|
1 | 1 | package convert
|
2 | 2 |
|
3 | 3 | import (
|
4 |
| - "cmp" |
5 |
| - "fmt" |
6 |
| - "strings" |
| 4 | + "cmp" |
| 5 | + "fmt" |
| 6 | + "strings" |
7 | 7 |
|
8 |
| - corev1 "k8s.io/api/core/v1" |
9 |
| - rbacv1 "k8s.io/api/rbac/v1" |
10 |
| - "k8s.io/apimachinery/pkg/util/sets" |
11 |
| - "k8s.io/utils/ptr" |
12 |
| - "sigs.k8s.io/controller-runtime/pkg/client" |
| 8 | + corev1 "k8s.io/api/core/v1" |
| 9 | + rbacv1 "k8s.io/api/rbac/v1" |
| 10 | + "k8s.io/apimachinery/pkg/util/sets" |
| 11 | + "k8s.io/utils/ptr" |
| 12 | + "sigs.k8s.io/controller-runtime/pkg/client" |
13 | 13 |
|
14 |
| - registrybundle "github.com/operator-framework/operator-registry/pkg/lib/bundle" |
| 14 | + registrybundle "github.com/operator-framework/operator-registry/pkg/lib/bundle" |
15 | 15 |
|
16 |
| - "github.com/operator-framework/operator-controller/internal/operator-controller/rukpak/util" |
| 16 | + "github.com/operator-framework/operator-controller/internal/operator-controller/rukpak/util" |
17 | 17 | )
|
18 | 18 |
|
19 | 19 | type UniqueNameGenerator func(string, interface{}) (string, error)
|
20 | 20 |
|
21 | 21 | type Options struct {
|
22 |
| - InstallNamespace string |
23 |
| - TargetNamespaces []string |
24 |
| - UniqueNameGenerator UniqueNameGenerator |
| 22 | + InstallNamespace string |
| 23 | + TargetNamespaces []string |
| 24 | + UniqueNameGenerator UniqueNameGenerator |
25 | 25 | }
|
26 | 26 |
|
27 | 27 | type ResourceGenerator func(rv1 *RegistryV1, opts Options) ([]client.Object, error)
|
28 | 28 |
|
29 | 29 | func (g ResourceGenerator) GenerateResources(rv1 *RegistryV1, opts Options) ([]client.Object, error) {
|
30 |
| - return g(rv1, opts) |
| 30 | + return g(rv1, opts) |
31 | 31 | }
|
32 | 32 |
|
33 | 33 | func ChainedResourceGenerator(resourceGenerators ...ResourceGenerator) ResourceGenerator {
|
34 |
| - return func(rv1 *RegistryV1, opts Options) ([]client.Object, error) { |
35 |
| - //nolint:prealloc |
36 |
| - var renderedObjects []client.Object |
37 |
| - for _, generator := range resourceGenerators { |
38 |
| - objs, err := generator(rv1, opts) |
39 |
| - if err != nil { |
40 |
| - return nil, err |
41 |
| - } |
42 |
| - renderedObjects = append(renderedObjects, objs...) |
43 |
| - } |
44 |
| - return renderedObjects, nil |
45 |
| - } |
| 34 | + return func(rv1 *RegistryV1, opts Options) ([]client.Object, error) { |
| 35 | + //nolint:prealloc |
| 36 | + var renderedObjects []client.Object |
| 37 | + for _, generator := range resourceGenerators { |
| 38 | + objs, err := generator(rv1, opts) |
| 39 | + if err != nil { |
| 40 | + return nil, err |
| 41 | + } |
| 42 | + renderedObjects = append(renderedObjects, objs...) |
| 43 | + } |
| 44 | + return renderedObjects, nil |
| 45 | + } |
46 | 46 | }
|
47 | 47 |
|
48 | 48 | func BundleDeploymentGenerator(rv1 *RegistryV1, opts Options) ([]client.Object, error) {
|
49 |
| - objs := make([]client.Object, 0, len(rv1.CSV.Spec.InstallStrategy.StrategySpec.DeploymentSpecs)) |
50 |
