Skip to content

Commit 178d6c1

Browse files
jhrozekk8s-ci-robot
jhrozek
authored and
k8s-ci-robot
committed
make: Add PROJECT, CSV and other tooling to create bundles
Uses operator-sdk to create bundles based on existing manifests. By default uses a single channel called "stable". To build the bundle image run: make bundle; make bundle-build basic validation is ran automatically as part of the build. To run the full scorecard, run: ./build/operator-sdk scorecard -w 300s ./bundle The PROJECT file has to be maintained from now on, keeping the list of APIs as the SDK fills the APIs from PROJECT to the CSV scaffolding at deploy/base/clusterserviceversion.yaml
1 parent a7d074c commit 178d6c1

File tree

6 files changed

+301
-1
lines changed

6 files changed

+301
-1
lines changed

‎.gitignore

+2
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,5 @@ Vagrantfile
66
build
77
image.tar
88
result
9+
bundle
10+
bundle.Dockerfile

‎Makefile

+74
Original file line numberDiff line numberDiff line change
@@ -397,6 +397,80 @@ generate:
397397
$(CONTROLLER_GEN_CMD) rbac:roleName=spod paths="./internal/pkg/daemon/..." output:rbac:stdout >> deploy/base/role.yaml
398398
$(CONTROLLER_GEN_CMD) rbac:roleName=spo-webhook paths="./internal/pkg/webhooks/..." output:rbac:stdout >> deploy/base/role.yaml
399399

400+
## Bundle packaging begins here
401+
## read more at https://sdk.operatorframework.io/docs/olm-integration/tutorial-bundle/
402+
403+
.PHONY: operator-sdk
404+
OPERATOR_SDK = $(BUILD_DIR)/operator-sdk
405+
operator-sdk: $(BUILD_DIR) ## Download sdk locally if necessary.
406+
ifeq (,$(wildcard $(OPERATOR_SDK)))
407+
ifeq (,$(shell which operator-sdk 2>/dev/null))
408+
@{ \
409+
set -e ;\
410+
mkdir -p $(dir $(OPERATOR_SDK)) ;\
411+
OS=$(shell go env GOOS) && ARCH=$(shell go env GOARCH) && \
412+
curl -sSLo $(OPERATOR_SDK) https://github.com/operator-framework/operator-sdk/releases/download/v1.17.0/operator-sdk_$${OS}_$${ARCH} ;\
413+
chmod +x $(OPERATOR_SDK) ;\
414+
}
415+
else
416+
OPERATOR_SDK = $(shell which operator-sdk)
417+
endif
418+
endif
419+
420+
421+
# CHANNELS define the bundle channels used in the bundle.
422+
# Add a new line here if you would like to change its default config. (E.g CHANNELS = "candidate,fast,stable")
423+
# To re-generate a bundle for other specific channels without changing the standard setup, you can:
424+
# - use the CHANNELS as arg of the bundle target (e.g make bundle CHANNELS=candidate,fast,stable)
425+
# - use environment variables to overwrite this value (e.g export CHANNELS="candidate,fast,stable")
426+
CHANNELS="stable"
427+
ifneq ($(origin CHANNELS), undefined)
428+
BUNDLE_CHANNELS := --channels=$(CHANNELS)
429+
endif
430+
431+
# DEFAULT_CHANNEL defines the default channel used in the bundle.
432+
# Add a new line here if you would like to change its default config. (E.g DEFAULT_CHANNEL = "stable")
433+
# To re-generate a bundle for any other default channel without changing the default setup, you can:
434+
# - use the DEFAULT_CHANNEL as arg of the bundle target (e.g make bundle DEFAULT_CHANNEL=stable)
435+
# - use environment variables to overwrite this value (e.g export DEFAULT_CHANNEL="stable")
436+
DEFAULT_CHANNEL="stable"
437+
ifneq ($(origin DEFAULT_CHANNEL), undefined)
438+
BUNDLE_DEFAULT_CHANNEL := --default-channel=$(DEFAULT_CHANNEL)
439+
endif
440+
BUNDLE_METADATA_OPTS ?= $(BUNDLE_CHANNELS) $(BUNDLE_DEFAULT_CHANNEL)
441+
442+
# BUNDLE_IMG defines the image:tag used for the bundle.
443+
# You can use it as an arg. (E.g make bundle-build BUNDLE_IMG=<some-registry>/<project-name-bundle>:<tag>)
444+
BUNDLE_IMG ?= $(PROJECT)-bundle:v$(VERSION)
445+
446+
# These examples are added to the alm-examples annotation and subsequently
447+
# displayed in the UI
448+
OLM_EXAMPLES := \
449+
examples/apparmorprofile.yaml \
450+
examples/config.yaml \
451+
examples/profilerecording-seccomp-bpf.yaml \
452+
examples/profilebinding.yaml \
453+
examples/rawselinuxprofile.yaml \
454+
examples/seccompprofile.yaml \
455+
examples/selinuxprofile.yaml
456+
457+
.PHONY: bundle
458+
bundle: operator-sdk deployments ## Generate bundle manifests and metadata, then validate generated files.
459+
sed -i "s/\(olm.skipRange: '>=.*\)<.*'/\1<$(VERSION)'/" deploy/base/clusterserviceversion.yaml
460+
cat $(OLM_EXAMPLES) deploy/operator.yaml deploy/base/clusterserviceversion.yaml | $(OPERATOR_SDK) generate bundle -q --overwrite --version $(VERSION) $(BUNDLE_METADATA_OPTS)
461+
git restore deploy/base/clusterserviceversion.yaml
462+
mkdir -p ./bundle/tests/scorecard
463+
cp deploy/bundle-test-config.yaml ./bundle/tests/scorecard/config.yaml
464+
$(OPERATOR_SDK) bundle validate ./bundle
465+
466+
.PHONY: bundle-build
467+
bundle-build: ## Build the bundle image.
468+
$(CONTAINER_RUNTIME) build -f bundle.Dockerfile -t $(BUNDLE_IMG) .
469+
470+
.PHONY: bundle-push
471+
bundle-push: ## Push the bundle image.
472+
$(CONTAINER_RUNTIME) push $(BUNDLE_IMG)
473+
400474
## OpenShift-only
401475
## These targets are meant to make development in OpenShift easier.
402476

