Skip to content

Commit 01deb59

Browse files
author
Kugamoorthy Gajananan
authored
Integrity Shield Operator Update to 0.3.0 in OperatorHub.io (#33)
* Operator update (#1) * Prepare for Operatorhub.io submission, fixed Makefile,scripts for generating bundle for local olm test, generated new bundle * Prepare for Operatorhub.io submission: fixed previous version, replaces in CSV * Prepare for Operatorhub.io submission: changed to operator-sdk version v1.10.1 to deal validation test issue * Prepare for Operatorhub.io submission: fixed makefile * Operator update (#2) * Prepare for Operatorhub.io submission, fixed Makefile,scripts for generating bundle for local olm test, generated new bundle * Prepare for Operatorhub.io submission: fixed previous version, replaces in CSV * Prepare for Operatorhub.io submission: changed to operator-sdk version v1.10.1 to deal validation test issue * Prepare for Operatorhub.io submission: fixed makefile * Prepare for Operatorhub.io submission: fixed scripts and odoc * Prepare for Operatorhub.io submission: fixed script * Operator update (#3) * Prepare for Operatorhub.io submission, fixed Makefile,scripts for generating bundle for local olm test, generated new bundle * Prepare for Operatorhub.io submission: fixed previous version, replaces in CSV * Prepare for Operatorhub.io submission: changed to operator-sdk version v1.10.1 to deal validation test issue * Prepare for Operatorhub.io submission: fixed makefile * Prepare for Operatorhub.io submission: fixed scripts and odoc * Prepare for Operatorhub.io submission: fixed script * Prepare for Operatorhub.io submission: fixed docs * Integrity Shield Operator Update to 0.3.0 in OperatorHub.io (#4) * Prepare for Operatorhub.io submission, fixed makefile, scripts * Integrity Shield Operator Update to 0.3.0 in OperatorHub.io (#5) * Prepare for Operatorhub.io submission: fixed script
1 parent be1726f commit 01deb59

14 files changed

+146
-111
lines changed

‎Makefile

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -349,9 +349,13 @@ install-ishield: check-kubeconfig install-crds install-operator create-cr
349349
uninstall-ishield: delete-cr delete-operator
350350

351351
create-ns:
352-
@echo
353-
@echo creating namespace
354-
kubectl create ns $(ISHIELD_NS)
352+
@if [ "$(shell kubectl get ns $(ISHIELD_NS) | sed -n '2 p' | awk '{print$$1}')" = $(ISHIELD_NS) ]; then \
353+
echo namespace already exists !; \
354+
else \
355+
echo; \
356+
echo creating namespace; \
357+
kubectl create ns $(ISHIELD_NS); \
358+
fi
355359

356360
install-crds:
357361
@echo installing crds
@@ -570,7 +574,6 @@ setup-olm-local:
570574
$(ISHIELD_REPO_ROOT)/build/setup-olm-local.sh
571575

572576
bundle-test-local:
573-
make create-keyring-secret
574577
make setup-tmp-cr
575578
make setup-test-env
576579
make e2e-test

‎build/clean-e2e-bundle-test-local.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ metadata:
6262
name: integrity-shield-operator
6363
namespace: ${ISHIELD_NS}
6464
spec:
65-
channel: alpha
65+
channel: ${ISHIELD_DEFAULT_CHANNEL}
6666
name: integrity-shield-operator
6767
source: integrity-shield-operator-catalog
6868
sourceNamespace: olm

‎build/deploy-bundle-local.sh

Lines changed: 41 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -49,12 +49,48 @@ echo ""
4949
echo "-------------------------------------------------"
5050
echo "Install bundle catalogsource"
5151

