diff --git a/.gitignore b/.gitignore index 3900953..4d3e0cc 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,8 @@ Makefile.dapper Makefile.shipyard Dockerfile.* helm_repo +yamls +submariner-k8s-broker/crds/crd.yaml +submariner-k8s-broker/templates/_role.tpl +submariner-operator/crds/crd.yaml +submariner-operator/templates/*-rbac.yaml diff --git a/Makefile b/Makefile index 3d579bd..349c8ca 100644 --- a/Makefile +++ b/Makefile @@ -34,7 +34,10 @@ local-helm-repo: $(CHART_PACKAGES) e2e: local-helm-repo $(SCRIPTS_DIR)/e2e.sh -%.tgz: +generate-yamls: + ./generate-yamls.sh $(BASE_BRANCH) + +%.tgz: generate-yamls helm dep update $(subst -$(CHARTS_VERSION),,$(basename $(@F))) helm package --version $(CHARTS_VERSION) --app-version $(CHARTS_VERSION) $(subst -$(CHARTS_VERSION),,$(basename $(@F))) diff --git a/extract-yamls b/extract-yamls index 2da50e7..fecee5c 100755 --- a/extract-yamls +++ b/extract-yamls @@ -4,7 +4,10 @@ /= `/ { outfile = gensub("_yaml$", ".yaml", "1", $1) print "Writing " outfile - print substr($0, index($0, "`") + 1) > outfile + firstline = substr($0, index($0, "`") + 1) + if (firstline !~ "^---") + firstline = "---\n"firstline + print firstline > outfile next } diff --git a/generate-yamls.sh b/generate-yamls.sh new file mode 100755 index 0000000..6260d8c --- /dev/null +++ b/generate-yamls.sh @@ -0,0 +1,100 @@ +#!/bin/bash + +set -e + +BROKER_ROLE_TPL=submariner-k8s-broker/templates/_role.tpl +OPERATOR_RBAC_YAML=submariner-operator/templates/operator-rbac.yaml +GATEWAY_RBAC_YAML=submariner-operator/templates/gateway-rbac.yaml +ROUTE_AGENT_RBAC_YAML=submariner-operator/templates/routeagent-rbac.yaml +GLOBALNET_RBAC_YAML=submariner-operator/templates/globalnet-rbac.yaml +SERVICE_DISC_RBAC_YAML=submariner-operator/templates/service-discovery-rbac.yaml +OPENSHIFT_MONITORING_YAML=submariner-operator/templates/openshift-monitoring-rbac.yaml + +function add_service_acct_ns() { + sed -i '/- kind: ServiceAccount/a \ \ \ \ namespace: {{ .Release.Namespace }}' $1 +} + +mkdir -p yamls +cd yamls +curl -L https://raw.githubusercontent.com/submariner-io/submariner-operator/refs/heads/$1/pkg/embeddedyamls/yamls.go | ../extract-yamls +cd - + +# Generate the CRDs for the broker chart +mkdir -p submariner-k8s-broker/crds +cat yamls/Deploy_submariner_crds_submariner_io_endpoints.yaml \ + yamls/Deploy_submariner_crds_submariner_io_clusters.yaml \ + yamls/Deploy_submariner_crds_submariner_io_gateways.yaml \ + yamls/Deploy_mcsapi_crds_multicluster_x_k8s_io_serviceexports.yaml \ + yamls/Deploy_mcsapi_crds_multicluster_x_k8s_io_serviceimports.yaml > submariner-k8s-broker/crds/crd.yaml + +# Generate the client role yaml for the broker chart +echo '{{- define "broker-role" -}}' > ${BROKER_ROLE_TPL} +cat yamls/Config_broker_broker_client_role.yaml >> ${BROKER_ROLE_TPL} +echo '{{- end -}}' >> ${BROKER_ROLE_TPL} +sed -i -e 's/name:.*/name: {{ template "submariner-k8s-broker.fullname" \. }}-cluster/' ${BROKER_ROLE_TPL} + +# Generate the CRDs for the operator chart +mkdir -p submariner-operator/crds +cat yamls/Deploy_crds_submariner_io_submariners.yaml \ + yamls/Deploy_crds_submariner_io_servicediscoveries.yaml \ + yamls/Deploy_crds_submariner_io_brokers.yaml > submariner-operator/crds/crd.yaml + +# Generate the operator RBAC yaml for the operator chart +echo '{{- if .Values.rbac.create -}}' > ${OPERATOR_RBAC_YAML} +add_service_acct_ns yamls/Config_rbac_submariner_operator_cluster_role_binding.yaml +cat yamls/Config_rbac_submariner_operator_service_account.yaml \ + yamls/Config_rbac_submariner_operator_role.yaml \ + yamls/Config_rbac_submariner_operator_role_binding.yaml \ + yamls/Config_rbac_submariner_operator_cluster_role.yaml \ + yamls/Config_rbac_submariner_operator_cluster_role_binding.yaml > ${OPERATOR_RBAC_YAML} +echo '{{- end -}}' >> ${OPERATOR_RBAC_YAML} + +# Generate the gateway RBAC yaml for the operator chart +echo '{{- if .Values.rbac.create -}}' > ${GATEWAY_RBAC_YAML} +add_service_acct_ns yamls/Config_rbac_submariner_gateway_cluster_role_binding.yaml +cat yamls/Config_rbac_submariner_gateway_service_account.yaml \ + yamls/Config_rbac_submariner_gateway_role.yaml \ + yamls/Config_rbac_submariner_gateway_role_binding.yaml \ + yamls/Config_rbac_submariner_gateway_cluster_role.yaml \ + yamls/Config_rbac_submariner_gateway_cluster_role_binding.yaml > ${GATEWAY_RBAC_YAML} +echo '{{- end -}}' >> ${GATEWAY_RBAC_YAML} + +# Generate the routeagent RBAC yaml for the operator chart +echo '{{- if .Values.rbac.create -}}' > ${ROUTE_AGENT_RBAC_YAML} +add_service_acct_ns yamls/Config_rbac_submariner_route_agent_cluster_role_binding.yaml +cat yamls/Config_rbac_submariner_route_agent_service_account.yaml \ + yamls/Config_rbac_submariner_route_agent_role.yaml \ + yamls/Config_rbac_submariner_route_agent_role_binding.yaml \ + yamls/Config_rbac_submariner_route_agent_cluster_role.yaml \ + yamls/Config_rbac_submariner_route_agent_cluster_role_binding.yaml > ${ROUTE_AGENT_RBAC_YAML} +echo '{{- end -}}' >> ${ROUTE_AGENT_RBAC_YAML} + +# Generate the globalnet RBAC yaml for the operator chart +echo '{{- if .Values.rbac.create -}}' > ${GLOBALNET_RBAC_YAML} +echo '{{- if .Values.broker.globalnet }}' > ${GLOBALNET_RBAC_YAML} +add_service_acct_ns yamls/Config_rbac_submariner_globalnet_cluster_role_binding.yaml +cat yamls/Config_rbac_submariner_globalnet_service_account.yaml \ + yamls/Config_rbac_submariner_globalnet_role.yaml \ + yamls/Config_rbac_submariner_globalnet_role_binding.yaml \ + yamls/Config_rbac_submariner_globalnet_cluster_role.yaml \ + yamls/Config_rbac_submariner_globalnet_cluster_role_binding.yaml >> ${GLOBALNET_RBAC_YAML} +echo '{{- end -}}' >> ${GLOBALNET_RBAC_YAML} + +# Generate the service discovery RBAC yaml for the operator chart +echo '{{- if .Values.rbac.create -}}' > ${SERVICE_DISC_RBAC_YAML} +echo '{{- if .Values.submariner.serviceDiscovery }}' > ${SERVICE_DISC_RBAC_YAML} +add_service_acct_ns yamls/Config_rbac_lighthouse_agent_cluster_role_binding.yaml +add_service_acct_ns yamls/Config_rbac_lighthouse_coredns_cluster_role_binding.yaml +cat yamls/Config_rbac_lighthouse_agent_service_account.yaml \ + yamls/Config_rbac_lighthouse_agent_cluster_role.yaml \ + yamls/Config_rbac_lighthouse_agent_cluster_role_binding.yaml \ + yamls/Config_rbac_lighthouse_coredns_service_account.yaml \ + yamls/Config_rbac_lighthouse_coredns_cluster_role.yaml \ + yamls/Config_rbac_lighthouse_coredns_cluster_role_binding.yaml >> ${SERVICE_DISC_RBAC_YAML} +echo '{{- end -}}' >> ${SERVICE_DISC_RBAC_YAML} + +# Generate the openshift monitoring rbac yaml for the operator chart +echo '{{- if .Values.rbac.create -}}' > ${OPENSHIFT_MONITORING_YAML} +cat yamls/Config_openshift_rbac_submariner_metrics_reader_role.yaml \ + yamls/Config_openshift_rbac_submariner_metrics_reader_role_binding.yaml >> ${OPENSHIFT_MONITORING_YAML} +echo '{{- end -}}' >> ${OPENSHIFT_MONITORING_YAML} diff --git a/submariner-k8s-broker/crds/crd.yaml b/submariner-k8s-broker/crds/crd.yaml deleted file mode 100644 index 747db6b..0000000 --- a/submariner-k8s-broker/crds/crd.yaml +++ /dev/null @@ -1,560 +0,0 @@ -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: clusters.submariner.io -spec: - group: submariner.io - names: - kind: Cluster - listKind: ClusterList - plural: clusters - singular: cluster - scope: Namespaced - versions: - - name: v1 - schema: - openAPIV3Schema: - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - properties: - cluster_cidr: - items: - type: string - type: array - cluster_id: - type: string - color_codes: - items: - type: string - type: array - global_cidr: - items: - type: string - type: array - service_cidr: - items: - type: string - type: array - required: - - cluster_cidr - - cluster_id - - color_codes - - global_cidr - - service_cidr - type: object - required: - - spec - type: object - served: true - storage: true -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: endpoints.submariner.io -spec: - group: submariner.io - names: - kind: Endpoint - listKind: EndpointList - plural: endpoints - singular: endpoint - scope: Namespaced - versions: - - name: v1 - schema: - openAPIV3Schema: - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - properties: - backend: - type: string - backend_config: - additionalProperties: - type: string - type: object - cable_name: - type: string - cluster_id: - type: string - healthCheckIP: - type: string - hostname: - type: string - nat_enabled: - type: boolean - private_ip: - type: string - public_ip: - type: string - subnets: - items: - type: string - type: array - required: - - backend - - cable_name - - cluster_id - - hostname - - nat_enabled - - private_ip - - public_ip - - subnets - type: object - required: - - spec - type: object - served: true - storage: true -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: gateways.submariner.io -spec: - group: submariner.io - names: - kind: Gateway - listKind: GatewayList - plural: gateways - singular: gateway - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: High availability status of the Gateway - jsonPath: .status.haStatus - name: HA Status - type: string - name: v1 - schema: - openAPIV3Schema: - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - status: - properties: - connections: - items: - properties: - endpoint: - properties: - backend: - type: string - backend_config: - additionalProperties: - type: string - type: object - cable_name: - type: string - cluster_id: - type: string - healthCheckIP: - type: string - hostname: - type: string - nat_enabled: - type: boolean - private_ip: - type: string - public_ip: - type: string - subnets: - items: - type: string - type: array - required: - - backend - - cable_name - - cluster_id - - hostname - - nat_enabled - - private_ip - - public_ip - - subnets - type: object - latency: - description: LatencySpec describes the round trip time information - in nanoseconds for a packet between the gateway pods of two - clusters. - properties: - averageRTT: - format: int64 - type: integer - lastRTT: - description: TODO This shall be deleted once the operator - is using the latest. Using Optional to avoid validation - errors when this field is not used. - format: int64 - type: integer - maxRTT: - format: int64 - type: integer - minRTT: - format: int64 - type: integer - stddevRTT: - format: int64 - type: integer - type: object - latencyRTT: - description: LatencySpec describes the round trip time information - for a packet between the gateway pods of two clusters. - properties: - average: - type: string - last: - type: string - max: - type: string - min: - type: string - stdDev: - type: string - type: object - status: - type: string - statusMessage: - type: string - required: - - endpoint - - status - - statusMessage - type: object - type: array - haStatus: - type: string - localEndpoint: - properties: - backend: - type: string - backend_config: - additionalProperties: - type: string - type: object - cable_name: - type: string - cluster_id: - type: string - healthCheckIP: - type: string - hostname: - type: string - nat_enabled: - type: boolean - private_ip: - type: string - public_ip: - type: string - subnets: - items: - type: string - type: array - required: - - backend - - cable_name - - cluster_id - - hostname - - nat_enabled - - private_ip - - public_ip - - subnets - type: object - statusFailure: - type: string - version: - type: string - required: - - connections - - haStatus - - localEndpoint - - statusFailure - - version - type: object - required: - - status - type: object - served: true - storage: true - subresources: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: serviceexports.multicluster.x-k8s.io -spec: - group: multicluster.x-k8s.io - scope: Namespaced - names: - plural: serviceexports - singular: serviceexport - kind: ServiceExport - shortNames: - - svcex - versions: - - name: v1alpha1 - served: true - storage: true - subresources: - status: {} - additionalPrinterColumns: - - name: Age - type: date - jsonPath: .metadata.creationTimestamp - "schema": - "openAPIV3Schema": - description: ServiceExport declares that the Service with the same name and - namespace as this export should be consumable from other clusters. - type: object - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - status: - description: status describes the current state of an exported service. - Service configuration comes from the Service that had the same name - and namespace as this ServiceExport. Populated by the multi-cluster - service implementation's controller. - type: object - properties: - conditions: - type: array - items: - description: "ServiceExportCondition contains details for the current - condition of this service export. \n Once [KEP-1623](https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/1623-standardize-conditions) - is implemented, this will be replaced by metav1.Condition." - type: object - required: - - status - - type - properties: - lastTransitionTime: - type: string - format: date-time - message: - type: string - reason: - type: string - status: - description: Status is one of {"True", "False", "Unknown"} - type: string - enum: - - "True" - - "False" - - Unknown - type: - description: ServiceExportConditionType identifies a specific - condition. - type: string - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: serviceimports.multicluster.x-k8s.io -spec: - group: multicluster.x-k8s.io - scope: Namespaced - names: - plural: serviceimports - singular: serviceimport - kind: ServiceImport - shortNames: - - svcim - versions: - - name: v1alpha1 - served: true - storage: true - subresources: - status: {} - additionalPrinterColumns: - - name: Type - type: string - description: The type of this ServiceImport - jsonPath: .spec.type - - name: IP - type: string - description: The VIP for this ServiceImport - jsonPath: .spec.ips - - name: Age - type: date - jsonPath: .metadata.creationTimestamp - "schema": - "openAPIV3Schema": - description: ServiceImport describes a service imported from clusters in a - ClusterSet. - type: object - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: spec defines the behavior of a ServiceImport. - type: object - required: - - ports - - type - properties: - ips: - description: ip will be used as the VIP for this service when type - is ClusterSetIP. - type: array - maxItems: 1 - items: - type: string - ports: - type: array - items: - description: ServicePort represents the port on which the service - is exposed - type: object - required: - - port - properties: - appProtocol: - description: The application protocol for this port. This field - follows standard Kubernetes label syntax. Un-prefixed names - are reserved for IANA standard service names (as per RFC-6335 - and http://www.iana.org/assignments/service-names). Non-standard - protocols should use prefixed names such as mycompany.com/my-custom-protocol. - Field can be enabled with ServiceAppProtocol feature gate. - type: string - name: - description: The name of this port within the service. This - must be a DNS_LABEL. All ports within a ServiceSpec must have - unique names. When considering the endpoints for a Service, - this must match the 'name' field in the EndpointPort. Optional - if only one ServicePort is defined on this service. - type: string - port: - description: The port that will be exposed by this service. - type: integer - format: int32 - protocol: - description: The IP protocol for this port. Supports "TCP", - "UDP", and "SCTP". Default is TCP. - type: string - x-kubernetes-list-type: atomic - sessionAffinity: - description: 'Supports "ClientIP" and "None". Used to maintain session - affinity. Enable client IP based session affinity. Must be ClientIP - or None. Defaults to None. Ignored when type is Headless More info: - https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies' - type: string - sessionAffinityConfig: - description: sessionAffinityConfig contains session affinity configuration. - type: object - properties: - clientIP: - description: clientIP contains the configurations of Client IP - based session affinity. - type: object - properties: - timeoutSeconds: - description: timeoutSeconds specifies the seconds of ClientIP - type session sticky time. The value must be >0 && <=86400(for - 1 day) if ServiceAffinity == "ClientIP". Default value is - 10800(for 3 hours). - type: integer - format: int32 - type: - description: type defines the type of this service. Must be ClusterSetIP - or Headless. - type: string - enum: - - ClusterSetIP - - Headless - status: - description: status contains information about the exported services that - form the multi-cluster service referenced by this ServiceImport. - type: object - properties: - clusters: - description: clusters