Skip to content

Commit 0c518e4

Browse files
janbolljanboll
committed
Use helm for pko
1 parent 35408ec commit 0c518e4

16 files changed

+205
-2
lines changed

‎config/config.schema.json

+20
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,26 @@
5151
"regionalSubdomain"
5252
]
5353
},
54+
"pko": {
55+
"type": "object",
56+
"properties": {
57+
"image": {
58+
"type": "string"
59+
},
60+
"imageManager": {
61+
"type": "string"
62+
},
63+
"imageTag": {
64+
"type": "string"
65+
}
66+
},
67+
"additionalProperties": false,
68+
"required": [
69+
"image",
70+
"imageManager",
71+
"imageTag"
72+
]
73+
},
5474
"clusterService": {
5575
"type": "object",
5676
"properties": {

‎config/config.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,11 @@ defaults:
7878
consumerName: hcp-underlay-{{ .ctx.regionShort }}-mgmt-{{ .ctx.stamp }}
7979
imageBase: quay.io/redhat-user-workloads/maestro-rhtap-tenant/maestro/maestro
8080

81+
pko:
82+
image: arohcpsvcdev.azurecr.io/package-operator/package-operator-package
83+
imageManager: arohcpsvcdev.azurecr.io/package-operator/package-operator-manager
84+
imageTag: v1.15.0
85+
8186
# Cluster Service
8287
clusterService:
8388
acrRG: global

‎config/public-cloud-cs-pr.json

+5
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,11 @@
182182
},
183183
"ocpAcrName": "arohcpocpdev",
184184
"oidcStorageAccountName": "arohcpoidccspr",
185+
"pko": {
186+
"image": "arohcpsvcdev.azurecr.io/package-operator/package-operator-package",
187+
"imageManager": "arohcpsvcdev.azurecr.io/package-operator/package-operator-manager",
188+
"imageTag": "v1.15.0"
189+
},
185190
"podSubnetPrefix": "10.128.64.0/18",
186191
"region": "westus3",
187192
"regionRG": "hcp-underlay-cspr",

‎config/public-cloud-dev.json

+5
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,11 @@
182182
},
183183
"ocpAcrName": "arohcpocpdev",
184184
"oidcStorageAccountName": "arohcpoidcdev",
185+
"pko": {
186+
"image": "arohcpsvcdev.azurecr.io/package-operator/package-operator-package",
187+
"imageManager": "arohcpsvcdev.azurecr.io/package-operator/package-operator-manager",
188+
"imageTag": "v1.15.0"
189+
},
185190
"podSubnetPrefix": "10.128.64.0/18",
186191
"region": "westus3",
187192
"regionRG": "hcp-underlay-dev",

‎config/public-cloud-personal-dev.json

+5
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,11 @@
182182
},
183183
"ocpAcrName": "arohcpocpdev",
184184
"oidcStorageAccountName": "arohcpoidcusw3tst",
185+
"pko": {
186+
"image": "arohcpsvcdev.azurecr.io/package-operator/package-operator-package",
187+
"imageManager": "arohcpsvcdev.azurecr.io/package-operator/package-operator-manager",
188+
"imageTag": "v1.15.0"
189+
},
185190
"podSubnetPrefix": "10.128.64.0/18",
186191
"region": "westus3",
187192
"regionRG": "hcp-underlay-usw3tst",

‎dev-infrastructure/configurations/global-roles.bicepparam

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
using '../templates/global-roles.bicep'
2+
3+
param manageTokenRole = true

‎dev-infrastructure/templates/mgmt-cluster.bicep

+5
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,11 @@ module mgmtCluster '../modules/aks-cluster-base.bicep' = {
107107
namespace: 'maestro'
108108
serviceAccountName: 'maestro'
109109
}
110+
package_operator: {
111+
uamiName: 'package-operator'
112+
namespace: 'package-operator-system'
113+
serviceAccountName: 'package-operator'
114+
}
110115
})
111116
aksKeyVaultName: aksKeyVaultName
112117
acrPullResourceGroups: acrPullResourceGroups

‎pko/Makefile

+35-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,39 @@
1-
SHELL = /bin/bash
1+
-include ../setup-env.mk
2+
-include ../helm-cmd.mk
3+
HELM_CMD ?= helm upgrade --install
4+
5+
NAMESPACE ?= package-operator-system
6+
ARO_HCP_IMAGE_REGISTRY ?= ${ARO_HCP_IMAGE_ACR}.azurecr.io
7+
ARO_HCP_IMAGE_REPOSITORY ?= package-operator/package-operator-package
28

39
deploy:
4-
kubectl apply -f https://github.com/package-operator/package-operator/releases/download/v1.15.0/self-bootstrap-job.yaml
10+
@kubectl create namespace ${NAMESPACE} --dry-run=client -o json | kubectl apply -f -
11+
PKO_MI_CLIENT_ID=$$(az identity show \
12+
-g ${RESOURCEGROUP} \
13+
-n package-operator \
14+
--query clientId -o tsv) && \
15+
PKO_MI_TENANT_ID=$$(az identity show \
16+
-g ${RESOURCEGROUP} \
17+
-n package-operator \
18+
--query tenantId -o tsv) && \
19+
IMAGE_PULLER_MI_CLIENT_ID=$$(az identity show \
20+
-g ${RESOURCEGROUP} \
21+
-n image-puller \
22+
--query clientId -o tsv) && \
23+
IMAGE_PULLER_MI_TENANT_ID=$$(az identity show \
24+
-g ${RESOURCEGROUP} \
25+
-n image-puller \
26+
--query tenantId -o tsv) && \
27+
${HELM_CMD} package-operator ./helm \
28+
--namespace ${NAMESPACE} \
29+
--set pkoImage=${PKO_IMAGE} \
30+
--set pkoImageManager=${PKO_IMAGE_MANAGER} \
31+
--set pkoImageTag=${PKO_IMAGE_TAG} \
32+
--set pullBinding.workloadIdentityClientId="$${IMAGE_PULLER_MI_CLIENT_ID}" \
33+
--set pullBinding.workloadIdentityTenantId="$${IMAGE_PULLER_MI_TENANT_ID}" \
34+
--set pullBinding.registry=${ARO_HCP_IMAGE_REGISTRY} \
35+
--set pullBinding.scope='repository:*:pull' \
36+
--set serviceAccount.workloadIdentityClientId="$${PKO_MI_CLIENT_ID}" \
37+
--set serviceAccount.workloadIdentityTenantId="$${PKO_MI_CLIENT_ID}"
538