‎PROJECT

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
domain: security-profiles-operator.x-k8s.io
2+
layout:
3+
- go.kubebuilder.io/v3
4+
plugins:
5+
manifests.sdk.operatorframework.io/v2: {}
6+
scorecard.sdk.operatorframework.io/v2: {}
7+
projectName: security-profiles-operator
8+
repo: github.com/kubernetes-sigs/security-profiles-operator
9+
resources:
10+
- api:
11+
crdVersion: v1
12+
namespaced: true
13+
controller: true
14+
domain: security-profiles-operator.x-k8s.io
15+
kind: SecurityProfileNodeStatus
16+
path: sigs.k8s.io/security-profiles-operator/api/secprofnodestatus/v1alpha1
17+
version: v1alpha1
18+
- api:
19+
crdVersion: v1
20+
namespaced: true
21+
controller: true
22+
domain: security-profiles-operator.x-k8s.io
23+
kind: SeccompProfile
24+
path: sigs.k8s.io/security-profiles-operator/api/seccompprofile/v1beta1
25+
version: v1beta1
26+
- api:
27+
crdVersion: v1
28+
namespaced: true
29+
controller: true
30+
domain: security-profiles-operator.x-k8s.io
31+
kind: SecurityProfilesOperatorDaemon
32+
path: sigs.k8s.io/security-profiles-operator/api/spod/v1alpha1
33+
version: v1alpha1
34+
- api:
35+
crdVersion: v1
36+
namespaced: true
37+
controller: true
38+
domain: security-profiles-operator.x-k8s.io
39+
kind: SelinuxProfile
40+
path: sigs.k8s.io/security-profiles-operator/api/selinuxprofile/v1alpha2
41+
version: v1alpha2
42+
- api:
43+
crdVersion: v1
44+
namespaced: true
45+
controller: true
46+
domain: security-profiles-operator.x-k8s.io
47+
kind: AppArmorProfile
48+
path: sigs.k8s.io/security-profiles-operator/api/apparmorprofile/v1alpha1
49+
version: v1alpha1
50+
- api:
51+
crdVersion: v1
52+
namespaced: true
53+
controller: true
54+
domain: security-profiles-operator.x-k8s.io
55+
kind: ProfileBinding
56+
path: sigs.k8s.io/security-profiles-operator/api/profilebinding/v1alpha1
57+
version: v1alpha1
58+
- api:
59+
crdVersion: v1
60+
namespaced: true
61+
controller: true
62+
domain: security-profiles-operator.x-k8s.io
63+
kind: ProfileRecording
64+
path: sigs.k8s.io/security-profiles-operator/api/profilerecording/v1alpha1
65+
version: v1alpha1
66+
version: "3"

