Skip to content

Commit 9ceac49

Browse files
sriram-30sajmera-pensando
sriram-30
authored and
sajmera-pensando
committed
Utils Container Openshift Security Context Constraint access
1 parent 69278a2 commit 9ceac49

File tree

17 files changed

+217
-9
lines changed

17 files changed

+217
-9
lines changed

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -353,7 +353,7 @@ bundle-build: operator-sdk manifests kustomize ## OpenShift Build OLM bundle.
353353
cd config/manager && $(KUSTOMIZE) edit set image controller=$(IMG)
354354
cd config/manager-base && $(KUSTOMIZE) edit set image controller=$(IMG)
355355
OPERATOR_SDK="${OPERATOR_SDK}" \
356-
BUNDLE_GEN_FLAGS="${BUNDLE_GEN_FLAGS} --extra-service-accounts amd-gpu-operator-kmm-device-plugin,amd-gpu-operator-kmm-module-loader,amd-gpu-operator-node-labeller,amd-gpu-operator-metrics-exporter,amd-gpu-operator-metrics-exporter-rbac-proxy,amd-gpu-operator-test-runner,amd-gpu-operator-config-manager" \
356+
BUNDLE_GEN_FLAGS="${BUNDLE_GEN_FLAGS} --extra-service-accounts amd-gpu-operator-kmm-device-plugin,amd-gpu-operator-kmm-module-loader,amd-gpu-operator-node-labeller,amd-gpu-operator-metrics-exporter,amd-gpu-operator-metrics-exporter-rbac-proxy,amd-gpu-operator-test-runner,amd-gpu-operator-config-manager,amd-gpu-operator-utils-container" \
357357
PKG=amd-gpu-operator \
358358
SOURCE_DIR=$(dir $(realpath $(lastword $(MAKEFILE_LIST)))) \
359359
KUBECTL_CMD=${KUBECTL_CMD} ./hack/generate-bundle

‎bundle/manifests/amd-gpu-operator.clusterserviceversion.yaml‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ metadata:
3030
}
3131
]
3232
capabilities: Basic Install
33-
createdAt: "2025-03-18T22:58:17Z"
33+
createdAt: "2025-03-20T06:06:57Z"
3434
operatorframework.io/suggested-namespace: openshift-amd-gpu
3535
operators.operatorframework.io/builder: operator-sdk-v1.32.0
3636
operators.operatorframework.io/project_layout: go.kubebuilder.io/v3
@@ -955,6 +955,16 @@ spec:
955955
verbs:
956956
- use
957957
serviceAccountName: amd-gpu-operator-test-runner
958+
- rules:
959+
- apiGroups:
960+
- security.openshift.io
961+
resourceNames:
962+
- privileged
963+
resources:
964+
- securitycontextconstraints
965+
verbs:
966+
- use
967+
serviceAccountName: amd-gpu-operator-utils-container
958968
deployments:
959969
- label:
960970
app.kubernetes.io/component: amd-gpu

‎config/rbac/kustomization.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,6 @@ resources:
2222
- test_runner_service_account.yaml
2323
- test_runner_role.yaml
2424
- test_runner_role_binding.yaml
25+
- utils_container_service_account.yaml
26+
- utils_container_role.yaml
27+
- utils_container_role_binding.yaml

‎config/rbac/utils_container_role.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: utils-container
5+
rules:
6+
- apiGroups:
7+
- security.openshift.io
8+
resourceNames:
9+
- privileged
10+
resources:
11+
- securitycontextconstraints
12+
verbs:
13+
- use

‎config/rbac/utils_container_role_binding.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
name: utils-container
5+
subjects:
6+
- kind: ServiceAccount
7+
name: utils-container
8+
roleRef:
9+
kind: ClusterRole
10+
name: utils-container
11+
apiGroup: rbac.authorization.k8s.io

‎config/rbac/utils_container_service_account.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: utils-container

‎hack/k8s-patch/metadata-patch/values.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,9 @@ testRunner:
101101
configManager:
102102
serviceAccount:
103103
annotations: {}
104+
utilsContainer:
105+
serviceAccount:
106+
annotations: {}
104107
global:
105108
proxy:
106109
env: {}

‎hack/k8s-patch/template-patch/serviceaccount.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,3 +85,14 @@ metadata:
8585
{{- include "helm-charts-k8s.labels" . | nindent 4 }}
8686
annotations:
8787
{{- toYaml .Values.configManager.serviceAccount.annotations | nindent 4 }}
88+
---
89+
apiVersion: v1
90+
kind: ServiceAccount
91+
metadata:
92+
name: amd-gpu-operator-utils-container
93+
labels:
94+
app.kubernetes.io/component: amd-gpu
95+
app.kubernetes.io/part-of: amd-gpu
96+
{{- include "helm-charts-k8s.labels" . | nindent 4 }}
97+
annotations:
98+
{{- toYaml .Values.utilsContainer.serviceAccount.annotations | nindent 4 }}

‎hack/k8s-patch/template-patch/utils-container-rbac.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: {{ include "helm-charts-k8s.fullname" . }}-utils-container
5+
labels:
6+
app.kubernetes.io/component: amd-gpu
7+
app.kubernetes.io/part-of: amd-gpu
8+
{{- include "helm-charts-k8s.labels" . | nindent 4 }}
9+
rules:
10+
- apiGroups:
11+
- security.openshift.io
12+
resourceNames:
13+
- privileged
14+
resources:
15+
- securitycontextconstraints
16+
verbs:
17+
- use
18+
---
19+
apiVersion: rbac.authorization.k8s.io/v1
20+
kind: ClusterRoleBinding
21+
metadata:
22+
name: {{ include "helm-charts-k8s.fullname" . }}-utils-container
23+
labels:
24+
app.kubernetes.io/component: amd-gpu
25+
app.kubernetes.io/part-of: amd-gpu
26+
{{- include "helm-charts-k8s.labels" . | nindent 4 }}
27+
roleRef:
28+
apiGroup: rbac.authorization.k8s.io
29+
kind: ClusterRole
30+
name: '{{ include "helm-charts-k8s.fullname" . }}-utils-container'
31+
subjects:
32+
- kind: ServiceAccount
33+
name: amd-gpu-operator-utils-container
34+
namespace: '{{ .Release.Namespace }}'

‎hack/openshift-patch/template-patch/utils-container-rbac.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: {{ include "helm-charts-openshift.fullname" . }}-utils-container
5+
labels:
6+
app.kubernetes.io/component: amd-gpu
7+
app.kubernetes.io/part-of: amd-gpu
8+
{{- include "helm-charts-openshift.labels" . | nindent 4 }}
9+
rules:
10+
- apiGroups:
11+
- security.openshift.io
12+
resourceNames:
13+
- privileged
14+
resources:
15+
- securitycontextconstraints
16+
verbs:
17+
- use
18+
---
19+
apiVersion: rbac.authorization.k8s.io/v1
20+
kind: ClusterRoleBinding
21+
metadata:
22+
name: {{ include "helm-charts-openshift.fullname" . }}-utils-container
23+
labels:
24+
app.kubernetes.io/component: amd-gpu
25+
app.kubernetes.io/part-of: amd-gpu
26+
{{- include "helm-charts-openshift.labels" . | nindent 4 }}
27+
roleRef:
28+
apiGroup: rbac.authorization.k8s.io
29+
kind: ClusterRole
30+
name: '{{ include "helm-charts-openshift.fullname" . }}-utils-container'
31+
subjects:
32+
- kind: ServiceAccount
33+
name: amd-gpu-operator-utils-container
34+
namespace: '{{ .Release.Namespace }}'

0 commit comments

Comments
 (0)