52+
cat <<EOF | kubectl create -f -
53+
apiVersion: operators.coreos.com/v1alpha1
54+
kind: CatalogSource
55+
metadata:
56+
name: integrity-shield-operator-catalog
57+
namespace: olm
58+
spec:
59+
displayName: Integrity Ishield Operator
60+
image: ${BUNDLE_INDX_IMAGE}
61+
publisher: Community
62+
sourceType: grpc
63+
updateStrategy:
64+
registryPoll:
65+
interval: 15m
66+
EOF
67+
68+
echo ""
69+
echo "-------------------------------------------------"
70+
echo "Check if integrity-shield-operator-catalog is deployed correctly."
71+
echo "Let's wait for integrity-shield-operator-catalog to be deployed..."
72+
while true; do
73+
ISHIELD_STATUS=$(kubectl get pod -n olm 2>/dev/null | grep integrity-shield-operator-catalog | awk '{print $3}')
74+
READY_STATUS=$(kubectl get pod -n olm 2>/dev/null | grep integrity-shield-operator-catalog | awk '{print $2}')
75+
if [[ "$ISHIELD_STATUS" == "Running" && "$READY_STATUS" == "1/1" ]]; then
76+
echo
77+
echo -n "===== Integrity Shield operator catalog has started, let's continue with installing subscription. ====="
78+
echo
79+
break
80+
else
81+
printf "."
82+
sleep 2
83+
fi
84+
done
85+
5286
cat <<EOF | kubectl create -f -
5387
apiVersion: v1
5488
kind: Namespace
5589
metadata:
5690
name: ${ISHIELD_NS}
57-
---
91+
EOF
92+
93+
cat <<EOF | kubectl create -f -
5894
apiVersion: operators.coreos.com/v1
5995
kind: OperatorGroup
6096
metadata:
@@ -63,31 +99,19 @@ metadata:
6399
spec:
64100
targetNamespaces:
65101
- ${ISHIELD_NS}
66-
---
102+
EOF
103+
104+
cat <<EOF | kubectl create -f -
67105
apiVersion: operators.coreos.com/v1alpha1
68106
kind: Subscription
69107
metadata:
70108
name: integrity-shield-operator
71109
namespace: ${ISHIELD_NS}
72110
spec:
73-
channel: alpha
111+
channel: ${ISHIELD_DEFAULT_CHANNEL}
74112
installPlanApproval: Automatic
75113
name: integrity-shield-operator
76114
source: integrity-shield-operator-catalog
77115
sourceNamespace: olm
78116
startingCSV: ${STARTING_CSV}
79-
---
80-
apiVersion: operators.coreos.com/v1alpha1
81-
kind: CatalogSource
82-
metadata:
83-
name: integrity-shield-operator-catalog
84-
namespace: olm
85-
spec:
86-
displayName: Integrity Ishield Operator
87-
image: ${BUNDLE_INDX_IMAGE}
88-
publisher: Community
89-
sourceType: grpc
90-
updateStrategy:
91-
registryPoll:
92-
interval: 15m
93117
EOF

‎build/pull_images.sh

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,9 +53,9 @@ echo -----------------------------
5353
echo ""
5454

5555

56-
# Push integrity-shield-logging image
56+
# Push integrity-shield-admission-controller image
5757
echo -----------------------------
58-
echo [2/3] Pulling integrity-shield-logging image.
58+
echo [2/3] Pulling integrity-shield-admission-controller image.
5959
docker pull ${ISHIELD_ADMISSION_CONTROLLER_IMAGE_NAME_AND_VERSION}
6060
echo done.
6161
echo -----------------------------

‎build/update-version.sh

Lines changed: 15 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -26,15 +26,18 @@ if [ -z "$SHIELD_OP_DIR" ]; then
2626
exit 1
2727
fi
2828

