Add an operator Helm chart

The submariner-operator Helm chart deploys Submariner using the
Submariner operator: it deploys the CRDs, roles, and SAs required to
run the operator and Submariner, then pushes a Submariner CR to
instruct the operator to deploy Submariner.

This patch also adds a Makefile to validate the deployments; run

	make deploy

to test the Helm charts (this will bring up two clusters, install the
broker on one of them and the operator on both, and end with a
connectivity test).

Fixes: #17
Signed-off-by: Stephen Kitt <skitt@redhat.com>

.github/workflows/linting.yml

@@ -53,5 +53,5 @@ jobs:
       - name: Run yamllint
         uses: ibiqlik/action-yamllint@v1
         with:
-          file_or_dir: submariner/values.yaml submariner-k8s-broker/values.yaml submariner/Chart.yaml submariner-k8s-broker/Chart.yaml
+          file_or_dir: submariner/Chart.yaml submariner/values.yaml submariner-k8s-broker/Chart.yaml submariner-k8s-broker/values.yaml submariner-operator/Chart.yaml submariner-operator/values.yaml
           config_file: .yamllint.yml

.travis.yml

@@ -18,7 +18,7 @@ install:
   - sudo pip install yamllint=="${YAMLLINT_VERSION}"
 
 script:
-  - for dir in submariner submariner-k8s-broker; do helm lint $dir $HELM_FLAGS; done
+  - for dir in submariner submariner-k8s-broker submariner-operator; do helm lint $dir $HELM_FLAGS; done
   - yamllint -c .yamllint.yml -s $(find . -type f -name "Chart.yaml")
   - yamllint -c .yamllint.yml -s $(find . -type f -name "values.yaml")
 
@@ -26,7 +26,7 @@ after_success:
   - >
     if [ $TRAVIS_BRANCH = 'master' ] && [ $TRAVIS_PULL_REQUEST = 'false' ]; then
       set -e
-      for dir in submariner submariner-k8s-broker; do
+      for dir in submariner submariner-k8s-broker submariner-operator; do
         helm dep update $dir
         helm package $dir
       done

Dockerfile.dapper

@@ -0,0 +1,15 @@
+FROM quay.io/submariner/shipyard-dapper-base:devel
+
+ARG DAPPER_HOST_ARCH
+ENV HOST_ARCH=${DAPPER_HOST_ARCH} ARCH=${DAPPER_HOST_ARCH} \
+    DAPPER_ENV="REPO TAG QUAY_USERNAME QUAY_PASSWORD GITHUB_SHA MAKEFLAGS CLUSTERS_ARGS DEPLOY_ARGS E2E_ARGS RELEASE_ARGS" \
+    DAPPER_SOURCE=/go/src/github.com/submariner-io/submariner-charts DAPPER_DOCKER_SOCKET=true
+ENV DAPPER_OUTPUT=${DAPPER_SOURCE}/output PATH=${DAPPER_SOURCE}/bin/:${PATH}
+
+WORKDIR ${DAPPER_SOURCE}
+
+# Override the Helm deployment scripts
+COPY deploy_helm /opt/shipyard/scripts/lib/
+
+ENTRYPOINT ["/opt/shipyard/scripts/entry"]
+CMD ["sh"]

Makefile

@@ -0,0 +1,36 @@
+ifneq (,$(DAPPER_HOST_ARCH))
+
+# Running in Dapper
+
+include $(SHIPYARD_DIR)/Makefile.inc
+
+CLUSTER_SETTINGS_FLAG = --cluster_settings $(DAPPER_SOURCE)/cluster_settings
+override CLUSTERS_ARGS += $(CLUSTER_SETTINGS_FLAG)
+override DEPLOY_ARGS += $(CLUSTER_SETTINGS_FLAG) --deploytool helm
+export DEPLOY_ARGS
+
+# Targets to make
+
+deploy: clusters preload-images
+
+preload-images:
+	source $(SCRIPTS_DIR)/lib/debug_functions; \
+	source $(SCRIPTS_DIR)/lib/deploy_funcs; \
+	source $(SCRIPTS_DIR)/lib/version; \
+	set -e; \
+	for image in submariner submariner-route-agent submariner-operator lighthouse-agent submariner-globalnet lighthouse-coredns; do \
+		import_image quay.io/submariner/$${image}; \
+	done
+
+.PHONY: preload-images
+
+else
+
+# Not running in Dapper
+
+include Makefile.dapper
+
+endif
+
+# Disable rebuilding Makefile
+Makefile Makefile.dapper Makefile.inc: ;

Makefile.dapper

@@ -0,0 +1,26 @@
+# This Makefile contains the rules required to set up our
+# Dapper-based build environment; it can be copied as-is to
+# other projects (and needs to be copied, it can't be shared
+# via the Dapper image since it's needed to retrieve the image)
+
+.dapper:
+	@echo Downloading dapper
+	@curl -sL https://releases.rancher.com/dapper/latest/dapper-`uname -s`-`uname -m` > .dapper.tmp
+	@@chmod +x .dapper.tmp
+	@./.dapper.tmp -v
+	@mv .dapper.tmp .dapper
+
+invoke_dapper = +./.dapper -m bind make -- $1
+
+%: .dapper
+	@echo Invoking Dapper, MAKEFLAGS=$(MAKEFLAGS)
+	$(call invoke_dapper,$@)
+
+# Ensure that files in the current directory don't hide Dapper targets
+$(wildcard [^M]*): .dapper
+	$(call invoke_dapper,$@)
+
+shell: .dapper
+	./.dapper -m bind -s
+
+.PHONY: shell $(wildcard [^M]*)

