Generate SCC-related resources when on OCP

bundle/manifests/nexus-operator.clusterserviceversion.yaml

@@ -167,6 +167,17 @@ spec:
           - patch
           - update
           - watch
+        - apiGroups:
+          - rbac.authorization.k8s.io
+          resources:
+          - clusterrole
+          - rolebinding
+          verbs:
+          - create
+          - get
+          - list
+          - update
+          - watch
         - apiGroups:
           - route.openshift.io
           resources:
@@ -179,6 +190,16 @@ spec:
           - patch
           - update
           - watch
+        - apiGroups:
+          - security.openshift.io
+          resources:
+          - scc
+          verbs:
+          - create
+          - get
+          - list
+          - update
+          - watch
         - apiGroups:
           - authentication.k8s.io
           resources:

config/rbac/role.yaml

@@ -98,6 +98,17 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterrole
+  - rolebinding
+  verbs:
+  - create
+  - get
+  - list
+  - update
+  - watch
 - apiGroups:
   - route.openshift.io
   resources:
@@ -110,3 +121,13 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - security.openshift.io
+  resources:
+  - scc
+  verbs:
+  - create
+  - get
+  - list
+  - update
+  - watch

controllers/nexus/resource/deployment/manager.go

@@ -15,33 +15,27 @@
 package deployment
 
 import (
-	"fmt"
 	"reflect"
 	"strings"
 
 	"github.com/RHsyseng/operator-utils/pkg/resource"
 	"github.com/RHsyseng/operator-utils/pkg/resource/compare"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	"github.com/m88i/nexus-operator/api/v1alpha1"
 	"github.com/m88i/nexus-operator/pkg/framework"
 	"github.com/m88i/nexus-operator/pkg/logger"
 )
 
-var managedObjectsRef = map[string]resource.KubernetesResource{
-	framework.DeploymentKind: &appsv1.Deployment{},
-	framework.ServiceKind:    &corev1.Service{},
-}
-
 // Manager is responsible for creating deployment-related resources, fetching deployed ones and comparing them
 // Use with zero values will result in a panic. Use the NewManager function to get a properly initialized manager
 type Manager struct {
-	nexus  *v1alpha1.Nexus
-	client client.Client
-	log    logger.Logger
+	nexus             *v1alpha1.Nexus
+	client            client.Client
+	log               logger.Logger
+	managedObjectsRef map[string]resource.KubernetesResource
 }
 
 // NewManager creates a deployment resources manager
@@ -51,6 +45,11 @@ func NewManager(nexus *v1alpha1.Nexus, client client.Client) *Manager {
 		nexus:  nexus,
 		client: client,
 		log:    logger.GetLoggerWithResource("deployment_manager", nexus),
+
+		managedObjectsRef: map[string]resource.KubernetesResource{
+			framework.DeploymentKind: &appsv1.Deployment{},
+			framework.ServiceKind:    &corev1.Service{},
+		},
 	}
 }
 
@@ -63,15 +62,7 @@ func (m *Manager) GetRequiredResources() ([]resource.KubernetesResource, error)
 
 // GetDeployedResources returns the deployment-related resources deployed on the cluster
 func (m *Manager) GetDeployedResources() ([]resource.KubernetesResource, error) {
-	var resources []resource.KubernetesResource
-	for resType, resRef := range managedObjectsRef {
-		if err := framework.Fetch(m.client, framework.Key(m.nexus), resRef, resType); err == nil {
-			resources = append(resources, resRef)
-		} else if !errors.IsNotFound(err) {
-			return nil, fmt.Errorf("could not fetch %s (%s/%s): %v", resType, m.nexus.Namespace, m.nexus.Name, err)
-		}
-	}
-	return resources, nil
+	return framework.FetchDeployedResources(m.managedObjectsRef, m.nexus, m.client)
 }
 
 // GetCustomComparator returns the custom comp function used to compare a deployment-related resource

controllers/nexus/resource/deployment/manager_test.go

@@ -79,10 +79,8 @@ func TestManager_GetRequiredResources(t *testing.T) {
 func TestManager_GetDeployedResources(t *testing.T) {
 	// first no deployed resources
 	fakeClient := test.NewFakeClientBuilder().Build()
-	mgr := &Manager{
-		nexus:  allDefaultsCommunityNexus,
-		client: fakeClient,
-	}
+	mgr := NewManager(allDefaultsCommunityNexus, fakeClient)
+
 	resources, err := mgr.GetDeployedResources()
 	assert.Nil(t, resources)
 	assert.Len(t, resources, 0)

controllers/nexus/resource/networking/manager.go

@@ -22,7 +22,6 @@ import (
 	"github.com/RHsyseng/operator-utils/pkg/resource/compare"
 	routev1 "github.com/openshift/api/route/v1"
 	networkingv1beta1 "k8s.io/api/networking/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	"github.com/m88i/nexus-operator/api/v1alpha1"
@@ -32,46 +31,50 @@ import (
 )
 
 const (
-	discOCPFailureFormat = "unable to determine if cluster is Openshift: %v"
 	discFailureFormat    = "unable to determine if %s are available: %v" // resource type, error
 	resUnavailableFormat = "%s are not available in this cluster"        // resource type
 )
 
