Add an e2e GHA

For now this only uses the default deployment.

Signed-off-by: Stephen Kitt <skitt@redhat.com>

.github/ISSUE_TEMPLATE/broken-link.md

@@ -1,2 +1,8 @@
-Periodic link aliveness CI detected a broken link. Please see the [periodic job
+---
-results](https://github.com/submariner-io/submariner-charts/actions?query=workflow%3APeriodic) for details.
+name: Broken link detected by CI
+labels: bug
+---
+
+<!-- Used by automation to raise an Issue when the periodic link aliveness tests detect a broken link. -->
+
+Periodic link aliveness CI detected a broken link. Please see the job results for details.

.github/ISSUE_TEMPLATE/bug-report.md

@@ -1,33 +0,0 @@
----
-name: Bug Report
-about: Report a bug in Helm Charts
-labels: bug
-
----
-
-<!-- Please use this template while reporting a bug and provide as much info as
-possible. Not doing so may result in your bug not being addressed in a timely
-manner. Thanks!
-
-If the matter is security related, please disclose it privately to the
-Submariner Owners: https://github.com/orgs/submariner-io/teams/submariner-core
--->
-
-
-**What happened**:
-
-**What you expected to happen**:
-
-**How to reproduce it (as minimally and precisely as possible)**:
-
-**Anything else we need to know?**:
-
-**Environment**:
-- Submariner version (use `subctl version`):
-- Kubernetes version (use `kubectl version`):
-- Cloud provider or hardware configuration:
-- OS (e.g: `cat /etc/os-release`):
-- Kernel (e.g. `uname -a`):
-- Install tools:
-- Network plugin and version (if this is a network-related bug):
-- Others:

.github/ISSUE_TEMPLATE/enhancement.md

@@ -1,11 +0,0 @@
----
-name: Enhancement Request
-about: Suggest an enhancement to the Helm Charts project
-labels: enhancement
-
----
-<!-- Please only use this template for submitting enhancement requests -->
-
-**What would you like to be added**:
-
-**Why is this needed**:

.github/ISSUE_TEMPLATE/support.md

@@ -1,18 +0,0 @@
----
-name: Support Request
-about: Support request or question relating to Helm Charts
-labels: support
-
----
-
-<!--
-GitHub may not the right place for support requests.
-
-You can also post your question on the [Submariner
-Slack](https://kubernetes.slack.com/archives/C010RJV694M) or the Submariner
-[users](https://bit.ly/submariner-users) or
-[developers](https://bit.ly/submariner-dev) mailing lists.
-
-If the matter is security related, please disclose it privately to the
-Submariner Owners: https://github.com/orgs/submariner-io/teams/submariner-core
--->

.github/workflows/e2e.yml

@@ -11,17 +11,24 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
-      matrix:
-        globalnet: ['', 'globalnet']
     steps:
       - name: Check out the repository
         uses: actions/checkout@v2
 
+      - name: Reclaim free space
+        run: |
+          sudo swapoff -a
+          sudo rm -f /swapfile
+          df -h
+          free -h
+
       - name: Run E2E deployment and tests
-        uses: submariner-io/shipyard/gh-actions/e2e@devel
+        run: |
-        with:
+          make e2e
-          globalnet: ${{ matrix.globalnet }}
 
       - name: Post mortem
         if: failure()
-        uses: submariner-io/shipyard/gh-actions/post-mortem@devel
+        run: |
+          df -h
+          free -h
+          make post-mortem

.github/workflows/linting.yml

@@ -19,17 +19,6 @@ jobs:
         with:
           commits: ${{ steps.get-pr-commits.outputs.commits }}
 
-  gitlint:
-    name: Commit Message(s)
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out the repository
-        uses: actions/checkout@v2
-        with:
-          fetch-depth: 0
-      - name: Run gitlint
-        run: make gitlint
-
   markdown-link-check:
     name: Markdown Links (modified files)
     runs-on: ubuntu-latest
@@ -42,7 +31,6 @@ jobs:
         with:
           config-file: ".markdownlinkcheck.json"
           check-modified-files-only: "yes"
-          base-branch: ${{ github.base_ref }}
 
   markdownlint:
     name: Markdown
@@ -51,7 +39,10 @@ jobs:
       - name: Check out the repository
         uses: actions/checkout@v2
       - name: Run markdownlint
-        run: make markdownlint
+        uses: nosborn/github-action-markdown-cli@v1.1.1
+        with:
+          files: .
+          config_file: ".markdownlint.yml"
 
   yaml-lint:
     name: YAML

.github/workflows/periodic.yml

@@ -20,8 +20,8 @@ jobs:
 
       - name: Raise an Issue to report broken links
         if: ${{ failure() }}
-        uses: peter-evans/create-issue-from-file@v2.3.2
+        uses: JasonEtco/create-an-issue@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          title: Broken link detected by CI
+          filename: .github/ISSUE_TEMPLATE/broken-link.md
-          content-filepath: .github/ISSUE_TEMPLATE/broken-link.md
-          labels: automated, broken link

.github/workflows/release.yml

@@ -1,32 +0,0 @@
----
-name: Release Charts
-
-on:
-  push:
-    branches:
-      - devel
-
-jobs:
-  release:
-    name: Release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v2
-        with:
-          fetch-depth: 0
-
-      - name: Configure Git
-        run: |
-          git config user.name "$GITHUB_ACTOR"
-          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
-
-      - name: Update the charts
-        run: |
-          make release
-
-      - name: Push the charts
-        run: |
-          git add charts/*
-          git commit -m "Chart update"
-          git push

.gitignore

@@ -1,4 +1,2 @@
-.dapper
 .idea
-.shflags
+*.tgz
-*.tgz

.gitlint

@@ -1,9 +0,0 @@
-[general]
-# body-is-missing: Allow commit messages with only a title
-# body-min-length: Allow short body lines, like "Relates-to: #issue"
-ignore=body-is-missing,body-min-length
-
-[ignore-by-body]
-# Dependabot doesn't follow our conventions, unfortunately
-regex=^Signed-off-by: dependabot\[bot\](.*)
-ignore=all

.travis.yml

@@ -0,0 +1,47 @@
+language: python
+
+env:
+  global:
+    - HELM_URL=https://storage.googleapis.com/kubernetes-helm
+    - HELM_TGZ=helm-v2.14.3-linux-amd64.tar.gz
+    - TARGET_BR=gh-pages
+    - GH_URL=https://submariner-io.github.io/submariner-charts/charts
+    - CHARTS_DIR=charts
+    - YAMLLINT_VERSION=1.17.0
+    - HELM_FLAGS='--set submariner.serviceDiscovery=true,serviceAccounts.globalnet.create=true,globalCidr="169.254.0.0/16"'
+
+install:
+  - wget -q ${HELM_URL}/${HELM_TGZ}
+  - tar xzfv ${HELM_TGZ}
+  - PATH=`pwd`/linux-amd64/:$PATH
+  - helm init --client-only
+  - sudo pip install yamllint=="${YAMLLINT_VERSION}"
+
+script:
+  - for dir in submariner submariner-k8s-broker submariner-operator; do helm lint $dir $HELM_FLAGS; done
+  - yamllint -c .yamllint.yml -s $(find . -type f -name "Chart.yaml")
+  - yamllint -c .yamllint.yml -s $(find . -type f -name "values.yaml")
+
+after_success:
+  - >
+    if [ $TRAVIS_BRANCH = 'master' ] && [ $TRAVIS_PULL_REQUEST = 'false' ]; then
+      set -e
+      for dir in submariner submariner-k8s-broker submariner-operator; do
+        helm dep update $dir
+        helm package $dir
+      done
+      REPO_URL=`git config remote.origin.url`
+      git clone ${REPO_URL} out && cd out && git checkout gh-pages && mkdir -p ${CHARTS_DIR}
+      cp -f ../submariner-*.tgz ${CHARTS_DIR}/
+      if [ -f charts/index.yaml ]; then
+        helm repo index ${CHARTS_DIR} --url ${GH_URL} --merge index.yaml
+      else
+        helm repo index ${CHARTS_DIR} --url ${GH_URL}
+      fi
+      git config user.name "Travis CI"
+      git config user.email "travis@travis-ci.org"
+      git add -f ${CHARTS_DIR}/*
+      git commit -m "Travis build: $TRAVIS_BUILD_NUMBER"
+      git remote add origin-pages https://${GH_TOKEN}@github.com/submariner-io/submariner-charts.git > /dev/null 2>&1
+      git push --quiet -f -u origin-pages gh-pages
+    fi

CODE-OF-CONDUCT.md

@@ -1,3 +0,0 @@
-# Code of Conduct
-
-Please see the [Code of Conduct docs on Submariner's website](https://submariner.io/community/code-of-conduct/).

CODEOWNERS

@@ -1 +1 @@
-* @mangelajo @Oats87 @skitt @tpantelis
+* @mangelajo @tpantelis @Oats87

CONTRIBUTING.md

@@ -1,3 +0,0 @@
-# Contributing
-
-Please see the [Development docs on Submariner's website](https://submariner.io/development/).