cluster_settings

@@ -0,0 +1,10 @@
+. "${SCRIPTS_DIR}"/lib/source_only
+
+# We need a minimal setup to verify the deployment works
+clusters=('cluster1' 'cluster2')
+cluster_nodes['cluster1']="control-plane worker"
+cluster_nodes['cluster2']="control-plane worker"
+
+cluster_cni=( ['cluster1']="weave" ['cluster2']="weave" )
+
+cluster_subm=( ['cluster1']="true" ['cluster2']="true" )

deploy_helm

@@ -0,0 +1,84 @@
+# shellcheck shell=bash
+# shellcheck source=scripts/shared/lib/source_only
+. "${BASH_SOURCE%/*}"/source_only
+
+### Constants ###
+
+readonly SUBMARINER_BROKER_NS=submariner-k8s-broker
+readonly SUBMARINER_PSK=$(LC_CTYPE=C tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 64 | head -n 1)
+
+### Functions ###
+
+function install_helm() {
+    if kubectl -n kube-system rollout status deploy/tiller-deploy --timeout=3s > /dev/null 2>&1; then
+        echo "Helm already installed, skipping helm installation..."
+        return
+    fi
+
+    echo "Installing helm..."
+    kubectl -n kube-system create serviceaccount tiller
+    kubectl create clusterrolebinding tiller --clusterrole=cluster-admin --serviceaccount=kube-system:tiller
+    helm --kube-context "${cluster}" init --service-account tiller
+    kubectl -n kube-system rollout status deploy/tiller-deploy --timeout=30s
+}
+
+function deploytool_prereqs() {
+    helm init --client-only
+    run_all_clusters install_helm
+}
+
+function setup_broker() {
+    if kubectl get crd clusters.submariner.io > /dev/null 2>&1; then
+        echo "Submariner CRDs already exist, skipping broker creation..."
+    else
+        echo "Installing submariner broker..."
+        # shellcheck disable=SC2086 # Split on purpose
+        helm install ./submariner-k8s-broker \
+             --kube-context "${cluster}" \
+             --name "${SUBMARINER_BROKER_NS}" \
+             --namespace "${SUBMARINER_BROKER_NS}" \
+             ${deploytool_broker_args}
+    fi
+
+    submariner_broker_url=$(kubectl -n default get endpoints kubernetes -o jsonpath="{.subsets[0].addresses[0].ip}:{.subsets[0].ports[?(@.name=='https')].port}")
+    submariner_broker_ca=$(kubectl -n "${SUBMARINER_BROKER_NS}" get secrets -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='${SUBMARINER_BROKER_NS}-client')].data['ca\.crt']}")
+    submariner_broker_token=$(kubectl -n "${SUBMARINER_BROKER_NS}" get secrets -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='${SUBMARINER_BROKER_NS}-client')].data.token}"|base64 --decode)
+}
+
+function helm_install_subm() {
+    local crd_create=false
+    [[ "${cluster}" = "${broker}" ]] || crd_create=true
+
+    if kubectl wait --for=condition=Ready pods -l app=submariner-operator -n "${SUBM_NS}" --timeout=60s > /dev/null 2>&1; then
+        echo "Submariner already installed, skipping installation..."
+        return
+    fi
+
+    echo "Installing Submariner..."
+    # shellcheck disable=SC2086 # Split on purpose
+    helm --kube-context "${cluster}" install ./submariner-operator \
+        --name submariner-operator \
+        --namespace "${SUBM_NS}" \
+        --set ipsec.psk="${SUBMARINER_PSK}" \
+        --set broker.server="${submariner_broker_url}" \
+        --set broker.token="${submariner_broker_token}" \
+        --set broker.namespace="${SUBMARINER_BROKER_NS}" \
+        --set broker.ca="${submariner_broker_ca}" \
+        --set submariner.clusterId="${cluster}" \
+        --set submariner.clusterCidr="${cluster_CIDRs[$cluster]}" \
+        --set submariner.serviceCidr="${service_CIDRs[$cluster]}" \
+        --set submariner.globalCidr="${global_CIDRs[$cluster]}" \
+        --set serviceAccounts.globalnet.create="${globalnet}" \
+        --set submariner.natEnabled="false" \
+        --set operator.image.repository="localhost:5000/submariner-operator" \
+        --set operator.image.tag="local" \
+        --set operator.image.pullPolicy="IfNotPresent" \
+        --set submariner.images.repository="localhost:5000" \
+        --set submariner.images.tag="local" \
+        --set brokercrds.create="${crd_create}" \
+        ${deploytool_submariner_args}
+}
+
+function install_subm_all_clusters() {
+    run_subm_clusters helm_install_subm
+}

submariner-operator/.helmignore

@@ -0,0 +1 @@
+.git

submariner-operator/Chart.yaml

@@ -0,0 +1,12 @@
+---
+name: submariner-operator
+version: 0.7.0
+appVersion: 0.7.0
+description: Submariner enables direct networking between Pods and Services in different Kubernetes clusters
+keywords:
+home: https://submariner-io.github.io/
+sources:
+  - https://submariner-io.github.io/submariner-charts/charts
+maintainers:
+  - name: Submariner Developers
+    email: submariner-dev@googlegroups.com

submariner-operator/app-readme.md

@@ -0,0 +1,5 @@
+# Submariner
+
+[Submariner](https://submariner.io) is a cross-cluster networking tool.
+
+This chart creates the required components in this cluster to deploy the Submariner operator.

