Skip to content

Commit 83d7dc0

Browse files
ewoutpewoutp
authored
Merge pull request #56 from arangodb/cluster-level-crd
Changed scope of ArangoLocalStorage to Cluster.
2 parents e054884 + a21d707 commit 83d7dc0

File tree

26 files changed

+436
-201
lines changed

26 files changed

+436
-201
lines changed

‎Makefile‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,14 @@ else
4040
IMAGESUFFIX := :dev
4141
endif
4242

43+
ifeq ($(MANIFESTSUFFIX),-)
44+
# Release setting
45+
MANIFESTSUFFIX :=
46+
else
4347
ifndef MANIFESTSUFFIX
4448
MANIFESTSUFFIX := -dev
4549
endif
50+
endif
4651
MANIFESTPATHDEPLOYMENT := manifests/arango-deployment$(MANIFESTSUFFIX).yaml
4752
MANIFESTPATHSTORAGE := manifests/arango-storage$(MANIFESTSUFFIX).yaml
4853
ifndef DEPLOYMENTNAMESPACE

‎manifests/arango-deployment.yaml‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
## deployment/rbac.yaml
2+
## Cluster role granting access to ArangoDeployment resources.
3+
apiVersion: rbac.authorization.k8s.io/v1beta1
4+
kind: ClusterRole
5+
metadata:
6+
name: arango-deployments
7+
rules:
8+
- apiGroups: ["database.arangodb.com"]
9+
resources: ["arangodeployments"]
10+
verbs: ["*"]
11+
12+
---
13+
14+
## Cluster role granting access to all resources needed by the ArangoDeployment operator.
15+
apiVersion: rbac.authorization.k8s.io/v1beta1
16+
kind: ClusterRole
17+
metadata:
18+
name: arango-deployment-operator
19+
rules:
20+
- apiGroups: ["database.arangodb.com"]
21+
resources: ["arangodeployments"]
22+
verbs: ["*"]
23+
- apiGroups: ["apiextensions.k8s.io"]
24+
resources: ["customresourcedefinitions"]
25+
verbs: ["get"]
26+
- apiGroups: [""]
27+
resources: ["pods", "services", "endpoints", "persistentvolumeclaims", "events", "secrets"]
28+
verbs: ["*"]
29+
- apiGroups: ["apps"]
30+
resources: ["deployments"]
31+
verbs: ["*"]
32+
- apiGroups: ["storage.k8s.io"]
33+
resources: ["storageclasses"]
34+
verbs: ["get", "list"]
35+
36+
---
37+
38+
## Bind the cluster role granting access to ArangoLocalStorage resources
39+
## to the default service account of the configured namespace.
40+
apiVersion: rbac.authorization.k8s.io/v1beta1
41+
kind: RoleBinding
42+
metadata:
43+
name: arango-deployments
44+
namespace: default
45+
roleRef:
46+
apiGroup: rbac.authorization.k8s.io
47+
kind: ClusterRole
48+
name: arango-deployments
49+
subjects:
50+
- kind: ServiceAccount
51+
name: default
52+
namespace: default
53+
54+
---
55+
56+
## Bind the cluster role granting access to all resources needed by
57+
## the ArangoDeployment operator to the default service account
58+
## the is being used to run the operator deployment.
59+
apiVersion: rbac.authorization.k8s.io/v1beta1
60+
kind: ClusterRoleBinding
61+
metadata:
62+
name: arango-deployment-operator-default
63+
roleRef:
64+
apiGroup: rbac.authorization.k8s.io
65+
kind: ClusterRole
66+
name: arango-deployment-operator
67+
subjects:
68+
- kind: ServiceAccount
69+
name: default
70+
namespace: default
71+
72+
---
73+
74+
## deployment/deployment.yaml
75+
76+
apiVersion: extensions/v1beta1
77+
kind: Deployment
78+
metadata:
79+
name: arango-deployment-operator
80+
namespace: default
81+
spec:
82+
replicas: 1
83+
template:
84+
metadata:
85+
labels:
86+
name: arango-deployment-operator
87+
spec:
88+
containers:
89+
- name: operator
90+
imagePullPolicy: IfNotPresent
91+
image: arangodb/kube-arangodb@sha256:748421ba01fd52d9589cc1830c79b62c3a7af3f4366b9cba0247e09d0a7d6e19
92+
args:
93+
- --operator.deployment
94+
env:
95+
- name: MY_POD_NAMESPACE
96+
valueFrom:
97+
fieldRef:
98+
fieldPath: metadata.namespace
99+
- name: MY_POD_NAME
100+
valueFrom:
101+
fieldRef:
102+
fieldPath: metadata.name
103+

