osb-operators.configmap.upstream.yaml

---
kind: ConfigMap
apiVersion: v1
metadata:
  name: "{{ olm_osb_catalog_name }}"
  namespace: "{{ olm_namespace }}"
data:
  customResourceDefinitions: |-
    - apiVersion: apiextensions.k8s.io/v1beta1
      kind: CustomResourceDefinition
      metadata:
        name: templateservicebrokers.osb.openshift.io
      spec:
        group: osb.openshift.io
        names:
          kind: TemplateServiceBroker
          listKind: TemplateServiceBrokerList
          plural: templateservicebrokers
          singular: templateservicebroker
        scope: Namespaced
        version: v1alpha1
    - apiVersion: apiextensions.k8s.io/v1beta1
      kind: CustomResourceDefinition
      metadata:
        name: automationbrokers.automationbroker.io
      spec:
        group: automationbroker.io
        names:
          kind: AutomationBroker
          listKind: AutomationBrokerList
          plural: automationbrokers
          singular: automationbroker
        scope: Namespaced
        version: v1alpha1
    - apiVersion: apiextensions.k8s.io/v1beta1
      kind: CustomResourceDefinition
      metadata:
        name: bundles.automationbroker.io
      spec:
        group: automationbroker.io
        version: v1alpha1
        scope: Namespaced
        names:
          plural: bundles
          singular: bundle
          kind: Bundle
    - apiVersion: apiextensions.k8s.io/v1beta1
      kind: CustomResourceDefinition
      metadata:
        name: bundlebindings.automationbroker.io
      spec:
        group: automationbroker.io
        version: v1alpha1
        scope: Namespaced
        names:
          plural: bundlebindings
          singular: bundleebinding
          kind: BundleBinding
    - apiVersion: apiextensions.k8s.io/v1beta1
      kind: CustomResourceDefinition
      metadata:
        name: bundleinstances.automationbroker.io
      spec:
        group: automationbroker.io
        version: v1alpha1
        scope: Namespaced
        names:
          plural: bundleinstances
          singular: bundleinstance
          kind: BundleInstance
  clusterServiceVersions: |-
    - apiVersion: operators.coreos.com/v1alpha1
      kind: ClusterServiceVersion
      metadata:
        name: templateservicebrokeroperator.v0.1.0
        namespace: placeholder
      spec:
        displayName: Template Service Broker Operator
        description: Template Service Broker Operator
        keywords: ['template', 'broker', 'open service broker']
        version: 0.1.0
        maturity: alpha
        maintainers:
        - name: Red Hat, Inc.
          email: ansible-service-broker@redhat.com
        provider:
          name: Red Hat, Inc.
        labels:
          alm-status-descriptors: templateservicebrokeroperator.v0.1.0
          operated-by: templateservicebrokeroperator
        selector:
          matchLabels:
            operated-by: templateservicebrokeroperator
        install:
          strategy: deployment
          spec:
            permissions:
            - serviceAccountName: template-service-broker-operator
              rules:
              - apiGroups:
                - ""
                resources:
                - pods
                - configmaps
                - secrets
                - services
                verbs:
                - "*"
              - apiGroups:
                - apps
                resources:
                - deployments
                verbs:
                - "*"
              - apiGroups:
                - apps.openshift.io
                resources:
                - deploymentconfigs
                verbs:
                - "*"
            clusterPermissions:
            - serviceAccountName: template-service-broker-operator
              rules:
              - apiGroups:
                - osb.openshift.io
                resources:
                - templateservicebrokers
                verbs:
                - "*"
              - apiGroups:
                - servicecatalog.k8s.io
                resources:
                - clusterservicebrokers
                - servicebrokers
                verbs:
                - "*"
            - serviceAccountName: template-service-broker-client
              rules:
              - nonResourceURLs:
                - /brokers/template.openshift.io/*
                verbs:
                - delete
                - get
                - put
                - update
            - serviceAccountName: apiserver
              rules:
              - apiGroups:
                - authorization.k8s.io
                resources:
                - subjectaccessreviews
                verbs:
                - create
              - apiGroups:
                - authentication.k8s.io
                resources:
                - tokenreviews
                verbs:
                - create
              - apiGroups:
                - authorization.openshift.io
                resources:
                - subjectaccessreviews
                verbs:
                - create
              - apiGroups:
                - template.openshift.io
                resources:
                - brokertemplateinstances
                verbs:
                - create
                - delete
                - get
                - update
              - apiGroups:
                - template.openshift.io
                resources:
                - brokertemplateinstances/finalizers
                verbs:
                - update
              - apiGroups:
                - template.openshift.io
                resources:
                - templateinstances
                verbs:
                - assign
                - create
                - delete
                - get
              - apiGroups:
                - template.openshift.io
                resources:
                - templates
                verbs:
                - get
                - list
                - watch
              - apiGroups:
                - ""
                resources:
                - secrets
                verbs:
                - create
