-
Notifications
You must be signed in to change notification settings - Fork 515
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add Intermediate HyperShiftIndependent Profile
For historical reasons, "include.release.openshift.io/ibm-cloud-managed" was used
as a basis when creating the productized HyperShift installation profile. ibm-cloud-managed
is a different offering, however, and we would like to correct this so that
(1) the profiles can diverge if necessary and (2) the cluster profile name makes
sense.
This change establishes a "HypershiftIndependent" profile using the improved
profile annotation name "include.release.openshift.io/hypershift" . Dozens of
other changes across the product have already been introduced to use this
annotation in their manifests - openshift/api needs to support it now.
Once this change has merged, "include.release.openshift.io/hypershift" can
be tested. We will be able to find any overlooked manifests and annotate them.
Once the HyperShift team believes the new annotation can be treated as
canonical, we can eliminate ClusterProfileName("include.release.openshift.io/ibm-cloud-managed")
and replace it with ClusterProfileName("include.release.openshift.io/hypershift").- Loading branch information
Showing
189 changed files
with
7,774 additions
and
80 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
553 changes: 553 additions & 0 deletions
553
...0000_10_config-operator_01_authentications-HypershiftIndependent-CustomNoUpgrade.crd.yaml
Large diffs are not rendered by default.
Oops, something went wrong.
171 changes: 171 additions & 0 deletions
171
...nifests/0000_10_config-operator_01_authentications-HypershiftIndependent-Default.crd.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,171 @@ | ||
| apiVersion: apiextensions.k8s.io/v1 | ||
| kind: CustomResourceDefinition | ||
| metadata: | ||
| annotations: | ||
| api-approved.openshift.io: https://github.com/openshift/api/pull/470 | ||
| api.openshift.io/merged-by-featuregates: "true" | ||
| include.release.openshift.io/hypershift: "true" | ||
| release.openshift.io/feature-set: Default | ||
| name: authentications.config.openshift.io | ||
| spec: | ||
| group: config.openshift.io | ||
| names: | ||
| kind: Authentication | ||
| listKind: AuthenticationList | ||
| plural: authentications | ||
| singular: authentication | ||
| scope: Cluster | ||
| versions: | ||
| - name: v1 | ||
| schema: | ||
| openAPIV3Schema: | ||
| description: "Authentication specifies cluster-wide settings for authentication | ||
| (like OAuth and webhook token authenticators). The canonical name of an | ||
| instance is `cluster`. \n Compatibility level 1: Stable within a major release | ||
| for a minimum of 12 months or 3 minor releases (whichever is longer)." | ||
| properties: | ||
| apiVersion: | ||
| description: 'APIVersion defines the versioned schema of this representation | ||
| of an object. Servers should convert recognized schemas to the latest | ||
| internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' | ||
| type: string | ||
| kind: | ||
| description: 'Kind is a string value representing the REST resource this | ||
| object represents. Servers may infer this from the endpoint the client | ||
| submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' | ||
| type: string | ||
| metadata: | ||
| type: object | ||
| spec: | ||
| description: spec holds user settable values for configuration | ||
| properties: | ||
| oauthMetadata: | ||
| description: 'oauthMetadata contains the discovery endpoint data for | ||
| OAuth 2.0 Authorization Server Metadata for an external OAuth server. | ||
| This discovery document can be viewed from its served location: | ||
| oc get --raw ''/.well-known/oauth-authorization-server'' For further | ||
| details, see the IETF Draft: https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2 | ||
| If oauthMetadata.name is non-empty, this value has precedence over | ||
| any metadata reference stored in status. The key "oauthMetadata" | ||
| is used to locate the data. If specified and the config map or expected | ||
| key is not found, no metadata is served. If the specified metadata | ||
| is not valid, no metadata is served. The namespace for this config | ||
| map is openshift-config.' | ||
| properties: | ||
| name: | ||
| description: name is the metadata.name of the referenced config | ||
| map | ||
| type: string | ||
| required: | ||
| - name | ||
| type: object | ||
| serviceAccountIssuer: | ||
| description: 'serviceAccountIssuer is the identifier of the bound | ||
| service account token issuer. The default is https://kubernetes.default.svc | ||
| WARNING: Updating this field will not result in immediate invalidation | ||