submariner-operator/questions.yml

@@ -0,0 +1,118 @@
+questions:
+- variable: defaultOperatorImage
+  default: true
+  description: "Use default Submariner operator image or specify a custom one"
+  label: Use default Submariner operator image
+  type: boolean
+  show_subquestion_if: false
+  group: "Container Images"
+  subquestions:
+  - variable: operator.image.repository
+    default: "quay.io/submariner/submariner-operator"
+    description: "Submariner Operator Image Repository"
+    type: string
+    label: Submariner Operator Image Repository
+  - variable: operator.image.tag
+    default: "0.7.0"
+    description: "Submariner Operator Image Tag"
+    type: string
+    label: Submariner Operator Image Tag
+- variable: defaultSubmarinerImages
+  default: true
+  description: "Use default Submariner images or specify custom ones"
+  label: Use default Submariner images
+  type: boolean
+  show_subquestion_if: false
+  group: "Container images"
+  subquestions:
+  - variable: submariner.images.repository
+    default: "quay.io/submariner"
+    description: "Submariner Repository (base for all non-operator images)"
+    type: string
+    label: Submariner Repository
+  - variable: submariner.images.tag
+    default: "0.7.0"
+    description: "Submariner Images Tag (shared for all non-operator images)"
+    type: string
+    label: Submariner Images Tag
+- variable: submariner.clusterId
+  default: ""
+  description: "Enter a unique cluster ID to identify this cluster"
+  type: string
+  label: "Cluster ID"
+  group: "Configuration"
+  required: true
+- variable: ipsec.psk
+  default: ""
+  description: "Enter the pre-shared key for the IPsec Cable Engine"
+  type: string
+  label: "IPsec Pre-Shared Key"
+  group: "Configuration"
+  required: true
+- variable: broker.server
+  type: string
+  default: ""
+  group: "Broker Configuration"
+  label: "Broker Server"
+  description: "Broker server to use (without the https://)"
+- variable: broker.insecure
+  type: boolean
+  default: false
+  show_subquestion_if: false
+  group: "Broker Configuration"
+  label: "Insecure Broker"
+  description: "Connect to K8s broker without validating CA"
+  subquestions:
+  - variable: broker.ca
+    type: string
+    description: "Base64 encoded broker ca.crt"
+    label: "Broker CA encoded in base64"
+    default: ""
+- variable: broker.token
+  type: string
+  group: "Broker Configuration"
+  label: "Broker Token"
+  description: "Bearer token for broker"
+- variable: broker.namespace
+  type: string
+  group: "Broker Configuration"
+  label: "Broker Namespace"
+  description: "Enter namespace to use on central broker"
+- variable: submariner.clusterCidr
+  default: ""
+  description: "Enter the cluster CIDR (i.e. 10.42.0.0/16) for this cluster"
+  type: string
+  label: "Cluster CIDR"
+  group: "CIDR Configuration"
+  required: true
+- variable: submariner.serviceCidr
+  default: ""
+  description: "Enter the service CIDR (i.e. 10.43.0.0/16) for this cluster"
+  type: string
+  label: "Service CIDR"
+  group: "CIDR Configuration"
+  required: true
+- variable: submariner.natEnabled
+  type: boolean
+  default: false
+  group: "Advanced Configuration"
+  description: "If the gateway nodes for this cluster are behind 1:1 NAT, you should enable NAT"
+  label: "NAT Enabled"
+- variable: submariner.debug
+  type: boolean
+  default: false
+  group: "Advanced Configuration"
+  description: "Enable submariner debug mode"
+  label: "Submariner Debug Enabled"
+- variable: ipsec.debug
+  type: boolean
+  default: false
+  group: "Advanced Configuration"
+  description: "Enable Charon debug mode"
+  label: "Charon Enabled"
+- variable: submariner.cableDriver
+  type: string
+  default: ""
+  group: "Advanced Configuration"
+  description: "Cable driver implementation"
+  label: "Cable Driver"

submariner-operator/templates/NOTES.txt

@@ -0,0 +1,7 @@
+Submariner is now installed.
+
+{{- if .Values.engine.nodeSelectorEnabled }}
+If you haven't done so yet, please label a node as `submariner.io/gateway=true` to elect it for running Submariner.
+{{- end }}
+
+By default, Submariner runs with 1 replica. If you have more than one Gateway host, you can scale Submariner to N replicas, and the other Submariner pods will simply join the leader election pool.

