Draft: Support Openshifts cert-manager-operator

.cruft.json

@@ -1,17 +1,17 @@
 {
   "template": "https://github.com/projectsyn/commodore-component-template.git",
-  "commit": "a4aff6a9d004c1aad085a875c7759c8f8f1e0d3d",
+  "commit": "7803d07f1d79fc8b902fcafbb336b6b0a4b57b90",
   "checkout": "main",
   "context": {
     "cookiecutter": {
       "name": "cert-manager",
       "slug": "cert-manager",
       "parameter_key": "cert_manager",
-      "test_cases": "defaults",
+      "test_cases": "defaults operator",
       "add_lib": "y",
       "add_pp": "y",
       "add_golden": "y",
-      "add_matrix": "n",
+      "add_matrix": "y",
       "add_go_unit": "n",
       "copyright_holder": "VSHN AG <[email protected]>",
       "copyright_year": "2021",

.github/workflows/test.yaml

@@ -29,6 +29,11 @@ jobs:
           args: 'check'
   test:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        instance:
+          - defaults
+          - operator
     defaults:
       run:
         working-directory: ${{ env.COMPONENT_NAME }}
@@ -37,9 +42,14 @@ jobs:
         with:
           path: ${{ env.COMPONENT_NAME }}
       - name: Compile component
-        run: make test
+        run: make test -e instance=${{ matrix.instance }}
   golden:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        instance:
+          - defaults
+          - operator
     defaults:
       run:
         working-directory: ${{ env.COMPONENT_NAME }}
@@ -48,4 +58,4 @@ jobs:
         with:
           path: ${{ env.COMPONENT_NAME }}
       - name: Golden diff
-        run: make golden-diff
+        run: make golden-diff -e instance=${{ matrix.instance }}

Makefile

@@ -71,6 +71,22 @@ golden-diff: commodore_args += -f tests/$(instance).yml
 golden-diff: clean .compile ## Diff compile output against the reference version. Review output and run `make gen-golden golden-diff` if this target fails.
 	@git diff --exit-code --minimal --no-index -- tests/golden/$(instance) compiled/
 
+.PHONY: golden-diff-all
+golden-diff-all: recursive_target=golden-diff
+golden-diff-all: $(test_instances) ## Run golden-diff for all instances. Note: this doesn't work when running make with multiple parallel jobs (-j != 1).
+
+.PHONY: gen-golden-all
+gen-golden-all: recursive_target=gen-golden
+gen-golden-all: $(test_instances) ## Run gen-golden for all instances. Note: this doesn't work when running make with multiple parallel jobs (-j != 1).
+
+.PHONY: lint_kubent_all
+lint_kubent_all: recursive_target=lint_kubent
+lint_kubent_all: $(test_instances) ## Lint deprecated Kubernetes API versions for all golden test instances. Will exit on first error. Note: this doesn't work when running make with multiple parallel jobs (-j != 1).
+
+.PHONY: $(test_instances)
+$(test_instances):
+	$(MAKE) $(recursive_target) -e instance=$(basename $(@F))
+
 .PHONY: clean
 clean: ## Clean the project
 	rm -rf .cache compiled dependencies vendor helmcharts jsonnetfile*.json || true

Makefile.vars.mk

@@ -57,3 +57,4 @@ KUBENT_IMAGE    ?= ghcr.io/doitintl/kube-no-trouble:latest
 KUBENT_DOCKER   ?= $(DOCKER_CMD) $(DOCKER_ARGS) $(root_volume) --entrypoint=/app/kubent $(KUBENT_IMAGE)
 
