Merged in feature/ZITADOPER-1-initial-operator-build (pull request #1)
Feature/ZITADOPER-1 initial operator build Approved-by: Albert Attia
This commit is contained in:
Haim Kortovich
137
bitbucket-pipelines.yml
Normal file
137
bitbucket-pipelines.yml
Normal file
@@ -0,0 +1,137 @@
|
|||||||
|
definitions:
|
||||||
|
steps:
|
||||||
|
- step: &test
|
||||||
|
name: "Test"
|
||||||
|
runs-on:
|
||||||
|
- "linux"
|
||||||
|
- "self.hosted"
|
||||||
|
script:
|
||||||
|
- echo please create tests
|
||||||
|
|
||||||
|
- step: &build
|
||||||
|
name: "Build"
|
||||||
|
runs-on:
|
||||||
|
- "nixrunner"
|
||||||
|
- "linux.shell"
|
||||||
|
- "self.hosted"
|
||||||
|
script:
|
||||||
|
- mkdir -p images
|
||||||
|
- (umask 077 ; echo -n $SSHKEY | base64 -d > ./id_rsa)
|
||||||
|
- nix build --print-build-logs ./build/#dockerImage
|
||||||
|
- cp $(readlink ./result) images/
|
||||||
|
artifacts:
|
||||||
|
- images/*
|
||||||
|
|
||||||
|
- step: &package-dev
|
||||||
|
name: "Package Chart for Dev"
|
||||||
|
runs-on:
|
||||||
|
- "nixrunner"
|
||||||
|
- "linux.shell"
|
||||||
|
- "self.hosted"
|
||||||
|
script:
|
||||||
|
- mkdir -p charts
|
||||||
|
- export VERSION="$BITBUCKET_BUILD_NUMBER"
|
||||||
|
- export REPOSITORY="$K8S_ARES_DEV_DOCKERREGISTRY_URL/$BITBUCKET_REPO_SLUG"
|
||||||
|
- nix-shell -p yq-go --run 'yq -i ".controllerManager.manager.image.tag = env(VERSION)" ./ops/chart/values.yaml'
|
||||||
|
- nix-shell -p yq-go --run 'yq -i ".controllerManager.manager.image.repository = env(REPOSITORY)" ./ops/chart/values.yaml'
|
||||||
|
- nix-shell -p kubernetes-helm --run 'helm repo add base "$K8S_ARES_DEV_CHARTMUSEUM_ENDPOINT" --username "$K8S_ARES_DEV_CHARTMUSEUM_USERNAME" --password "$K8S_ARES_DEV_CHARTMUSEUM_PASSWORD" --insecure-skip-tls-verify --force-update && helm dependency build ./ops/chart && helm package ./ops/chart -d result --app-version "$VERSION" --version "$VERSION"'
|
||||||
|
- cp -a ./result/. charts/
|
||||||
|
artifacts:
|
||||||
|
- charts/*
|
||||||
|
|
||||||
|
- step: &package-qa
|
||||||
|
name: "Package Chart for QA"
|
||||||
|
runs-on:
|
||||||
|
- "nixrunner"
|
||||||
|
- "linux.shell"
|
||||||
|
- "self.hosted"
|
||||||
|
script:
|
||||||
|
- mkdir -p charts
|
||||||
|
- export VERSION="$BITBUCKET_BUILD_NUMBER"
|
||||||
|
- export REPOSITORY="$K8S_ARES_QA_DOCKERREGISTRY_URL/$BITBUCKET_REPO_SLUG"
|
||||||
|
- nix-shell -p yq-go --run 'yq -i ".controllerManager.manager.image.tag = env(VERSION)" ./ops/chart/values.yaml'
|
||||||
|
- nix-shell -p yq-go --run 'yq -i ".controllerManager.manager.image.repository = env(REPOSITORY)" ./ops/chart/values.yaml'
|
||||||
|
- nix-shell -p kubernetes-helm --run 'helm repo add base "$K8S_ARES_QA_CHARTMUSEUM_ENDPOINT" --username "$K8S_ARES_QA_CHARTMUSEUM_USERNAME" --password "$K8S_ARES_QA_CHARTMUSEUM_PASSWORD" --insecure-skip-tls-verify --force-update && helm dependency build ./ops/chart && helm package ./ops/chart -d result --app-version "$VERSION" --version "$VERSION"'
|
||||||
|
- cp -a ./result/. charts/
|
||||||
|
artifacts:
|
||||||
|
- charts/*
|
||||||
|
|
||||||
|
- step: &publish-dev
|
||||||
|
name: "Publish Chart to Dev"
|
||||||
|
runs-on:
|
||||||
|
- "nixrunner"
|
||||||
|
- "linux.shell"
|
||||||
|
- "self.hosted"
|
||||||
|
deployment: dev
|
||||||
|
script:
|
||||||
|
- |
|
||||||
|
nix-shell -p cacert curl --run 'curl -k --fail --data-binary "@charts/$(ls charts | tee /dev/stderr | head -n 1)" -u "$K8S_ARES_DEV_CHARTMUSEUM_USERNAME:$K8S_ARES_DEV_CHARTMUSEUM_PASSWORD" "$K8S_ARES_DEV_CHARTMUSEUM_ENDPOINT/api/charts"'
|
||||||
|
|
||||||
|
- step: &push-dev
|
||||||
|
name: "Push image to Dev"
|
||||||
|
image: topmanage/deployment-pipeline-image:28
|
||||||
|
runs-on:
|
||||||
|
- "linux"
|
||||||
|
- "self.hosted"
|
||||||
|
# deployment: dev
|
||||||
|
script:
|
||||||
|
- |
|
||||||
|
set -euo pipefail
|
||||||
|
DOCKERREGISTRY_URL=$K8S_ARES_DEV_DOCKERREGISTRY_URL \
|
||||||
|
DOCKERREGISTRY_CACERT=$K8S_ARES_DEV_DOCKERREGISTRY_CACERT \
|
||||||
|
DOCKERREGISTRY_CLIENTCERT=$K8S_ARES_DEV_DOCKERREGISTRY_CLIENTCERT \
|
||||||
|
DOCKERREGISTRY_CLIENTKEY=$K8S_ARES_DEV_DOCKERREGISTRY_CLIENTKEY \
|
||||||
|
DOCKERREGISTRY_PASSWORD=$K8S_ARES_DEV_DOCKERREGISTRY_PASSWORD \
|
||||||
|
./build/push-image.sh
|
||||||
|
|
||||||
|
- step: &publish-qa
|
||||||
|
name: "Publish Chart to QA"
|
||||||
|
runs-on:
|
||||||
|
- "nixrunner"
|
||||||
|
- "linux.shell"
|
||||||
|
- "self.hosted"
|
||||||
|
deployment: qa
|
||||||
|
script:
|
||||||
|
- |
|
||||||
|
nix-shell -p cacert curl --run 'curl -k --fail --data-binary "@charts/$(ls charts | tee /dev/stderr | head -n 1)" -u "$K8S_ARES_QA_CHARTMUSEUM_USERNAME:$K8S_ARES_QA_CHARTMUSEUM_PASSWORD" "$K8S_ARES_QA_CHARTMUSEUM_ENDPOINT/api/charts"'
|
||||||
|
|
||||||
|
- step: &push-qa
|
||||||
|
name: "Push image to QA"
|
||||||
|
image: topmanage/deployment-pipeline-image:28
|
||||||
|
runs-on:
|
||||||
|
- "linux"
|
||||||
|
- "self.hosted"
|
||||||
|
# deployment: qa
|
||||||
|
script:
|
||||||
|
- |
|
||||||
|
set -euo pipefail
|
||||||
|
DOCKERREGISTRY_URL=$K8S_ARES_QA_DOCKERREGISTRY_URL \
|
||||||
|
DOCKERREGISTRY_CACERT=$K8S_ARES_QA_DOCKERREGISTRY_CACERT \
|
||||||
|
DOCKERREGISTRY_CLIENTCERT=$K8S_ARES_QA_DOCKERREGISTRY_CLIENTCERT \
|
||||||
|
DOCKERREGISTRY_CLIENTKEY=$K8S_ARES_QA_DOCKERREGISTRY_CLIENTKEY \
|
||||||
|
DOCKERREGISTRY_PASSWORD=$K8S_ARES_QA_DOCKERREGISTRY_PASSWORD \
|
||||||
|
./build/push-image.sh
|
||||||
|
|
||||||
|
pipelines:
|
||||||
|
default:
|
||||||
|
- parallel:
|
||||||
|
- step: *build
|
||||||
|
- step: *test
|
||||||
|
- step: *package-dev
|
||||||
|
- step: *push-dev
|
||||||
|
- step: *publish-dev
|
||||||
|
branches:
|
||||||
|
master:
|
||||||
|
- parallel:
|
||||||
|
- step: *build
|
||||||
|
- step: *test
|
||||||
|
- step: *package-qa
|
||||||
|
- step: *push-qa
|
||||||
|
- step: *publish-qa
|
||||||
|
tags:
|
||||||
|
release-*:
|
||||||
|
- parallel:
|
||||||
|
- step: *build
|
||||||
|
- step: *test
|
||||||
|
- step: *package-dev
|
||||||
|
- step: *push-dev
|
||||||
75
build/flake.lock
generated
Normal file
75
build/flake.lock
generated
Normal file
@@ -0,0 +1,75 @@
|
|||||||
|
{
|
||||||
|
"nodes": {
|
||||||
|
"flake-utils": {
|
||||||
|
"inputs": {
|
||||||
|
"systems": "systems"
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1701680307,
|
||||||
|
"narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"nixpkgs": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1704842529,
|
||||||
|
"narHash": "sha256-OTeQA+F8d/Evad33JMfuXC89VMetQbsU4qcaePchGr4=",
|
||||||
|
"owner": "NixOS",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"rev": "eabe8d3eface69f5bb16c18f8662a702f50c20d5",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"id": "nixpkgs",
|
||||||
|
"type": "indirect"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"nixpkgs-unstable": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1704722960,
|
||||||
|
"narHash": "sha256-mKGJ3sPsT6//s+Knglai5YflJUF2DGj7Ai6Ynopz0kI=",
|
||||||
|
"owner": "NixOS",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"rev": "317484b1ead87b9c1b8ac5261a8d2dd748a0492d",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"id": "nixpkgs",
|
||||||
|
"ref": "nixos-unstable",
|
||||||
|
"type": "indirect"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"root": {
|
||||||
|
"inputs": {
|
||||||
|
"flake-utils": "flake-utils",
|
||||||
|
"nixpkgs": "nixpkgs",
|
||||||
|
"nixpkgs-unstable": "nixpkgs-unstable"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"systems": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1681028828,
|
||||||
|
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||||
|
"owner": "nix-systems",
|
||||||
|
"repo": "default",
|
||||||
|
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "nix-systems",
|
||||||
|
"repo": "default",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"root": "root",
|
||||||
|
"version": 7
|
||||||
|
}
|
||||||
52
build/flake.nix
Normal file
52
build/flake.nix
Normal file
@@ -0,0 +1,52 @@
|
|||||||
|
{
|
||||||
|
description = "Zitadel K8s Operator";
|
||||||
|
|
||||||
|
inputs = {
|
||||||
|
flake-utils.url = "github:numtide/flake-utils";
|
||||||
|
nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
|
||||||
|
};
|
||||||
|
|
||||||
|
outputs = { self, nixpkgs, nixpkgs-unstable, flake-utils }:
|
||||||
|
flake-utils.lib.eachDefaultSystem (system:
|
||||||
|
let
|
||||||
|
unstable = nixpkgs-unstable.legacyPackages.${system};
|
||||||
|
pkgs = nixpkgs.legacyPackages.${system};
|
||||||
|
package = unstable.buildGoModule {
|
||||||
|
pname = "zitadel-k8s-operator";
|
||||||
|
version = "0.0.0";
|
||||||
|
src = ../src;
|
||||||
|
doCheck = false;
|
||||||
|
vendorHash = "sha256-tELr2Idyk3g6LLwMlehO4dnsHkmBO9ltLmheabQz1QY=";
|
||||||
|
installPhase = ''
|
||||||
|
runHook preInstall
|
||||||
|
|
||||||
|
mkdir -p $out/bin
|
||||||
|
dir="$GOPATH/bin"
|
||||||
|
[ -e "$dir" ] && cp -r $dir/cmd $out/manager
|
||||||
|
|
||||||
|
runHook postInstall
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
dockerPackage = pkgs.dockerTools.buildImage {
|
||||||
|
name = "zitadel-k8s-operator";
|
||||||
|
fromImageName = "gcr.io/distroless/static";
|
||||||
|
fromImageTag = "nonroot";
|
||||||
|
copyToRoot = pkgs.buildEnv {
|
||||||
|
name = "operator";
|
||||||
|
paths = [ package ];
|
||||||
|
pathsToLink = [ "/" ];
|
||||||
|
};
|
||||||
|
config = {
|
||||||
|
Cmd = [ "/manager" ];
|
||||||
|
WorkingDir = "/";
|
||||||
|
User = "65532:65532";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
in with pkgs; {
|
||||||
|
packages.default = package;
|
||||||
|
packages.dockerImage = dockerPackage;
|
||||||
|
devShells.default = mkShell {
|
||||||
|
buildInputs = [ nixfmt unstable.gopls operator-sdk unstable.go ];
|
||||||
|
};
|
||||||
|
});
|
||||||
|
}
|
||||||
63
build/push-image.sh
Executable file
63
build/push-image.sh
Executable file
@@ -0,0 +1,63 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
set -xeuo pipefail
|
||||||
|
|
||||||
|
# Setup client certificate for docker registry login
|
||||||
|
mkdir -p /.docker
|
||||||
|
mkdir -p /etc/docker/certs.d/$DOCKERREGISTRY_URL
|
||||||
|
echo $DOCKERREGISTRY_CACERT
|
||||||
|
(umask 077 ; echo $DOCKERREGISTRY_CACERT | base64 -d > /.docker/ca.pem)
|
||||||
|
(umask 077 ; echo $DOCKERREGISTRY_CACERT | base64 -d > /etc/docker/certs.d/$DOCKERREGISTRY_URL/ca.crt) #Don't ask why this is needed twice.
|
||||||
|
(umask 077 ; echo $DOCKERREGISTRY_CLIENTCERT | base64 -d > /etc/docker/certs.d/$DOCKERREGISTRY_URL/client.cert)
|
||||||
|
(umask 077 ; echo $DOCKERREGISTRY_CLIENTKEY | base64 -d > /etc/docker/certs.d/$DOCKERREGISTRY_URL/client.key)
|
||||||
|
|
||||||
|
docker --tls login -u $DOCKERREGISTRY_USER -p $DOCKERREGISTRY_PASSWORD $DOCKERREGISTRY_URL
|
||||||
|
|
||||||
|
export DOCKER_HOST=$DOCKERDAEMON_ADDRESS #Setup docker to use a specific daemon
|
||||||
|
|
||||||
|
BUILD_IMAGE_NAME=$(ls images | tee /dev/stderr | head -n 1)
|
||||||
|
|
||||||
|
IMAGE_ID=$(
|
||||||
|
docker load --input "images/$BUILD_IMAGE_NAME" |
|
||||||
|
sed -nr 's/^Loaded image: (.*)$/\1/p' |
|
||||||
|
xargs -I{} docker image ls "{}" --format="{{.ID}}" |
|
||||||
|
tee /dev/stderr
|
||||||
|
)
|
||||||
|
|
||||||
|
DOCKER_IMAGE_NAME=$DOCKERREGISTRY_URL/$BITBUCKET_REPO_SLUG
|
||||||
|
VERSION=$BITBUCKET_BUILD_NUMBER
|
||||||
|
|
||||||
|
if [[ "${BITBUCKET_BRANCH:-""}" == "master" ]]; then
|
||||||
|
LATEST="latest"
|
||||||
|
else
|
||||||
|
unset LATEST
|
||||||
|
fi
|
||||||
|
|
||||||
|
escapeTag(){ echo "${1//[^a-zA-Z0-9._\-]/-}"; }
|
||||||
|
|
||||||
|
tagPush(){
|
||||||
|
if [ -n "$1" ]; then
|
||||||
|
local tag=$(escapeTag "$1")
|
||||||
|
docker tag "$IMAGE_ID" "$DOCKER_IMAGE_NAME:$tag" && docker push "$DOCKER_IMAGE_NAME:$tag"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
tagRemove(){
|
||||||
|
if [ -n "$1" ]; then
|
||||||
|
local tag=$(escapeTag "$1")
|
||||||
|
docker rmi "$DOCKER_IMAGE_NAME:$tag"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
set +u
|
||||||
|
|
||||||
|
tagPush "$VERSION"
|
||||||
|
tagPush "$BITBUCKET_BRANCH"
|
||||||
|
tagPush "$BITBUCKET_TAG"
|
||||||
|
tagPush "$BITBUCKET_COMMIT"
|
||||||
|
tagPush "$LATEST"
|
||||||
|
|
||||||
|
tagRemove "$VERSION"
|
||||||
|
tagRemove "$BITBUCKET_BRANCH"
|
||||||
|
tagRemove "$BITBUCKET_TAG"
|
||||||
|
tagRemove "$BITBUCKET_COMMIT"
|
||||||
|
tagRemove "$LATEST"
|
||||||
23
ops/chart/.helmignore
Normal file
23
ops/chart/.helmignore
Normal file
@@ -0,0 +1,23 @@
|
|||||||
|
# Patterns to ignore when building packages.
|
||||||
|
# This supports shell glob matching, relative path matching, and
|
||||||
|
# negation (prefixed with !). Only one pattern per line.
|
||||||
|
.DS_Store
|
||||||
|
# Common VCS dirs
|
||||||
|
.git/
|
||||||
|
.gitignore
|
||||||
|
.bzr/
|
||||||
|
.bzrignore
|
||||||
|
.hg/
|
||||||
|
.hgignore
|
||||||
|
.svn/
|
||||||
|
# Common backup files
|
||||||
|
*.swp
|
||||||
|
*.bak
|
||||||
|
*.tmp
|
||||||
|
*.orig
|
||||||
|
*~
|
||||||
|
# Various IDEs
|
||||||
|
.project
|
||||||
|
.idea/
|
||||||
|
*.tmproj
|
||||||
|
.vscode/
|
||||||
21
ops/chart/Chart.yaml
Normal file
21
ops/chart/Chart.yaml
Normal file
@@ -0,0 +1,21 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: zitadel-k8s-operator
|
||||||
|
description: A Helm chart for Kubernetes
|
||||||
|
# A chart can be either an 'application' or a 'library' chart.
|
||||||
|
#
|
||||||
|
# Application charts are a collection of templates that can be packaged into versioned archives
|
||||||
|
# to be deployed.
|
||||||
|
#
|
||||||
|
# Library charts provide useful utilities or functions for the chart developer. They're included as
|
||||||
|
# a dependency of application charts to inject those utilities and functions into the rendering
|
||||||
|
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
|
||||||
|
type: application
|
||||||
|
# This is the chart version. This version number should be incremented each time you make changes
|
||||||
|
# to the chart and its templates, including the app version.
|
||||||
|
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||||
|
version: 0.1.0
|
||||||
|
# This is the version number of the application being deployed. This version number should be
|
||||||
|
# incremented each time you make changes to the application. Versions are not expected to
|
||||||
|
# follow Semantic Versioning. They should reflect the version the application is using.
|
||||||
|
# It is recommended to use it with quotes.
|
||||||
|
appVersion: "0.1.0"
|
||||||
176
ops/chart/crds/apiapp-crd.yaml
Normal file
176
ops/chart/crds/apiapp-crd.yaml
Normal file
@@ -0,0 +1,176 @@
|
|||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
controller-gen.kubebuilder.io/version: v0.11.1
|
||||||
|
creationTimestamp: null
|
||||||
|
name: apiapps.zitadel.topmanage.com
|
||||||
|
spec:
|
||||||
|
group: zitadel.topmanage.com
|
||||||
|
names:
|
||||||
|
kind: APIApp
|
||||||
|
listKind: APIAppList
|
||||||
|
plural: apiapps
|
||||||
|
singular: apiapp
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: APIApp is the Schema for the apiapps API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: APIAppSpec defines the desired state of APIApp
|
||||||
|
properties:
|
||||||
|
authMethodType:
|
||||||
|
enum:
|
||||||
|
- API_AUTH_METHOD_TYPE_BASIC
|
||||||
|
- API_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT
|
||||||
|
type: string
|
||||||
|
projectRef:
|
||||||
|
description: 'INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
|
||||||
|
Important: Run "make" to regenerate code after modifying this file'
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead of
|
||||||
|
an entire object, this string should contain a valid JSON/Go
|
||||||
|
field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container within
|
||||||
|
a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that triggered
|
||||||
|
the event) or if no container name is specified "spec.containers[2]"
|
||||||
|
(container with index 2 in this pod). This syntax is chosen
|
||||||
|
only to have some well-defined way of referencing a part of
|
||||||
|
an object. TODO: this design is not final and this field is
|
||||||
|
subject to change in the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
required:
|
||||||
|
- authMethodType
|
||||||
|
- projectRef
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: APIAppStatus defines the observed state of APIApp
|
||||||
|
properties:
|
||||||
|
appId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
clientId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
conditions:
|
||||||
|
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
|
||||||
|
of cluster Important: Run "make" to regenerate code after modifying
|
||||||
|
this file'
|
||||||
|
items:
|
||||||
|
description: "Condition contains details for one aspect of the current
|
||||||
|
state of this API Resource. --- This struct is intended for direct
|
||||||
|
use as an array at the field path .status.conditions. For example,
|
||||||
|
\n type FooStatus struct{ // Represents the observations of a
|
||||||
|
foo's current state. // Known .status.conditions.type are: \"Available\",
|
||||||
|
\"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
|
||||||
|
// +listType=map // +listMapKey=type Conditions []metav1.Condition
|
||||||
|
`json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
|
||||||
|
protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
|
||||||
|
properties:
|
||||||
|
lastTransitionTime:
|
||||||
|
description: lastTransitionTime is the last time the condition
|
||||||
|
transitioned from one status to another. This should be when
|
||||||
|
the underlying condition changed. If that is not known, then
|
||||||
|
using the time when the API field changed is acceptable.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: message is a human readable message indicating
|
||||||
|
details about the transition. This may be an empty string.
|
||||||
|
maxLength: 32768
|
||||||
|
type: string
|
||||||
|
observedGeneration:
|
||||||
|
description: observedGeneration represents the .metadata.generation
|
||||||
|
that the condition was set based upon. For instance, if .metadata.generation
|
||||||
|
is currently 12, but the .status.conditions[x].observedGeneration
|
||||||
|
is 9, the condition is out of date with respect to the current
|
||||||
|
state of the instance.
|
||||||
|
format: int64
|
||||||
|
minimum: 0
|
||||||
|
type: integer
|
||||||
|
reason:
|
||||||
|
description: reason contains a programmatic identifier indicating
|
||||||
|
the reason for the condition's last transition. Producers
|
||||||
|
of specific condition types may define expected values and
|
||||||
|
meanings for this field, and whether the values are considered
|
||||||
|
a guaranteed API. The value should be a CamelCase string.
|
||||||
|
This field may not be empty.
|
||||||
|
maxLength: 1024
|
||||||
|
minLength: 1
|
||||||
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||||
|
type: string
|
||||||
|
status:
|
||||||
|
description: status of the condition, one of True, False, Unknown.
|
||||||
|
enum:
|
||||||
|
- "True"
|
||||||
|
- "False"
|
||||||
|
- Unknown
|
||||||
|
type: string
|
||||||
|
type:
|
||||||
|
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||||
|
--- Many .condition.type values are consistent across resources
|
||||||
|
like Available, but because arbitrary conditions can be useful
|
||||||
|
(see .node.status.conditions), the ability to deconflict is
|
||||||
|
important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||||
|
maxLength: 316
|
||||||
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- lastTransitionTime
|
||||||
|
- message
|
||||||
|
- reason
|
||||||
|
- status
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
keyId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- appId
|
||||||
|
- clientId
|
||||||
|
- keyId
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
224
ops/chart/crds/machineuser-crd.yaml
Normal file
224
ops/chart/crds/machineuser-crd.yaml
Normal file
@@ -0,0 +1,224 @@
|
|||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
controller-gen.kubebuilder.io/version: v0.11.1
|
||||||
|
creationTimestamp: null
|
||||||
|
name: machineusers.zitadel.topmanage.com
|
||||||
|
spec:
|
||||||
|
group: zitadel.topmanage.com
|
||||||
|
names:
|
||||||
|
kind: MachineUser
|
||||||
|
listKind: MachineUserList
|
||||||
|
plural: machineusers
|
||||||
|
singular: machineuser
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: MachineUser is the Schema for the machineusers API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: MachineUserSpec defines the desired state of MachineUser
|
||||||
|
properties:
|
||||||
|
accessTokenType:
|
||||||
|
enum:
|
||||||
|
- ACCESS_TOKEN_TYPE_BEARER
|
||||||
|
- ACCESS_TOKEN_TYPE_JWT
|
||||||
|
type: string
|
||||||
|
organizationRef:
|
||||||
|
description: 'INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
|
||||||
|
Important: Run "make" to regenerate code after modifying this file'
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead of
|
||||||
|
an entire object, this string should contain a valid JSON/Go
|
||||||
|
field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container within
|
||||||
|
a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that triggered
|
||||||
|
the event) or if no container name is specified "spec.containers[2]"
|
||||||
|
(container with index 2 in this pod). This syntax is chosen
|
||||||
|
only to have some well-defined way of referencing a part of
|
||||||
|
an object. TODO: this design is not final and this field is
|
||||||
|
subject to change in the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
userGrants:
|
||||||
|
items:
|
||||||
|
properties:
|
||||||
|
projectRef:
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead
|
||||||
|
of an entire object, this string should contain a valid
|
||||||
|
JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container
|
||||||
|
within a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that
|
||||||
|
triggered the event) or if no container name is specified
|
||||||
|
"spec.containers[2]" (container with index 2 in this pod).
|
||||||
|
This syntax is chosen only to have some well-defined way
|
||||||
|
of referencing a part of an object. TODO: this design
|
||||||
|
is not final and this field is subject to change in the
|
||||||
|
future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
roleKeys:
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- projectRef
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- accessTokenType
|
||||||
|
- organizationRef
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: MachineUserStatus defines the observed state of MachineUser
|
||||||
|
properties:
|
||||||
|
conditions:
|
||||||
|
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
|
||||||
|
of cluster Important: Run "make" to regenerate code after modifying
|
||||||
|
this file'
|
||||||
|
items:
|
||||||
|
description: "Condition contains details for one aspect of the current
|
||||||
|
state of this API Resource. --- This struct is intended for direct
|
||||||
|
use as an array at the field path .status.conditions. For example,
|
||||||
|
\n type FooStatus struct{ // Represents the observations of a
|
||||||
|
foo's current state. // Known .status.conditions.type are: \"Available\",
|
||||||
|
\"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
|
||||||
|
// +listType=map // +listMapKey=type Conditions []metav1.Condition
|
||||||
|
`json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
|
||||||
|
protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
|
||||||
|
properties:
|
||||||
|
lastTransitionTime:
|
||||||
|
description: lastTransitionTime is the last time the condition
|
||||||
|
transitioned from one status to another. This should be when
|
||||||
|
the underlying condition changed. If that is not known, then
|
||||||
|
using the time when the API field changed is acceptable.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: message is a human readable message indicating
|
||||||
|
details about the transition. This may be an empty string.
|
||||||
|
maxLength: 32768
|
||||||
|
type: string
|
||||||
|
observedGeneration:
|
||||||
|
description: observedGeneration represents the .metadata.generation
|
||||||
|
that the condition was set based upon. For instance, if .metadata.generation
|
||||||
|
is currently 12, but the .status.conditions[x].observedGeneration
|
||||||
|
is 9, the condition is out of date with respect to the current
|
||||||
|
state of the instance.
|
||||||
|
format: int64
|
||||||
|
minimum: 0
|
||||||
|
type: integer
|
||||||
|
reason:
|
||||||
|
description: reason contains a programmatic identifier indicating
|
||||||
|
the reason for the condition's last transition. Producers
|
||||||
|
of specific condition types may define expected values and
|
||||||
|
meanings for this field, and whether the values are considered
|
||||||
|
a guaranteed API. The value should be a CamelCase string.
|
||||||
|
This field may not be empty.
|
||||||
|
maxLength: 1024
|
||||||
|
minLength: 1
|
||||||
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||||
|
type: string
|
||||||
|
status:
|
||||||
|
description: status of the condition, one of True, False, Unknown.
|
||||||
|
enum:
|
||||||
|
- "True"
|
||||||
|
- "False"
|
||||||
|
- Unknown
|
||||||
|
type: string
|
||||||
|
type:
|
||||||
|
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||||
|
--- Many .condition.type values are consistent across resources
|
||||||
|
like Available, but because arbitrary conditions can be useful
|
||||||
|
(see .node.status.conditions), the ability to deconflict is
|
||||||
|
important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||||
|
maxLength: 316
|
||||||
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- lastTransitionTime
|
||||||
|
- message
|
||||||
|
- reason
|
||||||
|
- status
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
keyId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
patId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
userId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- keyId
|
||||||
|
- patId
|
||||||
|
- userId
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
240
ops/chart/crds/oidcapp-crd.yaml
Normal file
240
ops/chart/crds/oidcapp-crd.yaml
Normal file
@@ -0,0 +1,240 @@
|
|||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
controller-gen.kubebuilder.io/version: v0.11.1
|
||||||
|
creationTimestamp: null
|
||||||
|
name: oidcapps.zitadel.topmanage.com
|
||||||
|
spec:
|
||||||
|
group: zitadel.topmanage.com
|
||||||
|
names:
|
||||||
|
kind: OIDCApp
|
||||||
|
listKind: OIDCAppList
|
||||||
|
plural: oidcapps
|
||||||
|
singular: oidcapp
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: OIDCApp is the Schema for the oidcapps API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: OIDCAppSpec defines the desired state of OIDCApp
|
||||||
|
properties:
|
||||||
|
accessTokenRoleAssertion:
|
||||||
|
type: boolean
|
||||||
|
accessTokenType:
|
||||||
|
enum:
|
||||||
|
- OIDC_TOKEN_TYPE_BEARER
|
||||||
|
- OIDC_TOKEN_TYPE_JWT
|
||||||
|
type: string
|
||||||
|
additionalOrigins:
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
appType:
|
||||||
|
enum:
|
||||||
|
- OIDC_APP_TYPE_WEB
|
||||||
|
- OIDC_APP_TYPE_USER_AGENT
|
||||||
|
- OIDC_APP_TYPE_NATIVE
|
||||||
|
type: string
|
||||||
|
authMethodType:
|
||||||
|
enum:
|
||||||
|
- OIDC_AUTH_METHOD_TYPE_BASIC
|
||||||
|
- OIDC_AUTH_METHOD_TYPE_POST
|
||||||
|
- OIDC_AUTH_METHOD_TYPE_NONE
|
||||||
|
- OIDC_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT
|
||||||
|
type: string
|
||||||
|
clockSkew:
|
||||||
|
format: duration
|
||||||
|
type: string
|
||||||
|
devMode:
|
||||||
|
type: boolean
|
||||||
|
grantTypes:
|
||||||
|
items:
|
||||||
|
enum:
|
||||||
|
- OIDC_GRANT_TYPE_AUTHORIZATION_CODE
|
||||||
|
- OIDC_GRANT_TYPE_IMPLICIT
|
||||||
|
- OIDC_GRANT_TYPE_REFRESH_TOKEN
|
||||||
|
- OIDC_GRANT_TYPE_DEVICE_CODE
|
||||||
|
- OIDC_GRANT_TYPE_TOKEN_EXCHANGE
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
idTokenRoleAssertion:
|
||||||
|
type: boolean
|
||||||
|
idTokenUserinfoAssertion:
|
||||||
|
type: boolean
|
||||||
|
postLogoutRedirectUris:
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
projectRef:
|
||||||
|
description: 'INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
|
||||||
|
Important: Run "make" to regenerate code after modifying this file'
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead of
|
||||||
|
an entire object, this string should contain a valid JSON/Go
|
||||||
|
field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container within
|
||||||
|
a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that triggered
|
||||||
|
the event) or if no container name is specified "spec.containers[2]"
|
||||||
|
(container with index 2 in this pod). This syntax is chosen
|
||||||
|
only to have some well-defined way of referencing a part of
|
||||||
|
an object. TODO: this design is not final and this field is
|
||||||
|
subject to change in the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
redirectUris:
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
responseTypes:
|
||||||
|
items:
|
||||||
|
enum:
|
||||||
|
- OIDC_RESPONSE_TYPE_CODE
|
||||||
|
- OIDC_RESPONSE_TYPE_ID_TOKEN
|
||||||
|
- OIDC_RESPONSE_TYPE_ID_TOKEN_TOKEN
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
skipNativeAppSuccessPage:
|
||||||
|
type: boolean
|
||||||
|
required:
|
||||||
|
- accessTokenRoleAssertion
|
||||||
|
- accessTokenType
|
||||||
|
- appType
|
||||||
|
- authMethodType
|
||||||
|
- clockSkew
|
||||||
|
- devMode
|
||||||
|
- grantTypes
|
||||||
|
- idTokenRoleAssertion
|
||||||
|
- idTokenUserinfoAssertion
|
||||||
|
- postLogoutRedirectUris
|
||||||
|
- projectRef
|
||||||
|
- redirectUris
|
||||||
|
- responseTypes
|
||||||
|
- skipNativeAppSuccessPage
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: OIDCAppStatus defines the observed state of OIDCApp
|
||||||
|
properties:
|
||||||
|
appId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
clientId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
conditions:
|
||||||
|
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
|
||||||
|
of cluster Important: Run "make" to regenerate code after modifying
|
||||||
|
this file'
|
||||||
|
items:
|
||||||
|
description: "Condition contains details for one aspect of the current
|
||||||
|
state of this API Resource. --- This struct is intended for direct
|
||||||
|
use as an array at the field path .status.conditions. For example,
|
||||||
|
\n type FooStatus struct{ // Represents the observations of a
|
||||||
|
foo's current state. // Known .status.conditions.type are: \"Available\",
|
||||||
|
\"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
|
||||||
|
// +listType=map // +listMapKey=type Conditions []metav1.Condition
|
||||||
|
`json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
|
||||||
|
protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
|
||||||
|
properties:
|
||||||
|
lastTransitionTime:
|
||||||
|
description: lastTransitionTime is the last time the condition
|
||||||
|
transitioned from one status to another. This should be when
|
||||||
|
the underlying condition changed. If that is not known, then
|
||||||
|
using the time when the API field changed is acceptable.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: message is a human readable message indicating
|
||||||
|
details about the transition. This may be an empty string.
|
||||||
|
maxLength: 32768
|
||||||
|
type: string
|
||||||
|
observedGeneration:
|
||||||
|
description: observedGeneration represents the .metadata.generation
|
||||||
|
that the condition was set based upon. For instance, if .metadata.generation
|
||||||
|
is currently 12, but the .status.conditions[x].observedGeneration
|
||||||
|
is 9, the condition is out of date with respect to the current
|
||||||
|
state of the instance.
|
||||||
|
format: int64
|
||||||
|
minimum: 0
|
||||||
|
type: integer
|
||||||
|
reason:
|
||||||
|
description: reason contains a programmatic identifier indicating
|
||||||
|
the reason for the condition's last transition. Producers
|
||||||
|
of specific condition types may define expected values and
|
||||||
|
meanings for this field, and whether the values are considered
|
||||||
|
a guaranteed API. The value should be a CamelCase string.
|
||||||
|
This field may not be empty.
|
||||||
|
maxLength: 1024
|
||||||
|
minLength: 1
|
||||||
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||||
|
type: string
|
||||||
|
status:
|
||||||
|
description: status of the condition, one of True, False, Unknown.
|
||||||
|
enum:
|
||||||
|
- "True"
|
||||||
|
- "False"
|
||||||
|
- Unknown
|
||||||
|
type: string
|
||||||
|
type:
|
||||||
|
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||||
|
--- Many .condition.type values are consistent across resources
|
||||||
|
like Available, but because arbitrary conditions can be useful
|
||||||
|
(see .node.status.conditions), the ability to deconflict is
|
||||||
|
important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||||
|
maxLength: 316
|
||||||
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- lastTransitionTime
|
||||||
|
- message
|
||||||
|
- reason
|
||||||
|
- status
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- appId
|
||||||
|
- clientId
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
183
ops/chart/crds/organization-crd.yaml
Normal file
183
ops/chart/crds/organization-crd.yaml
Normal file
@@ -0,0 +1,183 @@
|
|||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
controller-gen.kubebuilder.io/version: v0.11.1
|
||||||
|
creationTimestamp: null
|
||||||
|
name: organizations.zitadel.topmanage.com
|
||||||
|
spec:
|
||||||
|
group: zitadel.topmanage.com
|
||||||
|
names:
|
||||||
|
kind: Organization
|
||||||
|
listKind: OrganizationList
|
||||||
|
plural: organizations
|
||||||
|
singular: organization
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: Organization is the Schema for the organizations API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: OrganizationSpec defines the desired state of Organization
|
||||||
|
properties:
|
||||||
|
organizationAdmin:
|
||||||
|
properties:
|
||||||
|
email:
|
||||||
|
type: string
|
||||||
|
firstName:
|
||||||
|
type: string
|
||||||
|
lastName:
|
||||||
|
type: string
|
||||||
|
userName:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- email
|
||||||
|
- firstName
|
||||||
|
- lastName
|
||||||
|
- userName
|
||||||
|
type: object
|
||||||
|
zitadelClusterRef:
|
||||||
|
description: 'INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
|
||||||
|
Important: Run "make" to regenerate code after modifying this file'
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead of
|
||||||
|
an entire object, this string should contain a valid JSON/Go
|
||||||
|
field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container within
|
||||||
|
a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that triggered
|
||||||
|
the event) or if no container name is specified "spec.containers[2]"
|
||||||
|
(container with index 2 in this pod). This syntax is chosen
|
||||||
|
only to have some well-defined way of referencing a part of
|
||||||
|
an object. TODO: this design is not final and this field is
|
||||||
|
subject to change in the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
required:
|
||||||
|
- organizationAdmin
|
||||||
|
- zitadelClusterRef
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: OrganizationStatus defines the observed state of Organization
|
||||||
|
properties:
|
||||||
|
adminId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
conditions:
|
||||||
|
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
|
||||||
|
of cluster Important: Run "make" to regenerate code after modifying
|
||||||
|
this file Conditions for the Database object.'
|
||||||
|
items:
|
||||||
|
description: "Condition contains details for one aspect of the current
|
||||||
|
state of this API Resource. --- This struct is intended for direct
|
||||||
|
use as an array at the field path .status.conditions. For example,
|
||||||
|
\n type FooStatus struct{ // Represents the observations of a
|
||||||
|
foo's current state. // Known .status.conditions.type are: \"Available\",
|
||||||
|
\"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
|
||||||
|
// +listType=map // +listMapKey=type Conditions []metav1.Condition
|
||||||
|
`json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
|
||||||
|
protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
|
||||||
|
properties:
|
||||||
|
lastTransitionTime:
|
||||||
|
description: lastTransitionTime is the last time the condition
|
||||||
|
transitioned from one status to another. This should be when
|
||||||
|
the underlying condition changed. If that is not known, then
|
||||||
|
using the time when the API field changed is acceptable.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: message is a human readable message indicating
|
||||||
|
details about the transition. This may be an empty string.
|
||||||
|
maxLength: 32768
|
||||||
|
type: string
|
||||||
|
observedGeneration:
|
||||||
|
description: observedGeneration represents the .metadata.generation
|
||||||
|
that the condition was set based upon. For instance, if .metadata.generation
|
||||||
|
is currently 12, but the .status.conditions[x].observedGeneration
|
||||||
|
is 9, the condition is out of date with respect to the current
|
||||||
|
state of the instance.
