Squashed 'cluster-config/' content from commit 654f2390

git-subtree-dir: cluster-config
git-subtree-split: 654f23903bd1f9a27a4810bd289d165b6cfdbb0c

components/amq-streams-v1/base/README.md

@@ -0,0 +1 @@
+Experimenting with OLM v1

components/amq-streams-v1/base/clusterextension.yaml

@@ -0,0 +1,15 @@
+apiVersion: olm.operatorframework.io/v1
+kind: ClusterExtension
+metadata:
+  name: amq-streams
+spec:
+  namespace: amq-streams-operator
+  serviceAccount:
+    name: amq-streams-installer
+  source:
+    sourceType: Catalog
+    catalog:
+      packageName: amq-streams
+      channels:
+        - amq-streams-2.9.x
+      upgradeConstraintPolicy: CatalogProvided

components/amq-streams-v1/base/clusterrole.yaml

@@ -0,0 +1,398 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: amq-streams-installer-clusterrole
+rules:
+  # ClusterRoles and ClusterRoleBindings for the controllers of the extension
+  - apiGroups:
+    - rbac.authorization.k8s.io
+    resources:
+    - clusterroles
+    verbs:
+    - "*"
+  - apiGroups:
+    - rbac.authorization.k8s.io
+    resources:
+    - clusterrolebindings
+    verbs:
+    - "*"
+  - apiGroups:
+    - olm.operatorframework.io
+    resources:
+    - clusterextensions/finalizers
+    verbs:
+    - update
+    # Scoped to the name of the ClusterExtension
+    resourceNames:
+    - amq-streams # the value from <metadata.name> from the extension's custom resource (CR)
+  # Deployments specified in install.spec.deployments
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - list
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - get
+    - update
+    - patch
+    - delete
+    # scoped to the extension controller deployment name
+    resourceNames:
+    - amq-streams-cluster-operator
+    - amq-streams-cluster-operator-v2.9.0-0
+  # Service accounts in the CSV
+  - apiGroups:
+    - ""
+    resources:
+    - serviceaccounts
+    verbs:
+    - create
+    - list
+    - watch
+  - apiGroups:
+    - ""
+    resources:
+    - serviceaccounts
+    verbs:
+    - get
+    - update
+    - patch
+    - delete
+    # scoped to the extension controller's deployment service account
+    resourceNames:
+    - strimzi-cluster-operator
+  # configmaps
+  - apiGroups:
+    - ""
+    resources:
+    - configmaps
+    verbs:
+    - create
+  - apiGroups:
+    - ""
+    resources:
+    - configmaps
+    verbs:
+    - get
+    - list
+    - watch
+    - update
+    - patch
+    - delete
+    # scoped to the configmap name
+    resourceNames:
+    - strimzi-cluster-operator
+  - apiGroups:
+    - apiextensions.k8s.io
+    resources:
+    - customresourcedefinitions
+    verbs:
+    - create
+    - list
+    - watch
+  - apiGroups:
+    - apiextensions.k8s.io
+    resources:
+    - customresourcedefinitions
+    verbs:
+    - get
+    - update
+    - patch
+    - delete
+    resourceNames:
+    - kafkas.kafka.strimzi.io
+    - kafkanodepools.kafka.strimzi.io
+    - kafkaconnects.kafka.strimzi.io
+    - kafkamirrormakers.kafka.strimzi.io
+    - kafkabridges.kafka.strimzi.io
+    - kafkatopics.kafka.strimzi.io
+    - kafkausers.kafka.strimzi.io
+    - kafkaconnectors.kafka.strimzi.io
+    - kafkamirrormaker2s.kafka.strimzi.io
+    - kafkarebalances.kafka.strimzi.io
+    - strimzipodsets.core.strimzi.io
+  # install permissions from CSV
+  - apiGroups:
+    - "rbac.authorization.k8s.io"
+    resources:
+      # The cluster operator needs to access and manage rolebindings to grant Strimzi components cluster permissions
+    - rolebindings
+    verbs:
+    - get
+    - list
+    - watch
+    - create
+    - delete
+    - patch
+    - update
+  - apiGroups:
+    - "rbac.authorization.k8s.io"
+    resources:
+      # The cluster operator needs to access and manage roles to grant the entity operator permissions
+    - roles
+    verbs:
+    - get
+    - list
+    - watch
+    - create
+    - delete
+    - patch
+    - update
+  - apiGroups:
+    - ""
+    resources:
+      # The cluster operator needs to access and delete pods, this is to allow it to monitor pod health and coordinate rolling updates
+    - pods
+      # The cluster operator needs to access and manage service accounts to grant Strimzi components cluster permissions
+    - serviceaccounts
+      # The cluster operator needs to access and manage config maps for Strimzi components configuration
+    - configmaps
+      # The cluster operator needs to access and manage services and endpoints to expose Strimzi components to network traffic
+    - services
+    - endpoints
+      # The cluster operator needs to access and manage secrets to handle credentials
+      # The entity operator user-operator needs to access and manage secrets to store generated credentials
+    - secrets
+      # The cluster operator needs to access and manage persistent volume claims to bind them to Strimzi components for persistent data
+    - persistentvolumeclaims
+    verbs:
+    - get
+    - list
+    - watch
+    - create
+    - delete
+    - patch
+    - update
+  - apiGroups:
+    - "kafka.strimzi.io"
+    resources:
+      # The Cluster Operator operates the Strimzi custom resources
+    - kafkas
+    - kafkanodepools
+    - kafkaconnects
+    - kafkaconnectors
+    - kafkamirrormakers
+    - kafkabridges
+    - kafkamirrormaker2s
+    - kafkarebalances
+    - kafkatopics
+    - kafkausers
+    verbs:
+    - get
+    - list
+    - watch
+    - create
+    - delete
+    - patch
+    - update
+  - apiGroups:
+    - "kafka.strimzi.io"
+    resources:
+      # The Cluster Operator needs to manage the status of the Strimzi custom resources
+    - kafkas/status
+    - kafkanodepools/status
+    - kafkaconnects/status
+    - kafkaconnectors/status
+    - kafkamirrormakers/status
+    - kafkabridges/status
+    - kafkamirrormaker2s/status
+    - kafkarebalances/status
+    - kafkatopics/status
+    - kafkausers/status
+    verbs:
+    - get
+    - patch
+    - update
+  - apiGroups:
+    - "core.strimzi.io"
+    resources:
+      # The cluster operator uses StrimziPodSets to manage the Kafka and ZooKeeper pods
+    - strimzipodsets
+    verbs:
+    - get
+    - list
+    - watch
+    - create
+    - delete
+    - patch
+    - update
+  - apiGroups:
+    - "core.strimzi.io"
+    resources:
+      # The Cluster Operator needs to manage the status of the StrimziPodSet custom resource
+    - strimzipodsets/status
+    verbs:
+    - get
+    - patch
+    - update
+  - apiGroups:
+    - "kafka.strimzi.io"
+    resources:
+      # The Cluster Operator needs deletion for KafkaRebalance only (during auto-rebalancing)
+    - kafkarebalances
+    verbs:
+    - delete
+  - apiGroups:
+    - "apps"
+    resources:
+      # The cluster operator needs to access and manage deployments to run deployment based Strimzi components
+    - deployments
+      # The cluster operator needs to access and manage stateful sets to run stateful sets based Strimzi components
+    - statefulsets
+      # The cluster operator needs to access replica-sets to manage Strimzi components and to determine error states
+    - replicasets
+    verbs:
+    - get
+    - list
+    - watch
+    - create
+    - delete
+    - patch
+    - update
+  - apiGroups:
+    - "apps"
+    resources:
+      # The Cluster Operator needs to scale Deployments while migrating Connect and Mirror Maker 2 clusters from Deployments to StrimziPodSets
+    - deployments/scale
+    verbs:
+    - get
+    - patch
+    - update
+  - apiGroups:
+    - ""   # legacy core events api, used by topic operator
+    - "events.k8s.io"   # new events api, used by cluster operator
+    resources:
+    - events
+    verbs:
+    - create
+  - apiGroups:
+      # Kafka Connect Build on OpenShift requirement
+    - build.openshift.io
+    resources:
+    - buildconfigs
+    - buildconfigs/instantiate
+    - builds
+    verbs:
+    - get
+    - list
+    - watch
+    - create
+    - delete
+    - patch
+    - update
+  - apiGroups:
+    - networking.k8s.io
+    resources:
+      # The cluster operator needs to access and manage network policies to lock down communication between Strimzi components
+    - networkpolicies
+      # The cluster operator needs to access and manage ingresses which allow external access to the services in a cluster
+    - ingresses
+    verbs:
+    - get
+    - list
+    - watch
+    - create
+    - delete
+    - patch
+    - update
+  - apiGroups:
+    - route.openshift.io
+    resources:
+      # The cluster operator needs to access and manage routes to expose Strimzi components for external access
+    - routes
+    - routes/custom-host
+    verbs:
+    - get
+    - list
+    - watch
+    - create
+    - delete
+    - patch
+    - update
+  - apiGroups:
+    - image.openshift.io
+    resources:
+      # The cluster operator needs to verify the image stream when used for Kafka Connect image build
+    - imagestreams
+    verbs:
+    - get
+  - apiGroups:
+    - policy
+    resources:
+      # The cluster operator needs to access and manage pod disruption budgets this limits the number of concurrent disruptions
+      # that a Streams component experiences, allowing for higher availability
+    - poddisruptionbudgets
+    verbs:
+    - get
+    - list
+    - watch
+    - create
+    - delete
+    - patch
+    - update
+  - apiGroups:
+    - coordination.k8s.io
+    resources:
+      # The cluster operator needs to access and manage leases for leader election
+      # The "create" verb cannot be used with "resourceNames"
+    - leases
+    verbs:
+    - create
+  - apiGroups:
+    - coordination.k8s.io
+    resources:
+      # The cluster operator needs to access and manage leases for leader election
+    - leases
+    resourceNames:
+      # The default RBAC files give the operator only access to the Lease resource names strimzi-cluster-operator
+      # If you want to use another resource name or resource namespace, you have to configure the RBAC resources accordingly
+    - strimzi-cluster-operator
+    verbs:
+    - get
+    - list
+    - watch
+    - delete
+    - patch
+    - update
+  # Cluster permissions from CSV
+  - apiGroups:
+    - "rbac.authorization.k8s.io"
+    resources:
+    # The cluster operator needs to create and manage cluster role bindings in the case of an install where a user
+    # has specified they want their cluster role bindings generated
+    - clusterrolebindings
+    verbs:
+    - get
+    - list
+    - watch
+    - create
+    - delete
+    - patch
+    - update
+  - apiGroups:
+    - storage.k8s.io
+    resources:
+    # The cluster operator requires "get" permissions to view storage class details
+    # This is because only a persistent volume of a supported storage class type can be resized
+    - storageclasses
+    verbs:
+    - get
+  - apiGroups:
+    - ""
+    resources:
+    # The cluster operator requires "list" permissions to view all nodes in a cluster
+    # The listing is used to determine the node addresses when NodePort access is configured
+    # These addresses are then exposed in the custom resource states
+    # The Kafka Brokers require "get" permissions to view the node they are on
+    # This information is used to generate a Rack ID that is used for High Availability configurations
+    - nodes
+    verbs:
+    - get
+    - list

components/amq-streams-v1/base/clusterrolebinding.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: amq-streams-installer-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: amq-streams-installer-clusterrole
+subjects:
+- kind: ServiceAccount
+  name: amq-streams-installer
+  namespace: amq-streams-operator

components/amq-streams-v1/base/kustomization.yaml

@@ -0,0 +1,6 @@
+resources:
+- namespace.yaml
+- clusterrole.yaml
+- clusterrolebinding.yaml
+- serviceaccount.yaml
+- clusterextension.yaml

components/amq-streams-v1/base/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: amq-streams-operator

components/amq-streams-v1/base/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: amq-streams-installer
+  namespace: amq-streams-operator