adding templates needed for hcp proxy to work

config/rbac/role.yaml

@@ -11,7 +11,6 @@ rules:
   - events
   - namespaces
   - secrets
-  - serviceaccounts
   - services
   verbs:
   - '*'
@@ -32,6 +31,13 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - groups
+  - users
+  verbs:
+  - impersonate
 - apiGroups:
   - ""
   resources:
@@ -70,6 +76,12 @@ rules:
   - pods/portforward
   verbs:
   - '*'
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts
+  verbs:
+  - '*'
 - apiGroups:
   - ""
   resources:

pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-hcp-proxy-apiservice.yaml

@@ -0,0 +1,15 @@
+apiVersion: apiregistration.k8s.io/v1
+kind: APIService
+metadata:
+  name: v1alpha1.hcp.ocm.io
+  annotations:
+    service.beta.openshift.io/inject-cabundle: "true"
+spec:
+  group: hcp.ocm.io
+  groupPriorityMinimum: 2000
+  service:
+    name: hypershift-addon-hcp-proxy
+    namespace: {{ .Values.global.namespace }}
+    port: 443
+  version: v1alpha1
+  versionPriority: 10

pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-hcp-proxy-clusterrole.yaml

@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Values.org }}:{{ .Chart.Name }}:hypershift-addon-hcp-proxy
+rules:
+  - apiGroups: ["clusterview.open-cluster-management.io"]
+    resources: ["userpermissions"]
+    verbs: ["get"]
+  - apiGroups: ["cluster.open-cluster-management.io"]
+    resources: ["managedclusters"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["config.openshift.io"]
+    resources: ["apiservers"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["users", "groups", "serviceaccounts"]
+    verbs: ["impersonate"]

pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-hcp-proxy-clusterrolebinding.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ .Values.org }}:{{ .Chart.Name }}:hypershift-addon-hcp-proxy
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Values.org }}:{{ .Chart.Name }}:hypershift-addon-hcp-proxy
+subjects:
+  - kind: ServiceAccount
+    name: hypershift-addon-manager-sa
+    namespace: {{ .Values.global.namespace }}

pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-hcp-proxy-service.yaml

@@ -0,0 +1,15 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: hypershift-addon-hcp-proxy
+  namespace: {{ .Values.global.namespace }}
+  annotations:
+    service.beta.openshift.io/serving-cert-secret-name: hypershift-addon-hcp-proxy-tls
+spec:
+  ports:
+    - name: https
+      port: 443
+      protocol: TCP
+      targetPort: 9443
+  selector:
+    app: hypershift-addon-manager

pkg/templates/charts/toggle/hypershift/templates/hypershift-addon-manager-deployment.yaml

@@ -58,6 +58,10 @@ spec:
       - emptyDir:
           medium: Memory
         name: tmp-vol
+      - name: hcp-proxy-tls
+        secret:
+          secretName: hypershift-addon-hcp-proxy-tls
+          optional: true
       hostNetwork: false
       hostPID: false
       hostIPC: false
@@ -77,6 +81,13 @@ spec:
           volumeMounts:
           - mountPath: /tmp
             name: tmp-vol
+          - mountPath: /etc/hcp-proxy/tls
+            name: hcp-proxy-tls
+            readOnly: true
+          ports:
+          - name: hcp-proxy
+            containerPort: 9443
+            protocol: TCP
           args:
             - ./hypershift-addon
             - manager