29-
sed -i "s|$PREV_VERSION|$VERSION|" ${ISHIELD_REPO_ROOT}/docs/ACM/README_DISABLE_ISHIELD_PROTECTION_ACM_ENV.md
30-
sed -i "s|$PREV_VERSION|$VERSION|" ${ISHIELD_REPO_ROOT}/scripts/install_shield.sh
31-
sed -i "s|$PREV_VERSION|$VERSION|" ${ISHIELD_REPO_ROOT}/COMPONENT_VERSION
32-
sed -i "s|$PREV_VERSION|$VERSION|" ${ISHIELD_REPO_ROOT}/develop/local-deploy/operator_local.yaml
33-
sed -i "s|$PREV_VERSION|$VERSION|" ${SHIELD_OP_DIR}Makefile
34-
sed -i "s|$PREV_VERSION|$VERSION|" ${SHIELD_OP_DIR}resources/testdata/deploymentForIShield.yaml
35-
sed -i "s|$PREV_VERSION|$VERSION|" ${SHIELD_OP_DIR}resources/testdata/integrityShieldCRForTest.yaml
36-
sed -i "s|$PREV_VERSION|$VERSION|" ${SHIELD_OP_DIR}resources/testdata/integrityShieldCR.yaml
37-
sed -i "s|$PREV_VERSION|$VERSION|" ${SHIELD_OP_DIR}resources/default-ishield-cr.yaml
38-
sed -i "s|$PREV_VERSION|$VERSION|" ${SHIELD_OP_DIR}config/manifests/bases/integrity-shield-operator.clusterserviceversion.yaml
39-
sed -i "s|$PREV_VERSION|$VERSION|" ${SHIELD_DIR}version/version.go
40-
sed -i "s|$PREV_VERSION|$VERSION|" ${SHIELD_DIR}pkg/util/mapnode/node_test.go
29+
OS_NAME=$(uname -s)
30+
31+
32+
if [[ "$OS_NAME" == "Darwin" ]]; then
33+
sedi=(-i "")
34+
else
35+
sedi=(-i)
36+
fi
37+
38+
39+
sed "${sedi[@]}" "s|$PREV_VERSION|$VERSION|" ${ISHIELD_REPO_ROOT}/docs/ACM/README_DISABLE_ISHIELD_PROTECTION_ACM_ENV.md
40+
sed "${sedi[@]}" "s|$PREV_VERSION|$VERSION|" ${ISHIELD_REPO_ROOT}/scripts/install_shield.sh
41+
sed "${sedi[@]}" "s|$PREV_VERSION|$VERSION|" ${ISHIELD_REPO_ROOT}/COMPONENT_VERSION
42+
sed "${sedi[@]}" "s|$PREV_VERSION|$VERSION|" ${SHIELD_OP_DIR}Makefile
43+
sed "${sedi[@]}" "s|$PREV_VERSION|$VERSION|" ${SHIELD_OP_DIR}config/manifests/bases/integrity-shield-operator.clusterserviceversion.yaml

‎integrity-shield-operator/bundle.Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ LABEL operators.operatorframework.io.bundle.manifests.v1=manifests/
2121
LABEL operators.operatorframework.io.bundle.metadata.v1=metadata/
2222
LABEL operators.operatorframework.io.bundle.package.v1=integrity-shield-operator
2323
LABEL operators.operatorframework.io.bundle.channels.v1=alpha-0.3.0
24-
LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.12.0
24+
LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.10.0+git
2525
LABEL operators.operatorframework.io.metrics.mediatype.v1=metrics+v1
2626
LABEL operators.operatorframework.io.metrics.project_layout=go.kubebuilder.io/v3
2727

‎integrity-shield-operator/bundle/manifests/apis.integrityshield.io_integrityshields.yaml