 // Manager is responsible for creating networking resources, fetching deployed ones and comparing them
 // Use with zero values will result in a panic. Use the NewManager function to get a properly initialized manager
 type Manager struct {
-	nexus                                 *v1alpha1.Nexus
-	client                                client.Client
-	log                                   logger.Logger
-	routeAvailable, ingressAvailable, ocp bool
+	nexus             *v1alpha1.Nexus
+	client            client.Client
+	log               logger.Logger
+	managedObjectsRef map[string]resource.KubernetesResource
+
+	routeAvailable, ingressAvailable bool
 }
 
 // NewManager creates a networking resources manager
 // It is expected that the Nexus has been previously validated.
 func NewManager(nexus *v1alpha1.Nexus, client client.Client) (*Manager, error) {
+	mgr := &Manager{
+		nexus:             nexus,
+		client:            client,
+		log:               logger.GetLoggerWithResource("networking_manager", nexus),
+		managedObjectsRef: make(map[string]resource.KubernetesResource),
+	}
+
 	routeAvailable, err := discovery.IsRouteAvailable()
 	if err != nil {
 		return nil, fmt.Errorf(discFailureFormat, "routes", err)
 	}
+	if routeAvailable {
+		mgr.routeAvailable = true
+		mgr.managedObjectsRef[framework.RouteKind] = &routev1.Route{}
+	}
 
 	ingressAvailable, err := discovery.IsIngressAvailable()
 	if err != nil {
 		return nil, fmt.Errorf(discFailureFormat, "ingresses", err)
 	}
-
-	ocp, err := discovery.IsOpenShift()
-	if err != nil {
-		return nil, fmt.Errorf(discOCPFailureFormat, err)
+	if ingressAvailable {
+		mgr.ingressAvailable = true
+		mgr.managedObjectsRef[framework.IngressKind] = &networkingv1beta1.Ingress{}
 	}
 
-	return &Manager{
-		nexus:            nexus,
-		client:           client,
-		routeAvailable:   routeAvailable,
-		ingressAvailable: ingressAvailable,
-		ocp:              ocp,
-		log:              logger.GetLoggerWithResource("networking_manager", nexus),
-	}, nil
+	return mgr, nil
 }
 
 func (m *Manager) IngressAvailable() bool {
@@ -129,24 +132,7 @@ func (m *Manager) createIngress() *networkingv1beta1.Ingress {
 
 // GetDeployedResources returns the networking resources deployed on the cluster
 func (m *Manager) GetDeployedResources() ([]resource.KubernetesResource, error) {
-	var resources []resource.KubernetesResource
-	if m.routeAvailable {
-		route := &routev1.Route{}
-		if err := framework.Fetch(m.client, framework.Key(m.nexus), route, framework.RouteKind); err == nil {
-			resources = append(resources, route)
-		} else if !errors.IsNotFound(err) {
-			return nil, fmt.Errorf("could not fetch %s (%s/%s): %v", framework.RouteKind, m.nexus.Namespace, m.nexus.Name, err)
-		}
-	}
-	if m.ingressAvailable {
-		ingress := &networkingv1beta1.Ingress{}
-		if err := framework.Fetch(m.client, framework.Key(m.nexus), ingress, framework.IngressKind); err == nil {
-			resources = append(resources, ingress)
-		} else if !errors.IsNotFound(err) {
-			return nil, fmt.Errorf("could not fetch %s (%s/%s): %v", framework.IngressKind, m.nexus.Namespace, m.nexus.Name, err)
-		}
-	}
-	return resources, nil
+	return framework.FetchDeployedResources(m.managedObjectsRef, m.nexus, m.client)
 }
 
 // GetCustomComparator returns the custom comp function used to compare a networking resource.

controllers/nexus/resource/networking/manager_test.go

@@ -79,7 +79,6 @@ func TestNewManager(t *testing.T) {
 				client:           test.NewFakeClientBuilder().WithIngress().Build(),
 				routeAvailable:   false,
 				ingressAvailable: true,
-				ocp:              false,
 			},
 			k8sClientWithIngress,
 		},
@@ -90,7 +89,6 @@ func TestNewManager(t *testing.T) {
 				client:           test.NewFakeClientBuilder().Build(),
 				routeAvailable:   false,
 				ingressAvailable: false,
-				ocp:              false,
 			},
 			k8sClient,
 		},
@@ -101,7 +99,6 @@ func TestNewManager(t *testing.T) {
 				client:           test.NewFakeClientBuilder().OnOpenshift().Build(),
 				routeAvailable:   true,
 				ingressAvailable: false,
-				ocp:              true,
 			},
 			ocpClient,
 		},
@@ -115,7 +112,6 @@ func TestNewManager(t *testing.T) {
 		assert.NotNil(t, got.nexus)
 		assert.Equal(t, tt.want.routeAvailable, got.routeAvailable)
 		assert.Equal(t, tt.want.ingressAvailable, got.ingressAvailable)
-		assert.Equal(t, tt.want.ocp, got.ocp)
 	}
 
