diff --git a/admission-policies/default/authoritative-api-transition-requires-capi-infrastructure-ready.yaml b/admission-policies/default/authoritative-api-transition-requires-capi-infrastructure-ready.yaml index 6aeaed0a5..98bbdf742 100644 --- a/admission-policies/default/authoritative-api-transition-requires-capi-infrastructure-ready.yaml +++ b/admission-policies/default/authoritative-api-transition-requires-capi-infrastructure-ready.yaml @@ -48,7 +48,8 @@ spec: expression: >- !(request.userInfo.username in [ "system:serviceaccount:openshift-machine-api:machine-api-controllers", - "system:serviceaccount:openshift-cluster-api:capi-controllers" + "system:serviceaccount:openshift-cluster-api:capi-controllers", + "system:serviceaccount:openshift-cluster-api:machine-api-migration" ]) - name: check-param-match expression: 'object.metadata.name == params.metadata.name' diff --git a/admission-policies/default/cluster-api-machine-set-vap.yaml b/admission-policies/default/cluster-api-machine-set-vap.yaml index 07ca33082..c2e9ffeea 100644 --- a/admission-policies/default/cluster-api-machine-set-vap.yaml +++ b/admission-policies/default/cluster-api-machine-set-vap.yaml @@ -47,7 +47,8 @@ spec: expression: >- !(request.userInfo.username in [ "system:serviceaccount:openshift-machine-api:machine-api-controllers", - "system:serviceaccount:openshift-cluster-api:capi-controllers" + "system:serviceaccount:openshift-cluster-api:capi-controllers", + "system:serviceaccount:openshift-cluster-api:machine-api-migration" ]) - name: check-param-match expression: 'object.metadata.name == params.metadata.name' diff --git a/admission-policies/default/cluster-api-machine-vap.yaml b/admission-policies/default/cluster-api-machine-vap.yaml index af6a4c601..602b83a5d 100644 --- a/admission-policies/default/cluster-api-machine-vap.yaml +++ b/admission-policies/default/cluster-api-machine-vap.yaml @@ -47,7 +47,8 @@ spec: expression: >- !(request.userInfo.username in [ "system:serviceaccount:openshift-machine-api:machine-api-controllers", - "system:serviceaccount:openshift-cluster-api:capi-controllers" + "system:serviceaccount:openshift-cluster-api:capi-controllers", + "system:serviceaccount:openshift-cluster-api:machine-api-migration" ]) - name: check-param-match expression: 'object.metadata.name == params.metadata.name' diff --git a/admission-policies/default/machine-api-machine-set-vap.yaml b/admission-policies/default/machine-api-machine-set-vap.yaml index d638c9902..d068465ea 100644 --- a/admission-policies/default/machine-api-machine-set-vap.yaml +++ b/admission-policies/default/machine-api-machine-set-vap.yaml @@ -48,7 +48,8 @@ spec: expression: >- !(request.userInfo.username in [ "system:serviceaccount:openshift-machine-api:machine-api-controllers", - "system:serviceaccount:openshift-cluster-api:capi-controllers" + "system:serviceaccount:openshift-cluster-api:capi-controllers", + "system:serviceaccount:openshift-cluster-api:machine-api-migration" ]) - name: check-authoritativeAPI-clusterapi expression: 'object.status.authoritativeAPI == "ClusterAPI"' diff --git a/admission-policies/default/machine-api-machine-vap.yaml b/admission-policies/default/machine-api-machine-vap.yaml index 1b2ba2442..c1c71b80e 100644 --- a/admission-policies/default/machine-api-machine-vap.yaml +++ b/admission-policies/default/machine-api-machine-vap.yaml @@ -48,7 +48,8 @@ spec: expression: >- !(request.userInfo.username in [ "system:serviceaccount:openshift-machine-api:machine-api-controllers", - "system:serviceaccount:openshift-cluster-api:capi-controllers" + "system:serviceaccount:openshift-cluster-api:capi-controllers", + "system:serviceaccount:openshift-cluster-api:machine-api-migration" ]) - name: check-authoritativeAPI-clusterapi expression: 'object.status.authoritativeAPI == "ClusterAPI"' diff --git a/admission-policies/default/validate-capi-machine-creation.yaml b/admission-policies/default/validate-capi-machine-creation.yaml index 16bd7b848..178c03442 100644 --- a/admission-policies/default/validate-capi-machine-creation.yaml +++ b/admission-policies/default/validate-capi-machine-creation.yaml @@ -42,7 +42,8 @@ spec: expression: >- !(request.userInfo.username in [ "system:serviceaccount:openshift-machine-api:machine-api-controllers", - "system:serviceaccount:openshift-cluster-api:capi-controllers" + "system:serviceaccount:openshift-cluster-api:capi-controllers", + "system:serviceaccount:openshift-cluster-api:machine-api-migration" ]) - name: check-param-match expression: 'object.metadata.name == params.metadata.name' diff --git a/admission-policies/default/validate-capi-machine-set-creation.yaml b/admission-policies/default/validate-capi-machine-set-creation.yaml index fd5d99b59..2ac34ddcd 100644 --- a/admission-policies/default/validate-capi-machine-set-creation.yaml +++ b/admission-policies/default/validate-capi-machine-set-creation.yaml @@ -42,7 +42,8 @@ spec: expression: >- !(request.userInfo.username in [ "system:serviceaccount:openshift-machine-api:machine-api-controllers", - "system:serviceaccount:openshift-cluster-api:capi-controllers" + "system:serviceaccount:openshift-cluster-api:capi-controllers", + "system:serviceaccount:openshift-cluster-api:machine-api-migration" ]) - name: check-param-match expression: 'object.metadata.name == params.metadata.name' diff --git a/capi-operator-manifests/default/manifests.yaml b/capi-operator-manifests/default/manifests.yaml index 328b61c04..6339e47e0 100644 --- a/capi-operator-manifests/default/manifests.yaml +++ b/capi-operator-manifests/default/manifests.yaml @@ -28,7 +28,8 @@ spec: !(request.userInfo.username in [ "system:serviceaccount:openshift-machine-api:machine-api-controllers", - "system:serviceaccount:openshift-cluster-api:capi-controllers" + "system:serviceaccount:openshift-cluster-api:capi-controllers", + "system:serviceaccount:openshift-cluster-api:machine-api-migration" ]) name: check-only-non-service-account-requests - expression: object.status.authoritativeAPI == "ClusterAPI" @@ -155,7 +156,8 @@ spec: !(request.userInfo.username in [ "system:serviceaccount:openshift-machine-api:machine-api-controllers", - "system:serviceaccount:openshift-cluster-api:capi-controllers" + "system:serviceaccount:openshift-cluster-api:capi-controllers", + "system:serviceaccount:openshift-cluster-api:machine-api-migration" ]) name: check-only-non-service-account-requests - expression: object.status.authoritativeAPI == "ClusterAPI" @@ -280,7 +282,8 @@ spec: !(request.userInfo.username in [ "system:serviceaccount:openshift-machine-api:machine-api-controllers", - "system:serviceaccount:openshift-cluster-api:capi-controllers" + "system:serviceaccount:openshift-cluster-api:capi-controllers", + "system:serviceaccount:openshift-cluster-api:machine-api-migration" ]) name: check-only-non-service-account-requests - expression: object.metadata.name == params.metadata.name @@ -392,7 +395,8 @@ spec: !(request.userInfo.username in [ "system:serviceaccount:openshift-machine-api:machine-api-controllers", - "system:serviceaccount:openshift-cluster-api:capi-controllers" + "system:serviceaccount:openshift-cluster-api:capi-controllers", + "system:serviceaccount:openshift-cluster-api:machine-api-migration" ]) name: check-only-non-service-account-requests - expression: object.metadata.name == params.metadata.name @@ -652,7 +656,8 @@ spec: !(request.userInfo.username in [ "system:serviceaccount:openshift-machine-api:machine-api-controllers", - "system:serviceaccount:openshift-cluster-api:capi-controllers" + "system:serviceaccount:openshift-cluster-api:capi-controllers", + "system:serviceaccount:openshift-cluster-api:machine-api-migration" ]) name: check-only-non-service-account-requests - expression: object.metadata.name == params.metadata.name @@ -730,7 +735,8 @@ spec: !(request.userInfo.username in [ "system:serviceaccount:openshift-machine-api:machine-api-controllers", - "system:serviceaccount:openshift-cluster-api:capi-controllers" + "system:serviceaccount:openshift-cluster-api:capi-controllers", + "system:serviceaccount:openshift-cluster-api:machine-api-migration" ]) name: check-only-non-service-account-requests - expression: object.metadata.name == params.metadata.name @@ -907,7 +913,8 @@ spec: !