Makefile

@@ -6,12 +6,8 @@ include $(SHIPYARD_DIR)/Makefile.inc
 
 CLUSTER_SETTINGS_FLAG = --cluster_settings $(DAPPER_SOURCE)/cluster_settings
 override CLUSTERS_ARGS += $(CLUSTER_SETTINGS_FLAG)
-override DEPLOY_ARGS += $(CLUSTER_SETTINGS_FLAG) --deploytool helm --deploytool_broker_args '--set submariner.serviceDiscovery=true'
+override DEPLOY_ARGS += $(CLUSTER_SETTINGS_FLAG) --deploytool helm
 export DEPLOY_ARGS
-GH_URL=https://submariner-io.github.io/submariner-charts/charts
-CHARTS_DIR=charts
-CHARTS_VERSION=0.7.0
-REPO_URL=$(shell git config remote.origin.url)
 
 # Targets to make
 
@@ -28,20 +24,7 @@ preload-images:
 		import_image quay.io/submariner/$${image}; \
 	done
 
-%.tgz:
+.PHONY: preload-images
-	helm dep update $(subst -$(CHARTS_VERSION),,$(basename $(@F)))
-	helm package --version $(CHARTS_VERSION) $(subst -$(CHARTS_VERSION),,$(basename $(@F)))
-
-release: submariner-$(CHARTS_VERSION).tgz submariner-k8s-broker-$(CHARTS_VERSION).tgz submariner-operator-$(CHARTS_VERSION).tgz
-	git checkout gh-pages
-	mv *.tgz $(CHARTS_DIR)
-	if [ -f $(CHARTS_DIR)/index.yaml ]; then \
-	  helm repo index $(CHARTS_DIR) --url $(GH_URL) --merge $(CHARTS_DIR)/index.yaml; \
-	else \
-	  helm repo index $(CHARTS_DIR) --url $(GH_URL); \
-	fi
-
-.PHONY: preload-images release
 
 else
 

README.md

@@ -1,13 +1,13 @@
 # submariner-charts
 
-Please see the [Helm docs on Submariner's website](https://submariner.io/operations/deployment/helm/).
+Please see the [Helm docs on Submariner's website](https://submariner.io/deployment/helm/).
 
-## Development workflow
+## Dev workflow
 
 ### Prerequisites
 
-- [Helm] v3
+- [helm]
-- [Docker] or [Podman]
+- [docker] or [podman]
 
 ### Create a fork and checkout
 
@@ -21,36 +21,96 @@ cd submariner-charts
 git checkout -b new-feature
 ```
 
-Now you can modify the Helm charts according to your needs.
+Now you can modify the helm charts according to your needs.
+
+### Serve the modified charts
+
+Before serving the modified charts, the charts must be packaged for local usage.
+
+```bash
+helm package ./submariner
+helm package ./submariner-k8s-broker
+```
+
+Note: if you just installed helm, you have to init the helm, by running
+
+```bash
+helm init --client-only
+```
+
+Serve the packaged charts through a local helm repository:
+
+```bash
+docker run -d --rm --name helm-repo -p 8080:8080 -v $PWD:/charts -e DEBUG=true -e STORAGE=local -e STORAGE_LOCAL_ROOTDIR=/charts chartmuseum/chartmuseum
+```
+
+or
+
+```bash
+sudo podman run -d --rm --name helm-repo -p 8080:8080 -v $PWD:/charts -e DEBUG=true -e STORAGE=local -e STORAGE_LOCAL_ROOTDIR=/charts chartmuseum/chartmuseum
+```
+
+Get the container internal ip:
+
+```bash
+docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' helm-repo
+```
+
+The local container will serve the charts locally on port 8080.
+
+Get logs for the container:
+
+```bash
+docker logs -f helm-repo
+```
 
 ### Use the modified charts
 
-Locally-modified charts can be installed using `helm install`,
+Init helm
-referring to the local path; for example:
 
 ```bash
-helm install submariner-k8s-broker ./submariner-k8s-broker ...
+helm init --client-only
 ```
 
-In the base directory of this repository, a local deployment using the
+Add your local repository to helm
-local charts can be obtained by running the following command:
 
 ```bash
-make deploy
+internal_ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' helm-repo)
+helm repo add test-repo http://$internal_ip:8080
 ```
 
-This will start two kind clusters and deploy Submariner using the
+List the repos:
-Broker and Operator charts.
 
