Skip to content

Commit 4c8293c

Browse files
wpjuniorwpjunior
committed
Bootstrap operator
1 parent e20eb8e commit 4c8293c

30 files changed

+1942
-0
lines changed

‎.dockerignore

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# More info: https://docs.docker.com/engine/reference/builder/#dockerignore-file
2+
# Ignore build and test binaries.
3+
bin/
4+
testbin/

‎Dockerfile

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Build the manager binary
2+
FROM golang:1.18 as builder
3+
4+
WORKDIR /workspace
5+
# Copy the Go Modules manifests
6+
COPY go.mod go.mod
7+
COPY go.sum go.sum
8+
# cache deps before building and copying source so that we don't need to re-download as much
9+
# and so that source changes don't invalidate our downloaded layer
10+
RUN go mod download
11+
12+
# Copy the go source
13+
COPY main.go main.go
14+
COPY api/ api/
15+
COPY controllers/ controllers/
16+
17+
# Build
18+
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -a -o manager main.go
19+
20+
# Use distroless as minimal base image to package the manager binary
21+
# Refer to https://github.com/GoogleContainerTools/distroless for more details
22+
FROM gcr.io/distroless/static:nonroot
23+
WORKDIR /
24+
COPY --from=builder /workspace/manager .
25+
USER 65532:65532
26+
27+
ENTRYPOINT ["/manager"]

