✨ Install spicedb #1372

yanmxa · 2025-02-10T03:49:42Z

Summary

Install spicedb operator and operand
apply the imagepullsecret, imagepullpolicy, toleration, nodeselector of mgh into the operator and operand

Related issue(s)

Fixes # https://issues.redhat.com/browse/ACM-17759

Tests

Unit/function tests have been added and incorporated into make unit-tests.
Integration tests have been added and incorporated into make integration-test.
E2E tests have been added and incorporated into make e2e-test-all.
List other manual tests you have done.

NAME                                                READY   STATUS    RESTARTS   AGE
kafka-kraft-0                                       0/1     Running   0          30s
multicluster-global-hub-grafana-79bd77df4f-f7pd5    2/2     Running   0          96s
multicluster-global-hub-operator-5787469d56-xkcn5   1/1     Running   0          3m5s
multicluster-global-hub-postgresql-0                2/2     Running   0          99s
spicedb-operator-7f4474848-59l8c                    1/1     Running   0          98s
spicedb-spicedb-787597bcf4-ps255                    1/1     Running   0          69s
strimzi-cluster-operator-v0.43.0-76f57fb5b7-chjw2   1/1     Running   0          69s

yanmxa · 2025-02-10T05:49:14Z

/test sonarcloud

Signed-off-by: myan <[email protected]>

clyang82 · 2025-02-14T11:01:45Z

one comment: we need to control the spicedb components with WithInventory. in other words, if we have with-inventory annotation, then the spicedb will be there. otherwise, we should not have spicedb installed.

Signed-off-by: myan <[email protected]>

yanmxa · 2025-02-14T11:59:56Z

one comment: we need to control the spicedb components with WithInventory. in other words, if we have with-inventory annotation, then the spicedb will be there. otherwise, we should not have spicedb installed.

Done

yanmxa · 2025-02-14T15:30:35Z

/test test-integration

Signed-off-by: myan <[email protected]>

...or/pkg/controllers/inventory/manifests/spicedb-operator/3.spicedb-operator.clusterroles.yaml

clyang82 · 2025-02-17T01:46:38Z

...or/pkg/controllers/inventory/manifests/spicedb-operator/3.spicedb-operator.clusterroles.yaml

+  labels:
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+  name: spicedb-operator-edit


This role is intended for user access, not the operator. Remove it for now.

clyang82 · 2025-02-17T01:46:45Z

...or/pkg/controllers/inventory/manifests/spicedb-operator/3.spicedb-operator.clusterroles.yaml

+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+  name: spicedb-operator-view


As above, remove it for now

clyang82 · 2025-02-17T01:47:01Z

.../controllers/inventory/manifests/spicedb-operator/4.spicedb-operator.clusterrolebinding.yaml

+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: spicedb-operator


suggest to add multicluster-global-hub: as prefix to avoid collision.

clyang82 · 2025-02-17T01:47:47Z

operator/pkg/controllers/inventory/manifests/spicedb-operator/5.update-graph.cm.yaml

@@ -0,0 +1,2796 @@
+apiVersion: v1
+data:
+  update-graph.yaml: |


is it necessary for spicedb operator?

I couldn't find a description of it. Open an issue in the community to track it. authzed/spicedb-operator#351

clyang82 · 2025-02-17T01:51:43Z

operator/pkg/controllers/inventory/manifests/spicedb-operator/6.spicedb-operator.deploy.yaml

+  name: spicedb-operator
+  namespace: {{.Namespace}}
+spec:
+  replicas: {{.Replicas}}


for operator, maybe we just hardcode 1 replica

clyang82 · 2025-02-17T02:00:06Z

operator/pkg/controllers/inventory/spicedb_reconciler.go

+		pgConfig.Host,
+		pgConfig.Port,
+		InventoryDatabaseName,
+		"disable",


need a TODO to support verify-full

clyang82 · 2025-02-17T02:02:15Z

operator/pkg/controllers/inventory/spicedb_reconciler.go

+		replicas = 2
+	}
+
+	// create spicedb cluster


how to specify the PV in spicedb?

I just reinstalled it but didn't find any PVC associated with Spicedb.

