Merge pull request operator-framework#418 from ecordell/prom-fixes

Deployment fixes

deploy/aos-olm/manifests/0.6.0/files/08-ocs.configmap.yaml

@@ -6962,7 +6962,7 @@ data:
         namespace: placeholder
         annotations:
           tectonic-visibility: ocs
-          alm-examples: '[{"apiVersion":"monitoring.coreos.com/v1","kind":"Prometheus","metadata":{"name":"example","labels":{"prometheus":"k8s"}},"spec":{"replicas":2,"version":"v1.7.0","serviceAccountName":"prometheus-k8s","serviceMonitorSelector":{"matchExpressions":[{"key":"k8s-app","operator":"Exists"}]},"ruleSelector":{"matchLabels":{"role":"prometheus-rulefiles","prometheus":"k8s"}},"resources":{"requests":{"memory":"400Mi"}},"alerting":{"alertmanagers":[{"namespace":"monitoring","name":"alertmanager-main","port":"web"}]}}},{"apiVersion":"monitoring.coreos.com/v1","kind":"ServiceMonitor","metadata":{"name":"example","labels":{"k8s-app":"prometheus"}},"spec":{"selector":{"matchLabels":{"k8s-app":"prometheus","prometheus":"k8s"}},"namespaceSelector":{"matchNames":["monitoring"]},"endpoints":[{"port":"web","interval":"30s"}]}},{"apiVersion":"monitoring.coreos.com/v1","kind":"Alertmanager","metadata":{"name":"alertmanager-main"},"spec":{"replicas":3}}]'
+          alm-examples: '[{"apiVersion":"monitoring.coreos.com/v1","kind":"Prometheus","metadata":{"name":"example","labels":{"prometheus":"k8s"}},"spec":{"replicas":2,"version":"v2.3.2","serviceAccountName":"prometheus-k8s","securityContext": {}, "serviceMonitorSelector":{"matchExpressions":[{"key":"k8s-app","operator":"Exists"}]},"ruleSelector":{"matchLabels":{"role":"prometheus-rulefiles","prometheus":"k8s"}},"resources":{"requests":{"memory":"400Mi"}},"alerting":{"alertmanagers":[{"namespace":"monitoring","name":"alertmanager-main","port":"web"}]}}},{"apiVersion":"monitoring.coreos.com/v1","kind":"ServiceMonitor","metadata":{"name":"example","labels":{"k8s-app":"prometheus"}},"spec":{"selector":{"matchLabels":{"k8s-app":"prometheus","prometheus":"k8s"}},"namespaceSelector":{"matchNames":["monitoring"]},"endpoints":[{"port":"web","interval":"30s"}]}},{"apiVersion":"monitoring.coreos.com/v1","kind":"Alertmanager","metadata":{"name":"alertmanager-main"},"spec":{"replicas":3}}]'
       spec:
         replaces: prometheusoperator.0.15.0
         displayName: Prometheus
@@ -7147,9 +7147,6 @@ data:
                         readOnlyRootFilesystem: true
                     nodeSelector:
                       beta.kubernetes.io/os: linux
-                    securityContext:
-                      runAsNonRoot: true
-                      runAsUser: 65534
         maturity: alpha
         version: 0.22.2
         customresourcedefinitions:

deploy/aos-olm/manifests/0.6.0/files/20-aggregated-edit.clusterrole.yaml

@@ -10,5 +10,5 @@ metadata:
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
 rules:
 - apiGroups: ["operators.coreos.com"]
-  resources: ["*"]
-  verbs: ["*"]
+  resources: ["clusterserviceversions", "catalogsources", "installplans", "subscriptions"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

deploy/aos-olm/manifests/0.6.0/files/21-aggregated-view.clusterrole.yaml

@@ -9,5 +9,5 @@ metadata:
     rbac.authorization.k8s.io/aggregate-to-view: "true"
 rules:
 - apiGroups: ["operators.coreos.com"]
-  resources: ["*"]
+  resources: ["clusterserviceversions", "catalogsources", "installplans", "subscriptions"]
   verbs: ["get", "list", "watch"]

deploy/aos-olm/manifests/0.6.0/tasks/install.yaml

@@ -116,15 +116,6 @@
     files:
       - "{{ mktemp.stdout }}/20-aggregated-edit.clusterrole.yaml"
 
-- name: Apply aggregate-olm-edit ClusterRole manifest
-  oc_obj:
-    state: present
-    kind: ClusterRole
-    name: aggregate-olm-edit
-    namespace: operator-lifecycle-manager
-    files:
-      - "{{ mktemp.stdout }}/20-aggregated.clusterrole.yaml"
-
 - name: Apply aggregate-olm-view ClusterRole manifest
   oc_obj:
     state: present

deploy/aos-olm/manifests/0.6.0/tasks/remove_components.yaml

@@ -76,13 +76,6 @@
     name: aggregate-olm-edit
     namespace: operator-lifecycle-manager
 
