-
Notifications
You must be signed in to change notification settings - Fork 21
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #234 from adishaull/SLK-78181-update-kube-enforcer…
…-opnshift-deploymen-with-the-latest-changes Slk 78181 update kube-enforcer openshift deployment with the latest changes
- Loading branch information
Showing
26 changed files
with
512 additions
and
1,159 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| # Build the manager binary | ||
| FROM golang:1.21 as builder | ||
|
|
||
| WORKDIR /workspace | ||
| # Copy the Go Modules manifests | ||
| COPY go.mod go.mod | ||
| COPY go.sum go.sum | ||
| # cache deps before building and copying source so that we don't need to re-download as much | ||
| # and so that source changes don't invalidate our downloaded layer | ||
| RUN go mod download | ||
|
|
||
| # Copy the go source | ||
| COPY main.go main.go | ||
| COPY apis/ apis/ | ||
| COPY controllers/ controllers/ | ||
| COPY pkg/ pkg/ | ||
|
|
||
| # Install dlv | ||
| RUN go install -mod=readonly github.com/go-delve/delve/cmd/dlv@latest | ||
| ENV GCFLAGS "all=-N -l" | ||
|
|
||
| # Build the Go binary | ||
| RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -gcflags "all=-N -l" -a -o manager main.go | ||
|
|
||
| # Use a separate stage for the final image | ||
| FROM registry.access.redhat.com/ubi9/ubi-minimal:latest | ||
| RUN microdnf install -y wget tar yum findutils gzip && microdnf clean all | ||
| RUN yum install -y glibc golang \ | ||
| && yum update -y glibc golang | ||
|
|
||
| ENV OPERATOR=/usr/local/bin/aqua-operator \ | ||
| USER_UID=1001 \ | ||
| USER_NAME=aqua-operator | ||
|
|
||
| LABEL name="Aqua Operator" \ | ||
| vendor="Aqua Security Software Ltd." \ | ||
| version="v1.0.2" \ | ||
| release="1" \ | ||
| summary="Aqua Security Operator." \ | ||
| description="The Aqua Security Operator runs within a Openshift (or Kubernetes) cluster, and provides a means to deploy and manage the Aqua Security cluster and components" | ||
|
|
||
| WORKDIR / | ||
|
|
||
| COPY licenses /licenses | ||
| COPY --from=builder /workspace/manager . | ||
| COPY --from=builder /go/bin/dlv /usr/bin/ | ||
|
|
||
| USER ${USER_UID} | ||
| ENTRYPOINT ["/manager"] | ||
|
|
||
| ## Set the entrypoint for the container | ||
| ENTRYPOINT ["/usr/bin/dlv", "--listen=:40000", "--headless=true", "--api-version=2", "--accept-multiclient", "exec", "/manager"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -35,7 +35,6 @@ import ( | |
| "k8s.io/apimachinery/pkg/labels" | ||
| "k8s.io/apimachinery/pkg/types" | ||
| "reflect" | ||
| "sigs.k8s.io/controller-runtime/pkg/controller" | ||
| "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil" | ||
| "sigs.k8s.io/controller-runtime/pkg/reconcile" | ||
| "strings" | ||
|
|
@@ -56,17 +55,6 @@ type AquaStarboardReconciler struct { | |
| Scheme *runtime.Scheme | ||
| } | ||
|
|
||
| //+kubebuilder:rbac:groups=aquasecurity.aquasec.com,resources=aquastarboards,verbs=get;list;watch;create;update;patch;delete | ||
| //+kubebuilder:rbac:groups=aquasecurity.aquasec.com,resources=aquastarboards/status,verbs=get;update;patch | ||
| //+kubebuilder:rbac:groups=aquasecurity.aquasec.com,resources=aquastarboards/finalizers,verbs=update | ||
| //+kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch;delete | ||
| //+kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;list;watch;create;update;patch;delete | ||
| //+kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;create;update;patch;delete | ||
| //+kubebuilder:rbac:groups=core,resources=pods,verbs=get;list; | ||
| //+kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete | ||