(request.userInfo.username in [ "system:serviceaccount:openshift-machine-api:machine-api-controllers", - "system:serviceaccount:openshift-cluster-api:capi-controllers" + "system:serviceaccount:openshift-cluster-api:capi-controllers", + "system:serviceaccount:openshift-cluster-api:machine-api-migration" ]) name: check-only-non-service-account-requests - expression: object.metadata.name == params.metadata.name @@ -984,10 +991,10 @@ spec: name: webhook-server protocol: TCP - containerPort: 8443 - name: diagnostics-o + name: diagnostics protocol: TCP - containerPort: 9440 - name: healthz-o + name: healthz protocol: TCP resources: requests: @@ -1001,32 +1008,6 @@ spec: - mountPath: /tmp/k8s-metrics-server/serving-certs name: metrics-cert readOnly: true - - args: - - --diagnostics-address=:8442 - - --health-addr=:9441 - command: - - /machine-api-migration - env: - - name: RELEASE_VERSION - value: 0.0.1-snapshot - image: registry.ci.openshift.org/openshift:cluster-capi-operator - name: machine-api-migration - ports: - - containerPort: 8442 - name: diagnostics-m - protocol: TCP - - containerPort: 9441 - name: healthz-m - protocol: TCP - resources: - requests: - cpu: 10m - memory: 50Mi - terminationMessagePolicy: FallbackToLogsOnError - volumeMounts: - - mountPath: /tmp/k8s-metrics-server/serving-certs - name: metrics-cert - readOnly: true nodeSelector: node-role.kubernetes.io/control-plane: "" priorityClassName: system-cluster-critical diff --git a/cmd/capi-controllers/main.go b/cmd/capi-controllers/main.go index a8d6054d5..6e85f303d 100644 --- a/cmd/capi-controllers/main.go +++ b/cmd/capi-controllers/main.go @@ -235,11 +235,6 @@ func getDefaultCacheOptions(capiNamespace string, sync time.Duration) cache.Opti defaultMachineAPINamespace: {}, }, }, - &mapiv1beta1.MachineSet{}: { - Namespaces: map[string]cache.Config{ - defaultMachineAPINamespace: {}, - }, - }, &mapiv1beta1.Machine{}: { Namespaces: map[string]cache.Config{ defaultMachineAPINamespace: {}, diff --git a/docs/rbac.md b/docs/rbac.md index 39518b15c..bada15b07 100644 --- a/docs/rbac.md +++ b/docs/rbac.md @@ -20,15 +20,26 @@ Both SAs also bind to ClusterRole `system:openshift:openshift-cluster-api:read-t ### capi-controllers -The `capi-controllers` ServiceAccount (used by both the `capi-controllers` and `machine-api-migration` containers) has permissions split across scopes: +The `capi-controllers` ServiceAccount runs the `capi-controllers` binary (core cluster, infra cluster, kubeconfig, secret sync, and webhook controllers): | Manifest | Kind | Scope | Purpose | |----------|------|-------|---------| -| `0000_30_cluster-api_03_rbac_roles.yaml` | ClusterRole `openshift-capi-controllers` | cluster-wide | Cluster-scoped resources only: infrastructures, clusteroperators, featuregates, clusterversions, nodes, CRDs | -| `0000_30_cluster-api_03_rbac_roles.yaml` | Role `capi-controllers` | `openshift-cluster-api` | CAPI core + infra provider resources, secrets, pod self-read, events, leases | -| `0000_30_cluster-api_03_rbac_roles.yaml` | Role `capi-controllers` | `openshift-machine-api` | MAPI machines, machinesets, controlplanemachinesets, secrets, events | +| `0000_30_cluster-api_03_rbac_roles.yaml` | ClusterRole `openshift-capi-controllers` | cluster-wide | Cluster-scoped resources: infrastructures, clusteroperators, nodes | +| `0000_30_cluster-api_03_rbac_roles.yaml` | Role `capi-controllers` | `openshift-cluster-api` | CAPI Cluster + infra cluster resources, secrets, pod self-read, events, leases | +| `0000_30_cluster-api_03_rbac_roles.yaml` | Role `capi-controllers` | `openshift-machine-api` | MAPI machines (read-only for InfraCluster), controlplanemachinesets (InfraCluster), secrets (read-only) | | `0000_30_cluster-api_03_rbac_roles.yaml` | Role `capi-controllers-kube-system` | `kube-system` | Secrets (vSphere credentials) | -| `0000_30_cluster-api_03_rbac_roles.yaml` | Role `cluster-capi-operator-pull-secret` | `openshift-config` | Pull-secret read | + +This SA also binds to ClusterRole `system:openshift:openshift-cluster-api:read-tls-configuration` for APIServer TLS profile reading. + +### machine-api-migration + +The `machine-api-migration` ServiceAccount runs the `machine-api-migration` binary (machine/machineset sync and migration controllers): + +| Manifest | Kind | Scope | Purpose | +|----------|------|-------|---------| +| `0000_30_cluster-api_03_machine-api-migration-rbac-roles.yaml` | ClusterRole `openshift-machine-api-migration` | cluster-wide | Cluster-scoped resources: infrastructures (get only), featuregates, clusterversions, CRDs | +| `0000_30_cluster-api_03_machine-api-migration-rbac-roles.yaml` | Role `machine-api-migration` | `openshift-cluster-api` | CAPI Cluster (read), Machine/MachineSet + infra cluster (read)/machine/machinetemplate resources, events, leader election lease (scoped to `machine-api-migration-leader`) | +| `0000_30_cluster-api_03_machine-api-migration-rbac-roles.yaml` | Role `machine-api-migration` | `openshift-machine-api` | MAPI machines (full), machinesets (no create), events | This SA also binds to ClusterRole `system:openshift:openshift-cluster-api:read-tls-configuration` for APIServer TLS profile reading. diff --git a/e2e/cluster_api_machine_management.go b/e2e/cluster_api_machine_management.go index 8035c042b..1373927c0 100644 --- a/e2e/cluster_api_machine_management.go +++ b/e2e/cluster_api_machine_management.go @@ -56,6 +56,14 @@ var _ = Describe("[sig-cluster-lifecycle][OCPFeatureGate:ClusterAPIMachineManage framework.AssertDeploymentAvailable("capi-controllers", framework.CAPINamespace) }) + It("should have the machine-api-migration deployment available", func() { + if !framework.IsFeatureGateEnabled(ctx, cl, features.FeatureGateMachineAPIMigration) { + Skip("Skipping, machine-api-migration is only deployed when MachineAPIMigration is enabled") + } + + framework.AssertDeploymentAvailable("machine-api-migration", framework.CAPINamespace) + }) + It("should have the capi-installer deployment available", func() { framework.AssertDeploymentAvailable("capi-installer", framework.CAPIOperatorNamespace) }) diff --git a/manifests/0000_30_cluster-api_02_machine-api-migration-service-account.yaml b/manifests/0000_30_cluster-api_02_machine-api-migration-service-account.yaml new file mode 100644 index 000000000..25d0eea9d --- /dev/null +++ b/manifests/0000_30_cluster-api_02_machine-api-migration-service-account.yaml @@ -0,0 +1,11 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + namespace: openshift-cluster-api + name: machine-api-migration + annotations: + exclude.release.openshift.io/internal-openshift-hosted: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + release.openshift.io/feature-gate: "MachineAPIMigration" diff --git a/manifests/0000_30_cluster-api_03_machine-api-migration-rbac-roles.yaml b/manifests/0000_30_cluster-api_03_machine-api-migration-rbac-roles.yaml new file mode 100644 index 000000000..4160cd696 --- /dev/null +++ b/manifests/0000_30_cluster-api_03_machine-api-migration-rbac-roles.yaml @@ -0,0 +1,228 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + annotations: + exclude.release.openshift.io/internal-openshift-hosted: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + release.openshift.io/feature-gate: "MachineAPIMigration" + name: openshift-machine-api-migration +rules: +- apiGroups: + - config.openshift.io + resources: + - infrastructures + verbs: + - get +- apiGroups: + - config.openshift.io + resources: + - featuregates + - clusterversions + verbs: + - get + - list + - watch +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + annotations: + exclude.release.openshift.io/internal-openshift-hosted: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + release.openshift.io/feature-gate: "MachineAPIMigration" + name: machine-api-migration + namespace: openshift-cluster-api +rules: +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create +- apiGroups: + - coordination.k8s.io + resourceNames: + - machine-api-migration-leader + resources: + - leases + verbs: + - get + - update + - patch + - delete +- apiGroups: + - cluster.x-k8s.io + resources: + - machines + - machinesets + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - cluster.x-k8s.io + resources: + - machines/status + - machinesets/status + verbs: + - update + - patch +- apiGroups: + - cluster.x-k8s.io + resources: + - clusters + verbs: + - get + - list + - watch +- apiGroups: + - cluster.x-k8s.io + resources: + - clusters/finalizers + - machines/finalizers + - machinesets/finalizers + verbs: + - update +- apiGroups: + - infrastructure.cluster.x-k8s.io + resources: + - awsclusters + - azureclusters + - gcpclusters + - vsphereclusters + - openstackclusters + - metal3clusters + - ibmpowervsclusters + verbs: + - get + - list + - watch +- apiGroups: + - infrastructure.cluster.x-k8s.io + resources: + - awsmachines + - azuremachines + - gcpmachines + - vspheremachines + - openstackmachines + - metal3machines + - ibmpowervsmachines + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - infrastructure.cluster.x-k8s.io + resources: + - awsmachines/status + - azuremachines/status + - gcpmachines/status + - vspheremachines/status + - openstackmachines/status + - metal3machines/status + - ibmpowervsmachines/status + verbs: + - update + - patch +- apiGroups: + - infrastructure.cluster.x-k8s.io + resources: + - awsmachinetemplates + - azuremachinetemplates + - gcpmachinetemplates + - vspheremachinetemplates + - openstackmachinetemplates + - metal3machinetemplates + - ibmpowervsmachinetemplates + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - deletecollection +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + annotations: + exclude.release.openshift.io/internal-openshift-hosted: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + release.openshift.io/feature-gate: "MachineAPIMigration" + name: machine-api-migration + namespace: openshift-machine-api +rules: +- apiGroups: + - machine.openshift.io + resources: + - machines + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - machine.openshift.io + resources: + - machinesets + verbs: + - get + - list + - watch + - update + - patch + - delete +- apiGroups: + - machine.openshift.io + resources: + - machines/status + - machinesets/status + verbs: + - update + - patch +- apiGroups: + - machine.openshift.io + resources: + - machines/finalizers + - machinesets/finalizers + verbs: + - update +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch diff --git a/manifests/0000_30_cluster-api_03_rbac_roles.yaml b/manifests/0000_30_cluster-api_03_rbac_roles.yaml index dd804703d..4a733f285 100644 --- a/manifests/0000_30_cluster-api_03_rbac_roles.yaml +++ b/manifests/0000_30_cluster-api_03_rbac_roles.yaml @@ -43,23 +43,6 @@ rules: verbs: - update - patch -- apiGroups: - - config.openshift.io - resources: - - featuregates - - clusterversions - verbs: - - get - - list - - watch -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - watch - apiGroups: - "" resources: @@ -69,7 +52,6 @@ rules: - list - watch - patch - - update --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role @@ -99,33 +81,18 @@ rules: - cluster.x-k8s.io resources: - clusters - - machines - - machinesets verbs: - get - list - watch - create - - update - patch - - delete - apiGroups: - cluster.x-k8s.io resources: - clusters/status - - machines/status - - machinesets/status verbs: - - update - patch -- apiGroups: - - cluster.x-k8s.io - resources: - - clusters/finalizers - - machines/finalizers - - machinesets/finalizers - verbs: - - update - apiGroups: - infrastructure.cluster.x-k8s.io resources: @@ -165,56 +132,6 @@ rules: - list - watch - create -- apiGroups: - - infrastructure.cluster.x-k8s.io - resources: - - awsmachines - - azuremachines - - gcpmachines - - vspheremachines - - openstackmachines - - metal3machines - - ibmpowervsmachines - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - infrastructure.cluster.x-k8s.io - resources: - - awsmachines/status - - azuremachines/status - - gcpmachines/status - - vspheremachines/status - - openstackmachines/status - - metal3machines/status - - ibmpowervsmachines/status - verbs: - - update - - patch -- apiGroups: - - infrastructure.cluster.x-k8s.io - resources: - - awsmachinetemplates - - azuremachinetemplates - - gcpmachinetemplates - - vspheremachinetemplates - - openstackmachinetemplates - - metal3machinetemplates - - ibmpowervsmachinetemplates - verbs: - - get - - list - - watch - - create - - update - - patch - - delete - - deletecollection - apiGroups: - "" resources: @@ -256,30 +173,10 @@ rules: - machine.openshift.io resources: - machines - - machinesets verbs: - get - list - watch - - create - - update - - patch - - delete -- apiGroups: - - machine.openshift.io - resources: - - machines/status - - machinesets/status - verbs: - - update - - patch -- apiGroups: - - machine.openshift.io - resources: - - machines/finalizers - - machinesets/finalizers - verbs: - - update - apiGroups: - machine.openshift.io resources: @@ -296,13 +193,6 @@ rules: - get - list - watch -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role @@ -331,24 +221,3 @@ rules: - vsphere-creds verbs: - get ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - annotations: - exclude.release.openshift.io/internal-openshift-hosted: "true" - include.release.openshift.io/self-managed-high-availability: "true" - include.release.openshift.io/single-node-developer: "true" - release.openshift.io/feature-gate: "ClusterAPIMachineManagement" - capability.openshift.io/name: ClusterAPI - name: cluster-capi-operator-pull-secret - namespace: openshift-config -rules: -- apiGroups: - - "" - resources: - - secrets - resourceNames: - - pull-secret - verbs: - - get diff --git a/manifests/0000_30_cluster-api_04_machine-api-migration-rbac-bindings.yaml b/manifests/0000_30_cluster-api_04_machine-api-migration-rbac-bindings.yaml new file mode 100644 index 000000000..f3b8814c5 --- /dev/null +++ b/manifests/0000_30_cluster-api_04_machine-api-migration-rbac-bindings.yaml @@ -0,0 +1,74 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: openshift-machine-api-migration + annotations: + exclude.release.openshift.io/internal-openshift-hosted: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + release.openshift.io/feature-gate: "MachineAPIMigration" +roleRef: + kind: ClusterRole + name: openshift-machine-api-migration + apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + namespace: openshift-cluster-api + name: machine-api-migration +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: machine-api-migration + namespace: openshift-cluster-api + annotations: + exclude.release.openshift.io/internal-openshift-hosted: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + release.openshift.io/feature-gate: "MachineAPIMigration" +roleRef: + kind: Role + name: machine-api-migration + apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + namespace: openshift-cluster-api + name: machine-api-migration +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: system:openshift:machine-api-migration-read-tls-configuration + annotations: + exclude.release.openshift.io/internal-openshift-hosted: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + release.openshift.io/feature-gate: "MachineAPIMigration" +roleRef: + kind: ClusterRole + name: system:openshift:openshift-cluster-api:read-tls-configuration + apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + namespace: openshift-cluster-api + name: machine-api-migration +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: machine-api-migration + namespace: openshift-machine-api + annotations: + exclude.release.openshift.io/internal-openshift-hosted: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + release.openshift.io/feature-gate: "MachineAPIMigration" +roleRef: + kind: Role + name: machine-api-migration + apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + namespace: openshift-cluster-api + name: machine-api-migration diff --git a/manifests/0000_30_cluster-api_04_rbac_bindings.yaml b/manifests/0000_30_cluster-api_04_rbac_bindings.yaml index cafce2e68..b5a9b3133 100644 --- a/manifests/0000_30_cluster-api_04_rbac_bindings.yaml +++ b/manifests/0000_30_cluster-api_04_rbac_bindings.yaml @@ -96,23 +96,3 @@ subjects: - kind: ServiceAccount namespace: openshift-cluster-api name: capi-controllers ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: cluster-capi-operator-pull-secret - namespace: openshift-config - annotations: - exclude.release.openshift.io/internal-openshift-hosted: "true" - include.release.openshift.io/self-managed-high-availability: "true" - include.release.openshift.io/single-node-developer: "true" - release.openshift.io/feature-gate: "ClusterAPIMachineManagement" - capability.openshift.io/name: ClusterAPI -roleRef: - kind: Role - name: cluster-capi-operator-pull-secret - apiGroup: rbac.authorization.k8s.io -subjects: -- kind: ServiceAccount - namespace: openshift-cluster-api - name: capi-controllers diff --git a/manifests/0000_30_cluster-api_10_capi-controllers-servicemonitor.yaml b/manifests/0000_30_cluster-api_10_capi-controllers-servicemonitor.yaml index d9d6dfde4..ba957cfaf 100644 --- a/manifests/0000_30_cluster-api_10_capi-controllers-servicemonitor.yaml +++ b/manifests/0000_30_cluster-api_10_capi-controllers-servicemonitor.yaml @@ -19,14 +19,6 @@ spec: certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key serverName: capi-controllers-metrics.openshift-cluster-api.svc - - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token - port: machine-api-migration-metrics - scheme: https - tlsConfig: - caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt - certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt - keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key - serverName: capi-controllers-metrics.openshift-cluster-api.svc selector: matchLabels: k8s-app: capi-controllers diff --git a/manifests/0000_30_cluster-api_10_machine-api-migration-metrics-service.yaml b/manifests/0000_30_cluster-api_10_machine-api-migration-metrics-service.yaml new file mode 100644 index 000000000..07e68312c --- /dev/null +++ b/manifests/0000_30_cluster-api_10_machine-api-migration-metrics-service.yaml @@ -0,0 +1,21 @@ +apiVersion: v1 +kind: Service +metadata: + annotations: + exclude.release.openshift.io/internal-openshift-hosted: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + release.openshift.io/feature-gate: "MachineAPIMigration" + service.beta.openshift.io/serving-cert-secret-name: machine-api-migration-metrics-tls + name: machine-api-migration-metrics + namespace: openshift-cluster-api +spec: + ports: + - name: machine-api-migration-metrics + port: 8443 + targetPort: diagnostics + selector: + k8s-app: machine-api-migration + type: ClusterIP + clusterIP: None + sessionAffinity: None diff --git a/manifests/0000_30_cluster-api_10_machine-api-migration-servicemonitor.yaml b/manifests/0000_30_cluster-api_10_machine-api-migration-servicemonitor.yaml new file mode 100644 index 000000000..7fd99ffad --- /dev/null +++ b/manifests/0000_30_cluster-api_10_machine-api-migration-servicemonitor.yaml @@ -0,0 +1,23 @@ +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + annotations: + exclude.release.openshift.io/internal-openshift-hosted: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + release.openshift.io/feature-gate: "MachineAPIMigration" + name: machine-api-migration + namespace: openshift-cluster-api +spec: + endpoints: + - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token + port: machine-api-migration-metrics + scheme: https + tlsConfig: + caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt + certFile: /etc/prometheus/secrets/metrics-client-certs/tls.crt + keyFile: /etc/prometheus/secrets/metrics-client-certs/tls.key + serverName: machine-api-migration-metrics.openshift-cluster-api.svc + selector: + matchLabels: + k8s-app: machine-api-migration diff --git a/manifests/0000_30_cluster-api_10_metrics-service.yaml b/manifests/0000_30_cluster-api_10_metrics-service.yaml index 286cdc22a..8d398eea9 100644 --- a/manifests/0000_30_cluster-api_10_metrics-service.yaml +++ b/manifests/0000_30_cluster-api_10_metrics-service.yaml @@ -14,10 +14,7 @@ spec: ports: - name: capi-controllers-metrics port: 8443 - targetPort: diagnostics-o - - name: machine-api-migration-metrics - port: 8442 - targetPort: diagnostics-m + targetPort: diagnostics selector: k8s-app: capi-controllers type: ClusterIP diff --git a/manifests/0000_30_cluster-api_12_allow-ingress-to-metrics-operators.yaml b/manifests/0000_30_cluster-api_12_allow-ingress-to-metrics-operators.yaml index f45f85a0e..089f677ea 100644 --- a/manifests/0000_30_cluster-api_12_allow-ingress-to-metrics-operators.yaml +++ b/manifests/0000_30_cluster-api_12_allow-ingress-to-metrics-operators.yaml @@ -61,14 +61,12 @@ spec: ports: - port: 8443 protocol: TCP - # machine-api-migration controller has a distinct metrics endpoint - - port: 8442 - protocol: TCP podSelector: matchExpressions: - key: k8s-app operator: In values: - capi-controllers + - machine-api-migration policyTypes: - Ingress diff --git a/manifests/0000_30_cluster-api_14_allow-egress-operators.yaml b/manifests/0000_30_cluster-api_14_allow-egress-operators.yaml index fc3d3bf71..395c94085 100644 --- a/manifests/0000_30_cluster-api_14_allow-egress-operators.yaml +++ b/manifests/0000_30_cluster-api_14_allow-egress-operators.yaml @@ -1,5 +1,5 @@ -# This NetworkPolicy allows egress traffic required for the CAPI controller -# deployments in the openshift-cluster-api namespace. +# This NetworkPolicy allows egress traffic required for the capi-controllers +# deployment in the openshift-cluster-api namespace. # The controllers need broad internet access for cluster management operations, # cloud provider API calls, and communication with various services. # @@ -28,3 +28,32 @@ spec: - capi-controllers policyTypes: - Egress +--- +# This NetworkPolicy allows egress traffic required for the machine-api-migration +# deployment in the openshift-cluster-api namespace. +# The migration controller only needs access to the Kubernetes API server. +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + annotations: + exclude.release.openshift.io/internal-openshift-hosted: "true" + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + release.openshift.io/feature-gate: "MachineAPIMigration" + capability.openshift.io/name: ClusterAPI + name: allow-egress-machine-api-migration + namespace: openshift-cluster-api +spec: + egress: + - ports: + # Allow egress traffic to kube-apiserver + - port: 6443 + protocol: TCP + podSelector: + matchExpressions: + - key: k8s-app + operator: In + values: + - machine-api-migration + policyTypes: + - Egress diff --git a/manifests/0000_30_cluster-api_17_machine-api-migration-deployment.yaml b/manifests/0000_30_cluster-api_17_machine-api-migration-deployment.yaml new file mode 100644 index 000000000..d3c9520ab --- /dev/null +++ b/manifests/0000_30_cluster-api_17_machine-api-migration-deployment.yaml @@ -0,0 +1,75 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: machine-api-migration + namespace: openshift-cluster-api + annotations: + include.release.openshift.io/self-managed-high-availability: "true" + include.release.openshift.io/single-node-developer: "true" + exclude.release.openshift.io/internal-openshift-hosted: "true" + release.openshift.io/feature-gate: "MachineAPIMigration" + labels: + k8s-app: machine-api-migration +spec: + selector: + matchLabels: + k8s-app: machine-api-migration + replicas: 1 + template: + metadata: + annotations: + target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}' + openshift.io/required-scc: restricted-v2 + labels: + k8s-app: machine-api-migration + spec: + serviceAccountName: machine-api-migration + containers: + - name: machine-api-migration + image: registry.ci.openshift.org/openshift:cluster-capi-operator + command: + - /machine-api-migration + args: + - --diagnostics-address=:8443 + env: + - name: RELEASE_VERSION + value: "0.0.1-snapshot" + ports: + - containerPort: 8443 + name: diagnostics + protocol: TCP + - containerPort: 9440 + name: healthz + protocol: TCP + resources: + requests: + cpu: 10m + memory: 50Mi + securityContext: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - name: metrics-cert + mountPath: /tmp/k8s-metrics-server/serving-certs + readOnly: true + nodeSelector: + node-role.kubernetes.io/control-plane: "" + priorityClassName: system-cluster-critical + restartPolicy: Always + tolerations: + - key: "node-role.kubernetes.io/master" + operator: "Exists" + effect: "NoSchedule" + - key: "node-role.kubernetes.io/control-plane" + operator: "Exists" + effect: "NoSchedule" + volumes: + - name: metrics-cert + secret: + defaultMode: 420 + secretName: machine-api-migration-metrics-tls diff --git a/ocp-manifests-input/default/capi-controllers-deployment.yaml b/ocp-manifests-input/default/capi-controllers-deployment.yaml index 0f864a11f..fda218738 100644 --- a/ocp-manifests-input/default/capi-controllers-deployment.yaml +++ b/ocp-manifests-input/default/capi-controllers-deployment.yaml @@ -36,10 +36,10 @@ spec: name: webhook-server protocol: TCP - containerPort: 8443 - name: diagnostics-o + name: diagnostics protocol: TCP - containerPort: 9440 - name: healthz-o + name: healthz protocol: TCP resources: requests: @@ -53,32 +53,6 @@ spec: - name: metrics-cert mountPath: /tmp/k8s-metrics-server/serving-certs readOnly: true - - name: machine-api-migration - image: registry.ci.openshift.org/openshift:cluster-capi-operator - command: - - /machine-api-migration - args: - - --diagnostics-address=:8442 - - --health-addr=:9441 - env: - - name: RELEASE_VERSION - value: "0.0.1-snapshot" - ports: - - containerPort: 8442 - name: diagnostics-m - protocol: TCP - - containerPort: 9441 - name: healthz-m - protocol: TCP - resources: - requests: - cpu: 10m - memory: 50Mi - terminationMessagePolicy: FallbackToLogsOnError - volumeMounts: - - name: metrics-cert - mountPath: /tmp/k8s-metrics-server/serving-certs - readOnly: true nodeSelector: node-role.kubernetes.io/control-plane: "" priorityClassName: system-cluster-critical