 	// simulate discovery 500 response, expect error
@@ -147,7 +143,6 @@ func TestManager_GetRequiredResources(t *testing.T) {
 		client:         test.NewFakeClientBuilder().OnOpenshift().Build(),
 		log:            logger.GetLoggerWithResource("test", routeNexus),
 		routeAvailable: true,
-		ocp:            true,
 	}
 	resources, err = mgr.GetRequiredResources()
 	assert.Nil(t, err)
@@ -216,13 +211,9 @@ func TestManager_createIngress(t *testing.T) {
 func TestManager_GetDeployedResources(t *testing.T) {
 	// first with no deployed resources
 	fakeClient := test.NewFakeClientBuilder().WithIngress().OnOpenshift().Build()
-	mgr := &Manager{
-		nexus:            nodePortNexus,
-		client:           fakeClient,
-		ingressAvailable: true,
-		routeAvailable:   true,
-		ocp:              true,
-	}
+	discovery.SetClient(fakeClient)
+	mgr, _ := NewManager(nodePortNexus, fakeClient)
+
 	resources, err := mgr.GetDeployedResources()
 	assert.Nil(t, resources)
 	assert.Len(t, resources, 0)

controllers/nexus/resource/persistence/manager.go

@@ -15,29 +15,24 @@
 package persistence
 
 import (
-	"fmt"
 	"reflect"
 
 	"github.com/RHsyseng/operator-utils/pkg/resource"
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	"github.com/m88i/nexus-operator/api/v1alpha1"
 	"github.com/m88i/nexus-operator/pkg/framework"
 	"github.com/m88i/nexus-operator/pkg/logger"
 )
 
-var managedObjectsRef = map[string]resource.KubernetesResource{
-	framework.PVCKind: &corev1.PersistentVolumeClaim{},
-}
-
 // Manager is responsible for creating persistence resources, fetching deployed ones and comparing them
 // Use with zero values will result in a panic. Use the NewManager function to get a properly initialized manager
 type Manager struct {
-	nexus  *v1alpha1.Nexus
-	client client.Client
-	log    logger.Logger
+	nexus             *v1alpha1.Nexus
+	client            client.Client
+	log               logger.Logger
+	managedObjectsRef map[string]resource.KubernetesResource
 }
 
 // NewManager creates a persistence resources manager
@@ -47,6 +42,10 @@ func NewManager(nexus *v1alpha1.Nexus, client client.Client) *Manager {
 		nexus:  nexus,
 		client: client,
 		log:    logger.GetLoggerWithResource("persistence_manager", nexus),
+
+		managedObjectsRef: map[string]resource.KubernetesResource{
+			framework.PVCKind: &corev1.PersistentVolumeClaim{},
+		},
 	}
 }
 
@@ -66,15 +65,7 @@ func (m *Manager) GetRequiredResources() ([]resource.KubernetesResource, error)
 
 // GetDeployedResources returns the persistence resources deployed on the cluster
 func (m *Manager) GetDeployedResources() ([]resource.KubernetesResource, error) {
-	var resources []resource.KubernetesResource
-	for resType, resRef := range managedObjectsRef {
-		if err := framework.Fetch(m.client, framework.Key(m.nexus), resRef, resType); err == nil {
-			resources = append(resources, resRef)
-		} else if !errors.IsNotFound(err) {
-			return nil, fmt.Errorf("could not fetch %s (%s/%s): %v", resType, m.nexus.Namespace, m.nexus.Name, err)
-		}
-	}
-	return resources, nil
+	return framework.FetchDeployedResources(m.managedObjectsRef, m.nexus, m.client)
 }
 
 // GetCustomComparator returns the custom comp function used to compare a persistence resource.

controllers/nexus/resource/persistence/manager_test.go

@@ -75,10 +75,8 @@ func TestManager_GetRequiredResources(t *testing.T) {
 func TestManager_GetDeployedResources(t *testing.T) {
 	// first with no deployed resources
 	fakeClient := test.NewFakeClientBuilder().Build()
-	mgr := &Manager{
-		nexus:  baseNexus,
-		client: fakeClient,
-	}
+	mgr := NewManager(baseNexus, fakeClient)
+
 	resources, err := mgr.GetDeployedResources()
 	assert.Nil(t, resources)
 	assert.Len(t, resources, 0)