controller + app: release-controller-okd template: metadata: labels: - app: release-controller + app: release-controller-okd spec: containers: - args: @@ -168,7 +168,7 @@ spec: volumeMounts: - mountPath: /tmp/git-sync name: release - serviceAccountName: release-controller + serviceAccountName: release-controller-okd volumes: - configMap: defaultMode: 420 @@ -216,17 +216,17 @@ metadata: keel.sh/policy: force keel.sh/pollSchedule: '@every 5m' keel.sh/trigger: poll - name: release-controller-api + name: release-controller-api-okd namespace: ci spec: replicas: 3 selector: matchLabels: - app: release-controller-api + app: release-controller-api-okd template: metadata: labels: - app: release-controller-api + app: release-controller-api-okd spec: containers: - command: @@ -277,7 +277,7 @@ spec: subPath: .git-credentials - mountPath: /tmp/pull-secret name: pull-secret - serviceAccountName: release-controller + serviceAccountName: release-controller-okd volumes: - name: jira secret: @@ -305,3 +305,59 @@ spec: secret: defaultMode: 420 secretName: release-controller-oc-pull-secret +--- +#--------------------------------------------------------------------------------- +# origin_resources.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + keel.sh/matchTag: 'true' + keel.sh/policy: force + keel.sh/pollSchedule: '@every 5m' + keel.sh/trigger: poll + name: release-controller + namespace: ci +spec: + replicas: 0 + selector: + matchLabels: + app: release-controller + template: + metadata: + labels: + app: release-controller + spec: + containers: + - image: quay-proxy.ci.openshift.org/openshift/ci:ci_release-controller_latest + name: controller +--- +#--------------------------------------------------------------------------------- +# origin_resources.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + keel.sh/matchTag: 'true' + keel.sh/policy: force + keel.sh/pollSchedule: '@every 5m' + keel.sh/trigger: poll + name: release-controller-api + namespace: ci +spec: + replicas: 0 + selector: + matchLabels: + app: release-controller-api + template: + metadata: + labels: + app: release-controller-api + spec: + containers: + - image: quay-proxy.ci.openshift.org/openshift/ci:ci_release-controller-api_latest + name: controller diff --git a/clusters/app.ci/trt/admin_generated_rbac.yaml b/clusters/app.ci/trt/admin_generated_rbac.yaml index 7ba17f8b82237..adbf5d969b48b 100644 --- a/clusters/app.ci/trt/admin_generated_rbac.yaml +++ b/clusters/app.ci/trt/admin_generated_rbac.yaml @@ -188,6 +188,42 @@ subjects: # trt_rbac.py added the following resource #--------------------------------------------------------------------------------- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: trt-admins-binding + namespace: origin +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: trt-admin +subjects: +- apiGroup: rbac.authorization.k8s.io + kind: Group + name: trt-admins +--- +#--------------------------------------------------------------------------------- +# trt_rbac.py added the following resource +#--------------------------------------------------------------------------------- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: trt-admins-binding + namespace: origin-arm64 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: trt-admin +subjects: +- apiGroup: rbac.authorization.k8s.io + kind: Group + name: trt-admins +--- +#--------------------------------------------------------------------------------- +# trt_rbac.py added the following resource +#--------------------------------------------------------------------------------- + apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: diff --git a/hack/generators/release-controllers/config/__init__.py b/hack/generators/release-controllers/config/__init__.py index 