Merge pull request #1796 from deads2k/by-gate-10-random-stragglers

update the last manifests used directly from this image to featuregate generation

authorization/v1/0000_03_authorization-openshift_01_rolebindingrestriction.crd.yaml

@@ -3,6 +3,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.openshift.io: https://github.com/openshift/api/pull/470
+    api.openshift.io/merged-by-featuregates: "true"
     include.release.openshift.io/ibm-cloud-managed: "true"
     include.release.openshift.io/self-managed-high-availability: "true"
     include.release.openshift.io/single-node-developer: "true"

authorization/v1/types.go

@@ -532,6 +532,10 @@ type ClusterRoleList struct {
 // a subject, rolebindings on that subject in the namespace are allowed.
 //
 // Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+// +kubebuilder:object:root=true
+// +kubebuilder:resource:path=rolebindingrestrictions,scope=Namespaced
+// +openshift:api-approved.openshift.io=https://github.com/openshift/api/pull/470
+// +openshift:file-pattern=0000_03_authorization-openshift_01_rolebindingrestrictionMARKERS.crd.yaml
 // +openshift:compatibility-gen:level=1
 type RoleBindingRestriction struct {
 	metav1.TypeMeta `json:",inline"`

authorization/v1/zz_generated.featuregated-crd-manifests.yaml

@@ -0,0 +1,19 @@
+rolebindingrestrictions.authorization.openshift.io:
+  Annotations: {}
+  ApprovedPRNumber: https://github.com/openshift/api/pull/470
+  CRDName: rolebindingrestrictions.authorization.openshift.io
+  Capability: ""
+  Category: ""
+  FeatureGates: []
+  GroupName: authorization.openshift.io
+  HasStatus: false
+  KindName: RoleBindingRestriction
+  Labels: {}
+  PluralName: rolebindingrestrictions
+  PrinterColumns: []
+  Scope: Namespaced
+  ShortNames: null
+  TargetFilenamePattern: 0000_03_authorization-openshift_01_rolebindingrestrictionMARKERS.crd.yaml
+  TopLevelFeatureGates: []
+  Version: v1
+

authorization/v1/zz_generated.featuregated-crd-manifests/rolebindingrestrictions.authorization.openshift.io/AAA_ungated.yaml

@@ -0,0 +1,214 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    api-approved.openshift.io: https://github.com/openshift/api/pull/470
+    api.openshift.io/filename-pattern: 0000_03_authorization-openshift_01_rolebindingrestrictionMARKERS.crd.yaml
+    feature-gate.release.openshift.io/: "true"
+  name: rolebindingrestrictions.authorization.openshift.io
+spec:
+  group: authorization.openshift.io
+  names:
+    kind: RoleBindingRestriction
+    listKind: RoleBindingRestrictionList
+    plural: rolebindingrestrictions
+    singular: rolebindingrestriction
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: "RoleBindingRestriction is an object that can be matched against
+          a subject (user, group, or service account) to determine whether rolebindings
+          on that subject are allowed in the namespace to which the RoleBindingRestriction
+          belongs.  If any one of those RoleBindingRestriction objects matches a subject,
+          rolebindings on that subject in the namespace are allowed. \n Compatibility
+          level 1: Stable within a major release for a minimum of 12 months or 3 minor
+          releases (whichever is longer)."
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Spec defines the matcher.
+            properties:
+              grouprestriction:
+                description: GroupRestriction matches against group subjects.
+                nullable: true
+                properties:
+                  groups:
+                    description: Groups is a list of groups used to match against
+                      an individual user's groups. If the user is a member of one
+                      of the whitelisted groups, the user is allowed to be bound to
+                      a role.
+                    items:
+                      type: string
+                    nullable: true
+                    type: array
+                  labels:
+                    description: Selectors specifies a list of label selectors over
+                      group labels.
+                    items:
+                      description: A label selector is a label query over a set of
+                        resources. The result of matchLabels and matchExpressions
+                        are ANDed. An empty label selector matches all objects. A
+                        null label selector matches no objects.
+                      properties:
+                        matchExpressions:
+                          description: matchExpressions is a list of label selector
+                            requirements. The requirements are ANDed.
+                          items:
+                            description: A label selector requirement is a selector
+                              that contains values, a key, and an operator that relates
+                              the key and values.
+                            properties:
+                              key:
+                                description: key is the label key that the selector
+                                  applies to.
+                                type: string
+                              operator:
+                                description: operator represents a key's relationship
+                                  to a set of values. Valid operators are In, NotIn,
+                                  Exists and DoesNotExist.
+                                type: string
+                              values:
+                                description: values is an array of string values.
+                                  If the operator is In or NotIn, the values array
+                                  must be non-empty. If the operator is Exists or
+                                  DoesNotExist, the values array must be empty. This
+                                  array is replaced during a strategic merge patch.
+                                items:
+                                  type: string
+                                type: array
+                            required:
+                            - key
+                            - operator
+                            type: object
+                          type: array
+                        matchLabels:
+                          additionalProperties:
+                            type: string
+                          description: matchLabels is a map of {key,value} pairs.
+                            A single {key,value} in the matchLabels map is equivalent
+                            to an element of matchExpressions, whose key field is
+                            "key", the operator is "In", and the values array contains
+                            only "value". The requirements are ANDed.
+                          type: object
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    nullable: true
+                    type: array
+                type: object
+              serviceaccountrestriction:
+                description: ServiceAccountRestriction matches against service-account
+                  subjects.
+                nullable: true
+                properties:
+                  namespaces:
+                    description: Namespaces specifies a list of literal namespace
+                      names.
+                    items:
+                      type: string
+                    type: array
+                  serviceaccounts:
+                    description: ServiceAccounts specifies a list of literal service-account
+                      names.
+                    items:
+                      description: ServiceAccountReference specifies a service account
+                        and namespace by their names.
+                      properties:
+                        name:
+                          description: Name is the name of the service account.
+                          type: string
+                        namespace:
+                          description: Namespace is the namespace of the service account.  Service
+                            accounts from inside the whitelisted namespaces are allowed
+                            to be bound to roles.  If Namespace is empty, then the
+                            namespace of the RoleBindingRestriction in which the ServiceAccountReference
+                            is embedded is used.
+                          type: string
+                      type: object
+                    type: array
+                type: object
+              userrestriction:
+                description: UserRestriction matches against user subjects.
+                nullable: true
+                properties:
+                  groups:
+                    description: Groups specifies a list of literal group names.
+                    items:
+                      type: string
+                    nullable: true
+                    type: array
+                  labels:
+                    description: Selectors specifies a list of label selectors over
+                      user labels.
+                    items:
+                      description: A label selector is a label query over a set of
+                        resources. The result of matchLabels and matchExpressions
+                        are ANDed. An empty label selector matches all objects. A
+                        null label selector matches no objects.
+                      properties:
+                        matchExpressions:
+                          description: matchExpressions is a list of label selector
+                            requirements. The requirements are ANDed.
+                          items:
+                            description: A label selector requirement is a selector
+                              that contains values, a key, and an operator that relates
+                              the key and values.
+                            properties:
+                              key:
+                                description: key is the label key that the selector
+                                  applies to.
+                                type: string
+                              operator:
+                                description: operator represents a key's relationship
+                                  to a set of values. Valid operators are In, NotIn,
+                                  Exists and DoesNotExist.
+                                type: string
+                              values:
+                                description: values is an array of string values.
+                                  If the operator is In or NotIn, the values array
+                                  must be non-empty. If the operator is Exists or
+                                  DoesNotExist, the values array must be empty. This
+                                  array is replaced during a strategic merge patch.
+                                items:
+                                  type: string
+                                type: array
+                            required:
+                            - key
+                            - operator
+                            type: object
+                          type: array
+                        matchLabels:
+                          additionalProperties:
+                            type: string
+                          description: matchLabels is a map of {key,value} pairs.
+                            A single {key,value} in the matchLabels map is equivalent
+                            to an element of matchExpressions, whose key field is
+                            "key", the operator is "In", and the values array contains
+                            only "value". The requirements are ANDed.
+                          type: object
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    nullable: true
+                    type: array
+                  users:
+                    description: Users specifies a list of literal user names.
+                    items:
+                      type: string
+                    type: array
+                type: object
+            type: object
+        type: object
+    served: true
+    storage: true

payload-manifests/crds/0000_03_authorization-openshift_01_rolebindingrestriction.crd.yaml