-- name: Remove aggregate-olm-edit ClusterRole manifest
-  oc_obj:
-    state: absent
-    kind: ClusterRole
-    name: aggregate-olm-edit
-    namespace: operator-lifecycle-manager
-
 - name: Remove aggregate-olm-view ClusterRole manifest
   oc_obj:
     state: absent

deploy/chart/catalog_resources/ocs/prometheusoperator.0.22.2.clusterserviceversion.yaml

@@ -7,7 +7,7 @@ metadata:
   namespace: placeholder
   annotations:
     tectonic-visibility: ocs
-    alm-examples: '[{"apiVersion":"monitoring.coreos.com/v1","kind":"Prometheus","metadata":{"name":"example","labels":{"prometheus":"k8s"}},"spec":{"replicas":2,"version":"v1.7.0","serviceAccountName":"prometheus-k8s","serviceMonitorSelector":{"matchExpressions":[{"key":"k8s-app","operator":"Exists"}]},"ruleSelector":{"matchLabels":{"role":"prometheus-rulefiles","prometheus":"k8s"}},"resources":{"requests":{"memory":"400Mi"}},"alerting":{"alertmanagers":[{"namespace":"monitoring","name":"alertmanager-main","port":"web"}]}}},{"apiVersion":"monitoring.coreos.com/v1","kind":"ServiceMonitor","metadata":{"name":"example","labels":{"k8s-app":"prometheus"}},"spec":{"selector":{"matchLabels":{"k8s-app":"prometheus","prometheus":"k8s"}},"namespaceSelector":{"matchNames":["monitoring"]},"endpoints":[{"port":"web","interval":"30s"}]}},{"apiVersion":"monitoring.coreos.com/v1","kind":"Alertmanager","metadata":{"name":"alertmanager-main"},"spec":{"replicas":3}}]'
+    alm-examples: '[{"apiVersion":"monitoring.coreos.com/v1","kind":"Prometheus","metadata":{"name":"example","labels":{"prometheus":"k8s"}},"spec":{"replicas":2,"version":"v2.3.2","serviceAccountName":"prometheus-k8s","securityContext": {}, "serviceMonitorSelector":{"matchExpressions":[{"key":"k8s-app","operator":"Exists"}]},"ruleSelector":{"matchLabels":{"role":"prometheus-rulefiles","prometheus":"k8s"}},"resources":{"requests":{"memory":"400Mi"}},"alerting":{"alertmanagers":[{"namespace":"monitoring","name":"alertmanager-main","port":"web"}]}}},{"apiVersion":"monitoring.coreos.com/v1","kind":"ServiceMonitor","metadata":{"name":"example","labels":{"k8s-app":"prometheus"}},"spec":{"selector":{"matchLabels":{"k8s-app":"prometheus","prometheus":"k8s"}},"namespaceSelector":{"matchNames":["monitoring"]},"endpoints":[{"port":"web","interval":"30s"}]}},{"apiVersion":"monitoring.coreos.com/v1","kind":"Alertmanager","metadata":{"name":"alertmanager-main"},"spec":{"replicas":3}}]'
 spec:
   replaces: prometheusoperator.0.15.0
   displayName: Prometheus
@@ -192,9 +192,6 @@ spec:
                   readOnlyRootFilesystem: true
               nodeSelector:
                 beta.kubernetes.io/os: linux
-              securityContext:
-                runAsNonRoot: true
-                runAsUser: 65534
   maturity: alpha
   version: 0.22.2
   customresourcedefinitions:

deploy/chart/templates/20-aggregated-edit.clusterrole.yaml

@@ -8,5 +8,5 @@ metadata:
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
 rules:
 - apiGroups: ["operators.coreos.com"]
-  resources: ["*"]
-  verbs: ["*"]
+  resources: ["clusterserviceversions", "catalogsources", "installplans", "subscriptions"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

deploy/chart/templates/21-aggregated-view.clusterrole.yaml

@@ -7,5 +7,5 @@ metadata:
     rbac.authorization.k8s.io/aggregate-to-view: "true"
 rules:
 - apiGroups: ["operators.coreos.com"]
-  resources: ["*"]
+  resources: ["clusterserviceversions", "catalogsources", "installplans", "subscriptions"]
   verbs: ["get", "list", "watch"]