|
||||||
|
format: int64
|
||||||
|
minimum: 0
|
||||||
|
type: integer
|
||||||
|
reason:
|
||||||
|
description: reason contains a programmatic identifier indicating
|
||||||
|
the reason for the condition's last transition. Producers
|
||||||
|
of specific condition types may define expected values and
|
||||||
|
meanings for this field, and whether the values are considered
|
||||||
|
a guaranteed API. The value should be a CamelCase string.
|
||||||
|
This field may not be empty.
|
||||||
|
maxLength: 1024
|
||||||
|
minLength: 1
|
||||||
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||||
|
type: string
|
||||||
|
status:
|
||||||
|
description: status of the condition, one of True, False, Unknown.
|
||||||
|
enum:
|
||||||
|
- "True"
|
||||||
|
- "False"
|
||||||
|
- Unknown
|
||||||
|
type: string
|
||||||
|
type:
|
||||||
|
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||||
|
--- Many .condition.type values are consistent across resources
|
||||||
|
like Available, but because arbitrary conditions can be useful
|
||||||
|
(see .node.status.conditions), the ability to deconflict is
|
||||||
|
important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||||
|
maxLength: 316
|
||||||
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- lastTransitionTime
|
||||||
|
- message
|
||||||
|
- reason
|
||||||
|
- status
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
orgId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- adminId
|
||||||
|
- orgId
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
233
ops/chart/crds/project-crd.yaml
Normal file
233
ops/chart/crds/project-crd.yaml
Normal file
@@ -0,0 +1,233 @@
|
|||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
controller-gen.kubebuilder.io/version: v0.11.1
|
||||||
|
creationTimestamp: null
|
||||||
|
name: projects.zitadel.topmanage.com
|
||||||
|
spec:
|
||||||
|
group: zitadel.topmanage.com
|
||||||
|
names:
|
||||||
|
kind: Project
|
||||||
|
listKind: ProjectList
|
||||||
|
plural: projects
|
||||||
|
singular: project
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: Project is the Schema for the projects API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: ProjectSpec defines the desired state of Project
|
||||||
|
properties:
|
||||||
|
grants:
|
||||||
|
items:
|
||||||
|
properties:
|
||||||
|
organizationRef:
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead
|
||||||
|
of an entire object, this string should contain a valid
|
||||||
|
JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container
|
||||||
|
within a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that
|
||||||
|
triggered the event) or if no container name is specified
|
||||||
|
"spec.containers[2]" (container with index 2 in this pod).
|
||||||
|
This syntax is chosen only to have some well-defined way
|
||||||
|
of referencing a part of an object. TODO: this design
|
||||||
|
is not final and this field is subject to change in the
|
||||||
|
future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
roleKeys:
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- organizationRef
|
||||||
|
- roleKeys
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
hasProjectCheck:
|
||||||
|
type: boolean
|
||||||
|
organizationRef:
|
||||||
|
description: 'INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
|
||||||
|
Important: Run "make" to regenerate code after modifying this file
|
||||||
|
https://zitadel.com/docs/apis/resources/mgmt/management-service-add-project'
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead of
|
||||||
|
an entire object, this string should contain a valid JSON/Go
|
||||||
|
field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container within
|
||||||
|
a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that triggered
|
||||||
|
the event) or if no container name is specified "spec.containers[2]"
|
||||||
|
(container with index 2 in this pod). This syntax is chosen
|
||||||
|
only to have some well-defined way of referencing a part of
|
||||||
|
an object. TODO: this design is not final and this field is
|
||||||
|
subject to change in the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
projectRoleAssertion:
|
||||||
|
type: boolean
|
||||||
|
projectRoleCheck:
|
||||||
|
type: boolean
|
||||||
|
roles:
|
||||||
|
items:
|
||||||
|
properties:
|
||||||
|
displayName:
|
||||||
|
type: string
|
||||||
|
group:
|
||||||
|
type: string
|
||||||
|
key:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- displayName
|
||||||
|
- group
|
||||||
|
- key
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- organizationRef
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: ProjectStatus defines the observed state of Project
|
||||||
|
properties:
|
||||||
|
conditions:
|
||||||
|
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
|
||||||
|
of cluster Important: Run "make" to regenerate code after modifying
|
||||||
|
this file Conditions for the Database object.'
|
||||||
|
items:
|
||||||
|
description: "Condition contains details for one aspect of the current
|
||||||
|
state of this API Resource. --- This struct is intended for direct
|
||||||
|
use as an array at the field path .status.conditions. For example,
|
||||||
|
\n type FooStatus struct{ // Represents the observations of a
|
||||||
|
foo's current state. // Known .status.conditions.type are: \"Available\",
|
||||||
|
\"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
|
||||||
|
// +listType=map // +listMapKey=type Conditions []metav1.Condition
|
||||||
|
`json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
|
||||||
|
protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
|
||||||
|
properties:
|
||||||
|
lastTransitionTime:
|
||||||
|
description: lastTransitionTime is the last time the condition
|
||||||
|
transitioned from one status to another. This should be when
|
||||||
|
the underlying condition changed. If that is not known, then
|
||||||
|
using the time when the API field changed is acceptable.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: message is a human readable message indicating
|
||||||
|
details about the transition. This may be an empty string.
|
||||||
|
maxLength: 32768
|
||||||
|
type: string
|
||||||
|
observedGeneration:
|
||||||
|
description: observedGeneration represents the .metadata.generation
|
||||||
|
that the condition was set based upon. For instance, if .metadata.generation
|
||||||
|
is currently 12, but the .status.conditions[x].observedGeneration
|
||||||
|
is 9, the condition is out of date with respect to the current
|
||||||
|
state of the instance.
|
||||||
|
format: int64
|
||||||
|
minimum: 0
|
||||||
|
type: integer
|
||||||
|
reason:
|
||||||
|
description: reason contains a programmatic identifier indicating
|
||||||
|
the reason for the condition's last transition. Producers
|
||||||
|
of specific condition types may define expected values and
|
||||||
|
meanings for this field, and whether the values are considered
|
||||||
|
a guaranteed API. The value should be a CamelCase string.
|
||||||
|
This field may not be empty.
|
||||||
|
maxLength: 1024
|
||||||
|
minLength: 1
|
||||||
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||||
|
type: string
|
||||||
|
status:
|
||||||
|
description: status of the condition, one of True, False, Unknown.
|
||||||
|
enum:
|
||||||
|
- "True"
|
||||||
|
- "False"
|
||||||
|
- Unknown
|
||||||
|
type: string
|
||||||
|
type:
|
||||||
|
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||||
|
--- Many .condition.type values are consistent across resources
|
||||||
|
like Available, but because arbitrary conditions can be useful
|
||||||
|
(see .node.status.conditions), the ability to deconflict is
|
||||||
|
important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||||
|
maxLength: 316
|
||||||
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- lastTransitionTime
|
||||||
|
- message
|
||||||
|
- reason
|
||||||
|
- status
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
projectId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- projectId
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
347
ops/chart/crds/zitadelcluster-crd.yaml
Normal file
347
ops/chart/crds/zitadelcluster-crd.yaml
Normal file
@@ -0,0 +1,347 @@
|
|||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
controller-gen.kubebuilder.io/version: v0.11.1
|
||||||
|
creationTimestamp: null
|
||||||
|
name: zitadelclusters.zitadel.topmanage.com
|
||||||
|
spec:
|
||||||
|
group: zitadel.topmanage.com
|
||||||
|
names:
|
||||||
|
kind: ZitadelCluster
|
||||||
|
listKind: ZitadelClusterList
|
||||||
|
plural: zitadelclusters
|
||||||
|
singular: zitadelcluster
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: ZitadelCluster is the Schema for the zitadelclusters API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: ZitadelClusterSpec defines the desired state of ZitadelCluster
|
||||||
|
properties:
|
||||||
|
crdbClusterRef:
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead of
|
||||||
|
an entire object, this string should contain a valid JSON/Go
|
||||||
|
field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container within
|
||||||
|
a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that triggered
|
||||||
|
the event) or if no container name is specified "spec.containers[2]"
|
||||||
|
(container with index 2 in this pod). This syntax is chosen
|
||||||
|
only to have some well-defined way of referencing a part of
|
||||||
|
an object. TODO: this design is not final and this field is
|
||||||
|
subject to change in the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
domainSettings:
|
||||||
|
properties:
|
||||||
|
smtpSenderAddressMatchesInstanceDomain:
|
||||||
|
default: true
|
||||||
|
type: boolean
|
||||||
|
userLoginMustBeDomain:
|
||||||
|
default: true
|
||||||
|
type: boolean
|
||||||
|
validateOrgDomains:
|
||||||
|
default: true
|
||||||
|
type: boolean
|
||||||
|
required:
|
||||||
|
- smtpSenderAddressMatchesInstanceDomain
|
||||||
|
- userLoginMustBeDomain
|
||||||
|
- validateOrgDomains
|
||||||
|
type: object
|
||||||
|
externalPort:
|
||||||
|
default: 443
|
||||||
|
format: int64
|
||||||
|
type: integer
|
||||||
|
externalSecure:
|
||||||
|
default: true
|
||||||
|
type: boolean
|
||||||
|
firstOrgName:
|
||||||
|
default: DEFAULT
|
||||||
|
description: 'INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
|
||||||
|
Important: Run "make" to regenerate code after modifying this file'
|
||||||
|
type: string
|
||||||
|
host:
|
||||||
|
type: string
|
||||||
|
image:
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
type: string
|
||||||
|
tag:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
- tag
|
||||||
|
type: object
|
||||||
|
podAnnotations:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: PodAnnotations to add to the Pods metadata.
|
||||||
|
type: object
|
||||||
|
purpose:
|
||||||
|
enum:
|
||||||
|
- demo
|
||||||
|
- trial
|
||||||
|
- staging
|
||||||
|
- productive
|
||||||
|
- testing
|
||||||
|
type: string
|
||||||
|
replicas:
|
||||||
|
default: 3
|
||||||
|
format: int32
|
||||||
|
type: integer
|
||||||
|
resources:
|
||||||
|
description: ResourceRequirements describes the compute resource requirements.
|
||||||
|
properties:
|
||||||
|
claims:
|
||||||
|
description: "Claims lists the names of resources, defined in
|
||||||
|
spec.resourceClaims, that are used by this container. \n This
|
||||||
|
is an alpha field and requires enabling the DynamicResourceAllocation
|
||||||
|
feature gate. \n This field is immutable. It can only be set
|
||||||
|
for containers."
|
||||||
|
items:
|
||||||
|
description: ResourceClaim references one entry in PodSpec.ResourceClaims.
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
description: Name must match the name of one entry in pod.spec.resourceClaims
|
||||||
|
of the Pod where this field is used. It makes that resource
|
||||||
|
available inside a container.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
x-kubernetes-list-map-keys:
|
||||||
|
- name
|
||||||
|
x-kubernetes-list-type: map
|
||||||
|
limits:
|
||||||
|
additionalProperties:
|
||||||
|
anyOf:
|
||||||
|
- type: integer
|
||||||
|
- type: string
|
||||||
|
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||||
|
x-kubernetes-int-or-string: true
|
||||||
|
description: 'Limits describes the maximum amount of compute resources
|
||||||
|
allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
|
||||||
|
type: object
|
||||||
|
requests:
|
||||||
|
additionalProperties:
|
||||||
|
anyOf:
|
||||||
|
- type: integer
|
||||||
|
- type: string
|
||||||
|
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||||
|
x-kubernetes-int-or-string: true
|
||||||
|
description: 'Requests describes the minimum amount of compute
|
||||||
|
resources required. If Requests is omitted for a container,
|
||||||
|
it defaults to Limits if that is explicitly specified, otherwise
|
||||||
|
to an implementation-defined value. Requests cannot exceed Limits.
|
||||||
|
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
rootTLSSecret:
|
||||||
|
description: SecretReference represents a Secret Reference. It has
|
||||||
|
enough information to retrieve secret in any namespace
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
description: name is unique within a namespace to reference a
|
||||||
|
secret resource.
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: namespace defines the space within which the secret
|
||||||
|
name must be unique.
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
serviceAnnotations:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: ServiceAnnotations to add to the service metadata.
|
||||||
|
type: object
|
||||||
|
smtpConfig:
|
||||||
|
properties:
|
||||||
|
host:
|
||||||
|
type: string
|
||||||
|
password:
|
||||||
|
properties:
|
||||||
|
secretRef:
|
||||||
|
description: SecretKeySelector selects a key of a Secret.
|
||||||
|
properties:
|
||||||
|
key:
|
||||||
|
description: The key of the secret to select from. Must
|
||||||
|
be a valid secret key.
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||||
|
TODO: Add other useful fields. apiVersion, kind, uid?'
|
||||||
|
type: string
|
||||||
|
optional:
|
||||||
|
description: Specify whether the Secret or its key must
|
||||||
|
be defined
|
||||||
|
type: boolean
|
||||||
|
required:
|
||||||
|
- key
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
required:
|
||||||
|
- secretRef
|
||||||
|
type: object
|
||||||
|
replyToAddress:
|
||||||
|
type: string
|
||||||
|
senderAddress:
|
||||||
|
type: string
|
||||||
|
senderName:
|
||||||
|
type: string
|
||||||
|
tls:
|
||||||
|
default: true
|
||||||
|
type: boolean
|
||||||
|
user:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- host
|
||||||
|
- senderAddress
|
||||||
|
- senderName
|
||||||
|
- tls
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- crdbClusterRef
|
||||||
|
- domainSettings
|
||||||
|
- externalPort
|
||||||
|
- externalSecure
|
||||||
|
- firstOrgName
|
||||||
|
- host
|
||||||
|
- image
|
||||||
|
- purpose
|
||||||
|
- resources
|
||||||
|
- rootTLSSecret
|
||||||
|
- smtpConfig
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: ZitadelClusterStatus defines the observed state of ZitadelCluster
|
||||||
|
properties:
|
||||||
|
conditions:
|
||||||
|
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
|
||||||
|
of cluster Important: Run "make" to regenerate code after modifying
|
||||||
|
this file'
|
||||||
|
items:
|
||||||
|
description: "Condition contains details for one aspect of the current
|
||||||
|
state of this API Resource. --- This struct is intended for direct
|
||||||
|
use as an array at the field path .status.conditions. For example,
|
||||||
|
\n type FooStatus struct{ // Represents the observations of a
|
||||||
|
foo's current state. // Known .status.conditions.type are: \"Available\",
|
||||||
|
\"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
|
||||||
|
// +listType=map // +listMapKey=type Conditions []metav1.Condition
|
||||||
|
`json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
|
||||||
|
protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
|
||||||
|
properties:
|
||||||
|
lastTransitionTime:
|
||||||
|
description: lastTransitionTime is the last time the condition
|
||||||
|
transitioned from one status to another. This should be when
|
||||||
|
the underlying condition changed. If that is not known, then
|
||||||
|
using the time when the API field changed is acceptable.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: message is a human readable message indicating
|
||||||
|
details about the transition. This may be an empty string.
|
||||||
|
maxLength: 32768
|
||||||
|
type: string
|
||||||
|
observedGeneration:
|
||||||
|
description: observedGeneration represents the .metadata.generation
|
||||||
|
that the condition was set based upon. For instance, if .metadata.generation
|
||||||
|
is currently 12, but the .status.conditions[x].observedGeneration
|
||||||
|
is 9, the condition is out of date with respect to the current
|
||||||
|
state of the instance.
|
||||||
|
format: int64
|
||||||
|
minimum: 0
|
||||||
|
type: integer
|
||||||
|
reason:
|
||||||
|
description: reason contains a programmatic identifier indicating
|
||||||
|
the reason for the condition's last transition. Producers
|
||||||
|
of specific condition types may define expected values and
|
||||||
|
meanings for this field, and whether the values are considered
|
||||||
|
a guaranteed API. The value should be a CamelCase string.
|
||||||
|
This field may not be empty.
|
||||||
|
maxLength: 1024
|
||||||
|
minLength: 1
|
||||||
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||||
|
type: string
|
||||||
|
status:
|
||||||
|
description: status of the condition, one of True, False, Unknown.
|
||||||
|
enum:
|
||||||
|
- "True"
|
||||||
|
- "False"
|
||||||
|
- Unknown
|
||||||
|
type: string
|
||||||
|
type:
|
||||||
|
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||||
|
--- Many .condition.type values are consistent across resources
|
||||||
|
like Available, but because arbitrary conditions can be useful
|
||||||
|
(see .node.status.conditions), the ability to deconflict is
|
||||||
|
important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||||
|
maxLength: 316
|
||||||
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- lastTransitionTime
|
||||||
|
- message
|
||||||
|
- reason
|
||||||
|
- status
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
defaultInstanceId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
replicas:
|
||||||
|
default: 3
|
||||||
|
format: int32
|
||||||
|
type: integer
|
||||||
|
smtpProviderId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- defaultInstanceId
|
||||||
|
- smtpProviderId
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
62
ops/chart/templates/_helpers.tpl
Normal file
62
ops/chart/templates/_helpers.tpl
Normal file
@@ -0,0 +1,62 @@
|
|||||||
|
{{/*
|
||||||
|
Expand the name of the chart.
|
||||||
|
*/}}
|
||||||
|
{{- define "zitadel-k8s-operator.name" -}}
|
||||||
|
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a default fully qualified app name.
|
||||||
|
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||||
|
If release name contains chart name it will be used as a full name.
|
||||||
|
*/}}
|
||||||
|
{{- define "zitadel-k8s-operator.fullname" -}}
|
||||||
|
{{- if .Values.fullnameOverride }}
|
||||||
|
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||||
|
{{- if contains $name .Release.Name }}
|
||||||
|
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create chart name and version as used by the chart label.