@@ -3,6 +3,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.openshift.io: https://github.com/openshift/api/pull/470
+    api.openshift.io/merged-by-featuregates: "true"
     include.release.openshift.io/ibm-cloud-managed: "true"
     include.release.openshift.io/self-managed-high-availability: "true"
     include.release.openshift.io/single-node-developer: "true"

payload-manifests/crds/0000_03_quota-openshift_01_clusterresourcequota.crd.yaml

@@ -3,6 +3,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.openshift.io: https://github.com/openshift/api/pull/470
+    api.openshift.io/merged-by-featuregates: "true"
     include.release.openshift.io/ibm-cloud-managed: "true"
     include.release.openshift.io/self-managed-high-availability: "true"
     include.release.openshift.io/single-node-developer: "true"

payload-manifests/crds/0000_03_security-openshift_01_scc.crd.yaml

@@ -3,6 +3,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.openshift.io: https://github.com/openshift/api/pull/470
+    api.openshift.io/merged-by-featuregates: "true"
     include.release.openshift.io/ibm-cloud-managed: "true"
     include.release.openshift.io/self-managed-high-availability: "true"
     include.release.openshift.io/single-node-developer: "true"

payload-manifests/crds/0000_03_securityinternal-openshift_02_rangeallocation.crd.yaml

@@ -3,6 +3,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.openshift.io: https://github.com/openshift/api/pull/751
+    api.openshift.io/merged-by-featuregates: "true"
     include.release.openshift.io/ibm-cloud-managed: "true"
     include.release.openshift.io/self-managed-high-availability: "true"
     include.release.openshift.io/single-node-developer: "true"
@@ -33,6 +34,7 @@ spec:
             description: data is a byte array representing the serialized state of
               a range allocation.  It is a bitmap with each bit set to one to represent
               a range is taken.
+            format: ""
             type: string
           kind:
             description: 'Kind is a string value representing the REST resource this

quota/v1/0000_03_quota-openshift_01_clusterresourcequota.crd.yaml

@@ -3,6 +3,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.openshift.io: https://github.com/openshift/api/pull/470
+    api.openshift.io/merged-by-featuregates: "true"
     include.release.openshift.io/ibm-cloud-managed: "true"
     include.release.openshift.io/self-managed-high-availability: "true"
     include.release.openshift.io/single-node-developer: "true"

quota/v1/types.go

@@ -13,6 +13,11 @@ import (
 // synthetic ResourceQuota object to allow quota evaluation re-use.
 //
 // Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+// +kubebuilder:object:root=true
+// +kubebuilder:resource:path=clusterresourcequotas,scope=Cluster
+// +kubebuilder:subresource:status
+// +openshift:api-approved.openshift.io=https://github.com/openshift/api/pull/470
+// +openshift:file-pattern=0000_03_quota-openshift_01_clusterresourcequotaMARKERS.crd.yaml
 // +openshift:compatibility-gen:level=1
 type ClusterResourceQuota struct {
 	metav1.TypeMeta `json:",inline"`

quota/v1/zz_generated.featuregated-crd-manifests.yaml

@@ -0,0 +1,19 @@
+clusterresourcequotas.quota.openshift.io:
+  Annotations: {}
+  ApprovedPRNumber: https://github.com/openshift/api/pull/470
+  CRDName: clusterresourcequotas.quota.openshift.io
+  Capability: ""
+  Category: ""
+  FeatureGates: []
+  GroupName: quota.openshift.io
+  HasStatus: true
+  KindName: ClusterResourceQuota
+  Labels: {}
+  PluralName: clusterresourcequotas
+  PrinterColumns: []
+  Scope: Cluster
+  ShortNames: null
+  TargetFilenamePattern: 0000_03_quota-openshift_01_clusterresourcequotaMARKERS.crd.yaml
+  TopLevelFeatureGates: []
+  Version: v1
+