Add kustomization overlay: katib-openshift (#1513)

* Add kustomization overlay: katib-standalone-openshift

* Rename OpenShift kustomization and remove unused RBAC resources

* Update kustomization katib-openshift to support changes in #1498

* katib-openshift: move patches to dedicated dir

* katib-openshift: clarify comments

* Update katib-openshift image tags

manifests/v1beta1/installs/katib-openshift/kustomization.yml

@@ -0,0 +1,75 @@
+# This kustomization copies the `katib-standalone` one with following exclusions:
+#  - No Job is spawned to generate TLS key for `katib-controller` Service
+#  - Instead, the Service and WebhookConfigurations linked to it are annotated
+#    for OpenShift service controller to handle TLS certification.
+#  - PersistentVolumeClaim has empty `.spec.storageClassName` to allow dynamic
+#    provisioning with default StorageClass
+#
+# Requires OpenShift version: 4.4+
+#  
+# Note: PersistentVolume should not be created, as OpenShift installations typically
+# have PVC dynamic provisioning configured or need some extra administrative effort
+# to provision a PV manually.
+# To achieve this, run:
+# 
+# `kustomize build ./manifests/v1beta1/installs/katib-openshift | oc apply -f - -l type!=local`
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kubeflow
+resources:
+  # Namespace.
+  - ../../components/namespace/
+  # Katib controller.
+  - ../../components/controller/
+  # Katib CRDs.
+  - ../../components/crd/
+  # Katib DB manager.
+  - ../../components/db-manager/
+  # Katib DB mysql.
+  - ../../components/mysql/
+  # Katib UI.
+  - ../../components/ui/
+  # Katib webhooks.
+  - ../../components/webhook/
+images:
+  - name: docker.io/kubeflowkatib/katib-controller
+    newName: docker.io/kubeflowkatib/katib-controller
+    newTag: latest
+  - name: docker.io/kubeflowkatib/katib-db-manager
+    newName: docker.io/kubeflowkatib/katib-db-manager
+    newTag: latest
+  - name: docker.io/kubeflowkatib/katib-ui
+    newName: docker.io/kubeflowkatib/katib-ui
+    newTag: latest
+
+patchesJson6902:
+  # Annotate Service to delegate TLS-secret generation to OpenShift service controller
+  # https://docs.openshift.com/container-platform/4.6/security/certificates/service-serving-certificate.html#add-service-certificate_service-serving-certificate
+  - target:
+      group: ""
+      version: v1
+      kind: Service
+      name: katib-controller
+    path: patches/service-serving-cert.yaml
+  # Annotate WebhookConfigurations to delegate `caBundle` population to OpenShift service controller
+  # https://docs.openshift.com/container-platform/4.6/security/certificates/service-serving-certificate.html#add-service-certificate-mutating-webhook_service-serving-certificate
+  - target:
+      group: admissionregistration.k8s.io
+      version: v1
+      kind: ValidatingWebhookConfiguration
+      name: katib.kubeflow.org
+    path: patches/webhook-inject-cabundle.yaml
+  - target:
+      group: admissionregistration.k8s.io
+      version: v1
+      kind: MutatingWebhookConfiguration
+      name: katib.kubeflow.org
+    path: patches/webhook-inject-cabundle.yaml
+  # Remove PVC's storageClassName to provision it with the default StorageClass by default
+  - target:
+      group: ""
+      version: v1
+      kind: PersistentVolumeClaim
+      name: katib-mysql
+    path: patches/pvc-unset-storageClass.yaml

manifests/v1beta1/installs/katib-openshift/patches/pvc-unset-storageClass.yaml

@@ -0,0 +1,3 @@
+---
+- op: remove
+  path: "/spec/storageClassName"

manifests/v1beta1/installs/katib-openshift/patches/service-serving-cert.yaml

@@ -0,0 +1,5 @@
+---
+- op: "add"
+  path: "/metadata/annotations"
+  value:
+    service.beta.openshift.io/serving-cert-secret-name: katib-webhook-cert

manifests/v1beta1/installs/katib-openshift/patches/webhook-inject-cabundle.yaml

@@ -0,0 +1,5 @@
+---
+- op: "add"
+  path: "/metadata/annotations"
+  value:
+    service.beta.openshift.io/inject-cabundle: "true"

scripts/v1beta1/release.sh

@@ -75,12 +75,14 @@ if [[ $(uname) == "Darwin" ]]; then
   sed -i '' -e "s@newTag: .*@newTag: ${TAG}@" ./manifests/v1beta1/installs/katib-standalone/kustomization.yaml
   sed -i '' -e "s@newTag: .*@newTag: ${TAG}@" ./manifests/v1beta1/installs/katib-with-kubeflow/kustomization.yaml
   sed -i '' -e "s@newTag: .*@newTag: ${TAG}@" ./manifests/v1beta1/installs/katib-cert-manager/kustomization.yaml
+  sed -i '' -e "s@newTag: .*@newTag: ${TAG}@" ./manifests/v1beta1/installs/katib-openshift/kustomization.yaml
 else
   sed -i -e "s@newTag: .*@newTag: ${TAG}@" ./manifests/v1beta1/installs/katib-external-db/kustomization.yaml
   sed -i -e "s@:[^[:space:]].*\"@:${TAG}\"@" ./manifests/v1beta1/components/controller/katib-config.yaml
   sed -i -e "s@newTag: .*@newTag: ${TAG}@" ./manifests/v1beta1/installs/katib-standalone/kustomization.yaml
   sed -i -e "s@newTag: .*@newTag: ${TAG}@" ./manifests/v1beta1/installs/katib-with-kubeflow/kustomization.yaml
   sed -i -e "s@newTag: .*@newTag: ${TAG}@" ./manifests/v1beta1/installs/katib-cert-manager/kustomization.yaml
+  sed -i -e "s@newTag: .*@newTag: ${TAG}@" ./manifests/v1beta1/installs/katib-openshift/kustomization.yaml
 fi
 echo -e "Katib images have been updated\n"