 instance ?= defaults
+test_instances = tests/defaults.yml tests/operator.yml

class/cert-manager.yml

@@ -1,37 +1,67 @@
 parameters:
-  kapitan:
-    dependencies:
-      - type: helm
-        source: https://charts.jetstack.io
-        chart_name: cert-manager
-        version: ${cert_manager:charts:cert-manager}
-        output_path: ${_base_directory}/helmcharts/cert-manager/${cert_manager:charts:cert-manager}/
+  =_kapitan:
+    olm:
+      compile:
+        # common
+        - input_type: jsonnet
+          input_paths:
+            - ${_base_directory}/component/app.jsonnet
+          output_type: yaml
+          output_path: apps/
+        - input_type: jsonnet
+          input_paths:
+            - ${_base_directory}/component/namespace.jsonnet
+          output_type: yaml
+          output_path: cert-manager/
+        - input_type: jsonnet
+          input_paths:
+            - ${_base_directory}/component/main.jsonnet
+          output_type: yaml
+          output_path: cert-manager/02_issuers
+        # install-method specific
+        - input_type: jsonnet
+          input_paths:
+            - ${_base_directory}/component/operator.jsonnet
+          output_type: yaml
+          output_path: cert-manager/01_operator
+    helm:
+      dependencies:
+        - type: helm
+          source: https://charts.jetstack.io
+          chart_name: cert-manager
+          version: ${cert_manager:charts:cert-manager}
+          output_path: ${_base_directory}/helmcharts/cert-manager/${cert_manager:charts:cert-manager}/
+      compile:
+        # common
+        - input_type: jsonnet
+          input_paths:
+            - ${_base_directory}/component/app.jsonnet
+          output_type: yaml
+          output_path: apps/
+        - input_type: jsonnet
+          input_paths:
+            - ${_base_directory}/component/namespace.jsonnet
+          output_type: yaml
+          output_path: cert-manager/
+        - input_type: jsonnet
+          input_paths:
+            - ${_base_directory}/component/main.jsonnet
+          output_type: yaml
+          output_path: cert-manager/02_issuers
+        # install-method specific
+        - input_type: jsonnet
+          input_paths:
+            - ${_base_directory}/component/upgrade.jsonnet
+          output_type: yaml
+          output_path: cert-manager/03_upgrade
+        - input_type: helm
+          input_paths:
+            - ${_base_directory}/helmcharts/cert-manager/${cert_manager:charts:cert-manager}/
+          output_path: cert-manager/01_helmchart
+          helm_values: ${cert_manager:helm_values}
+          helm_params:
+            name: cert-manager
+            namespace: ${cert_manager:namespace}
 
-    compile:
-      - input_paths:
-          - ${_base_directory}/component/app.jsonnet
-        input_type: jsonnet
-        output_path: apps/
-      - output_path: cert-manager/01_helmchart
-        input_type: helm
-        input_paths:
-          - ${_base_directory}/helmcharts/cert-manager/${cert_manager:charts:cert-manager}/
-        helm_values: ${cert_manager:helm_values}
-        helm_params:
-          name: cert-manager
-          namespace: ${cert_manager:namespace}
-      - output_path: cert-manager/
-        input_type: jsonnet
-        output_type: yaml
-        input_paths:
-          - ${_base_directory}/component/namespace.jsonnet
-      - output_path: cert-manager/02_issuers
-        input_type: jsonnet
-        output_type: yaml
-        input_paths:
-          - ${_base_directory}/component/main.jsonnet
-      - output_path: cert-manager/03_upgrade
-        input_type: jsonnet
-        output_type: yaml
-        input_paths:
-          - ${_base_directory}/component/upgrade.jsonnet
+  kapitan:
+    ${_kapitan:${cert_manager:install_method}}

class/defaults.yml

@@ -1,32 +1,40 @@
 parameters:
   cert_manager:
     namespace: syn-cert-manager
-    dns01-recursive-nameservers: "1.1.1.1:53"
+    install_method: helm
+
     charts:
       cert-manager: v1.13.2
+
+    images:
+      kubectl:
+        registry: quay.io
+        image: appuio/oc
+        tag: 'v4.13'
+
     http_proxy: ""
     https_proxy: ""
     no_proxy: ""
+
+    dns01-recursive-nameservers: "1.1.1.1:53"
+
     letsencrypt_clusterissuers:
       staging: true
       production: true
+
     solvers:
       nginx_http01:
         http01:
           ingress:
             class: 'nginx'
+
     secrets: {}
     acme_dns_api: {}
     # acme_dns_api:
     #   endpoint: acme-dns-api.example.com
     #   username: dns_api_registration_user
     #   password: dns_api_registration_password
     #   fqdns: [ "api.cluster.example.com", "apps.cluster.example.com" ]
-    images:
-      kubectl:
-        registry: quay.io
-        image: appuio/oc
-        tag: 'v4.13'
 
     helm_values:
       global:
@@ -60,3 +68,7 @@ parameters:
           requests:
             cpu: 50m
             memory: 512Mi
+
+    olm:
+      channel: stable-v1
+      resources: {}

component/namespace.jsonnet

@@ -5,18 +5,25 @@ local prom = import 'lib/prometheus.libsonnet';
 local inv = kap.inventory();
 local params = inv.parameters.cert_manager;
 