                - delete
                - get
              - apiGroups:
                - ""
                resources:
                - configmaps
                - services
                verbs:
                - get
              - apiGroups:
                - ""
                resources:
                - routes
                verbs:
                - get
              - apiGroups:
                - route.openshift.io
                resources:
                - routes
                verbs:
                - get
              - apiGroups:
                - ""
                resources:
                - events
                verbs:
                - create
                - patch
                - update
            deployments:
            - name: template-service-broker-operator
              spec:
                replicas: 1
                selector:
                  matchLabels:
                    name: template-service-broker-operator-alm-owned
                template:
                  metadata:
                    name: template-service-broker-operator-alm-owned
                    labels:
                      name: template-service-broker-operator-alm-owned
                  spec:
                    serviceAccountName: template-service-broker-operator
                    containers:
                    - name: template-service-broker-operator
                      image: "{{ olm_tsb_full_image }}"
                      imagePullPolicy: IfNotPresent
        customresourcedefinitions:
          owned:
          - name: templateservicebrokers.osb.openshift.io
            version: v1alpha1
            kind: TemplateServiceBroker
            displayName: Template Service Broker
            description: An Open Service Broker supporting management of OpenShift templates.
    - apiVersion: operators.coreos.com/v1alpha1
      kind: ClusterServiceVersion
      metadata:
        name: automationbrokeroperator.v0.1.0
        namespace: placeholder
      spec:
        displayName: Automation Broker Operator
        description: Automation Broker Operator
        keywords: ['ansible', 'automation', 'broker', 'open service broker']
        version: 0.1.0
        maturity: alpha
        maintainers:
        - name: Red Hat, Inc.
          email: ansible-service-broker@redhat.com
        provider:
          name: Red Hat, Inc.
        labels:
          alm-status-descriptors: automationbrokeroperator.v0.1.0
          operated-by: automationbrokeroperator
        selector:
          matchLabels:
            operated-by: automationbrokeroperator
        install:
          strategy: deployment
          spec:
            permissions:
            - serviceAccountName: automation-broker-operator
              rules:
              - apiGroups:
                - ""
                resources:
                - namespaces
                verbs:
                - get
              - apiGroups:
                - ""
                resources:
                - pods
                - configmaps
                - secrets
                - serviceaccounts
                - services
                verbs:
                - "*"
              - apiGroups:
                - apps
                resources:
                - deployments
                verbs:
                - "*"
              - apiGroups:
                - route.openshift.io
                resources:
                - routes
                verbs:
                - "*"
              - apiGroups:
                - apps.openshift.io
                resources:
                - deploymentconfigs
                verbs:
                - "*"
            - serviceAccountName: automation-broker
              rules:
              - apiGroups:
                - ""
                resources:
                - configmaps
                verbs:
                - get
                - delete
              - apiGroups:
                - ""
                resources:
                - secrets
                verbs:
                - create
                - delete
                - get
              - apiGroups:
                - automationbroker.io
                resources:
                - bundles
                - bundleinstances
                - bundlebindings
                verbs:
                - "*"
            clusterPermissions:
            - serviceAccountName: automation-broker-operator
              rules:
              - apiGroups:
                - servicecatalog.k8s.io
                resources:
                - clusterservicebrokers
                - servicebrokers
                verbs:
                - "*"
              # Must be cluster scoped, since we're expecting a single operator
              # to be installed into a designated namespace, watching the full
              # cluster for CRs.
              - apiGroups:
                - automationbroker.io
                resources:
                - "*"
                verbs:
                - "*"
              ################################################################################
              # This may be required to allow the operator to create an aggregated ClusterRole
              # in order to add the rule that is checked by the broker to edit and/or admin.
              ################################################################################
              - apiGroups:
                - rbac.authorization.k8s.io
                resources:
                - clusterroles
                verbs:
                - create
                - patch
              ################################################################################
              #
              ################################################################################
              # Questionable, could maybe pull these?
              ################################################################################
              #- nonResourceURLs:
              #  - /version/openshift
              #  verbs:
              #  - get
              ##Could maybe try this one with just get?
