separate the manifests and operations for klusterlet operator

Signed-off-by: zhujian <jiazhu@redhat.com>
open-cluster-management-io · Dec 17, 2021 · cec4ec8 · cec4ec8
1 parent 07b951b
commit cec4ec8
Show file tree

Hide file tree

Showing 30 changed files with 241 additions and 224 deletions.
diff --git a/hack/copy-crds.sh b/hack/copy-crds.sh
@@ -9,7 +9,7 @@ done
 
 for f in $SPOKE_CRD_FILES
 do
-    cp $f ./manifests/klusterlet/
+    cp $f ./manifests/klusterlet/managed/
 done
 
 cp $CLUSTER_MANAGER_CRD_FILE ./deploy/cluster-manager/config/crds/

diff --git a/hack/verify-crds.sh b/hack/verify-crds.sh
@@ -9,7 +9,7 @@ done
 
 for f in $SPOKE_CRD_FILES
 do
-    diff -N $f ./manifests/klusterlet/$(basename $f) || ( echo 'crd content is incorrect' && false )
+    diff -N $f ./manifests/klusterlet/managed/$(basename $f) || ( echo 'crd content is incorrect' && false )
 done
 
 diff -N $CLUSTER_MANAGER_CRD_FILE ./deploy/cluster-manager/config/crds/$(basename $CLUSTER_MANAGER_CRD_FILE) || ( echo 'crd content is incorrect' && false )

diff --git a/manifests/fs.go b/manifests/fs.go
@@ -5,9 +5,7 @@ import "embed"
 //go:embed cluster-manager
 var ClusterManagerManifestFiles embed.FS
 
-//go:embed klusterlet
-//go:embed klusterlet/detached
+//go:embed klusterlet/management
+//go:embed klusterlet/managed
 //go:embed klusterletkube111
 var KlusterletManifestFiles embed.FS
-
-// var Klusterlet111ManifestFiles embed.FS
diff --git a/manifests/klusterlet/detached/klusterlet-registration-role-management.yaml b/manifests/klusterlet/detached/klusterlet-registration-role-management.yaml
diff --git a/manifests/klusterlet/detached/klusterlet-registration-rolebinding-management.yaml b/manifests/klusterlet/detached/klusterlet-registration-rolebinding-management.yaml
diff --git a/...nagement.io_appliedmanifestworks.crd.yaml → ...nagement.io_appliedmanifestworks.crd.yaml b/...nagement.io_appliedmanifestworks.crd.yaml → ...nagement.io_appliedmanifestworks.crd.yaml
diff --git a/...ster-management.io_clusterclaims.crd.yaml → ...ster-management.io_clusterclaims.crd.yaml b/...ster-management.io_clusterclaims.crd.yaml → ...ster-management.io_clusterclaims.crd.yaml
diff --git a/...nagement.io_appliedmanifestworks.crd.yaml → ...nagement.io_appliedmanifestworks.crd.yaml b/...nagement.io_appliedmanifestworks.crd.yaml → ...nagement.io_appliedmanifestworks.crd.yaml
diff --git a/...ster-management.io_clusterclaims.crd.yaml → ...ster-management.io_clusterclaims.crd.yaml b/...ster-management.io_clusterclaims.crd.yaml → ...ster-management.io_clusterclaims.crd.yaml
diff --git a/.../klusterlet-registration-clusterrole.yaml → .../klusterlet-registration-clusterrole.yaml b/.../klusterlet-registration-clusterrole.yaml → .../klusterlet-registration-clusterrole.yaml
@@ -5,10 +5,12 @@ metadata:
   name: open-cluster-management:{{ .KlusterletName }}-registration:agent
 rules:
 # Allow agent to get/list/watch nodes and configmaps.
-- apiGroups: [""]
-  resources: ["nodes", "configmaps"]
-  verbs: ["get", "list", "watch"]
+# - apiGroups: [""]
+#   resources: ["nodes", "configmaps"]
+#   verbs: ["get", "list", "watch"]
+
 # Allow agent to get/list/watch/create/delete/update/patch secrets.
+# TODO(zhujian7): consider to delete when addon agents can deployed on the management cluster.
 - apiGroups: [""]
   resources: ["secrets"]
   verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]

