Support Separation of duties

Makefile

@@ -188,7 +188,7 @@ bundle-manifests:
 
 generate-all: manifests kustomize operator-sdk ## Generate bundle manifests, metadata and package manifests
 	$(OPERATOR_SDK) generate kustomize manifests -q
-	- make bundle-manifests CHANNELS=v3.20 DEFAULT_CHANNEL=v3.20
+	- make bundle-manifests CHANNELS=v4.0 DEFAULT_CHANNEL=v4.0
 
 ##@ Test
 

README.md

@@ -17,6 +17,7 @@
     - [Troubleshooting](#troubleshooting)
     - [Running Tests](#running-tests)
     - [Development](#development)
+  - [SecurityContextConstraints Requirements](#securitycontextconstraints-requirements)
 
 <!-- END doctoc generated TOC please keep comment here to allow auto update -->
 

api/v1alpha1/operandregistry_types.go

@@ -42,10 +42,14 @@ type Operator struct {
 	// - "cluster": operator is deployed in "openshift-operators" namespace;
 	// +optional
 	InstallMode string `json:"installMode,omitempty"`
-	// The namespace in which operator CR should be deployed.
-	// Also the namespace in which operator should be deployed when InstallMode is empty or set to "namespace".
+	// The namespace in which operator should be deployed when InstallMode is empty or set to "namespace".
+	// If the namespace is not set, the operator namespace is the same as OperandRegistry Namespace
 	// +optional
 	Namespace string `json:"namespace,omitempty"`
+	// The namespace in which operator CR should be deployed.
+	// If the namespace is not set, the operator CR namespace is the same as OperandRegistry Namespace
+	// +optional
+	ServiceNamespace string `json:"serviceNamespace,omitempty"`
 	// Name of a CatalogSource that defines where and how to find the channel.
 	SourceName string `json:"sourceName,omitempty"`
 	// The Kubernetes namespace where the CatalogSource used is located.

bundle.Dockerfile

@@ -5,9 +5,9 @@ LABEL operators.operatorframework.io.bundle.mediatype.v1=registry+v1
 LABEL operators.operatorframework.io.bundle.manifests.v1=manifests/
 LABEL operators.operatorframework.io.bundle.metadata.v1=metadata/
 LABEL operators.operatorframework.io.bundle.package.v1=ibm-odlm
-LABEL operators.operatorframework.io.bundle.channels.v1=v3
-LABEL operators.operatorframework.io.bundle.channel.default.v1=v3
-LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.10.0+git
+LABEL operators.operatorframework.io.bundle.channels.v1=v4.0
+LABEL operators.operatorframework.io.bundle.channel.default.v1=v4.0
+LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.24.0
 LABEL operators.operatorframework.io.metrics.mediatype.v1=metrics+v1
 LABEL operators.operatorframework.io.metrics.project_layout=go.kubebuilder.io/v3
 

bundle/manifests/operand-deployment-lifecycle-manager.clusterserviceversion.yaml

@@ -107,7 +107,7 @@ metadata:
     description: The Operand Deployment Lifecycle Manager provides a Kubernetes CRD-based
       API to manage the lifecycle of operands.
     olm.skipRange: '>=1.2.0 <2.0.0'
-    operators.operatorframework.io/builder: operator-sdk-v1.11.0+git
+    operators.operatorframework.io/builder: operator-sdk-v1.24.0
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v3
     repository: https://github.com/IBM/operand-deployment-lifecycle-manager
     support: IBM
@@ -535,7 +535,11 @@ spec:
   install:
     spec:
       deployments:
-      - name: operand-deployment-lifecycle-manager
+      - label:
+          app.kubernetes.io/instance: operand-deployment-lifecycle-manager
+          app.kubernetes.io/managed-by: operand-deployment-lifecycle-manager
+          app.kubernetes.io/name: operand-deployment-lifecycle-manager
+        name: operand-deployment-lifecycle-manager
         spec:
           replicas: 1
           selector:
@@ -580,7 +584,6 @@ spec:
                 - name: WATCH_NAMESPACE
                   valueFrom:
                     fieldRef:
-                      apiVersion: v1
                       fieldPath: metadata.annotations['olm.targetNamespaces']
                 image: icr.io/cpopen/odlm:latest
                 imagePullPolicy: Always