submariner-operator/templates/_helpers.tpl

@@ -0,0 +1,94 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "submariner.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "submariner.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "submariner.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-operator service account to use
+*/}}
+{{- define "submariner.operatorServiceAccountName" -}}
+{{- if .Values.serviceAccounts.operator.create -}}
+    {{ default (printf "%s" (include "submariner.fullname" .)) .Values.serviceAccounts.operator.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.operator.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-engine service account to use
+*/}}
+{{- define "submariner.engineServiceAccountName" -}}
+{{- if .Values.serviceAccounts.engine.create -}}
+    {{ default (printf "%s-engine" (include "submariner.fullname" .)) .Values.serviceAccounts.engine.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.engine.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-route-agent service account to use
+*/}}
+{{- define "submariner.routeAgentServiceAccountName" -}}
+{{- if .Values.serviceAccounts.routeAgent.create -}}
+    {{ default (printf "%s-routeagent" (include "submariner.fullname" .)) .Values.serviceAccounts.routeAgent.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.routeAgent.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-globalnet service account to use
+*/}}
+{{- define "submariner.globalnetServiceAccountName" -}}
+{{- if .Values.serviceAccounts.globalnet.create -}}
+    {{ default (printf "%s:globalnet" (include "submariner.fullname" .)) .Values.serviceAccounts.globalnet.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.globalnet.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-lighthouse service account to use
+*/}}
+{{- define "submariner.lighthouseServiceAccountName" -}}
+{{- if .Values.submariner.serviceDiscovery -}}
+    {{ default (printf "%s-lighthouse" (include "submariner.fullname" .)) .Values.serviceAccounts.lighthouse.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.lighthouse.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-lighthouse-coredns service name to use
+*/}}
+{{- define "submariner.lighthouseDnsName" -}}
+{{- default (printf "%s-lighthouse-coredns" (include "submariner.fullname" .)) .Values.lighthouseCoredns.name }}
+{{- end -}}

