Apply labels in patch for openshift-logging

This is change related to bug: - https://issues.redhat.com/browse/OSD-25576 Signed-off-by: Petr Kotas <[email protected]>
openshift · Nov 15, 2024 · d55fb6f · d55fb6f
1 parent 5c803b3
commit d55fb6f
Show file tree

Hide file tree

Showing 27 changed files with 1,485 additions and 458 deletions.
diff --git a/deploy/acm-policies/50-GENERATED-osd-logging-unsupported.Policy.yaml b/deploy/acm-policies/50-GENERATED-osd-logging-unsupported.Policy.yaml
@@ -21,67 +21,165 @@ spec:
                     compliant: 2h
                     noncompliant: 45s
                 object-templates:
+                    - complianceType: mustonlyhave
+                      metadataComplianceType: musthave
+                      objectDefinition:
+                        apiVersion: v1
+                        applyMode: AlwaysApply
+                        kind: Namespace
+                        name: openshift-logging
+                        patch: |-
+                            {
+                              "annotations": {
+                                "openshift.io/node-selector": ""
+                              },
+                              "labels": {
+                                "openshift.io/cluster-logging": "true"
+                              }
+                            }
+                        patchType: merge
                     - complianceType: mustonlyhave
                       metadataComplianceType: musthave
                       objectDefinition:
                         apiVersion: v1
                         kind: Namespace
                         metadata:
-                            annotations:
-                                openshift.io/node-selector: ""
-                            labels:
-                                openshift.io/cluster-logging: "true"
                             name: openshift-logging
                     - complianceType: mustonlyhave
                       metadataComplianceType: musthave
                       objectDefinition:
                         apiVersion: rbac.authorization.k8s.io/v1
-                        applyMode: AlwaysApply
                         kind: Role
-                        name: dedicated-admins-openshift-logging
-                        namespace: openshift-logging
-                        patch: '{"rules":[{"apiGroups":[""],"resources":["events","namespaces","persistentvolumeclaims","persistentvolumes","pods","pods/log"],"verbs":["list","get","watch"]},{"apiGroups":[""],"resources":["secrets"],"verbs":["*"]},{"apiGroups":["logging.openshift.io"],"resources":["clusterloggings"],"verbs":["create","delete","deletecollection","get","list","patch","update","watch"]},{"apiGroups":["operators.coreos.com"],"resources":["subscriptions","clusterserviceversions"],"verbs":["*"]},{"apiGroups":["operators.coreos.com"],"resources":["installplans"],"verbs":["update"]},{"apiGroups":[""],"resources":["persistentvolumeclaims"],"verbs":["*"]},{"apiGroups":["apps","extensions"],"resources":["daemonsets"],"verbs":["get","list","patch","update","watch"]}]}'
-                        patchType: merge
+                        metadata:
+                            name: dedicated-admins-openshift-logging
+                            namespace: openshift-logging
+                        rules:
+                            - apiGroups:
+                                - ""
+                              resources:
+                                - events
+                                - namespaces
+                                - persistentvolumeclaims
+                                - persistentvolumes
+                                - pods
+                                - pods/log
+                              verbs:
+                                - list
+                                - get
+                                - watch
+                            - apiGroups:
+                                - ""
+                              resources:
+                                - secrets
+                              verbs:
+                                - '*'
+                            - apiGroups:
+                                - logging.openshift.io
+                              resources:
+                                - clusterloggings
+                              verbs:
+                                - create
+                                - delete
+                                - deletecollection
+                                - get
+                                - list
+                                - patch
+                                - update
+                                - watch
+                            - apiGroups:
+                                - operators.coreos.com
+                              resources:
+                                - subscriptions
+                                - clusterserviceversions
+                              verbs:
+                                - '*'
+                            - apiGroups:
+                                - operators.coreos.com
+                              resources:
+                                - installplans
+                              verbs:
+                                - update
+                            - apiGroups:
+                                - ""
+                              resources:
+                                - persistentvolumeclaims
+                              verbs:
+                                - '*'
+                            - apiGroups:
+                                - apps
+                                - extensions
+                              resources:
+                                - daemonsets
+                              verbs:
+                                - get
+                                - list
+                                - patch
+                                - update
+                                - watch
                     - complianceType: mustonlyhave
                       metadataComplianceType: musthave
                       objectDefinition:
                         apiVersion: rbac.authorization.k8s.io/v1
-                        applyMode: AlwaysApply
                         kind: RoleBinding
-                        name: admin-dedicated-admins
-                        namespace: openshift-logging
-                        patch: '{"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"admin"},"subjects":[{"apiGroup":"rbac.authorization.k8s.io","kind":"Group","name":"dedicated-admins"}]}'
-                        patchType: merge
+                        metadata:
+                            name: admin-dedicated-admins
+                            namespace: openshift-logging
+                        roleRef:
+                            apiGroup: rbac.authorization.k8s.io
+                            kind: ClusterRole
+                            name: admin
+                        subjects:
+                            - apiGroup: rbac.authorization.k8s.io
+                              kind: Group
+                              name: dedicated-admins
                     - complianceType: mustonlyhave
                       metadataComplianceType: musthave
                       objectDefinition:
                         apiVersion: rbac.authorization.k8s.io/v1
-                        applyMode: AlwaysApply
                         kind: RoleBinding
-                        name: admin-system:serviceaccounts:dedicated-admin
-                        namespace: openshift-logging
-                        patch: '{"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"admin"},"subjects":[{"apiGroup":"rbac.authorization.k8s.io","kind":"Group"}]}'
-                        patchType: merge
+                        metadata:
+                            name: admin-system:serviceaccounts:dedicated-admin
+                            namespace: openshift-logging
+                        roleRef:
+                            apiGroup: rbac.authorization.k8s.io
+                            kind: ClusterRole
+                            name: admin
+                        subjects:
+                            - apiGroup: rbac.authorization.k8s.io
+                              kind: Group
+                              name: system:serviceaccounts:dedicated-admin
                     - complianceType: mustonlyhave
                       metadataComplianceType: musthave
                       objectDefinition:
                         apiVersion: rbac.authorization.k8s.io/v1
-                        applyMode: AlwaysApply
                         kind: RoleBinding
-                        name: openshift-logging-dedicated-admins
-                        namespace: openshift-logging
-                        patch: '{"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"dedicated-admins-project"},"subjects":[{"apiGroup":"rbac.authorization.k8s.io","kind":"Group","name":"dedicated-admins"}]}'
-                        patchType: merge
+                        metadata:
+                            name: openshift-logging-dedicated-admins
+                            namespace: openshift-logging
+                        roleRef:
+                            apiGroup: rbac.authorization.k8s.io
+                            kind: ClusterRole
+                            name: dedicated-admins-project
+                        subjects:
+                            - apiGroup: rbac.authorization.k8s.io
+                              kind: Group
+                              name: dedicated-admins
                     - complianceType: mustonlyhave
                       metadataComplianceType: musthave
                       objectDefinition:
                         apiVersion: rbac.authorization.k8s.io/v1
-                        applyMode: AlwaysApply
                         kind: RoleBinding
-                        name: openshift-logging:serviceaccounts:dedicated-admin
-                        namespace: openshift-logging
-                        patch: '{"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"dedicated-admins-project"},"subjects":[{"apiGroup":"rbac.authorization.k8s.io","kind":"Group","name":"system:serviceaccounts:dedicated-admin"}]}'
-                        patchType: merge
+                        metadata:
+                            name: openshift-logging:serviceaccounts:dedicated-admin
+                            namespace: openshift-logging
+                        roleRef:
+                            apiGroup: rbac.authorization.k8s.io
+                            kind: ClusterRole
+                            name: dedicated-admins-project
+                        subjects:
+                            - apiGroup: rbac.authorization.k8s.io
+                              kind: Group
+                              name: system:serviceaccounts:dedicated-admin
                 pruneObjectBehavior: DeleteIfCreated
                 remediationAction: enforce
                 severity: low

