diff --git a/Makefile b/Makefile index 0f21bd7..5e1ac01 100644 --- a/Makefile +++ b/Makefile @@ -403,7 +403,6 @@ endif crdsync: generate manifests cp config/crd/bases/intel.com_clusterpolicies.yaml charts/gpu-base-operator/crds/clusterpolicies.yaml cp config/crd/bases/intel.com_gpufirmwareupdates.yaml charts/gpu-base-operator/crds/gpufirmwareupdates.yaml - cp config/rbac/role.yaml charts/gpu-base-operator/templates/role.yaml .PHONY: check-generated-files check-generated-files: crdsync diff --git a/charts/gpu-base-operator/templates/clusterpolicy_admin_role.yaml b/charts/gpu-base-operator/templates/clusterpolicy_admin_role.yaml deleted file mode 100644 index 032aa84..0000000 --- a/charts/gpu-base-operator/templates/clusterpolicy_admin_role.yaml +++ /dev/null @@ -1,27 +0,0 @@ -# This rule is not used by the project intel-gpu-base-operator itself. -# It is provided to allow the cluster admin to help manage permissions for users. -# -# Grants full permissions ('*') over intel.com. -# This role is intended for users authorized to modify roles and bindings within the cluster, -# enabling them to delegate specific permissions to other users or groups as needed. - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app.kubernetes.io/name: intel-gpu-base-operator - app.kubernetes.io/managed-by: kustomize - name: clusterpolicy-admin-role -rules: -- apiGroups: - - intel.com - resources: - - clusterpolicies - verbs: - - '*' -- apiGroups: - - intel.com - resources: - - clusterpolicies/status - verbs: - - get diff --git a/charts/gpu-base-operator/templates/clusterpolicy_editor_role.yaml b/charts/gpu-base-operator/templates/clusterpolicy_editor_role.yaml deleted file mode 100644 index c935802..0000000 --- a/charts/gpu-base-operator/templates/clusterpolicy_editor_role.yaml +++ /dev/null @@ -1,33 +0,0 @@ -# This rule is not used by the project intel-gpu-base-operator itself. -# It is provided to allow the cluster admin to help manage permissions for users. -# -# Grants permissions to create, update, and delete resources within the intel.com. -# This role is intended for users who need to manage these resources -# but should not control RBAC or manage permissions for others. - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app.kubernetes.io/name: intel-gpu-base-operator - app.kubernetes.io/managed-by: kustomize - name: clusterpolicy-editor-role -rules: -- apiGroups: - - intel.com - resources: - - clusterpolicies - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - intel.com - resources: - - clusterpolicies/status - verbs: - - get diff --git a/charts/gpu-base-operator/templates/clusterpolicy_viewer_role.yaml b/charts/gpu-base-operator/templates/clusterpolicy_viewer_role.yaml deleted file mode 100644 index af3839b..0000000 --- a/charts/gpu-base-operator/templates/clusterpolicy_viewer_role.yaml +++ /dev/null @@ -1,29 +0,0 @@ -# This rule is not used by the project intel-gpu-base-operator itself. -# It is provided to allow the cluster admin to help manage permissions for users. -# -# Grants read-only access to intel.com resources. -# This role is intended for users who need visibility into these resources -# without permissions to modify them. It is ideal for monitoring purposes and limited-access viewing. - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app.kubernetes.io/name: intel-gpu-base-operator - app.kubernetes.io/managed-by: kustomize - name: clusterpolicy-viewer-role -rules: -- apiGroups: - - intel.com - resources: - - clusterpolicies - verbs: - - get - - list - - watch -- apiGroups: - - intel.com - resources: - - clusterpolicies/status - verbs: - - get diff --git a/charts/gpu-base-operator/templates/gpufirmwareupdate_admin_role.yaml b/charts/gpu-base-operator/templates/gpufirmwareupdate_admin_role.yaml deleted file mode 100644 index 55289a2..0000000 --- a/charts/gpu-base-operator/templates/gpufirmwareupdate_admin_role.yaml +++ /dev/null @@ -1,27 +0,0 @@ -# This rule is not used by the project intel-gpu-base-operator itself. -# It is provided to allow the cluster admin to help manage permissions for users. -# -# Grants full permissions ('*') over intel.com. -# This role is intended for users authorized to modify roles and bindings within the cluster, -# enabling them to delegate specific permissions to other users or groups as needed. - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app.kubernetes.io/name: intel-gpu-base-operator - app.kubernetes.io/managed-by: kustomize - name: gpufirmwareupdate-admin-role -rules: -- apiGroups: - - intel.com - resources: - - gpufirmwareupdates - verbs: - - '*' -- apiGroups: - - intel.com - resources: - - gpufirmwareupdates/status - verbs: - - get diff --git a/charts/gpu-base-operator/templates/gpufirmwareupdate_editor_role.yaml b/charts/gpu-base-operator/templates/gpufirmwareupdate_editor_role.yaml deleted file mode 100644 index 8215e26..0000000 --- a/charts/gpu-base-operator/templates/gpufirmwareupdate_editor_role.yaml +++ /dev/null @@ -1,33 +0,0 @@ -# This rule is not used by the project intel-gpu-base-operator itself. -# It is provided to allow the cluster admin to help manage permissions for users. -# -# Grants permissions to create, update, and delete resources within the intel.com. -# This role is intended for users who need to manage these resources -# but should not control RBAC or manage permissions for others. - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app.kubernetes.io/name: intel-gpu-base-operator - app.kubernetes.io/managed-by: kustomize - name: gpufirmwareupdate-editor-role -rules: -- apiGroups: - - intel.com - resources: - - gpufirmwareupdates - verbs: - - create - - delete - - get - - list - - patch - - update - - watch -- apiGroups: - - intel.com - resources: - - gpufirmwareupdates/status - verbs: - - get diff --git a/charts/gpu-base-operator/templates/gpufirmwareupdate_viewer_role.yaml b/charts/gpu-base-operator/templates/gpufirmwareupdate_viewer_role.yaml deleted file mode 100644 index 57e968f..0000000 --- a/charts/gpu-base-operator/templates/gpufirmwareupdate_viewer_role.yaml +++ /dev/null @@ -1,29 +0,0 @@ -# This rule is not used by the project intel-gpu-base-operator itself. -# It is provided to allow the cluster admin to help manage permissions for users. -# -# Grants read-only access to intel.com resources. -# This role is intended for users who need visibility into these resources -# without permissions to modify them. It is ideal for monitoring purposes and limited-access viewing. - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app.kubernetes.io/name: intel-gpu-base-operator - app.kubernetes.io/managed-by: kustomize - name: gpufirmwareupdate-viewer-role -rules: -- apiGroups: - - intel.com - resources: - - gpufirmwareupdates - verbs: - - get - - list - - watch -- apiGroups: - - intel.com - resources: - - gpufirmwareupdates/status - verbs: - - get diff --git a/charts/gpu-base-operator/templates/leader_election_role_binding.yaml b/charts/gpu-base-operator/templates/leader_election_role_binding.yaml index 85e9845..64eda85 100644 --- a/charts/gpu-base-operator/templates/leader_election_role_binding.yaml +++ b/charts/gpu-base-operator/templates/leader_election_role_binding.yaml @@ -11,5 +11,5 @@ roleRef: name: leader-election-role subjects: - kind: ServiceAccount - name: controller-manager + name: {{ .Release.Name }}-controller-manager namespace: {{ .Release.Namespace }} diff --git a/charts/gpu-base-operator/templates/manager.yaml b/charts/gpu-base-operator/templates/manager.yaml index 2c2b274..bec40f0 100644 --- a/charts/gpu-base-operator/templates/manager.yaml +++ b/charts/gpu-base-operator/templates/manager.yaml @@ -1,15 +1,15 @@ apiVersion: apps/v1 kind: Deployment metadata: - name: controller-manager + name: {{ .Release.Name }}-controller-manager labels: - control-plane: controller-manager + control-plane: {{ .Release.Name }}-controller-manager app.kubernetes.io/name: intel-gpu-base-operator app.kubernetes.io/managed-by: kustomize spec: selector: matchLabels: - control-plane: controller-manager + control-plane: {{ .Release.Name }}-controller-manager app.kubernetes.io/name: intel-gpu-base-operator replicas: 1 template: @@ -17,7 +17,7 @@ spec: annotations: kubectl.kubernetes.io/default-container: manager labels: - control-plane: controller-manager + control-plane: {{ .Release.Name }}-controller-manager app.kubernetes.io/name: intel-gpu-base-operator spec: # TODO(user): Uncomment the following code to configure the nodeAffinity expression @@ -105,7 +105,7 @@ spec: requests: cpu: {{ .Values.operator.resources.requests.cpu | default "10m" }} memory: {{ .Values.operator.resources.requests.memory | default "64Mi" }} - serviceAccountName: controller-manager + serviceAccountName: {{ .Release.Name }}-controller-manager terminationGracePeriodSeconds: 10 volumes: - name: webhook-certs diff --git a/charts/gpu-base-operator/templates/metrics_auth_role.yaml b/charts/gpu-base-operator/templates/metrics_auth_role.yaml index 32d2e4e..1e84a11 100644 --- a/charts/gpu-base-operator/templates/metrics_auth_role.yaml +++ b/charts/gpu-base-operator/templates/metrics_auth_role.yaml @@ -1,7 +1,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: metrics-auth-role + name: {{ .Release.Name }}-metrics-auth-role rules: - apiGroups: - authentication.k8s.io diff --git a/charts/gpu-base-operator/templates/metrics_auth_role_binding.yaml b/charts/gpu-base-operator/templates/metrics_auth_role_binding.yaml index f480bb3..63db601 100644 --- a/charts/gpu-base-operator/templates/metrics_auth_role_binding.yaml +++ b/charts/gpu-base-operator/templates/metrics_auth_role_binding.yaml @@ -1,12 +1,12 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: metrics-auth-rolebinding + name: {{ .Release.Name }}-metrics-auth-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: metrics-auth-role + name: {{ .Release.Name }}-metrics-auth-role subjects: - kind: ServiceAccount - name: controller-manager + name: {{ .Release.Name }}-controller-manager namespace: {{ .Release.Namespace }} diff --git a/charts/gpu-base-operator/templates/namespaced_role_binding.yaml b/charts/gpu-base-operator/templates/namespaced_role_binding.yaml index 064af69..ad05029 100644 --- a/charts/gpu-base-operator/templates/namespaced_role_binding.yaml +++ b/charts/gpu-base-operator/templates/namespaced_role_binding.yaml @@ -12,5 +12,5 @@ roleRef: name: manager-namespaced-role subjects: - kind: ServiceAccount - name: controller-manager + name: {{ .Release.Name }}-controller-manager namespace: {{ .Release.Namespace }} diff --git a/charts/gpu-base-operator/templates/role.yaml b/charts/gpu-base-operator/templates/role.yaml index e691942..c556fbd 100644 --- a/charts/gpu-base-operator/templates/role.yaml +++ b/charts/gpu-base-operator/templates/role.yaml @@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: manager-role + name: {{ .Release.Name }}-manager-role rules: - apiGroups: - "" diff --git a/charts/gpu-base-operator/templates/role_binding.yaml b/charts/gpu-base-operator/templates/role_binding.yaml index f6922fc..bedd155 100644 --- a/charts/gpu-base-operator/templates/role_binding.yaml +++ b/charts/gpu-base-operator/templates/role_binding.yaml @@ -4,12 +4,12 @@ metadata: labels: app.kubernetes.io/name: intel-gpu-base-operator app.kubernetes.io/managed-by: kustomize - name: manager-rolebinding + name: {{ .Release.Name }}-manager-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: manager-role + name: {{ .Release.Name }}-manager-role subjects: - kind: ServiceAccount - name: controller-manager + name: {{ .Release.Name }}-controller-manager namespace: {{.Release.Namespace }} diff --git a/charts/gpu-base-operator/templates/service_account.yaml b/charts/gpu-base-operator/templates/service_account.yaml index 53a1ce4..eace817 100644 --- a/charts/gpu-base-operator/templates/service_account.yaml +++ b/charts/gpu-base-operator/templates/service_account.yaml @@ -4,5 +4,5 @@ metadata: labels: app.kubernetes.io/name: intel-gpu-base-operator app.kubernetes.io/managed-by: kustomize - name: controller-manager + name: {{ .Release.Name }}-controller-manager namespace: {{ .Release.Namespace }} diff --git a/charts/gpu-base-operator/templates/webhook_service.yaml b/charts/gpu-base-operator/templates/webhook_service.yaml index c1e8038..d93a524 100644 --- a/charts/gpu-base-operator/templates/webhook_service.yaml +++ b/charts/gpu-base-operator/templates/webhook_service.yaml @@ -14,4 +14,4 @@ spec: targetPort: 9443 selector: app.kubernetes.io/name: intel-gpu-base-operator - control-plane: controller-manager + control-plane: {{ .Release.Name }}-controller-manager