Merge pull request operator-framework#475 from ecordell/0.7.1

Cut 0.7.1

.gitlab-ci.yml

@@ -16,12 +16,11 @@
   script:
   - echo $TEAMUI_KUBECONFIG | base64 -d > kubeconfig
   - export KUBECONFIG=./kubeconfig
-  - kubectl create ns operator-lifecycle-manager || true
-  - kubectl create secret docker-registry coreos-pull-secret --docker-server quay.io --docker-username $DOCKER_USER --docker-password $DOCKER_PASS --docker-email ignored@example.com --namespace=operator-lifecycle-manager
-    || true
   - charttmpdir=`mktemp -d 2>/dev/null || mktemp -d -t 'charttmpdir'`;mkdir -p ${charttmpdir};helm template -n olm --set namespace=operator-lifecycle-manager deploy/chart --set alm.image.ref=quay.io/coreos/olm:${CI_COMMIT_REF_SLUG}-${SHA8}
     --set catalog.image.ref=quay.io/coreos/catalog:${CI_COMMIT_REF_SLUG}-${SHA8} --set catalog_namespace=operator-lifecycle-manager --set namespace=operator-lifecycle-manager --set package.image.ref=quay.io/coreos/package-server:${CI_COMMIT_REF_SLUG}-${SHA8}
     --set watchedNamespaces= --output-dir ${charttmpdir};chartfilenames=$(ls ${charttmpdir}/olm/templates/*.yaml);echo ${chartfilenames};for f in ${chartfilenames};do kubectl replace --force -f ${f};done;
+  - kubectl create secret docker-registry coreos-pull-secret --docker-server quay.io --docker-username $DOCKER_USER --docker-password $DOCKER_PASS --docker-email ignored@example.com --namespace=operator-lifecycle-manager
+    || true
   - kubectl rollout status -w deployment/olm-operator --namespace=operator-lifecycle-manager
   - kubectl rollout status -w deployment/catalog-operator --namespace=operator-lifecycle-manager
   - kubectl rollout status -w deployment/package-server --namespace=operator-lifecycle-manager
@@ -114,12 +113,11 @@ deploy-openshift:
   script:
   - echo $OPENSHIFT_KUBECONFIG | base64 -d > kubeconfig
   - export KUBECONFIG=./kubeconfig
-  - kubectl create ns operator-lifecycle-manager || true
-  - kubectl create secret docker-registry coreos-pull-secret --docker-server quay.io --docker-username $DOCKER_USER --docker-password $DOCKER_PASS --docker-email ignored@example.com --namespace=operator-lifecycle-manager
-    || true
   - charttmpdir=`mktemp -d 2>/dev/null || mktemp -d -t 'charttmpdir'`;mkdir -p ${charttmpdir};helm template -n olm --set namespace=operator-lifecycle-manager deploy/chart --set alm.image.ref=quay.io/coreos/olm:${CI_COMMIT_REF_SLUG}-${SHA8}
     --set catalog.image.ref=quay.io/coreos/catalog:${CI_COMMIT_REF_SLUG}-${SHA8} --set catalog_namespace=operator-lifecycle-manager --set namespace=operator-lifecycle-manager --set package.image.ref=quay.io/coreos/package-server:${CI_COMMIT_REF_SLUG}-${SHA8}
     --set watchedNamespaces= --output-dir ${charttmpdir};chartfilenames=$(ls ${charttmpdir}/olm/templates/*.yaml);echo ${chartfilenames};for f in ${chartfilenames};do kubectl replace --force -f ${f};done;
+  - kubectl create secret docker-registry coreos-pull-secret --docker-server quay.io --docker-username $DOCKER_USER --docker-password $DOCKER_PASS --docker-email ignored@example.com --namespace=operator-lifecycle-manager
+    || true
   - kubectl rollout status -w deployment/olm-operator --namespace=operator-lifecycle-manager
   - kubectl rollout status -w deployment/catalog-operator --namespace=operator-lifecycle-manager
   - kubectl rollout status -w deployment/package-server --namespace=operator-lifecycle-manager
@@ -150,13 +148,12 @@ deploy-preview:
   script:
   - echo $CD_KUBECONFIG | base64 -d > kubeconfig
   - export KUBECONFIG=./kubeconfig
-  - kubectl create ns ci-alm-${CI_COMMIT_REF_SLUG} || true
-  - kubectl create secret docker-registry coreos-pull-secret --docker-server quay.io --docker-username $DOCKER_USER --docker-password $DOCKER_PASS --docker-email ignored@example.com --namespace=ci-alm-${CI_COMMIT_REF_SLUG}
-    || true
   - charttmpdir=`mktemp -d 2>/dev/null || mktemp -d -t 'charttmpdir'`;mkdir -p ${charttmpdir};helm template -n olm --set namespace=ci-alm-${CI_COMMIT_REF_SLUG} deploy/chart --set alm.image.ref=quay.io/coreos/alm-ci:${CI_COMMIT_REF_SLUG}-pre
     --set catalog.image.ref=quay.io/coreos/catalog-ci:${CI_COMMIT_REF_SLUG}-pre --set catalog_namespace=operator-lifecycle-manager --set namespace=ci-alm-${CI_COMMIT_REF_SLUG} --set package.image.ref=quay.io/coreos/package-server-ci:${CI_COMMIT_REF_SLUG}-pre
