Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Source release.yaml from GitHub release #182

Merged

Conversation

adambkaplan
Copy link
Member

@adambkaplan adambkaplan commented Jan 10, 2024

Changes

The release.yaml used as the base for deploying Shipwright Builds appears to have been manipulated by a YAML linter or other processor. There are significant differentes in YAML structure and formatting between the kodata/release.yaml in tree and the release.yaml published on GitHub for the respective release (v0.12.0). This makes it difficult to verify that the operator is deploying the right thing, especially when versions are bumped.

This replaces the kodata/release.yaml in tree with the release.yaml published for v0.12.0. This will make it easy to verify that we are deploying the right version of Shipwright Builds with the operator, as well as support future workflows that let contributors update the deployed operand from a nightly release.

Fixes #184

Submitter Checklist

  • Includes tests if functionality changed/was added
  • Includes docs if changes are user-facing
  • Set a kind label on this PR
  • Release notes block has been filled in, or marked NONE

See the contributor guide
for details on coding conventions, github and prow interactions, and the code review process.

Release Notes

Update operator to use an exact copy of the Builds v0.12.0 release as the base for its manifests.

@pull-request-size pull-request-size bot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Jan 10, 2024
@adambkaplan
Copy link
Member Author

/kind cleanup

@openshift-ci openshift-ci bot added the kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. label Jan 10, 2024
@adambkaplan
Copy link
Member Author

/assign @divyansh42

The `release.yaml` used as the base for deploying Shipwright Builds
appears to have been manipulated by a YAML linter or other processor.
There are significant differentes in YAML structure and formatting
between the `kodata/release.yaml` in tree and the `release.yaml`
published on GitHub for the respective release (v0.12.0). This makes it
difficult to verify that the operator is deploying the right thing,
especially when versions are bumped.

This replaces the `kodata/release.yaml` in tree with the `release.yaml`
published for v0.12.0. This will make it easy to verify that we are
deploying the right version of Shipwright Builds with the operator, as
well as support future workflows that let contributors update the
deployed operand from a nightly release.

Signed-off-by: Adam Kaplan <adam.kaplan@redhat.com>
In the v0.12.0 `release.yaml`, the Build API webhook has a cluster role
that grants it '*' permission on many core resources. This is
technically different from the original RBAC deployed in the operator's
modified `release.yaml`, which itemized the supported verbs for the
webhook. This commit adds the '*' verb permission for these resources,
which are then needed to deploy all content in `release.yaml`. The OLM
bundle was regenerated so that the RBAC is granted to the operator via
the `ClusterServiceVersion` definition.

Note that the use of '*' permissions in Kubernetes RBAC is highly
discouraged, as it violates the principle of least privilege. A more
narrowly scoped RBAC for the build webhook should be provided in a
future release.

Signed-off-by: Adam Kaplan <adam.kaplan@redhat.com>
@adambkaplan
Copy link
Member Author

/assign @ayushsatyam146

@adambkaplan
Copy link
Member Author

adambkaplan commented May 8, 2024

/cc @SaschaSchwarze0

Note - this is not directly tied to the v0.13.0 release. My goal here is to set a good "baseline" so when we upgrade to v0.13.0, it is easier to see what changed.

@adambkaplan
Copy link
Member Author

The diff for kodata/release.yaml is huge because of manipulations that were done by hand to the CRD definitions.

Below is the more relevant diff at the top of the file, everything else is formatting or CRD related:

$ git diff main kodata/release.yaml
diff --git a/kodata/release.yaml b/kodata/release.yaml
index 3ce3852..fcc1b40 100644
--- a/kodata/release.yaml
+++ b/kodata/release.yaml
@@ -81,12 +81,25 @@ kind: ClusterRole
 metadata:
   name: shipwright-build-webhook
 rules:
-  - apiGroups: [""]
-    resources: ["pods", "configmaps", "services", "events", "namespaces", "limitranges", "secrets"]
-    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
-  - apiGroups: ["admissionregistration.k8s.io", "admissionregistration.k8s.io/v1beta1"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - events
+      - configmaps
+      - secrets
+      - limitranges
+      - namespaces
+      - services
+    verbs:
+      - '*'
+  - apiGroups:
+      - admissionregistration.k8s.io
+      - admissionregistration.k8s.io/v1beta1
+    resources:
+      - validatingwebhookconfigurations
+    verbs:
+      - '*'
 
 ---
 kind: ClusterRoleBinding
@@ -332,7 +345,6 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    cert-manager.io/inject-ca-from: shipwright-build/shipwright-build-webhook-cert
     controller-gen.kubebuilder.io/version: v0.11.4
   name: buildruns.shipwright.io
 spec:

@ayushsatyam146
Copy link
Contributor

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label May 9, 2024
@adambkaplan
Copy link
Member Author

/approve

Self-approving as this PR has been out for a while, and we want this to land before updating release.yaml to v0.13.0

Copy link
Contributor

openshift-ci bot commented May 9, 2024

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: adambkaplan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 9, 2024
@openshift-merge-bot openshift-merge-bot bot merged commit d831c31 into shipwright-io:main May 9, 2024
4 checks passed
@adambkaplan adambkaplan deleted the source-release-from-gh branch May 13, 2024 18:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. lgtm Indicates that a PR is ready to be merged. release-note size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

[BUG] v0.12.0 does not ship an exact match of build v0.12.0
3 participants