Add OpenShift Auth native support (grafana#94)

bundle/manifests/loki-operator.clusterserviceversion.yaml

@@ -545,6 +545,8 @@ spec:
                 env:
                 - name: RELATED_IMAGE_LOKI
                   value: quay.io/openshift-logging/loki:v2.2.0-10
+                - name: RELATED_IMAGE_GATEWAY
+                  value: quay.io/observatorium/api:latest
                 - name: RELATED_IMAGE_OPA
                   value: quay.io/observatorium/opa-openshift:latest
                 image: quay.io/openshift-logging/loki-operator:v0.0.1

config/overlays/development/kustomization.yaml

@@ -16,3 +16,7 @@ commonLabels:
   app.kubernetes.io/version: "0.0.1"
   app.kubernetes.io/part-of: loki-operator
   app.kubernetes.io/managed-by: operator-lifecycle-manager
+
+patchesStrategicMerge:
+- manager_related_image_patch.yaml
+- manager_run_flags_patch.yaml

config/overlays/development/manager_related_image_patch.yaml

@@ -0,0 +1,14 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: controller-manager
+spec:
+  template:
+    spec:
+      containers:
+        - name: manager
+          env:
+          - name: RELATED_IMAGE_LOKI
+            value: docker.io/grafana/loki:2.2.0
+          - name: RELATED_IMAGE_GATEWAY
+            value: quay.io/observatorium/api:latest

config/overlays/development/manager_run_flags_patch.yaml

@@ -0,0 +1,11 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: controller-manager
+spec:
+  template:
+    spec:
+      containers:
+        - name: manager
+          args:
+          - "--with-lokistack-gateway"

config/overlays/openshift/manager_auth_proxy_patch.yaml

@@ -1,5 +1,3 @@
-# This patch inject a sidecar container which is a HTTP proxy for the
-# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
 apiVersion: apps/v1
 kind: Deployment
 metadata:

config/overlays/openshift/manager_related_image_patch.yaml

@@ -1,5 +1,3 @@
-# This patch inject a sidecar container which is a HTTP proxy for the
-# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -12,5 +10,7 @@ spec:
           env:
           - name: RELATED_IMAGE_LOKI
             value: quay.io/openshift-logging/loki:v2.2.0-10
+          - name: RELATED_IMAGE_GATEWAY
+            value: quay.io/observatorium/api:latest
           - name: RELATED_IMAGE_OPA
             value: quay.io/observatorium/opa-openshift:latest

config/overlays/openshift/manager_run_flags_patch.yaml

@@ -1,5 +1,3 @@
-# This patch inject a sidecar container which is a HTTP proxy for the
-# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
 apiVersion: apps/v1
 kind: Deployment
 metadata:

config/overlays/openshift/prometheus_service_monitor_patch.yaml

@@ -1,4 +1,3 @@
-# Prometheus Monitor Service (Metrics)
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:

config/overlays/production/kustomization.yaml

@@ -36,6 +36,7 @@ patchesStrategicMerge:
 # endpoint w/o any authn/z, please comment the following line.
 - manager_auth_proxy_patch.yaml
 - manager_related_image_patch.yaml
+- manager_run_flags_patch.yaml
 - prometheus_service_monitor_patch.yaml
 
 images:

config/overlays/production/manager_related_image_patch.yaml

@@ -1,5 +1,3 @@
-# This patch inject a sidecar container which is a HTTP proxy for the
-# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -12,5 +10,5 @@ spec:
           env:
           - name: RELATED_IMAGE_LOKI
             value: docker.io/grafana/loki:2.2.0
-          - name: RELATED_IMAGE_OPA
-            value: quay.io/observatorium/opa-openshift:latest
+          - name: RELATED_IMAGE_GATEWAY
+            value: quay.io/observatorium/api:latest

config/overlays/production/manager_run_flags_patch.yaml

@@ -0,0 +1,11 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: controller-manager
+spec:
+  template:
+    spec:
+      containers:
+        - name: manager
+          args:
+          - "--with-lokistack-gateway"

controllers/lokistack_controller.go

@@ -26,9 +26,12 @@ import (
 	"github.com/ViaQ/loki-operator/internal/manifests"
 	"github.com/ViaQ/loki-operator/internal/status"
 	"github.com/go-logr/logr"
+	routev1 "github.com/openshift/api/route/v1"
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
+	networkingv1 "k8s.io/api/networking/v1"
+	rbacv1 "k8s.io/api/rbac/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/builder"
@@ -73,12 +76,19 @@ var (
 	})
 )
 
+// LokiStackReconcilerConfig represents a set of
+// configuration options to setup the reconciler.
+type LokiStackReconcilerConfig struct {
+	Host  string
+	Flags manifests.FeatureFlags
+}
+
 // LokiStackReconciler reconciles a LokiStack object
 type LokiStackReconciler struct {
 	client.Client
 	Log    logr.Logger
 	Scheme *runtime.Scheme
-	Flags  manifests.FeatureFlags
+	Config LokiStackReconcilerConfig
 }
 
 // +kubebuilder:rbac:groups=loki.openshift.io,resources=lokistacks,verbs=get;list;watch;create;update;patch;delete
@@ -113,7 +123,7 @@ func (r *LokiStackReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
 		return ctrl.Result{}, nil
 	}
 