is the list of exporting clusters from which - this service was derived. - type: array - items: - description: ClusterStatus contains service configuration mapped - to a specific source cluster - type: object - required: - - cluster - properties: - cluster: - description: cluster is the name of the exporting cluster. Must - be a valid RFC-1123 DNS label. - type: string - x-kubernetes-list-map-keys: - - cluster - x-kubernetes-list-type: map diff --git a/submariner-k8s-broker/templates/rbac.yaml b/submariner-k8s-broker/templates/rbac.yaml index 47c8067..df4a2d9 100644 --- a/submariner-k8s-broker/templates/rbac.yaml +++ b/submariner-k8s-broker/templates/rbac.yaml @@ -1,26 +1,5 @@ {{- if .Values.rbac.create -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ template "submariner-k8s-broker.fullname" . }}-cluster - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner-k8s-broker.chart" . }} - app: {{ template "submariner-k8s-broker.name" . }} -rules: -- apiGroups: ["submariner.io"] - resources: ["clusters", "endpoints"] - verbs: ["create", "get", "list", "watch", "patch", "update", "delete"] -- apiGroups: ["lighthouse.submariner.io"] - resources: ["*"] - verbs: ["create", "get", "list", "watch", "patch", "update", "delete"] -- apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices", "endpointslices/restricted"] - verbs: ["create", "get", "list", "watch","patch", "update", "delete"] -- apiGroups: ["multicluster.x-k8s.io"] - resources: ["*"] - verbs: ["create", "get", "list", "watch", "update", "delete"] +{{ include "broker-role" $ }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding diff --git a/submariner-operator/crds/crd.yaml b/submariner-operator/crds/crd.yaml deleted file mode 100644 index afd98b9..0000000 --- a/submariner-operator/crds/crd.yaml +++ /dev/null @@ -1,1190 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.12.1 - name: submariners.submariner.io -spec: - group: submariner.io - names: - kind: Submariner - listKind: SubmarinerList - plural: submariners - singular: submariner - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: Submariner is the Schema for the submariners API. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: SubmarinerSpec defines the desired state of Submariner. - properties: - airGappedDeployment: - type: boolean - broker: - description: Type of broker (must be "k8s"). - type: string - brokerK8sApiServer: - description: The broker API URL. - type: string - brokerK8sApiServerToken: - description: The broker API Token. - type: string - brokerK8sCA: - description: The broker certificate authority. - type: string - brokerK8sInsecure: - type: boolean - brokerK8sRemoteNamespace: - description: The Broker namespace. - type: string - brokerK8sSecret: - type: string - cableDriver: - description: Cable driver implementation - any of [libreswan, wireguard, - vxlan]. - type: string - ceIPSecDebug: - description: Enable logging IPsec debugging information. - type: boolean - ceIPSecForceUDPEncaps: - description: Force UDP encapsulation for IPsec. - type: boolean - ceIPSecIKEPort: - description: The IPsec IKE port (500 usually). - type: integer - ceIPSecNATTPort: - description: The IPsec NAT traversal port (4500 usually). - type: integer - ceIPSecPSK: - description: The IPsec Pre-Shared Key which must be identical in all - route agents across the cluster. - type: string - ceIPSecPSKSecret: - type: string - ceIPSecPreferredServer: - description: Enable this cluster as a preferred server for data-plane - connections. - type: boolean - clusterCIDR: - description: The cluster CIDR. - type: string - clusterID: - description: The cluster ID used to identify the tunnels. - type: string - clustersetIPCIDR: - description: ClustersetIP CIDR for allocating ClustersetIPs to exported - services. - type: string - colorCodes: - type: string - connectionHealthCheck: - description: The gateway connection health check. - properties: - enabled: - description: Enable the connection health check. - type: boolean - intervalSeconds: - description: The interval at which health check pings are sent. - format: int64 - type: integer - maxPacketLossCount: - description: The maximum number of packets lost at which the health - checker will mark the connection as down. - format: int64 - type: integer - type: object - coreDNSCustomConfig: - description: Name of the custom CoreDNS configmap to configure forwarding - to Lighthouse. It should be in / format where - is optional and defaults to kube-system. - properties: - configMapName: - description: Name of the custom CoreDNS configmap. - type: string - namespace: - description: Namespace of the custom CoreDNS configmap. - type: string - type: object - customDomains: - description: List of domains to use for multi-cluster service discovery. - items: - type: string - type: array - x-kubernetes-list-type: set - debug: - description: Enable operator debugging. - type: boolean - globalCIDR: - description: The Global CIDR super-net range for allocating GlobalCIDRs - to each cluster. - type: string - haltOnCertificateError: - description: Halt on certificate error (so the pod gets restarted). - type: boolean - imageOverrides: - additionalProperties: - type: string - description: Override component images. - type: object - loadBalancerEnabled: - description: Enable automatic Load Balancer in front of the gateways. - type: boolean - namespace: - description: The namespace in which to deploy the submariner operator. - type: string - natEnabled: - description: Enable NAT between clusters. - type: boolean - nodeSelector: - additionalProperties: - type: string - type: object - repository: - description: The image repository. - type: string - serviceCIDR: - description: The service CIDR. - type: string - serviceDiscoveryEnabled: - description: Enable support for Service Discovery (Lighthouse). - type: boolean - clustersetIPEnabled: - description: Enable ClustersetIP default for services exported on this - cluster. - type: boolean - tolerations: - items: - description: The pod this Toleration is attached to tolerates any - taint that matches the triple using the matching - operator . - properties: - effect: - description: Effect indicates the taint effect to match. Empty - means match all taint effects. When specified, allowed values - are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: Key is the taint key that the toleration applies - to. Empty means match all taint keys. If the key is empty, - operator must be Exists; this combination means to match all - values and all keys. - type: string - operator: - description: Operator represents a key's relationship to the - value. Valid operators are Exists and Equal. Defaults to Equal. - Exists is equivalent to wildcard for value, so that a pod - can tolerate all taints of a particular category. - type: string - tolerationSeconds: - description: TolerationSeconds represents the period of time - the toleration (which must be of effect NoExecute, otherwise - this field is ignored) tolerates the taint. By default, it - is not set, which means tolerate the taint forever (do not - evict). Zero and negative values will be treated as 0 (evict - immediately) by the system. - format: int64 - type: integer - value: - description: Value is the taint value the toleration matches - to. If the operator is Exists, the value should be empty, - otherwise just a regular string. - type: string - type: object - type: array - version: - description: The image tag. - type: string - required: - - broker - - brokerK8sApiServer - - brokerK8sRemoteNamespace - - ceIPSecDebug - - clusterCIDR - - clusterID - - debug - - namespace - - natEnabled - - serviceCIDR - type: object - status: - description: SubmarinerStatus defines the observed state of Submariner. - properties: - airGappedDeployment: - type: boolean - clusterCIDR: - description: The current cluster CIDR. - type: string - clusterID: - description: The current cluster ID. - type: string - clustersetIPCIDR: - description: The current clustersetIP CIDR. - type: string - colorCodes: - type: string - deploymentInfo: - description: Information about the deployment. - properties: - cloudProvider: - type: string - kubernetesType: - type: string - kubernetesTypeVersion: - type: string - kubernetesVersion: - type: string - type: object - gatewayDaemonSetStatus: - description: The status of the gateway DaemonSet. - properties: - lastResourceVersion: - type: string - mismatchedContainerImages: - type: boolean - nonReadyContainerStates: - items: - description: ContainerState holds a possible state of container. - Only one of its members may be specified. If none of them - is specified, the default one is ContainerStateWaiting. - properties: - running: - description: Details about a running container - properties: - startedAt: - description: Time at which the container was last (re-)started - format: date-time - type: string - type: object - terminated: - description: Details about a terminated container - properties: - containerID: - description: Container's ID in the format '://' - type: string - exitCode: - description: Exit status from the last termination of - the container - format: int32 - type: integer - finishedAt: - description: Time at which the container last terminated - format: date-time - type: string - message: - description: Message regarding the last termination - of the container - type: string - reason: - description: (brief) reason from the last termination - of the container - type: string - signal: - description: Signal from the last termination of the - container - format: int32 - type: integer - startedAt: - description: Time at which previous execution of the - container started - format: date-time - type: string - required: - - exitCode - type: object - waiting: - description: Details about a waiting container - properties: - message: - description: Message regarding why the container is - not yet running. - type: string - reason: - description: (brief) reason the container is not yet - running. - type: string - type: object - type: object - type: array - status: - description: DaemonSetStatus represents the current status of - a daemon set. - properties: - collisionCount: - description: Count of hash collisions for the DaemonSet. The - DaemonSet controller uses this field as a collision avoidance - mechanism when it needs to create the name for the newest - ControllerRevision. - format: int32 - type: integer - conditions: - description: Represents the latest available observations - of a DaemonSet's current state. - items: - description: DaemonSetCondition describes the state of a - DaemonSet at a certain point. - properties: - lastTransitionTime: - description: Last time the condition transitioned from - one status to another. - format: date-time - type: string - message: - description: A human readable message indicating details - about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - status: - description: Status of the condition, one of True, False, - Unknown. - type: string - type: - description: Type of DaemonSet condition. - type: string - required: - - status - - type - type: object - type: array - currentNumberScheduled: - description: 'The number of nodes that are running at least - 1 daemon pod and are supposed to run the daemon pod. More - info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/' - format: int32 - type: integer - desiredNumberScheduled: - description: 'The total number of nodes that should be running - the daemon pod (including nodes correctly running the daemon - pod). More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/' - format: int32 - type: integer - numberAvailable: - description: The number of nodes that should be running the - daemon pod and have one or more of the daemon pod running - and available (ready for at least spec.minReadySeconds) - format: int32 - type: integer - numberMisscheduled: - description: 'The number of nodes that are running the daemon - pod, but are not supposed to run the daemon pod. More info: - https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/' - format: int32 - type: integer - numberReady: - description: numberReady is the number of nodes that should - be running the daemon pod and have one or more of the daemon - pod running with a Ready Condition. - format: int32 - type: integer - numberUnavailable: - description: The number of nodes that should be running the - daemon pod and have none of the daemon pod running and available - (ready for at least spec.minReadySeconds) - format: int32 - type: integer - observedGeneration: - description: The most recent generation observed by the daemon - set controller. - format: int64 - type: integer - updatedNumberScheduled: - description: The total number of nodes that are running updated - daemon pod - format: int32 - type: integer - required: - - currentNumberScheduled - - desiredNumberScheduled - - numberMisscheduled - - numberReady - type: object - required: - - mismatchedContainerImages - type: object - gateways: - description: Status of the gateways in the cluster. - items: - properties: - connections: - items: - properties: - endpoint: - properties: - backend: - type: string - backend_config: - additionalProperties: - type: string - type: object - cable_name: - type: string - cluster_id: - maxLength: 63 - minLength: 1 - type: string - healthCheckIP: - type: string - hostname: - type: string - nat_enabled: - type: boolean - private_ip: - type: string - public_ip: - type: string - subnets: - items: - type: string - type: array - required: - - backend - - cable_name - - cluster_id - - hostname - - nat_enabled - - private_ip - - public_ip - - subnets - type: object - latencyRTT: - description: LatencySpec describes the round trip time - information for a packet between the gateway pods of - two clusters. - properties: - average: - type: string - last: - type: string - max: - type: string - min: - type: string - stdDev: - type: string - type: object - status: - type: string - statusMessage: - type: string - usingIP: - type: string - usingNAT: - type: boolean - required: - - endpoint - - status - - statusMessage - type: object - type: array - haStatus: - type: string - localEndpoint: - properties: - backend: - type: string - backend_config: - additionalProperties: - type: string - type: object - cable_name: - type: string - cluster_id: - maxLength: 63 - minLength: 1 - type: string - healthCheckIP: - type: string - hostname: - type: string - nat_enabled: - type: boolean - private_ip: - type: string - public_ip: - type: string - subnets: - items: - type: string - type: array - required: - - backend - - cable_name - - cluster_id - - hostname - - nat_enabled - - private_ip - - public_ip - - subnets - type: object - statusFailure: - type: string - version: - type: string - required: - - connections - - haStatus - - localEndpoint - - statusFailure - - version - type: object - type: array - globalCIDR: - description: The current global CIDR. - type: string - globalnetDaemonSetStatus: - description: The status of the Globalnet DaemonSet. - properties: - lastResourceVersion: - type: string - mismatchedContainerImages: - type: boolean - nonReadyContainerStates: - items: - description: ContainerState holds a possible state of container. - Only one of its members may be specified. If none of them - is specified, the default one is ContainerStateWaiting. - properties: - running: - description: Details about a running container - properties: - startedAt: - description: Time at which the container was last (re-)started - format: date-time - type: string - type: object - terminated: - description: Details about a terminated container - properties: - containerID: - description: Container's ID in the format '://' - type: string - exitCode: - description: Exit status from the last termination of - the container - format: int32 - type: integer - finishedAt: - description: Time at which the container last terminated - format: date-time - type: string - message: - description: Message regarding the last termination - of the container - type: string - reason: - description: (brief) reason from the last termination - of the container - type: string - signal: - description: Signal from the last termination of the - container - format: int32 - type: integer - startedAt: - description: Time at which previous execution of the - container started - format: date-time - type: string - required: - - exitCode - type: object - waiting: - description: Details about a waiting container - properties: - message: - description: Message regarding why the container is - not yet running. - type: string - reason: - description: (brief) reason the container is