     --set watchedNamespaces=ci-alm-${CI_COMMIT_REF_SLUG} --output-dir ${charttmpdir};chartfilenames=$(ls ${charttmpdir}/olm/templates/*.yaml);echo ${chartfilenames};for f in ${chartfilenames};do kubectl
     replace --force -f ${f};done;
+  - kubectl create secret docker-registry coreos-pull-secret --docker-server quay.io --docker-username $DOCKER_USER --docker-password $DOCKER_PASS --docker-email ignored@example.com --namespace=ci-alm-${CI_COMMIT_REF_SLUG}
+    || true
   - kubectl rollout status -w deployment/olm-operator --namespace=ci-alm-${CI_COMMIT_REF_SLUG}
   - kubectl rollout status -w deployment/catalog-operator --namespace=ci-alm-${CI_COMMIT_REF_SLUG}
   - kubectl rollout status -w deployment/package-server --namespace=ci-alm-${CI_COMMIT_REF_SLUG}
@@ -182,13 +179,12 @@ deploy-staging:
   script:
   - echo $CD_KUBECONFIG | base64 -d > kubeconfig
   - export KUBECONFIG=./kubeconfig
-  - kubectl create ns ci-alm-staging || true
-  - kubectl create secret docker-registry coreos-pull-secret --docker-server quay.io --docker-username $DOCKER_USER --docker-password $DOCKER_PASS --docker-email ignored@example.com --namespace=ci-alm-staging
-    || true
   - charttmpdir=`mktemp -d 2>/dev/null || mktemp -d -t 'charttmpdir'`;mkdir -p ${charttmpdir};helm template -n olm --set namespace=ci-alm-staging deploy/chart --set alm.image.ref=quay.io/coreos/olm:${CI_COMMIT_REF_SLUG}-${SHA8}
     --set catalog.image.ref=quay.io/coreos/catalog:${CI_COMMIT_REF_SLUG}-${SHA8} --set catalog_namespace=operator-lifecycle-manager --set namespace=ci-alm-staging --set package.image.ref=quay.io/coreos/package-server:${CI_COMMIT_REF_SLUG}-${SHA8}
     --set watchedNamespaces=ci-alm-staging --output-dir ${charttmpdir};chartfilenames=$(ls ${charttmpdir}/olm/templates/*.yaml);echo ${chartfilenames};for f in ${chartfilenames};do kubectl replace --force
     -f ${f};done;
+  - kubectl create secret docker-registry coreos-pull-secret --docker-server quay.io --docker-username $DOCKER_USER --docker-password $DOCKER_PASS --docker-email ignored@example.com --namespace=ci-alm-staging
+    || true
   - kubectl rollout status -w deployment/olm-operator --namespace=ci-alm-staging
   - kubectl rollout status -w deployment/catalog-operator --namespace=ci-alm-staging
   - kubectl rollout status -w deployment/package-server --namespace=ci-alm-staging
@@ -212,13 +208,12 @@ e2e-setup:
   script:
   - echo $CD_KUBECONFIG | base64 -d > kubeconfig
   - export KUBECONFIG=./kubeconfig
-  - kubectl create ns e2e-${CI_COMMIT_REF_SLUG}-${SHA8} || true
-  - kubectl create secret docker-registry coreos-pull-secret --docker-server quay.io --docker-username $DOCKER_USER --docker-password $DOCKER_PASS --docker-email ignored@example.com --namespace=e2e-${CI_COMMIT_REF_SLUG}-${SHA8}
-    || true
   - charttmpdir=`mktemp -d 2>/dev/null || mktemp -d -t 'charttmpdir'`;mkdir -p ${charttmpdir};helm template -n olm --set namespace=e2e-${CI_COMMIT_REF_SLUG}-${SHA8} deploy/chart --set alm.image.ref=quay.io/coreos/alm-ci:${CI_COMMIT_REF_SLUG}-pre
     --set catalog.image.ref=quay.io/coreos/catalog-ci:${CI_COMMIT_REF_SLUG}-pre --set catalog_namespace=e2e-${CI_COMMIT_REF_SLUG}-${SHA8} --set namespace=e2e-${CI_COMMIT_REF_SLUG}-${SHA8} --set package.image.ref=quay.io/coreos/package-server-ci:${CI_COMMIT_REF_SLUG}-pre
     --set watchedNamespaces=e2e-${CI_COMMIT_REF_SLUG}-${SHA8} --output-dir ${charttmpdir};chartfilenames=$(ls ${charttmpdir}/olm/templates/*.yaml);echo ${chartfilenames};for f in ${chartfilenames};do kubectl
     replace --force -f ${f};done;
+  - kubectl create secret docker-registry coreos-pull-secret --docker-server quay.io --docker-username $DOCKER_USER --docker-password $DOCKER_PASS --docker-email ignored@example.com --namespace=e2e-${CI_COMMIT_REF_SLUG}-${SHA8}
+    || true
   - kubectl rollout status -w deployment/olm-operator --namespace=e2e-${CI_COMMIT_REF_SLUG}-${SHA8}
   - kubectl rollout status -w deployment/catalog-operator --namespace=e2e-${CI_COMMIT_REF_SLUG}-${SHA8}
   - kubectl rollout status -w deployment/package-server --namespace=e2e-${CI_COMMIT_REF_SLUG}-${SHA8}