submariner-operator/templates/crd.yaml

@@ -0,0 +1,723 @@
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: submariners.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+    controller-gen.kubebuilder.io/version: v0.3.0
+spec:
+  group: submariner.io
+  names:
+    kind: Submariner
+    listKind: SubmarinerList
+    plural: submariners
+    singular: submariner
+  scope: Namespaced
+  subresources:
+    status: {}
+  validation:
+    openAPIV3Schema:
+      description: Submariner is the Schema for the submariners API
+      properties:
+        apiVersion:
+          description: 'APIVersion defines the versioned schema of this representation
+            of an object. Servers should convert recognized schemas to the latest
+            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+          type: string
+        kind:
+          description: 'Kind is a string value representing the REST resource this
+            object represents. Servers may infer this from the endpoint the client
+            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+          type: string
+        metadata:
+          type: object
+        spec:
+          description: SubmarinerSpec defines the desired state of Submariner
+          properties:
+            broker:
+              type: string
+            brokerK8sApiServer:
+              type: string
+            brokerK8sApiServerToken:
+              type: string
+            brokerK8sCA:
+              type: string
+            brokerK8sRemoteNamespace:
+              type: string
+            cableDriver:
+              type: string
+            ceIPSecDebug:
+              type: boolean
+            ceIPSecIKEPort:
+              type: integer
+            ceIPSecNATTPort:
+              type: integer
+            ceIPSecPSK:
+              type: string
+            clusterCIDR:
+              type: string
+            clusterID:
+              type: string
+            colorCodes:
+              type: string
+            customDomains:
+              items:
+                type: string
+              type: array
+              x-kubernetes-list-type: set
+            debug:
+              type: boolean
+            globalCIDR:
+              type: string
+            namespace:
+              type: string
+            natEnabled:
+              type: boolean
+            repository:
+              type: string
+            serviceCIDR:
+              type: string
+            serviceDiscoveryEnabled:
+              type: boolean
+            version:
+              type: string
+          required:
+          - broker
+          - brokerK8sApiServer
+          - brokerK8sApiServerToken
+          - brokerK8sCA
+          - brokerK8sRemoteNamespace
+          - ceIPSecDebug
+          - ceIPSecPSK
+          - clusterCIDR
+          - clusterID
+          - debug
+          - namespace
+          - natEnabled
+          - serviceCIDR
+          type: object
+        status:
+          description: SubmarinerStatus defines the observed state of Submariner
+          properties:
+            clusterCIDR:
+              type: string
+            clusterID:
+              type: string
+            colorCodes:
+              type: string
+            engineDaemonSetStatus:
+              properties:
+                lastResourceVersion:
+                  type: string
+                mismatchedContainerImages:
+                  type: boolean
+                nonReadyContainerStates:
+                  items:
+                    description: ContainerState holds a possible state of container.
+                      Only one of its members may be specified. If none of them is
+                      specified, the default one is ContainerStateWaiting.
+                    properties:
+                      running:
+                        description: Details about a running container
+                        properties:
+                          startedAt:
+                            description: Time at which the container was last (re-)started
+                            format: date-time
+                            type: string
+                        type: object
+                      terminated:
+                        description: Details about a terminated container
+                        properties:
+                          containerID:
+                            description: Container's ID in the format 'docker://<container_id>'
+                            type: string
+                          exitCode:
+                            description: Exit status from the last termination of
+                              the container
+                            format: int32
+                            type: integer
+                          finishedAt:
+                            description: Time at which the container last terminated
+                            format: date-time
+                            type: string
+                          message:
+                            description: Message regarding the last termination of
+                              the container
+                            type: string
+                          reason:
+                            description: (brief) reason from the last termination
+                              of the container
+                            type: string
+                          signal:
+                            description: Signal from the last termination of the container
+                            format: int32
+                            type: integer
+                          startedAt:
+                            description: Time at which previous execution of the container
+                              started
+                            format: date-time
+                            type: string
+                        required:
+                        - exitCode
+                        type: object
+                      waiting:
+                        description: Details about a waiting container
+                        properties:
+                          message:
+                            description: Message regarding why the container is not
+                              yet running.
+                            type: string
+                          reason:
+                            description: (brief) reason the container is not yet running.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
+                status:
+                  description: DaemonSetStatus represents the current status of a
+                    daemon set.
+                  properties:
+                    collisionCount:
+                      description: Count of hash collisions for the DaemonSet. The
+                        DaemonSet controller uses this field as a collision avoidance
+                        mechanism when it needs to create the name for the newest
+                        ControllerRevision.
+                      format: int32
+                      type: integer
+                    conditions:
+                      description: Represents the latest available observations of
+                        a DaemonSet's current state.
+                      items:
+                        description: DaemonSetCondition describes the state of a DaemonSet
+                          at a certain point.
+                        properties:
+                          lastTransitionTime:
+                            description: Last time the condition transitioned from
+                              one status to another.
+                            format: date-time
+                            type: string
+                          message:
+                            description: A human readable message indicating details
+                              about the transition.
+                            type: string
+                          reason:
+                            description: The reason for the condition's last transition.
+                            type: string
+                          status:
+                            description: Status of the condition, one of True, False,
+                              Unknown.
+                            type: string
+                          type:
+                            description: Type of DaemonSet condition.
+                            type: string
+                        required:
+                        - status
+                        - type
+                        type: object
+                      type: array
+                    currentNumberScheduled:
+                      description: 'The number of nodes that are running at least
+                        1 daemon pod and are supposed to run the daemon pod. More
+                        info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/'
+                      format: int32
+                      type: integer
+                    desiredNumberScheduled:
+                      description: 'The total number of nodes that should be running
+                        the daemon pod (including nodes correctly running the daemon
+                        pod). More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/'
+                      format: int32
+                      type: integer
+                    numberAvailable:
+                      description: The number of nodes that should be running the
+                        daemon pod and have one or more of the daemon pod running
+                        and available (ready for at least spec.minReadySeconds)
+                      format: int32
+                      type: integer
+                    numberMisscheduled:
+                      description: 'The number of nodes that are running the daemon
+                        pod, but are not supposed to run the daemon pod. More info:
+                        https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/'
+                      format: int32
+                      type: integer
+                    numberReady:
+                      description: The number of nodes that should be running the
+                        daemon pod and have one or more of the daemon pod running
+                        and ready.
+                      format: int32
+                      type: integer
+                    numberUnavailable:
+                      description: The number of nodes that should be running the
+                        daemon pod and have none of the daemon pod running and available