‎Makefile

+236
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,236 @@
1+
# VERSION defines the project version for the bundle.
2+
# Update this value when you upgrade the version of your project.
3+
# To re-generate a bundle for another specific version without changing the standard setup, you can:
4+
# - use the VERSION as arg of the bundle target (e.g make bundle VERSION=0.0.2)
5+
# - use environment variables to overwrite this value (e.g export VERSION=0.0.2)
6+
VERSION ?= 0.0.1
7+
8+
# CHANNELS define the bundle channels used in the bundle.
9+
# Add a new line here if you would like to change its default config. (E.g CHANNELS = "candidate,fast,stable")
10+
# To re-generate a bundle for other specific channels without changing the standard setup, you can:
11+
# - use the CHANNELS as arg of the bundle target (e.g make bundle CHANNELS=candidate,fast,stable)
12+
# - use environment variables to overwrite this value (e.g export CHANNELS="candidate,fast,stable")
13+
ifneq ($(origin CHANNELS), undefined)
14+
BUNDLE_CHANNELS := --channels=$(CHANNELS)
15+
endif
16+
17+
# DEFAULT_CHANNEL defines the default channel used in the bundle.
18+
# Add a new line here if you would like to change its default config. (E.g DEFAULT_CHANNEL = "stable")
19+
# To re-generate a bundle for any other default channel without changing the default setup, you can:
20+
# - use the DEFAULT_CHANNEL as arg of the bundle target (e.g make bundle DEFAULT_CHANNEL=stable)
21+
# - use environment variables to overwrite this value (e.g export DEFAULT_CHANNEL="stable")
22+
ifneq ($(origin DEFAULT_CHANNEL), undefined)
23+
BUNDLE_DEFAULT_CHANNEL := --default-channel=$(DEFAULT_CHANNEL)
24+
endif
25+
BUNDLE_METADATA_OPTS ?= $(BUNDLE_CHANNELS) $(BUNDLE_DEFAULT_CHANNEL)
26+
27+
# IMAGE_TAG_BASE defines the docker.io namespace and part of the image name for remote images.
28+
# This variable is used to construct full image tags for bundle and catalog images.
29+
#
30+
# For example, running 'make bundle-build bundle-push catalog-build catalog-push' will build and push both
31+
# extensions.tsuru.io/acl-operator-bundle:$VERSION and extensions.tsuru.io/acl-operator-catalog:$VERSION.
32+
IMAGE_TAG_BASE ?= extensions.tsuru.io/acl-operator
33+
34+
# BUNDLE_IMG defines the image:tag used for the bundle.
35+
# You can use it as an arg. (E.g make bundle-build BUNDLE_IMG=<some-registry>/<project-name-bundle>:<tag>)
36+
BUNDLE_IMG ?= $(IMAGE_TAG_BASE)-bundle:v$(VERSION)
37+
38+
# BUNDLE_GEN_FLAGS are the flags passed to the operator-sdk generate bundle command
39+
BUNDLE_GEN_FLAGS ?= -q --overwrite --version $(VERSION) $(BUNDLE_METADATA_OPTS)
40+
41+
# USE_IMAGE_DIGESTS defines if images are resolved via tags or digests
42+
# You can enable this value if you would like to use SHA Based Digests
43+
# To enable set flag to true
44+
USE_IMAGE_DIGESTS ?= false
45+
ifeq ($(USE_IMAGE_DIGESTS), true)
46+
BUNDLE_GEN_FLAGS += --use-image-digests
47+
endif
48+
49+
# Image URL to use all building/pushing image targets
50+
IMG ?= controller:latest
51+
# ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
52+
ENVTEST_K8S_VERSION = 1.24.1
53+
54+
# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
55+
ifeq (,$(shell go env GOBIN))
56+
GOBIN=$(shell go env GOPATH)/bin
57+
else
58+
GOBIN=$(shell go env GOBIN)
59+
endif
60+
61+
# Setting SHELL to bash allows bash commands to be executed by recipes.
62+
# This is a requirement for 'setup-envtest.sh' in the test target.
63+
# Options are set to exit when a recipe line exits non-zero or a piped command fails.
64+
SHELL = /usr/bin/env bash -o pipefail
65+
.SHELLFLAGS = -ec
66+
67+
.PHONY: all
68+
all: build
69+
70+
##@ General
71+
72+
# The help target prints out all targets with their descriptions organized
73+
# beneath their categories. The categories are represented by '##@' and the
74+
# target descriptions by '##'. The awk commands is responsible for reading the
75+
# entire set of makefiles included in this invocation, looking for lines of the
76+
# file as xyz: ## something, and then pretty-format the target and help. Then,
77+
# if there's a line with ##@ something, that gets pretty-printed as a category.
78+
# More info on the usage of ANSI control characters for terminal formatting:
79+
# https://en.wikipedia.org/wiki/ANSI_escape_code#SGR_parameters
80+
# More info on the awk command:
81+
# http://linuxcommand.org/lc3_adv_awk.php
82+
83+
.PHONY: help
84+
help: ## Display this help.
85+
@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf " \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
86+
87+
##@ Development
88+
89+
.PHONY: manifests
90+
manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
91+
$(CONTROLLER_GEN) rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases
92+
93+
.PHONY: generate
94+
generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
95+
$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..."
96+
97+
.PHONY: fmt
98+
fmt: ## Run go fmt against code.
99+
go fmt ./...
100+
101+
.PHONY: vet
102+
vet: ## Run go vet against code.
103+
go vet ./...
104+
105+
.PHONY: test
106+
test: manifests generate fmt vet envtest ## Run tests.
107+
KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)" go test ./... -coverprofile cover.out
108+
109+
##@ Build
110+
111+
.PHONY: build
112+
build: generate fmt vet ## Build manager binary.
113+
go build -o bin/manager main.go
114+
115+
.PHONY: run
116+
run: manifests generate fmt vet ## Run a controller from your host.
117+
go run ./main.go
118+
119+
.PHONY: docker-build
120+
docker-build: test ## Build docker image with the manager.
121+
docker build -t ${IMG} .
122+
123+
.PHONY: docker-push
124+
docker-push: ## Push docker image with the manager.
125+
docker push ${IMG}
126+
127+
##@ Deployment
128+
129+
ifndef ignore-not-found
130+
ignore-not-found = false
131+
endif
132+
133+
.PHONY: install
134+
install: manifests kustomize ## Install CRDs into the K8s cluster specified in ~/.kube/config.
135+
$(KUSTOMIZE) build config/crd | kubectl apply -f -
136+
137+
.PHONY: uninstall
138+
uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
139+
$(KUSTOMIZE) build config/crd | kubectl delete --ignore-not-found=$(ignore-not-found) -f -
140+
141+
.PHONY: deploy
142+
deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
143+
cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
144+
$(KUSTOMIZE) build config/default | kubectl apply -f -
145+
146+
.PHONY: undeploy
147+
undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
148+
$(KUSTOMIZE) build config/default | kubectl delete --ignore-not-found=$(ignore-not-found) -f -
149+
150+
##@ Build Dependencies
151+
152+
## Location to install dependencies to
153+
LOCALBIN ?= $(shell pwd)/bin
154+
$(LOCALBIN):
155+
mkdir -p $(LOCALBIN)
156+
157+
## Tool Binaries
158+
KUSTOMIZE ?= $(LOCALBIN)/kustomize
159+
CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
160+
ENVTEST ?= $(LOCALBIN)/setup-envtest
161+
162+
## Tool Versions
163+
KUSTOMIZE_VERSION ?= v3.8.7
164+
CONTROLLER_TOOLS_VERSION ?= v0.9.0
165+
166+
KUSTOMIZE_INSTALL_SCRIPT ?= "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"
167+
.PHONY: kustomize
168+
kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.
169+
$(KUSTOMIZE): $(LOCALBIN)
170+
curl -s $(KUSTOMIZE_INSTALL_SCRIPT) | bash -s -- $(subst v,,$(KUSTOMIZE_VERSION)) $(LOCALBIN)
171+
172+
.PHONY: controller-gen
173+
controller-gen: $(CONTROLLER_GEN) ## Download controller-gen locally if necessary.
174+
$(CONTROLLER_GEN): $(LOCALBIN)
175+
GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-tools/cmd/controller-gen@$(CONTROLLER_TOOLS_VERSION)
176+
177+
.PHONY: envtest
178+
envtest: $(ENVTEST) ## Download envtest-setup locally if necessary.
179+
$(ENVTEST): $(LOCALBIN)
180+
GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
181+
182+
.PHONY: bundle
183+
bundle: manifests kustomize ## Generate bundle manifests and metadata, then validate generated files.
184+
operator-sdk generate kustomize manifests -q
185+
cd config/manager && $(KUSTOMIZE) edit set image controller=$(IMG)
186+
$(KUSTOMIZE) build config/manifests | operator-sdk generate bundle $(BUNDLE_GEN_FLAGS)
187+
operator-sdk bundle validate ./bundle
188+
189+
.PHONY: bundle-build
190+
bundle-build: ## Build the bundle image.
191+
docker build -f bundle.Dockerfile -t $(BUNDLE_IMG) .
192+
193+
.PHONY: bundle-push
194+
bundle-push: ## Push the bundle image.
195+
$(MAKE) docker-push IMG=$(BUNDLE_IMG)
196+
197+
.PHONY: opm
198+
OPM = ./bin/opm
199+
opm: ## Download opm locally if necessary.
200+
ifeq (,$(wildcard $(OPM)))
201+
ifeq (,$(shell which opm 2>/dev/null))
202+
@{ \
203+
set -e ;\
204+
mkdir -p $(dir $(OPM)) ;\
205+
OS=$(shell go env GOOS) && ARCH=$(shell go env GOARCH) && \
206+
curl -sSLo $(OPM) https://github.com/operator-framework/operator-registry/releases/download/v1.23.0/$${OS}-$${ARCH}-opm ;\
207+
chmod +x $(OPM) ;\
208+
}
209+
else
210+
OPM = $(shell which opm)
211+
endif
212+
endif
213+
214+
# A comma-separated list of bundle images (e.g. make catalog-build BUNDLE_IMGS=example.com/operator-bundle:v0.1.0,example.com/operator-bundle:v0.2.0).
215+
# These images MUST exist in a registry and be pull-able.
216+
BUNDLE_IMGS ?= $(BUNDLE_IMG)
217+
218+
# The image tag given to the resulting catalog image (e.g. make catalog-build CATALOG_IMG=example.com/operator-catalog:v0.2.0).
219+
CATALOG_IMG ?= $(IMAGE_TAG_BASE)-catalog:v$(VERSION)
220+
221+
# Set CATALOG_BASE_IMG to an existing catalog image tag to add $BUNDLE_IMGS to that image.
222+
ifneq ($(origin CATALOG_BASE_IMG), undefined)
223+
FROM_INDEX_OPT := --from-index $(CATALOG_BASE_IMG)
224+
endif
225+
226+
# Build a catalog image by adding bundle images to an empty catalog using the operator package manager tool, 'opm'.
227+
# This recipe invokes 'opm' in 'semver' bundle add mode. For more information on add modes, see:
228+
# https://github.com/operator-framework/community-operators/blob/7f1438c/docs/packaging-operator.md#updating-your-existing-operator
229+
.PHONY: catalog-build
230+
catalog-build: opm ## Build a catalog image.
231+
$(OPM) index add --container-tool docker --mode semver --tag $(CATALOG_IMG) --bundles $(BUNDLE_IMGS) $(FROM_INDEX_OPT)
232+
233+
# Push the catalog image.
234+
.PHONY: catalog-push
235+
catalog-push: ## Push a catalog image.
236+
$(MAKE) docker-push IMG=$(CATALOG_IMG)