.gitlab-ci/base_jobs.libsonnet

@@ -128,13 +128,12 @@ local appr = utils.appr;
 
         script:
             k8s.setKubeConfig(_vars.kubeconfig) +
-            k8s.createNamespace(_vars.namespace) +
+            helm.templateApply("olm", _vars.chart, _vars.namespace, _vars.params) +
             k8s.createPullSecret("coreos-pull-secret",
                                  _vars.namespace,
                                  "quay.io",
                                  "$DOCKER_USER",
                                  "$DOCKER_PASS") +
-            helm.templateApply("olm", _vars.chart, _vars.namespace, _vars.params) +
             k8s.waitForDeployment("olm-operator", _vars.namespace) +
             k8s.waitForDeployment("catalog-operator", _vars.namespace) +
             k8s.waitForDeployment("package-server", _vars.namespace),

Makefile

@@ -150,6 +150,7 @@ release:
 	docker pull quay.io/coreos/package-server:$(ver)
 	$(MAKE) target=upstream ver=$(ver) package
 	$(MAKE) target=okd ver=$(ver) package
+	$(MAKE) target=ocp ver=$(ver) package
 
 package:
 ifndef target

OLM_VERSION

@@ -1 +1 @@
-0.7.0
+0.7.1

deploy/chart/templates/30_00-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .Values.namespace }}

deploy/chart/templates/02-olm-operator.rolebinding.yaml → deploy/chart/templates/30_01-olm-operator.serviceaccount.yaml