|
||||||
|
*/}}
|
||||||
|
{{- define "zitadel-k8s-operator.chart" -}}
|
||||||
|
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Common labels
|
||||||
|
*/}}
|
||||||
|
{{- define "zitadel-k8s-operator.labels" -}}
|
||||||
|
helm.sh/chart: {{ include "zitadel-k8s-operator.chart" . }}
|
||||||
|
{{ include "zitadel-k8s-operator.selectorLabels" . }}
|
||||||
|
{{- if .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||||
|
{{- end }}
|
||||||
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Selector labels
|
||||||
|
*/}}
|
||||||
|
{{- define "zitadel-k8s-operator.selectorLabels" -}}
|
||||||
|
app.kubernetes.io/name: {{ include "zitadel-k8s-operator.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create the name of the service account to use
|
||||||
|
*/}}
|
||||||
|
{{- define "zitadel-k8s-operator.serviceAccountName" -}}
|
||||||
|
{{- if .Values.serviceAccount.create }}
|
||||||
|
{{- default (include "zitadel-k8s-operator.fullname" .) .Values.serviceAccount.name }}
|
||||||
|
{{- else }}
|
||||||
|
{{- default "default" .Values.serviceAccount.name }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
85
ops/chart/templates/deployment.yaml
Normal file
85
ops/chart/templates/deployment.yaml
Normal file
@@ -0,0 +1,85 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: {{ include "zitadel-k8s-operator.fullname" . }}-controller-manager
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: manager
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
control-plane: controller-manager
|
||||||
|
{{- include "zitadel-k8s-operator.labels" . | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
replicas: {{ .Values.controllerManager.replicas }}
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
control-plane: controller-manager
|
||||||
|
{{- include "zitadel-k8s-operator.selectorLabels" . | nindent 6 }}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
control-plane: controller-manager
|
||||||
|
{{- include "zitadel-k8s-operator.selectorLabels" . | nindent 8 }}
|
||||||
|
annotations:
|
||||||
|
kubectl.kubernetes.io/default-container: manager
|
||||||
|
spec:
|
||||||
|
affinity:
|
||||||
|
nodeAffinity:
|
||||||
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
nodeSelectorTerms:
|
||||||
|
- matchExpressions:
|
||||||
|
- key: kubernetes.io/arch
|
||||||
|
operator: In
|
||||||
|
values:
|
||||||
|
- amd64
|
||||||
|
- arm64
|
||||||
|
- ppc64le
|
||||||
|
- s390x
|
||||||
|
- key: kubernetes.io/os
|
||||||
|
operator: In
|
||||||
|
values:
|
||||||
|
- linux
|
||||||
|
containers:
|
||||||
|
- args: {{- toYaml .Values.controllerManager.kubeRbacProxy.args | nindent 8 }}
|
||||||
|
env:
|
||||||
|
- name: KUBERNETES_CLUSTER_DOMAIN
|
||||||
|
value: {{ quote .Values.kubernetesClusterDomain }}
|
||||||
|
image: {{ .Values.controllerManager.kubeRbacProxy.image.repository }}:{{ .Values.controllerManager.kubeRbacProxy.image.tag
|
||||||
|
| default .Chart.AppVersion }}
|
||||||
|
name: kube-rbac-proxy
|
||||||
|
ports:
|
||||||
|
- containerPort: 8443
|
||||||
|
name: https
|
||||||
|
protocol: TCP
|
||||||
|
resources: {{- toYaml .Values.controllerManager.kubeRbacProxy.resources | nindent
|
||||||
|
10 }}
|
||||||
|
securityContext: {{- toYaml .Values.controllerManager.kubeRbacProxy.containerSecurityContext
|
||||||
|
| nindent 10 }}
|
||||||
|
- args: {{- toYaml .Values.controllerManager.manager.args | nindent 8 }}
|
||||||
|
command:
|
||||||
|
- /manager
|
||||||
|
env:
|
||||||
|
- name: KUBERNETES_CLUSTER_DOMAIN
|
||||||
|
value: {{ quote .Values.kubernetesClusterDomain }}
|
||||||
|
image: {{ .Values.controllerManager.manager.image.repository }}:{{ .Values.controllerManager.manager.image.tag
|
||||||
|
| default .Chart.AppVersion }}
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /healthz
|
||||||
|
port: 8081
|
||||||
|
initialDelaySeconds: 15
|
||||||
|
periodSeconds: 20
|
||||||
|
name: manager
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /readyz
|
||||||
|
port: 8081
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 10
|
||||||
|
resources: {{- toYaml .Values.controllerManager.manager.resources | nindent 10
|
||||||
|
}}
|
||||||
|
securityContext: {{- toYaml .Values.controllerManager.manager.containerSecurityContext
|
||||||
|
| nindent 10 }}
|
||||||
|
securityContext:
|
||||||
|
runAsNonRoot: true
|
||||||
|
serviceAccountName: {{ include "zitadel-k8s-operator.fullname" . }}-controller-manager
|
||||||
|
terminationGracePeriodSeconds: 10
|
||||||
59
ops/chart/templates/leader-election-rbac.yaml
Normal file
59
ops/chart/templates/leader-election-rbac.yaml
Normal file
@@ -0,0 +1,59 @@
|
|||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: {{ include "zitadel-k8s-operator.fullname" . }}-leader-election-role
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
{{- include "zitadel-k8s-operator.labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- create
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- delete
|
||||||
|
- apiGroups:
|
||||||
|
- coordination.k8s.io
|
||||||
|
resources:
|
||||||
|
- leases
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- create
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- delete
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- patch
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ include "zitadel-k8s-operator.fullname" . }}-leader-election-rolebinding
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
{{- include "zitadel-k8s-operator.labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: '{{ include "zitadel-k8s-operator.fullname" . }}-leader-election-role'
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: '{{ include "zitadel-k8s-operator.fullname" . }}-controller-manager'
|
||||||
|
namespace: '{{ .Release.Namespace }}'
|
||||||
346
ops/chart/templates/manager-rbac.yaml
Normal file
346
ops/chart/templates/manager-rbac.yaml
Normal file
@@ -0,0 +1,346 @@
|
|||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ include "zitadel-k8s-operator.fullname" . }}-manager-role
|
||||||
|
labels:
|
||||||
|
{{- include "zitadel-k8s-operator.labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- endpoints
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- endpoints/restricted
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- pods
|
||||||
|
verbs:
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- serviceaccounts
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- services
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- apps
|
||||||
|
resources:
|
||||||
|
- deployments
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- batch
|
||||||
|
resources:
|
||||||
|
- jobs
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- certificates.k8s.io
|
||||||
|
resources:
|
||||||
|
- certificatesigningrequests
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- certificates.k8s.io
|
||||||
|
resources:
|
||||||
|
- certificatesigningrequests/approval
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- certificates.k8s.io
|
||||||
|
resources:
|
||||||
|
- certificatesigningrequests/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- crdb.cockroachlabs.com
|
||||||
|
resources:
|
||||||
|
- crdbclusters
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- crdb.cockroachlabs.com
|
||||||
|
resources:
|
||||||
|
- crdbclusters/finalizers
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- crdb.cockroachlabs.com
|
||||||
|
resources:
|
||||||
|
- crdbclusters/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- policy
|
||||||
|
resources:
|
||||||
|
- poddisruptionbudgets
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- rbac.authorization.k8s.io
|
||||||
|
resources:
|
||||||
|
- clusterrolebindings
|
||||||
|
- rolebindings
|
||||||
|
- roles
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- apiapps
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- apiapps/finalizers
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- apiapps/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- machineusers
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- machineusers/finalizers
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- machineusers/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- oidcapps
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- oidcapps/finalizers
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- oidcapps/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- organizations
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- organizations/finalizers
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- organizations/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- projects
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- projects/finalizers
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- projects/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- zitadelclusters
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- zitadelclusters/finalizers
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- zitadelclusters/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ include "zitadel-k8s-operator.fullname" . }}-manager-rolebinding
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
{{- include "zitadel-k8s-operator.labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: '{{ include "zitadel-k8s-operator.fullname" . }}-manager-role'
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: '{{ include "zitadel-k8s-operator.fullname" . }}-controller-manager'
|
||||||
|
namespace: '{{ .Release.Namespace }}'
|
||||||
14
ops/chart/templates/metrics-reader-rbac.yaml
Normal file
14
ops/chart/templates/metrics-reader-rbac.yaml
Normal file
@@ -0,0 +1,14 @@
|
|||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ include "zitadel-k8s-operator.fullname" . }}-metrics-reader
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: kube-rbac-proxy
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
{{- include "zitadel-k8s-operator.labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- nonResourceURLs:
|
||||||
|
- /metrics
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
17
ops/chart/templates/metrics-service.yaml
Normal file
17
ops/chart/templates/metrics-service.yaml
Normal file
@@ -0,0 +1,17 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ include "zitadel-k8s-operator.fullname" . }}-controller-manager-metrics-service
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: kube-rbac-proxy
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
control-plane: controller-manager
|
||||||
|
{{- include "zitadel-k8s-operator.labels" . | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
type: {{ .Values.metricsService.type }}
|
||||||
|
selector:
|
||||||
|
control-plane: controller-manager
|
||||||
|
{{- include "zitadel-k8s-operator.selectorLabels" . | nindent 4 }}
|
||||||
|
ports:
|
||||||
|
{{- .Values.metricsService.ports | toYaml | nindent 2 }}
|
||||||
40
ops/chart/templates/proxy-rbac.yaml
Normal file
40
ops/chart/templates/proxy-rbac.yaml
Normal file
@@ -0,0 +1,40 @@
|
|||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ include "zitadel-k8s-operator.fullname" . }}-proxy-role
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: kube-rbac-proxy
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
{{- include "zitadel-k8s-operator.labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- authentication.k8s.io
|
||||||
|
resources:
|
||||||
|
- tokenreviews
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- apiGroups:
|
||||||
|
- authorization.k8s.io
|
||||||
|
resources:
|
||||||
|
- subjectaccessreviews
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ include "zitadel-k8s-operator.fullname" . }}-proxy-rolebinding
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: kube-rbac-proxy
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
{{- include "zitadel-k8s-operator.labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: '{{ include "zitadel-k8s-operator.fullname" . }}-proxy-role'
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: '{{ include "zitadel-k8s-operator.fullname" . }}-controller-manager'
|
||||||
|
namespace: '{{ .Release.Namespace }}'
|
||||||
11
ops/chart/templates/serviceaccount.yaml
Normal file
11
ops/chart/templates/serviceaccount.yaml
Normal file
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: {{ include "zitadel-k8s-operator.fullname" . }}-controller-manager
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
{{- include "zitadel-k8s-operator.labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml .Values.controllerManager.serviceAccount.annotations | nindent 4 }}
|
||||||
53
ops/chart/values.yaml
Normal file
53
ops/chart/values.yaml
Normal file
@@ -0,0 +1,53 @@
|
|||||||
|
controllerManager:
|
||||||
|
kubeRbacProxy:
|
||||||
|
args:
|
||||||
|
- --secure-listen-address=0.0.0.0:8443
|
||||||
|
- --upstream=http://127.0.0.1:8080/
|
||||||
|
- --logtostderr=true
|
||||||
|
- --v=0
|
||||||
|
containerSecurityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
image:
|
||||||
|
repository: gcr.io/kubebuilder/kube-rbac-proxy
|
||||||
|
tag: v0.13.1
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 128Mi
|
||||||
|
requests:
|
||||||
|
cpu: 5m
|
||||||
|
memory: 64Mi
|
||||||
|
manager:
|
||||||
|
args:
|
||||||
|
- --health-probe-bind-address=:8081
|
||||||
|
- --metrics-bind-address=127.0.0.1:8080
|
||||||
|
- --leader-elect
|
||||||
|
containerSecurityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
image:
|
||||||
|
repository: controller
|
||||||
|
tag: latest
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 128Mi
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 64Mi
|
||||||
|
replicas: 1
|
||||||
|
serviceAccount:
|
||||||
|
annotations: {}
|
||||||
|
kubernetesClusterDomain: cluster.local
|
||||||
|
metricsService:
|
||||||
|
ports:
|
||||||
|
- name: https
|
||||||
|
port: 8443
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: https
|
||||||
|
type: ClusterIP
|
||||||
4
src/.dockerignore
Normal file
4
src/.dockerignore
Normal file
@@ -0,0 +1,4 @@
|
|||||||
|
# More info: https://docs.docker.com/engine/reference/builder/#dockerignore-file
|
||||||
|
# Ignore build and test binaries.
|
||||||
|
bin/
|
||||||
|
testbin/
|
||||||
26
src/.gitignore
vendored
Normal file
26
src/.gitignore
vendored
Normal file
@@ -0,0 +1,26 @@
|
|||||||
|
|
||||||
|
# Binaries for programs and plugins
|
||||||
|
*.exe
|
||||||
|
*.exe~
|
||||||
|
*.dll
|
||||||
|
*.so
|
||||||
|
*.dylib
|
||||||
|
bin
|
||||||
|
testbin/*
|
||||||
|
Dockerfile.cross
|
||||||
|
|
||||||
|
# Test binary, build with `go test -c`
|
||||||
|
*.test
|
||||||
|
|
||||||
|
# Output of the go coverage tool, specifically when used with LiteIDE
|
||||||
|
*.out
|
||||||
|
|
||||||
|
# Kubernetes Generated files - skip generated files, except for vendored files
|
||||||
|
|
||||||
|
!vendor/**/zz_generated.*
|
||||||
|
|
||||||
|
# editor and IDE paraphernalia
|
||||||
|
.idea
|
||||||
|
*.swp
|
||||||
|
*.swo
|
||||||
|
*~
|
||||||
33
src/Dockerfile
Normal file
33
src/Dockerfile
Normal file
@@ -0,0 +1,33 @@
|
|||||||
|
# Build the manager binary
|
||||||
|
FROM golang:1.19 as builder
|
||||||
|
ARG TARGETOS
|
||||||
|
ARG TARGETARCH
|
||||||
|
|
||||||
|
WORKDIR /workspace
|
||||||
|
# Copy the Go Modules manifests
|
||||||
|
COPY go.mod go.mod
|
||||||
|
COPY go.sum go.sum
|
||||||
|
# cache deps before building and copying source so that we don't need to re-download as much
|
||||||
|
# and so that source changes don't invalidate our downloaded layer
|
||||||
|
RUN go mod download
|
||||||
|
|
||||||
|
# Copy the go source
|
||||||
|
COPY cmd/main.go cmd/main.go
|
||||||
|
COPY api/ api/
|
||||||
|
COPY internal/controller/ internal/controller/
|
||||||
|
|
||||||
|
# Build
|
||||||
|
# the GOARCH has not a default value to allow the binary be built according to the host where the command
|
||||||
|
# was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO
|
||||||
|
# the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
|
||||||
|
# by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
|
||||||
|
RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager cmd/main.go
|
||||||
|
|
||||||
|
# Use distroless as minimal base image to package the manager binary
|
||||||
|
# Refer to https://github.com/GoogleContainerTools/distroless for more details
|
||||||
|
FROM gcr.io/distroless/static:nonroot
|
||||||
|
WORKDIR /
|
||||||
|
COPY --from=builder /workspace/manager .
|
||||||
|
USER 65532:65532
|
||||||
|
|
||||||
|
ENTRYPOINT ["/manager"]
|
||||||
291
src/Makefile
Normal file
291
src/Makefile
Normal file
@@ -0,0 +1,291 @@
|
|||||||
|
# VERSION defines the project version for the bundle.
|
||||||
|
# Update this value when you upgrade the version of your project.
|
||||||
|
# To re-generate a bundle for another specific version without changing the standard setup, you can:
|
||||||
|
# - use the VERSION as arg of the bundle target (e.g make bundle VERSION=0.0.2)
|
||||||
|
# - use environment variables to overwrite this value (e.g export VERSION=0.0.2)
|
||||||
|
VERSION ?= 0.0.1
|
||||||
|
|
||||||
|
# CHANNELS define the bundle channels used in the bundle.
|
||||||
|
# Add a new line here if you would like to change its default config. (E.g CHANNELS = "candidate,fast,stable")
|
||||||
|
# To re-generate a bundle for other specific channels without changing the standard setup, you can:
|
||||||
|
# - use the CHANNELS as arg of the bundle target (e.g make bundle CHANNELS=candidate,fast,stable)
|
||||||
|
# - use environment variables to overwrite this value (e.g export CHANNELS="candidate,fast,stable")
|
||||||
|
ifneq ($(origin CHANNELS), undefined)
|
||||||
|
BUNDLE_CHANNELS := --channels=$(CHANNELS)
|
||||||
|
endif
|
||||||
|
|
||||||
|
# DEFAULT_CHANNEL defines the default channel used in the bundle.
|
||||||
|
# Add a new line here if you would like to change its default config. (E.g DEFAULT_CHANNEL = "stable")
|
||||||
|
# To re-generate a bundle for any other default channel without changing the default setup, you can:
|
||||||
|
# - use the DEFAULT_CHANNEL as arg of the bundle target (e.g make bundle DEFAULT_CHANNEL=stable)
|
||||||
|
# - use environment variables to overwrite this value (e.g export DEFAULT_CHANNEL="stable")
|
||||||
|
ifneq ($(origin DEFAULT_CHANNEL), undefined)
|
||||||
|
BUNDLE_DEFAULT_CHANNEL := --default-channel=$(DEFAULT_CHANNEL)
|
||||||
|
endif
|
||||||
|
BUNDLE_METADATA_OPTS ?= $(BUNDLE_CHANNELS) $(BUNDLE_DEFAULT_CHANNEL)
|
||||||
|
|
||||||
|
# IMAGE_TAG_BASE defines the docker.io namespace and part of the image name for remote images.
|
||||||
|
# This variable is used to construct full image tags for bundle and catalog images.
|
||||||
|
#
|
||||||
|
# For example, running 'make bundle-build bundle-push catalog-build catalog-push' will build and push both
|
||||||
|
# topmanage.com/src-bundle:$VERSION and topmanage.com/src-catalog:$VERSION.
|
||||||
|
IMAGE_TAG_BASE ?= topmanage.com/src
|
||||||
|
|
||||||
|
# BUNDLE_IMG defines the image:tag used for the bundle.
|
||||||
|
# You can use it as an arg. (E.g make bundle-build BUNDLE_IMG=<some-registry>/<project-name-bundle>:<tag>)
|
||||||
|
BUNDLE_IMG ?= $(IMAGE_TAG_BASE)-bundle:v$(VERSION)
|
||||||
|
|
||||||
|
# BUNDLE_GEN_FLAGS are the flags passed to the operator-sdk generate bundle command
|
||||||
|
BUNDLE_GEN_FLAGS ?= -q --overwrite --version $(VERSION) $(BUNDLE_METADATA_OPTS)
|
||||||
|
|
||||||
|
# USE_IMAGE_DIGESTS defines if images are resolved via tags or digests
|
||||||
|
# You can enable this value if you would like to use SHA Based Digests
|
||||||
|
# To enable set flag to true
|
||||||
|
USE_IMAGE_DIGESTS ?= false
|
||||||
|
ifeq ($(USE_IMAGE_DIGESTS), true)
|
||||||
|
BUNDLE_GEN_FLAGS += --use-image-digests
|
||||||
|
endif
|
||||||
|
|
||||||
|
# Set the Operator SDK version to use. By default, what is installed on the system is used.
|
||||||
|
# This is useful for CI or a project to utilize a specific version of the operator-sdk toolkit.
|
||||||
|
OPERATOR_SDK_VERSION ?= unknown
|
||||||
|
|
||||||
|
# Image URL to use all building/pushing image targets
|
||||||
|
IMG ?= controller:latest
|
||||||
|
# ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
|
||||||
|
ENVTEST_K8S_VERSION = 1.26.0
|
||||||
|
|
||||||
|
# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
|
||||||
|
ifeq (,$(shell go env GOBIN))
|
||||||
|
GOBIN=$(shell go env GOPATH)/bin
|
||||||
|
else
|
||||||
|
GOBIN=$(shell go env GOBIN)
|
||||||
|
endif
|
||||||
|
|
||||||
|
# Setting SHELL to bash allows bash commands to be executed by recipes.
|
||||||
|
# Options are set to exit when a recipe line exits non-zero or a piped command fails.
|
||||||
|
SHELL = /usr/bin/env bash -o pipefail
|
||||||
|
.SHELLFLAGS = -ec
|
||||||
|
|
||||||
|
.PHONY: all
|
||||||
|
all: build
|
||||||
|
|
||||||
|
##@ General
|
||||||
|
|
||||||
|
# The help target prints out all targets with their descriptions organized
|
||||||
|
# beneath their categories. The categories are represented by '##@' and the
|
||||||
|
# target descriptions by '##'. The awk commands is responsible for reading the
|
||||||
|
# entire set of makefiles included in this invocation, looking for lines of the
|
||||||
|
# file as xyz: ## something, and then pretty-format the target and help. Then,
|
||||||
|
# if there's a line with ##@ something, that gets pretty-printed as a category.
|
||||||
|
# More info on the usage of ANSI control characters for terminal formatting:
|
||||||
|
# https://en.wikipedia.org/wiki/ANSI_escape_code#SGR_parameters
|
||||||
|
# More info on the awk command:
|
||||||
|
# http://linuxcommand.org/lc3_adv_awk.php
|
||||||
|
|
||||||
|
.PHONY: help
|
||||||
|
help: ## Display this help.
|
||||||
|
@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf " \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
|
||||||
|
|
||||||
|
##@ Development
|
||||||
|
|
||||||
|
.PHONY: manifests
|
||||||
|
manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
|
||||||
|
$(CONTROLLER_GEN) rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases
|
||||||
|
|
||||||
|
.PHONY: generate
|
||||||
|
generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
|
||||||
|
$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..."
|
||||||
|
|
||||||
|
.PHONY: fmt
|
||||||
|
fmt: ## Run go fmt against code.
|
||||||
|
go fmt ./...
|
||||||
|
|
||||||
|
.PHONY: vet
|
||||||
|
vet: ## Run go vet against code.
|
||||||
|
go vet ./...
|
||||||
|
|
||||||
|
.PHONY: test
|
||||||
|
test: manifests generate fmt vet envtest ## Run tests.
|
||||||
|
KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test ./... -coverprofile cover.out
|
||||||
|
|
||||||
|
##@ Build
|
||||||
|
|
||||||
|
.PHONY: build
|
||||||
|
build: manifests generate fmt vet ## Build manager binary.
|
||||||
|
go build -o bin/manager cmd/main.go
|
||||||
|
|
||||||
|
.PHONY: run
|
||||||
|
run: manifests generate fmt vet ## Run a controller from your host.