not yet - running. - type: string - type: object - type: object - type: array - status: - description: DaemonSetStatus represents the current status of - a daemon set. - properties: - collisionCount: - description: Count of hash collisions for the DaemonSet. The - DaemonSet controller uses this field as a collision avoidance - mechanism when it needs to create the name for the newest - ControllerRevision. - format: int32 - type: integer - conditions: - description: Represents the latest available observations - of a DaemonSet's current state. - items: - description: DaemonSetCondition describes the state of a - DaemonSet at a certain point. - properties: - lastTransitionTime: - description: Last time the condition transitioned from - one status to another. - format: date-time - type: string - message: - description: A human readable message indicating details - about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - status: - description: Status of the condition, one of True, False, - Unknown. - type: string - type: - description: Type of DaemonSet condition. - type: string - required: - - status - - type - type: object - type: array - currentNumberScheduled: - description: 'The number of nodes that are running at least - 1 daemon pod and are supposed to run the daemon pod. More - info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/' - format: int32 - type: integer - desiredNumberScheduled: - description: 'The total number of nodes that should be running - the daemon pod (including nodes correctly running the daemon - pod). More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/' - format: int32 - type: integer - numberAvailable: - description: The number of nodes that should be running the - daemon pod and have one or more of the daemon pod running - and available (ready for at least spec.minReadySeconds) - format: int32 - type: integer - numberMisscheduled: - description: 'The number of nodes that are running the daemon - pod, but are not supposed to run the daemon pod. More info: - https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/' - format: int32 - type: integer - numberReady: - description: numberReady is the number of nodes that should - be running the daemon pod and have one or more of the daemon - pod running with a Ready Condition. - format: int32 - type: integer - numberUnavailable: - description: The number of nodes that should be running the - daemon pod and have none of the daemon pod running and available - (ready for at least spec.minReadySeconds) - format: int32 - type: integer - observedGeneration: - description: The most recent generation observed by the daemon - set controller. - format: int64 - type: integer - updatedNumberScheduled: - description: The total number of nodes that are running updated - daemon pod - format: int32 - type: integer - required: - - currentNumberScheduled - - desiredNumberScheduled - - numberMisscheduled - - numberReady - type: object - required: - - mismatchedContainerImages - type: object - loadBalancerStatus: - description: The status of the load balancer DaemonSet. - properties: - status: - description: LoadBalancerStatus represents the status of a load-balancer. - properties: - ingress: - description: Ingress is a list containing ingress points for - the load-balancer. Traffic intended for the service should - be sent to these ingress points. - items: - description: 'LoadBalancerIngress represents the status - of a load-balancer ingress point: traffic intended for - the service should be sent to an ingress point.' - properties: - hostname: - description: Hostname is set for load-balancer ingress - points that are DNS based (typically AWS load-balancers) - type: string - ip: - description: IP is set for load-balancer ingress points - that are IP based (typically GCE or OpenStack load-balancers) - type: string - ports: - description: Ports is a list of records of service ports - If used, every port defined in the service should - have an entry in it - items: - properties: - error: - description: 'Error is to record the problem with - the service port The format of the error shall - comply with the following rules: - built-in - error values shall be specified in this file - and those shall use CamelCase names - cloud - provider specific error values must have names - that comply with the format foo.example.com/CamelCase. - --- The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)' - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - port: - description: Port is the port number of the service - port of which status is recorded here - format: int32 - type: integer - protocol: - default: TCP - description: 'Protocol is the protocol of the - service port of which status is recorded here - The supported values are: "TCP", "UDP", "SCTP"' - type: string - required: - - port - - protocol - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: array - type: object - type: object - natEnabled: - description: The current NAT status. - type: boolean - networkPlugin: - description: The current network plugin. - type: string - routeAgentDaemonSetStatus: - description: The status of the route agent DaemonSet. - properties: - lastResourceVersion: - type: string - mismatchedContainerImages: - type: boolean - nonReadyContainerStates: - items: - description: ContainerState holds a possible state of container. - Only one of its members may be specified. If none of them - is specified, the default one is ContainerStateWaiting. - properties: - running: - description: Details about a running container - properties: - startedAt: - description: Time at which the container was last (re-)started - format: date-time - type: string - type: object - terminated: - description: Details about a terminated container - properties: - containerID: - description: Container's ID in the format '://' - type: string - exitCode: - description: Exit status from the last termination of - the container - format: int32 - type: integer - finishedAt: - description: Time at which the container last terminated - format: date-time - type: string - message: - description: Message regarding the last termination - of the container - type: string - reason: - description: (brief) reason from the last termination - of the container - type: string - signal: - description: Signal from the last termination of the - container - format: int32 - type: integer - startedAt: - description: Time at which previous execution of the - container started - format: date-time - type: string - required: - - exitCode - type: object - waiting: - description: Details about a waiting container - properties: - message: - description: Message regarding why the container is - not yet running. - type: string - reason: - description: (brief) reason the container is not yet - running. - type: string - type: object - type: object - type: array - status: - description: DaemonSetStatus represents the current status of - a daemon set. - properties: - collisionCount: - description: Count of hash collisions for the DaemonSet. The - DaemonSet controller uses this field as a collision avoidance - mechanism when it needs to create the name for the newest - ControllerRevision. - format: int32 - type: integer - conditions: - description: Represents the latest available observations - of a DaemonSet's current state. - items: - description: DaemonSetCondition describes the state of a - DaemonSet at a certain point. - properties: - lastTransitionTime: - description: Last time the condition transitioned from - one status to another. - format: date-time - type: string - message: - description: A human readable message indicating details - about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - status: - description: Status of the condition, one of True, False, - Unknown. - type: string - type: - description: Type of DaemonSet condition. - type: string - required: - - status - - type - type: object - type: array - currentNumberScheduled: - description: 'The number of nodes that are running at least - 1 daemon pod and are supposed to run the daemon pod. More - info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/' - format: int32 - type: integer - desiredNumberScheduled: - description: 'The total number of nodes that should be running - the daemon pod (including nodes correctly running the daemon - pod). More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/' - format: int32 - type: integer - numberAvailable: - description: The number of nodes that should be running the - daemon pod and have one or more of the daemon pod running - and available (ready for at least spec.minReadySeconds) - format: int32 - type: integer - numberMisscheduled: - description: 'The number of nodes that are running the daemon - pod, but are not supposed to run the daemon pod. More info: - https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/' - format: int32 - type: integer - numberReady: - description: numberReady is the number of nodes that should - be running the daemon pod and have one or more of the daemon - pod running with a Ready Condition. - format: int32 - type: integer - numberUnavailable: - description: The number of nodes that should be running the - daemon pod and have none of the daemon pod running and available - (ready for at least spec.minReadySeconds) - format: int32 - type: integer - observedGeneration: - description: The most recent generation observed by the daemon - set controller. - format: int64 - type: integer - updatedNumberScheduled: - description: The total number of nodes that are running updated - daemon pod - format: int32 - type: integer - required: - - currentNumberScheduled - - desiredNumberScheduled - - numberMisscheduled - - numberReady - type: object - required: - - mismatchedContainerImages - type: object - serviceCIDR: - description: The current service CIDR. - type: string - version: - description: The image version in use by the various Submariner DaemonSets - and Deployments. - type: string - required: - - clusterID - - natEnabled - type: object - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.12.1 - name: servicediscoveries.submariner.io -spec: - group: submariner.io - names: - kind: ServiceDiscovery - listKind: ServiceDiscoveryList - plural: servicediscoveries - singular: servicediscovery - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: ServiceDiscovery is the Schema for the servicediscoveries API. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: ServiceDiscoverySpec defines the desired state of ServiceDiscovery. - properties: - brokerK8sApiServer: - type: string - brokerK8sApiServerToken: - type: string - brokerK8sCA: - type: string - brokerK8sInsecure: - type: boolean - brokerK8sRemoteNamespace: - type: string - brokerK8sSecret: - type: string - clusterID: - type: string - clustersetIPCIDR: - type: string - coreDNSCustomConfig: - properties: - configMapName: - description: Name of the custom CoreDNS configmap. - type: string - namespace: - description: Namespace of the custom CoreDNS configmap. - type: string - type: object - customDomains: - items: - type: string - type: array - x-kubernetes-list-type: set - debug: - type: boolean - globalnetEnabled: - type: boolean - haltOnCertificateError: - type: boolean - clustersetIPEnabled: - type: boolean - imageOverrides: - additionalProperties: - type: string - type: object - namespace: - type: string - nodeSelector: - additionalProperties: - type: string - type: object - repository: - type: string - tolerations: - items: - description: The pod this Toleration is attached to tolerates any - taint that matches the triple using the matching - operator . - properties: - effect: - description: Effect indicates the taint effect to match. Empty - means match all taint effects. When specified, allowed values - are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: Key is the taint key that the toleration applies - to. Empty means match all taint keys. If the key is empty, - operator must be Exists; this combination means to match all - values and all keys. - type: string - operator: - description: Operator represents a key's relationship to the - value. Valid operators are Exists and Equal. Defaults to Equal. - Exists is equivalent to wildcard for value, so that a pod - can tolerate all taints of a particular category. - type: string - tolerationSeconds: - description: TolerationSeconds represents the period of time - the toleration (which must be of effect NoExecute, otherwise - this field is ignored) tolerates the taint. By default, it - is not set, which means tolerate the taint forever (do not - evict). Zero and negative values will be treated as 0 (evict - immediately) by the system. - format: int64 - type: integer - value: - description: Value is the taint value the toleration matches - to. If the operator is Exists, the value should be empty, - otherwise just a regular string. - type: string - type: object - type: array - version: - type: string - required: - - brokerK8sApiServer - - brokerK8sRemoteNamespace - - clusterID - - debug - - namespace - type: object - status: - description: ServiceDiscoveryStatus defines the observed state of ServiceDiscovery. - properties: - deploymentInfo: - properties: - cloudProvider: - type: string - kubernetesType: - type: string - kubernetesTypeVersion: - type: string - kubernetesVersion: - type: string - type: object - type: object - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.3.0 - creationTimestamp: null - name: brokers.submariner.io -spec: - group: submariner.io - names: - kind: Broker - listKind: BrokerList - plural: brokers - singular: broker - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: Broker is the Schema for the brokers API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: BrokerSpec defines the desired state of Broker - properties: - components: - items: - type: string - type: array - defaultCustomDomains: - items: - type: string - type: array - defaultGlobalnetClusterSize: - type: integer - globalnetCIDRRange: - type: string - globalnetEnabled: - type: boolean - type: object - status: - description: BrokerStatus defines the observed state of Broker - type: object - type: object - served: true - storage: true - subresources: - status: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] diff --git a/submariner-operator/templates/_helpers.tpl b/submariner-operator/templates/_helpers.tpl index 778ac0a..9f5145d 100644 --- a/submariner-operator/templates/_helpers.tpl +++ b/submariner-operator/templates/_helpers.tpl @@ -1,11 +1,4 @@ {{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "submariner.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - {{/* Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). @@ -31,75 +24,3 @@ Create chart name and version as used by the chart label. {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} {{- end -}} -{{/* -Create the name of the submariner-operator service account to use -*/}} -{{- define "submariner.operatorServiceAccountName" -}} -{{- if .Values.serviceAccounts.operator.create -}} - {{ default (printf "%s" (include "submariner.fullname" .)) .Values.serviceAccounts.operator.name }} -{{- else -}} - {{ default "default" .Values.serviceAccounts.operator.name }} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the submariner-gateway service account to use -*/}} -{{- define "submariner.gatewayServiceAccountName" -}} -{{- if .Values.serviceAccounts.gateway.create -}} - {{ default "submariner-gateway" .Values.serviceAccounts.gateway.name }} -{{- else -}} - {{ default "default" .Values.serviceAccounts.gateway.name }} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the submariner-route-agent service account to use -*/}} -{{- define "submariner.routeAgentServiceAccountName" -}} -{{- if .Values.serviceAccounts.routeAgent.create -}} - {{ default "submariner-routeagent" .Values.serviceAccounts.routeAgent.name }} -{{- else -}} - {{ default "default" .Values.serviceAccounts.routeAgent.name }} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the submariner-globalnet service account to use -*/}} -{{- define "submariner.globalnetServiceAccountName" -}} -{{- if .Values.serviceAccounts.globalnet.create -}} - {{ default "submariner-globalnet" .Values.serviceAccounts.globalnet.name }} -{{- else -}} - {{ default "default" .Values.serviceAccounts.globalnet.name }} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the submariner-lighthouse-agent service account to use -*/}} -{{- define "submariner.lighthouseAgentServiceAccountName" -}} -{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseAgent.create) -}} - {{ default "submariner-lighthouse-agent" .Values.serviceAccounts.lighthouseAgent.name }} -{{- else -}} - {{ default "default" .Values.serviceAccounts.lighthouseAgent.name }} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the submariner-lighthouse-coredns service account to use -*/}} -{{- define "submariner.lighthouseCoreDnsServiceAccountName" -}} -{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseCoreDns.create) -}} - {{ default "submariner-lighthouse-coredns" .Values.serviceAccounts.lighthouseCoreDns.name }} -{{- else -}} - {{ default "default" .Values.serviceAccounts.lighthouseCoreDns.name }} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the submariner-lighthouse-coredns service name to use -*/}} -{{- define "submariner.lighthouseDnsName" -}} -{{- default (printf "%s-lighthouse-coredns" (include "submariner.fullname" .)) .Values.lighthouseCoredns.name }} -{{- end -}} diff --git a/submariner-operator/templates/operator-deployment.yaml b/submariner-operator/templates/operator-deployment.yaml index ff9f0d2..a17eea6 100644 --- a/submariner-operator/templates/operator-deployment.yaml +++ b/submariner-operator/templates/operator-deployment.yaml @@ -6,7 +6,6 @@ metadata: release: {{ .Release.Name | quote }} chart: {{ template "submariner.chart" . }} app: {{ template "submariner.fullname" . }} - component: gateway name: {{ template "submariner.fullname" . }} spec: progressDeadlineSeconds: 600 @@ -52,6 +51,5 @@ spec: restartPolicy: Always schedulerName: default-scheduler securityContext: {} - serviceAccount: {{ template "submariner.fullname" . }} - serviceAccountName: {{ template "submariner.fullname" . }} + serviceAccountName: submariner-operator terminationGracePeriodSeconds: 30 diff --git a/submariner-operator/templates/rbac.yaml b/submariner-operator/templates/rbac.yaml deleted file mode 100644 index 229ae77..0000000 --- a/submariner-operator/templates/rbac.yaml +++ /dev/null @@ -1,752 +0,0 @@ -{{- if .Values.rbac.create -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ template "submariner.fullname" . }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} -rules: - - apiGroups: - - "" - resources: - # For metrics - - services - verbs: - - get - - create - - update - - apiGroups: - - "" - resources: - # Temporarily needed for network-plugin syncer removal - - serviceaccounts - resourceNames: - - submariner-networkplugin-syncer - verbs: - - delete - - apiGroups: - - apps - resources: - - deployments - - daemonsets - verbs: - - create - - delete - - get - - list - - patch - - update - - watch - - apiGroups: - - monitoring.coreos.com - resources: - # Needed for openshift monitoring - - servicemonitors - verbs: - - get - - create - - apiGroups: - - apps - resourceNames: - - {{ template "submariner.fullname" . }} - resources: - - deployments/finalizers - verbs: - - update - - apiGroups: - - submariner.io - resources: - - brokers - - brokers/status - - submariners - - submariners/status - - servicediscoveries - - servicediscoveries/status - verbs: - - get - - list - - watch - - create - - update - - delete - - apiGroups: - - submariner.io - resources: - - gateways - verbs: - - get - - list - - watch - - apiGroups: - - submariner.io - resources: - - submariners/finalizers - - servicediscoveries/finalizers - verbs: - - update - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - delete - - apiGroups: - - "" - resources: - - events - verbs: - - create ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ template "submariner.fullname" . }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} -subjects: -- kind: ServiceAccount - name: {{ template "submariner.operatorServiceAccountName" . }} -roleRef: - kind: Role - name: {{ template "submariner.fullname" . }} - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ template "submariner.fullname" . }}:gateway - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} -rules: - - apiGroups: - - "" - resources: - - pods - verbs: - - get - - update - - patch - - apiGroups: - - submariner.io - resources: - - clusters - - endpoints - - gateways - verbs: - - get - - list - - watch - - create - - update - - delete - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - delete ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ template "submariner.fullname" . }}:gateway - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ template "submariner.fullname" . }}:gateway -subjects: -- kind: ServiceAccount - name: {{ template "submariner.gatewayServiceAccountName" . }} - namespace: {{ .Release.Namespace }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ template "submariner.fullname" . }}:routeagent - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} -rules: - - apiGroups: - - submariner.io - resources: - - endpoints - verbs: - - get - - list - - watch - - apiGroups: - - submariner.io - resources: - - gatewayroutes - - nongatewayroutes - verbs: - - get - - list - - watch - - create - - update - - delete ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ template "submariner.fullname" . }}:routeagent - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ template "submariner.fullname" . }}:routeagent -subjects: -- kind: ServiceAccount - name: {{ template "submariner.routeAgentServiceAccountName" . }} - namespace: {{ .Release.Namespace }} ---- -{{- if .Values.broker.globalnet }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ template "submariner.fullname" . }}:globalnet - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} -rules: - - apiGroups: - - submariner.io - resources: - - gateways - verbs: - - get - - list - - watch - - update - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - list - - watch - - create - - update - - delete ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ template "submariner.fullname" . }}:globalnet - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ template "submariner.fullname" . }}:globalnet -subjects: - - kind: ServiceAccount - name: {{ template "submariner.globalnetServiceAccountName" . }} - namespace: {{ .Release.Namespace }} ---- -{{- end -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ template "submariner.fullname" . }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} -rules: - # submariner-operator updates the config map of core-dns to forward requests to - # clusterset.local to Lighthouse DNS, also looks at existing configmaps - # to figure out network settings - - apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - get - - list - - watch - - update - - apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - create - - update - - delete - - watch - - apiGroups: - - "" - resources: - # Needed for network settings discovery - - pods - - services - - nodes - verbs: - - get - - list - - watch - - apiGroups: - - operator.openshift.io - resources: - - dnses - verbs: - - get - - update - - apiGroups: - - config.openshift.io - resources: - # Needed for network settings discovery - - networks - resourceNames: - - cluster - verbs: - - get - - apiGroups: - - monitoring.coreos.com - resources: - # Needed for openshift monitoring - - servicemonitors - verbs: - - get - - create - - apiGroups: - - apps - resources: - # Needed for Flannel CNI discovery - - daemonsets - verbs: - - list - - apiGroups: - - rbac.authorization.k8s.io - resources: - # Temporarily needed for network-plugin syncer removal - - clusterroles - - clusterrolebindings - resourceNames: - - ocp-submariner-networkplugin-syncer - - submariner-networkplugin-syncer - verbs: - - delete ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ template "submariner.fullname" . }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} -subjects: - - kind: ServiceAccount - name: {{ template "submariner.operatorServiceAccountName" . }} - namespace: {{ .Release.Namespace }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ template "submariner.fullname" . }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: submariner-metrics-reader - namespace: {{ .Release.Namespace }} -rules: - - apiGroups: [""] - resources: ["pods", "services", "endpoints"] - verbs: ["get", "list", "watch"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: read-submariner-metrics -subjects: - - kind: ServiceAccount - name: prometheus-k8s - namespace: openshift-monitoring -roleRef: - kind: Role - name: submariner-metrics-reader - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ template "submariner.fullname" . }}:gateway - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} -rules: - - apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - apiGroups: - - "" - resources: - - pods - - services - - nodes - verbs: - - get - - list - - watch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ template "submariner.fullname" . }}:gateway - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ template "submariner.fullname" . }}:gateway -subjects: - - kind: ServiceAccount - name: {{ template "submariner.gatewayServiceAccountName" . }} - namespace: {{ .Release.Namespace }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ template "submariner.fullname" . }}:routeagent - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} -rules: - - apiGroups: - - "" - resources: - - pods - - services - - secrets - - configmaps - - endpoints - verbs: - - get - - list - - apiGroups: - - config.openshift.io - resources: - - networks - resourceNames: - - cluster - verbs: - - get - - apiGroups: - - "" - resources: - - nodes - verbs: - - get - - list - - watch - - apiGroups: - - projectcalico.org - resources: - - ippools - verbs: - - get - - create - - delete - - update - - deletecollection ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ template "submariner.fullname" . }}:routeagent - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ template "submariner.fullname" . }}:routeagent -subjects: - - kind: ServiceAccount - name: {{ template "submariner.routeAgentServiceAccountName" . }} - namespace: {{ .Release.Namespace }} ---- -{{- if .Values.broker.globalnet }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ template "submariner.fullname" . }}:globalnet - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} -rules: - - apiGroups: - - "" - resources: - - pods - verbs: - - get - - list - - watch - - apiGroups: - - "" - resources: - - services - - endpoints - verbs: - - create - - get - - list - - watch - - update - - delete - - apiGroups: - - submariner.io - resources: - - clusters - - endpoints - verbs: - - get - - list - - watch - - apiGroups: - - submariner.io - resources: - - clusterglobalegressips - - clusterglobalegressips/status - - globalegressips - - globalegressips/status - - globalingressips - - globalingressips/status - verbs: - - create - - get - - list - - watch - - update - - delete - - deletecollection - - apiGroups: - - multicluster.x-k8s.io - resources: - - serviceexports - verbs: - - get - - list - - watch - - apiGroups: - - network.openshift.io - resources: - - service/externalips - verbs: - - create - - get - - list - - delete ---- -{{- end -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ template "submariner.fullname" . }}:globalnet - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ template "submariner.fullname" . }}:globalnet -subjects: -- kind: ServiceAccount - name: {{ template "submariner.globalnetServiceAccountName" . }} - namespace: {{ .Release.Namespace }} ---- -{{- if .Values.submariner.serviceDiscovery }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ template "submariner.fullname" . }}:lighthouse-agent - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} -rules: - - apiGroups: - - "" - resources: - - services - - namespaces - - endpoints - verbs: - - get - - list - - watch - - apiGroups: - - discovery.k8s.io - resources: - - endpointslices - - endpointslices/restricted - verbs: - - create - - get - - list - - watch - - update - - delete - - deletecollection - - apiGroups: - - submariner.io - resources: - - gateways - - globalingressips - verbs: - - get - - list - - watch - - apiGroups: - - multicluster.x-k8s.io - resources: - - serviceimports - - serviceimports/status - verbs: - - create - - get - - list - - watch - - update - - delete - - apiGroups: - - multicluster.x-k8s.io - resources: - - serviceexports - verbs: - - get - - list - - watch - - apiGroups: - - multicluster.x-k8s.io - resources: - - serviceexports/status - verbs: - - update ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ template "submariner.fullname" . }}:lighthouse-agent - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ template "submariner.fullname" . }}:lighthouse-agent -subjects: - - kind: ServiceAccount - name: {{ template "submariner.lighthouseAgentServiceAccountName" . }} - namespace: {{ .Release.Namespace }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ template "submariner.fullname" . }}:lighthouse-coredns -rules: - - apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch - - apiGroups: - - submariner.io - resources: - - gateways - - submariners - verbs: - - get - - list - - watch - - apiGroups: - - multicluster.x-k8s.io - resources: - - serviceimports - verbs: - - get - - list - - watch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ template "submariner.fullname" . }}:lighthouse-coredns -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ template "submariner.fullname" . }}:lighthouse-coredns -subjects: - - kind: ServiceAccount - name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }} - namespace: {{ .Release.Namespace }} -{{- end -}} -{{- end -}} diff --git a/submariner-operator/templates/svc-acct.yaml b/submariner-operator/templates/svc-acct.yaml deleted file mode 100644 index 35e1a7c..0000000 --- a/submariner-operator/templates/svc-acct.yaml +++ /dev/null @@ -1,119 +0,0 @@ -{{- if .Values.serviceAccounts.operator.create }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ template "submariner.operatorServiceAccountName" . }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "submariner.operatorServiceAccountName" . }}-token - annotations: - kubernetes.io/service-account.name: {{ template "submariner.operatorServiceAccountName" . }} -type: kubernetes.io/service-account-token -{{- end }} ---- -{{- if .Values.serviceAccounts.gateway.create }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ template "submariner.gatewayServiceAccountName" . }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "submariner.gatewayServiceAccountName" . }}-token - annotations: - kubernetes.io/service-account.name: {{ template "submariner.gatewayServiceAccountName" . }} -type: kubernetes.io/service-account-token -{{- end }} ---- -{{- if .Values.serviceAccounts.routeAgent.create }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ template "submariner.routeAgentServiceAccountName" . }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "submariner.routeAgentServiceAccountName" . }}-token - annotations: - kubernetes.io/service-account.name: {{ template "submariner.routeAgentServiceAccountName" . }} -type: kubernetes.io/service-account-token -{{- end }} ---- -{{- if .Values.serviceAccounts.globalnet.create }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ template "submariner.globalnetServiceAccountName" . }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "submariner.globalnetServiceAccountName" . }}-token - annotations: - kubernetes.io/service-account.name: {{ template "submariner.globalnetServiceAccountName" . }} -type: kubernetes.io/service-account-token -{{- end }} ---- -{{- if .Values.serviceAccounts.lighthouseAgent.create }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ template "submariner.lighthouseAgentServiceAccountName" . }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}-token - annotations: - kubernetes.io/service-account.name: {{ template "submariner.lighthouseAgentServiceAccountName" . }} -type: kubernetes.io/service-account-token -{{- end }} ---- - {{- if .Values.serviceAccounts.lighthouseCoreDns.create }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: {{ template "submariner.chart" . }} - app: {{ template "submariner.name" . }} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}-token - annotations: - kubernetes.io/service-account.name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }} -type: kubernetes.io/service-account-token - {{- end }} diff --git a/submariner-operator/values.yaml b/submariner-operator/values.yaml index d447392..641c4c7 100644 --- a/submariner-operator/values.yaml +++ b/submariner-operator/values.yaml @@ -46,22 +46,3 @@ operator: resources: {} tolerations: [] affinity: {} -serviceAccounts: - operator: - create: true - name: "" - gateway: - create: true - name: "" - routeAgent: - create: true - name: "" - globalnet: - create: true - name: "" - lighthouseAgent: - create: true - name: "" - lighthouseCoreDns: - create: true - name: ""