add watches for owned resources and CRBs

Signed-off-by: Kevin <[email protected]>

Author: KPostOffice

config/rbac/role.yaml

@@ -26,6 +26,7 @@ rules:
   - delete
   - get
   - patch
+  - watch
 - apiGroups:
   - ""
   resources:
@@ -36,6 +37,7 @@ rules:
   - get
   - patch
   - update
+  - watch
 - apiGroups:
   - ""
   resources:
@@ -46,6 +48,7 @@ rules:
   - get
   - patch
   - update
+  - watch
 - apiGroups:
   - networking.k8s.io
   resources:
@@ -56,6 +59,7 @@ rules:
   - get
   - patch
   - update
+  - watch
 - apiGroups:
   - ray.io
   resources:
@@ -92,6 +96,7 @@ rules:
   - get
   - patch
   - update
+  - watch
 - apiGroups:
   - route.openshift.io
   resources:
@@ -103,3 +108,4 @@ rules:
   - get
   - patch
   - update
+  - watch

pkg/controllers/raycluster_controller.go

@@ -23,6 +23,8 @@ import (
 	"encoding/base64"
 	"fmt"
 
+	networkingv1 "k8s.io/api/networking/v1"
+
 	rayv1 "github.com/ray-project/kuberay/ray-operator/apis/ray/v1"
 
 	corev1 "k8s.io/api/core/v1"
@@ -38,6 +40,8 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
 	routev1 "github.com/openshift/api/route/v1"
 	routeapply "github.com/openshift/client-go/route/applyconfigurations/route/v1"
@@ -75,12 +79,12 @@ var (
 // +kubebuilder:rbac:groups=ray.io,resources=rayclusters,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=ray.io,resources=rayclusters/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=ray.io,resources=rayclusters/finalizers,verbs=update
-// +kubebuilder:rbac:groups=route.openshift.io,resources=routes;routes/custom-host,verbs=get;create;update;patch;delete
-// +kubebuilder:rbac:groups=networking.k8s.io,resources=ingresses,verbs=get;create;update;patch;delete
-// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;create;patch;delete;get
-// +kubebuilder:rbac:groups=core,resources=services,verbs=get;create;update;patch;delete
-// +kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;create;update;patch;delete
-// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterrolebindings,verbs=get;create;update;patch;delete
+// +kubebuilder:rbac:groups=route.openshift.io,resources=routes;routes/custom-host,verbs=get;create;update;patch;delete;watch
+// +kubebuilder:rbac:groups=networking.k8s.io,resources=ingresses,verbs=get;create;update;patch;delete;watch
+// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;create;patch;delete;get;watch
+// +kubebuilder:rbac:groups=core,resources=services,verbs=get;create;update;patch;delete;watch
+// +kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;create;update;patch;delete;watch
+// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterrolebindings,verbs=get;create;update;patch;delete;watch
 // +kubebuilder:rbac:groups=authentication.k8s.io,resources=tokenreviews,verbs=create;
 // +kubebuilder:rbac:groups=authorization.k8s.io,resources=subjectaccessreviews,verbs=create;
 
@@ -233,7 +237,7 @@ func crbNameFromCluster(cluster *rayv1.RayCluster) string {
 func desiredOAuthClusterRoleBinding(cluster *rayv1.RayCluster) *rbacapply.ClusterRoleBindingApplyConfiguration {
 	return rbacapply.ClusterRoleBinding(
 		crbNameFromCluster(cluster)).
-		WithLabels(map[string]string{"ray.io/cluster-name": cluster.Name}).
+		WithLabels(map[string]string{"ray.io/cluster-name": cluster.Name, "ray.io/cluster-namespace": cluster.Namespace}).
 		WithSubjects(
 			rbacapply.Subject().
 				WithKind("ServiceAccount").
@@ -350,5 +354,19 @@ func (r *RayClusterReconciler) SetupWithManager(mgr ctrl.Manager) error {
 	return ctrl.NewControllerManagedBy(mgr).
 		Named(controllerName).
 		For(&rayv1.RayCluster{}).
+		Owns(&corev1.ServiceAccount{}).
+		Owns(&corev1.Service{}).
+		Owns(&corev1.Secret{}).
+		Owns(&routev1.Route{}).
+		Owns(&networkingv1.Ingress{}).
+		Watches(&rbacv1.ClusterRoleBinding{}, handler.EnqueueRequestsFromMapFunc(
+			func(c context.Context, o client.Object) []reconcile.Request {
+				return []reconcile.Request{{
+					NamespacedName: client.ObjectKey{
+						Name:      o.GetLabels()["ray.io/cluster-name"],
+						Namespace: o.GetLabels()["ray.io/cluster-namespace"],
+					}}}
+			}),
+		).
 		Complete(r)
 }