‎PROJECT

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
domain: extensions.tsuru.io
2+
layout:
3+
- go.kubebuilder.io/v3
4+
plugins:
5+
manifests.sdk.operatorframework.io/v2: {}
6+
scorecard.sdk.operatorframework.io/v2: {}
7+
projectName: acl-operator
8+
repo: github.com/tsuru/acl-operator
9+
version: "3"

‎config/default/kustomization.yaml

+74
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# Adds namespace to all resources.
2+
namespace: acl-operator-system
3+
4+
# Value of this field is prepended to the
5+
# names of all resources, e.g. a deployment named
6+
# "wordpress" becomes "alices-wordpress".
7+
# Note that it should also match with the prefix (text before '-') of the namespace
8+
# field above.
9+
namePrefix: acl-operator-
10+
11+
# Labels to add to all resources and selectors.
12+
#commonLabels:
13+
# someName: someValue
14+
15+
bases:
16+
- ../crd
17+
- ../rbac
18+
- ../manager
19+
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
20+
# crd/kustomization.yaml
21+
#- ../webhook
22+
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
23+
#- ../certmanager
24+
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
25+
#- ../prometheus
26+
27+
patchesStrategicMerge:
28+
# Protect the /metrics endpoint by putting it behind auth.
29+
# If you want your controller-manager to expose the /metrics
30+
# endpoint w/o any authn/z, please comment the following line.
31+
- manager_auth_proxy_patch.yaml
32+
33+
# Mount the controller config file for loading manager configurations
34+
# through a ComponentConfig type
35+
#- manager_config_patch.yaml
36+
37+
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
38+
# crd/kustomization.yaml
39+
#- manager_webhook_patch.yaml
40+
41+
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'.
42+
# Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA injection in the admission webhooks.
43+
# 'CERTMANAGER' needs to be enabled to use ca injection
44+
#- webhookcainjection_patch.yaml
45+
46+
# the following config is for teaching kustomize how to do var substitution
47+
vars:
48+
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
49+
#- name: CERTIFICATE_NAMESPACE # namespace of the certificate CR
50+
# objref:
51+
# kind: Certificate
52+
# group: cert-manager.io
53+
# version: v1
54+
# name: serving-cert # this name should match the one in certificate.yaml
55+
# fieldref:
56+
# fieldpath: metadata.namespace
57+
#- name: CERTIFICATE_NAME
58+
# objref:
59+
# kind: Certificate
60+
# group: cert-manager.io
61+
# version: v1
62+
# name: serving-cert # this name should match the one in certificate.yaml
63+
#- name: SERVICE_NAMESPACE # namespace of the service
64+
# objref:
65+
# kind: Service
66+
# version: v1
67+
# name: webhook-service
68+
# fieldref:
69+
# fieldpath: metadata.namespace
70+
#- name: SERVICE_NAME
71+
# objref:
72+
# kind: Service
73+
# version: v1
74+
# name: webhook-service

‎config/default/manager_auth_proxy_patch.yaml

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# This patch inject a sidecar container which is a HTTP proxy for the
2+
# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
3+
apiVersion: apps/v1
4+
kind: Deployment
5+
metadata:
6+
name: controller-manager
7+
namespace: system
8+
spec:
9+
template:
10+
spec:
11+
containers:
12+
- name: kube-rbac-proxy
13+
securityContext:
14+
allowPrivilegeEscalation: false
15+
# TODO(user): uncomment for common cases that do not require escalating privileges
16+
# capabilities:
17+
# drop:
18+
# - "ALL"
19+
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.11.0
20+
args:
21+
- "--secure-listen-address=0.0.0.0:8443"
22+
- "--upstream=http://127.0.0.1:8080/"
23+
- "--logtostderr=true"
24+
- "--v=0"
25+
ports:
26+
- containerPort: 8443
27+
protocol: TCP
28+
name: https
29+
resources:
30+
limits:
31+
cpu: 500m
32+
memory: 128Mi
33+
requests:
34+
cpu: 5m
35+
memory: 64Mi
36+
- name: manager
37+
args:
38+
- "--health-probe-bind-address=:8081"
39+
- "--metrics-bind-address=127.0.0.1:8080"
40+
- "--leader-elect"

0 commit comments

Comments
 (0)