diff --git a/...rlet-registration-clusterrolebinding.yaml → ...rlet-registration-clusterrolebinding.yaml b/...rlet-registration-clusterrolebinding.yaml → ...rlet-registration-clusterrolebinding.yaml
diff --git a/...usterlet-registration-serviceaccount.yaml → ...usterlet-registration-serviceaccount.yaml b/...usterlet-registration-serviceaccount.yaml → ...usterlet-registration-serviceaccount.yaml
diff --git a/...usterlet/klusterlet-work-clusterrole.yaml → .../managed/klusterlet-work-clusterrole.yaml b/...usterlet/klusterlet-work-clusterrole.yaml → .../managed/klusterlet-work-clusterrole.yaml
@@ -24,9 +24,9 @@ rules:
   resources: ["subjectaccessreviews"]
   verbs: ["create"]
 # Allow agent to create events
-- apiGroups: ["", "events.k8s.io"]
-  resources: ["events"]
-  verbs: ["create", "patch", "update"]
+# - apiGroups: ["", "events.k8s.io"]
+#   resources: ["events"]
+#   verbs: ["create", "patch", "update"]
 # Allow agent to managed appliedmanifestworks
 - apiGroups: ["work.open-cluster-management.io"]
   resources: ["appliedmanifestworks"]

diff --git a/...let-work-clusterrolebinding-addition.yaml → ...let-work-clusterrolebinding-addition.yaml b/...let-work-clusterrolebinding-addition.yaml → ...let-work-clusterrolebinding-addition.yaml
diff --git a/...t/klusterlet-work-clusterrolebinding.yaml → ...d/klusterlet-work-clusterrolebinding.yaml b/...t/klusterlet-work-clusterrolebinding.yaml → ...d/klusterlet-work-clusterrolebinding.yaml
diff --git a/...erlet/klusterlet-work-serviceaccount.yaml → ...naged/klusterlet-work-serviceaccount.yaml b/...erlet/klusterlet-work-serviceaccount.yaml → ...naged/klusterlet-work-serviceaccount.yaml
diff --git a/...t/klusterlet-registration-deployment.yaml → ...t/klusterlet-registration-deployment.yaml b/...t/klusterlet-registration-deployment.yaml → ...t/klusterlet-registration-deployment.yaml
diff --git a/...sterlet/klusterlet-registration-role.yaml → ...agement/klusterlet-registration-role.yaml b/...sterlet/klusterlet-registration-role.yaml → ...agement/klusterlet-registration-role.yaml
@@ -5,6 +5,9 @@ metadata:
   name: open-cluster-management:{{ .KlusterletName }}-registration:agent
   namespace: {{ .KlusterletNamespace }}
 rules:
+# leader election needs to operate configmaps, create hub-kubeconfig external-managed-registration/work secrets
+# TODO(zhujian7): may be replaced by a clusterrole to grant secret operation for others namespaces when addon
+# agents are supported running on the management cluster
 - apiGroups: [""]
   resources: ["configmaps", "secrets"]
   verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]

diff --git a/...nding-extension-apiserver-management.yaml → ...tion-rolebinding-extension-apiserver.yaml b/...nding-extension-apiserver-management.yaml → ...tion-rolebinding-extension-apiserver.yaml
diff --git a/.../klusterlet-registration-rolebinding.yaml → .../klusterlet-registration-rolebinding.yaml b/.../klusterlet-registration-rolebinding.yaml → .../klusterlet-registration-rolebinding.yaml
diff --git a/...gistration-serviceaccount-management.yaml → ...usterlet-registration-serviceaccount.yaml b/...gistration-serviceaccount-management.yaml → ...usterlet-registration-serviceaccount.yaml
diff --git a/...lusterlet/klusterlet-work-deployment.yaml → ...anagement/klusterlet-work-deployment.yaml b/...lusterlet/klusterlet-work-deployment.yaml → ...anagement/klusterlet-work-deployment.yaml
diff --git a/...ched/klusterlet-work-role-management.yaml → ...rlet/management/klusterlet-work-role.yaml b/...ched/klusterlet-work-role-management.yaml → ...rlet/management/klusterlet-work-role.yaml
@@ -5,11 +5,12 @@ metadata:
   name: open-cluster-management:{{ .KlusterletName }}-work:agent
   namespace: {{ .KlusterletNamespace }}
 rules:
+# leader election needs to operate configmaps
+# - apiGroups: [""]
+#   resources: ["configmaps"]
+#   verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
 - apiGroups: [""]
-  resources: ["configmaps"]
-  verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
-- apiGroups: [""]
-  resources: ["secrets"]
+  resources: ["configmaps", "secrets"]
   verbs: ["get", "list", "watch"]
 - apiGroups: ["", "events.k8s.io"]
   resources: ["events"]

diff --git a/...nding-extension-apiserver-management.yaml → ...work-rolebinding-extension-apiserver.yaml b/...nding-extension-apiserver-management.yaml → ...work-rolebinding-extension-apiserver.yaml
diff --git a/...usterlet-work-rolebinding-management.yaml → ...nagement/klusterlet-work-rolebinding.yaml b/...usterlet-work-rolebinding-management.yaml → ...nagement/klusterlet-work-rolebinding.yaml
diff --git a/...erlet-work-serviceaccount-management.yaml → ...ement/klusterlet-work-serviceaccount.yaml b/...erlet-work-serviceaccount-management.yaml → ...ement/klusterlet-work-serviceaccount.yaml