Lines changed: 52 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,18 @@ spec:
222222
description: GMSACredentialSpecName is the name of the
223223
GMSA credential spec to use.
224224
type: string
225+
hostProcess:
226+
description: HostProcess determines if a container should
227+
be run as a 'Host Process' container. This field is
228+
alpha-level and will only be honored by components that
229+
enable the WindowsHostProcessContainers feature flag.
230+
Setting this field without the feature flag will result
231+
in errors when validating the Pod. All of a Pod's containers
232+
must have the same effective HostProcess value (it is
233+
not allowed to have a mix of HostProcess containers
234+
and non-HostProcess containers). In addition, if HostProcess
235+
is true then HostNetwork must also be set to true.
236+
type: boolean
225237
runAsUserName:
226238
description: The UserName in Windows to run the entrypoint
227239
of the container process. Defaults to the user specified
@@ -532,7 +544,7 @@ spec:
532544
field and the ones listed in the namespaces field.
533545
null selector and null or empty namespaces list
534546
means "this pod's namespace". An empty selector
535-
({}) matches all namespaces. This field is alpha-level
547+
({}) matches all namespaces. This field is beta-level
536548
and is only honored when PodAffinityNamespaceSelector
537549
feature is enabled.
538550
properties:
@@ -688,7 +700,7 @@ spec:
688700
the ones listed in the namespaces field. null selector
689701
and null or empty namespaces list means "this pod's
690702
namespace". An empty selector ({}) matches all namespaces.
691-
This field is alpha-level and is only honored when
703+
This field is beta-level and is only honored when
692704
PodAffinityNamespaceSelector feature is enabled.
693705
properties:
694706
matchExpressions:
@@ -841,7 +853,7 @@ spec:
841853
field and the ones listed in the namespaces field.
842854
null selector and null or empty namespaces list
843855
means "this pod's namespace". An empty selector
844-
({}) matches all namespaces. This field is alpha-level
856+
({}) matches all namespaces. This field is beta-level
845857
and is only honored when PodAffinityNamespaceSelector
846858
feature is enabled.
847859
properties:
@@ -997,7 +1009,7 @@ spec:
9971009
the ones listed in the namespaces field. null selector
9981010
and null or empty namespaces list means "this pod's
9991011
namespace". An empty selector ({}) matches all namespaces.
1000-
This field is alpha-level and is only honored when
1012+
This field is beta-level and is only honored when
10011013
PodAffinityNamespaceSelector feature is enabled.
10021014
properties:
10031015
matchExpressions:
@@ -1278,6 +1290,18 @@ spec:
12781290
description: GMSACredentialSpecName is the name of the
12791291
GMSA credential spec to use.
12801292
type: string
1293+
hostProcess:
1294+
description: HostProcess determines if a container should
1295+
be run as a 'Host Process' container. This field is
1296+
alpha-level and will only be honored by components that
1297+
enable the WindowsHostProcessContainers feature flag.
1298+
Setting this field without the feature flag will result
1299+
in errors when validating the Pod. All of a Pod's containers
1300+
must have the same effective HostProcess value (it is
1301+
not allowed to have a mix of HostProcess containers
1302+
and non-HostProcess containers). In addition, if HostProcess
1303+
is true then HostNetwork must also be set to true.
1304+
type: boolean
12811305
runAsUserName:
12821306
description: The UserName in Windows to run the entrypoint
12831307
of the container process. Defaults to the user specified
@@ -1458,6 +1482,18 @@ spec:
14581482
description: GMSACredentialSpecName is the name of the
14591483
GMSA credential spec to use.
14601484
type: string
1485+
hostProcess:
1486+
description: HostProcess determines if a container should
1487+
be run as a 'Host Process' container. This field is
1488+
alpha-level and will only be honored by components that
1489+
enable the WindowsHostProcessContainers feature flag.
1490+
Setting this field without the feature flag will result
1491+
in errors when validating the Pod. All of a Pod's containers
1492+
must have the same effective HostProcess value (it is
1493+
not allowed to have a mix of HostProcess containers
1494+
and non-HostProcess containers). In addition, if HostProcess
1495+
is true then HostNetwork must also be set to true.
1496+
type: boolean
14611497
runAsUserName:
14621498
description: The UserName in Windows to run the entrypoint
14631499
of the container process. Defaults to the user specified
@@ -1652,6 +1688,18 @@ spec:
16521688
description: GMSACredentialSpecName is the name of the
16531689
GMSA credential spec to use.
16541690
type: string
1691+
hostProcess:
1692+
description: HostProcess determines if a container should
1693+
be run as a 'Host Process' container. This field is
1694+
alpha-level and will only be honored by components that
1695+
enable the WindowsHostProcessContainers feature flag.
1696+
Setting this field without the feature flag will result
1697+
in errors when validating the Pod. All of a Pod's containers
1698+
must have the same effective HostProcess value (it is
1699+
not allowed to have a mix of HostProcess containers
1700+
and non-HostProcess containers). In addition, if HostProcess
1701+
is true then HostNetwork must also be set to true.
1702+
type: boolean
16551703
runAsUserName:
16561704
description: The UserName in Windows to run the entrypoint
16571705
of the container process. Defaults to the user specified