+                        (ready for at least spec.minReadySeconds)
+                      format: int32
+                      type: integer
+                    observedGeneration:
+                      description: The most recent generation observed by the daemon
+                        set controller.
+                      format: int64
+                      type: integer
+                    updatedNumberScheduled:
+                      description: The total number of nodes that are running updated
+                        daemon pod
+                      format: int32
+                      type: integer
+                  required:
+                  - currentNumberScheduled
+                  - desiredNumberScheduled
+                  - numberMisscheduled
+                  - numberReady
+                  type: object
+              required:
+              - mismatchedContainerImages
+              type: object
+            gateways:
+              items:
+                properties:
+                  connections:
+                    items:
+                      properties:
+                        endpoint:
+                          properties:
+                            backend:
+                              type: string
+                            backend_config:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            cable_name:
+                              type: string
+                            cluster_id:
+                              type: string
+                            hostname:
+                              type: string
+                            nat_enabled:
+                              type: boolean
+                            private_ip:
+                              type: string
+                            public_ip:
+                              type: string
+                            subnets:
+                              items:
+                                type: string
+                              type: array
+                          required:
+                          - backend
+                          - cable_name
+                          - cluster_id
+                          - hostname
+                          - nat_enabled
+                          - private_ip
+                          - public_ip
+                          - subnets
+                          type: object
+                        status:
+                          type: string
+                        statusMessage:
+                          type: string
+                      required:
+                      - endpoint
+                      - status
+                      - statusMessage
+                      type: object
+                    type: array
+                  haStatus:
+                    type: string
+                  localEndpoint:
+                    properties:
+                      backend:
+                        type: string
+                      backend_config:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      cable_name:
+                        type: string
+                      cluster_id:
+                        type: string
+                      hostname:
+                        type: string
+                      nat_enabled:
+                        type: boolean
+                      private_ip:
+                        type: string
+                      public_ip:
+                        type: string
+                      subnets:
+                        items:
+                          type: string
+                        type: array
+                    required:
+                    - backend
+                    - cable_name
+                    - cluster_id
+                    - hostname
+                    - nat_enabled
+                    - private_ip
+                    - public_ip
+                    - subnets
+                    type: object
+                  statusFailure:
+                    type: string
+                  version:
+                    type: string
+                required:
+                - connections
+                - haStatus
+                - localEndpoint
+                - statusFailure
+                - version
+                type: object
+              type: array
+            globalCIDR:
+              type: string
+            globalnetDaemonSetStatus:
+              properties:
+                lastResourceVersion:
+                  type: string
+                mismatchedContainerImages:
+                  type: boolean
+                nonReadyContainerStates:
+                  items:
+                    description: ContainerState holds a possible state of container.
+                      Only one of its members may be specified. If none of them is
+                      specified, the default one is ContainerStateWaiting.
+                    properties:
+                      running:
+                        description: Details about a running container
+                        properties:
+                          startedAt:
+                            description: Time at which the container was last (re-)started
+                            format: date-time
+                            type: string
+                        type: object
+                      terminated:
+                        description: Details about a terminated container
+                        properties:
+                          containerID:
+                            description: Container's ID in the format 'docker://<container_id>'
+                            type: string
+                          exitCode:
+                            description: Exit status from the last termination of
+                              the container
+                            format: int32
+                            type: integer
+                          finishedAt:
+                            description: Time at which the container last terminated
+                            format: date-time
+                            type: string
+                          message:
+                            description: Message regarding the last termination of
+                              the container
+                            type: string
+                          reason:
+                            description: (brief) reason from the last termination
+                              of the container
+                            type: string
+                          signal:
+                            description: Signal from the last termination of the container
+                            format: int32
+                            type: integer
+                          startedAt:
+                            description: Time at which previous execution of the container
+                              started
+                            format: date-time
+                            type: string
+                        required:
+                        - exitCode
+                        type: object
+                      waiting:
+                        description: Details about a waiting container
+                        properties:
+                          message:
+                            description: Message regarding why the container is not
+                              yet running.
+                            type: string
+                          reason:
+                            description: (brief) reason the container is not yet running.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
+                status:
+                  description: DaemonSetStatus represents the current status of a
+                    daemon set.
+                  properties:
+                    collisionCount:
+                      description: Count of hash collisions for the DaemonSet. The
+                        DaemonSet controller uses this field as a collision avoidance
+                        mechanism when it needs to create the name for the newest
+                        ControllerRevision.
+                      format: int32
+                      type: integer
+                    conditions:
+                      description: Represents the latest available observations of
+                        a DaemonSet's current state.
+                      items:
+                        description: DaemonSetCondition describes the state of a DaemonSet
+                          at a certain point.
+                        properties:
+                          lastTransitionTime:
+                            description: Last time the condition transitioned from
+                              one status to another.
+                            format: date-time
+                            type: string
+                          message:
+                            description: A human readable message indicating details
+                              about the transition.
+                            type: string
+                          reason:
+                            description: The reason for the condition's last transition.
+                            type: string
+                          status:
+                            description: Status of the condition, one of True, False,
+                              Unknown.
+                            type: string
+                          type:
+                            description: Type of DaemonSet condition.
+                            type: string
+                        required:
+                        - status
+                        - type
+                        type: object
+                      type: array
+                    currentNumberScheduled:
+                      description: 'The number of nodes that are running at least
+                        1 daemon pod and are supposed to run the daemon pod. More
+                        info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/'
+                      format: int32
+                      type: integer
+                    desiredNumberScheduled:
+                      description: 'The total number of nodes that should be running
+                        the daemon pod (including nodes correctly running the daemon
+                        pod). More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/'
+                      format: int32
+                      type: integer
+                    numberAvailable:
+                      description: The number of nodes that should be running the
+                        daemon pod and have one or more of the daemon pod running
