Allow OLM operator to bypass NS restrictions (#142)

appuio · Dec 6, 2022 · c098449 · c098449
1 parent dcdca69
commit c098449
Show file tree

Hide file tree

Showing 15 changed files with 78 additions and 1 deletion.
diff --git a/class/defaults.yml b/class/defaults.yml
@@ -106,6 +106,10 @@ parameters:
           kind: ServiceAccount
           name: namespace-openshift-config-2c8343f13594d63-manager
           namespace: syn-resource-locker
+        openshift-operator-lifecycle-manager:
+          kind: ServiceAccount
+          name: olm-operator-serviceaccount
+          namespace: openshift-operator-lifecycle-manager
 
     reservedNamespaces:
       kubernetes: ["default", "kube-*"]

diff --git a/docs/modules/ROOT/pages/references/policies/02_disallow_reserved_namespaces.adoc b/docs/modules/ROOT/pages/references/policies/02_disallow_reserved_namespaces.adoc
@@ -102,6 +102,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker

diff --git a/docs/modules/ROOT/pages/references/policies/02_organization_namespaces.adoc b/docs/modules/ROOT/pages/references/policies/02_organization_namespaces.adoc
@@ -113,6 +113,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker
@@ -162,6 +165,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker
@@ -211,6 +217,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker

diff --git a/docs/modules/ROOT/pages/references/policies/02_organization_sa_namespaces.adoc b/docs/modules/ROOT/pages/references/policies/02_organization_sa_namespaces.adoc
@@ -107,6 +107,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker
@@ -156,6 +159,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker
@@ -210,6 +216,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker

diff --git a/docs/modules/ROOT/pages/references/policies/02_validate_namespace_metadata.adoc b/docs/modules/ROOT/pages/references/policies/02_validate_namespace_metadata.adoc
@@ -91,6 +91,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker
@@ -162,6 +165,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker

diff --git a/docs/modules/ROOT/pages/references/policies/03_projectrequest.adoc b/docs/modules/ROOT/pages/references/policies/03_projectrequest.adoc
@@ -91,6 +91,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker

diff --git a/docs/modules/ROOT/pages/references/policies/12_namespace_quota_per_zone.adoc b/docs/modules/ROOT/pages/references/policies/12_namespace_quota_per_zone.adoc
@@ -121,6 +121,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker
@@ -195,6 +198,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker

diff --git a/tests/golden/defaults/appuio-cloud/appuio-cloud/01_agent/01_config_map.yaml b/tests/golden/defaults/appuio-cloud/appuio-cloud/01_agent/01_config_map.yaml
@@ -11,6 +11,7 @@ data:
     \n- \"system:controller:operator-lifecycle-manager\"\n- \"system:master\"\n- \"\
     system:openshift:controller:namespace-security-allocation-controller\"\n- \"system:openshift:controller:podsecurity-admission-label-syncer-controller\"\
     \n\"PrivilegedGroups\": []\n\"PrivilegedUsers\":\n- \"system:serviceaccount:argocd:argocd-application-controller\"\
+    \n- \"system:serviceaccount:openshift-operator-lifecycle-manager:olm-operator-serviceaccount\"\
     \n- \"system:serviceaccount:syn-resource-locker:namespace-openshift-config-2c8343f13594d63-manager\"\
     \n- \"system:serviceaccount:syn-resource-locker:namespace-default-d6a0af6dd07e8a3-manager\"\
     \n- \"system:serviceaccount:syn-resource-locker:namespace-openshift-monitoring-c4273dc15ddfdf7-manager\""

diff --git a/tests/golden/defaults/appuio-cloud/appuio-cloud/01_agent/02_deployment.yaml b/tests/golden/defaults/appuio-cloud/appuio-cloud/01_agent/02_deployment.yaml
@@ -13,7 +13,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config: a1d896d928f0c283d0841f0290a4443d
+        checksum/config: 98737c1e624c2d57494fc0cfdbe029b9
         kubectl.kubernetes.io/default-container: agent
       labels:
         control-plane: appuio-cloud-agent

diff --git a/tests/golden/defaults/appuio-cloud/appuio-cloud/02_disallow_reserved_namespaces.yaml b/tests/golden/defaults/appuio-cloud/appuio-cloud/02_disallow_reserved_namespaces.yaml
@@ -68,6 +68,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker

diff --git a/tests/golden/defaults/appuio-cloud/appuio-cloud/02_organization_namespaces.yaml b/tests/golden/defaults/appuio-cloud/appuio-cloud/02_organization_namespaces.yaml
@@ -76,6 +76,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker
@@ -125,6 +128,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker
@@ -174,6 +180,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker

diff --git a/tests/golden/defaults/appuio-cloud/appuio-cloud/02_organization_sa_namespaces.yaml b/tests/golden/defaults/appuio-cloud/appuio-cloud/02_organization_sa_namespaces.yaml
@@ -72,6 +72,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker
@@ -121,6 +124,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker
@@ -175,6 +181,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker

diff --git a/tests/golden/defaults/appuio-cloud/appuio-cloud/02_validate_namespace_metadata.yaml b/tests/golden/defaults/appuio-cloud/appuio-cloud/02_validate_namespace_metadata.yaml
@@ -60,6 +60,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker
@@ -131,6 +134,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker

diff --git a/tests/golden/defaults/appuio-cloud/appuio-cloud/03_projectrequest.yaml b/tests/golden/defaults/appuio-cloud/appuio-cloud/03_projectrequest.yaml
@@ -62,6 +62,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker

diff --git a/tests/golden/defaults/appuio-cloud/appuio-cloud/12_namespace_quota_per_zone.yaml b/tests/golden/defaults/appuio-cloud/appuio-cloud/12_namespace_quota_per_zone.yaml
@@ -84,6 +84,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker
@@ -158,6 +161,9 @@ spec:
               - kind: ServiceAccount
                 name: argocd-application-controller
                 namespace: argocd
+              - kind: ServiceAccount
+                name: olm-operator-serviceaccount
+                namespace: openshift-operator-lifecycle-manager
               - kind: ServiceAccount
                 name: namespace-openshift-config-2c8343f13594d63-manager
                 namespace: syn-resource-locker