Merge pull request #33 from kubealex/release-0.6.1

prepare for 0.6.1 bump

Dockerfile

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM quay.io/operator-framework/helm-operator:v1.15.0
+FROM quay.io/operator-framework/helm-operator:v1.23.0
 
 ENV HOME=/opt/helm
 COPY watches.yaml ${HOME}/watches.yaml

config/crd/bases/charts.kubealex.com_k8smediaservers.yaml

@@ -2,9 +2,9 @@
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
-  name: k8smediaservers.kubealex.com
+  name: k8smediaservers.charts.kubealex.com
 spec:
-  group: kubealex.com
+  group: charts.kubealex.com
   names:
     kind: K8SMediaserver
     listKind: K8SMediaserverList

config/default/kustomization.yaml

@@ -9,10 +9,12 @@ namespace: k8s-mediaserver-operator-system
 namePrefix: k8s-mediaserver-operator-
 
 # Labels to add to all resources and selectors.
-#commonLabels:
-#  someName: someValue
+#labels:
+#- includeSelectors: true
+#  pairs:
+#    someName: someValue
 
-bases:
+resources:
 - ../crd
 - ../rbac
 - ../manager

config/default/manager_auth_proxy_patch.yaml

@@ -10,15 +10,28 @@ spec:
     spec:
       containers:
       - name: kube-rbac-proxy
-        image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - "ALL"
+        image: gcr.io/kubebuilder/kube-rbac-proxy:v0.13.0
         args:
         - "--secure-listen-address=0.0.0.0:8443"
         - "--upstream=http://127.0.0.1:8080/"
         - "--logtostderr=true"
-        - "--v=10"
+        - "--v=0"
         ports:
         - containerPort: 8443
+          protocol: TCP
           name: https
+        resources:
+          limits:
+            cpu: 500m
+            memory: 128Mi
+          requests:
+            cpu: 5m
+            memory: 64Mi
       - name: manager
         args:
         - "--health-probe-bind-address=:8081"

config/manager/controller_manager_config.yaml

@@ -8,3 +8,13 @@ metrics:
 leaderElection:
   leaderElect: true
   resourceName: 811c9dc5.kubealex.com
+# leaderElectionReleaseOnCancel defines if the leader should step down volume
+# when the Manager ends. This requires the binary to immediately end when the
+# Manager is stopped, otherwise, this setting is unsafe. Setting this significantly
+# speeds up voluntary leader transitions as the new leader don't have to wait
+# LeaseDuration time first.
+# In the default scaffold provided, the program ends immediately after
+# the manager stops, so would be fine to enable this option. However,
+# if you are doing or is intended to do any operation such as perform cleanups
+# after the manager stops then its usage might be unsafe.
+# leaderElectionReleaseOnCancel: true

config/manager/manager.yaml

@@ -19,19 +19,31 @@ spec:
   replicas: 1
   template:
     metadata:
+      annotations:
+        kubectl.kubernetes.io/default-container: manager
       labels:
         control-plane: controller-manager
     spec:
       securityContext:
         runAsNonRoot: true
+        # TODO(user): For common cases that do not require escalating privileges
+        # it is recommended to ensure that all your Pods/Containers are restrictive.
+        # More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
+        # Please uncomment the following code if your project does NOT have to work on old Kubernetes
+        # versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ).
+        # seccompProfile:
+        #   type: RuntimeDefault
       containers:
       - args:
         - --leader-elect
         - --leader-election-id=k8s-mediaserver-operator
-        image: quay.io/kubealex/k8s-mediaserver-operator:v0.5
+        image: controller:latest
         name: manager
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - "ALL"
         livenessProbe:
           httpGet:
             path: /healthz
@@ -44,12 +56,14 @@ spec:
             port: 8081
           initialDelaySeconds: 5
           periodSeconds: 10
+        # TODO(user): Configure the resources accordingly based on the project requirements.
+        # More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
         resources:
           limits:
-            cpu: 100m
-            memory: 90Mi
+            cpu: 500m
+            memory: 128Mi
           requests:
-            cpu: 100m
-            memory: 60Mi
+            cpu: 10m
+            memory: 64Mi
       serviceAccountName: controller-manager
       terminationGracePeriodSeconds: 10

config/manifests/kustomization.yaml

@@ -1,7 +1,7 @@
 # These resources constitute the fully configured set of manifests
 # used to generate the 'manifests/' directory in a bundle.
 resources:
-#- bases/k8s-mediaserver-operator.clusterserviceversion.yaml
+- bases/k8s-mediaserver-operator.clusterserviceversion.yaml
 - ../default
-#- ../samples
-#- ../scorecard
+- ../samples
+- ../scorecard

config/rbac/auth_proxy_service.yaml

@@ -9,6 +9,7 @@ spec:
   ports:
   - name: https
     port: 8443
+    protocol: TCP
     targetPort: https
   selector:
     control-plane: controller-manager

config/rbac/k8smediaserver_editor_role.yaml

@@ -5,7 +5,7 @@ metadata:
   name: k8smediaserver-editor-role
 rules:
 - apiGroups:
-  - kubealex.com
+  - charts.kubealex.com
   resources:
   - k8smediaservers
   verbs:
@@ -17,7 +17,7 @@ rules:
   - update
   - watch
 - apiGroups:
-  - kubealex.com
+  - charts.kubealex.com
   resources:
   - k8smediaservers/status
   verbs:

config/rbac/k8smediaserver_viewer_role.yaml

@@ -5,15 +5,15 @@ metadata:
   name: k8smediaserver-viewer-role
 rules:
 - apiGroups:
-  - kubealex.com
+  - charts.kubealex.com
   resources:
   - k8smediaservers
   verbs:
   - get
   - list
   - watch
 - apiGroups:
-  - kubealex.com
+  - charts.kubealex.com
   resources:
   - k8smediaservers/status
   verbs:

config/rbac/role.yaml

@@ -32,7 +32,7 @@ rules:
 ## Rules for charts.kubealex.com/v1, Kind: K8SMediaserver
 ##
 - apiGroups:
-  - kubealex.com
+  - charts.kubealex.com
   resources:
   - k8smediaservers
   - k8smediaservers/status
@@ -45,25 +45,39 @@ rules:
   - patch
   - update
   - watch
-- verbs:
-  - "*"
-  apiGroups:
+- apiGroups:
   - ""
   resources:
-  - "configmaps"
-  - "persistentvolumeclaims"
-  - "services"
-- verbs:
-  - "*"
-  apiGroups:
-  - "apps"
-  resources:
-  - "deployments"
-- verbs:
-  - "*"
-  apiGroups:
-  - "networking.k8s.io"
+  - pods
+  - services
+  - services/finalizers
+  - endpoints
+  - persistentvolumeclaims
+  - events
+  - configmaps
+  - secrets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - apps
   resources:
-  - "ingresses"
+  - deployments
+  - daemonsets
+  - replicasets
+  - statefulsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 
 #+kubebuilder:scaffold:rules