|
||||||
|
go run ./cmd/main.go
|
||||||
|
|
||||||
|
# If you wish built the manager image targeting other platforms you can use the --platform flag.
|
||||||
|
# (i.e. docker build --platform linux/arm64 ). However, you must enable docker buildKit for it.
|
||||||
|
# More info: https://docs.docker.com/develop/develop-images/build_enhancements/
|
||||||
|
.PHONY: docker-build
|
||||||
|
docker-build: test ## Build docker image with the manager.
|
||||||
|
docker build -t ${IMG} .
|
||||||
|
|
||||||
|
.PHONY: docker-push
|
||||||
|
docker-push: ## Push docker image with the manager.
|
||||||
|
docker push ${IMG}
|
||||||
|
|
||||||
|
# PLATFORMS defines the target platforms for the manager image be build to provide support to multiple
|
||||||
|
# architectures. (i.e. make docker-buildx IMG=myregistry/mypoperator:0.0.1). To use this option you need to:
|
||||||
|
# - able to use docker buildx . More info: https://docs.docker.com/build/buildx/
|
||||||
|
# - have enable BuildKit, More info: https://docs.docker.com/develop/develop-images/build_enhancements/
|
||||||
|
# - be able to push the image for your registry (i.e. if you do not inform a valid value via IMG=<myregistry/image:<tag>> then the export will fail)
|
||||||
|
# To properly provided solutions that supports more than one platform you should use this option.
|
||||||
|
PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
|
||||||
|
.PHONY: docker-buildx
|
||||||
|
docker-buildx: test ## Build and push docker image for the manager for cross-platform support
|
||||||
|
# copy existing Dockerfile and insert --platform=${BUILDPLATFORM} into Dockerfile.cross, and preserve the original Dockerfile
|
||||||
|
sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Dockerfile > Dockerfile.cross
|
||||||
|
- docker buildx create --name project-v3-builder
|
||||||
|
docker buildx use project-v3-builder
|
||||||
|
- docker buildx build --push --platform=$(PLATFORMS) --tag ${IMG} -f Dockerfile.cross .
|
||||||
|
- docker buildx rm project-v3-builder
|
||||||
|
rm Dockerfile.cross
|
||||||
|
|
||||||
|
##@ Deployment
|
||||||
|
|
||||||
|
ifndef ignore-not-found
|
||||||
|
ignore-not-found = false
|
||||||
|
endif
|
||||||
|
|
||||||
|
.PHONY: install
|
||||||
|
install: manifests kustomize ## Install CRDs into the K8s cluster specified in ~/.kube/config.
|
||||||
|
$(KUSTOMIZE) build config/crd | kubectl apply -f -
|
||||||
|
|
||||||
|
.PHONY: uninstall
|
||||||
|
uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
|
||||||
|
$(KUSTOMIZE) build config/crd | kubectl delete --ignore-not-found=$(ignore-not-found) -f -
|
||||||
|
|
||||||
|
.PHONY: deploy
|
||||||
|
deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
|
||||||
|
cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
|
||||||
|
$(KUSTOMIZE) build config/default | kubectl apply -f -
|
||||||
|
|
||||||
|
.PHONY: undeploy
|
||||||
|
undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
|
||||||
|
$(KUSTOMIZE) build config/default | kubectl delete --ignore-not-found=$(ignore-not-found) -f -
|
||||||
|
|
||||||
|
##@ Build Dependencies
|
||||||
|
|
||||||
|
## Location to install dependencies to
|
||||||
|
LOCALBIN ?= $(shell pwd)/bin
|
||||||
|
$(LOCALBIN):
|
||||||
|
mkdir -p $(LOCALBIN)
|
||||||
|
|
||||||
|
## Tool Binaries
|
||||||
|
KUSTOMIZE ?= $(LOCALBIN)/kustomize
|
||||||
|
CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
|
||||||
|
ENVTEST ?= $(LOCALBIN)/setup-envtest
|
||||||
|
|
||||||
|
## Tool Versions
|
||||||
|
KUSTOMIZE_VERSION ?= v4.5.7
|
||||||
|
CONTROLLER_TOOLS_VERSION ?= v0.11.1
|
||||||
|
|
||||||
|
KUSTOMIZE_INSTALL_SCRIPT ?= "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"
|
||||||
|
.PHONY: kustomize
|
||||||
|
kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary. If wrong version is installed, it will be removed before downloading.
|
||||||
|
$(KUSTOMIZE): $(LOCALBIN)
|
||||||
|
@if test -x $(LOCALBIN)/kustomize && ! $(LOCALBIN)/kustomize version | grep -q $(KUSTOMIZE_VERSION); then \
|
||||||
|
echo "$(LOCALBIN)/kustomize version is not expected $(KUSTOMIZE_VERSION). Removing it before installing."; \
|
||||||
|
rm -rf $(LOCALBIN)/kustomize; \
|
||||||
|
fi
|
||||||
|
test -s $(LOCALBIN)/kustomize || { curl -Ss $(KUSTOMIZE_INSTALL_SCRIPT) | bash -s -- $(subst v,,$(KUSTOMIZE_VERSION)) $(LOCALBIN); }
|
||||||
|
|
||||||
|
.PHONY: controller-gen
|
||||||
|
controller-gen: $(CONTROLLER_GEN) ## Download controller-gen locally if necessary. If wrong version is installed, it will be overwritten.
|
||||||
|
$(CONTROLLER_GEN): $(LOCALBIN)
|
||||||
|
test -s $(LOCALBIN)/controller-gen && $(LOCALBIN)/controller-gen --version | grep -q $(CONTROLLER_TOOLS_VERSION) || \
|
||||||
|
GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-tools/cmd/controller-gen@$(CONTROLLER_TOOLS_VERSION)
|
||||||
|
|
||||||
|
.PHONY: envtest
|
||||||
|
envtest: $(ENVTEST) ## Download envtest-setup locally if necessary.
|
||||||
|
$(ENVTEST): $(LOCALBIN)
|
||||||
|
test -s $(LOCALBIN)/setup-envtest || GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
|
||||||
|
|
||||||
|
.PHONY: operator-sdk
|
||||||
|
OPERATOR_SDK ?= $(LOCALBIN)/operator-sdk
|
||||||
|
operator-sdk: ## Download operator-sdk locally if necessary.
|
||||||
|
ifeq (,$(wildcard $(OPERATOR_SDK)))
|
||||||
|
ifeq (, $(shell which operator-sdk 2>/dev/null))
|
||||||
|
@{ \
|
||||||
|
set -e ;\
|
||||||
|
mkdir -p $(dir $(OPERATOR_SDK)) ;\
|
||||||
|
OS=$(shell go env GOOS) && ARCH=$(shell go env GOARCH) && \
|
||||||
|
curl -sSLo $(OPERATOR_SDK) https://github.com/operator-framework/operator-sdk/releases/download/$(OPERATOR_SDK_VERSION)/operator-sdk_$${OS}_$${ARCH} ;\
|
||||||
|
chmod +x $(OPERATOR_SDK) ;\
|
||||||
|
}
|
||||||
|
else
|
||||||
|
OPERATOR_SDK = $(shell which operator-sdk)
|
||||||
|
endif
|
||||||
|
endif
|
||||||
|
|
||||||
|
.PHONY: bundle
|
||||||
|
bundle: manifests kustomize operator-sdk ## Generate bundle manifests and metadata, then validate generated files.
|
||||||
|
$(OPERATOR_SDK) generate kustomize manifests -q
|
||||||
|
cd config/manager && $(KUSTOMIZE) edit set image controller=$(IMG)
|
||||||
|
$(KUSTOMIZE) build config/manifests | $(OPERATOR_SDK) generate bundle $(BUNDLE_GEN_FLAGS)
|
||||||
|
$(OPERATOR_SDK) bundle validate ./bundle
|
||||||
|
|
||||||
|
.PHONY: bundle-build
|
||||||
|
bundle-build: ## Build the bundle image.
|
||||||
|
docker build -f bundle.Dockerfile -t $(BUNDLE_IMG) .
|
||||||
|
|
||||||
|
.PHONY: bundle-push
|
||||||
|
bundle-push: ## Push the bundle image.
|
||||||
|
$(MAKE) docker-push IMG=$(BUNDLE_IMG)
|
||||||
|
|
||||||
|
.PHONY: opm
|
||||||
|
OPM = ./bin/opm
|
||||||
|
opm: ## Download opm locally if necessary.
|
||||||
|
ifeq (,$(wildcard $(OPM)))
|
||||||
|
ifeq (,$(shell which opm 2>/dev/null))
|
||||||
|
@{ \
|
||||||
|
set -e ;\
|
||||||
|
mkdir -p $(dir $(OPM)) ;\
|
||||||
|
OS=$(shell go env GOOS) && ARCH=$(shell go env GOARCH) && \
|
||||||
|
curl -sSLo $(OPM) https://github.com/operator-framework/operator-registry/releases/download/v1.23.0/$${OS}-$${ARCH}-opm ;\
|
||||||
|
chmod +x $(OPM) ;\
|
||||||
|
}
|
||||||
|
else
|
||||||
|
OPM = $(shell which opm)
|
||||||
|
endif
|
||||||
|
endif
|
||||||
|
|
||||||
|
# A comma-separated list of bundle images (e.g. make catalog-build BUNDLE_IMGS=example.com/operator-bundle:v0.1.0,example.com/operator-bundle:v0.2.0).
|
||||||
|
# These images MUST exist in a registry and be pull-able.
|
||||||
|
BUNDLE_IMGS ?= $(BUNDLE_IMG)
|
||||||
|
|
||||||
|
# The image tag given to the resulting catalog image (e.g. make catalog-build CATALOG_IMG=example.com/operator-catalog:v0.2.0).
|
||||||
|
CATALOG_IMG ?= $(IMAGE_TAG_BASE)-catalog:v$(VERSION)
|
||||||
|
|
||||||
|
# Set CATALOG_BASE_IMG to an existing catalog image tag to add $BUNDLE_IMGS to that image.
|
||||||
|
ifneq ($(origin CATALOG_BASE_IMG), undefined)
|
||||||
|
FROM_INDEX_OPT := --from-index $(CATALOG_BASE_IMG)
|
||||||
|
endif
|
||||||
|
|
||||||
|
# Build a catalog image by adding bundle images to an empty catalog using the operator package manager tool, 'opm'.
|
||||||
|
# This recipe invokes 'opm' in 'semver' bundle add mode. For more information on add modes, see:
|
||||||
|
# https://github.com/operator-framework/community-operators/blob/7f1438c/docs/packaging-operator.md#updating-your-existing-operator
|
||||||
|
.PHONY: catalog-build
|
||||||
|
catalog-build: opm ## Build a catalog image.
|
||||||
|
$(OPM) index add --container-tool docker --mode semver --tag $(CATALOG_IMG) --bundles $(BUNDLE_IMGS) $(FROM_INDEX_OPT)
|
||||||
|
|
||||||
|
# Push the catalog image.
|
||||||
|
.PHONY: catalog-push
|
||||||
|
catalog-push: ## Push a catalog image.
|
||||||
|
$(MAKE) docker-push IMG=$(CATALOG_IMG)
|
||||||
|
|
||||||
|
HELMIFY ?= $(LOCALBIN)/helmify
|
||||||
|
|
||||||
|
.PHONY: helmify
|
||||||
|
helmify: $(HELMIFY) ## Download helmify locally if necessary.
|
||||||
|
$(HELMIFY): $(LOCALBIN)
|
||||||
|
test -s $(LOCALBIN)/helmify || GOBIN=$(LOCALBIN) go install github.com/arttor/helmify/cmd/helmify@latest
|
||||||
|
|
||||||
|
helm: manifests kustomize helmify
|
||||||
|
$(KUSTOMIZE) build config/default | $(HELMIFY) -crd-dir zitadel-k8s-operator
|
||||||
68
src/PROJECT
Normal file
68
src/PROJECT
Normal file
@@ -0,0 +1,68 @@
|
|||||||
|
# Code generated by tool. DO NOT EDIT.
|
||||||
|
# This file is used to track the info used to scaffold your project
|
||||||
|
# and allow the plugins properly work.
|
||||||
|
# More info: https://book.kubebuilder.io/reference/project-config.html
|
||||||
|
domain: topmanage.com
|
||||||
|
layout:
|
||||||
|
- go.kubebuilder.io/v4-alpha
|
||||||
|
plugins:
|
||||||
|
manifests.sdk.operatorframework.io/v2: {}
|
||||||
|
scorecard.sdk.operatorframework.io/v2: {}
|
||||||
|
projectName: src
|
||||||
|
repo: bitbucket.org/topmanage-software-engineering/zitadel-k8s-operator/src
|
||||||
|
resources:
|
||||||
|
- api:
|
||||||
|
crdVersion: v1
|
||||||
|
namespaced: true
|
||||||
|
controller: true
|
||||||
|
domain: topmanage.com
|
||||||
|
group: zitadel
|
||||||
|
kind: ZitadelCluster
|
||||||
|
path: bitbucket.org/topmanage-software-engineering/zitadel-k8s-operator/src/api/v1alpha1
|
||||||
|
version: v1alpha1
|
||||||
|
- api:
|
||||||
|
crdVersion: v1
|
||||||
|
namespaced: true
|
||||||
|
controller: true
|
||||||
|
domain: topmanage.com
|
||||||
|
group: zitadel
|
||||||
|
kind: Organization
|
||||||
|
path: bitbucket.org/topmanage-software-engineering/zitadel-k8s-operator/src/api/v1alpha1
|
||||||
|
version: v1alpha1
|
||||||
|
- api:
|
||||||
|
crdVersion: v1
|
||||||
|
namespaced: true
|
||||||
|
controller: true
|
||||||
|
domain: topmanage.com
|
||||||
|
group: zitadel
|
||||||
|
kind: Project
|
||||||
|
path: bitbucket.org/topmanage-software-engineering/zitadel-k8s-operator/src/api/v1alpha1
|
||||||
|
version: v1alpha1
|
||||||
|
- api:
|
||||||
|
crdVersion: v1
|
||||||
|
namespaced: true
|
||||||
|
controller: true
|
||||||
|
domain: topmanage.com
|
||||||
|
group: zitadel
|
||||||
|
kind: OIDCApp
|
||||||
|
path: bitbucket.org/topmanage-software-engineering/zitadel-k8s-operator/src/api/v1alpha1
|
||||||
|
version: v1alpha1
|
||||||
|
- api:
|
||||||
|
crdVersion: v1
|
||||||
|
namespaced: true
|
||||||
|
controller: true
|
||||||
|
domain: topmanage.com
|
||||||
|
group: zitadel
|
||||||
|
kind: MachineUser
|
||||||
|
path: bitbucket.org/topmanage-software-engineering/zitadel-k8s-operator/src/api/v1alpha1
|
||||||
|
version: v1alpha1
|
||||||
|
- api:
|
||||||
|
crdVersion: v1
|
||||||
|
namespaced: true
|
||||||
|
controller: true
|
||||||
|
domain: topmanage.com
|
||||||
|
group: zitadel
|
||||||
|
kind: APIApp
|
||||||
|
path: bitbucket.org/topmanage-software-engineering/zitadel-k8s-operator/src/api/v1alpha1
|
||||||
|
version: v1alpha1
|
||||||
|
version: "3"
|
||||||
94
src/README.md
Normal file
94
src/README.md
Normal file
@@ -0,0 +1,94 @@
|
|||||||
|
# src
|
||||||
|
// TODO(user): Add simple overview of use/purpose
|
||||||
|
|
||||||
|
## Description
|
||||||
|
// TODO(user): An in-depth paragraph about your project and overview of use
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
You’ll need a Kubernetes cluster to run against. You can use [KIND](https://sigs.k8s.io/kind) to get a local cluster for testing, or run against a remote cluster.
|
||||||
|
**Note:** Your controller will automatically use the current context in your kubeconfig file (i.e. whatever cluster `kubectl cluster-info` shows).
|
||||||
|
|
||||||
|
### Running on the cluster
|
||||||
|
1. Install Instances of Custom Resources:
|
||||||
|
|
||||||
|
```sh
|
||||||
|
kubectl apply -f config/samples/
|
||||||
|
```
|
||||||
|
|
||||||
|
2. Build and push your image to the location specified by `IMG`:
|
||||||
|
|
||||||
|
```sh
|
||||||
|
make docker-build docker-push IMG=<some-registry>/src:tag
|
||||||
|
```
|
||||||
|
|
||||||
|
3. Deploy the controller to the cluster with the image specified by `IMG`:
|
||||||
|
|
||||||
|
```sh
|
||||||
|
make deploy IMG=<some-registry>/src:tag
|
||||||
|
```
|
||||||
|
|
||||||
|
### Uninstall CRDs
|
||||||
|
To delete the CRDs from the cluster:
|
||||||
|
|
||||||
|
```sh
|
||||||
|
make uninstall
|
||||||
|
```
|
||||||
|
|
||||||
|
### Undeploy controller
|
||||||
|
UnDeploy the controller from the cluster:
|
||||||
|
|
||||||
|
```sh
|
||||||
|
make undeploy
|
||||||
|
```
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
// TODO(user): Add detailed information on how you would like others to contribute to this project
|
||||||
|
|
||||||
|
### How it works
|
||||||
|
This project aims to follow the Kubernetes [Operator pattern](https://kubernetes.io/docs/concepts/extend-kubernetes/operator/).
|
||||||
|
|
||||||
|
It uses [Controllers](https://kubernetes.io/docs/concepts/architecture/controller/),
|
||||||
|
which provide a reconcile function responsible for synchronizing resources until the desired state is reached on the cluster.
|
||||||
|
|
||||||
|
### Test It Out
|
||||||
|
1. Install the CRDs into the cluster:
|
||||||
|
|
||||||
|
```sh
|
||||||
|
make install
|
||||||
|
```
|
||||||
|
|
||||||
|
2. Run your controller (this will run in the foreground, so switch to a new terminal if you want to leave it running):
|
||||||
|
|
||||||
|
```sh
|
||||||
|
make run
|
||||||
|
```
|
||||||
|
|
||||||
|
**NOTE:** You can also run this in one step by running: `make install run`
|
||||||
|
|
||||||
|
### Modifying the API definitions
|
||||||
|
If you are editing the API definitions, generate the manifests such as CRs or CRDs using:
|
||||||
|
|
||||||
|
```sh
|
||||||
|
make manifests
|
||||||
|
```
|
||||||
|
|
||||||
|
**NOTE:** Run `make --help` for more information on all potential `make` targets
|
||||||
|
|
||||||
|
More information can be found via the [Kubebuilder Documentation](https://book.kubebuilder.io/introduction.html)
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
Copyright 2024.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
|
||||||
134
src/api/v1alpha1/apiapp_types.go
Normal file
134
src/api/v1alpha1/apiapp_types.go
Normal file
@@ -0,0 +1,134 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2024.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package v1alpha1
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"fmt"
|
||||||
|
|
||||||
|
"k8s.io/apimachinery/pkg/api/meta"
|
||||||
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||||
|
)
|
||||||
|
|
||||||
|
// EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN!
|
||||||
|
// NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized.