              #- apiGroups:
              #  - apiextensions.k8s.io
              #  resources:
              #  - customresourcedefinitions
              #  verbs:
              #  - get
              #  - patch
              #  - update
              # OLM should be able to handle these instead of the operator's ansible
              #- apiGroups:
              #  - rbac.authorization.k8s.io
              #  resources:
              #  - clusterrolebindings
              #  - clusterroles
              #  verbs:
              #  - get
              #  - patch
              #  - update
            - serviceAccountName: automation-broker
              rules:
              - apiGroups:
                - ""
                resources:
                - namespaces
                verbs:
                - get
                - create
                - delete
              - apiGroups:
                - ""
                resources:
                - pods
                verbs:
                - create
                - get
                - list
                - watch
              - apiGroups:
                - ""
                resources:
                - serviceaccounts
                verbs:
                - create
              - apiGroups:
                - authentication.k8s.io
                resources:
                - tokenreviews
                verbs:
                - create
              - apiGroups:
                - authorization.k8s.io
                resources:
                - subjectaccessreviews
                verbs:
                - create
              - apiGroups:
                - rbac.authorization.k8s.io
                resources:
                - rolebindings
                verbs:
                - create
                - delete
              # broker must be able to set up a networkpolicy in the target
              # namespace to set up a tunnel between the sandbox and the target
              - apiGroups:
                - networking.k8s.io
                resources:
                - networkpolicies
                verbs:
                - create
                - delete
              - apiGroups:
                - authorization.openshift.io
                resources:
                - subjectrulesreview
                verbs:
                - create
              - apiGroups:
                - image.openshift.io
                - ""
                resources:
                - images
                verbs:
                - get
                - list
              - apiGroups:
                - network.openshift.io
                - ""
                resources:
                - clusternetworks
                - netnamespaces
                verbs:
                - get
              - apiGroups:
                - network.openshift.io
                - ""
                resources:
                - netnamespaces
                verbs:
                - update
            - serviceAccountName: automation-broker-client
              rules:
              - nonResourceURLs:
                - "/osb"
                - "/osb/*"
                verbs:
                - get
                - post
                - put
                - patch
                - delete
            deployments:
            - name: automation-broker-operator
              spec:
                replicas: 1
                selector:
                  matchLabels:
                    name: automation-broker-operator-alm-owned
                template:
                  metadata:
                    name: automation-broker-operator-alm-owned
                    labels:
                      name: automation-broker-operator-alm-owned
                  spec:
                    serviceAccountName: automation-broker-operator
                    containers:
                    - name: automation-broker-operator
                      image: "{{ olm_asb_full_image }}"
                      imagePullPolicy: IfNotPresent
        customresourcedefinitions:
          owned:
          - name: automationbrokers.automationbroker.io
            version: v1alpha1
            kind: AutomationBroker
            displayName: Automation Broker
            description: An Open Service Broker supporting management of application bundles
          - name: bundles.automationbroker.io
            version: v1alpha1
            kind: Bundle
            displayName: Automation Broker Bundle
            description: An application bundle available for deployment via Automation Broker
          - name: bundlebindings.automationbroker.io
            version: v1alpha1
            kind: BundleBinding
            displayName: Automation Broker Bundle Binding
            description: An application bundle binding
          - name: bundleinstances.automationbroker.io
            version: v1alpha1
            kind: BundleInstance
            displayName: Automation Broker Bundle Instance
            description: An instance of an application bundle
  packages: |-
    - packageName: templateservicebroker
      channels:
      - name: alpha
        currentCSV: templateservicebrokeroperator.v0.1.0
    - packageName: automationbroker
      channels:
      - name: alpha
        currentCSV: automationbrokeroperator.v0.1.0