| - for _, depSpec := range rv1.CSV.Spec.InstallStrategy.StrategySpec.DeploymentSpecs { |
51 |
| - annotations := util.MergeMaps(rv1.CSV.Annotations, depSpec.Spec.Template.Annotations) |
52 |
| - annotations["olm.targetNamespaces"] = strings.Join(opts.TargetNamespaces, ",") |
53 |
| - depSpec.Spec.Template.Annotations = annotations |
54 |
| - |
55 |
| - // Hardcode the deployment with RevisionHistoryLimit=1 (something OLMv0 does, not sure why) |
56 |
| - depSpec.Spec.RevisionHistoryLimit = ptr.To(int32(1)) |
57 |
| - |
58 |
| - objs = append(objs, |
59 |
| - GenerateDeploymentResource( |
60 |
| - depSpec.Name, |
61 |
| - opts.InstallNamespace, |
62 |
| - WithDeploymentSpec(depSpec.Spec), |
63 |
| - WithLabels(depSpec.Label), |
64 |
| - ), |
65 |
| - ) |
66 |
| - } |
67 |
| - return objs, nil |
| 49 | + if rv1 == nil { |
| 50 | + return nil, fmt.Errorf("bundle cannot be nil") |
| 51 | + } |
| 52 | + objs := make([]client.Object, 0, len(rv1.CSV.Spec.InstallStrategy.StrategySpec.DeploymentSpecs)) |
| 53 | + for _, depSpec := range rv1.CSV.Spec.InstallStrategy.StrategySpec.DeploymentSpecs { |
| 54 | + annotations := util.MergeMaps(rv1.CSV.Annotations, depSpec.Spec.Template.Annotations) |
| 55 | + annotations["olm.targetNamespaces"] = strings.Join(opts.TargetNamespaces, ",") |
| 56 | + depSpec.Spec.Template.Annotations = annotations |
| 57 | + |
| 58 | + // Hardcode the deployment with RevisionHistoryLimit=1 (something OLMv0 does, not sure why) |
| 59 | + depSpec.Spec.RevisionHistoryLimit = ptr.To(int32(1)) |
| 60 | + |
| 61 | + objs = append(objs, |
| 62 | + GenerateDeploymentResource( |
| 63 | + depSpec.Name, |
| 64 | + opts.InstallNamespace, |
| 65 | + WithDeploymentSpec(depSpec.Spec), |
| 66 | + WithLabels(depSpec.Label), |
| 67 | + ), |
| 68 | + ) |
| 69 | + } |
| 70 | + return objs, nil |
68 | 71 | }
|
69 | 72 |
|
70 | 73 | func BundlePermissionsGenerator(rv1 *RegistryV1, opts Options) ([]client.Object, error) {
|
71 |
| - permissions := rv1.CSV.Spec.InstallStrategy.StrategySpec.Permissions |
72 |
| - |
73 |
| - // If we're in AllNamespaces mode permissions will be treated as clusterPermissions |
74 |
| - if len(opts.TargetNamespaces) == 1 && opts.TargetNamespaces[0] == "" { |
75 |
| - return nil, nil |
76 |
| - } |
77 |
| - |
78 |
| - objs := make([]client.Object, 0, 2*len(opts.TargetNamespaces)*len(permissions)) |
79 |
| - for _, ns := range opts.TargetNamespaces { |
80 |
| - for _, permission := range permissions { |
81 |
| - saName := saNameOrDefault(permission.ServiceAccountName) |
82 |
| - name, err := opts.UniqueNameGenerator(fmt.Sprintf("%s-%s", rv1.CSV.Name, saName), permission) |
83 |
| - if err != nil { |
84 |
| - return nil, err |
85 |
| - } |
86 |
| - |
87 |
| - objs = append(objs, |
88 |
| - GenerateRoleResource(name, ns, WithRules(permission.Rules...)), |
89 |
| - GenerateRoleBindingResource( |
90 |
| - name, |
91 |
| - ns, |
92 |
| - WithSubjects(rbacv1.Subject{Kind: "ServiceAccount", Namespace: opts.InstallNamespace, Name: saName}), |
93 |
| - WithRoleRef(rbacv1.RoleRef{APIGroup: rbacv1.GroupName, Kind: "Role", Name: name}), |
94 |
| - ), |
95 |
| - ) |
96 |
| - } |
97 |
| - } |
98 |
| - return objs, nil |
| 74 | + if rv1 == nil { |
| 75 | + return nil, fmt.Errorf("bundle cannot be nil") |
| 76 | + } |
| 77 | + |
| 78 | + // If we're in AllNamespaces mode permissions will be treated as clusterPermissions |
| 79 | + if len(opts.TargetNamespaces) == 1 && opts.TargetNamespaces[0] == "" { |
| 80 | + return nil, nil |
| 81 | + } |
| 82 | + |
| 83 | + permissions := rv1.CSV.Spec.InstallStrategy.StrategySpec.Permissions |
| 84 | + |
| 85 | + objs := make([]client.Object, 0, 2*len(opts.TargetNamespaces)*len(permissions)) |
| 86 | + for _, ns := range opts.TargetNamespaces { |
| 87 | + for _, permission := range permissions { |
| 88 | + saName := saNameOrDefault(permission.ServiceAccountName) |
| 89 | + name, err := opts.UniqueNameGenerator(fmt.Sprintf("%s-%s", rv1.CSV.Name, saName), permission) |
| 90 | + if err != nil { |
| 91 | + return nil, err |
| 92 | + } |
| 93 | + |
| 94 | + objs = append(objs, |
| 95 | + GenerateRoleResource(name, ns, WithRules(permission.Rules...)), |
| 96 | + GenerateRoleBindingResource( |
| 97 | + name, |
| 98 | + ns, |
| 99 | + WithSubjects(rbacv1.Subject{Kind: "ServiceAccount", Namespace: opts.InstallNamespace, Name: saName}), |
| 100 | + WithRoleRef(rbacv1.RoleRef{APIGroup: rbacv1.GroupName, Kind: "Role", Name: name}), |
| 101 | + ), |
| 102 | + ) |
| 103 | + } |
| 104 | + } |
| 105 | + return objs, nil |
99 | 106 | }
|
100 | 107 |
|
101 | 108 | func BundleClusterPermissionsGenerator(rv1 *RegistryV1, opts Options) ([]client.Object, error) {
|
102 |
| - clusterPermissions := rv1.CSV.Spec.InstallStrategy.StrategySpec.ClusterPermissions |
103 |
| - |
104 |
| - // If we're in AllNamespaces mode, promote the permissions to clusterPermissions |
105 |
| - if len(opts.TargetNamespaces) == 1 && opts.TargetNamespaces[0] == "" { |
106 |
| - for _, p := range rv1.CSV.Spec.InstallStrategy.StrategySpec.Permissions { |
107 |
| - p.Rules = append(p.Rules, rbacv1.PolicyRule{ |
108 |
| - Verbs: []string{"get", "list", "watch"}, |
109 |
| - APIGroups: []string{corev1.GroupName}, |
110 |
| - Resources: []string{"namespaces"}, |
111 |
| - }) |
112 |
| - clusterPermissions = append(clusterPermissions, p) |
113 |
| - } |
114 |
| - } |
115 |
| - |
116 |
| - objs := make([]client.Object, 0, 2*len(clusterPermissions)) |
117 |
| - for _, permission := range clusterPermissions { |
118 |
| - saName := saNameOrDefault(permission.ServiceAccountName) |
119 |
| - name, err := opts.UniqueNameGenerator(fmt.Sprintf("%s-%s", rv1.CSV.Name, saName), permission) |
120 |
| - if err != nil { |
121 |
| - return nil, err |
122 |
| - } |
123 |
| - objs = append(objs, |
124 |
| - GenerateClusterRoleResource(name, WithRules(permission.Rules...)), |
125 |
| - GenerateClusterRoleBindingResource( |
126 |
| - name, |
127 |
| - WithSubjects(rbacv1.Subject{Kind: "ServiceAccount", Namespace: opts.InstallNamespace, Name: saName}), |