|
||||||
|
|
||||||
|
// APIAppSpec defines the desired state of APIApp
|
||||||
|
type APIAppSpec struct {
|
||||||
|
// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
|
||||||
|
// Important: Run "make" to regenerate code after modifying this file
|
||||||
|
ProjectRef ProjectRef `json:"projectRef"`
|
||||||
|
// +kubebuilder:validation:Enum=API_AUTH_METHOD_TYPE_BASIC;API_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT
|
||||||
|
AuthMethodType string `json:"authMethodType"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// APIAppStatus defines the observed state of APIApp
|
||||||
|
type APIAppStatus struct {
|
||||||
|
// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
|
||||||
|
// Important: Run "make" to regenerate code after modifying this file
|
||||||
|
// +optional
|
||||||
|
// +operator-sdk:csv:customresourcedefinitions:type=status,xDescriptors={"urn:alm:descriptor:io.kubernetes.conditions"}
|
||||||
|
Conditions []metav1.Condition `json:"conditions,omitempty"`
|
||||||
|
// +kubebuilder:default=""
|
||||||
|
AppId string `json:"appId"`
|
||||||
|
// +kubebuilder:default=""
|
||||||
|
KeyId string `json:"keyId"`
|
||||||
|
// +kubebuilder:default=""
|
||||||
|
ClientId string `json:"clientId"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *APIAppStatus) SetCondition(condition metav1.Condition) {
|
||||||
|
if d.Conditions == nil {
|
||||||
|
d.Conditions = make([]metav1.Condition, 0)
|
||||||
|
}
|
||||||
|
meta.SetStatusCondition(&d.Conditions, condition)
|
||||||
|
}
|
||||||
|
|
||||||
|
//+kubebuilder:object:root=true
|
||||||
|
//+kubebuilder:subresource:status
|
||||||
|
|
||||||
|
// APIApp is the Schema for the apiapps API
|
||||||
|
type APIApp struct {
|
||||||
|
metav1.TypeMeta `json:",inline"`
|
||||||
|
metav1.ObjectMeta `json:"metadata,omitempty"`
|
||||||
|
|
||||||
|
Spec APIAppSpec `json:"spec,omitempty"`
|
||||||
|
Status APIAppStatus `json:"status,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *APIApp) IsBeingDeleted() bool {
|
||||||
|
return !d.DeletionTimestamp.IsZero()
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *APIApp) IsReady() bool {
|
||||||
|
return meta.IsStatusConditionTrue(d.Status.Conditions, ConditionTypeReady)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *APIApp) ZitadelClusterRef(ctx context.Context, refresolver *RefResolver) (*ZitadelClusterRef, error) {
|
||||||
|
project, err := refresolver.ProjectRef(ctx, &d.Spec.ProjectRef, d.Namespace)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
if project.Status.ProjectId == "" {
|
||||||
|
return nil, fmt.Errorf("Project has not been created yet...")
|
||||||
|
}
|
||||||
|
org, err := refresolver.OrganizationRef(ctx, &project.Spec.OrganizationRef, d.Namespace)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
if org.Status.OrgId == "" {
|
||||||
|
return nil, fmt.Errorf("Organization has not been created yet...")
|
||||||
|
}
|
||||||
|
ref, err := org.ZitadelClusterRef(ctx, refresolver)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return ref, nil
|
||||||
|
}
|
||||||
|
func (d *APIApp) Organization(ctx context.Context, refresolver *RefResolver) (*Organization, error) {
|
||||||
|
project, err := refresolver.ProjectRef(ctx, &d.Spec.ProjectRef, d.Namespace)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
org, err := refresolver.OrganizationRef(ctx, &project.Spec.OrganizationRef, d.Namespace)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return org, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *APIApp) Project(ctx context.Context, refresolver *RefResolver) (*Project, error) {
|
||||||
|
project, err := refresolver.ProjectRef(ctx, &d.Spec.ProjectRef, d.Namespace)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return project, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
//+kubebuilder:object:root=true
|
||||||
|
|
||||||
|
// APIAppList contains a list of APIApp
|
||||||
|
type APIAppList struct {
|
||||||
|
metav1.TypeMeta `json:",inline"`
|
||||||
|
metav1.ListMeta `json:"metadata,omitempty"`
|
||||||
|
Items []APIApp `json:"items"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func init() {
|
||||||
|
SchemeBuilder.Register(&APIApp{}, &APIAppList{})
|
||||||
|
}
|
||||||
32
src/api/v1alpha1/condition_types.go
Normal file
32
src/api/v1alpha1/condition_types.go
Normal file
@@ -0,0 +1,32 @@
|
|||||||
|
package v1alpha1
|
||||||
|
|
||||||
|
const (
|
||||||
|
ConditionTypeReady string = "Ready"
|
||||||
|
ConditionTypePATUpToDate string = "PATUpToDate"
|
||||||
|
|
||||||
|
ConditionReasonRolesChanged string = "RolesChanged"
|
||||||
|
ConditionReasonPATUpToDate string = "UpToDate"
|
||||||
|
|
||||||
|
ConditionReasonDeploymentNotReady string = "DeploymentNotReady"
|
||||||
|
ConditionReasonDeploymentReady string = "DeploymentReady"
|
||||||
|
ConditionReasonRestoreBackup string = "RestoreBackup"
|
||||||
|
|
||||||
|
ConditionReasonRestoreNotComplete string = "RestoreNotComplete"
|
||||||
|
ConditionReasonRestoreComplete string = "RestoreComplete"
|
||||||
|
|
||||||
|
ConditionReasonJobComplete string = "JobComplete"
|
||||||
|
ConditionReasonJobSuspended string = "JobSuspended"
|
||||||
|
ConditionReasonJobFailed string = "JobFailed"
|
||||||
|
ConditionReasonJobRunning string = "JobRunning"
|
||||||
|
|
||||||
|
ConditionReasonCronJobScheduled string = "CronJobScheduled"
|
||||||
|
ConditionReasonCronJobFailed string = "CronJobScheduled"
|
||||||
|
ConditionReasonCronJobRunning string = "CronJobRunning"
|
||||||
|
ConditionReasonCronJobSuccess string = "CronJobSucess"
|
||||||
|
|
||||||
|
ConditionReasonConnectionFailed string = "ConnectionFailed"
|
||||||
|
|
||||||
|
ConditionReasonCreated string = "Created"
|
||||||
|
ConditionReasonHealthy string = "Healthy"
|
||||||
|
ConditionReasonFailed string = "Failed"
|
||||||
|
)
|
||||||
36
src/api/v1alpha1/groupversion_info.go
Normal file
36
src/api/v1alpha1/groupversion_info.go
Normal file
@@ -0,0 +1,36 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2024.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// Package v1alpha1 contains API Schema definitions for the zitadel v1alpha1 API group
|
||||||
|
// +kubebuilder:object:generate=true
|
||||||
|
// +groupName=zitadel.topmanage.com
|
||||||
|
package v1alpha1
|
||||||
|
|
||||||
|
import (
|
||||||
|
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||||
|
"sigs.k8s.io/controller-runtime/pkg/scheme"
|
||||||
|
)
|
||||||
|
|
||||||
|
var (
|
||||||
|
// GroupVersion is group version used to register these objects
|
||||||
|
GroupVersion = schema.GroupVersion{Group: "zitadel.topmanage.com", Version: "v1alpha1"}
|
||||||
|
|
||||||
|
// SchemeBuilder is used to add go types to the GroupVersionKind scheme
|
||||||
|
SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
|
||||||
|
|
||||||
|
// AddToScheme adds the types in this group-version to the given scheme.
|
||||||
|
AddToScheme = SchemeBuilder.AddToScheme
|
||||||
|
)
|
||||||
131
src/api/v1alpha1/machineuser_types.go
Normal file
131
src/api/v1alpha1/machineuser_types.go
Normal file
@@ -0,0 +1,131 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2024.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package v1alpha1
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"fmt"
|
||||||
|
|
||||||
|
"k8s.io/apimachinery/pkg/api/meta"
|
||||||
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||||
|
)
|
||||||
|
|
||||||
|
// EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN!
|
||||||
|
// NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized.
|
||||||
|
|
||||||
|
type UserGrant struct {
|
||||||
|
ProjectRef ProjectRef `json:"projectRef"`
|
||||||
|
RoleKeys []string `json:"roleKeys,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// MachineUserSpec defines the desired state of MachineUser
|
||||||
|
type MachineUserSpec struct {
|
||||||
|
// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
|
||||||
|
// Important: Run "make" to regenerate code after modifying this file
|
||||||
|
// +kubebuilder:validation:Required
|
||||||
|
// +operator-sdk:csv:customresourcedefinitions:type=spec
|
||||||
|
OrganizationRef OrganizationRef `json:"organizationRef" webhook:"inmutable"`
|
||||||
|
// +kubebuilder:validation:Enum=ACCESS_TOKEN_TYPE_BEARER;ACCESS_TOKEN_TYPE_JWT
|
||||||
|
AccessTokenType string `json:"accessTokenType"`
|
||||||
|
UserGrants []UserGrant `json:"userGrants,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// MachineUserStatus defines the observed state of MachineUser
|
||||||
|
type MachineUserStatus struct {
|
||||||
|
// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
|
||||||
|
// Important: Run "make" to regenerate code after modifying this file
|
||||||
|
// +optional
|
||||||
|
// +operator-sdk:csv:customresourcedefinitions:type=status,xDescriptors={"urn:alm:descriptor:io.kubernetes.conditions"}
|
||||||
|
Conditions []metav1.Condition `json:"conditions,omitempty"`
|
||||||
|
// +kubebuilder:default=""
|
||||||
|
UserId string `json:"userId"`
|
||||||
|
// +kubebuilder:default=""
|
||||||
|
KeyId string `json:"keyId"`
|
||||||
|
// +kubebuilder:default=""
|
||||||
|
PATId string `json:"patId"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *MachineUserStatus) SetCondition(condition metav1.Condition) {
|
||||||
|
if d.Conditions == nil {
|
||||||
|
d.Conditions = make([]metav1.Condition, 0)
|
||||||
|
}
|
||||||
|
meta.SetStatusCondition(&d.Conditions, condition)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *MachineUserStatus) GetConditionStatus(conditionType string) bool {
|
||||||
|
if d.Conditions == nil {
|
||||||
|
d.Conditions = make([]metav1.Condition, 0)
|
||||||
|
}
|
||||||
|
return meta.IsStatusConditionTrue(d.Conditions, conditionType)
|
||||||
|
}
|
||||||
|
|
||||||
|
//+kubebuilder:object:root=true
|
||||||
|
//+kubebuilder:subresource:status
|
||||||
|
|
||||||
|
// MachineUser is the Schema for the machineusers API
|
||||||
|
type MachineUser struct {
|
||||||
|
metav1.TypeMeta `json:",inline"`
|
||||||
|
metav1.ObjectMeta `json:"metadata,omitempty"`
|
||||||
|
|
||||||
|
Spec MachineUserSpec `json:"spec,omitempty"`
|
||||||
|
Status MachineUserStatus `json:"status,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *MachineUser) IsBeingDeleted() bool {
|
||||||
|
return !d.DeletionTimestamp.IsZero()
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *MachineUser) IsReady() bool {
|
||||||
|
return meta.IsStatusConditionTrue(d.Status.Conditions, ConditionTypeReady)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *MachineUser) ZitadelClusterRef(ctx context.Context, refresolver *RefResolver) (*ZitadelClusterRef, error) {
|
||||||
|
org, err := refresolver.OrganizationRef(ctx, &d.Spec.OrganizationRef, d.Namespace)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
if org.Status.OrgId == "" {
|
||||||
|
return nil, fmt.Errorf("Organization has not been created yet...")
|
||||||
|
}
|
||||||
|
ref, err := org.ZitadelClusterRef(ctx, refresolver)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return ref, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *MachineUser) PatSecretName() string {
|
||||||
|
return d.Name + "-pat-secret"
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *MachineUser) JWTSecretName() string {
|
||||||
|
return d.Name + "-machinekey-secret"
|
||||||
|
}
|
||||||
|
|
||||||
|
//+kubebuilder:object:root=true
|
||||||
|
|
||||||
|
// MachineUserList contains a list of MachineUser
|
||||||
|
type MachineUserList struct {
|
||||||
|
metav1.TypeMeta `json:",inline"`
|
||||||
|
metav1.ListMeta `json:"metadata,omitempty"`
|
||||||
|
Items []MachineUser `json:"items"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func init() {
|
||||||
|
SchemeBuilder.Register(&MachineUser{}, &MachineUserList{})
|
||||||
|
}
|
||||||
161
src/api/v1alpha1/oidcapp_types.go
Normal file
161
src/api/v1alpha1/oidcapp_types.go
Normal file
@@ -0,0 +1,161 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2024.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package v1alpha1
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"fmt"
|
||||||
|
|
||||||
|
"k8s.io/apimachinery/pkg/api/meta"
|
||||||
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||||
|
)
|
||||||
|
|
||||||
|
// EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN!
|
||||||
|
// NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized.
|
||||||
|
|
||||||
|
// +kubebuilder:validation:Enum=OIDC_RESPONSE_TYPE_CODE;OIDC_RESPONSE_TYPE_ID_TOKEN;OIDC_RESPONSE_TYPE_ID_TOKEN_TOKEN
|
||||||
|
type ResponseType string
|
||||||
|
|
||||||
|
// +kubebuilder:validation:Enum=OIDC_GRANT_TYPE_AUTHORIZATION_CODE;OIDC_GRANT_TYPE_IMPLICIT;OIDC_GRANT_TYPE_REFRESH_TOKEN;OIDC_GRANT_TYPE_DEVICE_CODE;OIDC_GRANT_TYPE_TOKEN_EXCHANGE
|
||||||
|
type GrantType string
|
||||||
|
|
||||||
|
// OIDCAppSpec defines the desired state of OIDCApp
|
||||||
|
type OIDCAppSpec struct {
|
||||||
|
// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
|
||||||
|
// Important: Run "make" to regenerate code after modifying this file
|
||||||
|
ProjectRef ProjectRef `json:"projectRef"`
|
||||||
|
RedirectUris []string `json:"redirectUris"`
|
||||||
|
ResponseTypes []ResponseType `json:"responseTypes"`
|
||||||
|
GrantTypes []GrantType `json:"grantTypes"`
|
||||||
|
// +kubebuilder:validation:Enum=OIDC_APP_TYPE_WEB;OIDC_APP_TYPE_USER_AGENT;OIDC_APP_TYPE_NATIVE
|
||||||
|
AppType string `json:"appType"`
|
||||||
|
// +kubebuilder:validation:Enum=OIDC_AUTH_METHOD_TYPE_BASIC;OIDC_AUTH_METHOD_TYPE_POST;OIDC_AUTH_METHOD_TYPE_NONE;OIDC_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT
|
||||||
|
AuthMethodType string `json:"authMethodType"`
|
||||||
|
PostLogoutRedirectUris []string `json:"postLogoutRedirectUris"`
|
||||||
|
DevMode bool `json:"devMode"`
|
||||||
|
// +kubebuilder:validation:Enum=OIDC_TOKEN_TYPE_BEARER;OIDC_TOKEN_TYPE_JWT
|
||||||
|
AccessTokenType string `json:"accessTokenType"`
|
||||||
|
AccessTokenRoleAssertion bool `json:"accessTokenRoleAssertion"`
|
||||||
|
IdTokenRoleAssertion bool `json:"idTokenRoleAssertion"`
|
||||||
|
IdTokenUserinfoAssertion bool `json:"idTokenUserinfoAssertion"`
|
||||||
|
// +kubebuilder:validation:Type=string
|
||||||
|
// +kubebuilder:validation:Format=duration
|
||||||
|
ClockSkew *metav1.Duration `json:"clockSkew"`
|
||||||
|
// +optional
|
||||||
|
AdditionalOrigins []string `json:"additionalOrigins"`
|
||||||
|
SkipNativeAppSuccessPage bool `json:"skipNativeAppSuccessPage"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// OIDCAppStatus defines the observed state of OIDCApp
|
||||||
|
type OIDCAppStatus struct {
|
||||||
|
// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
|
||||||
|
// Important: Run "make" to regenerate code after modifying this file
|
||||||
|
// +optional
|
||||||
|
// +operator-sdk:csv:customresourcedefinitions:type=status,xDescriptors={"urn:alm:descriptor:io.kubernetes.conditions"}
|
||||||
|
Conditions []metav1.Condition `json:"conditions,omitempty"`
|
||||||
|
// +kubebuilder:default=""
|
||||||
|
AppId string `json:"appId"`
|
||||||
|
// +kubebuilder:default=""
|
||||||
|
ClientId string `json:"clientId"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *OIDCAppStatus) SetCondition(condition metav1.Condition) {
|
||||||
|
if d.Conditions == nil {
|
||||||
|
d.Conditions = make([]metav1.Condition, 0)
|
||||||
|
}
|
||||||
|
meta.SetStatusCondition(&d.Conditions, condition)
|
||||||
|
}
|
||||||
|
|
||||||
|
//+kubebuilder:object:root=true
|
||||||
|
//+kubebuilder:subresource:status
|
||||||
|
|
||||||
|
// OIDCApp is the Schema for the oidcapps API
|
||||||
|
type OIDCApp struct {
|
||||||
|
metav1.TypeMeta `json:",inline"`
|
||||||
|
metav1.ObjectMeta `json:"metadata,omitempty"`
|
||||||
|
|
||||||
|
Spec OIDCAppSpec `json:"spec,omitempty"`
|
||||||
|
Status OIDCAppStatus `json:"status,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *OIDCApp) IsBeingDeleted() bool {
|
||||||
|
return !d.DeletionTimestamp.IsZero()
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *OIDCApp) IsReady() bool {
|
||||||
|
return meta.IsStatusConditionTrue(d.Status.Conditions, ConditionTypeReady)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *OIDCApp) ZitadelClusterRef(ctx context.Context, refresolver *RefResolver) (*ZitadelClusterRef, error) {
|
||||||
|
project, err := refresolver.ProjectRef(ctx, &d.Spec.ProjectRef, d.Namespace)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
if project.Status.ProjectId == "" {
|
||||||
|
return nil, fmt.Errorf("Project has not been created yet...")
|
||||||
|
}
|
||||||
|
org, err := refresolver.OrganizationRef(ctx, &project.Spec.OrganizationRef, d.Namespace)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
if org.Status.OrgId == "" {
|
||||||
|
return nil, fmt.Errorf("Organization has not been created yet...")
|
||||||
|
}
|
||||||
|
ref, err := org.ZitadelClusterRef(ctx, refresolver)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return ref, nil
|
||||||
|
}
|
||||||
|
func (d *OIDCApp) Organization(ctx context.Context, refresolver *RefResolver) (*Organization, error) {
|
||||||
|
project, err := refresolver.ProjectRef(ctx, &d.Spec.ProjectRef, d.Namespace)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
org, err := refresolver.OrganizationRef(ctx, &project.Spec.OrganizationRef, d.Namespace)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return org, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *OIDCApp) Project(ctx context.Context, refresolver *RefResolver) (*Project, error) {
|
||||||
|
project, err := refresolver.ProjectRef(ctx, &d.Spec.ProjectRef, d.Namespace)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return project, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *OIDCApp) ClientSecretName() string {
|
||||||
|
return d.Name + "-client-secret"
|
||||||
|
}
|
||||||
|
|
||||||
|
//+kubebuilder:object:root=true
|
||||||
|
|
||||||
|
// OIDCAppList contains a list of OIDCApp
|
||||||
|
type OIDCAppList struct {
|
||||||
|
metav1.TypeMeta `json:",inline"`
|
||||||
|
metav1.ListMeta `json:"metadata,omitempty"`
|
||||||
|
Items []OIDCApp `json:"items"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func init() {
|
||||||
|
SchemeBuilder.Register(&OIDCApp{}, &OIDCAppList{})
|
||||||
|
}
|
||||||
102
src/api/v1alpha1/organization_types.go
Normal file
102
src/api/v1alpha1/organization_types.go
Normal file
@@ -0,0 +1,102 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2024.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package v1alpha1
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
|
||||||
|
"k8s.io/apimachinery/pkg/api/meta"
|
||||||
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||||
|
)
|
||||||
|
|
||||||
|
// EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN!
|
||||||
|
// NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized.
|
||||||
|
|
||||||
|
type OrganizationAdmin struct {
|
||||||
|
FirstName string `json:"firstName"`
|
||||||
|
LastName string `json:"lastName"`
|
||||||
|
Email string `json:"email"`
|
||||||
|
UserName string `json:"userName"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// OrganizationSpec defines the desired state of Organization
|
||||||
|
type OrganizationSpec struct {
|
||||||
|
// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
|
||||||
|
// Important: Run "make" to regenerate code after modifying this file
|
||||||
|
// +kubebuilder:validation:Required
|
||||||
|
// +operator-sdk:csv:customresourcedefinitions:type=spec
|
||||||
|
ZitadelClusterRef ZitadelClusterRef `json:"zitadelClusterRef" webhook:"inmutable"`
|
||||||
|
OrganizationAdmin OrganizationAdmin `json:"organizationAdmin"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// OrganizationStatus defines the observed state of Organization
|
||||||
|
type OrganizationStatus struct {
|
||||||
|
// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
|
||||||
|
// Important: Run "make" to regenerate code after modifying this file
|
||||||
|
// Conditions for the Database object.
