Move service operator RBAC from runtime bindata to OLM bundle

Dockerfile

@@ -35,7 +35,7 @@ RUN if [ -f $CACHITO_ENV_FILE ] ; then source $CACHITO_ENV_FILE ; fi ; env ${GO_
 RUN if [ -f $CACHITO_ENV_FILE ] ; then source $CACHITO_ENV_FILE ; fi ; env ${GO_BUILD_EXTRA_ENV_ARGS} go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/operator cmd/operator/main.go
 
 RUN cp -r config/services ${DEST_ROOT}/services
-RUN cp -r bindata ${DEST_ROOT}/bindata
+RUN cp -r bindata ${DEST_ROOT}/bindata && rm -rf ${DEST_ROOT}/bindata/rbac
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details

Makefile

@@ -406,11 +406,14 @@ bundle: manifests kustomize operator-sdk ## Generate bundle manifests and metada
 	$(KUSTOMIZE) edit set image controller=$(IMG) && \
 	$(KUSTOMIZE) edit add patch --kind Deployment --name openstack-operator-controller-init --namespace system --patch "[{\"op\": \"replace\", \"path\": \"/spec/template/spec/containers/0/env/0\", \"value\": {\"name\": \"OPENSTACK_RELEASE_VERSION\", \"value\": \"$(OPENSTACK_RELEASE_VERSION)\"}}]" && \
 	$(KUSTOMIZE) edit add patch --kind Deployment --name openstack-operator-controller-init --namespace system --patch "[{\"op\": \"replace\", \"path\": \"/spec/template/spec/containers/0/env/1\", \"value\": {\"name\": \"OPERATOR_IMAGE_URL\", \"value\": \"$(IMG)\"}}]"
+	rm -rf bundle/manifests bundle/metadata
 	$(KUSTOMIZE) build config/operator --load-restrictor='LoadRestrictionsNone' | $(OPERATOR_SDK) generate bundle $(BUNDLE_GEN_FLAGS)
 ifneq ($(REPLACES),)
 	@echo "Adding replaces: $(REPLACES) to CSV"
 	sed -i "/^  name: openstack-operator.v$(VERSION)/a\  replaces: $(REPLACES)" bundle/manifests/openstack-operator.clusterserviceversion.yaml
 endif
+	@echo "Staging service operator RBAC into bundle manifests"
+	cp config/operator/bundle-rbac/*.yaml bundle/manifests/
 	$(OPERATOR_SDK) bundle validate ./bundle
 
 .PHONY: bundle-build

bindata/rbac/rbac.yaml

@@ -739,20 +739,18 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - clusterrolebindings
-  - clusterroles
-  verbs:
-  - '*'
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:
   - rolebindings
   - roles
   verbs:
-  - '*'
+  - create
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - redis.openstack.org
   resources:

config/operator/bundle-rbac/barbican-operator-leader-election-role.yaml

@@ -0,0 +1,37 @@
+# NOTE: this file is automatically generated by hack/sync-bindata.sh!
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: barbican-operator-leader-election-role
+rules:
+- apiGroups:
+    - ""
+  resources:
+    - configmaps
+  verbs:
+    - get
+    - list
+    - watch
+    - create
+    - update
+    - patch
+    - delete
+- apiGroups:
+    - coordination.k8s.io
+  resources:
+    - leases
+  verbs:
+    - get
+    - list
+    - watch
+    - create
+    - update
+    - patch
+    - delete
+- apiGroups:
+    - ""
+  resources:
+    - events
+  verbs:
+    - create
+    - patch

config/operator/bundle-rbac/barbican-operator-leader-election-rolebinding.yaml

@@ -0,0 +1,12 @@
+# NOTE: this file is automatically generated by hack/sync-bindata.sh!
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: barbican-operator-leader-election-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: barbican-operator-leader-election-role
+subjects:
+- kind: ServiceAccount
+  name: barbican-operator-controller-manager