639
.PHONY: deploy

‎pko/config.mk

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
IMAGE_BASE ?= arohcpsvcdev.azurecr.io/package-operator/package-operator-package
2+
IMAGE_TAG ?= v1.11.0

‎pko/helm/Chart.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: v2
2+
name: package-operator
3+
description: A Helm chart for package-operator
4+
type: application
5+
6+
version: 0.1.0
7+
appVersion: "1.0.0"

‎pko/helm/templates/acrpullbinding.yaml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: acrpull.microsoft.com/v1beta2
2+
kind: AcrPullBinding
3+
metadata:
4+
name: pull-binding
5+
spec:
6+
acr:
7+
environment: PublicCloud
8+
server: {{ .Values.pullBinding.registry }}
9+
scope: {{ .Values.pullBinding.scope }}
10+
auth:
11+
workloadIdentity:
12+
serviceAccountRef: package-operator
13+
clientID: {{ .Values.pullBinding.workloadIdentityClientId }}
14+
tenantID: {{ .Values.pullBinding.workloadIdentityTenantId }}
15+
serviceAccountName: package-operator

‎pko/helm/templates/clusterrolebinding.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
name: package-operator
5+
labels:
6+
package-operator.run/cache: "True"
7+
roleRef:
8+
apiGroup: rbac.authorization.k8s.io
9+
kind: ClusterRole
10+
name: cluster-admin
11+
subjects:
12+
- kind: ServiceAccount
13+
name: package-operator
14+
namespace: package-operator-system

‎pko/helm/templates/job.yaml

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
apiVersion: batch/v1
2+
kind: Job
3+
metadata:
4+
name: package-operator-bootstrap
5+
namespace: package-operator-system
6+
spec:
7+
# delete right after completion
8+
ttlSecondsAfterFinished: 0
9+
# set deadline to 30min
10+
activeDeadlineSeconds: 1800
11+
template:
12+
spec:
13+
restartPolicy: OnFailure
14+
serviceAccountName: package-operator
15+
containers:
16+
- name: package-operator
17+
image: "{{ .Values.pkoImageManager }}:{{ .Values.pkoImageTag }}"
18+
args: ["-self-bootstrap={{ .Values.pkoImage }}:{{ .Values.pkoImageTag }}"]
19+
imagePullPolicy: Always
20+
env:
21+
- name: PKO_REGISTRY_HOST_OVERRIDES
22+
value: ''
23+
- name: PKO_CONFIG
24+
value: ''
25+
- name: PKO_NAMESPACE
26+
valueFrom:
27+
fieldRef:
28+
fieldPath: metadata.namespace
29+
- name: PKO_SERVICE_ACCOUNT_NAMESPACE
30+
valueFrom:
31+
fieldRef:
32+
fieldPath: metadata.namespace
33+
- name: PKO_SERVICE_ACCOUNT_NAME
34+
valueFrom:
35+
fieldRef:
36+
fieldPath: spec.serviceAccountName
37+
backoffLimit: 3

‎pko/helm/templates/serviceaccount.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: package-operator
5+
namespace: package-operator-system
6+
annotations:
7+
azure.workload.identity/client-id: '{{ .Values.serviceAccount.workloadIdentityClientId }}'
8+
azure.workload.identity/tenant-id: '{{ .Values.serviceAccount.workloadIdentityTenantId }}'
9+
labels:
10+
package-operator.run/cache: "True"

‎pko/helm/values.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
pkoImage: ""
2+
pkoImageManager: ""
3+
pkoImageTag: ""
4+
pullBinding:
5+
registry: ""
6+
scope: ""
7+
workloadIdentityClientId: ""
8+
workloadIdentityTenantId: ""
9+
serviceAccount:
10+
workloadIdentityClientId: ""
11+
workloadIdentityTenantId: ""

‎pko/pipeline.yaml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
$schema: "pipeline.schema.v1"
2+
serviceGroup: Microsoft.Azure.ARO.HCP.RP.PKO
3+
rolloutName: RP PKO Rollout
4+
resourceGroups:
5+
- name: {{ .mgmt.rg }}
6+
subscription: {{ .svc.subscription }}
7+
aksCluster: {{ .aksName }}
8+
steps:
9+
- name: deploy
10+
action: Shell
11+
command: make deploy
12+
dryRun:
13+
variables:
14+
- name: DRY_RUN
15+
value: "true"
16+
variables:
17+
- name: ARO_HCP_IMAGE_ACR
18+
configRef: svcAcrName
19+
- name: PKO_IMAGE
20+
configRef: pko.image
21+
- name: PKO_IMAGE_MANAGER
22+
configRef: pko.imageManager
23+
- name: PKO_IMAGE_TAG
24+
configRef: pko.imageTag
25+
- name: RESOURCEGROUP
26+
configRef: mgmt.rg

0 commit comments

Comments
 (0)