bundle/manifests/operator.ibm.com_operandregistries.yaml

@@ -79,9 +79,8 @@ spec:
                         be deployed.
                       type: string
                     namespace:
-                      description: The namespace in which operator CR should be deployed.
-                        Also the namespace in which operator should be deployed when
-                        InstallMode is empty or set to "namespace".
+                      description: The namespace in which operator should be deployed
+                        when InstallMode is empty or set to "namespace".
                       type: string
                     packageName:
                       description: Name of the package that defines the applications.
@@ -95,6 +94,9 @@ spec:
                       - public
                       - private
                       type: string
+                    serviceNamespace:
+                      description: The namespace in which operator CR should be deployed.
+                      type: string
                     sourceName:
                       description: Name of a CatalogSource that defines where and
                         how to find the channel.

bundle/metadata/annotations.yaml

@@ -6,7 +6,7 @@ annotations:
   operators.operatorframework.io.bundle.package.v1: ibm-odlm
   operators.operatorframework.io.bundle.channels.v1: v4.0
   operators.operatorframework.io.bundle.channel.default.v1: v4.0
-  operators.operatorframework.io.metrics.builder: operator-sdk-v1.10.0+git
+  operators.operatorframework.io.metrics.builder: operator-sdk-v1.24.0
   operators.operatorframework.io.metrics.mediatype.v1: metrics+v1
   operators.operatorframework.io.metrics.project_layout: go.kubebuilder.io/v3
 

bundle/tests/scorecard/config.yaml

@@ -12,24 +12,39 @@ stages:
     labels:
       suite: basic
       test: basic-check-spec-test
+    storage:
+      spec:
+        mountPath: {}
   - entrypoint:
     - scorecard-test
     - olm-bundle-validation
     image: quay.io/operator-framework/scorecard-test:master
     labels:
       suite: olm
       test: olm-bundle-validation-test
+    storage:
+      spec:
+        mountPath: {}
   - entrypoint:
     - scorecard-test
     - olm-crds-have-validation
     image: quay.io/operator-framework/scorecard-test:master
     labels:
       suite: olm
       test: olm-crds-have-validation-test
+    storage:
+      spec:
+        mountPath: {}
   - entrypoint:
     - scorecard-test
     - olm-spec-descriptors
     image: quay.io/operator-framework/scorecard-test:master
     labels:
       suite: olm
       test: olm-spec-descriptors-test
+    storage:
+      spec:
+        mountPath: {}
+storage:
+  spec:
+    mountPath: {}

config/crd/bases/operator.ibm.com_operandregistries.yaml

@@ -77,9 +77,8 @@ spec:
                         be deployed.
                       type: string
                     namespace:
-                      description: The namespace in which operator CR should be deployed.
-                        Also the namespace in which operator should be deployed when
-                        InstallMode is empty or set to "namespace".
+                      description: The namespace in which operator should be deployed
+                        when InstallMode is empty or set to "namespace".
                       type: string
                     packageName:
                       description: Name of the package that defines the applications.
@@ -93,6 +92,9 @@ spec:
                       - public
                       - private
                       type: string
+                    serviceNamespace:
+                      description: The namespace in which operator CR should be deployed.
+                      type: string
                     sourceName:
                       description: Name of a CatalogSource that defines where and
                         how to find the channel.

config/e2e/crd/bases/operator.ibm.com_operandregistries.yaml

@@ -51,7 +51,6 @@ spec:
           metadata:
             type: object
           spec:
-            x-kubernetes-preserve-unknown-fields: true
             description: OperandRegistrySpec defines the desired state of OperandRegistry.
             properties:
               operators:
@@ -82,9 +81,8 @@ spec:
                         be deployed.
                       type: string
                     namespace:
-                      description: The namespace in which operator CR should be deployed.
-                        Also the namespace in which operator should be deployed when
-                        InstallMode is empty or set to "namespace".
+                      description: The namespace in which operator should be deployed
+                        when InstallMode is empty or set to "namespace".
                       type: string
                     packageName:
                       description: Name of the package that defines the applications.
@@ -98,6 +96,9 @@ spec:
                       - public
                       - private
                       type: string
+                    serviceNamespace:
+                      description: The namespace in which operator CR should be deployed.
+                      type: string
                     sourceName:
                       description: Name of a CatalogSource that defines where and
                         how to find the channel.
@@ -2040,6 +2041,7 @@ spec:
                   type: object
                 type: array
             type: object
+            x-kubernetes-preserve-unknown-fields: true
           status:
             description: OperandRegistryStatus defines the observed state of OperandRegistry.
             properties:

controllers/operandbindinfo/operandbindinfo_controller.go

@@ -124,8 +124,8 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (_ ctrl.Re
 
 	// Fetch the OperandRegistry instance
 	registryKey := bindInfoInstance.GetRegistryKey()
-	registryInstance := &operatorv1alpha1.OperandRegistry{}
-	if err := r.Client.Get(ctx, registryKey, registryInstance); err != nil {
+	registryInstance, err := r.GetOperandRegistry(ctx, registryKey)
+	if err != nil {
 		if apierrors.IsNotFound(err) {
 			klog.Errorf("failed to find OperandRegistry from the NamespacedName %s: %v", registryKey.String(), err)
 			r.Recorder.Eventf(bindInfoInstance, corev1.EventTypeWarning, "NotFound", "NotFound OperandRegistry from the NamespacedName %s", registryKey.String())
@@ -147,7 +147,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (_ ctrl.Re
 		r.Recorder.Eventf(bindInfoInstance, corev1.EventTypeWarning, "NotFound", "NotFound operator %s in the OperandRegistry %s", bindInfoInstance.Spec.Operand, registryInstance.Name)
 		return ctrl.Result{}, nil
 	}
-	operandNamespace := operandOperator.Namespace
+	operandNamespace := operandOperator.ServiceNamespace
 
 	// If Secret or ConfigMap not found, reconcile will requeue after 1 min
 	var requeue bool

controllers/operandbindinfo/operandbindinfo_controller_test.go

@@ -75,13 +75,13 @@ var _ = Describe("OperandBindInfo controller", func() {
 		bindInfo = testutil.OperandBindInfoObj(name, namespaceName, registryName, registryNamespaceName)
 		bindInfoKey = types.NamespacedName{Name: name, Namespace: namespaceName}
 
-		secret1 = testutil.SecretObj("secret1", namespaceName)
-		secret2 = testutil.SecretObj("secret2", namespaceName)
-		secret3 = testutil.SecretObj("secret3", namespaceName)
+		secret1 = testutil.SecretObj("secret1", registryNamespaceName)
+		secret2 = testutil.SecretObj("secret2", registryNamespaceName)
+		secret3 = testutil.SecretObj("secret3", registryNamespaceName)
 		secret4 = testutil.SecretObj("secret4", requestNamespaceName)
-		configmap1 = testutil.ConfigmapObj("cm1", namespaceName)
-		configmap2 = testutil.ConfigmapObj("cm2", namespaceName)
-		configmap3 = testutil.ConfigmapObj("cm3", namespaceName)
+		configmap1 = testutil.ConfigmapObj("cm1", registryNamespaceName)
+		configmap2 = testutil.ConfigmapObj("cm2", registryNamespaceName)
+		configmap3 = testutil.ConfigmapObj("cm3", registryNamespaceName)
 		configmap4 = testutil.ConfigmapObj("cm4", requestNamespaceName)
 		secret4Key = types.NamespacedName{Name: "secret4", Namespace: requestNamespaceName}
 		cm4Key = types.NamespacedName{Name: "cm4", Namespace: requestNamespaceName}

controllers/operandconfig/operandconfig_controller.go

@@ -182,7 +182,7 @@ func (r *Reconciler) updateStatus(ctx context.Context, instance *operatorv1alpha
 			k8sAPIVersion := resource.APIVersion
 			k8sKind := resource.Kind
 			k8sName := resource.Name
-			k8sNamespace := op.Namespace
+			k8sNamespace := op.ServiceNamespace
 			if resource.Namespace != "" {
 				k8sNamespace = resource.Namespace
 			}
@@ -247,7 +247,7 @@ func (r *Reconciler) updateStatus(ctx context.Context, instance *operatorv1alpha
 