+                        and available (ready for at least spec.minReadySeconds)
+                      format: int32
+                      type: integer
+                    numberMisscheduled:
+                      description: 'The number of nodes that are running the daemon
+                        pod, but are not supposed to run the daemon pod. More info:
+                        https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/'
+                      format: int32
+                      type: integer
+                    numberReady:
+                      description: The number of nodes that should be running the
+                        daemon pod and have one or more of the daemon pod running
+                        and ready.
+                      format: int32
+                      type: integer
+                    numberUnavailable:
+                      description: The number of nodes that should be running the
+                        daemon pod and have none of the daemon pod running and available
+                        (ready for at least spec.minReadySeconds)
+                      format: int32
+                      type: integer
+                    observedGeneration:
+                      description: The most recent generation observed by the daemon
+                        set controller.
+                      format: int64
+                      type: integer
+                    updatedNumberScheduled:
+                      description: The total number of nodes that are running updated
+                        daemon pod
+                      format: int32
+                      type: integer
+                  required:
+                  - currentNumberScheduled
+                  - desiredNumberScheduled
+                  - numberMisscheduled
+                  - numberReady
+                  type: object
+              required:
+              - mismatchedContainerImages
+              type: object
+            natEnabled:
+              type: boolean
+            routeAgentDaemonSetStatus:
+              properties:
+                lastResourceVersion:
+                  type: string
+                mismatchedContainerImages:
+                  type: boolean
+                nonReadyContainerStates:
+                  items:
+                    description: ContainerState holds a possible state of container.
+                      Only one of its members may be specified. If none of them is
+                      specified, the default one is ContainerStateWaiting.
+                    properties:
+                      running:
+                        description: Details about a running container
+                        properties:
+                          startedAt:
+                            description: Time at which the container was last (re-)started
+                            format: date-time
+                            type: string
+                        type: object
+                      terminated:
+                        description: Details about a terminated container
+                        properties:
+                          containerID:
+                            description: Container's ID in the format 'docker://<container_id>'
+                            type: string
+                          exitCode:
+                            description: Exit status from the last termination of
+                              the container
+                            format: int32
+                            type: integer
+                          finishedAt:
+                            description: Time at which the container last terminated
+                            format: date-time
+                            type: string
+                          message:
+                            description: Message regarding the last termination of
+                              the container
+                            type: string
+                          reason:
+                            description: (brief) reason from the last termination
+                              of the container
+                            type: string
+                          signal:
+                            description: Signal from the last termination of the container
+                            format: int32
+                            type: integer
+                          startedAt:
+                            description: Time at which previous execution of the container
+                              started
+                            format: date-time
+                            type: string
+                        required:
+                        - exitCode
+                        type: object
+                      waiting:
+                        description: Details about a waiting container
+                        properties:
+                          message:
+                            description: Message regarding why the container is not
+                              yet running.
+                            type: string
+                          reason:
+                            description: (brief) reason the container is not yet running.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
+                status:
+                  description: DaemonSetStatus represents the current status of a
+                    daemon set.
+                  properties:
+                    collisionCount:
+                      description: Count of hash collisions for the DaemonSet. The
+                        DaemonSet controller uses this field as a collision avoidance
+                        mechanism when it needs to create the name for the newest
+                        ControllerRevision.
+                      format: int32
+                      type: integer
+                    conditions:
+                      description: Represents the latest available observations of
+                        a DaemonSet's current state.
+                      items:
+                        description: DaemonSetCondition describes the state of a DaemonSet
+                          at a certain point.
+                        properties:
+                          lastTransitionTime:
+                            description: Last time the condition transitioned from
+                              one status to another.
+                            format: date-time
+                            type: string
+                          message:
+                            description: A human readable message indicating details
+                              about the transition.
+                            type: string
+                          reason:
+                            description: The reason for the condition's last transition.
+                            type: string
+                          status:
+                            description: Status of the condition, one of True, False,
+                              Unknown.
+                            type: string
+                          type:
+                            description: Type of DaemonSet condition.
+                            type: string
+                        required:
+                        - status
+                        - type
+                        type: object
+                      type: array
+                    currentNumberScheduled:
+                      description: 'The number of nodes that are running at least
+                        1 daemon pod and are supposed to run the daemon pod. More
+                        info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/'
+                      format: int32
+                      type: integer
+                    desiredNumberScheduled:
+                      description: 'The total number of nodes that should be running
+                        the daemon pod (including nodes correctly running the daemon
+                        pod). More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/'
+                      format: int32
+                      type: integer
+                    numberAvailable:
+                      description: The number of nodes that should be running the
+                        daemon pod and have one or more of the daemon pod running
+                        and available (ready for at least spec.minReadySeconds)
+                      format: int32
+                      type: integer
+                    numberMisscheduled:
+                      description: 'The number of nodes that are running the daemon
+                        pod, but are not supposed to run the daemon pod. More info:
+                        https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/'
+                      format: int32
+                      type: integer
+                    numberReady:
+                      description: The number of nodes that should be running the
+                        daemon pod and have one or more of the daemon pod running
+                        and ready.
+                      format: int32
+                      type: integer
+                    numberUnavailable:
+                      description: The number of nodes that should be running the
+                        daemon pod and have none of the daemon pod running and available
+                        (ready for at least spec.minReadySeconds)
+                      format: int32
+                      type: integer
+                    observedGeneration:
+                      description: The most recent generation observed by the daemon
+                        set controller.
+                      format: int64
+                      type: integer
+                    updatedNumberScheduled:
+                      description: The total number of nodes that are running updated
+                        daemon pod
+                      format: int32
+                      type: integer
+                  required:
+                  - currentNumberScheduled
+                  - desiredNumberScheduled
+                  - numberMisscheduled
+                  - numberReady
+                  type: object
+              required:
+              - mismatchedContainerImages
+              type: object
+            serviceCIDR:
+              type: string
+          required:
+          - clusterID
+          - natEnabled
+          type: object
+      type: object
+  version: v1alpha1
+  versions:
+  - name: v1alpha1
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