|
||||||
|
// +optional
|
||||||
|
// +operator-sdk:csv:customresourcedefinitions:type=status,xDescriptors={"urn:alm:descriptor:io.kubernetes.conditions"}
|
||||||
|
Conditions []metav1.Condition `json:"conditions,omitempty"`
|
||||||
|
// +kubebuilder:default=""
|
||||||
|
OrgId string `json:"orgId"`
|
||||||
|
// +kubebuilder:default=""
|
||||||
|
AdminId string `json:"adminId"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *OrganizationStatus) SetCondition(condition metav1.Condition) {
|
||||||
|
if d.Conditions == nil {
|
||||||
|
d.Conditions = make([]metav1.Condition, 0)
|
||||||
|
}
|
||||||
|
meta.SetStatusCondition(&d.Conditions, condition)
|
||||||
|
}
|
||||||
|
|
||||||
|
//+kubebuilder:object:root=true
|
||||||
|
//+kubebuilder:subresource:status
|
||||||
|
|
||||||
|
// Organization is the Schema for the organizations API
|
||||||
|
type Organization struct {
|
||||||
|
metav1.TypeMeta `json:",inline"`
|
||||||
|
metav1.ObjectMeta `json:"metadata,omitempty"`
|
||||||
|
|
||||||
|
Spec OrganizationSpec `json:"spec,omitempty"`
|
||||||
|
Status OrganizationStatus `json:"status,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *Organization) IsBeingDeleted() bool {
|
||||||
|
return !d.DeletionTimestamp.IsZero()
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *Organization) IsReady() bool {
|
||||||
|
return meta.IsStatusConditionTrue(d.Status.Conditions, ConditionTypeReady)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *Organization) ZitadelClusterRef(_ context.Context, _ *RefResolver) (*ZitadelClusterRef, error) {
|
||||||
|
return &d.Spec.ZitadelClusterRef, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
//+kubebuilder:object:root=true
|
||||||
|
|
||||||
|
// OrganizationList contains a list of Organization
|
||||||
|
type OrganizationList struct {
|
||||||
|
metav1.TypeMeta `json:",inline"`
|
||||||
|
metav1.ListMeta `json:"metadata,omitempty"`
|
||||||
|
Items []Organization `json:"items"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func init() {
|
||||||
|
SchemeBuilder.Register(&Organization{}, &OrganizationList{})
|
||||||
|
}
|
||||||
126
src/api/v1alpha1/project_types.go
Normal file
126
src/api/v1alpha1/project_types.go
Normal file
@@ -0,0 +1,126 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2024.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package v1alpha1
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"fmt"
|
||||||
|
|
||||||
|
"k8s.io/apimachinery/pkg/api/meta"
|
||||||
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||||
|
)
|
||||||
|
|
||||||
|
// EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN!
|
||||||
|
// NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized.
|
||||||
|
|
||||||
|
type Role struct {
|
||||||
|
Key string `json:"key"`
|
||||||
|
DisplayName string `json:"displayName"`
|
||||||
|
Group string `json:"group"`
|
||||||
|
}
|
||||||
|
type Grant struct {
|
||||||
|
OrganizationRef OrganizationRef `json:"organizationRef"`
|
||||||
|
RoleKeys []string `json:"roleKeys"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// ProjectSpec defines the desired state of Project
|
||||||
|
type ProjectSpec struct {
|
||||||
|
// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
|
||||||
|
// Important: Run "make" to regenerate code after modifying this file
|
||||||
|
// https://zitadel.com/docs/apis/resources/mgmt/management-service-add-project
|
||||||
|
// +kubebuilder:validation:Required
|
||||||
|
// +operator-sdk:csv:customresourcedefinitions:type=spec
|
||||||
|
OrganizationRef OrganizationRef `json:"organizationRef"`
|
||||||
|
// +optional
|
||||||
|
Roles []Role `json:"roles"`
|
||||||
|
// +optional
|
||||||
|
Grants []Grant `json:"grants"`
|
||||||
|
// +optional
|
||||||
|
ProjectRoleAssertion bool `json:"projectRoleAssertion,omitempty"`
|
||||||
|
// +optional
|
||||||
|
ProjectRoleCheck bool `json:"projectRoleCheck,omitempty"`
|
||||||
|
// +optional
|
||||||
|
HasProjectCheck bool `json:"hasProjectCheck,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// ProjectStatus defines the observed state of Project
|
||||||
|
type ProjectStatus struct {
|
||||||
|
// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
|
||||||
|
// Important: Run "make" to regenerate code after modifying this file
|
||||||
|
// Conditions for the Database object.
|
||||||
|
// +optional
|
||||||
|
// +operator-sdk:csv:customresourcedefinitions:type=status,xDescriptors={"urn:alm:descriptor:io.kubernetes.conditions"}
|
||||||
|
Conditions []metav1.Condition `json:"conditions,omitempty"`
|
||||||
|
// +kubebuilder:default=""
|
||||||
|
ProjectId string `json:"projectId"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *ProjectStatus) SetCondition(condition metav1.Condition) {
|
||||||
|
if d.Conditions == nil {
|
||||||
|
d.Conditions = make([]metav1.Condition, 0)
|
||||||
|
}
|
||||||
|
meta.SetStatusCondition(&d.Conditions, condition)
|
||||||
|
}
|
||||||
|
|
||||||
|
//+kubebuilder:object:root=true
|
||||||
|
//+kubebuilder:subresource:status
|
||||||
|
|
||||||
|
// Project is the Schema for the projects API
|
||||||
|
type Project struct {
|
||||||
|
metav1.TypeMeta `json:",inline"`
|
||||||
|
metav1.ObjectMeta `json:"metadata,omitempty"`
|
||||||
|
|
||||||
|
Spec ProjectSpec `json:"spec,omitempty"`
|
||||||
|
Status ProjectStatus `json:"status,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *Project) IsBeingDeleted() bool {
|
||||||
|
return !d.DeletionTimestamp.IsZero()
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *Project) IsReady() bool {
|
||||||
|
return meta.IsStatusConditionTrue(d.Status.Conditions, ConditionTypeReady)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (d *Project) ZitadelClusterRef(ctx context.Context, refresolver *RefResolver) (*ZitadelClusterRef, error) {
|
||||||
|
org, err := refresolver.OrganizationRef(ctx, &d.Spec.OrganizationRef, d.Namespace)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
if org.Status.OrgId == "" {
|
||||||
|
return nil, fmt.Errorf("Organization has not been created yet...")
|
||||||
|
}
|
||||||
|
|
||||||
|
ref, err := org.ZitadelClusterRef(ctx, refresolver)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return ref, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
//+kubebuilder:object:root=true
|
||||||
|
|
||||||
|
// ProjectList contains a list of Project
|
||||||
|
type ProjectList struct {
|
||||||
|
metav1.TypeMeta `json:",inline"`
|
||||||
|
metav1.ListMeta `json:"metadata,omitempty"`
|
||||||
|
Items []Project `json:"items"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func init() {
|
||||||
|
SchemeBuilder.Register(&Project{}, &ProjectList{})
|
||||||
|
}
|
||||||
40
src/api/v1alpha1/ref_types.go
Normal file
40
src/api/v1alpha1/ref_types.go
Normal file
@@ -0,0 +1,40 @@
|
|||||||
|
package v1alpha1
|
||||||
|
|
||||||
|
import (
|
||||||
|
corev1 "k8s.io/api/core/v1"
|
||||||
|
)
|
||||||
|
|
||||||
|
type OIDCAppRef struct {
|
||||||
|
// ObjectReference is a reference to a object.
|
||||||
|
// +kubebuilder:validation:Required
|
||||||
|
// +operator-sdk:csv:customresourcedefinitions:type=spec
|
||||||
|
corev1.ObjectReference `json:",inline"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type CrdbClusterRef struct {
|
||||||
|
// ObjectReference is a reference to a object.
|
||||||
|
// +kubebuilder:validation:Required
|
||||||
|
// +operator-sdk:csv:customresourcedefinitions:type=spec
|
||||||
|
corev1.ObjectReference `json:",inline"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type ZitadelClusterRef struct {
|
||||||
|
// ObjectReference is a reference to a object.
|
||||||
|
// +kubebuilder:validation:Required
|
||||||
|
// +operator-sdk:csv:customresourcedefinitions:type=spec
|
||||||
|
corev1.ObjectReference `json:",inline"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type OrganizationRef struct {
|
||||||
|
// ObjectReference is a reference to a object.
|
||||||
|
// +kubebuilder:validation:Required
|
||||||
|
// +operator-sdk:csv:customresourcedefinitions:type=spec
|
||||||
|
corev1.ObjectReference `json:",inline"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type ProjectRef struct {
|
||||||
|
// ObjectReference is a reference to a object.
|
||||||
|
// +kubebuilder:validation:Required
|
||||||
|
// +operator-sdk:csv:customresourcedefinitions:type=spec
|
||||||
|
corev1.ObjectReference `json:",inline"`
|
||||||
|
}
|
||||||
144
src/api/v1alpha1/refresolver.go
Normal file
144
src/api/v1alpha1/refresolver.go
Normal file
@@ -0,0 +1,144 @@
|
|||||||
|
package v1alpha1
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"fmt"
|
||||||
|
crdbv1alpha1 "github.com/cockroachdb/cockroach-operator/apis/v1alpha1"
|
||||||
|
corev1 "k8s.io/api/core/v1"
|
||||||
|
v1 "k8s.io/api/core/v1"
|
||||||
|
"k8s.io/apimachinery/pkg/types"
|
||||||
|
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||||
|
)
|
||||||
|
|
||||||
|
// +kubebuilder:object:generate=false
|
||||||
|
type RefResolver struct {
|
||||||
|
client client.Client
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewRefResolver(client client.Client) *RefResolver {
|
||||||
|
return &RefResolver{
|
||||||
|
client: client,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *RefResolver) ZitadelCluster(ctx context.Context, ref *ZitadelClusterRef,
|
||||||
|
namespace string) (*ZitadelCluster, error) {
|
||||||
|
if ref.Kind != "" && ref.Kind != "ZitadelCluster" {
|
||||||
|
return nil, fmt.Errorf("Unsupported reference kind: '%s'", ref.Kind)
|
||||||
|
}
|
||||||
|
|
||||||
|
key := types.NamespacedName{
|
||||||
|
Name: ref.Name,
|
||||||
|
Namespace: namespace,
|
||||||
|
}
|
||||||
|
if ref.Namespace != "" {
|
||||||
|
key.Namespace = ref.Namespace
|
||||||
|
}
|
||||||
|
|
||||||
|
var zitadel ZitadelCluster
|
||||||
|
if err := r.client.Get(ctx, key, &zitadel); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return &zitadel, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *RefResolver) OIDCAppRef(ctx context.Context, ref *OIDCAppRef,
|
||||||
|
namespace string) (*OIDCApp, error) {
|
||||||
|
if ref.Kind != "" && ref.Kind != "OIDCApp" {
|
||||||
|
return nil, fmt.Errorf("Unsupported reference kind: '%s'", ref.Kind)
|
||||||
|
}
|
||||||
|
|
||||||
|
key := types.NamespacedName{
|
||||||
|
Name: ref.Name,
|
||||||
|
Namespace: namespace,
|
||||||
|
}
|
||||||
|
if ref.Namespace != "" {
|
||||||
|
key.Namespace = ref.Namespace
|
||||||
|
}
|
||||||
|
|
||||||
|
var zitadel OIDCApp
|
||||||
|
if err := r.client.Get(ctx, key, &zitadel); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return &zitadel, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *RefResolver) ProjectRef(ctx context.Context, ref *ProjectRef,
|
||||||
|
namespace string) (*Project, error) {
|
||||||
|
if ref.Kind != "" && ref.Kind != "Project" {
|
||||||
|
return nil, fmt.Errorf("Unsupported reference kind: '%s'", ref.Kind)
|
||||||
|
}
|
||||||
|
|
||||||
|
key := types.NamespacedName{
|
||||||
|
Name: ref.Name,
|
||||||
|
Namespace: namespace,
|
||||||
|
}
|
||||||
|
if ref.Namespace != "" {
|
||||||
|
key.Namespace = ref.Namespace
|
||||||
|
}
|
||||||
|
|
||||||
|
var zitadel Project
|
||||||
|
if err := r.client.Get(ctx, key, &zitadel); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return &zitadel, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *RefResolver) OrganizationRef(ctx context.Context, ref *OrganizationRef,
|
||||||
|
namespace string) (*Organization, error) {
|
||||||
|
if ref.Kind != "" && ref.Kind != "Organization" {
|
||||||
|
return nil, fmt.Errorf("Unsupported reference kind: '%s'", ref.Kind)
|
||||||
|
}
|
||||||
|
|
||||||
|
key := types.NamespacedName{
|
||||||
|
Name: ref.Name,
|
||||||
|
Namespace: namespace,
|
||||||
|
}
|
||||||
|
if ref.Namespace != "" {
|
||||||
|
key.Namespace = ref.Namespace
|
||||||
|
}
|
||||||
|
|
||||||
|
var zitadel Organization
|
||||||
|
if err := r.client.Get(ctx, key, &zitadel); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return &zitadel, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *RefResolver) CrdbClusterRef(ctx context.Context, ref *CrdbClusterRef, namespace string) (*crdbv1alpha1.CrdbCluster, error) {
|
||||||
|
if ref.Kind != "" && ref.Kind != "CrdbCluster" {
|
||||||
|
return nil, fmt.Errorf("Unsupported reference kind: '%s'", ref.Kind)
|
||||||
|
}
|
||||||
|
key := types.NamespacedName{
|
||||||
|
Name: ref.Name,
|
||||||
|
Namespace: namespace,
|
||||||
|
}
|
||||||
|
if ref.Namespace != "" {
|
||||||
|
key.Namespace = ref.Namespace
|
||||||
|
}
|
||||||
|
|
||||||
|
var crdb crdbv1alpha1.CrdbCluster
|
||||||
|
if err := r.client.Get(ctx, key, &crdb); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return &crdb, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *RefResolver) SecretKeyRef(ctx context.Context, selector corev1.SecretKeySelector,
|
||||||
|
namespace string) (string, error) {
|
||||||
|
nn := types.NamespacedName{
|
||||||
|
Name: selector.Name,
|
||||||
|
Namespace: namespace,
|
||||||
|
}
|
||||||
|
var secret v1.Secret
|
||||||
|
if err := r.client.Get(ctx, nn, &secret); err != nil {
|
||||||
|
return "", fmt.Errorf("error getting secret: %v", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
data, ok := secret.Data[selector.Key]
|
||||||
|
if !ok {
|
||||||
|
return "", fmt.Errorf("secret key \"%s\" not found", selector.Key)
|
||||||
|
}
|
||||||
|
|
||||||
|
return string(data), nil
|
||||||
|
}
|
||||||
151
src/api/v1alpha1/zitadelcluster_types.go
Normal file
151
src/api/v1alpha1/zitadelcluster_types.go
Normal file
@@ -0,0 +1,151 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2024.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package v1alpha1
|
||||||
|
|
||||||
|
import (
|
||||||
|
corev1 "k8s.io/api/core/v1"
|
||||||
|
"k8s.io/apimachinery/pkg/api/meta"
|
||||||
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||||
|
)
|
||||||
|
|
||||||
|
// EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN!
|
||||||
|
// NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized.
|
||||||
|
|
||||||
|
type Image struct {
|
||||||
|
Name string `json:"name"`
|
||||||
|
Tag string `json:"tag"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type Password struct {
|
||||||
|
SecretKeyRef corev1.SecretKeySelector `json:"secretRef"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type SMTPConfig struct {
|
||||||
|
SenderAddress string `json:"senderAddress"`
|
||||||
|
SenderName string `json:"senderName"`
|
||||||
|
// +kubebuilder:default=true
|
||||||
|
TLS bool `json:"tls"`
|
||||||
|
Host string `json:"host"`
|
||||||
|
User *string `json:"user,omitempty"`
|
||||||
|
Password *Password `json:"password,omitempty"`
|
||||||
|
ReplyToAddress *string `json:"replyToAddress,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type DomainSettings struct {
|
||||||
|
// +kubebuilder:default=true
|
||||||
|
UserLoginMustBeDomain bool `json:"userLoginMustBeDomain"`
|
||||||
|
// +kubebuilder:default=true
|
||||||
|
ValidateOrgDomains bool `json:"validateOrgDomains"`
|
||||||
|
// +kubebuilder:default=true
|
||||||
|
SMTPSenderAddressMatchesInstanceDomain bool `json:"smtpSenderAddressMatchesInstanceDomain"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// ZitadelClusterSpec defines the desired state of ZitadelCluster
|
||||||
|
type ZitadelClusterSpec struct {
|
||||||
|
// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
|
||||||
|
// Important: Run "make" to regenerate code after modifying this file
|
||||||
|
// +kubebuilder:default="DEFAULT"
|
||||||
|
FirstOrgName string `json:"firstOrgName"`
|
||||||
|
DomainSettings DomainSettings `json:"domainSettings"`
|
||||||
|
SMTPConfig SMTPConfig `json:"smtpConfig"`
|
||||||
|
Host string `json:"host"`
|
||||||
|
// +kubebuilder:default=443
|
||||||
|
ExternalPort int64 `json:"externalPort"`
|
||||||
|
// +kubebuilder:default=true
|
||||||
|
ExternalSecure bool `json:"externalSecure"`
|
||||||
|
Image Image `json:"image"`
|
||||||
|
Resources corev1.ResourceRequirements `json:"resources"`
|
||||||
|
CrdbClusterRef CrdbClusterRef `json:"crdbClusterRef"`
|
||||||
|
// +kubebuilder:validation:Enum=demo;trial;staging;productive;testing
|
||||||
|
Purpose string `json:"purpose"`
|
||||||
|
// PodAnnotations to add to the Pods metadata.
|
||||||
|
// +optional
|
||||||
|
// +operator-sdk:csv:customresourcedefinitions:type=spec
|
||||||
|
PodAnnotations map[string]string `json:"podAnnotations,omitempty"`
|
||||||
|
// ServiceAnnotations to add to the service metadata.
|
||||||
|
// +optional
|
||||||
|
// +operator-sdk:csv:customresourcedefinitions:type=spec
|
||||||
|
ServiceAnnotations map[string]string `json:"serviceAnnotations,omitempty"`
|
||||||
|
// +kubebuilder:default=3
|
||||||
|
// +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:podCount"}
|
||||||
|
Replicas int32 `json:"replicas,omitempty"`
|
||||||
|
RootTLSSecret corev1.SecretReference `json:"rootTLSSecret"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// ZitadelClusterStatus defines the observed state of ZitadelCluster
|
||||||
|
type ZitadelClusterStatus struct {
|
||||||
|
// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
|
||||||
|
// Important: Run "make" to regenerate code after modifying this file
|
||||||
|
Conditions []metav1.Condition `json:"conditions,omitempty"`
|
||||||
|
// +kubebuilder:default=3
|
||||||
|
// +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:podCount"}
|
||||||
|
Replicas int32 `json:"replicas,omitempty"`
|
||||||
|
// +kubebuilder:default=""
|
||||||
|
DefaultInstanceId string `json:"defaultInstanceId"`
|
||||||
|
// +kubebuilder:default=""
|
||||||
|
SMTPProviderId string `json:"smtpProviderId"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// SetCondition sets a status condition
|
||||||
|
func (s *ZitadelClusterStatus) SetCondition(condition metav1.Condition) {
|
||||||
|
if s.Conditions == nil {
|
||||||
|
s.Conditions = make([]metav1.Condition, 0)
|
||||||
|
}
|
||||||
|
meta.SetStatusCondition(&s.Conditions, condition)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *ZitadelClusterStatus) IsReady() bool {
|
||||||
|
for _, c := range s.Conditions {
|
||||||
|
if c.Type == ConditionTypeReady && c.Status == metav1.ConditionTrue {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *ZitadelClusterStatus) FillWithDefaults(zitadel *ZitadelCluster) {
|
||||||
|
//(Haim ;^D ): No defaults yet
|
||||||
|
}
|
||||||
|
|
||||||
|
//+kubebuilder:object:root=true
|
||||||
|
//+kubebuilder:subresource:status
|
||||||
|
|
||||||
|
// ZitadelCluster is the Schema for the zitadelclusters API
|
||||||
|
type ZitadelCluster struct {
|
||||||
|
metav1.TypeMeta `json:",inline"`
|
||||||
|
metav1.ObjectMeta `json:"metadata,omitempty"`
|
||||||
|
|
||||||
|
Spec ZitadelClusterSpec `json:"spec,omitempty"`
|
||||||
|
Status ZitadelClusterStatus `json:"status,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *ZitadelCluster) SetDefaults() {
|
||||||
|
//(Haim ;^D ): No defaults yet
|
||||||
|
}
|
||||||
|
|
||||||
|
//+kubebuilder:object:root=true
|
||||||
|
|
||||||
|
// ZitadelClusterList contains a list of ZitadelCluster
|
||||||
|
type ZitadelClusterList struct {
|
||||||
|
metav1.TypeMeta `json:",inline"`
|
||||||
|
metav1.ListMeta `json:"metadata,omitempty"`
|
||||||
|
Items []ZitadelCluster `json:"items"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func init() {
|
||||||
|
SchemeBuilder.Register(&ZitadelCluster{}, &ZitadelClusterList{})
|
||||||
|
}
|
||||||
906
src/api/v1alpha1/zz_generated.deepcopy.go
Normal file
906
src/api/v1alpha1/zz_generated.deepcopy.go
Normal file
@@ -0,0 +1,906 @@
|
|||||||
|
//go:build !ignore_autogenerated
|
||||||
|
// +build !ignore_autogenerated
|
||||||
|
|
||||||
|
/*
|
||||||
|
Copyright 2024.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// Code generated by controller-gen. DO NOT EDIT.