6266250ed4dc8..5f64b86f1cd9c 100644 --- a/hack/generators/release-controllers/config/__init__.py +++ b/hack/generators/release-controllers/config/__init__.py @@ -1,9 +1,23 @@ -# pylint: disable=R0902,R0903 +# pylint: disable=R0902,R0903,R0913,R0917 import os import pathlib +class Product: + def __init__(self, name, namespace_prefix, deployment_prefix, hostname_prefix, arches, has_private): + self.name = name + self.namespace_prefix = namespace_prefix + self.deployment_prefix = deployment_prefix + self.hostname_prefix = hostname_prefix + self.arches = arches + self.has_private = has_private + + @property + def privacy_modes(self): + return (False, True) if self.has_private else (False,) + + class RCPaths: def __init__(self, git_clone_dir): self.path_base = pathlib.Path(git_clone_dir) @@ -55,6 +69,10 @@ def __init__(self, git_clone_dir): self.scos_releases = self._get_scos_releases() self.rpc_release_namespace = "ocp" + self.ocp = Product('ocp', 'ocp', 'ocp', 'openshift-release', self.arches, has_private=True) + self.okd = Product('okd', 'origin', 'okd', 'origin-release', ('x86_64', 'arm64'), has_private=False) + self.products = [self.ocp, self.okd] + def _get_releases(self): releases = set() @@ -106,34 +124,34 @@ def get_art_suffix(self, arch, private): class Context: - def __init__(self, config, arch, private): + def __init__(self, config, arch, private, product): self.config = config self.arch = arch self.private = private + self.product = product self.suffix = config.get_suffix(arch, private) self.art_suffix = config.get_art_suffix(arch, private) + + self.is_namespace = f'{product.namespace_prefix}{self.suffix}' self.jobs_namespace = f'ci-release{self.suffix}' - self.rc_hostname = f'openshift-release{self.suffix}' - self.rc_temp_hostname = f'openshift-release{self.suffix}-temp' - self.hostname_artifacts = f'openshift-release-artifacts{self.suffix}' - self.secret_name_tls = f'release-controller{self.suffix}-tls' - self.secret_name_tls_api = f'release-controller-api{self.suffix}-tls' - self.is_namespace = f'ocp{self.suffix}' - self.rc_serviceaccount_name = f'release-controller-{self.is_namespace}' - self.rc_service_name = f'release-controller-{self.is_namespace}' - self.rc_api_service_name = f'release-controller-api-{self.is_namespace}' + rc_name = f'{product.deployment_prefix}{self.suffix}' + self.rc_deployment_name = rc_name + self.rc_serviceaccount_name = f'release-controller-{rc_name}' + self.rc_service_name = f'release-controller-{rc_name}' + self.rc_api_service_name = f'release-controller-api-{rc_name}' self.rc_route_name = self.rc_service_name - # Routes on the api.ci cluster - # files-cache - self.fc_api_url = f'{self.hostname_artifacts}.{self.config.rc_release_domain}' + self.rc_hostname = f'{product.hostname_prefix}{self.suffix}' + self.rc_temp_hostname = f'{product.hostname_prefix}{self.suffix}-temp' + self.hostname_artifacts = f'{product.hostname_prefix}-artifacts{self.suffix}' + + self.secret_name_tls = f'release-controller{self.suffix}-tls' + self.secret_name_tls_api = f'release-controller-api{self.suffix}-tls' - # Routes on the app.ci cluster - # release-controller + self.fc_api_url = f'{self.hostname_artifacts}.{self.config.rc_release_domain}' self.rc_app_url = f'{self.rc_hostname}.{self.config.rc_deployment_domain}' - # files-cache self.fc_app_url = f'{self.hostname_artifacts}.