‎integrity-shield-operator/bundle/manifests/integrity-shield-operator.clusterserviceversion.yaml

Lines changed: 3 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ metadata:
7676
}
7777
]
7878
capabilities: Basic Install
79-
operators.operatorframework.io/builder: operator-sdk-v1.12.0
79+
operators.operatorframework.io/builder: operator-sdk-v1.10.0+git
8080
operators.operatorframework.io/project_layout: go.kubebuilder.io/v3
8181
containerImage: quay.io/open-cluster-management/integrity-shield-operator:0.3.0
8282
name: integrity-shield-operator.v0.3.0
@@ -253,7 +253,6 @@ spec:
253253
- apiGroups:
254254
- apis.integrityshield.io
255255
resources:
256-
- integrityshieldren
257256
- integrityshields
258257
verbs:
259258
- create
@@ -263,20 +262,6 @@ spec:
263262
- patch
264263
- update
265264
- watch
266-
- apiGroups:
267-
- apis.integrityshield.io
268-
resources:
269-
- integrityshields
270-
- integrityshields/finalizers
271-
- manifestintegrityprofiles
272-
verbs:
273-
- create
274-
- delete
275-
- get
276-
- list
277-
- patch
278-
- update
279-
- watch
280265
- apiGroups:
281266
- apis.integrityshield.io
282267
resources:
@@ -303,16 +288,6 @@ spec:
303288
- patch
304289
- update
305290
- watch
306-
- apiGroups:
307-
- coordination.k8s.io
308-
resources:
309-
- leases
310-
verbs:
311-
- create
312-
- delete
313-
- get
314-
- list
315-
- update
316291
- apiGroups:
317292
- ""
318293
resources:
@@ -329,18 +304,6 @@ spec:
329304
- patch
330305
- update
331306
- watch
332-
- apiGroups:
333-
- policy
334-
resources:
335-
- podsecuritypolicies
336-
verbs:
337-
- create
338-
- delete
339-
- get
340-
- list
341-
- patch
342-
- update
343-
- watch
344307
- apiGroups:
345308
- rbac.authorization.k8s.io
346309
resources:
@@ -476,4 +439,5 @@ spec:
476439
maturity: alpha
477440
provider:
478441
name: Community
479-
version: 0.3.0
442+
replaces: integrity-shield-operator.v0.1.6
443+
version: 0.3.0

‎integrity-shield-operator/bundle/metadata/annotations.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ annotations:
55
operators.operatorframework.io.bundle.metadata.v1: metadata/
66
operators.operatorframework.io.bundle.package.v1: integrity-shield-operator
77
operators.operatorframework.io.bundle.channels.v1: alpha-0.3.0
8-
operators.operatorframework.io.metrics.builder: operator-sdk-v1.12.0
8+
operators.operatorframework.io.metrics.builder: operator-sdk-v1.10.0+git
99
operators.operatorframework.io.metrics.mediatype.v1: metrics+v1
1010
operators.operatorframework.io.metrics.project_layout: go.kubebuilder.io/v3
1111

0 commit comments

Comments
 (0)