Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BUILD-260: auto provision tekton via tekton operator if necessary #18

Merged
merged 2 commits into from
Sep 3, 2021
Merged

BUILD-260: auto provision tekton via tekton operator if necessary #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7b73008
bump(*) tektoncd/operator,k8s CRD,k8a unit test
gabemontero Aug 24, 2021
e5f838b
add tekton dependency in operator fw clusterserviceversion; make bundle
gabemontero Aug 24, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
10 changes: 3 additions & 7 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,13 +13,6 @@ To deploy and manage instances of [Shipwright Build-Controller][build-controller
operator is up-and-running, and then create the following:

```yml
---
apiVersion: v1
kind: Namespace
metadata:
name: shipwright-build
spec: {}

---
apiVersion: operator.shipwright.io/v1alpha1
kind: ShipwrightBuild
Expand All @@ -34,4 +27,7 @@ It will deploy the Build-Controller in `shipwright-build` namespace. When `.spec
set, it will use the `shipwright-build` namespace, this namespace needs to be created before the
actual deployment takes place.

It will also ensure Tekton is sufficient installed at the required level if the minimally required version
of the [Tekton Operator](https://github.com/tektoncd/operator) is installed on the cluster.

[build-controller]: https://github.com/shipwright-io/build
28 changes: 28 additions & 0 deletions bundle/manifests/operator.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,10 @@ spec:
kind: ShipwrightBuild
name: shipwrightbuilds.operator.shipwright.io
version: v1alpha1
required:
- kind: TektonConfig
name: tektonconfigs.operator.tekton.dev
version: v1alpha1
description: Install Shipwright Builds on your Kubernetes cluster
displayName: Shipwright Operator
icon:
Expand Down Expand Up @@ -199,6 +203,18 @@ spec:
- patch
- update
- watch
- apiGroups:
- ""
resources:
- namespaces
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- authentication.k8s.io
resources:
Expand All @@ -211,6 +227,18 @@ spec:
- subjectaccessreviews
verbs:
- create
- apiGroups:
- operator.tekton.dev
resources:
- tektonconfigs
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
serviceAccountName: default
deployments:
- name: operator-controller-manager
Expand Down
22 changes: 19 additions & 3 deletions cmd/operator/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,13 +13,16 @@ import (
_ "k8s.io/client-go/plugin/pkg/client/auth"

apiextv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
crdclientv1 "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1"
"k8s.io/apimachinery/pkg/runtime"
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/healthz"
"sigs.k8s.io/controller-runtime/pkg/log/zap"

tektonoperatorv1alpha1client "github.com/tektoncd/operator/pkg/client/clientset/versioned/typed/operator/v1alpha1"

operatorv1alpha1 "github.com/shipwright-io/operator/api/v1alpha1"
"github.com/shipwright-io/operator/controllers"
// +kubebuilder:scaffold:imports
Expand Down Expand Up @@ -79,10 +82,23 @@ func main() {
os.Exit(1)
}

crdClient, err := crdclientv1.NewForConfig(mgr.GetConfig())
if err != nil {
setupLog.Error(err, "unable to get crd client")
os.Exit(1)
}
tektonOperatorClient, err := tektonoperatorv1alpha1client.NewForConfig(mgr.GetConfig())
if err != nil {
setupLog.Error(err, "unable to get tekton operator client")
os.Exit(1)
}

if err = (&controllers.ShipwrightBuildReconciler{
Client: mgr.GetClient(),
Scheme: mgr.GetScheme(),
Logger: ctrl.Log.WithName("controllers").WithName("ShipwrightBuild"),
CRDClient: crdClient,
TektonOperatorClient: tektonOperatorClient,
Client: mgr.GetClient(),
Scheme: mgr.GetScheme(),
Logger: ctrl.Log.WithName("controllers").WithName("ShipwrightBuild"),
}).SetupWithManager(mgr); err != nil {
setupLog.Error(err, "unable to create controller", "controller", "ShipwrightBuild")
os.Exit(1)
Expand Down
4 changes: 4 additions & 0 deletions config/manifests/bases/operator.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,10 @@ spec:
kind: ShipwrightBuild
name: shipwrightbuilds.operator.shipwright.io
version: v1alpha1
required:
- kind: TektonConfig
name: tektonconfigs.operator.tekton.dev
version: v1alpha1
description: Install Shipwright Builds on your Kubernetes cluster
displayName: Shipwright Operator
icon:
Expand Down
4 changes: 4 additions & 0 deletions config/rbac/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@ resources:
- role_binding.yaml
- leader_election_role.yaml
- leader_election_role_binding.yaml
- tektonconfig_operator_role.yaml
- tektonconfig_operator_rolebinding.yaml
- namespace_role.yaml
- namespace_rolebinding.yaml
# Comment the following 4 lines if you want to disable
# the auth proxy (https://github.com/brancz/kube-rbac-proxy)
# which protects your /metrics endpoint.
Expand Down
18 changes: 18 additions & 0 deletions config/rbac/namespace_role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: namespace-role
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@otaviof I think our CI didn't catch this because we aren't testing on a "real" cluster yet.

rules:
- apiGroups:
- ""
resources:
- namespaces
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
12 changes: 12 additions & 0 deletions config/rbac/namespace_rolebinding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: namespace-rolebinding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: namespace-role
subjects:
- kind: ServiceAccount
name: default
namespace: system
17 changes: 17 additions & 0 deletions config/rbac/tektonconfig_operator_role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: tektonconfig-operator-role
rules:
- apiGroups:
- operator.tekton.dev
resources:
- tektonconfigs
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
12 changes: 12 additions & 0 deletions config/rbac/tektonconfig_operator_rolebinding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: tektonconfig-operator-rolebinding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: tektonconfig-operator-role
subjects:
- kind: ServiceAccount
name: default
namespace: system
Comment on lines +10 to +12
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Binding to the default system service account? Don't we want to bind to the operator's SA?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

there was no operator SA previously created in this repo nor in the tekton operator repo

See the tekton deployment (no SA specified): https://github.com/tektoncd/operator/blob/937dea56d9ed6011b1b3c8de4ed43c1cc4cba38b/config/kubernetes/operator.yaml
and
https://github.com/tektoncd/operator/blob/937dea56d9ed6011b1b3c8de4ed43c1cc4cba38b/config/openshift/operator.yaml

https://github.com/shipwright-io/operator/blob/main/config/manager/manager.yaml

I took adding an SA as out of scope for this particular Jira

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok @adambkaplan and I talked in office hours ... when I looked at the file, saw I merged tekton operator vs. ours

now, we are currently following the tekton operator's conversion of using the default SA in the system namespace

@adambkaplan and I agreed we won't change things with this PR. But he will be opening upstream issues / Jira's for the future work cited in this PR, and created a non-default SA for our operator will be one of those items.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Filed #19

Loading