 			getError := r.Client.Get(ctx, types.NamespacedName{
 				Name:      name,
-				Namespace: op.Namespace,
+				Namespace: op.ServiceNamespace,
 			}, &unstruct)
 
 			if getError != nil && !apierrors.IsNotFound(getError) {

controllers/operandrequest/operandrequest_controller_test.go

@@ -308,14 +308,14 @@ var _ = Describe("OperandRegistry controller", func() {
 			By("Checking of the CR of the etcd operator")
 			Eventually(func() error {
 				etcdCluster := &v1beta2.EtcdCluster{}
-				err := k8sClient.Get(context.TODO(), types.NamespacedName{Name: "example", Namespace: operatorNamespaceName}, etcdCluster)
+				err := k8sClient.Get(context.TODO(), types.NamespacedName{Name: "example", Namespace: registryNamespaceName}, etcdCluster)
 				return err
 			}, testutil.Timeout, testutil.Interval).Should(Succeed())
 
 			By("Checking of the k8s resource of the etcd operator")
 			Eventually(func() error {
 				etcdConfigMap := &corev1.ConfigMap{}
-				err := k8sClient.Get(context.TODO(), types.NamespacedName{Name: "fake-configmap", Namespace: operatorNamespaceName}, etcdConfigMap)
+				err := k8sClient.Get(context.TODO(), types.NamespacedName{Name: "fake-configmap", Namespace: registryNamespaceName}, etcdConfigMap)
 				return err
 			}, testutil.Timeout, testutil.Interval).Should(Succeed())
 
@@ -328,7 +328,7 @@ var _ = Describe("OperandRegistry controller", func() {
 			}, testutil.Timeout, testutil.Interval).Should(Succeed())
 			Eventually(func() error {
 				etcdCluster := &v1beta2.EtcdCluster{}
-				err := k8sClient.Get(context.TODO(), types.NamespacedName{Name: "example", Namespace: operatorNamespaceName}, etcdCluster)
+				err := k8sClient.Get(context.TODO(), types.NamespacedName{Name: "example", Namespace: registryNamespaceName}, etcdCluster)
 				return err
 			}, testutil.Timeout, testutil.Interval).Should(Succeed())
 
@@ -341,7 +341,7 @@ var _ = Describe("OperandRegistry controller", func() {
 			}, testutil.Timeout, testutil.Interval).Should(Succeed())
 			Eventually(func() bool {
 				etcdCluster := &v1beta2.EtcdCluster{}
-				err := k8sClient.Get(context.TODO(), types.NamespacedName{Name: "example", Namespace: operatorNamespaceName}, etcdCluster)
+				err := k8sClient.Get(context.TODO(), types.NamespacedName{Name: "example", Namespace: registryNamespaceName}, etcdCluster)
 				return err != nil && errors.IsNotFound(err)
 			}, testutil.Timeout, testutil.Interval).Should(BeTrue())
 
@@ -361,7 +361,7 @@ var _ = Describe("OperandRegistry controller", func() {
 			By("Checking the k8s resource has been deleted")
 			Eventually(func() bool {
 				etcdConfigMap := &corev1.ConfigMap{}
-				err := k8sClient.Get(context.TODO(), types.NamespacedName{Name: "fake-configmap", Namespace: operatorNamespaceName}, etcdConfigMap)
+				err := k8sClient.Get(context.TODO(), types.NamespacedName{Name: "fake-configmap", Namespace: registryNamespaceName}, etcdConfigMap)
 				return err != nil && errors.IsNotFound(err)
 			}, testutil.Timeout, testutil.Interval).Should(BeTrue())
 

controllers/operandrequest/reconcile_operand.go

@@ -185,7 +185,7 @@ func (r *Reconciler) reconcileOperand(ctx context.Context, requestInstance *oper
 						klog.V(2).Infof("There is no service: %s from the OperandConfig instance: %s/%s, Skip creating CR for it", operand.Name, req.RegistryNamespace, req.Registry)
 						continue
 					}
-					err = r.reconcileCRwithConfig(ctx, opdConfig, opdRegistry.Namespace, csv)
+					err = r.reconcileCRwithConfig(ctx, opdConfig, opdRegistry.ServiceNamespace, csv)
 					if err != nil {
 						merr.Add(err)
 						requestInstance.SetMemberStatus(operand.Name, "", operatorv1alpha1.ServiceFailed, &r.Mutex)