128 |
| - WithRoleRef(rbacv1.RoleRef{APIGroup: rbacv1.GroupName, Kind: "ClusterRole", Name: name}), |
129 |
| - ), |
130 |
| - ) |
131 |
| - } |
132 |
| - return objs, nil |
| 109 | + if rv1 == nil { |
| 110 | + return nil, fmt.Errorf("bundle cannot be nil") |
| 111 | + } |
| 112 | + clusterPermissions := rv1.CSV.Spec.InstallStrategy.StrategySpec.ClusterPermissions |
| 113 | + |
| 114 | + // If we're in AllNamespaces mode, promote the permissions to clusterPermissions |
| 115 | + if len(opts.TargetNamespaces) == 1 && opts.TargetNamespaces[0] == "" { |
| 116 | + for _, p := range rv1.CSV.Spec.InstallStrategy.StrategySpec.Permissions { |
| 117 | + p.Rules = append(p.Rules, rbacv1.PolicyRule{ |
| 118 | + Verbs: []string{"get", "list", "watch"}, |
| 119 | + APIGroups: []string{corev1.GroupName}, |
| 120 | + Resources: []string{"namespaces"}, |
| 121 | + }) |
| 122 | + clusterPermissions = append(clusterPermissions, p) |
| 123 | + } |
| 124 | + } |
| 125 | + |
| 126 | + objs := make([]client.Object, 0, 2*len(clusterPermissions)) |
| 127 | + for _, permission := range clusterPermissions { |
| 128 | + saName := saNameOrDefault(permission.ServiceAccountName) |
| 129 | + name, err := opts.UniqueNameGenerator(fmt.Sprintf("%s-%s", rv1.CSV.Name, saName), permission) |
| 130 | + if err != nil { |
| 131 | + return nil, err |
| 132 | + } |
| 133 | + objs = append(objs, |
| 134 | + GenerateClusterRoleResource(name, WithRules(permission.Rules...)), |
| 135 | + GenerateClusterRoleBindingResource( |
| 136 | + name, |
| 137 | + WithSubjects(rbacv1.Subject{Kind: "ServiceAccount", Namespace: opts.InstallNamespace, Name: saName}), |
| 138 | + WithRoleRef(rbacv1.RoleRef{APIGroup: rbacv1.GroupName, Kind: "ClusterRole", Name: name}), |
| 139 | + ), |
| 140 | + ) |
| 141 | + } |
| 142 | + return objs, nil |
133 | 143 | }
|
134 | 144 |
|
135 | 145 | func BundleServiceAccountGenerator(rv1 *RegistryV1, opts Options) ([]client.Object, error) {
|
136 |
| - allPermissions := append( |
137 |
| - rv1.CSV.Spec.InstallStrategy.StrategySpec.Permissions, |
138 |
| - rv1.CSV.Spec.InstallStrategy.StrategySpec.ClusterPermissions..., |
139 |
| - ) |
140 |
| - |
141 |
| - serviceAccountNames := sets.Set[string]{} |
142 |
| - for _, permission := range allPermissions { |
143 |
| - serviceAccountNames.Insert(saNameOrDefault(permission.ServiceAccountName)) |
144 |
| - } |
145 |
| - |
146 |
| - objs := make([]client.Object, 0, len(serviceAccountNames)) |
147 |
| - for _, serviceAccountName := range serviceAccountNames.UnsortedList() { |
148 |
| - // no need to generate the default service account |
149 |
| - if serviceAccountName != "default" { |
150 |
| - objs = append(objs, GenerateServiceAccountResource(serviceAccountName, opts.InstallNamespace)) |
151 |
| - } |
152 |
| - } |
153 |
| - return objs, nil |
| 146 | + if rv1 == nil { |
| 147 | + return nil, fmt.Errorf("bundle cannot be nil") |
| 148 | + } |
| 149 | + allPermissions := append( |
| 150 | + rv1.CSV.Spec.InstallStrategy.StrategySpec.Permissions, |