| of all bound tokens with the previous issuer value. Instead, the | ||
| tokens issued by previous service account issuer will continue to | ||
| be trusted for a time period chosen by the platform (currently set | ||
| to 24h). This time period is subject to change over time. This allows | ||
| internal components to transition to use new service account issuer | ||
| without service distruption.' | ||
| type: string | ||
| type: | ||
| description: type identifies the cluster managed, user facing authentication | ||
| mode in use. Specifically, it manages the component that responds | ||
| to login attempts. The default is IntegratedOAuth. | ||
| enum: | ||
| - "" | ||
| - None | ||
| - IntegratedOAuth | ||
| type: string | ||
| webhookTokenAuthenticator: | ||
| description: "webhookTokenAuthenticator configures a remote token | ||
| reviewer. These remote authentication webhooks can be used to verify | ||
| bearer tokens via the tokenreviews.authentication.k8s.io REST API. | ||
| This is required to honor bearer tokens that are provisioned by | ||
| an external authentication service. \n Can only be set if \"Type\" | ||
| is set to \"None\"." | ||
| properties: | ||
| kubeConfig: | ||
| description: "kubeConfig references a secret that contains kube | ||
| config file data which describes how to access the remote webhook | ||
| service. The namespace for the referenced secret is openshift-config. | ||
| \n For further details, see: \n https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication | ||
| \n The key \"kubeConfig\" is used to locate the data. If the | ||
| secret or expected key is not found, the webhook is not honored. | ||
| If the specified kube config data is not valid, the webhook | ||
| is not honored." | ||
| properties: | ||
| name: | ||
| description: name is the metadata.name of the referenced secret | ||
| type: string | ||
| required: | ||
| - name | ||
| type: object | ||
| required: | ||
| - kubeConfig | ||
| type: object | ||
| webhookTokenAuthenticators: | ||
| description: webhookTokenAuthenticators is DEPRECATED, setting it | ||
| has no effect. | ||
| items: | ||
| description: deprecatedWebhookTokenAuthenticator holds the necessary | ||
| configuration options for a remote token authenticator. It's the | ||
| same as WebhookTokenAuthenticator but it's missing the 'required' | ||
| validation on KubeConfig field. | ||
| properties: | ||
| kubeConfig: | ||
| description: 'kubeConfig contains kube config file data which | ||
| describes how to access the remote webhook service. For further | ||
| details, see: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication | ||
| The key "kubeConfig" is used to locate the data. If the secret | ||
| or expected key is not found, the webhook is not honored. | ||
| If the specified kube config data is not valid, the webhook | ||
| is not honored. The namespace for this secret is determined | ||
| by the point of use.' | ||
| properties: | ||
| name: | ||
| description: name is the metadata.name of the referenced | ||
| secret | ||
| type: string | ||
| required: | ||
| - name | ||
| type: object | ||
| type: object | ||
| type: array | ||
| x-kubernetes-list-type: atomic | ||
| type: object | ||
| status: | ||
| description: status holds observed values from the cluster. They may not | ||
| be overridden. | ||
| properties: | ||
| integratedOAuthMetadata: | ||
| description: 'integratedOAuthMetadata contains the discovery endpoint | ||
| data for OAuth 2.0 Authorization Server Metadata for the in-cluster | ||
| integrated OAuth server. This discovery document can be viewed from | ||
| its served location: oc get --raw ''/.well-known/oauth-authorization-server'' | ||
| For further details, see the IETF Draft: https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2 | ||
| This contains the observed value based on cluster state. An explicitly | ||
| set value in spec.oauthMetadata has precedence over this field. | ||
| This field has no meaning if authentication spec.type is not set | ||
| to IntegratedOAuth. The key "oauthMetadata" is used to locate the | ||
| data. If the config map or expected key is not found, no metadata | ||
| is served. If the specified metadata is not valid, no metadata is | ||
| served. The namespace for this config map is openshift-config-managed.' | ||
| properties: | ||
| name: | ||
| description: name is the metadata.name of the referenced config | ||
| map | ||
| type: string | ||
| required: | ||
| - name | ||
| type: object | ||
| type: object | ||
| required: | ||
| - spec | ||
| type: object | ||
| served: true | ||
| storage: true | ||
| subresources: | ||
| status: {} |
Oops, something went wrong.