config/operator/bundle-rbac/barbican-operator-manager-role.yaml

@@ -0,0 +1,193 @@
+# NOTE: this file is automatically generated by hack/sync-bindata.sh!
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: barbican-operator-manager-role
+rules:
+- apiGroups:
+    - ""
+  resources:
+    - configmaps
+    - pods
+    - secrets
+    - services
+  verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+- apiGroups:
+    - ""
+  resources:
+    - serviceaccounts
+  verbs:
+    - create
+    - get
+    - list
+    - patch
+    - update
+    - watch
+- apiGroups:
+    - apps
+  resources:
+    - deployments
+  verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+- apiGroups:
+    - barbican.openstack.org
+  resources:
+    - barbicanapis
+    - barbicankeystonelisteners
+    - barbicans
+    - barbicanworkers
+  verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+- apiGroups:
+    - barbican.openstack.org
+  resources:
+    - barbicanapis/finalizers
+    - barbicankeystonelisteners/finalizers
+    - barbicans/finalizers
+    - barbicanworkers/finalizers
+  verbs:
+    - patch
+    - update
+- apiGroups:
+    - barbican.openstack.org
+  resources:
+    - barbicanapis/status
+    - barbicankeystonelisteners/status
+    - barbicans/status
+    - barbicanworkers/status
+  verbs:
+    - get
+    - patch
+    - update
+- apiGroups:
+    - batch
+  resources:
+    - jobs
+  verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+- apiGroups:
+    - k8s.cni.cncf.io
+  resources:
+    - network-attachment-definitions
+  verbs:
+    - get
+    - list
+    - watch
+- apiGroups:
+    - keystone.openstack.org
+  resources:
+    - keystoneapis
+  verbs:
+    - get
+    - list
+    - watch
+- apiGroups:
+    - keystone.openstack.org
+  resources:
+    - keystoneendpoints
+    - keystoneservices
+  verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+- apiGroups:
+    - mariadb.openstack.org
+  resources:
+    - mariadbaccounts
+    - mariadbdatabases
+  verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+- apiGroups:
+    - mariadb.openstack.org
+  resources:
+    - mariadbaccounts/finalizers
+  verbs:
+    - update
+- apiGroups:
+    - rabbitmq.openstack.org
+  resources:
+    - transporturls
+  verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+- apiGroups:
+    - rbac.authorization.k8s.io
+  resources:
+    - rolebindings
+    - roles
+  verbs:
+    - create
+    - get
+    - list
+    - patch
+    - update
+    - watch
+- apiGroups:
+    - security.openshift.io
+  resourceNames:
+    - anyuid
+  resources:
+    - securitycontextconstraints
+  verbs:
+    - use
+- apiGroups:
+    - topology.openstack.org
+  resources:
+    - topologies
+  verbs:
+    - get
+    - list
+    - update
+    - watch
+- apiGroups:
+    - authentication.k8s.io
+  resources:
+    - tokenreviews
+  verbs:
+    - create
+- apiGroups:
+    - authorization.k8s.io
+  resources:
+    - subjectaccessreviews
+  verbs:
+    - create

config/operator/bundle-rbac/barbican-operator-manager-rolebinding.yaml

@@ -0,0 +1,13 @@
+# NOTE: this file is automatically generated by hack/sync-bindata.sh!
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: barbican-operator-manager-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: barbican-operator-manager-role
+subjects:
+- kind: ServiceAccount
+  name: barbican-operator-controller-manager
+  namespace: openstack-operators

config/operator/bundle-rbac/barbican-operator-metrics-auth-role.yaml

@@ -0,0 +1,18 @@
+# NOTE: this file is automatically generated by hack/sync-bindata.sh!
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: barbican-operator-operator-metrics-auth-role
+rules:
+- apiGroups:
+  - authentication.k8s.io
+  resources:
+  - tokenreviews
+  verbs:
+  - create
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - subjectaccessreviews
+  verbs:
+  - create

config/operator/bundle-rbac/barbican-operator-metrics-auth-rolebinding.yaml

@@ -0,0 +1,13 @@
+# NOTE: this file is automatically generated by hack/sync-bindata.sh!
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: barbican-operator-operator-metrics-auth-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: barbican-operator-operator-metrics-auth-role
+subjects:
+- kind: ServiceAccount
+  name: barbican-operator-operator-controller-manager
+  namespace: openstack-operators

config/operator/bundle-rbac/barbican-operator-metrics-reader.yaml

@@ -0,0 +1,10 @@
+# NOTE: this file is automatically generated by hack/sync-bindata.sh!
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: barbican-operator-operator-metrics-reader
+rules:
+- nonResourceURLs:
+  - /metrics
+  verbs:
+  - get

config/operator/bundle-rbac/barbican-operator-serviceaccount.yaml

@@ -0,0 +1,5 @@
+# NOTE: this file is automatically generated by hack/sync-bindata.sh!
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: barbican-operator-controller-manager

config/operator/bundle-rbac/cinder-operator-leader-election-role.yaml

@@ -0,0 +1,37 @@
+# NOTE: this file is automatically generated by hack/sync-bindata.sh!
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cinder-operator-leader-election-role
+rules:
+- apiGroups:
+    - ""
+  resources:
+    - configmaps
+  verbs:
+    - get
+    - list
+    - watch
+    - create
+    - update
+    - patch
+    - delete
+- apiGroups:
+    - coordination.k8s.io
+  resources:
+    - leases
+  verbs:
+    - get
+    - list
+    - watch
+    - create
+    - update
+    - patch
+    - delete
+- apiGroups:
+    - ""
+  resources:
+    - events
+  verbs:
+    - create
+    - patch