| //+kubebuilder:rbac:groups=authorization.k8s.io,resources=clusterroles,verbs=get;list;watch;create;update;patch;delete | ||
| //+kubebuilder:rbac:groups=authorization.k8s.io,resources=clusterrolebindings,verbs=get;list;watch;create;update;patch;delete | ||
|
|
||
| // Reconcile is part of the main kubernetes reconciliation loop which aims to | ||
| // move the current state of the cluster closer to the desired state. | ||
| // the AquaStarboard object against the actual cluster state, and then | ||
|
|
@@ -76,6 +64,7 @@ type AquaStarboardReconciler struct { | |
| // For more details, check Reconcile and its Result here: | ||
| // - https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/reconcile | ||
| func (r *AquaStarboardReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) { | ||
| req.NamespacedName.Namespace = extra.GetCurrentNameSpace() | ||
| reqLogger := log.WithValues("Request.Namespace", req.Namespace, "req.Name", req.Name) | ||
| reqLogger.Info("Reconciling AquaStarboard") | ||
|
|
||
|
|
@@ -159,7 +148,6 @@ func (r *AquaStarboardReconciler) Reconcile(ctx context.Context, req ctrl.Reques | |
| func (r *AquaStarboardReconciler) SetupWithManager(mgr ctrl.Manager) error { | ||
| return ctrl.NewControllerManagedBy(mgr). | ||
| Named("AquaStarboard-controller"). | ||
| WithOptions(controller.Options{Reconciler: r}). | ||
| Owns(&corev1.Secret{}). | ||
| Owns(&corev1.ServiceAccount{}). | ||
| Owns(&appsv1.Deployment{}). | ||
|
|
@@ -359,14 +347,13 @@ func (r *AquaStarboardReconciler) addStarboardRole(ro *aquasecurityv1alpha1.Aqua | |
|
|
||
| // Check if this Role already exists | ||
| found := &rbacv1.Role{} | ||
| err := r.Client.Get(context.TODO(), types.NamespacedName{Name: role.Name}, found) | ||
| err := r.Client.Get(context.TODO(), types.NamespacedName{Name: role.Name, Namespace: ro.Namespace}, found) | ||
| if err != nil && errors.IsNotFound(err) { | ||
| reqLogger.Info("Aqua Starboard: Creating a New Role", "Role.Namespace", role.Namespace, "Role.Name", role.Name) | ||
| err = r.Client.Create(context.TODO(), role) | ||
| if err != nil { | ||
| return reconcile.Result{Requeue: true}, nil | ||
| return reconcile.Result{Requeue: true}, err | ||
| } | ||
|
|
||
| return reconcile.Result{}, nil | ||
| } else if err != nil { | ||
| return reconcile.Result{}, err | ||
|
|
@@ -380,20 +367,19 @@ func (r *AquaStarboardReconciler) addStarboardRole(ro *aquasecurityv1alpha1.Aqua | |
| } | ||
|
|
||
| if !equal { | ||
| found = role | ||
| log.Info("Aqua Starboard: Updating Role", "Role.Namespace", found.Namespace, "Role.Name", found.Name) | ||
| found.Rules = role.Rules // Update the existing Role's rules | ||
| reqLogger.Info("Aqua Starboard: Updating Role", "Role.Namespace", found.Namespace, "Role.Name", found.Name) | ||
| err := r.Client.Update(context.TODO(), found) | ||
| if err != nil { | ||
| log.Error(err, "Failed to update Role", "Role.Namespace", found.Namespace, "Role.Name", found.Name) | ||
| reqLogger.Error(err, "Failed to update Role", "Role.Namespace", found.Namespace, "Role.Name", found.Name) | ||
| return reconcile.Result{}, err | ||
| } | ||
|
|
||
| return reconcile.Result{Requeue: true}, nil | ||
| } | ||
|
|
||
| // Role already exists - don't requeue | ||
| // Role already exists and is up-to-date - don't requeue | ||
| reqLogger.Info("Skip reconcile: Aqua Role Exists", "Role.Namespace", found.Namespace, "Role.Name", found.Name) | ||
| return reconcile.Result{Requeue: true}, nil | ||
| return reconcile.Result{}, nil | ||
| } | ||
|
|
||
| func (r *AquaStarboardReconciler) createAquaStarboardServiceAccount(cr *aquasecurityv1alpha1.AquaStarboard) (reconcile.Result, error) { | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.