-local namespace = kube.Namespace(params.namespace) {
-  metadata+: {
-    labels+: {
-      'openshift.io/cluster-monitoring': 'true',
-    },
-  },
-};
+local isOpenshift = std.startsWith(inv.parameters.facts.distribution, 'openshift');
+
+local namespace = kube.Namespace(params.namespace);
 
 {
   '00_namespace':
     if std.member(inv.applications, 'prometheus') then
       prom.RegisterNamespace(namespace)
+    else if isOpenshift then
+      namespace {
+        metadata+: {
+          annotations+: {
+            'openshift.io/node-selector': 'infra',
+          },
+          labels+: {
+            'openshift.io/cluster-monitoring': 'true',
+          },
+        },
+      }
     else
       namespace,
 }

component/operator.jsonnet

@@ -0,0 +1,46 @@
+local com = import 'lib/commodore.libjsonnet';
+local kap = import 'lib/kapitan.libjsonnet';
+local kube = import 'lib/kube.libjsonnet';
+local operatorlib = import 'lib/openshift4-operators.libsonnet';
+
+local inv = kap.inventory();
+local params = inv.parameters.cert_manager;
+
+local isOpenshift = std.startsWith(inv.parameters.facts.distribution, 'openshift');
+assert isOpenshift : 'olm install_method only available on Openshift';
+
+local operator_group = operatorlib.OperatorGroup('syn-cert-manager') {
+  metadata+: {
+    labels+: {
+      'app.kubernetes.io/managed-by': 'commodore',
+    },
+    namespace: params.namespace,
+  },
+  spec: {
+    targetNamespaces: [
+      params.namespace,
+    ],
+  },
+};
+
+local subscriptions = operatorlib.namespacedSubscription(
+  params.namespace,
+  'openshift-cert-manager-operator',
+  params.olm.channel,
+  'redhat-operators'
+) {
+  labels+: {
+    'app.kubernetes.io/managed-by': 'commodore',
+  },
+  spec+: {
+    config+: {
+      resources: params.olm.resources,
+    },
+  },
+};
+
+
+{
+  '00_operator_group': operator_group,
+  '10_subscriptions': subscriptions,
+}

renovate.json

@@ -9,7 +9,7 @@
   ],
   "postUpgradeTasks": {
     "commands": [
-      "make gen-golden"
+      "make gen-golden-all"
     ],
     "fileFilters": [ "tests/golden/**" ],
     "executionMode": "update"

tests/golden/defaults/cert-manager/cert-manager/00_namespace.yaml

@@ -5,5 +5,4 @@ metadata:
   labels:
     monitoring.syn.tools/infra-monitoring: 'true'
     name: syn-cert-manager
-    openshift.io/cluster-monitoring: 'true'
   name: syn-cert-manager

tests/golden/operator/cert-manager/apps/cert-manager.yaml

@@ -0,0 +1,13 @@
+spec:
+  ignoreDifferences:
+    - jsonPointers:
+        - /data
+      kind: Secret
+      name: acme-dns-client
+      namespace: syn-cert-manager
+    - group: admissionregistration.k8s.io
+      jqPathExpressions:
+        - .webhooks[].namespaceSelector.matchExpressions[] | select(.key == "control-plane")
+        - .webhooks[].namespaceSelector.matchExpressions[] | select(.key == "kubernetes.azure.com/managedby")
+      kind: ValidatingWebhookConfiguration
+      name: cert-manager-webhook

tests/golden/operator/cert-manager/cert-manager/00_namespace.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    openshift.io/node-selector: infra
+  labels:
+    name: syn-cert-manager
+    openshift.io/cluster-monitoring: 'true'
+  name: syn-cert-manager

tests/golden/operator/cert-manager/cert-manager/01_operator/00_operator_group.yaml

@@ -0,0 +1,12 @@
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/managed-by: commodore
+    name: syn-cert-manager
+  name: syn-cert-manager
+  namespace: syn-cert-manager
+spec:
+  targetNamespaces:
+    - syn-cert-manager

tests/golden/operator/cert-manager/cert-manager/01_operator/10_subscriptions.yaml

@@ -0,0 +1,25 @@
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+labels:
+  app.kubernetes.io/managed-by: commodore
+metadata:
+  annotations: {}
+  labels:
+    name: openshift-cert-manager-operator
+  name: openshift-cert-manager-operator
+  namespace: syn-cert-manager
+spec:
+  channel: stable-v1
+  config:
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: node-role.kubernetes.io/infra
+                  operator: Exists
+    resources: {}
+  installPlanApproval: Automatic
+  name: openshift-cert-manager-operator
+  source: redhat-operators
+  sourceNamespace: openshift-operators-redhat