 ```bash
-make e2e
+helm repo list
 ```
 
-will run the end-to-end test suite used to validate that Submariner is
+You should be able to see test-repo in the list
-working correctly.
+
+Search the new repo for submariner charts:
+
+```bash
+helm search -l test-repo
+```
+
+### Modify submariner e2e tests helm deployment script to use your local test-repo
+
+You can test your helm-charts with e2e tests from the [shipyard](https://github.com/submariner-io/shipyard) repository.
+In the file `scripts/shared/lib/deploy_helm` change the line from:
+
+```bash
+helm repo add submariner-latest https://submariner-io.github.io/submariner-charts/charts
+```
+
+to
+
+```bash
+internal_ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' helm-repo)
+helm repo add submariner-latest http://$internal_ip:8080
+```
 
 <!--links-->
-[Helm]: https://helm.sh/docs/using_helm/#installing-helm
+[helm]: https://helm.sh/docs/using_helm/#installing-helm
-[Docker]: https://docs.docker.com/install/
+[docker]: https://docs.docker.com/install/
-[Podman]: https://podman.io/getting-started/installation
+[podman]: https://podman.io/getting-started/installation
 [Create a fork]: https://help.github.com/en/articles/fork-a-repo

deploy_helm

@@ -9,8 +9,22 @@ readonly SUBMARINER_PSK=$(LC_CTYPE=C tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w
 
 ### Functions ###
 
+function install_helm() {
+    if kubectl -n kube-system rollout status deploy/tiller-deploy --timeout=3s > /dev/null 2>&1; then
+        echo "Helm already installed, skipping helm installation..."
+        return
+    fi
+
+    echo "Installing helm..."
+    kubectl -n kube-system create serviceaccount tiller
+    kubectl create clusterrolebinding tiller --clusterrole=cluster-admin --serviceaccount=kube-system:tiller
+    helm --kube-context "${cluster}" init --service-account tiller
+    kubectl -n kube-system rollout status deploy/tiller-deploy --timeout=30s
+}
+
 function deploytool_prereqs() {
-    helm version
+    helm init --client-only
+    run_all_clusters install_helm
 }
 
 function setup_broker() {
@@ -19,9 +33,9 @@ function setup_broker() {
     else
         echo "Installing submariner broker..."
         # shellcheck disable=SC2086 # Split on purpose
-        helm install "${SUBMARINER_BROKER_NS}" ./submariner-k8s-broker \
+        helm install ./submariner-k8s-broker \
-             --create-namespace \
              --kube-context "${cluster}" \
+             --name "${SUBMARINER_BROKER_NS}" \
              --namespace "${SUBMARINER_BROKER_NS}" \
              ${deploytool_broker_args}
     fi
@@ -42,16 +56,14 @@ function helm_install_subm() {
 
     echo "Installing Submariner..."
     # shellcheck disable=SC2086 # Split on purpose
-    helm --kube-context "${cluster}" install submariner-operator \
+    helm --kube-context "${cluster}" install ./submariner-operator \
-        ./submariner-operator \
+        --name submariner-operator \
-        --create-namespace \
         --namespace "${SUBM_NS}" \
         --set ipsec.psk="${SUBMARINER_PSK}" \
         --set broker.server="${submariner_broker_url}" \
         --set broker.token="${submariner_broker_token}" \
         --set broker.namespace="${SUBMARINER_BROKER_NS}" \
         --set broker.ca="${submariner_broker_ca}" \
-        --set submariner.cableDriver="${cable_driver}" \
         --set submariner.clusterId="${cluster}" \
         --set submariner.clusterCidr="${cluster_CIDRs[$cluster]}" \
         --set submariner.serviceCidr="${service_CIDRs[$cluster]}" \

submariner-k8s-broker/crds/crd.yaml

@@ -1,324 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: clusters.submariner.io
-spec:
-  group: submariner.io
-  version: v1
-  names:
-    kind: Cluster
-    plural: clusters
-  scope: Namespaced
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: endpoints.submariner.io
-spec:
-  group: submariner.io
-  version: v1
-  names:
-    kind: Endpoint
-    plural: endpoints
-  scope: Namespaced
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: gateways.submariner.io
-spec:
-  group: submariner.io
-  version: v1
-  names:
-    kind: Gateway
-    plural: gateways
-  scope: Namespaced
-  additionalPrinterColumns:
-    - name: ha-status
-      type: string
-      description: High Availability Status of the Gateway
-      JSONPath: .status.haStatus
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: multiclusterservices.lighthouse.submariner.io
-spec:
-  group: lighthouse.submariner.io
-  version: v1
-  names:
-    kind: MultiClusterService
-    plural: multiclusterservices
-    singular: multiclusterservice
-  scope: Namespaced
-  validation:
-    openAPIV3Schema:
-      properties:
-        spec:
-          properties:
-            clusterServiceInfo:
-              properties:
-                clusterID:
-                  type: "string"
-                clusterDomain:
-                  type: "string"
-                serviceIP:
-                  type: "string"
-                port:
-                  type: "integer"
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceexports.lighthouse.submariner.io
-spec:
-  group: lighthouse.submariner.io
-  version: v2alpha1
-  names:
-    kind: ServiceExport
-    plural: serviceexports
-    singular: serviceexport
-  scope: Namespaced
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceimports.lighthouse.submariner.io
-spec:
-  group: lighthouse.submariner.io
-  version: v2alpha1
-  names:
-    kind: ServiceImport
-    plural: serviceimports
-    singular: serviceimport
-  scope: Namespaced
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceexports.multicluster.x-k8s.io
-spec:
-  group: multicluster.x-k8s.io
-  scope: Namespaced
-  names:
-    plural: serviceexports
-    singular: serviceexport
-    kind: ServiceExport
-    shortNames:
-      - svcex
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      subresources:
-        status: {}
-      additionalPrinterColumns:
-        - name: Age
-          type: date
-          jsonPath: .metadata.creationTimestamp
-      "schema":
-        "openAPIV3Schema":
-          description: ServiceExport declares that the Service with the same name and
-            namespace as this export should be consumable from other clusters.
-          type: object
-          properties:
-            apiVersion:
-              description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-              type: string
-            kind:
-              description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-              type: string
-            metadata:
-              type: object
-            status:
-              description: status describes the current state of an exported service.
-                Service configuration comes from the Service that had the same name
-                and namespace as this ServiceExport. Populated by the multi-cluster
-                service implementation's controller.
-              type: object
-              properties:
-                conditions:
-                  type: array
-                  items:
-                    description: "ServiceExportCondition contains details for the current
-                    condition of this service export. \n Once [KEP-1623](https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/1623-standardize-conditions)
-                    is implemented, this will be replaced by metav1.Condition."
-                    type: object
-                    required:
-                      - status
-                      - type
-                    properties:
-                      lastTransitionTime:
-                        type: string
-                        format: date-time
-                      message:
-                        type: string
-                      reason:
-                        type: string
-                      status:
-                        description: Status is one of {"True", "False", "Unknown"}
-                        type: string
-                        enum:
-                          - "True"
-                          - "False"
-                          - Unknown
-                      type:
-                        description: ServiceExportConditionType identifies a specific
-                          condition.
-                        type: string
-                  x-kubernetes-list-map-keys:
-                    - type
-                  x-kubernetes-list-type: map
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceimports.multicluster.x-k8s.io
-spec:
-  group: multicluster.x-k8s.io
-  scope: Namespaced
-  names:
-    plural: serviceimports
-    singular: serviceimport
-    kind: ServiceImport
-    shortNames:
-      - svcim
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      subresources:
-        status: {}
-      additionalPrinterColumns:
-        - name: Type
-          type: string
-          description: The type of this ServiceImport
-          jsonPath: .spec.type
-        - name: IP
-          type: string
-          description: The VIP for this ServiceImport
-          jsonPath: .spec.ips
-        - name: Age
-          type: date
-          jsonPath: .metadata.creationTimestamp
-      "schema":
-        "openAPIV3Schema":
-          description: ServiceImport describes a service imported from clusters in a
-            ClusterSet.
-          type: object
-          properties:
-            apiVersion:
-              description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-              type: string
-            kind:
-              description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-              type: string
-            metadata:
-              type: object
-            spec:
-              description: spec defines the behavior of a ServiceImport.
-              type: object
-              required:
-                - ports
-                - type
-              properties:
-                ips:
-                  description: ip will be used as the VIP for this service when type
-                    is ClusterSetIP.
-                  type: array
-                  maxItems: 1
-                  items:
-                    type: string
-                ports:
-                  type: array
-                  items:
-                    description: ServicePort represents the port on which the service
-                      is exposed
-                    type: object
-                    required:
-                      - port
-                    properties:
-                      appProtocol:
-                        description: The application protocol for this port. This field
-                          follows standard Kubernetes label syntax. Un-prefixed names
-                          are reserved for IANA standard service names (as per RFC-6335
-                          and http://www.iana.org/assignments/service-names). Non-standard
-                          protocols should use prefixed names such as mycompany.com/my-custom-protocol.
-                          Field can be enabled with ServiceAppProtocol feature gate.
-                        type: string
-                      name:
-                        description: The name of this port within the service. This
-                          must be a DNS_LABEL. All ports within a ServiceSpec must have
-                          unique names. When considering the endpoints for a Service,
-                          this must match the 'name' field in the EndpointPort. Optional
-                          if only one ServicePort is defined on this service.
-                        type: string
-                      port:
-                        description: The port that will be exposed by this service.
-                        type: integer
-                        format: int32
-                      protocol:
-                        description: The IP protocol for this port. Supports "TCP",
-                          "UDP", and "SCTP". Default is TCP.
-                        type: string
-                  x-kubernetes-list-type: atomic
-                sessionAffinity:
-                  description: 'Supports "ClientIP" and "None". Used to maintain session
-                  affinity. Enable client IP based session affinity. Must be ClientIP
-                  or None. Defaults to None. Ignored when type is Headless More info:
-                  https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies'
-                  type: string
-                sessionAffinityConfig:
-                  description: sessionAffinityConfig contains session affinity configuration.