-	err = handlers.CreateOrUpdateLokiStack(ctx, req, r.Client, r.Scheme, r.Flags)
+	err = handlers.CreateOrUpdateLokiStack(ctx, req, r.Client, r.Scheme, r.Config.Host, r.Config.Flags)
 	if err != nil {
 		return ctrl.Result{
 			Requeue:      true,
@@ -142,8 +152,13 @@ func (r *LokiStackReconciler) buildController(bld k8s.Builder) error {
 	return bld.
 		For(&lokiv1beta1.LokiStack{}, createOrUpdateOnlyPred).
 		Owns(&corev1.ConfigMap{}, updateOrDeleteOnlyPred).
+		Owns(&corev1.ServiceAccount{}, updateOrDeleteOnlyPred).
 		Owns(&corev1.Service{}, updateOrDeleteOnlyPred).
 		Owns(&appsv1.Deployment{}, updateOrDeleteOnlyPred).
 		Owns(&appsv1.StatefulSet{}, updateOrDeleteOnlyPred).
+		Owns(&rbacv1.ClusterRole{}, updateOrDeleteOnlyPred).
+		Owns(&rbacv1.ClusterRoleBinding{}, updateOrDeleteOnlyPred).
+		Owns(&networkingv1.Ingress{}, updateOrDeleteOnlyPred).
+		Owns(&routev1.Route{}, updateOrDeleteOnlyPred).
 		Complete(r)
 }

controllers/lokistack_controller_test.go

@@ -9,15 +9,18 @@ import (
 	"github.com/ViaQ/logerr/log"
 	lokiv1beta1 "github.com/ViaQ/loki-operator/api/v1beta1"
 	"github.com/ViaQ/loki-operator/internal/external/k8s/k8sfakes"
+	routev1 "github.com/openshift/api/route/v1"
 	"github.com/stretchr/testify/require"
-	"sigs.k8s.io/controller-runtime/pkg/builder"
-	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
+	networkingv1 "k8s.io/api/networking/v1"
+	rbacv1 "k8s.io/api/rbac/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	"sigs.k8s.io/controller-runtime/pkg/builder"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 var scheme = runtime.NewScheme()
@@ -39,6 +42,7 @@ func TestMain(m *testing.M) {
 
 	// Register the clientgo and CRD schemes
 	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
+	utilruntime.Must(routev1.AddToScheme(scheme))
 	utilruntime.Must(lokiv1beta1.AddToScheme(scheme))
 
 	log.Init("testing")
@@ -77,7 +81,7 @@ func TestLokiStackController_RegisterOwnedResourcesForUpdateOrDeleteOnly(t *test
 	require.NoError(t, err)
 
 	// Require Owns-Calls for all owned resources
-	require.Equal(t, 4, b.OwnsCallCount())
+	require.Equal(t, 9, b.OwnsCallCount())
 
 	// Require owned resources
 	type test struct {
@@ -89,6 +93,10 @@ func TestLokiStackController_RegisterOwnedResourcesForUpdateOrDeleteOnly(t *test
 			obj:  &corev1.ConfigMap{},
 			pred: updateOrDeleteOnlyPred,
 		},
+		{
+			obj:  &corev1.ServiceAccount{},
+			pred: updateOrDeleteOnlyPred,
+		},
 		{
 			obj:  &corev1.Service{},
 			pred: updateOrDeleteOnlyPred,
@@ -101,6 +109,22 @@ func TestLokiStackController_RegisterOwnedResourcesForUpdateOrDeleteOnly(t *test
 			obj:  &appsv1.StatefulSet{},
 			pred: updateOrDeleteOnlyPred,
 		},
+		{
+			obj:  &rbacv1.ClusterRole{},
+			pred: updateOrDeleteOnlyPred,
+		},
+		{
+			obj:  &rbacv1.ClusterRoleBinding{},
+			pred: updateOrDeleteOnlyPred,
+		},
+		{
+			obj:  &networkingv1.Ingress{},
+			pred: updateOrDeleteOnlyPred,
+		},
+		{
+			obj:  &routev1.Route{},
+			pred: updateOrDeleteOnlyPred,
+		},
 	}
 	for i, tst := range table {
 		// Require Owns-call options to have delete predicate only

go.mod

@@ -8,13 +8,14 @@ require (
 	github.com/google/uuid v1.1.2
 	github.com/imdario/mergo v0.3.12
 	github.com/maxbrunsfeld/counterfeiter/v6 v6.3.0
+	github.com/openshift/api v0.0.0-20210901140736-d8ed1449662d // release-4.9
 	github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.48.0
 	github.com/prometheus/client_golang v1.11.0
 	github.com/stretchr/testify v1.7.0
-	k8s.io/api v0.21.4
-	k8s.io/apimachinery v0.21.4
-	k8s.io/client-go v0.21.4
-	k8s.io/utils v0.0.0-20210527160623-6fdb442a123b
+	k8s.io/api v0.22.1
+	k8s.io/apimachinery v0.22.1
+	k8s.io/client-go v0.22.1
+	k8s.io/utils v0.0.0-20210707171843-4b05e18ac7d9
 	sigs.k8s.io/controller-runtime v0.9.2
 	sigs.k8s.io/yaml v1.2.0
 )