submariner-operator/templates/operator-deployment.yaml

@@ -0,0 +1,57 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.fullname" . }}
+    component: engine
+  name: {{ template "submariner.fullname" . }}
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      name: {{ template "submariner.fullname" . }}
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        name: {{ template "submariner.fullname" . }}
+    spec:
+      containers:
+      - command:
+        - submariner-operator
+        env:
+        - name: WATCH_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        - name: OPERATOR_NAME
+          value: submariner-operator
+        image: {{ .Values.operator.image.repository }}:{{ default .Chart.AppVersion .Values.operator.image.tag }}
+        imagePullPolicy: {{ .Values.operator.image.pullPolicy }}
+        name: submariner-operator
+        resources: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      serviceAccount: {{ template "submariner.fullname" . }}
+      serviceAccountName: {{ template "submariner.fullname" . }}
+      terminationGracePeriodSeconds: 30

submariner-operator/templates/rbac.yaml

@@ -0,0 +1,318 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner.fullname" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - services
+  - services/finalizers
+  - endpoints
+  - persistentvolumeclaims
+  - events
+  - configmaps
+  - secrets
+  verbs:
+  - '*'
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - daemonsets
+  - replicasets
+  - statefulsets
+  verbs:
+  - '*'
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - servicemonitors
+  verbs:
+  - get
+  - create
+- apiGroups:
+  - apps
+  resourceNames:
+  - {{ template "submariner.fullname" . }}
+  resources:
+  - deployments/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+- apiGroups:
+  - apps
+  resources:
+  - replicasets
+  verbs:
+  - get
+- apiGroups:
+  - submariner.io
+  resources:
+  - '*'
+  - servicediscoveries
+  verbs:
+  - '*'
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ template "submariner.fullname" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "submariner.fullname" . }}
+roleRef:
+  kind: Role
+  name: {{ template "submariner.fullname" . }}
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["create", "get", "list", "watch", "patch", "update"]
+- apiGroups: ["submariner.io"]
+  resources: ["clusters", "endpoints", "gateways"]
+  verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
+- apiGroups: [""]
+  resources: ["events"]
+  verbs: ["create", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "submariner.fullname" . }}:engine
+subjects:
+- kind: ServiceAccount
+  name: {{ template "submariner.operatorServiceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+- apiGroups: ["submariner.io"]
+  resources: ["clusters", "endpoints", "gateways"]
+  verbs: ["create", "get", "list", "watch", "patch", "update"]
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "watch", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "submariner.fullname" . }}:routeagent
+subjects:
+- kind: ServiceAccount
+  name: {{ template "submariner.operatorServiceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  # submariner-operator updates the config map of core-dns to forward requests to
+  # clusterset.local to Lighthouse DNS, also looks at existing configmaps
+  # to figure out network settings
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list", "watch", "update"]
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "create", "update", "delete"]
+  - apiGroups: [""] # pods and services are looked up to figure out network settings
+    resources: ["pods", "services"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["operator.openshift.io"]
+    resources: ["dnses"]
+    verbs: ["get", "list", "watch", "update"]
+  - apiGroups: ["config.openshift.io"]
+    resources: ["networks"]
+    verbs: ["get", "list"]
+  - apiGroups: ["multicluster.x-k8s.io"]
+    resources: ["*"]
+    verbs: ["create", "get", "list", "watch", "update", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.operatorServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:routeagent
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.operatorServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+- apiGroups: [""]
+  resources: ["services", "namespaces", "pods", "nodes"]
+  verbs: ["get", "list", "watch", "update"]
+- apiGroups: ["submariner.io"]
+  resources: ["clusters", "endpoints", "gateways"]
+  verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:globalnet
+subjects:
+- kind: ServiceAccount
+  name: {{ template "submariner.operatorServiceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+---
+{{- if .Values.submariner.serviceDiscovery }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups: [""]
+    resources: ["services", "namespaces", "configmaps", "endpoints"]
+    verbs: ["get", "list", "watch", "update"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["create", "get", "list", "watch", "update", "delete"]
+  - apiGroups: ["lighthouse.submariner.io"]
+    resources: ["*"]
+    verbs: ["create", "get", "list", "watch", "update", "delete"]
+  - apiGroups: ["submariner.io"]
+    resources: ["gateways"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:lighthouse
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.operatorServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}
+{{- end -}}

submariner-operator/templates/submariner.yaml

@@ -0,0 +1,24 @@
+apiVersion: submariner.io/v1alpha1
+kind: Submariner
+metadata:
+  name: submariner
+  namespace: submariner-operator
+spec:
+  broker: k8s
+  brokerK8sApiServer: {{ .Values.broker.server }}
+  brokerK8sApiServerToken: {{ .Values.broker.token }}
+  brokerK8sCA: {{ .Values.broker.ca }}
+  brokerK8sRemoteNamespace: {{ .Values.broker.namespace }}
+  ceIPSecDebug: {{ .Values.ipsec.debug }}
+  ceIPSecIKEPort: {{ .Values.ipsec.ikePort }}
+  ceIPSecNATTPort: {{ .Values.ipsec.natPort }}
+  ceIPSecPSK: {{ .Values.ipsec.psk }}
+  clusterCIDR: "{{ .Values.submariner.clusterCidr }}"
+  clusterID: {{ .Values.submariner.clusterId }}
+  colorCodes: {{ .Values.submariner.colorCodes }}
+  debug: {{ .Values.submariner.debug }}
+  namespace: {{ .Release.Namespace }}
+  natEnabled: {{ .Values.submariner.natEnabled }}
+  repository: {{ .Values.submariner.images.repository }}
+  version: {{ .Values.submariner.images.tag }}
+  serviceCIDR: "{{ .Values.submariner.serviceCidr }}"

submariner-operator/templates/svc-acct.yaml

@@ -0,0 +1,59 @@
+{{- if .Values.serviceAccounts.operator.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.operatorServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+{{- end }}
+---
+{{- if .Values.serviceAccounts.engine.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.engineServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+{{- end }}
+---
+{{- if .Values.serviceAccounts.routeAgent.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.routeAgentServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+{{- end }}
+---
+{{- if .Values.serviceAccounts.globalnet.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.globalnetServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+{{- end }}
+---
+{{- if .Values.serviceAccounts.lighthouse.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.lighthouseServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+{{- end }}

submariner-operator/values.yaml

@@ -0,0 +1,59 @@
+---
+submariner:
+  clusterId: ""
+  token: ""
+  clusterCidr: ""
+  serviceCidr: ""
+  globalCidr: ""
+  natEnabled: false
+  colorCodes: blue
+  debug: false
+  serviceDiscovery: true
+  images:
+    repository: quay.io/submariner
+    tag: "0.7.0"
+broker:
+  server: example.k8s.apiserver
+  token: test
+  namespace: xyz
+  insecure: false
+  ca: ""
+rbac:
+  create: true
+ipsec:
+  psk: ""
+  debug: false
+  ikePort: 500
+  natPort: 4500
+leadership:
+  leaseDuration: 10
+  renewDeadline: 5
+  retryPeriod: 2
+operator:
+  image:
+    repository: quay.io/submariner/submariner-operator
+    tag: "0.7.0"
+    pullPolicy: IfNotPresent
+  resources: {}
+  tolerations: []
+  affinity: {}
+engine:
+  image:
+    repository: quay.io/submariner/submariner
+    tag: "0.7.0"
+serviceAccounts:
+  operator:
+    create: true
+    name: ""
+  engine:
+    create: true
+    name: ""
+  routeAgent:
+    create: true
+    name: ""
+  globalnet:
+    create: true
+    name: ""
+  lighthouse:
+    create: false
+    name: ""