-                  type: object
-                  properties:
-                    clientIP:
-                      description: clientIP contains the configurations of Client IP
-                        based session affinity.
-                      type: object
-                      properties:
-                        timeoutSeconds:
-                          description: timeoutSeconds specifies the seconds of ClientIP
-                            type session sticky time. The value must be >0 && <=86400(for
-                            1 day) if ServiceAffinity == "ClientIP". Default value is
-                            10800(for 3 hours).
-                          type: integer
-                          format: int32
-                type:
-                  description: type defines the type of this service. Must be ClusterSetIP
-                    or Headless.
-                  type: string
-                  enum:
-                    - ClusterSetIP
-                    - Headless
-            status:
-              description: status contains information about the exported services that
-                form the multi-cluster service referenced by this ServiceImport.
-              type: object
-              properties:
-                clusters:
-                  description: clusters is the list of exporting clusters from which
-                    this service was derived.
-                  type: array
-                  items:
-                    description: ClusterStatus contains service configuration mapped
-                      to a specific source cluster
-                    type: object
-                    required:
-                      - cluster
-                    properties:
-                      cluster:
-                        description: cluster is the name of the exporting cluster. Must
-                          be a valid RFC-1123 DNS label.
-                        type: string
-                  x-kubernetes-list-map-keys:
-                    - cluster
-                  x-kubernetes-list-type: map

submariner-k8s-broker/templates/crd.yaml

@@ -0,0 +1,166 @@
+{{- if .Values.crd.create -}}
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: clusters.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: submariner.io
+  version: v1
+  names:
+    kind: Cluster
+    plural: clusters
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: endpoints.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: submariner.io
+  version: v1
+  names:
+    kind: Endpoint
+    plural: endpoints
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: gateways.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: submariner.io
+  version: v1
+  names:
+    kind: Gateway
+    plural: gateways
+  scope: Namespaced
+  additionalPrinterColumns:
+    - name: ha-status
+      type: string
+      description: High Availability Status of the Gateway
+      JSONPath: .status.haStatus
+---
+{{- if .Values.submariner.serviceDiscovery }}
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: multiclusterservices.lighthouse.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: lighthouse.submariner.io
+  version: v1
+  names:
+    kind: MultiClusterService
+    plural: multiclusterservices
+    singular: multiclusterservice
+  scope: Namespaced
+  validation:
+    openAPIV3Schema:
+      properties:
+        spec:
+          properties:
+            clusterServiceInfo:
+              properties:
+                clusterID:
+                  type: "string"
+                clusterDomain:
+                  type: "string"
+                serviceIP:
+                  type: "string"
+                port:
+                  type: "integer"
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceexports.lighthouse.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: lighthouse.submariner.io
+  version: v2alpha1
+  names:
+    kind: ServiceExport
+    plural: serviceexports
+    singular: serviceexport
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceimports.lighthouse.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: lighthouse.submariner.io
+  version: v2alpha1
+  names:
+    kind: ServiceImport
+    plural: serviceimports
+    singular: serviceimport
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceexports.multicluster.x-k8s.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: multicluster.x-k8s.io
+  scope: Namespaced
+  names:
+    plural: serviceexports
+    singular: serviceexport
+    kind: ServiceExport
+    shortNames:
+      - svcex
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+  additionalPrinterColumns:
+    - name: Age
+      type: date
+      jsonPath: .metadata.creationTimestamp
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceimports.multicluster.x-k8s.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: multicluster.x-k8s.io
+  scope: Namespaced
+  names:
+    plural: serviceimports
+    singular: serviceimport
+    kind: ServiceImport
+    shortNames:
+      - svcim
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+  additionalPrinterColumns:
+    - name: Type
+      type: string
+      description: The type of this ServiceImport
+      jsonPath: .spec.type
+    - name: IP
+      type: string
+      description: The VIP for this ServiceImport
+      jsonPath: .spec.ips
+    - name: Age
+      type: date
+      jsonPath: .metadata.creationTimestamp
+{{- end -}}
+{{- end -}}

submariner-operator/questions.yml

@@ -92,13 +92,6 @@ questions:
   label: "Service CIDR"
   group: "CIDR Configuration"
   required: true
-- variable: submariner.globalCidr
-  default: ""
-  description: "Enter the globalnet CIDR (i.e. 169.254.1.0/24) for this cluster if using globalnet"
-  type: string
-  label: "Globalnet CIDR"
-  group: "CIDR Configuration"
-  required: false
 - variable: submariner.natEnabled
   type: boolean
   default: false

submariner-operator/templates/_helpers.tpl

@@ -47,7 +47,7 @@ Create the name of the submariner-engine service account to use
 */}}
 {{- define "submariner.engineServiceAccountName" -}}
 {{- if .Values.serviceAccounts.engine.create -}}
-    {{ default "submariner-engine" .Values.serviceAccounts.engine.name }}
+    {{ default (printf "%s-engine" (include "submariner.fullname" .)) .Values.serviceAccounts.engine.name }}
 {{- else -}}
     {{ default "default" .Values.serviceAccounts.engine.name }}
 {{- end -}}
@@ -58,7 +58,7 @@ Create the name of the submariner-route-agent service account to use
 */}}
 {{- define "submariner.routeAgentServiceAccountName" -}}
 {{- if .Values.serviceAccounts.routeAgent.create -}}
-    {{ default "submariner-routeagent" .Values.serviceAccounts.routeAgent.name }}
+    {{ default (printf "%s-routeagent" (include "submariner.fullname" .)) .Values.serviceAccounts.routeAgent.name }}
 {{- else -}}
     {{ default "default" .Values.serviceAccounts.routeAgent.name }}
 {{- end -}}
@@ -69,31 +69,20 @@ Create the name of the submariner-globalnet service account to use
 */}}
 {{- define "submariner.globalnetServiceAccountName" -}}
 {{- if .Values.serviceAccounts.globalnet.create -}}
-    {{ default "submariner-globalnet" .Values.serviceAccounts.globalnet.name }}
+    {{ default (printf "%s:globalnet" (include "submariner.fullname" .)) .Values.serviceAccounts.globalnet.name }}
 {{- else -}}
     {{ default "default" .Values.serviceAccounts.globalnet.name }}
 {{- end -}}
 {{- end -}}
 
 {{/*
-Create the name of the submariner-lighthouse-agent service account to use
+Create the name of the submariner-lighthouse service account to use
 */}}
-{{- define "submariner.lighthouseAgentServiceAccountName" -}}
+{{- define "submariner.lighthouseServiceAccountName" -}}
-{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseAgent.create) -}}
+{{- if .Values.submariner.serviceDiscovery -}}
-    {{ default "submariner-lighthouse-agent" .Values.serviceAccounts.lighthouseAgent.name }}
+    {{ default (printf "%s-lighthouse" (include "submariner.fullname" .)) .Values.serviceAccounts.lighthouse.name }}
 {{- else -}}
-    {{ default "default" .Values.serviceAccounts.lighthouseAgent.name }}
+    {{ default "default" .Values.serviceAccounts.lighthouse.name }}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Create the name of the submariner-lighthouse-coredns service account to use
-*/}}
-{{- define "submariner.lighthouseCoreDnsServiceAccountName" -}}
-{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseCoreDns.create) -}}
-    {{ default "submariner-lighthouse-coredns" .Values.serviceAccounts.lighthouseCoreDns.name }}
-{{- else -}}
-    {{ default "default" .Values.serviceAccounts.lighthouseCoreDns.name }}
 {{- end -}}
 {{- end -}}
 

submariner-operator/templates/crd.yaml

@@ -4,6 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   name: submariners.submariner.io
   annotations:
+    "helm.sh/hook": crd-install
     controller-gen.kubebuilder.io/version: v0.3.0
 spec:
   group: submariner.io
@@ -720,158 +721,3 @@ status:
     plural: ""
   conditions: []
   storedVersions: []
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.3.0
-  creationTimestamp: null
-  name: servicediscoveries.submariner.io
-spec:
-  group: submariner.io
-  names:
-    kind: ServiceDiscovery
-    listKind: ServiceDiscoveryList
-    plural: servicediscoveries
-    singular: servicediscovery
-  scope: Namespaced
-  versions:
-    - name: v1alpha1
-      schema:
-        openAPIV3Schema:
-          description: ServiceDiscovery is the Schema for the servicediscoveries API
-          properties:
-            apiVersion:
-              description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-              type: string
-            kind:
-              description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-              type: string
-            metadata:
-              type: object
-            spec:
-              description: ServiceDiscoverySpec defines the desired state of ServiceDiscovery
-              properties:
-                brokerK8sApiServer:
-                  type: string
-                brokerK8sApiServerToken:
-                  type: string
-                brokerK8sCA:
-                  type: string
-                brokerK8sRemoteNamespace:
-                  type: string
-                clusterID:
-                  type: string
-                customDomains:
-                  items:
-                    type: string
-                  type: array
-                  x-kubernetes-list-type: set
-                debug:
-                  type: boolean
-                globalnetEnabled:
-                  type: boolean
-                imageOverrides:
-                  additionalProperties:
-                    type: string
-                  type: object
-                namespace:
-                  type: string
-                repository:
-                  type: string
-                version:
-                  type: string
-              required:
-                - brokerK8sApiServer
-                - brokerK8sApiServerToken
-                - brokerK8sCA
-                - brokerK8sRemoteNamespace
-                - clusterID
-                - debug
-                - namespace
-              type: object
-            status:
-              description: ServiceDiscoveryStatus defines the observed state of ServiceDiscovery
-              type: object
-          type: object
-      served: true
-      storage: true
-      subresources:
-        status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    controller-gen.kubebuilder.io/version: v0.3.0
-  creationTimestamp: null
-  name: brokers.submariner.io
-spec:
-  group: submariner.io
-  names:
-    kind: Broker
-    listKind: BrokerList
-    plural: brokers
-    singular: broker
-  scope: Namespaced
-  versions:
-    - name: v1alpha1
-      schema:
-        openAPIV3Schema:
-          description: Broker is the Schema for the brokers API
-          properties:
-            apiVersion:
-              description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-              type: string
-            kind:
-              description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-              type: string
-            metadata:
-              type: object
-            spec:
-              description: BrokerSpec defines the desired state of Broker
-              properties:
-                components:
-                  items:
-                    type: string
-                  type: array
-                defaultCustomDomains:
-                  items:
-                    type: string
-                  type: array
-                defaultGlobalnetClusterSize:
-                  type: integer
-                globalnetCIDRRange:
-                  type: string
-                globalnetEnabled:
-                  type: boolean
-              type: object
-            status:
-              description: BrokerStatus defines the observed state of Broker
-              type: object
-          type: object
-      served: true
-      storage: true
-      subresources:
-        status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

submariner-operator/templates/rbac.yaml

@@ -77,7 +77,7 @@ metadata:
     app: {{ template "submariner.name" . }}
 subjects:
 - kind: ServiceAccount
-  name: {{ template "submariner.operatorServiceAccountName" . }}
+  name: {{ template "submariner.fullname" . }}
 roleRef:
   kind: Role
   name: {{ template "submariner.fullname" . }}
@@ -93,75 +93,15 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-- apiGroups:
+- apiGroups: [""]
-    - ""
+  resources: ["configmaps"]
-  resources:
+  verbs: ["create", "get", "list", "watch", "patch", "update"]
-    - pods
+- apiGroups: ["submariner.io"]
-    - services
+  resources: ["clusters", "endpoints", "gateways"]
-    - services/finalizers
+  verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
-    - endpoints
+- apiGroups: [""]
-    - persistentvolumeclaims
+  resources: ["events"]
-    - events
+  verbs: ["create", "patch"]
-    - configmaps
-    - secrets
-  verbs:
-    - '*'
-- apiGroups:
-    - apps
-  resources:
-    - deployments
-    - daemonsets
-    - replicasets
-    - statefulsets
-  verbs:
-    - '*'
-- apiGroups:
-    - monitoring.coreos.com
-  resources:
-    - servicemonitors
-  verbs:
-    - get
-    - create
-- apiGroups:
-    - apps
-  resourceNames:
-    - submariner-operator
-  resources:
-    - deployments/finalizers
-  verbs:
-    - update
-- apiGroups:
-    - ""
-  resources:
-    - pods
-  verbs:
-    - get
-- apiGroups:
-    - apps
-  resources:
-    - replicasets
-  verbs:
-    - get
-- apiGroups:
-    - submariner.io
-  resources:
-    - '*'
-    - servicediscoveries
-  verbs:
-    - '*'
-- apiGroups:
-    - lighthouse.submariner.io
-  resources:
-    - '*'
-    - serviceexports
-  verbs:
-    - create
-    - delete
-    - get
-    - list
-    - patch
-    - update
-    - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -178,7 +118,7 @@ roleRef:
   name: {{ template "submariner.fullname" . }}:engine
 subjects:
 - kind: ServiceAccount
-  name: {{ template "submariner.engineServiceAccountName" . }}
+  name: {{ template "submariner.operatorServiceAccountName" . }}
   namespace: {{ .Release.Namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -191,75 +131,12 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups:
+- apiGroups: ["submariner.io"]
-      - ""
+  resources: ["clusters", "endpoints", "gateways"]
-    resources:
+  verbs: ["create", "get", "list", "watch", "patch", "update"]
-      - pods
+- apiGroups: [""]
-      - services
+  resources: ["pods"]
-      - services/finalizers
+  verbs: ["get", "watch", "list"]
-      - endpoints
-      - persistentvolumeclaims
-      - events
-      - configmaps
-      - secrets
-    verbs:
-      - '*'
-  - apiGroups:
-      - apps
-    resources:
-      - deployments
-      - daemonsets
-      - replicasets
-      - statefulsets
-    verbs:
-      - '*'
-  - apiGroups:
-      - monitoring.coreos.com
-    resources:
-      - servicemonitors
-    verbs:
-      - get
-      - create
-  - apiGroups:
-      - apps
-    resourceNames:
-      - submariner-operator
-    resources:
-      - deployments/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-    verbs:
-      - get
-  - apiGroups:
-      - apps
-    resources:
-      - replicasets
-    verbs:
-      - get
-  - apiGroups:
-      - submariner.io
-    resources:
-      - '*'
-      - servicediscoveries
-    verbs:
-      - '*'
-  - apiGroups:
-      - lighthouse.submariner.io
-    resources:
-      - '*'
-      - serviceexports
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -276,109 +153,9 @@ roleRef:
   name: {{ template "submariner.fullname" . }}:routeagent
 subjects:
 - kind: ServiceAccount
-  name: {{ template "submariner.routeAgentServiceAccountName" . }}
+  name: {{ template "submariner.operatorServiceAccountName" . }}
   namespace: {{ .Release.Namespace }}
 ---
-{{- if ne .Values.submariner.globalCidr "" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ template "submariner.fullname" . }}:globalnet
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-      - services
-      - services/finalizers
-      - endpoints
-      - persistentvolumeclaims
-      - events
-      - configmaps
-      - secrets
-    verbs:
-      - '*'
-  - apiGroups:
-      - apps
-    resources:
-      - deployments
-      - daemonsets
-      - replicasets
-      - statefulsets
-    verbs:
-      - '*'
-  - apiGroups:
-      - monitoring.coreos.com
-    resources:
-      - servicemonitors
-    verbs:
-      - get
-      - create
-  - apiGroups:
-      - apps
-    resourceNames:
-      - submariner-operator
-    resources:
-      - deployments/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-    verbs:
-      - get
-  - apiGroups:
-      - apps
-    resources:
-      - replicasets
-    verbs:
-      - get
-  - apiGroups:
-      - submariner.io
-    resources:
-      - '*'
-      - servicediscoveries
-    verbs:
-      - '*'
-  - apiGroups:
-      - lighthouse.submariner.io
-    resources:
-      - '*'
-      - serviceexports
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ template "submariner.fullname" . }}:globalnet
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ template "submariner.fullname" . }}:globalnet
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "submariner.globalnetServiceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
----
-{{- end -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -392,50 +169,24 @@ rules:
   # submariner-operator updates the config map of core-dns to forward requests to
   # clusterset.local to Lighthouse DNS, also looks at existing configmaps
   # to figure out network settings
-  - apiGroups:
+  - apiGroups: [""]
-      - ""
+    resources: ["configmaps"]
-    resources:
+    verbs: ["get", "list", "watch", "update"]
-      - configmaps
+  - apiGroups: ["apiextensions.k8s.io"]
-    verbs:
+    resources: ["customresourcedefinitions"]
-      - get
+    verbs: ["get", "list", "create", "update", "delete"]
-      - list
+  - apiGroups: [""] # pods and services are looked up to figure out network settings
-      - watch
+    resources: ["pods", "services"]
-      - update
+    verbs: ["get", "list", "watch"]
-  - apiGroups:
+  - apiGroups: ["operator.openshift.io"]
-      - apiextensions.k8s.io
+    resources: ["dnses"]
-    resources:
+    verbs: ["get", "list", "watch", "update"]
-      - customresourcedefinitions
+  - apiGroups: ["config.openshift.io"]
-    verbs:
+    resources: ["networks"]
-      - get
+    verbs: ["get", "list"]
-      - list
+  - apiGroups: ["multicluster.x-k8s.io"]
-      - create
+    resources: ["*"]
-      - update
+    verbs: ["create", "get", "list", "watch", "update", "delete"]
-      - delete
-  - apiGroups:  # pods and services are looked up to figure out network settings
-      - ""
-    resources:
-      - pods
-      - services
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - operator.openshift.io
-    resources:
-      - dnses
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - config.openshift.io
-    resources:
-      - networks
-    verbs:
-      - get
-      - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -457,91 +208,6 @@ roleRef:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
-metadata:
-  name: {{ template "submariner.fullname" . }}:engine
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-  - apiGroups:
-      - apiextensions.k8s.io
-    resources:
-      - customresourcedefinitions
-    verbs:
-      - get
-      - list
-      - create
-      - update
-      - delete
-  - apiGroups:  # pods and services are looked up to figure out network settings
-      - ""
-    resources:
-      - pods
-      - services
-      - nodes
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - operator.openshift.io
-    resources:
-      - dnses
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - config.openshift.io
-    resources:
-      - networks
-    verbs:
-      - get
-      - list
-  - apiGroups:
-      - submariner.io
-    resources:
-      - endpoints
-      - gateways
-      - clusters
-    verbs:
-      - get
-      - list
-      - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "submariner.fullname" . }}:engine
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "submariner.fullname" . }}:engine
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "submariner.engineServiceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
 metadata:
   name: {{ template "submariner.fullname" . }}:routeagent
   labels:
@@ -550,59 +216,9 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups:
+  - apiGroups: [""]
-      - ""
+    resources: ["nodes"]
-    resources:
+    verbs: ["get", "update"]
-      - configmaps
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - apiextensions.k8s.io
-    resources:
-      - customresourcedefinitions
-    verbs:
-      - get
-      - list
-      - create
-      - update
-      - delete
-  - apiGroups:  # pods and services are looked up to figure out network settings
-      - ""
-    resources:
-      - pods
-      - services
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - operator.openshift.io
-    resources:
-      - dnses
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - config.openshift.io
-    resources:
-      - networks
-    verbs:
-      - get
-      - list
-  - apiGroups:
-      - ""
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-    resources:
-      - nodes
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -619,10 +235,9 @@ roleRef:
   name: {{ template "submariner.fullname" . }}:routeagent
 subjects:
   - kind: ServiceAccount
-    name: {{ template "submariner.routeAgentServiceAccountName" . }}
+    name: {{ template "submariner.operatorServiceAccountName" . }}
     namespace: {{ .Release.Namespace }}
 ---
-{{- if ne .Values.submariner.globalCidr "" }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -633,37 +248,13 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups:
+- apiGroups: [""]
-      - ""
+  resources: ["services", "namespaces", "pods", "nodes"]
-    resources:
+  verbs: ["get", "list", "watch", "update"]
-      - pods
+- apiGroups: ["submariner.io"]
-      - services
+  resources: ["clusters", "endpoints", "gateways"]
-      - namespaces
+  verbs: ["get", "list", "watch"]
-      - nodes
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - submariner.io
-    resources:
-      - endpoints
-      - clusters
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - multicluster.x-k8s.io
-    resources:
-      - "serviceexports"
-    verbs:
-      - get
-      - list
-      - watch
 ---
-{{- end -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -679,67 +270,37 @@ roleRef:
   name: {{ template "submariner.fullname" . }}:globalnet
 subjects:
 - kind: ServiceAccount
-  name: {{ template "submariner.globalnetServiceAccountName" . }}
+  name: {{ template "submariner.operatorServiceAccountName" . }}
   namespace: {{ .Release.Namespace }}
 ---
 {{- if .Values.submariner.serviceDiscovery }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse-agent
+  name: {{ template "submariner.fullname" . }}:lighthouse
   labels:
     heritage: {{ .Release.Service | quote }}
     release: {{ .Release.Name | quote }}
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups:
+  - apiGroups: [""]
-      - ""
+    resources: ["services", "namespaces", "configmaps", "endpoints"]
-    resources:
+    verbs: ["get", "list", "watch", "update"]
-      - services
+  - apiGroups: ["discovery.k8s.io"]
-      - namespaces
+    resources: ["endpointslices"]
-      - endpoints
+    verbs: ["create", "get", "list", "watch", "update", "delete"]
-    verbs:
+  - apiGroups: ["lighthouse.submariner.io"]
-      - get
+    resources: ["*"]
-      - list
+    verbs: ["create", "get", "list", "watch", "update", "delete"]
-      - watch
+  - apiGroups: ["submariner.io"]
-      - update
+    resources: ["gateways"]
-  - apiGroups:
+    verbs: ["get", "list", "watch"]
-      - discovery.k8s.io
-    resources:
-      - endpointslices
-    verbs:
-      - create
-      - get
-      - list
