OSD-6646: osd-cluster-ready Job is managed by configure-alertmanager-…

…operator - With openshift/configure-alertmanager-operator#143, configure-alertmanager-operator is responsible for deploying osd-cluster-ready, so that Job manifest is removed. - openshift/osd-cluster-ready#7 removes the logic that talks to prometheus and alertmanager, so `pods/exec` permissions are removed. - It's weird that this RBAC should still live here in MCC. Add a README acknowledging/explaining that. OSD-6646
2uasimojo · Mar 9, 2021 · 0d66727 · 0d66727
1 parent 31bf1a2
commit 0d66727
Show file tree

Hide file tree

Showing 6 changed files with 12 additions and 114 deletions.
diff --git a/deploy/osd-cluster-ready/20-osd-ready.openshift-monitoring.Role.yaml b/deploy/osd-cluster-ready/20-osd-ready.openshift-monitoring.Role.yaml
@@ -12,9 +12,3 @@ rules:
   verbs:
   - get
   - list
-- apiGroups:
-  - ""
-  resources:
-  - pods/exec
-  verbs:
-  - create
diff --git a/deploy/osd-cluster-ready/60-osd-ready.Job.yaml b/deploy/osd-cluster-ready/60-osd-ready.Job.yaml
diff --git a/deploy/osd-cluster-ready/README.md b/deploy/osd-cluster-ready/README.md
@@ -0,0 +1,12 @@
+# osd-cluster-ready RBAC
+
+This directory contains the RBAC artifacts -- ServiceAccount and [Cluster]Role[Bindings] -- for the [osd-cluster-ready](https://github.com/openshift/osd-cluster-ready) Job that is managed by [configure-alertmanager-operator](https://github.com/openshift/configure-alertmanager-operator).
+
+This is in lieu of having it either:
+- In osd-cluster-ready itself.
+  We have a [deploy/ directory](https://github.com/openshift/osd-cluster-ready/tree/master/deploy) there already, but those artifacts are not used for real deployments currently.
+  Unclear how we would do that.
+- In [configure-alertmanager-operator](https://github.com/openshift/configure-alertmanager-operator), because that would seem weird.
+
+That said, it is awkward having it here, because now there are three different repositories that manage (different aspects of) osd-cluster-ready.
+So we may some day try to move it.
diff --git a/hack/00-osd-managed-cluster-config-integration.yaml.tmpl b/hack/00-osd-managed-cluster-config-integration.yaml.tmpl
@@ -4868,12 +4868,6 @@ objects:
         verbs:
         - get
         - list
-      - apiGroups:
-        - ''
-        resources:
-        - pods/exec
-        verbs:
-        - create
     - apiVersion: rbac.authorization.k8s.io/v1
       kind: RoleBinding
       metadata:
@@ -4973,27 +4967,6 @@ objects:
       - kind: ServiceAccount
         name: osd-cluster-ready
         namespace: openshift-monitoring
-    - apiVersion: batch/v1
-      kind: Job
-      metadata:
-        name: osd-cluster-ready
-        namespace: openshift-monitoring
-      spec:
-        backoffLimit: 500
-        template:
-          metadata:
-            name: osd-cluster-ready
-          spec:
-            containers:
-            - env:
-              - name: MAX_CLUSTER_AGE_MINUTES
-                value: '240'
-              name: osd-cluster-ready
-              image: quay.io/openshift-sre/osd-cluster-ready:v0.1.38-614bf59
-              command:
-              - /root/main
-            restartPolicy: OnFailure
-            serviceAccountName: osd-cluster-ready
 - apiVersion: hive.openshift.io/v1
   kind: SelectorSyncSet
   metadata:

diff --git a/hack/00-osd-managed-cluster-config-production.yaml.tmpl b/hack/00-osd-managed-cluster-config-production.yaml.tmpl
@@ -4868,12 +4868,6 @@ objects:
         verbs:
         - get
         - list
-      - apiGroups:
-        - ''
-        resources:
-        - pods/exec
-        verbs:
-        - create
     - apiVersion: rbac.authorization.k8s.io/v1
       kind: RoleBinding
       metadata:
@@ -4973,27 +4967,6 @@ objects:
       - kind: ServiceAccount
         name: osd-cluster-ready
         namespace: openshift-monitoring
-    - apiVersion: batch/v1
-      kind: Job
-      metadata:
-        name: osd-cluster-ready
-        namespace: openshift-monitoring
-      spec:
-        backoffLimit: 500
-        template:
-          metadata:
-            name: osd-cluster-ready
-          spec:
-            containers:
-            - env:
-              - name: MAX_CLUSTER_AGE_MINUTES
-                value: '240'
-              name: osd-cluster-ready
-              image: quay.io/openshift-sre/osd-cluster-ready:v0.1.38-614bf59
-              command:
-              - /root/main
-            restartPolicy: OnFailure
-            serviceAccountName: osd-cluster-ready
 - apiVersion: hive.openshift.io/v1
   kind: SelectorSyncSet
   metadata:

diff --git a/hack/00-osd-managed-cluster-config-stage.yaml.tmpl b/hack/00-osd-managed-cluster-config-stage.yaml.tmpl
@@ -4868,12 +4868,6 @@ objects:
         verbs:
         - get
         - list
-      - apiGroups:
-        - ''
-        resources:
-        - pods/exec
-        verbs:
-        - create
     - apiVersion: rbac.authorization.k8s.io/v1
       kind: RoleBinding
       metadata:
@@ -4973,27 +4967,6 @@ objects:
       - kind: ServiceAccount
         name: osd-cluster-ready
         namespace: openshift-monitoring
-    - apiVersion: batch/v1
-      kind: Job
-      metadata:
-        name: osd-cluster-ready
-        namespace: openshift-monitoring
-      spec:
-        backoffLimit: 500
-        template:
-          metadata:
-            name: osd-cluster-ready
-          spec:
-            containers:
-            - env:
-              - name: MAX_CLUSTER_AGE_MINUTES
-                value: '240'
-              name: osd-cluster-ready
-              image: quay.io/openshift-sre/osd-cluster-ready:v0.1.38-614bf59
-              command:
-              - /root/main
-            restartPolicy: OnFailure
-            serviceAccountName: osd-cluster-ready
 - apiVersion: hive.openshift.io/v1
   kind: SelectorSyncSet
   metadata: