Skip to content

Commit e8a6ae7

Browse files
scotwellsclaude
scotwells
and
claude
committed
feat(config): CRDs, RBAC, and kustomize overlays for federation
Regenerate the Instance, Workload, and WorkloadDeployment CRDs for the new API fields and add the kustomize structure that deploys the manager in cell or management-plane mode: federation and downstream RBAC bases, cell/management/quota-credentials components, the WorkloadDeployment status interpreter, and the matching overlays. The regenerated controller role also grants the event writes the instance controller performs when surfacing blocking reasons (QuotaNoBudget, ImageUnavailable, NetworkFailedToCreate, ...) so those signals reach kubectl describe and the activity timeline instead of being rejected by RBAC. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 parent fa3c147 commit e8a6ae7

21 files changed

Lines changed: 343 additions & 11 deletions

‎config/base/downstream-rbac/kustomization.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
4+
resources:
5+
- rbac.yaml

‎config/base/downstream-rbac/rbac.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: compute-manager
5+
rules:
6+
- apiGroups: [""]
7+
resources: ["namespaces"]
8+
verbs: ["get", "list", "watch", "create", "update", "patch"]
9+
- apiGroups: ["compute.datumapis.com"]
10+
resources: ["workloaddeployments", "workloaddeployments/status", "instances", "instances/status"]
11+
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
12+
- apiGroups: ["policy.karmada.io"]
13+
resources: ["propagationpolicies", "clusterpropagationpolicies"]
14+
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
15+
- apiGroups: ["cluster.karmada.io"]
16+
resources: ["clusters"]
17+
verbs: ["get", "list", "watch"]
18+
- apiGroups: ["work.karmada.io"]
19+
resources: ["resourcebindings", "clusterresourcebindings"]
20+
verbs: ["get", "list", "watch"]
21+
- apiGroups: ["config.karmada.io"]
22+
resources: ["resourceinterpreterwebhookconfigurations", "resourceinterpretercustomizations"]
23+
verbs: ["get", "list", "watch"]
24+
---
25+
apiVersion: rbac.authorization.k8s.io/v1
26+
kind: ClusterRoleBinding
27+
metadata:
28+
name: compute-manager
29+
roleRef:
30+
apiGroup: rbac.authorization.k8s.io
31+
kind: ClusterRole
32+
name: compute-manager
33+
subjects:
34+
- kind: User
35+
name: system:serviceaccount:compute-system:compute-manager

‎config/base/federation/kustomization.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
4+
resources:
5+
- ../crd/bases/compute.datumapis.com_instances.yaml
6+
- ../crd/bases/compute.datumapis.com_workloaddeployments.yaml
7+
- ../crd/bases/compute.datumapis.com_workloads.yaml
8+
9+
components:
10+
- ../../components/federation

‎config/base/manager/manager.yaml‎

Lines changed: 25 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,33 @@ spec:
2626
seccompProfile:
2727
type: RuntimeDefault
2828
containers:
29-
- command:
29+
- name: manager
30+
command:
3031
- /manager
3132
args:
32-
- --leader-elect
33-
- --health-probe-bind-address=:8081
34-
- --server-config=/config/config.yaml
33+
- --leader-elect=$(LEADER_ELECT)
34+
- --health-probe-bind-address=$(HEALTH_PROBE_BIND_ADDRESS)
35+
- --server-config=$(SERVER_CONFIG)
36+
- --federation-kubeconfig=$(FEDERATION_KUBECONFIG)
37+
- --enable-management-controllers=$(ENABLE_MANAGEMENT_CONTROLLERS)
38+
- --enable-cell-controllers=$(ENABLE_CELL_CONTROLLERS)
39+
- --feature-gates=$(FEATURE_GATES)
40+
env:
41+
- name: LEADER_ELECT
42+
value: "true"
43+
- name: HEALTH_PROBE_BIND_ADDRESS
44+
value: ":8081"
45+
- name: SERVER_CONFIG
46+
value: /config/config.yaml
47+
- name: FEDERATION_KUBECONFIG
48+
value: ""
49+
- name: ENABLE_MANAGEMENT_CONTROLLERS
50+
value: "false"
51+
- name: ENABLE_CELL_CONTROLLERS
52+
value: "false"
53+
- name: FEATURE_GATES
54+
value: ""
3555
image: ghcr.io/datum-cloud/compute:latest
36-
name: manager
3756
ports:
3857
- containerPort: 9443
3958
name: webhook-server
@@ -66,7 +85,7 @@ spec:
6685
volumeMounts:
6786
- name: config
6887
mountPath: /config
69-
serviceAccountName: compute
88+
serviceAccountName: compute-manager
7089
terminationGracePeriodSeconds: 10
7190
volumes:
7291
- name: config

‎config/base/manager/service_account.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,4 @@ metadata:
44
labels:
55
app.kubernetes.io/name: compute
66
app.kubernetes.io/managed-by: kustomize
7-
name: compute
7+
name: compute-manager

‎config/components/cell-controllers/kustomization.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: kustomize.config.k8s.io/v1alpha1
2+
kind: Component
3+
4+
patches:
5+
- target:
6+
kind: Deployment
7+
name: compute-manager
8+
patch: |-
9+
apiVersion: apps/v1
10+
kind: Deployment
11+
metadata:
12+
name: compute-manager
13+
spec:
14+
template:
15+
spec:
16+
containers:
17+
- name: manager
18+
env:
19+
- name: ENABLE_CELL_CONTROLLERS
20+
value: "true"

‎config/components/controller_rbac/metrics_auth_role_binding.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@ roleRef:
88
name: compute-metrics-auth-role
99
subjects:
1010
- kind: ServiceAccount
11-
name: compute
11+
name: compute-manager

‎config/components/controller_rbac/role.yaml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,20 @@ kind: ClusterRole
44
metadata:
55
name: compute
66
rules:
7+
- apiGroups:
8+
- ""
9+
resources:
10+
- events
11+
verbs:
12+
- create
13+
- patch
14+
- apiGroups:
15+
- ""
16+
resources:
17+
- namespaces
18+
verbs:
19+
- get
20+
- list
721
- apiGroups:
822
- compute.datumapis.com
923
resources:
@@ -36,3 +50,36 @@ rules:
3650
- get
3751
- patch
3852
- update
53+
- apiGroups:
54+
- networking.datumapis.com
55+
resources:
56+
- locations
57+
- networkcontexts
58+
- subnets
59+
verbs:
60+
- get
61+
- list
62+
- watch
63+
- apiGroups:
64+
- networking.datumapis.com
65+
resources:
66+
- networkbindings
67+
- subnetclaims
68+
verbs:
69+
- create
70+
- delete
71+
- get
72+
- list
73+
- patch
74+
- update
75+
- watch
76+
- apiGroups:
77+
- quota.miloapis.com
78+
resources:
79+
- resourceclaims
80+
verbs:
81+
- create
82+
- delete
83+
- get
84+
- list
85+
- watch

‎config/components/controller_rbac/role_binding.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,4 @@ roleRef:
1111
name: compute
1212
subjects:
1313
- kind: ServiceAccount
14-
name: compute
14+
name: compute-manager

‎config/components/federation/kustomization.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: kustomize.config.k8s.io/v1alpha1
2+
kind: Component
3+
4+
resources:
5+
- workloaddeployment-interpreter.yaml

0 commit comments

Comments
 (0)