Compare commits

...
13 Commits
Author SHA1 Message Date
Automated ReleaseandSubmariner Bot fd88fcff1d Update Submariner dependencies to v0.19.0-m0
Signed-off-by: Automated Release <release@submariner.io>
2024-06-13 11:36:51 +03:00
Tom Pantelis 6c093ebca2 Adjust globalnet RBAC permissions
Globalnet now annotates Gateways instead of nodes.

Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
2024-06-03 15:03:23 -04:00
dependabot[bot]andThomas Pantelis d3bce36afe Bump actions/checkout from 4.1.4 to 4.1.6 in the github-actions group
Bumps the github-actions group with 1 update: [actions/checkout](https://github.com/actions/checkout).


Updates `actions/checkout` from 4.1.4 to 4.1.6
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/0ad4b8fadaa221de15dcec353f45205ec38ea70b...a5ac7e51b41094c92402da3b24376905380afc29)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
2024-06-03 07:15:07 -04:00
Tom Pantelis 301db56c91 Remove node update RBAC permission for route agent
Re: https://github.com/submariner-io/submariner/pull/3010

Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
2024-05-21 17:56:46 -04:00
Thomas PantelisandGitHub eb336236f3 Add RBAC access to finalizers for the operator role (#515)
On Openshift, the operator failed with error

"\"submariner-gateway\" is forbidden: cannot set blockOwnerDeletion
if an ownerReference refers to a resource you can't set finalizers on"

Openshift enables OwnerReferencesPermissionEnforcement, so
in order to set blockOwnerDeletion for an object, the user needs
update permission for the finalizers subresource of the referenced
owner. In this case the owner is the Submariner object.

Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
2024-05-21 12:28:13 +03:00
Tom PantelisandStephen Kitt 1b251e84cf Reduce lighthouse-agent RBAC permissions
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
2024-05-06 17:46:32 +02:00
Tom PantelisandStephen Kitt f037f15dc0 Reduce lighthouse-coredns RBAC permissions
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
2024-05-06 17:46:32 +02:00
Tom PantelisandStephen Kitt b4720fad02 Reduce submariner-globalnet RBAC permissions
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
2024-05-06 17:46:32 +02:00
Tom PantelisandStephen Kitt 6f632767b3 Reduce submariner-routeagent RBAC permissions
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
2024-05-06 17:46:32 +02:00
Tom PantelisandStephen Kitt ab6d482b9e Reduce submariner-gateway RBAC permissions
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
2024-05-06 17:46:32 +02:00
Tom PantelisandStephen Kitt 01a4312a89 Reduce submariner-operator RBAC permissions
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
2024-05-06 17:46:32 +02:00
Tom PantelisandStephen Kitt ae72e4bb5d Add Makefile.shipyard to .gitignore
Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
2024-05-06 17:46:32 +02:00
dependabot[bot]andThomas Pantelis a6f99ab9cc Bump the github-actions group with 2 updates
Bumps the github-actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [azure/setup-helm](https://github.com/azure/setup-helm).


Updates `actions/checkout` from 4.1.2 to 4.1.4
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/9bb56186c3b09b4f86b1c65136769dd318469633...0ad4b8fadaa221de15dcec353f45205ec38ea70b)