controllers/operandrequest/reconcile_operator.go

@@ -343,11 +343,11 @@ func (r *Reconciler) deleteSubscription(ctx context.Context, operandName string,
 
 	if csv != nil {
 		klog.V(2).Infof("Deleting all the Custom Resources for CSV, Namespace: %s, Name: %s", csv.Namespace, csv.Name)
-		if err := r.deleteAllCustomResource(ctx, csv, requestInstance, configInstance, operandName, op.Namespace); err != nil {
+		if err := r.deleteAllCustomResource(ctx, csv, requestInstance, configInstance, operandName, op.ServiceNamespace); err != nil {
 			return err
 		}
 		klog.V(2).Infof("Deleting all the k8s Resources for CSV, Namespace: %s, Name: %s", csv.Namespace, csv.Name)
-		if err := r.deleteAllK8sResource(ctx, configInstance, operandName, op.Namespace); err != nil {
+		if err := r.deleteAllK8sResource(ctx, configInstance, operandName, op.ServiceNamespace); err != nil {
 			return err
 		}
 		if r.checkUninstallLabel(ctx, op.Name, namespace) {

controllers/operator/manager.go

@@ -83,6 +83,12 @@ func (m *ODLMOperator) GetOperandRegistry(ctx context.Context, key types.Namespa
 		if o.InstallPlanApproval == "" {
 			reg.Spec.Operators[i].InstallPlanApproval = olmv1alpha1.ApprovalAutomatic
 		}
+		if o.Namespace == "" {
+			reg.Spec.Operators[i].Namespace = key.Namespace
+		}
+		if o.ServiceNamespace == "" {
+			reg.Spec.Operators[i].ServiceNamespace = key.Namespace
+		}
 		if o.SourceName == "" || o.SourceNamespace == "" {
 			catalogSourceName, catalogSourceNs, err := m.GetCatalogSourceFromPackage(ctx, o.PackageName, o.Namespace, o.Channel, key.Namespace, excludedCatalogSources)
 			if err != nil {

controllers/testutil/test_util.go

@@ -81,6 +81,7 @@ func OperandRegistryObj(name, namespace, subNamespace string) *apiv1alpha1.Opera
 					PackageName:     "etcd",
 					Channel:         "singlenamespace-alpha",
 					Scope:           "public",
+					// ServiceNamespace: namespace,
 				},
 				{
 					Name:            "jenkins",
@@ -90,6 +91,7 @@ func OperandRegistryObj(name, namespace, subNamespace string) *apiv1alpha1.Opera
 					PackageName:     "jenkins-operator",
 					Channel:         "alpha",
 					Scope:           "public",
+					// ServiceNamespace: namespace,
 				},
 			},
 		},
@@ -114,6 +116,7 @@ func OperandRegistryObjwithCfg(name, namespace, subNamespace string) *apiv1alpha
 					Channel:            "singlenamespace-alpha",
 					Scope:              "public",
 					SubscriptionConfig: SubConfig,
+					// ServiceNamespace:   namespace,
 				},
 				{
 					Name:            "jenkins",
@@ -123,6 +126,7 @@ func OperandRegistryObjwithCfg(name, namespace, subNamespace string) *apiv1alpha
 					PackageName:     "jenkins-operator",
 					Channel:         "alpha",
 					Scope:           "public",
+					// ServiceNamespace: namespace,
 				},
 			},
 		},

docs/design/create-cr-by-operandrequest.md

@@ -1,3 +1,12 @@
+<!-- START doctoc generated TOC please keep comment here to allow auto update -->
+<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
+**Table of Contents**  *generated with [DocToc](https://github.com/thlorenz/doctoc)*
+
+- [Create Custom Resource by OperandRequest](#create-custom-resource-by-operandrequest)
+  - [How to create Custom Resource by OperandRequest](#how-to-create-custom-resource-by-operandrequest)
+
+<!-- END doctoc generated TOC please keep comment here to allow auto update -->
+
 # Create Custom Resource by OperandRequest
 
 Using OperandConfig can apply a default custom resource according to the alm-example in the CSV, which provides convenience to users using a template to customize their own custom resource.