Merge pull request #152 from jkhelil/bump_build_0.12

Bump shipwright build 0.12.0

Makefile

@@ -3,7 +3,7 @@
 # To re-generate a bundle for another specific version without changing the standard setup, you can:
 # - use the VERSION as arg of the bundle target (e.g make bundle VERSION=0.0.2)
 # - use environment variables to overwrite this value (e.g export VERSION=0.0.2)
-VERSION ?= 0.11.0
+VERSION ?= 0.12.0
 
 # CHANNELS define the bundle channels used in the bundle.
 # Add a new line here if you would like to change its default config. (E.g CHANNELS = "candidate,fast,stable")

bundle/manifests/shipwright-operator.clusterserviceversion.yaml

@@ -24,7 +24,7 @@ metadata:
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v3
     repository: https://github.com/shipwright-io/operator
     support: The Shipwright Contributors
-  name: shipwright-operator.v0.11.0
+  name: shipwright-operator.v0.12.0
   namespace: placeholder
 spec:
   apiservicedefinitions: {}
@@ -515,7 +515,13 @@ spec:
         - apiGroups:
           - ""
           resources:
+          - configmaps
+          - events
+          - limitranges
           - namespaces
+          - pods
+          - secrets
+          - services
           verbs:
           - create
           - delete
@@ -527,22 +533,15 @@ spec:
         - apiGroups:
           - ""
           resources:
-          - secrets
+          - namespaces
           verbs:
           - create
+          - delete
           - get
           - list
-          - watch
-        - apiGroups:
-          - ""
-          resourceNames:
-          - shipwright-build-webhook-cert
-          resources:
-          - secrets
-          verbs:
-          - delete
           - patch
           - update
+          - watch
         - apiGroups:
           - ""
           resources:
@@ -572,25 +571,6 @@ spec:
           - delete
           - patch
           - update
-        - apiGroups:
-          - ""
-          resources:
-          - services
-          verbs:
-          - create
-          - get
-          - list
-          - watch
-        - apiGroups:
-          - ""
-          resourceNames:
-          - shipwright-build-webhook
-          resources:
-          - services
-          verbs:
-          - delete
-          - patch
-          - update
         - apiGroups:
           - operator.shipwright.io
           resources:
@@ -901,4 +881,4 @@ spec:
   provider:
     name: The Shipwright Contributors
     url: https://shipwright.io
-  version: 0.11.0
+  version: 0.12.0

config/rbac/role.yaml

@@ -137,7 +137,13 @@ rules:
 - apiGroups:
   - ""
   resources:
+  - configmaps
+  - events
+  - limitranges
   - namespaces
+  - pods
+  - secrets
+  - services
   verbs:
   - create
   - delete
@@ -149,22 +155,15 @@ rules:
 - apiGroups:
   - ""
   resources:
-  - secrets
+  - namespaces
   verbs:
   - create
+  - delete
   - get
   - list
-  - watch
-- apiGroups:
-  - ""
-  resourceNames:
-  - shipwright-build-webhook-cert
-  resources:
-  - secrets
-  verbs:
-  - delete
   - patch
   - update
+  - watch
 - apiGroups:
   - ""
   resources:
@@ -194,25 +193,6 @@ rules:
   - delete
   - patch
   - update
-- apiGroups:
-  - ""
-  resources:
-  - services
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-- apiGroups:
-  - ""
-  resourceNames:
-  - shipwright-build-webhook
-  resources:
-  - services
-  verbs:
-  - delete
-  - patch
-  - update
 - apiGroups:
   - operator.shipwright.io
   resources:

config/subscription/subscription.yaml

@@ -9,4 +9,4 @@ spec:
   source: shipwright-operator
   sourceNamespace: shipwright-operator
   installPlanApproval: Automatic
-  startingCSV: shipwright-operator.v0.8.1-snapshot
+  startingCSV: shipwright-operator.v0.12.0

controllers/shipwrightbuild_controller.go

@@ -41,6 +41,10 @@ const (
 
 	// UseManagedWebhookCerts is an env Var that controls wether we install the webhook certs
 	UseManagedWebhookCerts = "USE_MANAGED_WEBHOOK_CERTS"
+
+	CertManagerInjectAnnotationKey = "cert-manager.io/inject-ca-from"
+
+	CertManagerInjectAnnotationValueTemplate = "%s/shipwright-build-webhook-cert"
 )
 
 // ShipwrightBuildReconciler reconciles a ShipwrightBuild object
@@ -157,12 +161,26 @@ func (r *ShipwrightBuildReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		}
 	}
 
-	// filtering out namespace resource, so it does not create new namespaces accidentally, and
-	// transforming object to target the namespace informed on the CRD (.spec.namespace)
+	// Applying transformers
+	// image transformers: Alow to inject custom component images
+	// namespace transformer: Allow installing in a specific namespace
+	// InjetAnnotation transformer for webhook certs management via cert manager
 	images := common.ToLowerCaseKeys(common.ImagesFromEnv(common.ShipwrightImagePrefix))
+
+	transformerfncs := []manifestival.Transformer{}
+	if common.IsOpenShiftPlatform() {
+		transformerfncs = append(transformerfncs, manifestival.InjectNamespace(targetNamespace))
+		transformerfncs = append(transformerfncs, common.DeploymentImages(images))
+	} else {
+		transformerfncs = append(transformerfncs, manifestival.InjectNamespace(targetNamespace))
+		transformerfncs = append(transformerfncs, common.DeploymentImages(images))
+		transformerfncs = append(transformerfncs, common.InjectAnnotations(CertManagerInjectAnnotationKey, fmt.Sprintf(CertManagerInjectAnnotationValueTemplate, targetNamespace), common.Overwrite, "CustomResourceDefinition"))
+	}
+
 	manifest, err := r.Manifest.
 		Filter(manifestival.Not(manifestival.ByKind("Namespace"))).
-		Transform(manifestival.InjectNamespace(targetNamespace), common.DeploymentImages(images))
+		Transform(transformerfncs...)
+
 	if err != nil {
 		logger.Error(err, "transforming manifests, injecting namespace")
 		return RequeueWithError(err)

controllers/shipwrightbuild_rbac.go

@@ -39,7 +39,4 @@ package controllers
 // +kubebuilder:rbac:groups=cert-manager.io,resources=issuers,resourceNames=selfsigned-issuer,verbs=update;patch;delete
 // +kubebuilder:rbac:groups=cert-manager.io,resources=certificates,verbs=get;list;watch;create
 // +kubebuilder:rbac:groups=cert-manager.io,resources=certificates,resourceNames=shipwright-build-webhook-cert,verbs=update;patch;delete
-// +kubebuilder:rbac:groups=core,resources=services,verbs=get;list;watch;create
-// +kubebuilder:rbac:groups=core,resources=services,resourceNames=shipwright-build-webhook,verbs=update;patch;delete
-// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create
-// +kubebuilder:rbac:groups=core,resources=secrets,resourceNames=shipwright-build-webhook-cert,verbs=update;patch;delete
+// +kubebuilder:rbac:groups=core,resources=pods;events;configmaps;secrets;limitranges;namespaces;services,verbs=get;list;watch;create;update;patch;delete

docs/shipwrightbuild.md

@@ -3,7 +3,7 @@
 When the Shipwright Operator is installed with the Operator Lifecycle Manager, the
 `ShipwrightBuild` [custom resource definition](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) is added to your cluster.
 This custom resource is used to install and configure Shipwright Builds on your cluster.
-The current operator will install version `0.11.0` of Builds.
+The current operator will install version `0.12.0` of Builds.
 
 ## ShipwrightBuild Reference
 

go.mod

@@ -3,6 +3,7 @@ module github.com/shipwright-io/operator
 go 1.19
 
 require (
+	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d
 	github.com/go-logr/logr v1.2.4
 	github.com/manifestival/controller-runtime-client v0.4.0
 	github.com/manifestival/manifestival v0.7.2

go.sum

@@ -89,6 +89,8 @@ github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmV
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/asaskevich/govalidator v0.0.0-20180720115003-f9ffefc3facf/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
+github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d h1:Byv0BzEl3/e6D5CLfI0j/7hiIEtvGVFPCZ7Ei2oq8iQ=
+github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/benbjohnson/clock v1.0.3/go.mod h1:bGMdMPoPVvcYyt1gHDf4J2KE153Yf9BuiUKYMaxlTDM=
 github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=

kodata/certificates.yaml

@@ -14,8 +14,7 @@ metadata:
   namespace: shipwright-build
 spec:
   dnsNames:
-  - shipwright-build-webhook.shipwright-build.svc
-  - shipwright-build-webhook.shipwright-build.svc.cluster.local
+  - shp-build-webhook.shipwright-build.svc
   issuerRef:
     kind: Issuer
     name: selfsigned-issuer