Updates `azure/setup-helm` from 3.5 to 4
- [Release notes](https://github.com/azure/setup-helm/releases)
- [Changelog](https://github.com/Azure/setup-helm/blob/main/CHANGELOG.md)
- [Commits](https://github.com/azure/setup-helm/compare/5119fcb9089d432beecbf79bb2c7915207344b78...fe7b79cd5ee1e45176fcad797de68ecaf3ca4814)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: azure/setup-helm
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
2024-05-01 07:59:15 -04:00
9 changed files with 191 additions and 384 deletions
+1 -1
View File
@@ -26,7 +26,7 @@ jobs:
- k8s_version: '1.26'
steps:
- name: Check out the repository
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
- name: Run E2E deployment and tests
uses: submariner-io/shipyard/gh-actions/e2e@devel
+1 -1
View File
@@ -13,7 +13,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Check out the repository
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
- name: Run E2E deployment and tests
uses: submariner-io/shipyard/gh-actions/e2e@devel
+1 -1
View File
@@ -21,7 +21,7 @@ jobs:
lighthouse: ['', 'lighthouse']
steps:
- name: Check out the repository
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
- name: Run E2E deployment and tests
uses: submariner-io/shipyard/gh-actions/e2e@devel
+7 -7
View File
@@ -38,10 +38,10 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Check out the repository
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
- name: Set up Helm
uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78
uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
with:
version: v3.6.0
@@ -64,7 +64,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Check out the repository
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
with:
fetch-depth: 0
- name: Run gitlint
@@ -75,7 +75,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Check out the repository
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
- name: Run helm-docs and verify docs are up-to-date
run: make helm-docs
@@ -85,7 +85,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Check out the repository
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
- name: Run markdown-link-check
uses: gaurav-nelson/github-action-markdown-link-check@d53a906aa6b22b8979d33bc86170567e619495ec
@@ -99,7 +99,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Check out the repository
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
- name: Run markdownlint
run: make markdownlint
@@ -108,6 +108,6 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Check out the repository
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
- name: Run yamllint
run: make yamllint
+1 -1
View File
@@ -16,7 +16,7 @@ jobs:
issues: write
steps:
- name: Check out the repository
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
- name: Run markdown-link-check
uses: gaurav-nelson/github-action-markdown-link-check@d53a906aa6b22b8979d33bc86170567e619495ec
+1 -1
View File
@@ -16,7 +16,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
with:
fetch-depth: 0
+1
View File
@@ -3,5 +3,6 @@
.shflags
*.tgz
Makefile.dapper
Makefile.shipyard
Dockerfile.*
helm_repo
+1 -1
View File
@@ -17,7 +17,7 @@ endif
export DEPLOYTOOL = helm
GH_URL=https://submariner-io.github.io/submariner-charts/charts
CHARTS_DIR=charts
CHARTS_VERSION=0.18.0-m3
CHARTS_VERSION=0.19.0-m0
HELM_DOCS_VERSION=0.15.0
REPO_URL=$(shell git config remote.origin.url)
+177 -371
View File
@@ -9,62 +9,84 @@ metadata:
chart: {{ template "submariner.chart" . }}
app: {{ template "submariner.name" . }}
rules:
- apiGroups:
- ""
resources:
- pods
- services
- services/finalizers
- endpoints
- persistentvolumeclaims
- events
- configmaps
- secrets
verbs:
- '*'
- apiGroups:
- apps
resources:
- deployments
- daemonsets
- replicasets
- statefulsets
verbs:
- '*'
- apiGroups:
- monitoring.coreos.com
resources:
- servicemonitors
verbs:
- get
- create
- apiGroups:
- apps
resourceNames:
- {{ template "submariner.fullname" . }}
resources:
- deployments/finalizers
verbs:
- update
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- apiGroups:
- apps
resources:
- replicasets
verbs:
- get
- apiGroups:
- submariner.io
resources:
- '*'
- servicediscoveries
verbs:
- '*'
- apiGroups:
- ""
resources:
# For metrics
- services
verbs:
- get
- create
- update
- apiGroups:
- ""
resources:
# Temporarily needed for network-plugin syncer removal
- serviceaccounts
resourceNames:
- submariner-networkplugin-syncer
verbs:
- delete
- apiGroups:
- apps
resources:
- deployments
- daemonsets
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- monitoring.coreos.com
resources:
# Needed for openshift monitoring
- servicemonitors
verbs:
- get
- create
- apiGroups:
- apps
resourceNames:
- {{ template "submariner.fullname" . }}
resources:
- deployments/finalizers
verbs:
- update
- apiGroups:
- submariner.io
resources:
- brokers
- brokers/status
- submariners
- submariners/status
- servicediscoveries
- servicediscoveries/status
verbs:
- get
- list
- watch
- create
- update
- delete
- apiGroups:
- submariner.io
resources:
- gateways
verbs:
- get
- list
- watch
- apiGroups:
- submariner.io
resources:
- submariners/finalizers
- servicediscoveries/finalizers
verbs:
- update
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -93,86 +115,38 @@ metadata:
chart: {{ template "submariner.chart" . }}
app: {{ template "submariner.name" . }}
rules:
- apiGroups:
- ""
resources:
- pods
- services
- services/finalizers
- endpoints
- persistentvolumeclaims
- events
- configmaps
- secrets
verbs:
- '*'
- apiGroups:
- apps
resources:
- deployments
- daemonsets
- replicasets
- statefulsets
verbs:
- '*'
- apiGroups:
- monitoring.coreos.com
resources:
- servicemonitors
verbs:
- get
- create
- apiGroups:
- apps
resourceNames:
- submariner-operator
resources:
- deployments/finalizers
verbs:
- update
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- apiGroups:
- apps
resources:
- replicasets
verbs:
- get
- apiGroups:
- submariner.io
resources:
- '*'
- servicediscoveries
verbs:
- '*'
- apiGroups:
- lighthouse.submariner.io
resources:
- '*'
- serviceexports
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- get
- list
- watch
- create
- update
- delete
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- update
- patch
- apiGroups:
- submariner.io
resources:
- clusters
- endpoints
- gateways
verbs:
- get
- list
- watch
- create
- update
- delete
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- get
- list
- watch
- create
- update
- delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
@@ -203,74 +177,25 @@ metadata:
app: {{ template "submariner.name" . }}
rules:
- apiGroups:
- ""
- submariner.io
resources:
- pods
- services
- services/finalizers
- endpoints
- persistentvolumeclaims
- events
- configmaps
- secrets
verbs:
- '*'
- apiGroups:
- apps
resources:
- deployments
- daemonsets
- replicasets
- statefulsets
verbs:
- '*'
- apiGroups:
- monitoring.coreos.com
resources:
- servicemonitors
verbs:
- get
- create
- apiGroups:
- apps
resourceNames:
- submariner-operator
resources:
- deployments/finalizers
verbs:
- update
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- apiGroups:
- apps
resources:
- replicasets
verbs:
- get
- list
- watch
- apiGroups:
- submariner.io
resources:
- '*'
- servicediscoveries
- gatewayroutes
- nongatewayroutes
verbs:
- '*'
- apiGroups:
- lighthouse.submariner.io
resources:
- '*'
- serviceexports
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- create
- update
- delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
@@ -301,75 +226,15 @@ metadata:
chart: {{ template "submariner.chart" . }}
app: {{ template "submariner.name" . }}
rules:
- apiGroups:
- ""
resources:
- pods
- services
- services/finalizers
- endpoints
- persistentvolumeclaims
- events
- configmaps
- secrets
verbs:
- '*'
- apiGroups:
- apps
resources:
- deployments
- daemonsets
- replicasets
- statefulsets
verbs:
- '*'
- apiGroups:
- monitoring.coreos.com
resources:
- servicemonitors
verbs:
- get
- create
- apiGroups:
- apps
resourceNames:
- submariner-operator
resources:
- deployments/finalizers
verbs:
- update
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- apiGroups:
- apps
resources:
- replicasets
verbs:
- get
- apiGroups:
- submariner.io
resources:
- '*'
- servicediscoveries
- gateways
verbs:
- '*'
- apiGroups:
- lighthouse.submariner.io
resources:
- '*'
- serviceexports
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- update
- apiGroups:
- coordination.k8s.io
resources:
@@ -435,9 +300,10 @@ rules:
- update
- delete
- watch
- apiGroups: # pods, services and nodes are looked up to figure out network settings
- apiGroups:
- ""
resources:
# Needed for network settings discovery
- pods
- services
- nodes
@@ -451,27 +317,20 @@ rules:
- dnses
verbs:
- get
- list
- watch
- update
- apiGroups:
- config.openshift.io
resources:
# Needed for network settings discovery
- networks
resourceNames:
- cluster
verbs:
- get
- list
- apiGroups:
- ""
resources:
- namespaces
verbs:
- get
- list
- watch
- apiGroups:
- monitoring.coreos.com
resources:
# Needed for openshift monitoring
- servicemonitors
verbs:
- get
@@ -479,11 +338,21 @@ rules:
- apiGroups:
- apps
resources:
# Needed for Flannel CNI discovery
- daemonsets
verbs:
- get
- list
- watch
- apiGroups:
- rbac.authorization.k8s.io
resources:
# Temporarily needed for network-plugin syncer removal
- clusterroles
- clusterrolebindings
resourceNames:
- ocp-submariner-networkplugin-syncer
- submariner-networkplugin-syncer
verbs:
- delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
@@ -542,21 +411,7 @@ rules:
- configmaps
verbs:
- get
- list
- watch
- create
- update
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- create
- update
- delete
- apiGroups: # pods and services are looked up to figure out network settings
- ""
resources:
- pods
@@ -566,32 +421,6 @@ rules:
- get
- list
- watch
- apiGroups:
- operator.openshift.io
resources:
- dnses
verbs:
- get
- list
- watch
- update
- apiGroups:
- config.openshift.io
resources:
- networks
verbs:
- get
- list
- apiGroups:
- submariner.io
resources:
- endpoints
- gateways
- clusters
verbs:
- get
- list
- watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
@@ -623,57 +452,41 @@ metadata:
rules:
- apiGroups:
- ""
resources:
- configmaps
verbs:
- get
- list
- watch
- update
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- create
- update
- delete
- apiGroups: # pods and services are looked up to figure out network settings
- ""
resources:
- pods
- services
- secrets
- configmaps
- endpoints
verbs:
- get
- list
- watch
- apiGroups:
- operator.openshift.io
resources:
- dnses
verbs:
- get
- list
- watch
- update
- apiGroups:
- config.openshift.io
resources:
- networks
resourceNames:
- cluster
verbs:
- get
- list
- apiGroups:
- ""
resources:
- nodes
verbs:
- get
- list
- watch
- update
- apiGroups:
- projectcalico.org
resources:
- nodes
- ippools
verbs:
- get
- create
- delete
- update
- deletecollection
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
@@ -708,13 +521,10 @@ rules:
- ""
resources:
- pods
- namespaces
- nodes
verbs:
- get
- list
- watch
- update
- apiGroups:
- ""
resources:
@@ -730,8 +540,8 @@ rules:
- apiGroups:
- submariner.io
resources:
- endpoints
- clusters
- endpoints
verbs:
- get
- list
@@ -756,7 +566,7 @@ rules:
- apiGroups:
- multicluster.x-k8s.io
resources:
- "serviceexports"
- serviceexports
verbs:
- get
- list
@@ -811,7 +621,6 @@ rules:
- get
- list
- watch
- update
- apiGroups:
- discovery.k8s.io
resources:
@@ -828,8 +637,8 @@ rules:
- apiGroups:
- submariner.io
resources:
- "gateways"
- "globalingressips"
- gateways
- globalingressips
verbs:
- get
- list
@@ -837,7 +646,8 @@ rules:
- apiGroups:
- multicluster.x-k8s.io
resources:
- "*"
- serviceimports
- serviceimports/status
verbs:
- create
- get
@@ -845,6 +655,20 @@ rules:
- watch
- update
- delete
- apiGroups:
- multicluster.x-k8s.io
resources:
- serviceexports
verbs:
- get
- list
- watch
- apiGroups:
- multicluster.x-k8s.io
resources:
- serviceexports/status
verbs:
- update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
@@ -869,34 +693,19 @@ kind: ClusterRole
metadata:
name: {{ template "submariner.fullname" . }}:lighthouse-coredns
rules:
- apiGroups:
- ""
resources:
- services
- namespaces
- endpoints
verbs:
- get
- list
- watch
- update
- apiGroups:
- discovery.k8s.io
resources:
- endpointslices
verbs:
- create
- get
- list
- watch
- update
- delete
- deletecollection
- apiGroups:
- submariner.io
resources:
- "gateways"
- "submariners"
- gateways
- submariners
verbs:
- get
- list
@@ -904,14 +713,11 @@ rules:
- apiGroups:
- multicluster.x-k8s.io
resources:
- "*"
- serviceimports
verbs:
- create
- get
- list
- watch
- update
- delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding