Merge pull request operator-framework#444 from ecordell/perms

chore(rbac): add olm-specific ClusterRole
njhale · Sep 5, 2018 · 53d1d32 · 53d1d32
2 parents df2ed24 + e6bc5c3
commit 53d1d32
Show file tree

Hide file tree

Showing 6 changed files with 12 additions and 21 deletions.
diff --git a/.gitlab-ci.jsonnet b/.gitlab-ci.jsonnet
@@ -55,7 +55,6 @@ local jobs = {
             'builder': images.ci.alm.name,
             'olm': images.prerelease.alm.name,
             'catalog': images.prerelease.catalog.name,
-            'broker': images.prerelease.servicebroker.name,
             'e2e': images.e2e.name,
         }) +
         docker.run(images.ci.alm.name, "make verify-codegen verify-catalog")
@@ -69,7 +68,6 @@ local jobs = {
         script:
             docker.rename(images.prerelease.alm.name, images.release.alm.name) +
             docker.rename(images.prerelease.catalog.name, images.release.catalog.name) +
-            docker.rename(images.prerelease.servicebroker.name, images.release.servicebroker.name) +
             docker.rename(images.e2e.name, images.e2elatest.name),
 
     } + onlyMaster,

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
@@ -55,12 +55,10 @@ container-build:
   image: docker:git
   script:
   - docker build -f upstream.Dockerfile .
-  - "docker tag $(docker images --filter 'label=broker=true' --format '{{.CreatedAt}}\t{{.ID}}' | sort -nr | head -n 1 | cut -f2) quay.io/coreos/alm-service-broker-ci:${CI_COMMIT_REF_SLUG}-pre"
   - "docker tag $(docker images --filter 'label=builder=true' --format '{{.CreatedAt}}\t{{.ID}}' | sort -nr | head -n 1 | cut -f2) quay.io/coreos/alm-ci:${CI_COMMIT_REF_SLUG}"
   - "docker tag $(docker images --filter 'label=catalog=true' --format '{{.CreatedAt}}\t{{.ID}}' | sort -nr | head -n 1 | cut -f2) quay.io/coreos/catalog-ci:${CI_COMMIT_REF_SLUG}-pre"
   - "docker tag $(docker images --filter 'label=e2e=true' --format '{{.CreatedAt}}\t{{.ID}}' | sort -nr | head -n 1 | cut -f2) quay.io/coreos/alm-e2e:${CI_COMMIT_REF_SLUG}-${SHA8}"
   - "docker tag $(docker images --filter 'label=olm=true' --format '{{.CreatedAt}}\t{{.ID}}' | sort -nr | head -n 1 | cut -f2) quay.io/coreos/alm-ci:${CI_COMMIT_REF_SLUG}-pre"
-  - docker push quay.io/coreos/alm-service-broker-ci:${CI_COMMIT_REF_SLUG}-pre
   - docker push quay.io/coreos/alm-ci:${CI_COMMIT_REF_SLUG}
   - docker push quay.io/coreos/catalog-ci:${CI_COMMIT_REF_SLUG}-pre
   - docker push quay.io/coreos/alm-e2e:${CI_COMMIT_REF_SLUG}-${SHA8}
@@ -87,9 +85,6 @@ container-release:
   - docker pull quay.io/coreos/catalog-ci:${CI_COMMIT_REF_SLUG}-pre
   - docker tag quay.io/coreos/catalog-ci:${CI_COMMIT_REF_SLUG}-pre quay.io/coreos/catalog:${CI_COMMIT_REF_SLUG}-${SHA8}
   - docker push quay.io/coreos/catalog:${CI_COMMIT_REF_SLUG}-${SHA8}
-  - docker pull quay.io/coreos/alm-service-broker-ci:${CI_COMMIT_REF_SLUG}-pre
-  - docker tag quay.io/coreos/alm-service-broker-ci:${CI_COMMIT_REF_SLUG}-pre quay.io/coreos/alm-service-broker:${CI_COMMIT_REF_SLUG}-${SHA8}
-  - docker push quay.io/coreos/alm-service-broker:${CI_COMMIT_REF_SLUG}-${SHA8}
   - docker pull quay.io/coreos/alm-e2e:${CI_COMMIT_REF_SLUG}-${SHA8}
   - docker tag quay.io/coreos/alm-e2e:${CI_COMMIT_REF_SLUG}-${SHA8} quay.io/coreos/alm-e2e:latest
   - docker push quay.io/coreos/alm-e2e:latest

diff --git a/.gitlab-ci/vars.libsonnet b/.gitlab-ci/vars.libsonnet
@@ -37,11 +37,6 @@ local utils = import "utils.libsonnet";
                 tag: "${CI_COMMIT_REF_SLUG}-${SHA8}",
                 name: utils.containerName(self.repo, self.tag),
             },
-            servicebroker: {
-                repo: "quay.io/coreos/alm-service-broker",
-                tag: "${CI_COMMIT_REF_SLUG}-${SHA8}",
-                name: utils.containerName(self.repo, self.tag),
-            },
         },
 
         ci: {
@@ -75,11 +70,6 @@ local utils = import "utils.libsonnet";
                 tag: "${CI_COMMIT_REF_SLUG}-pre",
                 name: utils.containerName(self.repo, self.tag),
             },
-            servicebroker: {
-                repo: "quay.io/coreos/alm-service-broker-ci",
-                tag: "${CI_COMMIT_REF_SLUG}-pre",
-                name: utils.containerName(self.repo, self.tag),
-            },
         },
     },
 }
diff --git a/deploy/chart/templates/00-olm-operator.clusterrole.yaml b/deploy/chart/templates/00-olm-operator.clusterrole.yaml
@@ -0,0 +1,10 @@
+apiVersion: {{ .Values.rbacApiVersion }}/v1
+kind: ClusterRole
+metadata:
+  name: system:controller:operator-lifecycle-manager
+rules:
+- apiGroups: ["*"]
+  resources: ["*"]
+  verbs: ["*"]
+- nonResourceURLs: ["*"]
+  verbs: ["*"]
diff --git a/...lates/01-alm-operator.serviceaccount.yaml → ...lates/01-olm-operator.serviceaccount.yaml b/...lates/01-alm-operator.serviceaccount.yaml → ...lates/01-olm-operator.serviceaccount.yaml
@@ -3,5 +3,3 @@ apiVersion: v1
 metadata:
   name: olm-operator-serviceaccount
   namespace: {{ .Values.namespace }}
-imagePullSecrets:
-- name: coreos-pull-secret
diff --git a/...emplates/02-alm-operator.rolebinding.yaml → ...emplates/02-olm-operator.rolebinding.yaml b/...emplates/02-alm-operator.rolebinding.yaml → ...emplates/02-olm-operator.rolebinding.yaml
@@ -3,9 +3,9 @@ kind: ClusterRoleBinding
 metadata:
   name: olm-operator-binding-{{ .Values.namespace }}
 roleRef:
-  apiGroup: rbac.authorization.k8s.io
+  apiGroup: {{ .Values.rbacApiVersion }}
   kind: ClusterRole
-  name: cluster-admin
+  name: system:controller:operator-lifecycle-manager
 subjects:
 - kind: ServiceAccount
   name: olm-operator-serviceaccount