Skip to content

Commit 203a054

Browse files
author
Debakel Orakel
committed
Remove patch-operator dependency
1 parent 11c7cf5 commit 203a054

3 files changed

Lines changed: 179 additions & 33 deletions

File tree

‎component/build-strategy.jsonnet‎

Lines changed: 90 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,107 @@
11
local common = import 'common.libsonnet';
2+
local esp = import 'lib/espejote.libsonnet';
23
local kap = import 'lib/kapitan.libjsonnet';
34
local kube = import 'lib/kube.libjsonnet';
4-
local po = import 'lib/patch-operator.libsonnet';
5-
local inv = kap.inventory();
5+
66
// The hiera parameters for the component
7+
local inv = kap.inventory();
78
local params = inv.parameters.appuio_cloud;
89

9-
// See https://docs.openshift.com/container-platform/4.8/cicd/builds/securing-builds-by-strategy.html#builds-disabling-build-strategy-globally_securing-builds-by-strategy
10-
local bindingToPatch = kube.ClusterRoleBinding('system:build-strategy-docker-binding');
10+
local metadataPatch = {
11+
annotations+: {
12+
'syn.tools/source': 'https://github.com/appuio/component-appuio-cloud.git',
13+
},
14+
labels+: {
15+
'app.kubernetes.io/managed-by': 'espejote',
16+
'app.kubernetes.io/part-of': 'syn',
17+
'app.kubernetes.io/component': 'appuio-cloud',
18+
},
19+
};
1120

12-
local disallowDockerBuildStrategyPatch = {
21+
// See https://docs.openshift.com/container-platform/4.8/cicd/builds/securing-builds-by-strategy.html#builds-disabling-build-strategy-globally_securing-builds-by-strategy
22+
local patch = {
23+
apiVersion: 'rbac.authorization.k8s.io/v1',
24+
kind: 'ClusterRoleBinding',
1325
metadata: {
1426
annotations: {
1527
'rbac.authorization.kubernetes.io/autoupdate': 'false',
1628
},
29+
name: 'system:build-strategy-docker-binding',
1730
},
1831
subjects: [],
1932
};
2033

34+
local serviceAccount = {
35+
apiVersion: 'v1',
36+
kind: 'ServiceAccount',
37+
metadata: {
38+
name: 'rbac-clusterrolebinding-system-build-strategy-docker-binding',
39+
namespace: inv.parameters.espejote.namespace,
40+
} + metadataPatch,
41+
};
42+
43+
local clusterRole = {
44+
apiVersion: 'rbac.authorization.k8s.io/v1',
45+
kind: 'ClusterRole',
46+
metadata: {
47+
name: 'syn-espejote:rbac-clusterrolebinding-system-build-strategy-docker-binding',
48+
} + metadataPatch,
49+
rules: [
50+
{
51+
apiGroups: [ 'rbac.authorization.k8s.io' ],
52+
resources: [ 'clusterrolebindings' ],
53+
resourceNames: [ 'system:build-strategy-docker-binding' ],
54+
verbs: [ '*' ],
55+
},
56+
],
57+
};
58+
59+
local clusterRoleBinding = {
60+
apiVersion: 'rbac.authorization.k8s.io/v1',
61+
kind: 'ClusterRoleBinding',
62+
metadata: {
63+
name: 'syn-espejote:rbac-clusterrolebinding-system-build-strategy-docker-binding',
64+
} + metadataPatch,
65+
roleRef: {
66+
apiGroup: 'rbac.authorization.k8s.io',
67+
kind: 'ClusterRole',
68+
name: clusterRole.metadata.name,
69+
},
70+
subjects: [
71+
{
72+
kind: 'ServiceAccount',
73+
name: serviceAccount.metadata.name,
74+
namespace: serviceAccount.metadata.namespace,
75+
},
76+
],
77+
};
78+
79+
local managedResource = esp.managedResource('rbac-clusterrolebinding-system-build-strategy-docker-binding', inv.parameters.espejote.namespace) {
80+
metadata+: metadataPatch,
81+
spec: {
82+
applyOptions: {
83+
force: true,
84+
},
85+
serviceAccountRef: {
86+
name: serviceAccount.metadata.name,
87+
},
88+
template: std.manifestJson(patch),
89+
triggers: [ {
90+
name: 'clusterrolebinding',
91+
watchResource: {
92+
apiVersion: patch.apiVersion,
93+
kind: patch.kind,
94+
name: patch.metadata.name,
95+
},
96+
} ],
97+
},
98+
};
99+
21100
{
22-
[if params.disallowDockerBuildStrategy then '15_disallow_docker_build_strategy_patch']:
23-
po.Patch(bindingToPatch, disallowDockerBuildStrategyPatch),
101+
[if params.disallowDockerBuildStrategy then '15_disallow_docker_build_strategy_patch']: [
102+
serviceAccount,
103+
clusterRole,
104+
clusterRoleBinding,
105+
managedResource,
106+
],
24107
}

‎tests/defaults.yml‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,18 @@
1-
# Overwrite parameters here
1+
applications:
2+
- espejote
23

34
parameters:
45
kapitan:
56
dependencies:
6-
- type: https
7-
source: https://raw.githubusercontent.com/projectsyn/component-patch-operator/v1.2.0/lib/patch-operator.libsonnet
8-
output_path: vendor/lib/patch-operator.libsonnet
97
- type: https
108
source: https://raw.githubusercontent.com/appuio/component-openshift4-monitoring/v1.13.0/lib/openshift4-monitoring-prom.libsonnet
119
output_path: vendor/lib/prom.libsonnet
10+
- type: https
11+
source: https://raw.githubusercontent.com/projectsyn/component-espejote/master/lib/espejote.libsonnet
12+
output_path: vendor/lib/espejote.libsonnet
13+
14+
espejote:
15+
namespace: syn-espejote
1216

1317
appuio_cloud:
1418
metrics:
@@ -83,8 +87,3 @@ parameters:
8387
acme.cert-manager.io/http01-solver:
8488
operator: DoesNotExist
8589
another: null
86-
87-
patch_operator:
88-
patch_serviceaccount:
89-
name: patch-sa
90-
namespace: syn-patch-operator

‎tests/golden/defaults/appuio-cloud/appuio-cloud/15_disallow_docker_build_strategy_patch.yaml‎

Lines changed: 81 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,88 @@
1-
apiVersion: redhatcop.redhat.io/v1alpha1
2-
kind: Patch
1+
apiVersion: v1
2+
kind: ServiceAccount
33
metadata:
44
annotations:
5-
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
5+
syn.tools/source: https://github.com/appuio/component-appuio-cloud.git
66
labels:
7-
name: clusterrolebinding-system-build-strategy-docker-3729a69e19ab960
8-
name: clusterrolebinding-system-build-strategy-docker-3729a69e19ab960
9-
namespace: syn-patch-operator
7+
app.kubernetes.io/component: appuio-cloud
8+
app.kubernetes.io/managed-by: espejote
9+
app.kubernetes.io/part-of: syn
10+
name: rbac-clusterrolebinding-system-build-strategy-docker-binding
11+
namespace: syn-espejote
12+
---
13+
apiVersion: rbac.authorization.k8s.io/v1
14+
kind: ClusterRole
15+
metadata:
16+
annotations:
17+
syn.tools/source: https://github.com/appuio/component-appuio-cloud.git
18+
labels:
19+
app.kubernetes.io/component: appuio-cloud
20+
app.kubernetes.io/managed-by: espejote
21+
app.kubernetes.io/part-of: syn
22+
name: syn-espejote:rbac-clusterrolebinding-system-build-strategy-docker-binding
23+
rules:
24+
- apiGroups:
25+
- rbac.authorization.k8s.io
26+
resourceNames:
27+
- system:build-strategy-docker-binding
28+
resources:
29+
- clusterrolebindings
30+
verbs:
31+
- '*'
32+
---
33+
apiVersion: rbac.authorization.k8s.io/v1
34+
kind: ClusterRoleBinding
35+
metadata:
36+
annotations:
37+
syn.tools/source: https://github.com/appuio/component-appuio-cloud.git
38+
labels:
39+
app.kubernetes.io/component: appuio-cloud
40+
app.kubernetes.io/managed-by: espejote
41+
app.kubernetes.io/part-of: syn
42+
name: syn-espejote:rbac-clusterrolebinding-system-build-strategy-docker-binding
43+
roleRef:
44+
apiGroup: rbac.authorization.k8s.io
45+
kind: ClusterRole
46+
name: syn-espejote:rbac-clusterrolebinding-system-build-strategy-docker-binding
47+
subjects:
48+
- kind: ServiceAccount
49+
name: rbac-clusterrolebinding-system-build-strategy-docker-binding
50+
namespace: syn-espejote
51+
---
52+
apiVersion: espejote.io/v1alpha1
53+
kind: ManagedResource
54+
metadata:
55+
annotations:
56+
syn.tools/source: https://github.com/appuio/component-appuio-cloud.git
57+
labels:
58+
app.kubernetes.io/component: appuio-cloud
59+
app.kubernetes.io/managed-by: espejote
60+
app.kubernetes.io/name: rbac-clusterrolebinding-system-build-strategy-docker-binding
61+
app.kubernetes.io/part-of: syn
62+
name: rbac-clusterrolebinding-system-build-strategy-docker-binding
63+
namespace: syn-espejote
1064
spec:
11-
patches:
12-
clusterrolebinding-system-build-strategy-docker-3729a69e19ab960-patch:
13-
patchTemplate: |-
14-
"metadata":
15-
"annotations":
16-
"rbac.authorization.kubernetes.io/autoupdate": "false"
17-
"subjects": []
18-
patchType: application/strategic-merge-patch+json
19-
targetObjectRef:
65+
applyOptions:
66+
force: true
67+
serviceAccountRef:
68+
name: rbac-clusterrolebinding-system-build-strategy-docker-binding
69+
template: |-
70+
{
71+
"apiVersion": "rbac.authorization.k8s.io/v1",
72+
"kind": "ClusterRoleBinding",
73+
"metadata": {
74+
"annotations": {
75+
"rbac.authorization.kubernetes.io/autoupdate": "false"
76+
},
77+
"name": "system:build-strategy-docker-binding"
78+
},
79+
"subjects": [
80+
81+
]
82+
}
83+
triggers:
84+
- name: clusterrolebinding
85+
watchResource:
2086
apiVersion: rbac.authorization.k8s.io/v1
2187
kind: ClusterRoleBinding
2288
name: system:build-strategy-docker-binding
23-
serviceAccountRef:
24-
name: patch-sa

0 commit comments

Comments
 (0)