[tenant-namespace-operator] Upgraded to 1.32.0

charts/charts/tenant-namespace-operator/Chart.yaml

@@ -14,8 +14,8 @@ type: application
 
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: 0.1.17
+version: 0.1.18
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: 0.1.14-1
+appVersion: 0.1.15-1

charts/charts/tenant-namespace-operator/templates/clusterrole.yaml

@@ -8,45 +8,33 @@ rules:
 - apiGroups:
   - miscscripts.pnnl.gov
   resources:
-  - 'tenantnamespaceflavors'
+  - tenantnamespaceflavors
   verbs:
   - get
   - list
   - watch
 - apiGroups:
   - ""
   resources:
-  - 'namespaces'
-  - 'resourcequotas'
-  - 'limitranges'
+  - namespaces
+  - resourcequotas
+  - limitranges
   verbs:
   - "*"
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:
-  - 'rolebindings'
+  - rolebindings
+  - clusterroles
+  - clusterrolebindings
   verbs:
   - "*"
 - apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - 'clusterroles'
-  - 'clusterrolebindings'
-  verbs:
-  - "*"
-- apiGroups:
-  - networking.k8s.io/v1
+  - networking.k8s.io
   resources:
   - networkpolicies
   verbs:
   - "*"
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - 'clusterroles'
-  - 'clusterrolebindings'
-  verbs:
-  - "*"
 - apiGroups:
   - extensions
   - "networking.k8s.io" # k8s 1.14+

charts/charts/tenant-namespace-operator/templates/deployment.yaml

@@ -45,7 +45,7 @@ spec:
             initialDelaySeconds: 5
             periodSeconds: 10
           args:
-            - "--enable-leader-election"
+            - "--leader-elect"
             - "--leader-election-id=tenant-namespace-operator"
           env:
             - name: ANSIBLE_GATHERING

charts/charts/tenant-namespace-operator/templates/leader-election-role-binding.yaml

@@ -0,0 +1,15 @@
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "tenant-namespace-operator.fullname" . }}-le
+  labels:
+{{ include "tenant-namespace-operator.labels" . | nindent 4 }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "tenant-namespace-operator.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: {{ include "tenant-namespace-operator.fullname" . }}-le
+  apiGroup: rbac.authorization.k8s.io

charts/charts/tenant-namespace-operator/templates/leader-election-role.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "tenant-namespace-operator.fullname" . }}-le
+  labels:
+{{ include "tenant-namespace-operator.labels" . | nindent 4 }}
+rules:
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete

charts/charts/tenant-namespace-operator/templates/role.yaml

@@ -39,6 +39,19 @@ rules:
   - patch
   - update
   - watch
+# needed for ingress leader election pre 1.24
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
 - apiGroups:
   - monitoring.coreos.com
   resources:

charts/charts/tenant-namespace-operator/values.yaml

@@ -28,15 +28,18 @@ serviceAccount:
   # If not set and create is true, a name is generated using the fullname template
   name:
 
-podSecurityContext: {}
+podSecurityContext:
+  runAsNonRoot: true
+  seccompProfile:
+    type: RuntimeDefault
   # fsGroup: 2000
 
-securityContext: {}
-  # capabilities:
-  #   drop:
-  #   - ALL
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
   # readOnlyRootFilesystem: true
-  # runAsNonRoot: true
   # runAsUser: 1000
 
 resources: {}
@@ -55,7 +58,19 @@ nodeSelector: {}
 
 tolerations: []
 
-affinity: {}
+affinity:
+  nodeAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      nodeSelectorTerms:
+        - matchExpressions:
+          - key: kubernetes.io/arch
+            operator: In
+            values:
+              - amd64
+          - key: kubernetes.io/os
+            operator: In
+            values:
+              - linux
 
 ingressClass:
   enabled: true

containers/tenant-namespace-operator/Dockerfile

@@ -1,16 +1,17 @@
-FROM quay.io/operator-framework/ansible-operator:v1.4.0
+FROM quay.io/operator-framework/ansible-operator:v1.32.0
 
 ARG helm_version=v3.5.2
 USER 0
 RUN \
-  yum clean all && \
-  yum install -y git patch && \
-  yum clean all && \
-  curl -o helm.tar.gz https://get.helm.sh/helm-${helm_version}-linux-amd64.tar.gz && \
+  dnf clean all && \
+  dnf install -y git patch && \
+  dnf clean all && \
+  ARCH=$(uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/') && \
+  curl -o helm.tar.gz https://get.helm.sh/helm-${helm_version}-linux-${ARCH}.tar.gz && \
   tar -zxvf helm.tar.gz && \
-  mv linux-amd64/helm /usr/local/bin/helm && \
+  mv linux-${ARCH}/helm /usr/local/bin/helm && \
   rm -f helm.tar.gz && \
-  rm -rf linux-amd64 && \
+  rm -rf linux-${ARCH} && \
   touch /.extrafingerprints && \
   chown ${USER_UID}:0 /.extrafingerprints
 
@@ -22,7 +23,7 @@ COPY roles/ ${HOME}/roles/
 
 #FIXME forcing ingress newer to work on newer k8s clusters. Fix upstream chart.
 RUN \
-  ansible-galaxy collection install -r ${HOME}/requirements.yml && \
+  ansible-galaxy install -r ${HOME}/requirements.yml && \
   chmod -R ug+rwx ${HOME}/.ansible && \
   helm plugin install https://github.com/databus23/helm-diff --version master && \
   helm pull --repo https://pnnl-miscscripts.github.io/charts tenant-namespace --version 0.6.13 --untar && \
@@ -32,4 +33,4 @@ RUN \
   echo 0.1.13 >> /.extrafingerprints && \
   md5sum watches.yaml >> /.extrafingerprints
 
-ENTRYPOINT ["/usr/local/bin/ansible-operator", "run", "--watches-file=./watches.yaml", "--inject-owner-ref=false"]
+ENTRYPOINT ["/tini", "--", "/usr/local/bin/ansible-operator", "run", "--watches-file=./watches.yaml", "--inject-owner-ref=false"]