❯ oc get pods NAME READY STATUS RESTARTS AGE kafka-entity-operator-6765f65976-wnx2m 0/2 Running 0 9s kafka-kraft-0 1/1 Running 0 49s kafka-kraft-1 1/1 Running 0 49s kafka-kraft-2 1/1 Running 0 49s multicluster-global-hub-grafana-79bd77df4f-5kspv 2/2 Running 0 2m10s multicluster-global-hub-grafana-79bd77df4f-lccgt 2/2 Running 0 2m10s multicluster-global-hub-operator-5787469d56-8cmq4 1/1 Running 0 2m38s multicluster-global-hub-postgresql-0 2/2 Running 0 2m13s spicedb-operator-7f4474848-m9gns 1/1 Running 0 2m13s spicedb-spicedb-759bdd554b-44kpq 1/1 Running 0 92s spicedb-spicedb-759bdd554b-6q8q5 1/1 Running 0 92s strimzi-cluster-operator-v0.43.0-76f57fb5b7-pvkmv 1/1 Running 0 90s ❯ oc get pvc NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE data-0-kafka-kraft-0 Bound pvc-143f6317-8398-47c5-803f-4c1604a66bac 10Gi RWO gp3-csi <unset> 55s data-0-kafka-kraft-1 Bound pvc-2faf6766-eb88-444b-b107-5078bd326bf6 10Gi RWO gp3-csi <unset> 55s data-0-kafka-kraft-2 Bound pvc-c34ca80e-049e-474c-9ce8-da83f06017e8 10Gi RWO gp3-csi <unset> 55s postgresdb-multicluster-global-hub-postgresql-0 Bound pvc-357342b0-6888-4398-afcb-a80495832850 25Gi RWO gp3-csi <unset> 2m17s

why can't I see the inventory-api component?

clyang82 · 2025-02-17T02:25:36Z

operator/pkg/controllers/inventory/spicedb_reconciler.go

+	err := ctrl.NewControllerManagedBy(mgr).Named("spicedb-cluster").
+		For(&v1alpha4.MulticlusterGlobalHub{}, builder.WithPredicates(config.MGHPred)).
+		Watches(&corev1.Secret{}, &handler.EnqueueRequestForObject{}, builder.WithPredicates(spiceDBSecretPred)).
+		Watches(&spicedbv1alpha1.SpiceDBCluster{}, &handler.EnqueueRequestForObject{},


maybe we should use EnqueueRequestForOwner

Change with Owns now.

Signed-off-by: myan <[email protected]>

clyang82 · 2025-02-17T05:45:51Z

from e2e, it seems the spicedb-operator cannot be ready. refer to https://github.com/stolostron/multicluster-global-hub/actions/runs/13362270192/job/37313832429?pr=1372#step:5:1329

NAME                               READY   UP-TO-DATE   AVAILABLE   AGE
inventory-api                      1/1     1            1           11s
kafka-entity-operator              1/1     1            1           35s
multicluster-global-hub-manager    1/1     1            1           11s
multicluster-global-hub-operator   1/1     1            1           2m27s
spicedb-operator                   0/1     1            0           2m22s
strimzi-cluster-operator-v0.43.0   1/1     1            1           106s

Signed-off-by: myan <[email protected]>

sonarqubecloud · 2025-02-17T08:13:07Z

Quality Gate passed

Issues
4 New issues
0 Accepted issues

Measures
0 Security Hotspots
80.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

yanmxa · 2025-02-17T08:19:47Z

/test test-integration

clyang82

LGTM

openshift-ci · 2025-02-17T13:26:00Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: clyang82, yanmxa

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [clyang82,yanmxa]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci bot added dco-signoff: yes approved labels Feb 10, 2025

openshift-merge-robot added the needs-rebase label Feb 11, 2025

yanmxa force-pushed the br_spicedb branch from 34944e4 to f6872b2 Compare February 12, 2025 12:49

openshift-merge-robot added needs-rebase and removed needs-rebase labels Feb 12, 2025

yanmxa force-pushed the br_spicedb branch from f6872b2 to 174c4d6 Compare February 13, 2025 03:19

rollback

1a3e4bd

Signed-off-by: myan <[email protected]>

yanmxa force-pushed the br_spicedb branch from 174c4d6 to 1a3e4bd Compare February 13, 2025 03:20

openshift-merge-robot removed the needs-rebase label Feb 13, 2025

yanmxa added 15 commits February 13, 2025 06:38

add

a59aea4

Signed-off-by: myan <[email protected]>

update repliacs

63dcd52

Signed-off-by: myan <[email protected]>

add instance image

daf5f8e

Signed-off-by: myan <[email protected]>

add equal

c3c2fb4

Signed-off-by: myan <[email protected]>

update image

433d151

Signed-off-by: myan <[email protected]>

add toerlations and nodeselector

3a8259f

Signed-off-by: myan <[email protected]>

add owner reference

05121a2

Signed-off-by: myan <[email protected]>

remove delete

0621265

Signed-off-by: myan <[email protected]>

sonar scan

2688a8c

Signed-off-by: myan <[email protected]>

sonar scan

f4631ea

Signed-off-by: myan <[email protected]>

update image

10ae2e3

Signed-off-by: myan <[email protected]>

verify bundle

9db5b7a

Signed-off-by: myan <[email protected]>

add test

dfca034

Signed-off-by: myan <[email protected]>

embedded spicedb cluster controller

49bd74e

Signed-off-by: myan <[email protected]>

format

f72392d

Signed-off-by: myan <[email protected]>

config

8f2873e

Signed-off-by: myan <[email protected]>

yanmxa requested a review from clyang82 February 14, 2025 11:59

add gh prefix for the global resource

3e748d7

Signed-off-by: myan <[email protected]>

clyang82 reviewed Feb 17, 2025

View reviewed changes

reply review

3843502

Signed-off-by: myan <[email protected]>

yanmxa added 5 commits February 17, 2025 06:15

debug spicedb in github

6d8ec26

Signed-off-by: myan <[email protected]>

describe pod

3cec432

Signed-off-by: myan <[email protected]>

override the user in security context

2512be5

Signed-off-by: myan <[email protected]>

enable the spicedb operator can run as root

9e21f04

Signed-off-by: myan <[email protected]>

remove security context

a2a3639

Signed-off-by: myan <[email protected]>

yanmxa requested a review from clyang82 February 17, 2025 09:00

clyang82 approved these changes Feb 17, 2025

View reviewed changes

openshift-ci bot assigned clyang82 Feb 17, 2025

openshift-ci bot added the lgtm label Feb 17, 2025

openshift-merge-bot bot merged commit b129adf into stolostron:main Feb 17, 2025
16 checks passed

yanmxa deleted the br_spicedb branch February 19, 2025 02:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

✨ Install spicedb #1372

✨ Install spicedb #1372

yanmxa commented Feb 10, 2025 •

edited

Loading

yanmxa commented Feb 10, 2025

clyang82 commented Feb 14, 2025

yanmxa commented Feb 14, 2025

yanmxa commented Feb 14, 2025

clyang82 Feb 17, 2025

yanmxa Feb 17, 2025 •

edited

Loading

clyang82 Feb 17, 2025

yanmxa Feb 17, 2025

clyang82 Feb 17, 2025

yanmxa Feb 17, 2025

clyang82 Feb 17, 2025

yanmxa Feb 17, 2025

clyang82 Feb 17, 2025

yanmxa Feb 17, 2025

clyang82 Feb 17, 2025

yanmxa Feb 17, 2025

clyang82 Feb 17, 2025

yanmxa Feb 17, 2025

clyang82 Feb 17, 2025

clyang82 Feb 17, 2025

yanmxa Feb 17, 2025

clyang82 commented Feb 17, 2025

sonarqubecloud bot commented Feb 17, 2025

yanmxa commented Feb 17, 2025

clyang82 left a comment

openshift-ci bot commented Feb 17, 2025

✨ Install spicedb #1372

✨ Install spicedb #1372

Conversation

yanmxa commented Feb 10, 2025 • edited Loading

Summary

Related issue(s)

Tests

yanmxa commented Feb 10, 2025

clyang82 commented Feb 14, 2025

yanmxa commented Feb 14, 2025

yanmxa commented Feb 14, 2025

Choose a reason for hiding this comment

yanmxa Feb 17, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

clyang82 commented Feb 17, 2025

sonarqubecloud bot commented Feb 17, 2025

Quality Gate passed

yanmxa commented Feb 17, 2025

clyang82 left a comment

Choose a reason for hiding this comment

openshift-ci bot commented Feb 17, 2025

yanmxa commented Feb 10, 2025 •

edited

Loading

yanmxa Feb 17, 2025 •

edited

Loading