@@ -1,4 +1,21 @@
 apiVersion: {{ .Values.rbacApiVersion }}/v1
+kind: ClusterRole
+metadata:
+  name: system:controller:operator-lifecycle-manager
+rules:
+- apiGroups: ["*"]
+  resources: ["*"]
+  verbs: ["*"]
+- nonResourceURLs: ["*"]
+  verbs: ["*"]
+---
+kind: ServiceAccount
+apiVersion: v1
+metadata:
+  name: olm-operator-serviceaccount
+  namespace: {{ .Values.namespace }}
+---
+apiVersion: {{ .Values.rbacApiVersion }}/v1
 kind: ClusterRoleBinding
 metadata:
   name: olm-operator-binding-{{ .Values.namespace }}

deploy/chart/templates/20-aggregated-edit.clusterrole.yaml → deploy/chart/templates/30_12-aggregated.clusterrole.yaml

@@ -10,3 +10,15 @@ rules:
 - apiGroups: ["operators.coreos.com"]
   resources: ["clusterserviceversions", "catalogsources", "installplans", "subscriptions", "packagemanifests"]
   verbs: ["create", "update", "patch", "delete"]
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: aggregate-olm-view
+  labels:
+    # Add these permissions to the "view" default roles
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+rules:
+- apiGroups: ["operators.coreos.com"]
+  resources: ["clusterserviceversions", "catalogsources", "installplans", "subscriptions", "packagemanifests"]
+  verbs: ["get", "list", "watch"]

deploy/chart/templates/22-packageserver.yaml → deploy/chart/templates/30_13-packageserver.yaml

@@ -1,4 +1,4 @@
-{{- $ca := genCA "package-server-ca" 365 -}}
+{{- $ca := genCA "package-server-ca" 3650 -}}
 apiVersion: apiregistration.k8s.io/v1beta1
 kind: APIService
 metadata:

deploy/chart/templates/30_14-imagestream.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.imagestream }}
+kind: ImageStream
+apiVersion: image.openshift.io/v1
+spec:
+  tags:
+  - name: olm
+    from:
+      kind: DockerImage
+      Name:  {{ .Values.alm.image.ref }}
+  - name: catalog
+    from:
+      kind: DockerImage
+      Name:  {{ .Values.catalog.image.ref }}
+  - name: package-server
+     from:
+      kind: DockerImage
+      Name:  {{ .Values.package.image.ref }}
+{{- end }}

deploy/chart/values.yaml

@@ -1,6 +1,7 @@
 rbacApiVersion: rbac.authorization.k8s.io
-namespace: alm
-catalog_namespace: tectonic-system
+namespace: operator-lifecycle-manager
+catalog_namespace: operator-lifecycle-manager
+imagestream: false
 alm:
   replicaCount: 1
   image:

deploy/ocp/manifests/0.7.1/30_00-namespace.yaml

@@ -0,0 +1,6 @@
+##---
+# Source: olm/templates/30_00-namespace.yaml
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: operator-lifecycle-manager

deploy/ocp/manifests/0.7.1/30_01-olm-operator.serviceaccount.yaml

@@ -0,0 +1,31 @@
+##---
+# Source: olm/templates/30_01-olm-operator.serviceaccount.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: system:controller:operator-lifecycle-manager
+rules:
+- apiGroups: ["*"]
+  resources: ["*"]
+  verbs: ["*"]
+- nonResourceURLs: ["*"]
+  verbs: ["*"]
+---
+kind: ServiceAccount
+apiVersion: v1
+metadata:
+  name: olm-operator-serviceaccount
+  namespace: operator-lifecycle-manager
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: olm-operator-binding-operator-lifecycle-manager
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:controller:operator-lifecycle-manager
+subjects:
+- kind: ServiceAccount
+  name: olm-operator-serviceaccount
+  namespace: operator-lifecycle-manager