diff --git a/deploy/osd-logging/00-namespace.patch.yaml b/deploy/osd-logging/00-namespace.patch.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Namespace
+name: openshift-logging
+applyMode: AlwaysApply
+patchType: merge
+patch: |-
+  {
+    "annotations": {
+      "openshift.io/node-selector": ""
+    },
+    "labels": {
+      "managed.openshift.io/service-lb-quota-exempt": "true"
+      "managed.openshift.io/storage-pv-quota-exempt": "true"
+      "openshift.io/cluster-logging": "true"
+      "openshift.io/cluster-monitoring": 'true'
+    }
+  }
diff --git a/deploy/osd-logging/00-namespace.yaml b/deploy/osd-logging/00-namespace.yaml
@@ -2,10 +2,4 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: openshift-logging
-  annotations:
-    openshift.io/node-selector: ""
-  labels:
-    managed.openshift.io/service-lb-quota-exempt: "true"
-    managed.openshift.io/storage-pv-quota-exempt: "true"
-    openshift.io/cluster-logging: "true"
-    openshift.io/cluster-monitoring: 'true'
+
diff --git a/deploy/osd-logging/01-operatorgroup.patch.yaml b/deploy/osd-logging/01-operatorgroup.patch.yaml
diff --git a/deploy/osd-logging/01-operatorgroup.yaml.bak → deploy/osd-logging/01-operatorgroup.yaml b/deploy/osd-logging/01-operatorgroup.yaml.bak → deploy/osd-logging/01-operatorgroup.yaml
diff --git a/deploy/osd-logging/02-curator.configmap.patch.yaml b/deploy/osd-logging/02-curator.configmap.patch.yaml
diff --git a/...osd-logging/02-curator.configmap.yaml.bak → deploy/osd-logging/02-curator.configmap.yaml b/...osd-logging/02-curator.configmap.yaml.bak → deploy/osd-logging/02-curator.configmap.yaml
diff --git a/deploy/osd-logging/config.yaml b/deploy/osd-logging/config.yaml
@@ -3,6 +3,8 @@ selectorSyncSet:
   # if this config no longer applies, don't delete the resources
   resourceApplyMode: "Upsert"
 
