Add OpenShift specifics and fix resources for ubiquity

Signed-off-by: Ricardo Zanini <[email protected]>

workflowproj-apiserver/artifacts/examples/01-ns.yaml

@@ -15,4 +15,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: workflowproj
+  name: sonataflow-operator-system

workflowproj-apiserver/artifacts/examples/02-service_account.yaml

@@ -15,5 +15,5 @@
 kind: ServiceAccount
 apiVersion: v1
 metadata:
-  name: apiserver
-  namespace: workflowproj
+  name: workflowproj-apiserver
+  namespace: sonataflow-operator-system

workflowproj-apiserver/artifacts/examples/03-auth_delegator.yaml

@@ -15,12 +15,12 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: workflowproj:system:auth-delegator
+  name: workflowproj-apiserver:system:auth-delegator
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: system:auth-delegator
 subjects:
   - kind: ServiceAccount
-    name: apiserver
-    namespace: workflowproj
+    name: workflowproj-apiserver
+    namespace: sonataflow-operator-system

workflowproj-apiserver/artifacts/examples/04-auth_reader.yaml

@@ -16,12 +16,13 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: workflowproj-auth-reader
+  # The rolebinding must be in the same namespace as the role we are referring below
   namespace: kube-system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: extension-apiserver-authentication-reader
 subjects:
   - kind: ServiceAccount
-    name: apiserver
-    namespace: workflowproj
+    name: workflowproj-apiserver
+    namespace: sonataflow-operator-system

workflowproj-apiserver/artifacts/examples/05-rbac.yaml

@@ -15,7 +15,7 @@
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: aggregated-apiserver-clusterrole
+  name: workflowproj-apiserver-clusterrole
 rules:
   - apiGroups:
       - ""

workflowproj-apiserver/artifacts/examples/06-rbac_bind.yaml

@@ -15,12 +15,12 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: sample-apiserver-clusterrolebinding
+  name: workflowproj-apiserver-clusterrolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: aggregated-apiserver-clusterrole
+  name: workflowproj-apiserver-clusterrole
 subjects:
   - kind: ServiceAccount
-    name: apiserver
-    namespace: workflowproj
+    name: workflowproj-apiserver
+    namespace: sonataflow-operator-system

workflowproj-apiserver/artifacts/examples/07-deployment.yaml

@@ -16,7 +16,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: workflowproj-server
-  namespace: workflowproj
+  namespace: sonataflow-operator-system
   labels:
     apiserver: "true"
 spec:
@@ -29,12 +29,14 @@ spec:
       labels:
         apiserver: "true"
     spec:
-      serviceAccountName: apiserver
+      serviceAccountName: workflowproj-apiserver
       containers:
         - name: workflowproj-server
           # build from staging/src/k8s.io/sample-apiserver/artifacts/simple-image/Dockerfile
           # or
           # docker pull registry.k8s.io/e2e-test-images/sample-apiserver:1.17.4
           # docker tag registry.k8s.io/e2e-test-images/sample-apiserver:1.17.4 kube-sample-apiserver:latest
           image: dev.local/workflowproj-apiserver:latest
-          imagePullPolicy: Never
+          imagePullPolicy: Never
+          args:
+            - '--secure-port=8443'

workflowproj-apiserver/artifacts/examples/08-service.yaml

@@ -15,12 +15,12 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: api
-  namespace: workflowproj
+  name: workflowproj-apiserver
+  namespace: sonataflow-operator-system
 spec:
   ports:
     - port: 443
       protocol: TCP
-      targetPort: 443
+      targetPort: 8443
   selector:
     apiserver: "true"

workflowproj-apiserver/artifacts/examples/09-apiservice.yaml

@@ -22,6 +22,6 @@ spec:
   groupPriorityMinimum: 1000
   versionPriority: 15
   service:
-    name: api
-    namespace: workflowproj
+    name: workflowproj-apiserver
+    namespace: sonataflow-operator-system
   version: v1alpha08

workflowproj-apiserver/artifacts/examples/openshift/07-deployment.yaml

@@ -0,0 +1,53 @@
+# Copyright 2023 Red Hat, Inc. and/or its affiliates
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: workflowproj-server
+  namespace: sonataflow-operator-system
+  labels:
+    apiserver: "true"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      apiserver: "true"
+  template:
+    metadata:
+      labels:
+        apiserver: "true"
+    spec:
+      serviceAccountName: workflowproj-apiserver
+      volumes:
+        - name: tls
+          secret:
+            # this secret is created automatically by ocp, see the annotation in our service
+            secretName: workflowproj-apiserver-cert
+            defaultMode: 420
+      containers:
+        - name: workflowproj-server
+          image: dev.local/workflowproj-apiserver:latest
+          imagePullPolicy: Never
+          args:
+            - '--secure-port=8443'
+            # We use the certificate provided by the internal OCP CA
+            - '--tls-cert-file=/var/run/kubernetes/tls.crt'
+            - '--tls-private-key-file=/var/run/kubernetes/tls.key'
+            # Priority and Fairness are available only on k8s 1.20+
+            - '--feature-gates=APIPriorityAndFairness=false'
+          volumeMounts:
+            - name: tls
+              readOnly: true
+              mountPath: /var/run/kubernetes

workflowproj-apiserver/artifacts/examples/openshift/08-service.yaml

@@ -0,0 +1,28 @@
+# Copyright 2023 Red Hat, Inc. and/or its affiliates
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: workflowproj-apiserver
+  namespace: sonataflow-operator-system
+  annotations:
+    service.beta.openshift.io/serving-cert-secret-name: workflowproj-apiserver-cert
+spec:
+  ports:
+    - port: 443
+      protocol: TCP
+      targetPort: 8443
+  selector:
+    apiserver: "true"