deploy/upstream/manifests/0.6.0/08-ocs.configmap.yaml

@@ -6962,7 +6962,7 @@ data:
         namespace: placeholder
         annotations:
           tectonic-visibility: ocs
-          alm-examples: '[{"apiVersion":"monitoring.coreos.com/v1","kind":"Prometheus","metadata":{"name":"example","labels":{"prometheus":"k8s"}},"spec":{"replicas":2,"version":"v1.7.0","serviceAccountName":"prometheus-k8s","serviceMonitorSelector":{"matchExpressions":[{"key":"k8s-app","operator":"Exists"}]},"ruleSelector":{"matchLabels":{"role":"prometheus-rulefiles","prometheus":"k8s"}},"resources":{"requests":{"memory":"400Mi"}},"alerting":{"alertmanagers":[{"namespace":"monitoring","name":"alertmanager-main","port":"web"}]}}},{"apiVersion":"monitoring.coreos.com/v1","kind":"ServiceMonitor","metadata":{"name":"example","labels":{"k8s-app":"prometheus"}},"spec":{"selector":{"matchLabels":{"k8s-app":"prometheus","prometheus":"k8s"}},"namespaceSelector":{"matchNames":["monitoring"]},"endpoints":[{"port":"web","interval":"30s"}]}},{"apiVersion":"monitoring.coreos.com/v1","kind":"Alertmanager","metadata":{"name":"alertmanager-main"},"spec":{"replicas":3}}]'
+          alm-examples: '[{"apiVersion":"monitoring.coreos.com/v1","kind":"Prometheus","metadata":{"name":"example","labels":{"prometheus":"k8s"}},"spec":{"replicas":2,"version":"v2.3.2","serviceAccountName":"prometheus-k8s","securityContext": {}, "serviceMonitorSelector":{"matchExpressions":[{"key":"k8s-app","operator":"Exists"}]},"ruleSelector":{"matchLabels":{"role":"prometheus-rulefiles","prometheus":"k8s"}},"resources":{"requests":{"memory":"400Mi"}},"alerting":{"alertmanagers":[{"namespace":"monitoring","name":"alertmanager-main","port":"web"}]}}},{"apiVersion":"monitoring.coreos.com/v1","kind":"ServiceMonitor","metadata":{"name":"example","labels":{"k8s-app":"prometheus"}},"spec":{"selector":{"matchLabels":{"k8s-app":"prometheus","prometheus":"k8s"}},"namespaceSelector":{"matchNames":["monitoring"]},"endpoints":[{"port":"web","interval":"30s"}]}},{"apiVersion":"monitoring.coreos.com/v1","kind":"Alertmanager","metadata":{"name":"alertmanager-main"},"spec":{"replicas":3}}]'
       spec:
         replaces: prometheusoperator.0.15.0
         displayName: Prometheus
@@ -7147,9 +7147,6 @@ data:
                         readOnlyRootFilesystem: true
                     nodeSelector:
                       beta.kubernetes.io/os: linux
-                    securityContext:
-                      runAsNonRoot: true
-                      runAsUser: 65534
         maturity: alpha
         version: 0.22.2
         customresourcedefinitions:

deploy/upstream/manifests/0.6.0/20-aggregated-edit.clusterrole.yaml

@@ -10,5 +10,5 @@ metadata:
     rbac.authorization.k8s.io/aggregate-to-edit: "true"
 rules:
 - apiGroups: ["operators.coreos.com"]
-  resources: ["*"]
-  verbs: ["*"]
+  resources: ["clusterserviceversions", "catalogsources", "installplans", "subscriptions"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

deploy/upstream/manifests/0.6.0/21-aggregated-view.clusterrole.yaml

@@ -9,5 +9,5 @@ metadata:
     rbac.authorization.k8s.io/aggregate-to-view: "true"
 rules:
 - apiGroups: ["operators.coreos.com"]
-  resources: ["*"]
+  resources: ["clusterserviceversions", "catalogsources", "installplans", "subscriptions"]
   verbs: ["get", "list", "watch"]

test/e2e/installplan_e2e_test.go

@@ -23,7 +23,7 @@ import (
 
 const (
 	etcdVersion            = "3.2.13"
-	prometheusVersion      = "v1.7.0"
+	prometheusVersion      = "v2.3.2"
 	expectedEtcdNodes      = 3
 	expectedPrometheusSize = 3
 	ocsConfigMap           = "ocs"

test/e2e/ocs_e2e_test.go

@@ -305,13 +305,13 @@ func TestInstallPrometheusOCS(t *testing.T) {
 			"labels":    map[string]interface{}{"prometheus": "test-prometheus"},
 		},
 		"spec": map[string]interface{}{
-			"replicas": expectedPrometheusSize,
-			"version":  prometheusVersion,
+			"replicas":        expectedPrometheusSize,
+			"version":         prometheusVersion,
+			"securityContext": struct{}{},
 		},
 	}
 
 	t.Run("test prometheus object creation", func(t *testing.T) {
-		t.Skip("skipping prometheus object verification - currently broken")
 		err = c.CreateCustomResource(&unstructured.Unstructured{Object: prometheus})
 		require.NoError(t, err)