+  applyBehavior: "CreateOnly"
+
   matchExpressions:
   # Enable in-cluster logging alerts for those clusters that already have logging installed
   # https://issues.redhat.com/browse/OSD-7564

diff --git a/deploy/osd-logging/supported/03-storage-quota.patch.yaml b/deploy/osd-logging/supported/03-storage-quota.patch.yaml
diff --git a/...gging/supported/03-storage-quota.yaml.bak → ...d-logging/supported/03-storage-quota.yaml b/...gging/supported/03-storage-quota.yaml.bak → ...d-logging/supported/03-storage-quota.yaml
diff --git a/deploy/osd-logging/supported/05-role.patch.yaml b/deploy/osd-logging/supported/05-role.patch.yaml
diff --git a/...oy/osd-logging/supported/05-role.yaml.bak → deploy/osd-logging/supported/05-role.yaml b/...oy/osd-logging/supported/05-role.yaml.bak → deploy/osd-logging/supported/05-role.yaml
diff --git a/deploy/osd-logging/supported/06-rolebinding.patch.yaml b/deploy/osd-logging/supported/06-rolebinding.patch.yaml
diff --git a/...logging/supported/06-rolebinding.yaml.bak → ...osd-logging/supported/06-rolebinding.yaml b/...logging/supported/06-rolebinding.yaml.bak → ...osd-logging/supported/06-rolebinding.yaml
diff --git a/deploy/osd-logging/unsupported/00-namespace.patch.yaml b/deploy/osd-logging/unsupported/00-namespace.patch.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Namespace
+name: openshift-logging
+applyMode: AlwaysApply
+patchType: merge
+patch: |-
+  {
+    "annotations": {
+      "openshift.io/node-selector": ""
+    },
+    "labels": {
+      "openshift.io/cluster-logging": "true"
+    }
+  }
diff --git a/deploy/osd-logging/unsupported/00-namespace.yaml b/deploy/osd-logging/unsupported/00-namespace.yaml
@@ -2,7 +2,4 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: openshift-logging
-  annotations:
-    openshift.io/node-selector: ""
-  labels:
-    openshift.io/cluster-logging: "true"
+
diff --git a/deploy/osd-logging/unsupported/05-role.patch.yaml b/deploy/osd-logging/unsupported/05-role.patch.yaml
diff --git a/.../osd-logging/unsupported/05-role.yaml.bak → deploy/osd-logging/unsupported/05-role.yaml b/.../osd-logging/unsupported/05-role.yaml.bak → deploy/osd-logging/unsupported/05-role.yaml
diff --git a/...gging/unsupported/06-rolebinding.yaml.bak → ...d-logging/unsupported/06-rolebinding.yaml b/...gging/unsupported/06-rolebinding.yaml.bak → ...d-logging/unsupported/06-rolebinding.yaml
diff --git a/deploy/osd-logging/unsupported/0601-rolebinding.patch.yaml b/deploy/osd-logging/unsupported/0601-rolebinding.patch.yaml
diff --git a/deploy/osd-logging/unsupported/0602-rolebinding.patch.yaml b/deploy/osd-logging/unsupported/0602-rolebinding.patch.yaml
diff --git a/deploy/osd-logging/unsupported/0603-rolebinding.patch.yaml b/deploy/osd-logging/unsupported/0603-rolebinding.patch.yaml
diff --git a/deploy/osd-logging/unsupported/0604-rolebinding.patch.yaml b/deploy/osd-logging/unsupported/0604-rolebinding.patch.yaml
diff --git a/deploy/osd-logging/unsupported/config.yaml b/deploy/osd-logging/unsupported/config.yaml
@@ -2,6 +2,9 @@ deploymentMode: "SelectorSyncSet"
 selectorSyncSet:
   # if we ever remove this, do not remove the resources
   resourceApplyMode: "Upsert"
+
+  applyBehavior: "CreateOnly"
+
   matchExpressions:
   # Disable in-cluster logging alerts for those clusters that do not already have logging installed
   # We removed the version check because that would conflict with this check here for clusters that