‎deploy/base/clusterserviceversion.yaml

+87
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
apiVersion: operators.coreos.com/v1alpha1
2+
kind: ClusterServiceVersion
3+
metadata:
4+
annotations:
5+
alm-examples: '[]'
6+
capabilities: Basic Install
7+
olm.skipRange: '>=0.4.1 <0.4.2-dev'
8+
operatorframework.io/suggested-namespace: security-profiles-operator`
9+
name: security-profiles-operator.v0.0.0
10+
namespace: placeholder
11+
spec:
12+
apiservicedefinitions: {}
13+
customresourcedefinitions:
14+
owned:
15+
- description: AppArmorProfile is a cluster level specification for an AppArmor
16+
profile.
17+
displayName: App Armor Profile
18+
kind: AppArmorProfile
19+
name: apparmorprofiles.security-profiles-operator.x-k8s.io
20+
version: v1alpha1
21+
- description: ProfileBinding is the Schema for the profilebindings API.
22+
displayName: Profile Binding
23+
kind: ProfileBinding
24+
name: profilebindings.security-profiles-operator.x-k8s.io
25+
version: v1alpha1
26+
- description: ProfileRecording is the Schema for the profilerecordings API.
27+
displayName: Profile Recording
28+
kind: ProfileRecording
29+
name: profilerecordings.security-profiles-operator.x-k8s.io
30+
version: v1alpha1
31+
- description: SeccompProfile is a cluster level specification for a seccomp profile.
32+
See https://github.com/opencontainers/runtime-spec/blob/master/config-linux.md#seccomp
33+
displayName: Seccomp Profile
34+
kind: SeccompProfile
35+
name: seccompprofiles.security-profiles-operator.x-k8s.io
36+
version: v1beta1
37+
- description: SecurityProfileNodeStatus is a per-node status of a security profile
38+
displayName: Security Profile Node Status
39+
kind: SecurityProfileNodeStatus
40+
name: securityprofilenodestatuses.security-profiles-operator.x-k8s.io
41+
version: v1alpha1
42+
- description: SecurityProfilesOperatorDaemon is the Schema to configure the spod
43+
deployment.
44+
displayName: Security Profiles Operator Daemon
45+
kind: SecurityProfilesOperatorDaemon
46+
name: securityprofilesoperatordaemons.security-profiles-operator.x-k8s.io
47+
version: v1alpha1
48+
- description: SelinuxProfile is the Schema for the selinuxprofiles API.
49+
displayName: Selinux Profile
50+
kind: SelinuxProfile
51+
name: selinuxprofiles.security-profiles-operator.x-k8s.io
52+
version: v1alpha2
53+
description: SPO is an operator which aims to make it easier for users to use SELinux, seccomp and AppArmor in Kubernetes clusters
54+
displayName: Security Profiles Operator
55+
icon:
56+
- base64data: ""
57+
mediatype: ""
58+
install:
59+
spec:
60+
deployments: null
61+
strategy: ""
62+
installModes:
63+
- supported: true
64+
type: OwnNamespace
65+
- supported: true
66+
type: SingleNamespace
67+
- supported: false
68+
type: MultiNamespace
69+
- supported: false
70+
type: AllNamespaces
71+
keywords:
72+
- security
73+
- selinux
74+
- seccomp
75+
- apparmor
76+
- ebpf
77+
links:
78+
- name: Security Profiles Operator
79+
url: https://github.com/kubernetes-sigs/security-profiles-operator
80+
maintainers:
81+
- email: [email protected]
82+
name: Kubernetes upstream
83+
maturity: alpha
84+
provider:
85+
name: Kubernetes SIGs
86+
url: https://github.com/kubernetes-sigs
87+
version: 0.0.0

‎deploy/bundle-test-config.yaml

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
apiVersion: scorecard.operatorframework.io/v1alpha3
2+
kind: Configuration
3+
metadata:
4+
name: config
5+
stages:
6+
- parallel: true
7+
tests:
8+
- entrypoint:
9+
- scorecard-test
10+
- basic-check-spec
11+
image: quay.io/operator-framework/scorecard-test:v1.17.0
12+
labels:
13+
suite: basic
14+
test: basic-check-spec-test
15+
storage:
16+
spec:
17+
mountPath: {}
18+
- entrypoint:
19+
- scorecard-test
20+
- olm-bundle-validation
21+
image: quay.io/operator-framework/scorecard-test:v1.17.0
22+
labels:
23+
suite: olm
24+
test: olm-bundle-validation-test
25+
storage:
26+
spec:
27+
mountPath: {}
28+
- entrypoint:
29+
- scorecard-test
30+
- olm-crds-have-validation
31+
image: quay.io/operator-framework/scorecard-test:v1.17.0
32+
labels:
33+
suite: olm
34+
test: olm-crds-have-validation-test
35+
storage:
36+
spec:
37+
mountPath: {}
38+
- entrypoint:
39+
- scorecard-test
40+
- olm-crds-have-resources
41+
image: quay.io/operator-framework/scorecard-test:v1.17.0
42+
labels:
43+
suite: olm
44+
test: olm-crds-have-resources-test
45+
storage:
46+
spec:
47+
mountPath: {}
48+
- entrypoint:
49+
- scorecard-test
50+
- olm-spec-descriptors
51+
image: quay.io/operator-framework/scorecard-test:v1.17.0
52+
labels:
53+
suite: olm
54+
test: olm-spec-descriptors-test
55+
storage:
56+
spec:
57+
mountPath: {}
58+
- entrypoint:
59+
- scorecard-test
60+
- olm-status-descriptors
61+
image: quay.io/operator-framework/scorecard-test:v1.17.0
62+
labels:
63+
suite: olm
64+
test: olm-status-descriptors-test
65+
storage:
66+
spec:
67+
mountPath: {}
68+
storage:
69+
spec:
70+
mountPath: {}

‎examples/config.yaml

+2-1
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,5 @@ metadata:
77
spec:
88
enableSelinux: false
99
enableLogEnricher: false
10-
enableAppArmor: false
10+
enableAppArmor: false
11+

0 commit comments

Comments
 (0)