‎manifests/arango-storage.yaml‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
## storage/rbac.yaml
2+
## Cluster role granting access to ArangoLocalStorage resources.
3+
apiVersion: rbac.authorization.k8s.io/v1beta1
4+
kind: ClusterRole
5+
metadata:
6+
name: arango-storages
7+
rules:
8+
- apiGroups: ["storage.arangodb.com"]
9+
resources: ["arangolocalstorages"]
10+
verbs: ["*"]
11+
12+
---
13+
14+
## Cluster role granting access to all resources needed by the ArangoLocalStorage operator.
15+
apiVersion: rbac.authorization.k8s.io/v1beta1
16+
kind: ClusterRole
17+
metadata:
18+
name: arango-storage-operator
19+
rules:
20+
- apiGroups: ["storage.arangodb.com"]
21+
resources: ["arangolocalstorages"]
22+
verbs: ["*"]
23+
- apiGroups: ["apiextensions.k8s.io"]
24+
resources: ["customresourcedefinitions"]
25+
verbs: ["get"]
26+
- apiGroups: [""]
27+
resources: ["persistentvolumes", "persistentvolumeclaims", "endpoints", "events", "services"]
28+
verbs: ["*"]
29+
- apiGroups: [""]
30+
resources: ["pods"]
31+
verbs: ["get"]
32+
- apiGroups: ["apps"]
33+
resources: ["daemonsets"]
34+
verbs: ["*"]
35+
- apiGroups: ["storage.k8s.io"]
36+
resources: ["storageclasses"]
37+
verbs: ["*"]
38+
39+
---
40+
41+
## Bind the cluster role granting access to ArangoLocalStorage resources
42+
## to the default service account of the configured namespace.
43+
apiVersion: rbac.authorization.k8s.io/v1beta1
44+
kind: RoleBinding
45+
metadata:
46+
name: arango-storages
47+
namespace: default
48+
roleRef:
49+
apiGroup: rbac.authorization.k8s.io
50+
kind: ClusterRole
51+
name: arango-storages
52+
subjects:
53+
- kind: ServiceAccount
54+
name: default
55+
namespace: default
56+
57+
---
58+
59+
## Bind the cluster role granting access to all resources needed by
60+
## the ArangoLocalStorage operator to the default service account
61+
## the is being used to run the operator deployment.
62+
apiVersion: rbac.authorization.k8s.io/v1beta1
63+
kind: ClusterRoleBinding
64+
metadata:
65+
name: arango-storage-operator
66+
roleRef:
67+
apiGroup: rbac.authorization.k8s.io
68+
kind: ClusterRole
69+
name: arango-storage-operator
70+
subjects:
71+
- kind: ServiceAccount
72+
name: arango-storage-operator
73+
namespace: kube-system
74+
75+
---
76+
77+
## storage/deployment.yaml
78+
## Service accounts
79+
apiVersion: v1
80+
kind: ServiceAccount
81+
metadata:
82+
namespace: kube-system
83+
name: arango-storage-operator
84+
85+
---
86+
87+
apiVersion: extensions/v1beta1
88+
kind: Deployment
89+
metadata:
90+
name: arango-storage-operator
91+
namespace: kube-system
92+
spec:
93+
replicas: 1
94+
template:
95+
metadata:
96+
labels:
97+
name: arango-storage-operator
98+
spec:
99+
serviceAccountName: arango-storage-operator
100+
containers:
101+
- name: operator
102+
imagePullPolicy: IfNotPresent
103+
image: arangodb/kube-arangodb@sha256:748421ba01fd52d9589cc1830c79b62c3a7af3f4366b9cba0247e09d0a7d6e19
104+
args:
105+
- --operator.storage
106+
env:
107+
- name: MY_POD_NAMESPACE
108+
valueFrom:
109+
fieldRef:
110+
fieldPath: metadata.namespace
111+
- name: MY_POD_NAME
112+
valueFrom:
113+
fieldRef:
114+
fieldPath: metadata.name
115+

‎manifests/crd.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,5 +30,5 @@ spec:
3030
shortNames:
3131
- arangostorage
3232
singular: arangolocalstorage
33-
scope: Namespaced
33+
scope: Cluster
3434
version: v1alpha

‎manifests/templates/deployment/deployment.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,14 @@
22
apiVersion: extensions/v1beta1
33
kind: Deployment
44
metadata:
5-
name: {{ .Deployment.OperatorName }}
6-
namespace: {{ .Deployment.Namespace }}
5+
name: {{ .Deployment.OperatorDeploymentName }}
6+
namespace: {{ .Deployment.Operator.Namespace }}
77
spec:
88
replicas: 1
99
template:
1010
metadata:
1111
labels:
12-
name: {{ .Deployment.OperatorName }}
12+
name: {{ .Deployment.OperatorDeploymentName }}
1313
spec:
1414
containers:
1515
- name: operator

‎manifests/templates/deployment/rbac.yaml‎

Lines changed: 54 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,59 +1,72 @@
11
{{- if .RBAC -}}
2+
## Cluster role granting access to ArangoDeployment resources.
23
apiVersion: rbac.authorization.k8s.io/v1beta1
34
kind: ClusterRole
45
metadata:
5-
name: {{ .Deployment.ClusterRoleName }}
6+
name: {{ .Deployment.User.RoleName }}
67
rules:
7-
- apiGroups:
8-
- database.arangodb.com
9-
resources:
10-
- arangodeployments
11-
verbs:
12-
- "*"
13-
- apiGroups:
14-
- apiextensions.k8s.io
15-
resources:
16-
- customresourcedefinitions
17-
verbs:
18-
- get
19-
- apiGroups:
20-
- ""
21-
resources:
22-
- pods
23-
- services
24-
- endpoints
25-
- persistentvolumeclaims
26-
- events
27-
- secrets
28-
verbs:
29-
- "*"
30-
- apiGroups:
31-
- apps
32-
resources:
33-
- deployments
34-
verbs:
35-
- "*"
36-
- apiGroups:
37-
- storage.k8s.io
38-
resources:
39-
- storageclasses
40-
verbs:
41-
- get
42-
- list
8+
- apiGroups: ["database.arangodb.com"]
9+
resources: ["arangodeployments"]
10+
verbs: ["*"]
4311

4412
---
4513

14+
## Cluster role granting access to all resources needed by the ArangoDeployment operator.
15+
apiVersion: rbac.authorization.k8s.io/v1beta1
16+
kind: ClusterRole
17+
metadata:
18+
name: {{ .Deployment.Operator.RoleName }}
19+
rules:
20+
- apiGroups: ["database.arangodb.com"]
21+
resources: ["arangodeployments"]
22+
verbs: ["*"]
23+
- apiGroups: ["apiextensions.k8s.io"]
24+
resources: ["customresourcedefinitions"]
25+
verbs: ["get"]
26+
- apiGroups: [""]
27+
resources: ["pods", "services", "endpoints", "persistentvolumeclaims", "events", "secrets"]
28+
verbs: ["*"]
29+
- apiGroups: ["apps"]
30+
resources: ["deployments"]
31+
verbs: ["*"]
32+
- apiGroups: ["storage.k8s.io"]
33+
resources: ["storageclasses"]
34+
verbs: ["get", "list"]
35+
36+
---
37+
38+
## Bind the cluster role granting access to ArangoLocalStorage resources
39+
## to the default service account of the configured namespace.
40+
apiVersion: rbac.authorization.k8s.io/v1beta1
41+
kind: RoleBinding
42+
metadata:
43+
name: {{ .Deployment.User.RoleBindingName }}
44+
namespace: {{ .Deployment.User.Namespace }}
45+
roleRef:
46+
apiGroup: rbac.authorization.k8s.io
47+
kind: ClusterRole
48+
name: {{ .Deployment.User.RoleName }}
49+
subjects:
50+
- kind: ServiceAccount
51+
name: {{ .Deployment.User.ServiceAccountName }}
52+
namespace: {{ .Deployment.User.Namespace }}
53+
54+
---
55+
56+
## Bind the cluster role granting access to all resources needed by
57+
## the ArangoDeployment operator to the default service account
58+
## the is being used to run the operator deployment.
4659
apiVersion: rbac.authorization.k8s.io/v1beta1
4760
kind: ClusterRoleBinding
4861
metadata:
49-
name: {{ .Deployment.ClusterRoleBindingName }}
62+
name: {{ .Deployment.Operator.RoleBindingName }}-{{ .Deployment.Operator.Namespace }}
5063
roleRef:
5164
apiGroup: rbac.authorization.k8s.io
5265
kind: ClusterRole
53-
name: {{ .Deployment.ClusterRoleName }}
66+
name: {{ .Deployment.Operator.RoleName }}
5467
subjects:
5568
- kind: ServiceAccount
56-
name: default
57-
namespace: {{ .Deployment.Namespace }}
69+
name: {{ .Deployment.Operator.ServiceAccountName }}
70+
namespace: {{ .Deployment.Operator.Namespace }}
5871

5972
{{- end -}}

0 commit comments

Comments
 (0)