{self.config.rc_deployment_domain}' def get_supported_architecture_name(self): diff --git a/hack/generators/release-controllers/content/__init__.py b/hack/generators/release-controllers/content/__init__.py index 0a3dbade9b632..c14ad54e8a15c 100644 --- a/hack/generators/release-controllers/content/__init__.py +++ b/hack/generators/release-controllers/content/__init__.py @@ -8,7 +8,7 @@ from content.art_rpm_mirroring_services import add_rpm_mirror_service from content.bump_versioned_resources import bump_versioned_resources from content.development_rbac import generate_development_rbac -from content.origin_resources import generate_origin_admin_resources, generate_origin_resources +from content.origin_resources import add_okd_deployments, add_legacy_origin_deployments_scaled_down from content.osd_files_cache_rbac import add_osd_files_cache_service_account_resources from content.osd_files_cache_resources import add_osd_files_cache_resources from content.osd_rc_deployments import add_osd_rc_deployments diff --git a/hack/generators/release-controllers/content/art_namespaces_rbac.py b/hack/generators/release-controllers/content/art_namespaces_rbac.py index 132b57f80400f..c68396f436e80 100644 --- a/hack/generators/release-controllers/content/art_namespaces_rbac.py +++ b/hack/generators/release-controllers/content/art_namespaces_rbac.py @@ -157,8 +157,8 @@ def add_imagestream_namespace_rbac(gendoc): }] }) - if not context.suffix: - # Special permissions for x86_64 public rc + if not context.suffix and context.product.name == 'ocp': + # Special permissions for OCP x86_64 public rc resources.append({ 'apiVersion': 'rbac.authorization.k8s.io/v1', 'kind': 'Role', @@ -208,7 +208,7 @@ def add_imagestream_namespace_rbac(gendoc): 'apiVersion': 'rbac.authorization.k8s.io/v1', 'kind': 'Role', 'metadata': { - 'name': 'release-controller-import-ocp', + 'name': f'release-controller-import-{context.product.deployment_prefix}', 'namespace': context.is_namespace }, 'rules': [{ @@ -246,7 +246,7 @@ def add_imagestream_namespace_rbac(gendoc): 'apiVersion': 'rbac.authorization.k8s.io/v1', 'kind': 'RoleBinding', 'metadata': { - 'name': 'release-controller-binding-ocp', + 'name': f'release-controller-binding-{context.product.deployment_prefix}', 'namespace': context.is_namespace, }, 'roleRef': { @@ -261,8 +261,8 @@ def add_imagestream_namespace_rbac(gendoc): }] }) - if not context.suffix: - # Special permissions just for x86_64 public release controller + if not context.suffix and context.product.name == 'ocp': + # Special permissions just for OCP x86_64 public release controller resources.append({ 'apiVersion': 'rbac.authorization.k8s.io/v1', 'kind': 'RoleBinding', @@ -351,7 +351,7 @@ def add_imagestream_namespace_rbac(gendoc): 'apiVersion': 'rbac.authorization.k8s.io/v1', 'kind': 'RoleBinding', 'metadata': { - 'name': 'release-controller-binding-ocp', + 'name': f'release-controller-binding-{context.product.deployment_prefix}', 'namespace': context.jobs_namespace, }, 'roleRef': { @@ -395,7 +395,7 @@ def add_imagestream_namespace_rbac(gendoc): 'roleRef': { 'apiGroup': 'rbac.authorization.k8s.io', 'kind': 'Role', - 'name': 'release-controller-import-ocp', + 'name': f'release-controller-import-{context.product.deployment_prefix}', }, 'subjects': [{ 'kind': 'ServiceAccount', @@ -431,7 +431,7 @@ def add_imagestream_namespace_rbac(gendoc): 'apiVersion': 'rbac.authorization.k8s.io/v1', 'kind': 'ClusterRoleBinding', 'metadata': { - 'name': f'release-controller-ocp{context.suffix}-oauth' + 'name': f'release-controller-{context.product.deployment_prefix}{context.suffix}-oauth' }, 'roleRef': { 'apiGroup': 'rbac.authorization.k8s.io', @@ -450,7 +450,7 @@ def add_imagestream_namespace_rbac(gendoc): 'apiVersion': 'rbac.authorization.k8s.io/v1', 'kind': 'ClusterRoleBinding', 'metadata': { - 'name': f'release-controller-ocp{context.suffix}', + 'name': f'release-controller-{context.product.deployment_prefix}{context.suffix}', }, 'roleRef': { 'apiGroup': 'rbac.authorization.k8s.io', diff --git a/hack/generators/release-controllers/content/development_rbac.py b/hack/generators/release-controllers/content/development_rbac.py index 66565bd3d640c..80f328bda80db 100644 --- a/hack/generators/release-controllers/content/development_rbac.py +++ b/hack/generators/release-controllers/content/development_rbac.py @@ -82,7 +82,7 @@ def _add_cache_monitoring_rbac(gendoc): }, 'rules': [ { - 'apiGroups': ['batch/v1'], + 'apiGroups': ['batch'], 'resources': ['jobs'], 'verbs': ['get', 'list', 'watch'] }, @@ -128,16 +128,17 @@ def _add_monitoring_rbac(gendoc, namespace): def generate_development_rbac(config): - for private in (False, True): - for arch in config.arches: - context = Context(config, arch, private) + ci_monitoring_generated = False - with genlib.GenDoc(config.paths.path_rc_deployments.joinpath(f'admin-{context.is_namespace}-rbac.yaml'), context) as gendoc: - _add_namespace_read_only_rbac(gendoc, context.is_namespace) - _add_cache_monitoring_rbac(gendoc) + for product in config.products: + for private in product.privacy_modes: + for arch in product.arches: + context = Context(config, arch, private, product) - context = Context(config, "x86_64", False) - with genlib.GenDoc(config.paths.path_rc_deployments.joinpath('admin-origin-rbac.yaml'), context) as gendoc: - _add_deployment_monitoring_role(gendoc) - _add_monitoring_rbac(gendoc, 'ci') - _add_namespace_read_only_rbac(gendoc, 'origin') + with genlib.GenDoc(config.paths.path_rc_deployments.joinpath(f'admin-{context.is_namespace}-rbac.yaml'), context) as gendoc: + if not ci_monitoring_generated and product.name == 'okd': + _add_deployment_monitoring_role(gendoc) + _add_monitoring_rbac(gendoc, 'ci') + ci_monitoring_generated = True + _add_namespace_read_only_rbac(gendoc, context.is_namespace) + _add_cache_monitoring_rbac(gendoc) diff --git a/hack/generators/release-controllers/content/origin_resources.py b/hack/generators/release-controllers/content/origin_resources.py index 59361aee30408..563d1bbace4c2 100644 --- a/hack/generators/release-controllers/content/origin_resources.py +++ b/hack/generators/release-controllers/content/origin_resources.py @@ -1,70 +1,90 @@ from content.utils import get_rc_volumes, get_rc_volume_mounts, get_rcapi_volumes, get_rcapi_volume_mounts -def _add_origin_rbac(gendoc): - gendoc.append_all([{ - 'apiVersion': 'rbac.authorization.k8s.io/v1', - 'kind': 'Role', - 'metadata': { - 'name': 'release-controller-modify', - 'namespace': 'origin' - }, - 'rules': [ - { - 'apiGroups': [''], - 'resourceNames': ['release-upgrade-graph'], - 'resources': ['secrets'], - 'verbs': ['get', 'update', 'patch'] +def add_legacy_origin_deployments_scaled_down(gendoc): + """Emit the old release-controller / release-controller-api deployments + (the ones that pre-date the okd rename) with replicas: 0 so they are + drained atomically when the new release-controller-okd resources land.""" + context = gendoc.context + + gendoc.append({ + "apiVersion": "apps/v1", + "kind": "Deployment", + "metadata": { + "annotations": { + 'keel.sh/policy': 'force', + 'keel.sh/matchTag': 'true', + 'keel.sh/trigger': 'poll', + 'keel.sh/pollSchedule': '@every 5m' }, - { - 'apiGroups': ['image.openshift.io'], - 'resources': ['imagestreams', 'imagestreamtags'], - 'verbs': ['get', - 'list', - 'watch', - 'create', - 'delete', - 'update', - 'patch'] + "name": "release-controller", + "namespace": context.config.rc_deployment_namespace, + }, + "spec": { + "replicas": 0, + "selector": { + "matchLabels": { + "app": "release-controller" + } }, - { - 'apiGroups': ['release.openshift.io'], - 'resources': ['releasepayloads'], - 'verbs': ['get', - 'list', - 'watch', - 'create', - 'delete', - 'update', - 'patch'] + "template": { + "metadata": { + "labels": { + "app": "release-controller" + } + }, + "spec": { + "containers": [ + { + 'image': 'quay-proxy.ci.openshift.org/openshift/ci:ci_release-controller_latest', + "name": "controller", + } + ], + } + } + } + }) + + gendoc.append({ + "apiVersion": "apps/v1", + "kind": "Deployment", + "metadata": { + "annotations": { + 'keel.sh/policy': 'force', + 'keel.sh/matchTag': 'true', + 'keel.sh/trigger': 'poll', + 'keel.sh/pollSchedule': '@every 5m' }, - { - 'apiGroups': [''], - 'resources': ['events'], - 'verbs': ['create', 'patch', 'update'] - }] - }, { - 'apiVersion': 'rbac.authorization.k8s.io/v1', - 'kind': 'RoleBinding', - 'metadata': { - 'name': 'release-controller-binding', - 'namespace': 'origin', + "name": "release-controller-api", + "namespace": context.config.rc_deployment_namespace, }, - 'roleRef': { - 'apiGroup': 'rbac.authorization.k8s.io', - 'kind': 'Role', - 'name': 'release-controller-modify', - }, - 'subjects': [{ - 'kind': 'ServiceAccount', - 'name': 'release-controller', - 'namespace': 'ci' + "spec": { + "replicas": 0, + "selector": { + "matchLabels": { + "app": "release-controller-api" + } + }, + "template": { + "metadata": { + "labels": { + "app": "release-controller-api" + } + }, + "spec": { + "containers": [ + { + 'image': 'quay-proxy.ci.openshift.org/openshift/ci:ci_release-controller-api_latest', + "name": "controller", + } + ], + } + } } - ] - }]) + }) -def _add_origin_resources(gendoc): +def add_okd_deployments(gendoc): context = gendoc.context gendoc.append_all([ @@ -72,26 +92,26 @@ def _add_origin_resources(gendoc): "apiVersion": "route.openshift.io/v1", "kind": "Route", "metadata": { - "name": "release-controller", - "namespace": "ci", + "name": context.rc_route_name, + "namespace": context.config.rc_deployment_namespace, }, "spec": { - "host": "origin-release.apps.ci.l2s4.p1.openshiftapps.com", + "host": context.rc_app_url, "tls": { "insecureEdgeTerminationPolicy": "Redirect", "termination": "edge" }, "to": { "kind": "Service", - "name": "release-controller-api", + "name": context.rc_api_service_name, } } }, { "apiVersion": "v1", "kind": "Service", "metadata": { - "name": "release-controller", - "namespace": "ci", + "name": context.rc_service_name, + "namespace": context.config.rc_deployment_namespace, }, "spec": { "ports": [ @@ -101,15 +121,15 @@ def _add_origin_resources(gendoc): } ], "selector": { - "app": "release-controller" + "app": context.rc_service_name } } }, { "apiVersion": "v1", "kind": "Service", "metadata": { - "name": "release-controller-api", - "namespace": "ci", + "name": context.rc_api_service_name, + "namespace": context.config.rc_deployment_namespace, }, "spec": { "ports": [ @@ -119,7 +139,7 @@ def _add_origin_resources(gendoc): } ], "selector": { - "app": "release-controller-api" + "app": context.rc_api_service_name } } }, { @@ -132,20 +152,20 @@ def _add_origin_resources(gendoc): 'keel.sh/trigger': 'poll', 'keel.sh/pollSchedule': '@every 5m' }, - "name": "release-controller", - "namespace": "ci", + "name": context.rc_service_name, + "namespace": context.config.rc_deployment_namespace, }, "spec": { "replicas": 1, "selector": { "matchLabels": { - "app": "release-controller" + "app": context.rc_service_name } }, "template": { "metadata": { "labels": { - "app": "release-controller" + "app": context.rc_service_name } }, "spec": { @@ -209,14 +229,14 @@ def _add_origin_resources(gendoc): { "command": [ "/usr/bin/release-controller", - "--release-namespace=origin", + f"--release-namespace={context.is_namespace}", "--prow-config=/etc/config/config.yaml", "--supplemental-prow-config-dir=/etc/config", "--job-config=/var/repo/release/ci-operator/jobs", - "--prow-namespace=ci", - "--job-namespace=ci-release", + f"--prow-namespace={context.config.rc_deployment_namespace}", + f"--job-namespace={context.jobs_namespace}", "--tools-image-stream-tag=release-controller-bootstrap:tools", - "--release-architecture=amd64", + f"--release-architecture={context.get_supported_architecture_name()}", "-v=4", "--manifest-list-mode" ], @@ -243,7 +263,7 @@ def _add_origin_resources(gendoc): }, } ], - "serviceAccountName": "release-controller", + "serviceAccountName": context.rc_serviceaccount_name, "volumes": get_rc_volumes(context) } } @@ -258,20 +278,20 @@ def _add_origin_resources(gendoc): 'keel.sh/trigger': 'poll', 'keel.sh/pollSchedule': '@every 5m' }, - "name": "release-controller-api", - "namespace": "ci", + "name": context.rc_api_service_name, + "namespace": context.config.rc_deployment_namespace, }, "spec": { "replicas": 3, "selector": { "matchLabels": { - "app": "release-controller-api" + "app": context.rc_api_service_name } }, "template": { "metadata": { "labels": { - "app": "release-controller-api" + "app": context.rc_api_service_name } }, "spec": { @@ -279,11 +299,11 @@ def _add_origin_resources(gendoc): { "command": [ "/usr/bin/release-controller-api", - "--release-namespace=origin", - "--prow-namespace=ci", - "--job-namespace=ci-release", + f"--release-namespace={context.is_namespace}", + f"--prow-namespace={context.config.rc_deployment_namespace}", + f"--job-namespace={context.jobs_namespace}", "--tools-image-stream-tag=release-controller-bootstrap:tools", - "--release-architecture=amd64", + f"--release-architecture={context.get_supported_architecture_name()}", "--enable-jira", "--jira-endpoint=https://redhat.atlassian.net", "--jira-username=openshift-release-controller-jira-bot@redhat.com", @@ -314,18 +334,10 @@ def _add_origin_resources(gendoc): }, } ], - "serviceAccountName": "release-controller", + "serviceAccountName": context.rc_serviceaccount_name, "volumes": get_rcapi_volumes(context, secret_name=context.secret_name_tls_api) } } } } ]) - - -def generate_origin_admin_resources(gendoc): - _add_origin_rbac(gendoc) - - -def generate_origin_resources(gendoc): - _add_origin_resources(gendoc) diff --git a/hack/generators/release-controllers/content/rbac_resources.py b/hack/generators/release-controllers/content/rbac_resources.py index 518b36c31189d..fae556fe7b6e2 100644 --- a/hack/generators/release-controllers/content/rbac_resources.py +++ b/hack/generators/release-controllers/content/rbac_resources.py @@ -180,8 +180,9 @@ def generate_release_admin_rbac(config): _release_payload_modifiers_cluster_role(gendoc) _add_release_controller_developers_cluster_role_bindings(gendoc) - for private in (False, True): - for arch in config.arches: - context = Context(config, arch, private) - _add_release_admin_role_bindings(gendoc, context.is_namespace) - _add_release_payload_modifiers_role_bindings(gendoc, context.is_namespace) + for product in config.products: + for private in product.privacy_modes: + for arch in product.arches: + context = Context(config, arch, private, product) + _add_release_admin_role_bindings(gendoc, context.is_namespace) + _add_release_payload_modifiers_role_bindings(gendoc, context.is_namespace) diff --git a/hack/generators/release-controllers/content/trt_rbac.py b/hack/generators/release-controllers/content/trt_rbac.py index 5bee7fae93eb9..069730fa0516a 100644 --- a/hack/generators/release-controllers/content/trt_rbac.py +++ b/hack/generators/release-controllers/content/trt_rbac.py @@ -25,10 +25,11 @@ def _add_trt_admin_role_bindings(gendoc, namespace): def generate_trt_rbac(config): with genlib.GenDoc(config.paths.path_trt_resources.joinpath('admin_generated_rbac.yaml')) as gendoc: - for private in (False, True): - for arch in config.arches: - context = Context(config, arch, private) - _add_trt_admin_role_bindings(gendoc, context.is_namespace) + for product in config.products: + for private in product.privacy_modes: + for arch in product.arches: + context = Context(config, arch, private, product) + _add_trt_admin_role_bindings(gendoc, context.is_namespace) gendoc.append({ 'apiVersion': 'rbac.authorization.k8s.io/v1', diff --git a/hack/generators/release-controllers/generate-release-controllers.py b/hack/generators/release-controllers/generate-release-controllers.py index c3e7090e8a440..95a585b80c1da 100755 --- a/hack/generators/release-controllers/generate-release-controllers.py +++ b/hack/generators/release-controllers/generate-release-controllers.py @@ -31,20 +31,30 @@ def generate_app_ci_content(config, git_clone_dir): namespaces = [] - for private in (False, True): - for arch in config.arches: - context = Context(config, arch, private) - namespaces.append(context.is_namespace) - - with genlib.GenDoc(config.paths.path_rc_deployments.joinpath(f'admin_deploy-{context.is_namespace}-controller.yaml'), context) as gendoc: - content.add_imagestream_namespace_rbac(gendoc) - content.add_release_payload_modifier_rbac(gendoc) - - with genlib.GenDoc(config.paths.path_rc_deployments.joinpath(f'deploy-{context.is_namespace}-controller.yaml'), context) as gendoc: - content.add_osd_rc_deployments(gendoc) - content.add_osd_files_cache_service_account_resources(gendoc) - content.add_osd_files_cache_resources(gendoc) + for product in config.products: + for private in product.privacy_modes: + for arch in product.arches: + context = Context(config, arch, private, product) + + with genlib.GenDoc(config.paths.path_rc_deployments.joinpath(f'admin_deploy-{context.is_namespace}-controller.yaml'), context) as gendoc: + content.add_imagestream_namespace_rbac(gendoc) + content.add_release_payload_modifier_rbac(gendoc) + + if product.name == 'ocp': + namespaces.append(context.is_namespace) + with genlib.GenDoc(config.paths.path_rc_deployments.joinpath(f'deploy-{context.is_namespace}-controller.yaml'), context) as gendoc: + content.add_osd_rc_deployments(gendoc) + content.add_osd_files_cache_service_account_resources(gendoc) + content.add_osd_files_cache_resources(gendoc) + + elif product.name == 'okd': + with genlib.GenDoc(config.paths.path_rc_deployments.joinpath(f'deploy-{context.is_namespace}-controller.yaml'), context) as gendoc: + content.add_okd_deployments(gendoc) + if not context.suffix: + content.add_legacy_origin_deployments_scaled_down(gendoc) + + # OCP-specific one-off resources with genlib.GenDoc(config.paths.path_rc_deployments.joinpath('serviceaccount.yaml'), context=config) as gendoc: content.add_osd_rc_service_account_resources(gendoc) content.add_release_payload_modifier_service_account(gendoc) @@ -85,15 +95,7 @@ def generate_app_ci_content(config, git_clone_dir): with config.paths.path_priv_rc_annotations.joinpath(annotation_filename).open(mode='w+', encoding='utf-8') as f: json.dump(priv_annotation, f, sort_keys=True, indent=4) - # Generate the release-controller one-offs... - context = Context(config, "x86_64", False) - - # Origin release-controller - with genlib.GenDoc(config.paths.path_rc_deployments.joinpath('admin_deploy-origin-controller.yaml'), context) as gendoc: - content.generate_origin_admin_resources(gendoc) - - with genlib.GenDoc(config.paths.path_rc_deployments.joinpath('deploy-origin-controller.yaml'), context) as gendoc: - content.generate_origin_resources(gendoc) + context = Context(config, "x86_64", False, config.ocp) # Signer with genlib.GenDoc(config.paths.path_rc_deployments.joinpath('deploy-ci-signer.yaml'), context) as gendoc: @@ -117,6 +119,7 @@ def generate_app_ci_content(config, git_clone_dir): # Release Mirror Cleanup Controller content.add_release_mirror_cleanup_controller_resources(config, context, namespaces) + def make_priv_annotation(pub_annotation): priv_annotation = dict(pub_annotation) priv_annotation['name'] += '-priv' @@ -139,6 +142,7 @@ def make_priv_annotation(pub_annotation): test_config['disabled'] = True return priv_annotation + def run(git_clone_dir, bump=False): config = Config(git_clone_dir)