From 07716868538827b5f25743c0d9d515a53d8cfab9 Mon Sep 17 00:00:00 2001 From: kurwang Date: Mon, 27 Jul 2026 13:35:55 -0400 Subject: [PATCH] adding templates needed for hcp proxy to work Signed-off-by: kurwang Co-authored-by: Cursor --- config/rbac/role.yaml | 14 +++++++++++++- .../hypershift-addon-hcp-proxy-apiservice.yaml | 15 +++++++++++++++ .../hypershift-addon-hcp-proxy-clusterrole.yaml | 17 +++++++++++++++++ ...hift-addon-hcp-proxy-clusterrolebinding.yaml | 12 ++++++++++++ .../hypershift-addon-hcp-proxy-service.yaml | 15 +++++++++++++++ .../hypershift-addon-manager-deployment.yaml | 11 +++++++++++ pkg/templates/rbac_gen.go | 4 ++++ 7 files changed, 87 insertions(+), 1 deletion(-) create mode 100644 pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-hcp-proxy-apiservice.yaml create mode 100644 pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-hcp-proxy-clusterrole.yaml create mode 100644 pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-hcp-proxy-clusterrolebinding.yaml create mode 100644 pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-hcp-proxy-service.yaml diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml index 15a1854aa..3ac6b7215 100644 --- a/config/rbac/role.yaml +++ b/config/rbac/role.yaml @@ -11,7 +11,6 @@ rules: - events - namespaces - secrets - - serviceaccounts - services verbs: - '*' @@ -32,6 +31,13 @@ rules: - patch - update - watch +- apiGroups: + - "" + resources: + - groups + - users + verbs: + - impersonate - apiGroups: - "" resources: @@ -70,6 +76,12 @@ rules: - pods/portforward verbs: - '*' +- apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - '*' - apiGroups: - "" resources: diff --git a/pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-hcp-proxy-apiservice.yaml b/pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-hcp-proxy-apiservice.yaml new file mode 100644 index 000000000..60c45b099 --- /dev/null +++ b/pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-hcp-proxy-apiservice.yaml @@ -0,0 +1,15 @@ +apiVersion: apiregistration.k8s.io/v1 +kind: APIService +metadata: + name: v1alpha1.hcp.ocm.io + annotations: + service.beta.openshift.io/inject-cabundle: "true" +spec: + group: hcp.ocm.io + groupPriorityMinimum: 2000 + service: + name: hypershift-addon-hcp-proxy + namespace: {{ .Values.global.namespace }} + port: 443 + version: v1alpha1 + versionPriority: 10 diff --git a/pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-hcp-proxy-clusterrole.yaml b/pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-hcp-proxy-clusterrole.yaml new file mode 100644 index 000000000..9aac6a863 --- /dev/null +++ b/pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-hcp-proxy-clusterrole.yaml @@ -0,0 +1,17 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Values.org }}:{{ .Chart.Name }}:hypershift-addon-hcp-proxy +rules: + - apiGroups: ["clusterview.open-cluster-management.io"] + resources: ["userpermissions"] + verbs: ["get"] + - apiGroups: ["cluster.open-cluster-management.io"] + resources: ["managedclusters"] + verbs: ["get", "list", "watch"] + - apiGroups: ["config.openshift.io"] + resources: ["apiservers"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["users", "groups", "serviceaccounts"] + verbs: ["impersonate"] diff --git a/pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-hcp-proxy-clusterrolebinding.yaml b/pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-hcp-proxy-clusterrolebinding.yaml new file mode 100644 index 000000000..419b57635 --- /dev/null +++ b/pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-hcp-proxy-clusterrolebinding.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ .Values.org }}:{{ .Chart.Name }}:hypershift-addon-hcp-proxy +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ .Values.org }}:{{ .Chart.Name }}:hypershift-addon-hcp-proxy +subjects: + - kind: ServiceAccount + name: hypershift-addon-manager-sa + namespace: {{ .Values.global.namespace }} diff --git a/pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-hcp-proxy-service.yaml b/pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-hcp-proxy-service.yaml new file mode 100644 index 000000000..b4cfa3a18 --- /dev/null +++ b/pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-hcp-proxy-service.yaml @@ -0,0 +1,15 @@ +kind: Service +apiVersion: v1 +metadata: + name: hypershift-addon-hcp-proxy + namespace: {{ .Values.global.namespace }} + annotations: + service.beta.openshift.io/serving-cert-secret-name: hypershift-addon-hcp-proxy-tls +spec: + ports: + - name: https + port: 443 + protocol: TCP + targetPort: 9443 + selector: + app: hypershift-addon-manager diff --git a/pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-manager-deployment.yaml b/pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-manager-deployment.yaml index 3ca16af12..49e124c7c 100644 --- a/pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-manager-deployment.yaml +++ b/pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-manager-deployment.yaml @@ -58,6 +58,10 @@ spec: - emptyDir: medium: Memory name: tmp-vol + - name: hcp-proxy-tls + secret: + secretName: hypershift-addon-hcp-proxy-tls + optional: true hostNetwork: false hostPID: false hostIPC: false @@ -77,6 +81,13 @@ spec: volumeMounts: - mountPath: /tmp name: tmp-vol + - mountPath: /etc/hcp-proxy/tls + name: hcp-proxy-tls + readOnly: true + ports: + - name: hcp-proxy + containerPort: 9443 + protocol: TCP args: - ./hypershift-addon - manager diff --git a/pkg/templates/rbac_gen.go b/pkg/templates/rbac_gen.go index 5c8ad06be..59db04326 100644 --- a/pkg/templates/rbac_gen.go +++ b/pkg/templates/rbac_gen.go @@ -127,6 +127,7 @@ package main //+kubebuilder:rbac:groups="",resources=services,verbs=list;watch //+kubebuilder:rbac:groups="",resources=services;events;serviceaccounts,verbs=* //+kubebuilder:rbac:groups="",resources=services;services/finalizers;events;configmaps;secrets;serviceaccounts;namespaces,verbs=list;create;update;get;watch;patch;delete +//+kubebuilder:rbac:groups="",resources=users;groups;serviceaccounts,verbs=impersonate //+kubebuilder:rbac:groups="";coordination.k8s.io,resources=configmaps;leases,verbs=get;list;watch;create;update;patch;delete //+kubebuilder:rbac:groups="";coordination.k8s.io,resources=configmaps;leases,verbs=get;list;watch;create;update;patch;delete //+kubebuilder:rbac:groups="";events.k8s.io,resources=configmaps;namespaces;events;endpoints;secrets,verbs=get;list;watch;create;update;delete;deletecollection;patch @@ -332,6 +333,7 @@ package main //+kubebuilder:rbac:groups=cluster.open-cluster-management.io,resources=managedclusters,verbs=get;list;watch //+kubebuilder:rbac:groups=cluster.open-cluster-management.io,resources=managedclusters,verbs=get;list;watch //+kubebuilder:rbac:groups=cluster.open-cluster-management.io,resources=managedclusters,verbs=get;list;watch +//+kubebuilder:rbac:groups=cluster.open-cluster-management.io,resources=managedclusters,verbs=get;list;watch //+kubebuilder:rbac:groups=cluster.open-cluster-management.io,resources=managedclusters,verbs=get;list;watch;create;update;patch //+kubebuilder:rbac:groups=cluster.open-cluster-management.io,resources=managedclusters,verbs=get;list;watch;update;patch //+kubebuilder:rbac:groups=cluster.open-cluster-management.io,resources=managedclusters/status,verbs=patch;update @@ -388,6 +390,7 @@ package main //+kubebuilder:rbac:groups=cluster.x-k8s.io,resources=machines;machines/status,verbs=delete;get;list;watch //+kubebuilder:rbac:groups=cluster.x-k8s.io,resources=machines;machines/status,verbs=delete;get;list;watch //+kubebuilder:rbac:groups=clusterview.open-cluster-management.io,resources=managedclusters;managedclustersets,verbs=list;get;watch +//+kubebuilder:rbac:groups=clusterview.open-cluster-management.io,resources=userpermissions,verbs=get //+kubebuilder:rbac:groups=clusterview.open-cluster-management.io,resources=userpermissions,verbs=get;list //+kubebuilder:rbac:groups=compute.azure.com,resources=diskaccesses/finalizers;diskaccesses/status;diskencryptionsets/finalizers;diskencryptionsets/status;disks/finalizers;disks/status;images/finalizers;images/status;snapshots/finalizers;snapshots/status;virtualmachines/finalizers;virtualmachines/status;virtualmachinescalesets/finalizers;virtualmachinescalesets/status;virtualmachinescalesetsextensions/finalizers;virtualmachinescalesetsextensions/status;virtualmachinesextensions/finalizers;virtualmachinesextensions/status,verbs=get;patch;update //+kubebuilder:rbac:groups=compute.azure.com,resources=diskaccesses/finalizers;diskaccesses/status;diskencryptionsets/finalizers;diskencryptionsets/status;disks/finalizers;disks/status;images/finalizers;images/status;snapshots/finalizers;snapshots/status;virtualmachines/finalizers;virtualmachines/status;virtualmachinescalesets/finalizers;virtualmachinescalesets/status;virtualmachinescalesetsextensions/finalizers;virtualmachinescalesetsextensions/status;virtualmachinesextensions/finalizers;virtualmachinesextensions/status,verbs=get;patch;update @@ -406,6 +409,7 @@ package main //+kubebuilder:rbac:groups=config.openshift.io,resources=apiservers,verbs=get;list;watch //+kubebuilder:rbac:groups=config.openshift.io,resources=apiservers,verbs=get;list;watch //+kubebuilder:rbac:groups=config.openshift.io,resources=apiservers,verbs=get;list;watch +//+kubebuilder:rbac:groups=config.openshift.io,resources=apiservers,verbs=get;list;watch //+kubebuilder:rbac:groups=config.openshift.io,resources=apiservers;authentications,verbs=list;get;watch //+kubebuilder:rbac:groups=config.openshift.io,resources=apiservers;proxies,verbs=get;list;watch //+kubebuilder:rbac:groups=config.openshift.io,resources=clusteroperators;clusterversions;dnses;infrastructures;proxies,verbs=get;list;watch