| 151 | + rv1.CSV.Spec.InstallStrategy.StrategySpec.ClusterPermissions..., |
| 152 | + ) |
| 153 | + |
| 154 | + serviceAccountNames := sets.Set[string]{} |
| 155 | + for _, permission := range allPermissions { |
| 156 | + serviceAccountNames.Insert(saNameOrDefault(permission.ServiceAccountName)) |
| 157 | + } |
| 158 | + |
| 159 | + objs := make([]client.Object, 0, len(serviceAccountNames)) |
| 160 | + for _, serviceAccountName := range serviceAccountNames.UnsortedList() { |
| 161 | + // no need to generate the default service account |
| 162 | + if serviceAccountName != "default" { |
| 163 | + objs = append(objs, GenerateServiceAccountResource(serviceAccountName, opts.InstallNamespace)) |
| 164 | + } |
| 165 | + } |
| 166 | + return objs, nil |
154 | 167 | }
|
155 | 168 |
|
156 | 169 | func BundleCRDGenerator(rv1 *RegistryV1, _ Options) ([]client.Object, error) {
|
157 |
| - objs := make([]client.Object, 0, len(rv1.CRDs)) |
158 |
| - for _, crd := range rv1.CRDs { |
159 |
| - objs = append(objs, crd.DeepCopy()) |
160 |
| - } |
161 |
| - return objs, nil |
| 170 | + if rv1 == nil { |
| 171 | + return nil, fmt.Errorf("bundle cannot be nil") |
| 172 | + } |
| 173 | + objs := make([]client.Object, 0, len(rv1.CRDs)) |
| 174 | + for _, crd := range rv1.CRDs { |
| 175 | + objs = append(objs, crd.DeepCopy()) |
| 176 | + } |
| 177 | + return objs, nil |
162 | 178 | }
|
163 | 179 |
|
164 | 180 | func BundleAdditionalResourcesGenerator(rv1 *RegistryV1, opts Options) ([]client.Object, error) {
|
165 |
| - objs := make([]client.Object, 0, len(rv1.Others)) |
166 |
| - for _, res := range rv1.Others { |
167 |
| - supported, namespaced := registrybundle.IsSupported(res.GetKind()) |
168 |
| - if !supported { |
169 |
| - return nil, fmt.Errorf("bundle contains unsupported resource: Name: %v, Kind: %v", res.GetName(), res.GetKind()) |
170 |
| - } |
171 |
| - |
172 |
| - obj := res.DeepCopy() |
173 |
| - if namespaced { |
174 |
| - obj.SetNamespace(opts.InstallNamespace) |
175 |
| - } |
176 |
| - |
177 |
| - objs = append(objs, obj) |
178 |
| - } |
179 |
| - return objs, nil |
| 181 | + if rv1 == nil { |
| 182 | + return nil, fmt.Errorf("bundle cannot be nil") |
| 183 | + } |
| 184 | + objs := make([]client.Object, 0, len(rv1.Others)) |
| 185 | + for _, res := range rv1.Others { |
| 186 | + supported, namespaced := registrybundle.IsSupported(res.GetKind()) |
| 187 | + if !supported { |
| 188 | + return nil, fmt.Errorf("bundle contains unsupported resource: Name: %v, Kind: %v", res.GetName(), res.GetKind()) |
| 189 | + } |
| 190 | + |
| 191 | + obj := res.DeepCopy() |
| 192 | + if namespaced { |
| 193 | + obj.SetNamespace(opts.InstallNamespace) |
| 194 | + } |
| 195 | + |
| 196 | + objs = append(objs, obj) |
| 197 | + } |
| 198 | + return objs, nil |
180 | 199 | }
|
181 | 200 |
|
182 | 201 | func saNameOrDefault(saName string) string {
|
183 |
| - return cmp.Or(saName, "default") |
| 202 | + return cmp.Or(saName, "default") |
184 | 203 | }
|
0 commit comments