Skip to content

Commit c6649a2

Browse files
mprycmpryc
committed
Updated rbac based on the vmfr project
Updated CRDs based on the: migtools/oadp-vm-file-restore#54 Signed-off-by: Michal Pryc <mpryc@redhat.com>
1 parent f8b06e8 commit c6649a2

File tree

38 files changed

+955
-41
lines changed

38 files changed

+955
-41
lines changed

‎Makefile‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -907,6 +907,34 @@ endif
907907
$(SED) -i "s%resources:%resources:\n- $$file_name%" $(shell pwd)/config/samples/kustomization.yaml;done
908908
@make bundle
909909

910+
.PHONY: update-vmfr-manifests
911+
update-vmfr-manifests: VMFR_CONTROLLER_IMG?=quay.io/konveyor/oadp-vm-file-restore:latest
912+
update-vmfr-manifests: VMFR_ACCESS_IMG?=quay.io/konveyor/oadp-vmfr-access:latest
913+
update-vmfr-manifests: VMFR_SSH_IMG?=quay.io/konveyor/oadp-vmfr-access-sshd:latest
914+
update-vmfr-manifests: VMFR_BROWSER_IMG?=quay.io/konveyor/oadp-vmfr-access-filebrowser:latest
915+
update-vmfr-manifests: yq ## Update VM File Restore (VMFR) manifests shipped with OADP, from VMFR_CONTROLLER_PATH
916+
ifeq ($(VMFR_CONTROLLER_PATH),)
917+
$(error You must set VMFR_CONTROLLER_PATH to run this command)
918+
endif
919+
@for file_name in $(shell ls $(VMFR_CONTROLLER_PATH)/config/crd/bases);do \
920+
cp $(VMFR_CONTROLLER_PATH)/config/crd/bases/$$file_name $(shell pwd)/config/crd/bases/$$file_name && \
921+
grep -q "\- bases/$$file_name" $(shell pwd)/config/crd/kustomization.yaml || \
922+
$(SED) -i "s%resources:%resources:\n- bases/$$file_name%" $(shell pwd)/config/crd/kustomization.yaml;done
923+
$(YQ) -i 'select(.kind == "Deployment")|= .spec.template.spec.containers[0].env |= .[] |= select(.name == "RELATED_IMAGE_VM_FILE_RESTORE_CONTROLLER") |= .value="$(VMFR_CONTROLLER_IMG)"' config/manager/manager.yaml
924+
$(YQ) -i 'select(.kind == "Deployment")|= .spec.template.spec.containers[0].env |= .[] |= select(.name == "RELATED_IMAGE_VM_FILE_RESTORE_ACCESS") |= .value="$(VMFR_ACCESS_IMG)"' config/manager/manager.yaml
925+
$(YQ) -i 'select(.kind == "Deployment")|= .spec.template.spec.containers[0].env |= .[] |= select(.name == "RELATED_IMAGE_VM_FILE_RESTORE_SSH") |= .value="$(VMFR_SSH_IMG)"' config/manager/manager.yaml
926+
$(YQ) -i 'select(.kind == "Deployment")|= .spec.template.spec.containers[0].env |= .[] |= select(.name == "RELATED_IMAGE_VM_FILE_RESTORE_BROWSER") |= .value="$(VMFR_BROWSER_IMG)"' config/manager/manager.yaml
927+
@mkdir -p $(shell pwd)/config/vm-file-restore-controller_rbac
928+
@for file_name in $(shell grep -I '^\-' $(VMFR_CONTROLLER_PATH)/config/rbac/kustomization.yaml | awk -F'- ' '{print $$2}');do \
929+
cp $(VMFR_CONTROLLER_PATH)/config/rbac/$$file_name $(shell pwd)/config/vm-file-restore-controller_rbac/$$file_name;done
930+
@cp $(VMFR_CONTROLLER_PATH)/config/rbac/kustomization.yaml $(shell pwd)/config/vm-file-restore-controller_rbac/kustomization.yaml
931+
@$(SED) -i '1i namePrefix: oadp-vm-file-restore-' $(shell pwd)/config/vm-file-restore-controller_rbac/kustomization.yaml
932+
@for file_name in $(shell grep -I '^\-' $(VMFR_CONTROLLER_PATH)/config/samples/kustomization.yaml | awk -F'- ' '{print $$2}');do \
933+
cp $(VMFR_CONTROLLER_PATH)/config/samples/$$file_name $(shell pwd)/config/samples/$$file_name && \
934+
grep -q "\- $$file_name" $(shell pwd)/config/samples/kustomization.yaml || \
935+
$(SED) -i "s%resources:%resources:\n- $$file_name%" $(shell pwd)/config/samples/kustomization.yaml;done
936+
@make bundle
937+
910938
.PHONY: build-must-gather
911939
build-must-gather: check-go ## Build OADP Must-gather binary must-gather/oadp-must-gather
912940
ifeq ($(SKIP_MUST_GATHER),true)

‎bundle/manifests/controller-manager_v1_serviceaccount.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
creationTimestamp: null
5+
labels:
6+
app.kubernetes.io/managed-by: kustomize
7+
app.kubernetes.io/name: oadp-vm-file-restore
8+
name: controller-manager

‎bundle/manifests/leader-election-role_rbac.authorization.k8s.io_v1_role.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: Role
3+
metadata:
4+
creationTimestamp: null
5+
labels:
6+
app.kubernetes.io/managed-by: kustomize
7+
app.kubernetes.io/name: oadp-vm-file-restore
8+
name: leader-election-role
9+
rules:
10+
- apiGroups:
11+
- ""
12+
resources:
13+
- configmaps
14+
verbs:
15+
- get
16+
- list
17+
- watch
18+
- create
19+
- update
20+
- patch
21+
- delete
22+
- apiGroups:
23+
- coordination.k8s.io
24+
resources:
25+
- leases
26+
verbs:
27+
- get
28+
- list
29+
- watch
30+
- create
31+
- update
32+
- patch
33+
- delete
34+
- apiGroups:
35+
- ""
36+
resources:
37+
- events
38+
verbs:
39+
- create
40+
- patch

‎bundle/manifests/leader-election-rolebinding_rbac.authorization.k8s.io_v1_rolebinding.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: RoleBinding
3+
metadata:
4+
creationTimestamp: null
5+
labels:
6+
app.kubernetes.io/managed-by: kustomize
7+
app.kubernetes.io/name: oadp-vm-file-restore
8+
name: leader-election-rolebinding
9+
roleRef:
10+
apiGroup: rbac.authorization.k8s.io
11+
kind: Role
12+
name: leader-election-role
13+
subjects:
14+
- kind: ServiceAccount
15+
name: controller-manager
16+
namespace: system

‎bundle/manifests/manager-role_rbac.authorization.k8s.io_v1_clusterrole.yaml‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
creationTimestamp: null
5+
name: manager-role
6+
rules:
7+
- apiGroups:
8+
- ""
9+
resources:
10+
- namespaces
11+
- pods
12+
- secrets
13+
- serviceaccounts
14+
- services
15+
verbs:
16+
- create
17+
- delete
18+
- get
19+
- list
20+
- patch
21+
- update
22+
- watch
23+
- apiGroups:
24+
- ""
25+
resources:
26+
- persistentvolumeclaims
27+
verbs:
28+
- get
29+
- list
30+
- watch
31+
- apiGroups:
32+
- apps
33+
resources:
34+
- deployments
35+
verbs:
36+
- create
37+
- delete
38+
- get
39+
- list
40+
- patch
41+
- update
42+
- watch
43+
- apiGroups:
44+
- oadp.openshift.io
45+
resources:
46+
- virtualmachinebackupsdiscoveries
47+
- virtualmachinefilerestores
48+
verbs:
49+
- create
50+
- delete
51+
- get
52+
- list
53+
- patch
54+
- update
55+
- watch
56+
- apiGroups:
57+
- oadp.openshift.io
58+
resources:
59+
- virtualmachinebackupsdiscoveries/finalizers
60+
- virtualmachinefilerestores/finalizers
61+
verbs:
62+
- update
63+
- apiGroups:
64+
- oadp.openshift.io
65+
resources:
66+
- virtualmachinebackupsdiscoveries/status
67+
- virtualmachinefilerestores/status
68+
verbs:
69+
- get
70+
- patch
71+
- update
72+
- apiGroups:
73+
- rbac.authorization.k8s.io
74+
resources:
75+
- rolebindings
76+
verbs:
77+
- create
78+
- delete
79+
- get
80+
- list
81+
- patch
82+
- update
83+
- watch
84+
- apiGroups:
85+
- route.openshift.io
86+
resources:
87+
- routes
88+
verbs:
89+
- create
90+
- delete
91+
- get
92+
- list
93+
- patch
94+
- update
95+
- watch
96+
- apiGroups:
97+
- security.openshift.io
98+
resourceNames:
99+
- privileged
100+
resources:
101+
- securitycontextconstraints
102+
verbs:
103+
- use
104+
- apiGroups:
105+
- velero.io
106+
resources:
107+
- backups
108+
verbs:
109+
- get
110+
- list
111+
- watch
112+
- apiGroups:
113+
- velero.io
114+
resources:
115+
- datadownloads
116+
verbs:
117+
- get
118+
- list
119+
- patch
120+
- watch
121+
- apiGroups:
122+
- velero.io
123+
resources:
124+
- downloadrequests
125+
verbs:
126+
- create
127+
- delete
128+
- get
129+
- list
130+
- watch
131+
- apiGroups:
132+
- velero.io
133+
resources:
134+
- restores
135+
verbs:
136+
- create
137+
- delete
138+
- get
139+
- list
140+
- patch
141+
- update
142+
- watch

‎bundle/manifests/metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
creationTimestamp: null
5+
name: metrics-reader
6+
rules:
7+
- nonResourceURLs:
8+
- /metrics
9+
verbs:
10+
- get

‎bundle/manifests/oadp-operator.clusterserviceversion.yaml‎

Lines changed: 82 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,35 @@ metadata:
172172
}
173173
}
174174
},
175+
{
176+
"apiVersion": "oadp.openshift.io/v1alpha1",
177+
"kind": "VirtualMachineBackupsDiscovery",
178+
"metadata": {
179+
"labels": {
180+
"app.kubernetes.io/managed-by": "kustomize",
181+
"app.kubernetes.io/name": "oadp-vm-file-restore"
182+
},
183+
"name": "virtualmachinebackupsdiscovery-sample"
184+
},
185+
"spec": {
186+
"endTime": "2024-12-31T23:59:59Z",
187+
"startTime": "2024-01-01",
188+
"virtualMachineName": "test-vm",
189+
"virtualMachineNamespace": "test-namespace"
190+
}
191+
},
192+
{
193+
"apiVersion": "oadp.openshift.io/v1alpha1",
194+
"kind": "VirtualMachineFileRestore",
195+
"metadata": {
196+
"labels": {
197+
"app.kubernetes.io/managed-by": "kustomize",
198+
"app.kubernetes.io/name": "oadp-vm-file-restore"
199+
},
200+
"name": "virtualmachinefilerestore-sample"
201+
},
202+
"spec": null
203+
},
175204
{
176205
"apiVersion": "velero.io/v1",
177206
"kind": "Backup",
@@ -845,7 +874,6 @@ spec:
845874
- apiGroups:
846875
- ""
847876
resources:
848-
- events
849877
- namespaces
850878
- pods
851879
- secrets
@@ -879,18 +907,6 @@ spec:
879907
- patch
880908
- update
881909
- watch
882-
- apiGroups:
883-
- coordination.k8s.io
884-
resources:
885-
- leases
886-
verbs:
887-
- get
888-
- list
889-
- watch
890-
- create
891-
- update
892-
- patch
893-
- delete
894910
- apiGroups:
895911
- oadp.openshift.io
896912
resources:
@@ -944,6 +960,14 @@ spec:
944960
- patch
945961
- update
946962
- watch
963+
- apiGroups:
964+
- security.openshift.io
965+
resourceNames:
966+
- privileged
967+
resources:
968+
- securitycontextconstraints
969+
verbs:
970+
- use
947971
- apiGroups:
948972
- velero.io
949973
resources:
@@ -983,6 +1007,18 @@ spec:
9831007
- patch
9841008
- update
9851009
- watch
1010+
- apiGroups:
1011+
- authentication.k8s.io
1012+
resources:
1013+
- tokenreviews
1014+
verbs:
1015+
- create
1016+
- apiGroups:
1017+
- authorization.k8s.io
1018+
resources:
1019+
- subjectaccessreviews
1020+
verbs:
1021+
- create
9861022
serviceAccountName: oadp-vm-file-restore-controller-manager
9871023
- rules:
9881024
- apiGroups:
@@ -1348,6 +1384,39 @@ spec:
13481384
- emptyDir: {}
13491385
name: tmp-dir
13501386
permissions:
1387+
- rules:
1388+
- apiGroups:
1389+
- ""
1390+
resources:
1391+
- configmaps
1392+
verbs:
1393+
- get
1394+
- list
1395+
- watch
1396+
- create
1397+
- update
1398+
- patch
1399+
- delete
1400+
- apiGroups:
1401+
- coordination.k8s.io
1402+
resources:
1403+
- leases
1404+
verbs:
1405+
- get
1406+
- list
1407+
- watch
1408+
- create
1409+
- update
1410+
- patch
1411+
- delete
1412+
- apiGroups:
1413+
- ""
1414+
resources:
1415+
- events
1416+
verbs:
1417+
- create
1418+
- patch
1419+
serviceAccountName: oadp-vm-file-restore-controller-manager
13511420
- rules:
13521421
- apiGroups:
13531422
- ""

0 commit comments

Comments
 (0)