public_git/kubernetes-operator
1
0
Fork 0
mirror of https://github.com/jenkinsci/kubernetes-operator.git synced 2026-09-30 05:01:10 +02:00
Code Issues Releases Wiki Activity

Adding OpenShift doc

Browse Source
This commit is contained in:
Akram Ben Aissi
2020-04-29 14:47:28 +02:00
parent 83b3fa8cd0
commit 0a57ebb96e
6 changed files with 229 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/controller/jenkins/configuration/base/reconcile_test.go
+24 -4
View File
@@ -767,7 +767,12 @@ func TestEnsureExtraRBAC(t *testing.T) {
Roles: []rbacv1.RoleRef{},
},
}
reconciler := New(configuration.Configuration{Client: fakeClient, Jenkins: jenkins, Scheme: scheme.Scheme}, nil, client.JenkinsAPIConnectionSettings{})
config := configuration.Configuration{
Client: fakeClient,
Jenkins: jenkins,
Scheme: scheme.Scheme,
}
reconciler := New(config, log.Log, client.JenkinsAPIConnectionSettings{})
metaObject := resources.NewResourceObjectMeta(jenkins)
// when
@@ -803,7 +808,12 @@ func TestEnsureExtraRBAC(t *testing.T) {
},
},
}
reconciler := New(configuration.Configuration{Client: fakeClient, Jenkins: jenkins, Scheme: scheme.Scheme}, nil, client.JenkinsAPIConnectionSettings{})
config := configuration.Configuration{
Client: fakeClient,
Jenkins: jenkins,
Scheme: scheme.Scheme,
}
reconciler := New(config, log.Log, client.JenkinsAPIConnectionSettings{})
metaObject := resources.NewResourceObjectMeta(jenkins)
// when
@@ -845,7 +855,12 @@ func TestEnsureExtraRBAC(t *testing.T) {
},
},
}
reconciler := New(configuration.Configuration{Client: fakeClient, Jenkins: jenkins, Scheme: scheme.Scheme}, nil, client.JenkinsAPIConnectionSettings{})
config := configuration.Configuration{
Client: fakeClient,
Jenkins: jenkins,
Scheme: scheme.Scheme,
}
reconciler := New(config, log.Log, client.JenkinsAPIConnectionSettings{})
metaObject := resources.NewResourceObjectMeta(jenkins)
// when
@@ -888,7 +903,12 @@ func TestEnsureExtraRBAC(t *testing.T) {
},
},
}
reconciler := New(configuration.Configuration{Client: fakeClient, Jenkins: jenkins, Scheme: scheme.Scheme}, log.Log, client.JenkinsAPIConnectionSettings{})
config := configuration.Configuration{
Client: fakeClient,
Jenkins: jenkins,
Scheme: scheme.Scheme,
}
reconciler := New(config, log.Log, client.JenkinsAPIConnectionSettings{})
metaObject := resources.NewResourceObjectMeta(jenkins)
// when
pkg/controller/jenkins/configuration/base/resources/rbac.go
+27 -25
View File
@@ -6,17 +6,19 @@ import (
)
const (
createVerb = "create"
deleteVerb = "delete"
getVerb = "get"
listVerb = "list"
watchVerb = "watch"
patchVerb = "patch"
updateVerb = "update"
EmptyApiGroups = ""
OpenshiftApiGroup = "image.openshift.io"
BuildApiGroup = "build.openshift.io"
createVerb = "create"
deleteVerb = "delete"
getVerb = "get"
listVerb = "list"
watchVerb = "watch"
patchVerb = "patch"
updateVerb = "update"
//EmptyAPIGroup short hand for the empty API group while defining policies
EmptyAPIGroup = ""
//OpenshiftAPIGroup the openshift api group name
OpenshiftAPIGroup = "image.openshift.io"
//BuildAPIGroup the openshift api group name for builds
BuildAPIGroup = "build.openshift.io"
)
// NewRole returns rbac role for jenkins master
@@ -54,22 +56,23 @@ func NewRoleBinding(name, namespace, serviceAccountName string, roleRef v1.RoleR
}
}
// NewDefaultPolicyRules sets the default policy rules
func NewDefaultPolicyRules() []v1.PolicyRule {
var rules []v1.PolicyRule
ReadOnly := []string{getVerb, listVerb, watchVerb}
Default := []string{createVerb, deleteVerb, getVerb, listVerb, patchVerb, updateVerb, watchVerb}
Create := []string{createVerb}
Default := []string{createVerb, deleteVerb, getVerb, listVerb, patchVerb, updateVerb, watchVerb}