-      - watch
-      - update
-      - delete
-      - deletecollection
-  - apiGroups:
-      - submariner.io
-    resources:
-      - "gateways"
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - multicluster.x-k8s.io
-    resources:
-      - "*"
-    verbs:
-      - create
-      - get
-      - list
-      - watch
-      - update
-      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse-agent
+  name: {{ template "submariner.fullname" . }}:lighthouse
   labels:
     heritage: {{ .Release.Service | quote }}
     release: {{ .Release.Name | quote }}
@@ -748,82 +309,10 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ template "submariner.fullname" . }}:lighthouse-agent
+  name: {{ template "submariner.fullname" . }}:lighthouse
 subjects:
   - kind: ServiceAccount
-    name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
+    name: {{ template "submariner.operatorServiceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - services
-      - namespaces
-      - endpoints
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - discovery.k8s.io
-    resources:
-      - endpointslices
-    verbs:
-      - create
-      - get
-      - list
-      - watch
-      - update
-      - delete
-      - deletecollection
-  - apiGroups:
-      - lighthouse.submariner.io
-    resources:
-      - "*"
-    verbs:
-      - create
-      - get
-      - list
-      - watch
-      - update
-      - delete
-  - apiGroups:
-      - submariner.io
-    resources:
-      - "gateways"
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - multicluster.x-k8s.io
-    resources:
-      - "*"
-    verbs:
-      - create
-      - get
-      - list
-      - watch
-      - update
-      - delete
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
     namespace: {{ .Release.Namespace }}
 {{- end -}}
 {{- end -}}

submariner-operator/templates/submariner.yaml

@@ -22,5 +22,3 @@ spec:
   repository: {{ .Values.submariner.images.repository }}
   version: {{ .Values.submariner.images.tag }}
   serviceCIDR: "{{ .Values.submariner.serviceCidr }}"
-  globalCIDR: "{{ .Values.submariner.globalCidr }}"
-  serviceDiscoveryEnabled: {{ .Values.submariner.serviceDiscovery }}

submariner-operator/templates/svc-acct.yaml

@@ -46,26 +46,14 @@ metadata:
     app: {{ template "submariner.name" . }}
 {{- end }}
 ---
-{{- if .Values.serviceAccounts.lighthouseAgent.create }}
+{{- if .Values.serviceAccounts.lighthouse.create }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
+  name: {{ template "submariner.lighthouseServiceAccountName" . }}
   labels:
     heritage: {{ .Release.Service | quote }}
     release: {{ .Release.Name | quote }}
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 {{- end }}
----
-  {{- if .Values.serviceAccounts.lighthouseCoreDns.create }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-  {{- end }}

submariner-operator/values.yaml

@@ -54,9 +54,6 @@ serviceAccounts:
   globalnet:
     create: true
     name: ""
-  lighthouseAgent:
+  lighthouse:
-    create: true
+    create: false
-    name: ""
-  lighthouseCoreDns:
-    create: true
     name: ""

submariner/crds/crd.yaml

@@ -1,324 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: clusters.submariner.io
-spec:
-  group: submariner.io
-  version: v1
-  names:
-    kind: Cluster
-    plural: clusters
-  scope: Namespaced
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: endpoints.submariner.io
-spec:
-  group: submariner.io
-  version: v1
-  names:
-    kind: Endpoint
-    plural: endpoints
-  scope: Namespaced
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: gateways.submariner.io
-spec:
-  group: submariner.io
-  version: v1
-  names:
-    kind: Gateway
-    plural: gateways
-  scope: Namespaced
-  additionalPrinterColumns:
-  - name: ha-status
-    type: string
-    description: High Availability Status of the Gateway
-    JSONPath: .status.haStatus
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: multiclusterservices.lighthouse.submariner.io
-spec:
-  group: lighthouse.submariner.io
-  version: v1
-  names:
-    kind: MultiClusterService
-    plural: multiclusterservices
-    singular: multiclusterservice
-  scope: Namespaced
-  validation:
-    openAPIV3Schema:
-      properties:
-        spec:
-          properties:
-            clusterServiceInfo:
-              properties:
-                clusterID:
-                  type: "string"
-                clusterDomain:
-                  type: "string"
-                serviceIP:
-                  type: "string"
-                port:
-                  type: "integer"
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceexports.lighthouse.submariner.io
-spec:
-  group: lighthouse.submariner.io
-  version: v2alpha1
-  names:
-    kind: ServiceExport
-    plural: serviceexports
-    singular: serviceexport
-  scope: Namespaced
----
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceimports.lighthouse.submariner.io
-spec:
-  group: lighthouse.submariner.io
-  version: v2alpha1
-  names:
-    kind: ServiceImport
-    plural: serviceimports
-    singular: serviceimport
-  scope: Namespaced
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceexports.multicluster.x-k8s.io
-spec:
-  group: multicluster.x-k8s.io
-  scope: Namespaced
-  names:
-    plural: serviceexports
-    singular: serviceexport
-    kind: ServiceExport
-    shortNames:
-      - svcex
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      subresources:
-        status: {}
-      additionalPrinterColumns:
-        - name: Age
-          type: date
-          jsonPath: .metadata.creationTimestamp
-      "schema":
-        "openAPIV3Schema":
-          description: ServiceExport declares that the Service with the same name and
-            namespace as this export should be consumable from other clusters.
-          type: object
-          properties:
-            apiVersion:
-              description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-              type: string
-            kind:
-              description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-              type: string
-            metadata:
-              type: object
-            status:
-              description: status describes the current state of an exported service.
-                Service configuration comes from the Service that had the same name
-                and namespace as this ServiceExport. Populated by the multi-cluster
-                service implementation's controller.
-              type: object
-              properties:
-                conditions:
-                  type: array
-                  items:
-                    description: "ServiceExportCondition contains details for the current
-                    condition of this service export. \n Once [KEP-1623](https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/1623-standardize-conditions)
-                    is implemented, this will be replaced by metav1.Condition."
-                    type: object
-                    required:
-                      - status
-                      - type
-                    properties:
-                      lastTransitionTime:
-                        type: string
-                        format: date-time
-                      message:
-                        type: string
-                      reason:
-                        type: string
-                      status:
-                        description: Status is one of {"True", "False", "Unknown"}
-                        type: string
-                        enum:
-                          - "True"
-                          - "False"
-                          - Unknown
-                      type:
-                        description: ServiceExportConditionType identifies a specific
-                          condition.
-                        type: string
-                  x-kubernetes-list-map-keys:
-                    - type
-                  x-kubernetes-list-type: map
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceimports.multicluster.x-k8s.io
-spec:
-  group: multicluster.x-k8s.io
-  scope: Namespaced
-  names:
-    plural: serviceimports
-    singular: serviceimport
-    kind: ServiceImport
-    shortNames:
-      - svcim
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      subresources:
-        status: {}
-      additionalPrinterColumns:
-        - name: Type
-          type: string
-          description: The type of this ServiceImport
-          jsonPath: .spec.type
-        - name: IP
-          type: string
-          description: The VIP for this ServiceImport
-          jsonPath: .spec.ips
-        - name: Age
-          type: date
-          jsonPath: .metadata.creationTimestamp
-      "schema":
-        "openAPIV3Schema":
-          description: ServiceImport describes a service imported from clusters in a
-            ClusterSet.
-          type: object
-          properties:
-            apiVersion:
-              description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-              type: string
-            kind:
-              description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-              type: string
-            metadata:
-              type: object
-            spec:
-              description: spec defines the behavior of a ServiceImport.
-              type: object
-              required:
-                - ports
-                - type
-              properties:
-                ips:
-                  description: ip will be used as the VIP for this service when type
-                    is ClusterSetIP.
-                  type: array
-                  maxItems: 1
-                  items:
-                    type: string
-                ports:
-                  type: array
-                  items:
-                    description: ServicePort represents the port on which the service
-                      is exposed
-                    type: object
-                    required:
-                      - port
-                    properties:
-                      appProtocol:
-                        description: The application protocol for this port. This field
-                          follows standard Kubernetes label syntax. Un-prefixed names
-                          are reserved for IANA standard service names (as per RFC-6335
-                          and http://www.iana.org/assignments/service-names). Non-standard
-                          protocols should use prefixed names such as mycompany.com/my-custom-protocol.
-                          Field can be enabled with ServiceAppProtocol feature gate.
-                        type: string
-                      name:
-                        description: The name of this port within the service. This
-                          must be a DNS_LABEL. All ports within a ServiceSpec must have
-                          unique names. When considering the endpoints for a Service,
-                          this must match the 'name' field in the EndpointPort. Optional
-                          if only one ServicePort is defined on this service.
-                        type: string
-                      port:
-                        description: The port that will be exposed by this service.
-                        type: integer
-                        format: int32
-                      protocol:
-                        description: The IP protocol for this port. Supports "TCP",
-                          "UDP", and "SCTP". Default is TCP.
-                        type: string
-                  x-kubernetes-list-type: atomic
-                sessionAffinity:
-                  description: 'Supports "ClientIP" and "None". Used to maintain session
-                  affinity. Enable client IP based session affinity. Must be ClientIP
-                  or None. Defaults to None. Ignored when type is Headless More info:
-                  https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies'
-                  type: string
-                sessionAffinityConfig:
-                  description: sessionAffinityConfig contains session affinity configuration.
-                  type: object
-                  properties:
-                    clientIP:
-                      description: clientIP contains the configurations of Client IP
-                        based session affinity.
-                      type: object
-                      properties:
-                        timeoutSeconds:
-                          description: timeoutSeconds specifies the seconds of ClientIP
-                            type session sticky time. The value must be >0 && <=86400(for
-                            1 day) if ServiceAffinity == "ClientIP". Default value is
-                            10800(for 3 hours).
-                          type: integer
-                          format: int32
-                type:
-                  description: type defines the type of this service. Must be ClusterSetIP
-                    or Headless.
-                  type: string
-                  enum:
-                    - ClusterSetIP
-                    - Headless
-            status:
-              description: status contains information about the exported services that
-                form the multi-cluster service referenced by this ServiceImport.
-              type: object
-              properties:
-                clusters:
-                  description: clusters is the list of exporting clusters from which
-                    this service was derived.
-                  type: array
-                  items:
-                    description: ClusterStatus contains service configuration mapped
-                      to a specific source cluster
-                    type: object
-                    required:
-                      - cluster
-                    properties:
-                      cluster:
-                        description: cluster is the name of the exporting cluster. Must
-                          be a valid RFC-1123 DNS label.
-                        type: string
-                  x-kubernetes-list-map-keys:
-                    - cluster
-                  x-kubernetes-list-type: map

submariner/templates/_helpers.tpl

@@ -36,7 +36,7 @@ Create the name of the submariner-engine service account to use
 */}}
 {{- define "submariner.engineServiceAccountName" -}}
 {{- if .Values.serviceAccounts.engine.create -}}
-    {{ default "submariner-engine" .Values.serviceAccounts.engine.name }}
+    {{ default (printf "%s-engine" (include "submariner.fullname" .)) .Values.serviceAccounts.engine.name }}
 {{- else -}}
     {{ default "default" .Values.serviceAccounts.engine.name }}
 {{- end -}}
@@ -47,7 +47,7 @@ Create the name of the submariner-route-agent service account to use
 */}}
 {{- define "submariner.routeAgentServiceAccountName" -}}
 {{- if .Values.serviceAccounts.routeAgent.create -}}
-    {{ default "submariner-routeagent" .Values.serviceAccounts.routeAgent.name }}
+    {{ default (printf "%s-routeagent" (include "submariner.fullname" .)) .Values.serviceAccounts.routeAgent.name }}
 {{- else -}}
     {{ default "default" .Values.serviceAccounts.routeAgent.name }}
 {{- end -}}
@@ -58,31 +58,20 @@ Create the name of the submariner-globalnet service account to use
 */}}
 {{- define "submariner.globalnetServiceAccountName" -}}
 {{- if .Values.serviceAccounts.globalnet.create -}}
-    {{ default "submariner-globalnet" .Values.serviceAccounts.globalnet.name }}
+    {{ default (printf "%s-globalnet" (include "submariner.fullname" .)) .Values.serviceAccounts.globalnet.name }}
 {{- else -}}
     {{ default "default" .Values.serviceAccounts.globalnet.name }}
 {{- end -}}
 {{- end -}}
 
 {{/*
-Create the name of the submariner-lighthouse-agent service account to use
+Create the name of the submariner-lighthouse service account to use
 */}}
-{{- define "submariner.lighthouseAgentServiceAccountName" -}}
+{{- define "submariner.lighthouseServiceAccountName" -}}
-{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseAgent.create) -}}
+{{- if .Values.submariner.serviceDiscovery -}}
-    {{ default "submariner-lighthouse-agent" .Values.serviceAccounts.lighthouseAgent.name }}
+    {{ default (printf "%s-lighthouse" (include "submariner.fullname" .)) .Values.serviceAccounts.lighthouse.name }}
 {{- else -}}
-    {{ default "default" .Values.serviceAccounts.lighthouseAgent.name }}
+    {{ default "default" .Values.serviceAccounts.lighthouse.name }}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Create the name of the submariner-lighthouse-coredns service account to use
-*/}}
-{{- define "submariner.lighthouseCoreDnsServiceAccountName" -}}
-{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseCoreDns.create) -}}
-    {{ default "submariner-lighthouse-coredns" .Values.serviceAccounts.lighthouseCoreDns.name }}
-{{- else -}}
-    {{ default "default" .Values.serviceAccounts.lighthouseCoreDns.name }}
 {{- end -}}
 {{- end -}}
 

submariner/templates/crd.yaml

@@ -0,0 +1,166 @@
+{{- if .Values.crd.create -}}
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: clusters.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: submariner.io
+  version: v1
+  names:
+    kind: Cluster
+    plural: clusters
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: endpoints.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: submariner.io
+  version: v1
+  names:
+    kind: Endpoint
+    plural: endpoints
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: gateways.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: submariner.io
+  version: v1
+  names:
+    kind: Gateway
+    plural: gateways
+  scope: Namespaced
+  additionalPrinterColumns:
+  - name: ha-status
+    type: string
+    description: High Availability Status of the Gateway
+    JSONPath: .status.haStatus
+---
+{{- if .Values.submariner.serviceDiscovery }}
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: multiclusterservices.lighthouse.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: lighthouse.submariner.io
+  version: v1
+  names:
+    kind: MultiClusterService
+    plural: multiclusterservices
+    singular: multiclusterservice
+  scope: Namespaced
+  validation:
+    openAPIV3Schema:
+      properties:
+        spec:
+          properties:
+            clusterServiceInfo:
+              properties:
+                clusterID:
+                  type: "string"
+                clusterDomain:
+                  type: "string"
+                serviceIP:
+                  type: "string"
+                port:
+                  type: "integer"
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceexports.lighthouse.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: lighthouse.submariner.io
+  version: v2alpha1
+  names:
+    kind: ServiceExport
+    plural: serviceexports
+    singular: serviceexport
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceimports.lighthouse.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: lighthouse.submariner.io
+  version: v2alpha1
+  names:
+    kind: ServiceImport
+    plural: serviceimports
+    singular: serviceimport
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceexports.multicluster.x-k8s.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: multicluster.x-k8s.io
+  scope: Namespaced
+  names:
+    plural: serviceexports
+    singular: serviceexport
+    kind: ServiceExport
+    shortNames:
+      - svcex
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+  additionalPrinterColumns:
+    - name: Age
+      type: date
+      jsonPath: .metadata.creationTimestamp
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceimports.multicluster.x-k8s.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: multicluster.x-k8s.io
+  scope: Namespaced
+  names:
+    plural: serviceimports
+    singular: serviceimport
+    kind: ServiceImport
+    shortNames:
+      - svcim
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+  additionalPrinterColumns:
+    - name: Type
+      type: string
+      description: The type of this ServiceImport
+      jsonPath: .spec.type
+    - name: IP
+      type: string
+      description: The VIP for this ServiceImport
+      jsonPath: .spec.ips
+    - name: Age
+      type: date
+      jsonPath: .metadata.creationTimestamp
+{{- end }}
+{{- end -}}

submariner/templates/engine-deploy.yaml

@@ -108,10 +108,6 @@ spec:
           value: "{{ .Values.leadership.renewDeadline }}"
         - name: LEADERSHIP_RETRYPERIOD
           value: "{{ .Values.leadership.retryPeriod }}"
-        - name: NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: "spec.nodeName"
         image: {{ .Values.engine.image.repository }}:{{ default .Chart.AppVersion .Values.engine.image.tag }}
         imagePullPolicy: {{ .Values.engine.image.pullPolicy }}
         name: submariner

submariner/templates/globalnet.yaml

@@ -29,33 +29,29 @@ spec:
       nodeSelector:
         submariner.io/gateway: 'true'
       containers:
-      - name: {{ template "submariner.fullname" . }}-globalnet
+        - name: {{ template "submariner.fullname" . }}-globalnet
-        image: {{ .Values.globalnet.image.repository }}:{{  default .Chart.AppVersion .Values.globalnet.image.tag }}
+          image: {{ .Values.globalnet.image.repository }}:{{  default .Chart.AppVersion .Values.globalnet.image.tag }}
-        imagePullPolicy: {{ .Values.globalnet.image.pullPolicy }}
+          imagePullPolicy: {{ .Values.globalnet.image.pullPolicy }}
-        env:
+          env:
-          - name: SUBMARINER_CLUSTERID
+            - name: SUBMARINER_CLUSTERID
-            value: '{{ .Values.submariner.clusterId }}'
+              value: '{{ .Values.submariner.clusterId }}'
-          - name: SUBMARINER_EXCLUDENS
+            - name: SUBMARINER_EXCLUDENS
-            value: 'submariner-operator,kube-system,operators,openshift-monitoring,openshift-dns'
+              value: 'submariner-operator,kube-system,operators'
-          - name: SUBMARINER_NAMESPACE
+            - name: SUBMARINER_NAMESPACE
-            value: '{{ .Release.Namespace }}'
+              value: '{{ .Release.Namespace }}'
-          - name: NODE_NAME
+          securityContext:
-            valueFrom:
+            allowPrivilegeEscalation: true
-              fieldRef:
+            capabilities:
-                fieldPath: "spec.nodeName"
+              add:
-        securityContext:
+                - ALL
-          allowPrivilegeEscalation: true
+            privileged: true
-          capabilities:
+            readOnlyRootFilesystem: false
-            add:
+            runAsNonRoot: false
-              - ALL
+          volumeMounts:
-          privileged: true
+            # Because we don't actually run iptables locally, but chroot in to the host
-          readOnlyRootFilesystem: false
+            - mountPath: /host
-          runAsNonRoot: false
+              name: host-slash
-        volumeMounts:
+              readOnly: true
-          # Because we don't actually run iptables locally, but chroot in to the host
-          - mountPath: /host
-            name: host-slash
-            readOnly: true
       volumes:
         - name: host-slash
           hostPath:

submariner/templates/lighthouse-coredns.yaml

@@ -30,7 +30,7 @@ spec:
             - mountPath: /etc/coredns
               name: config-volume
               readOnly: true
-      serviceAccountName: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
+      serviceAccountName: {{ template "submariner.lighthouseServiceAccountName" . }}
       volumes:
         - configMap:
             defaultMode: 420

submariner/templates/lighthouse.yaml

@@ -19,7 +19,7 @@ spec:
       labels:
         app: {{ template "submariner.fullname" . }}-lighthouse-agent
     spec:
-      serviceAccountName: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
+      serviceAccountName: {{ template "submariner.lighthouseServiceAccountName" . }}
       containers:
       - command:
         - lighthouse-agent.sh

submariner/templates/rbac.yaml

@@ -9,93 +9,15 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups:
+- apiGroups: [""]
-      - ""
+  resources: ["configmaps"]
-    resources:
+  verbs: ["create", "get", "list", "watch", "patch", "update"]
-      - pods
+- apiGroups: ["submariner.io"]
-      - services
+  resources: ["clusters", "endpoints", "gateways"]
-      - services/finalizers
+  verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
-      - endpoints
+- apiGroups: [""]
-      - persistentvolumeclaims
+  resources: ["events"]
-      - events
+  verbs: ["create", "patch"]
-      - configmaps
-      - secrets
-    verbs:
-      - '*'
-  - apiGroups:
-      - apps
-    resources:
-      - deployments
-      - daemonsets
-      - replicasets
-      - statefulsets
-    verbs:
-      - '*'
-  - apiGroups:
-      - monitoring.coreos.com
-    resources:
-      - servicemonitors
-    verbs:
-      - get
-      - create
-  - apiGroups:
-      - apps
-    resourceNames:
-      - submariner-operator
-    resources:
-      - deployments/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-    verbs:
-      - get
-  - apiGroups:
-      - apps
-    resources:
-      - replicasets
-    verbs:
-      - get
-  - apiGroups:
-      - submariner.io
-    resources:
-      - '*'
-      - servicediscoveries
-    verbs:
-      - '*'
-  - apiGroups:
-      - lighthouse.submariner.io
-    resources:
-      - '*'
-      - serviceexports
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ template "submariner.fullname" . }}:engine
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ template "submariner.fullname" . }}:engine
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "submariner.engineServiceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -107,353 +29,52 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups:
+- apiGroups: ["submariner.io"]
-      - ""
+  resources: ["clusters", "endpoints", "gateways"]
-    resources:
+  verbs: ["create", "get", "list", "watch", "patch", "update"]
-      - pods
+- apiGroups: [""]
-      - services
+  resources: ["pods"]
-      - services/finalizers
+  verbs: ["get", "watch", "list"]
-      - endpoints
+---
-      - persistentvolumeclaims
+apiVersion: rbac.authorization.k8s.io/v1
-      - events
+kind: RoleBinding
-      - configmaps
+metadata:
-      - secrets
+  name: {{ template "submariner.fullname" . }}:engine
-    verbs:
+roleRef:
-      - '*'
+  apiGroup: rbac.authorization.k8s.io
-  - apiGroups:
+  kind: Role
-      - apps
+  name: {{ template "submariner.fullname" . }}:engine
-    resources:
+subjects:
-      - deployments
+- kind: ServiceAccount
-      - daemonsets
+  name: {{ template "submariner.engineServiceAccountName" . }}
-      - replicasets
+  namespace: {{ .Release.Namespace }}
-      - statefulsets
-    verbs:
-      - '*'
-  - apiGroups:
-      - monitoring.coreos.com
-    resources:
-      - servicemonitors
-    verbs:
-      - get
-      - create
-  - apiGroups:
-      - apps
-    resourceNames:
-      - submariner-operator
-    resources:
-      - deployments/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-    verbs:
-      - get
-  - apiGroups:
-      - apps
-    resources:
-      - replicasets
-    verbs:
-      - get
-  - apiGroups:
-      - submariner.io
-    resources:
-      - '*'
-      - servicediscoveries
-    verbs:
-      - '*'
-  - apiGroups:
-      - lighthouse.submariner.io
-    resources:
-      - '*'
-      - serviceexports
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: {{ template "submariner.fullname" . }}:routeagent
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: {{ template "submariner.fullname" . }}:routeagent
 subjects:
-  - kind: ServiceAccount
+- kind: ServiceAccount
-    name: {{ template "submariner.routeAgentServiceAccountName" . }}
+  name: {{ template "submariner.routeAgentServiceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
+  namespace: {{ .Release.Namespace }}
----
-{{- if ne .Values.submariner.globalCidr "" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ template "submariner.fullname" . }}:globalnet
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-      - services
-      - services/finalizers
-      - endpoints
-      - persistentvolumeclaims
-      - events
-      - configmaps
-      - secrets
-    verbs:
-      - '*'
-  - apiGroups:
-      - apps
-    resources:
-      - deployments
-      - daemonsets
-      - replicasets
-      - statefulsets
-    verbs:
-      - '*'
-  - apiGroups:
-      - monitoring.coreos.com
-    resources:
-      - servicemonitors
-    verbs:
-      - get
-      - create
-  - apiGroups:
-      - apps
-    resourceNames:
-      - submariner-operator
-    resources:
-      - deployments/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-    verbs:
-      - get
-  - apiGroups:
-      - apps
-    resources:
-      - replicasets
-    verbs:
-      - get
-  - apiGroups:
-      - submariner.io
-    resources:
-      - '*'
-      - servicediscoveries
-    verbs:
-      - '*'
-  - apiGroups:
-      - lighthouse.submariner.io
-    resources:
-      - '*'
-      - serviceexports
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ template "submariner.fullname" . }}:globalnet
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ template "submariner.fullname" . }}:globalnet
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "submariner.globalnetServiceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
----
-{{- end -}}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "submariner.fullname" . }}:engine
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-  - apiGroups:
-      - apiextensions.k8s.io
-    resources:
-      - customresourcedefinitions
-    verbs:
-      - get
-      - list
-      - create
-      - update
-      - delete
-  - apiGroups:  # pods and services are looked up to figure out network settings
-      - ""
-    resources:
-      - pods
-      - services
-      - nodes
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - operator.openshift.io
-    resources:
-      - dnses
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - config.openshift.io
-    resources:
-      - networks
-    verbs:
-      - get
-      - list
-  - apiGroups:
-      - submariner.io
-    resources:
-      - endpoints
-      - gateways
-      - clusters
-    verbs:
-      - get
-      - list
-      - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "submariner.fullname" . }}:engine
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "submariner.fullname" . }}:engine
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "submariner.engineServiceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: {{ template "submariner.fullname" . }}:routeagent
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups:
+  - apiGroups: [""]
-      - ""
+    resources: ["nodes"]
-    resources:
+    verbs: ["get", "update"]
-      - configmaps
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - apiextensions.k8s.io
-    resources:
-      - customresourcedefinitions
-    verbs:
-      - get
-      - list
-      - create
-      - update
-      - delete
-  - apiGroups:  # pods and services are looked up to figure out network settings
-      - ""
-    resources:
-      - pods
-      - services
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - operator.openshift.io
-    resources:
-      - dnses
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - config.openshift.io
-    resources:
-      - networks
-    verbs:
-      - get
-      - list
-  - apiGroups:
-      - ""
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-    resources:
-      - nodes
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: {{ template "submariner.fullname" . }}:routeagent
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -468,203 +89,61 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: {{ template "submariner.fullname" . }}:globalnet
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups:
+- apiGroups: [""]
-      - ""
+  resources: ["services", "namespaces", "pods", "nodes"]
-    resources:
+  verbs: ["get", "list", "watch", "update"]
-      - pods
+- apiGroups: ["submariner.io"]
-      - services
+  resources: ["clusters", "endpoints", "gateways"]
-      - namespaces
+  verbs: ["get", "list", "watch"]
-      - nodes
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - submariner.io
-    resources:
-      - endpoints
-      - clusters
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - multicluster.x-k8s.io
-    resources:
-      - "serviceexports"
-    verbs:
-      - get
-      - list
-      - watch
 ---
-{{- end -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: {{ template "submariner.fullname" . }}:globalnet
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: {{ template "submariner.fullname" . }}:globalnet
 subjects:
-  - kind: ServiceAccount
+- kind: ServiceAccount
-    name: {{ template "submariner.globalnetServiceAccountName" . }}
+  name: {{ template "submariner.globalnetServiceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
+  namespace: {{ .Release.Namespace }}
 ---
+{{- end -}}
 {{- if .Values.submariner.serviceDiscovery }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse-agent
+  name: {{ template "submariner.fullname" . }}:lighthouse
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups:
+  - apiGroups: [""]
-      - ""
+    resources: ["services", "namespaces", "configmaps", "endpoints"]
-    resources:
+    verbs: ["get", "list", "watch", "update"]
-      - services
+  - apiGroups: ["discovery.k8s.io"]
-      - namespaces
+    resources: ["endpointslices"]
-      - endpoints
+    verbs: ["create", "get", "list", "watch", "update", "delete", "deletecollection"]
-    verbs:
+  - apiGroups: ["lighthouse.submariner.io"]
-      - get
+    resources: ["*"]
-      - list
+    verbs: ["create", "get", "list", "watch", "update", "delete"]
-      - watch
+  - apiGroups: ["submariner.io"]
-      - update
+    resources: ["gateways"]
-  - apiGroups:
+    verbs: ["get", "list", "watch"]
-      - discovery.k8s.io
+  - apiGroups: ["multicluster.x-k8s.io"]
-    resources:
+    resources: ["*"]
-      - endpointslices
+    verbs: ["create", "get", "list", "watch", "update", "delete"]
-    verbs:
-      - create
-      - get
-      - list
-      - watch
-      - update
-      - delete
-      - deletecollection
-  - apiGroups:
-      - submariner.io
-    resources:
-      - "gateways"
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - multicluster.x-k8s.io
-    resources:
-      - "*"
-    verbs:
-      - create
-      - get
-      - list
-      - watch
-      - update
-      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse-agent
+  name: {{ template "submariner.fullname" . }}:lighthouse
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ template "submariner.fullname" . }}:lighthouse-agent
+  name: {{ template "submariner.fullname" . }}:lighthouse
 subjects:
   - kind: ServiceAccount
-    name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
+    name: {{ template "submariner.lighthouseServiceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - services
-      - namespaces
-      - endpoints
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - discovery.k8s.io
-    resources:
-      - endpointslices
-    verbs:
-      - create
-      - get
-      - list
-      - watch
-      - update
-      - delete
-      - deletecollection
-  - apiGroups:
-      - lighthouse.submariner.io
-    resources:
-      - "*"
-    verbs:
-      - create
-      - get
-      - list
-      - watch
-      - update
-      - delete
-  - apiGroups:
-      - submariner.io
-    resources:
-      - "gateways"
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - multicluster.x-k8s.io
-    resources:
-      - "*"
-    verbs:
-      - create
-      - get
-      - list
-      - watch
-      - update
-      - delete
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
     namespace: {{ .Release.Namespace }}
 {{- end -}}
 {{- end -}}

submariner/templates/route-agent-ds.yaml

@@ -41,14 +41,10 @@ spec:
           value: "{{ .Values.submariner.clusterId }}"
         - name: SUBMARINER_DEBUG
           value: "{{ .Values.submariner.debug }}"
-        - name: SUBMARINER_CLUSTERCIDR
+        - name: SUBMARINER_CLUSTERCIDR                                                                                                                                                        
           value: "{{ .Values.submariner.clusterCidr }}"
         - name: SUBMARINER_SERVICECIDR
           value: "{{ .Values.submariner.serviceCidr }}"
-        - name: NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: "spec.nodeName"
         resources:
 {{ toYaml .Values.routeAgent.resources | indent 10 }}
         securityContext:

submariner/templates/svc-acct.yaml

@@ -34,26 +34,14 @@ metadata:
     app: {{ template "submariner.name" . }}
 {{- end }}
 ---
-{{- if .Values.serviceAccounts.lighthouseAgent.create }}
+{{- if .Values.serviceAccounts.lighthouse.create }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
+  name: {{ template "submariner.lighthouseServiceAccountName" . }}
   labels:
     heritage: {{ .Release.Service | quote }}
     release: {{ .Release.Name | quote }}
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 {{- end }}
----
-{{- if .Values.serviceAccounts.lighthouseCoreDns.create }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-  {{- end }}

submariner/values.yaml

@@ -72,11 +72,8 @@ serviceAccounts:
     create: true
     name: ""
   globalnet:
-    create: true
+    create: false
     name: ""
-  lighthouseAgent:
+  lighthouse:
-    create: true
+    create: false
-    name: ""
-  lighthouseCoreDns:
-    create: true
     name: ""