Create := []string{createVerb}
rules = append(rules, NewPolicyRule(EmptyApiGroups, "pods/portforward", Create))
rules = append(rules, NewPolicyRule(EmptyApiGroups, "pods", Default))
rules = append(rules, NewPolicyRule(EmptyApiGroups, "pods/exec", Default))
rules = append(rules, NewPolicyRule(EmptyApiGroups, "configmaps", ReadOnly))
rules = append(rules, NewPolicyRule(EmptyApiGroups, "pods/log", ReadOnly))
rules = append(rules, NewPolicyRule(EmptyApiGroups, "secrets", ReadOnly))
rules = append(rules, NewPolicyRule(EmptyAPIGroup, "pods/portforward", Create))
rules = append(rules, NewPolicyRule(EmptyAPIGroup, "pods", Default))
rules = append(rules, NewPolicyRule(EmptyAPIGroup, "pods/exec", Default))
rules = append(rules, NewPolicyRule(EmptyAPIGroup, "configmaps", ReadOnly))
rules = append(rules, NewPolicyRule(EmptyAPIGroup, "pods/log", ReadOnly))
rules = append(rules, NewPolicyRule(EmptyAPIGroup, "secrets", ReadOnly))
rules = append(rules, NewOpenShiftPolicyRule(OpenshiftApiGroup, "imagestreams", ReadOnly))
rules = append(rules, NewOpenShiftPolicyRule(BuildApiGroup, "buildconfigs", ReadOnly))
rules = append(rules, NewOpenShiftPolicyRule(BuildApiGroup, "builds", ReadOnly))
rules = append(rules, NewOpenShiftPolicyRule(OpenshiftAPIGroup, "imagestreams", ReadOnly))
rules = append(rules, NewOpenShiftPolicyRule(BuildAPIGroup, "buildconfigs", ReadOnly))
rules = append(rules, NewOpenShiftPolicyRule(BuildAPIGroup, "builds", ReadOnly))
return rules
}
@@ -84,8 +87,7 @@ func NewPolicyRule(apiGroup string, resource string, verbs []string) v1.PolicyRu
return rule
}
// NewPolicyRule returns a policyRule allowing verbs on resources
// NewOpenShiftPolicyRule returns a policyRule allowing verbs on resources
func NewOpenShiftPolicyRule(apiGroup string, resource string, verbs []string) v1.PolicyRule {
return NewPolicyRule(apiGroup,resource,verbs)
return NewPolicyRule(apiGroup, resource, verbs)
}
pkg/controller/jenkins/configuration/base/serviceaccount.go
+8 -3
View File
@@ -2,8 +2,10 @@ package base
import (
"context"
"fmt"
"github.com/jenkinsci/kubernetes-operator/pkg/controller/jenkins/configuration/base/resources"
"github.com/jenkinsci/kubernetes-operator/pkg/log"
stackerr "github.com/pkg/errors"
corev1 "k8s.io/api/core/v1"
@@ -15,8 +17,11 @@ import (
func (r *ReconcileJenkinsBaseConfiguration) createServiceAccount(meta metav1.ObjectMeta) error {
serviceAccount := &corev1.ServiceAccount{}
err := r.Client.Get(context.TODO(), types.NamespacedName{Name: meta.Name, Namespace: meta.Namespace}, serviceAccount)
annotations := r.Configuration.Jenkins.Spec.ServiceAccount.Annotations
msg := fmt.Sprintf("createServiceAccount with annotations %v", annotations)
r.logger.V(log.VDebug).Info(msg)
if err != nil && apierrors.IsNotFound(err) {
serviceAccount = resources.NewServiceAccount(meta, r.Configuration.Jenkins.Spec.ServiceAccount.Annotations)
serviceAccount = resources.NewServiceAccount(meta, annotations)
if err = r.CreateResource(serviceAccount); err != nil {
return stackerr.WithStack(err)
}
@@ -24,11 +29,11 @@ func (r *ReconcileJenkinsBaseConfiguration) createServiceAccount(meta metav1.Obj
return stackerr.WithStack(err)
}
if !compareMap(r.Configuration.Jenkins.Spec.ServiceAccount.Annotations, serviceAccount.Annotations) {
if !compareMap(annotations, serviceAccount.Annotations) {
if serviceAccount.Annotations == nil {
serviceAccount.Annotations = map[string]string{}
}
for key, value := range r.Configuration.Jenkins.Spec.ServiceAccount.Annotations {
for key, value := range annotations {
serviceAccount.Annotations[key] = value
}
if err = r.UpdateResource(serviceAccount); err != nil {