|
||||||
|
|
||||||
|
package v1alpha1
|
||||||
|
|
||||||
|
import (
|
||||||
|
"k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||||
|
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||||
|
)
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *APIApp) DeepCopyInto(out *APIApp) {
|
||||||
|
*out = *in
|
||||||
|
out.TypeMeta = in.TypeMeta
|
||||||
|
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
||||||
|
out.Spec = in.Spec
|
||||||
|
in.Status.DeepCopyInto(&out.Status)
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIApp.
|
||||||
|
func (in *APIApp) DeepCopy() *APIApp {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(APIApp)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||||
|
func (in *APIApp) DeepCopyObject() runtime.Object {
|
||||||
|
if c := in.DeepCopy(); c != nil {
|
||||||
|
return c
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *APIAppList) DeepCopyInto(out *APIAppList) {
|
||||||
|
*out = *in
|
||||||
|
out.TypeMeta = in.TypeMeta
|
||||||
|
in.ListMeta.DeepCopyInto(&out.ListMeta)
|
||||||
|
if in.Items != nil {
|
||||||
|
in, out := &in.Items, &out.Items
|
||||||
|
*out = make([]APIApp, len(*in))
|
||||||
|
for i := range *in {
|
||||||
|
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIAppList.
|
||||||
|
func (in *APIAppList) DeepCopy() *APIAppList {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(APIAppList)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||||
|
func (in *APIAppList) DeepCopyObject() runtime.Object {
|
||||||
|
if c := in.DeepCopy(); c != nil {
|
||||||
|
return c
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *APIAppSpec) DeepCopyInto(out *APIAppSpec) {
|
||||||
|
*out = *in
|
||||||
|
out.ProjectRef = in.ProjectRef
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIAppSpec.
|
||||||
|
func (in *APIAppSpec) DeepCopy() *APIAppSpec {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(APIAppSpec)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *APIAppStatus) DeepCopyInto(out *APIAppStatus) {
|
||||||
|
*out = *in
|
||||||
|
if in.Conditions != nil {
|
||||||
|
in, out := &in.Conditions, &out.Conditions
|
||||||
|
*out = make([]v1.Condition, len(*in))
|
||||||
|
for i := range *in {
|
||||||
|
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIAppStatus.
|
||||||
|
func (in *APIAppStatus) DeepCopy() *APIAppStatus {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(APIAppStatus)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *CrdbClusterRef) DeepCopyInto(out *CrdbClusterRef) {
|
||||||
|
*out = *in
|
||||||
|
out.ObjectReference = in.ObjectReference
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CrdbClusterRef.
|
||||||
|
func (in *CrdbClusterRef) DeepCopy() *CrdbClusterRef {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(CrdbClusterRef)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *DomainSettings) DeepCopyInto(out *DomainSettings) {
|
||||||
|
*out = *in
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DomainSettings.
|
||||||
|
func (in *DomainSettings) DeepCopy() *DomainSettings {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(DomainSettings)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *Grant) DeepCopyInto(out *Grant) {
|
||||||
|
*out = *in
|
||||||
|
out.OrganizationRef = in.OrganizationRef
|
||||||
|
if in.RoleKeys != nil {
|
||||||
|
in, out := &in.RoleKeys, &out.RoleKeys
|
||||||
|
*out = make([]string, len(*in))
|
||||||
|
copy(*out, *in)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Grant.
|
||||||
|
func (in *Grant) DeepCopy() *Grant {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(Grant)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *Image) DeepCopyInto(out *Image) {
|
||||||
|
*out = *in
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Image.
|
||||||
|
func (in *Image) DeepCopy() *Image {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(Image)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *MachineUser) DeepCopyInto(out *MachineUser) {
|
||||||
|
*out = *in
|
||||||
|
out.TypeMeta = in.TypeMeta
|
||||||
|
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
||||||
|
in.Spec.DeepCopyInto(&out.Spec)
|
||||||
|
in.Status.DeepCopyInto(&out.Status)
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MachineUser.
|
||||||
|
func (in *MachineUser) DeepCopy() *MachineUser {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(MachineUser)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||||
|
func (in *MachineUser) DeepCopyObject() runtime.Object {
|
||||||
|
if c := in.DeepCopy(); c != nil {
|
||||||
|
return c
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *MachineUserList) DeepCopyInto(out *MachineUserList) {
|
||||||
|
*out = *in
|
||||||
|
out.TypeMeta = in.TypeMeta
|
||||||
|
in.ListMeta.DeepCopyInto(&out.ListMeta)
|
||||||
|
if in.Items != nil {
|
||||||
|
in, out := &in.Items, &out.Items
|
||||||
|
*out = make([]MachineUser, len(*in))
|
||||||
|
for i := range *in {
|
||||||
|
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MachineUserList.
|
||||||
|
func (in *MachineUserList) DeepCopy() *MachineUserList {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(MachineUserList)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||||
|
func (in *MachineUserList) DeepCopyObject() runtime.Object {
|
||||||
|
if c := in.DeepCopy(); c != nil {
|
||||||
|
return c
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *MachineUserSpec) DeepCopyInto(out *MachineUserSpec) {
|
||||||
|
*out = *in
|
||||||
|
out.OrganizationRef = in.OrganizationRef
|
||||||
|
if in.UserGrants != nil {
|
||||||
|
in, out := &in.UserGrants, &out.UserGrants
|
||||||
|
*out = make([]UserGrant, len(*in))
|
||||||
|
for i := range *in {
|
||||||
|
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MachineUserSpec.
|
||||||
|
func (in *MachineUserSpec) DeepCopy() *MachineUserSpec {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(MachineUserSpec)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *MachineUserStatus) DeepCopyInto(out *MachineUserStatus) {
|
||||||
|
*out = *in
|
||||||
|
if in.Conditions != nil {
|
||||||
|
in, out := &in.Conditions, &out.Conditions
|
||||||
|
*out = make([]v1.Condition, len(*in))
|
||||||
|
for i := range *in {
|
||||||
|
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MachineUserStatus.
|
||||||
|
func (in *MachineUserStatus) DeepCopy() *MachineUserStatus {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(MachineUserStatus)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *OIDCApp) DeepCopyInto(out *OIDCApp) {
|
||||||
|
*out = *in
|
||||||
|
out.TypeMeta = in.TypeMeta
|
||||||
|
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
||||||
|
in.Spec.DeepCopyInto(&out.Spec)
|
||||||
|
in.Status.DeepCopyInto(&out.Status)
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCApp.
|
||||||
|
func (in *OIDCApp) DeepCopy() *OIDCApp {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(OIDCApp)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||||
|
func (in *OIDCApp) DeepCopyObject() runtime.Object {
|
||||||
|
if c := in.DeepCopy(); c != nil {
|
||||||
|
return c
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *OIDCAppList) DeepCopyInto(out *OIDCAppList) {
|
||||||
|
*out = *in
|
||||||
|
out.TypeMeta = in.TypeMeta
|
||||||
|
in.ListMeta.DeepCopyInto(&out.ListMeta)
|
||||||
|
if in.Items != nil {
|
||||||
|
in, out := &in.Items, &out.Items
|
||||||
|
*out = make([]OIDCApp, len(*in))
|
||||||
|
for i := range *in {
|
||||||
|
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCAppList.
|
||||||
|
func (in *OIDCAppList) DeepCopy() *OIDCAppList {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(OIDCAppList)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||||
|
func (in *OIDCAppList) DeepCopyObject() runtime.Object {
|
||||||
|
if c := in.DeepCopy(); c != nil {
|
||||||
|
return c
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *OIDCAppRef) DeepCopyInto(out *OIDCAppRef) {
|
||||||
|
*out = *in
|
||||||
|
out.ObjectReference = in.ObjectReference
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCAppRef.
|
||||||
|
func (in *OIDCAppRef) DeepCopy() *OIDCAppRef {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(OIDCAppRef)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *OIDCAppSpec) DeepCopyInto(out *OIDCAppSpec) {
|
||||||
|
*out = *in
|
||||||
|
out.ProjectRef = in.ProjectRef
|
||||||
|
if in.RedirectUris != nil {
|
||||||
|
in, out := &in.RedirectUris, &out.RedirectUris
|
||||||
|
*out = make([]string, len(*in))
|
||||||
|
copy(*out, *in)
|
||||||
|
}
|
||||||
|
if in.ResponseTypes != nil {
|
||||||
|
in, out := &in.ResponseTypes, &out.ResponseTypes
|
||||||
|
*out = make([]ResponseType, len(*in))
|
||||||
|
copy(*out, *in)
|
||||||
|
}
|
||||||
|
if in.GrantTypes != nil {
|
||||||
|
in, out := &in.GrantTypes, &out.GrantTypes
|
||||||
|
*out = make([]GrantType, len(*in))
|
||||||
|
copy(*out, *in)
|
||||||
|
}
|
||||||
|
if in.PostLogoutRedirectUris != nil {
|
||||||
|
in, out := &in.PostLogoutRedirectUris, &out.PostLogoutRedirectUris
|
||||||
|
*out = make([]string, len(*in))
|
||||||
|
copy(*out, *in)
|
||||||
|
}
|
||||||
|
if in.ClockSkew != nil {
|
||||||
|
in, out := &in.ClockSkew, &out.ClockSkew
|
||||||
|
*out = new(v1.Duration)
|
||||||
|
**out = **in
|
||||||
|
}
|
||||||
|
if in.AdditionalOrigins != nil {
|
||||||
|
in, out := &in.AdditionalOrigins, &out.AdditionalOrigins
|
||||||
|
*out = make([]string, len(*in))
|
||||||
|
copy(*out, *in)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCAppSpec.
|
||||||
|
func (in *OIDCAppSpec) DeepCopy() *OIDCAppSpec {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(OIDCAppSpec)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *OIDCAppStatus) DeepCopyInto(out *OIDCAppStatus) {
|
||||||
|
*out = *in
|
||||||
|
if in.Conditions != nil {
|
||||||
|
in, out := &in.Conditions, &out.Conditions
|
||||||
|
*out = make([]v1.Condition, len(*in))
|
||||||
|
for i := range *in {
|
||||||
|
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDCAppStatus.
|
||||||
|
func (in *OIDCAppStatus) DeepCopy() *OIDCAppStatus {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(OIDCAppStatus)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *Organization) DeepCopyInto(out *Organization) {
|
||||||
|
*out = *in
|
||||||
|
out.TypeMeta = in.TypeMeta
|
||||||
|
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
||||||
|
out.Spec = in.Spec
|
||||||
|
in.Status.DeepCopyInto(&out.Status)
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Organization.
|
||||||
|
func (in *Organization) DeepCopy() *Organization {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(Organization)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||||
|
func (in *Organization) DeepCopyObject() runtime.Object {
|
||||||
|
if c := in.DeepCopy(); c != nil {
|
||||||
|
return c
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *OrganizationAdmin) DeepCopyInto(out *OrganizationAdmin) {
|
||||||
|
*out = *in
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OrganizationAdmin.
|
||||||
|
func (in *OrganizationAdmin) DeepCopy() *OrganizationAdmin {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(OrganizationAdmin)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *OrganizationList) DeepCopyInto(out *OrganizationList) {
|
||||||
|
*out = *in
|
||||||
|
out.TypeMeta = in.TypeMeta
|
||||||
|
in.ListMeta.DeepCopyInto(&out.ListMeta)
|
||||||
|
if in.Items != nil {
|
||||||
|
in, out := &in.Items, &out.Items
|
||||||
|
*out = make([]Organization, len(*in))
|
||||||
|
for i := range *in {
|
||||||
|
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OrganizationList.
|
||||||
|
func (in *OrganizationList) DeepCopy() *OrganizationList {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(OrganizationList)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||||
|
func (in *OrganizationList) DeepCopyObject() runtime.Object {
|
||||||
|
if c := in.DeepCopy(); c != nil {
|
||||||
|
return c
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *OrganizationRef) DeepCopyInto(out *OrganizationRef) {
|
||||||
|
*out = *in
|
||||||
|
out.ObjectReference = in.ObjectReference
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OrganizationRef.
|
||||||
|
func (in *OrganizationRef) DeepCopy() *OrganizationRef {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(OrganizationRef)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *OrganizationSpec) DeepCopyInto(out *OrganizationSpec) {
|
||||||
|
*out = *in
|
||||||
|
out.ZitadelClusterRef = in.ZitadelClusterRef
|
||||||
|
out.OrganizationAdmin = in.OrganizationAdmin
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OrganizationSpec.
|
||||||
|
func (in *OrganizationSpec) DeepCopy() *OrganizationSpec {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(OrganizationSpec)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *OrganizationStatus) DeepCopyInto(out *OrganizationStatus) {
|
||||||
|
*out = *in
|
||||||
|
if in.Conditions != nil {
|
||||||
|
in, out := &in.Conditions, &out.Conditions
|
||||||
|
*out = make([]v1.Condition, len(*in))
|
||||||
|
for i := range *in {
|
||||||
|
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OrganizationStatus.
|
||||||
|
func (in *OrganizationStatus) DeepCopy() *OrganizationStatus {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(OrganizationStatus)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *Password) DeepCopyInto(out *Password) {
|
||||||
|
*out = *in
|
||||||
|
in.SecretKeyRef.DeepCopyInto(&out.SecretKeyRef)
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Password.
|
||||||
|
func (in *Password) DeepCopy() *Password {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(Password)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *Project) DeepCopyInto(out *Project) {
|
||||||
|
*out = *in
|
||||||
|
out.TypeMeta = in.TypeMeta
|
||||||
|
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
||||||
|
in.Spec.DeepCopyInto(&out.Spec)
|
||||||
|
in.Status.DeepCopyInto(&out.Status)
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Project.
|
||||||
|
func (in *Project) DeepCopy() *Project {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(Project)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||||
|
func (in *Project) DeepCopyObject() runtime.Object {
|
||||||
|
if c := in.DeepCopy(); c != nil {
|
||||||
|
return c
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *ProjectList) DeepCopyInto(out *ProjectList) {
|
||||||
|
*out = *in
|
||||||
|
out.TypeMeta = in.TypeMeta
|
||||||
|
in.ListMeta.DeepCopyInto(&out.ListMeta)
|
||||||
|
if in.Items != nil {
|
||||||
|
in, out := &in.Items, &out.Items
|
||||||
|
*out = make([]Project, len(*in))
|
||||||
|
for i := range *in {
|
||||||
|
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProjectList.
|
||||||
|
func (in *ProjectList) DeepCopy() *ProjectList {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(ProjectList)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||||
|
func (in *ProjectList) DeepCopyObject() runtime.Object {
|
||||||
|
if c := in.DeepCopy(); c != nil {
|
||||||
|
return c
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *ProjectRef) DeepCopyInto(out *ProjectRef) {
|
||||||
|
*out = *in
|
||||||
|
out.ObjectReference = in.ObjectReference
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProjectRef.
|
||||||
|
func (in *ProjectRef) DeepCopy() *ProjectRef {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(ProjectRef)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *ProjectSpec) DeepCopyInto(out *ProjectSpec) {
|
||||||
|
*out = *in
|
||||||
|
out.OrganizationRef = in.OrganizationRef
|
||||||
|
if in.Roles != nil {
|
||||||
|
in, out := &in.Roles, &out.Roles
|
||||||
|
*out = make([]Role, len(*in))
|
||||||
|
copy(*out, *in)
|
||||||
|
}
|
||||||
|
if in.Grants != nil {
|
||||||
|
in, out := &in.Grants, &out.Grants
|
||||||
|
*out = make([]Grant, len(*in))
|
||||||
|
for i := range *in {
|
||||||
|
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProjectSpec.
|
||||||
|
func (in *ProjectSpec) DeepCopy() *ProjectSpec {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(ProjectSpec)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *ProjectStatus) DeepCopyInto(out *ProjectStatus) {
|
||||||
|
*out = *in
|
||||||
|
if in.Conditions != nil {
|
||||||
|
in, out := &in.Conditions, &out.Conditions
|
||||||
|
*out = make([]v1.Condition, len(*in))
|
||||||
|
for i := range *in {
|
||||||
|
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProjectStatus.
|
||||||
|
func (in *ProjectStatus) DeepCopy() *ProjectStatus {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(ProjectStatus)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *Role) DeepCopyInto(out *Role) {
|
||||||
|
*out = *in
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Role.
|
||||||
|
func (in *Role) DeepCopy() *Role {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(Role)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *SMTPConfig) DeepCopyInto(out *SMTPConfig) {
|
||||||
|
*out = *in
|
||||||
|
if in.User != nil {
|
||||||
|
in, out := &in.User, &out.User
|
||||||
|
*out = new(string)
|
||||||
|
**out = **in
|
||||||
|
}
|
||||||
|
if in.Password != nil {
|
||||||
|
in, out := &in.Password, &out.Password
|
||||||
|
*out = new(Password)
|
||||||
|
(*in).DeepCopyInto(*out)
|
||||||
|
}
|
||||||
|
if in.ReplyToAddress != nil {
|
||||||
|
in, out := &in.ReplyToAddress, &out.ReplyToAddress
|
||||||
|
*out = new(string)
|
||||||
|
**out = **in
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SMTPConfig.
|
||||||
|
func (in *SMTPConfig) DeepCopy() *SMTPConfig {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(SMTPConfig)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *UserGrant) DeepCopyInto(out *UserGrant) {
|
||||||
|
*out = *in
|
||||||
|
out.ProjectRef = in.ProjectRef
|
||||||
|
if in.RoleKeys != nil {
|
||||||
|
in, out := &in.RoleKeys, &out.RoleKeys
|
||||||
|
*out = make([]string, len(*in))
|
||||||
|
copy(*out, *in)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UserGrant.
|
||||||
|
func (in *UserGrant) DeepCopy() *UserGrant {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(UserGrant)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *ZitadelCluster) DeepCopyInto(out *ZitadelCluster) {
|
||||||
|
*out = *in
|
||||||
|
out.TypeMeta = in.TypeMeta
|
||||||
|
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
||||||
|
in.Spec.DeepCopyInto(&out.Spec)
|
||||||
|
in.Status.DeepCopyInto(&out.Status)
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ZitadelCluster.
|
||||||
|
func (in *ZitadelCluster) DeepCopy() *ZitadelCluster {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(ZitadelCluster)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||||
|
func (in *ZitadelCluster) DeepCopyObject() runtime.Object {
|
||||||
|
if c := in.DeepCopy(); c != nil {
|
||||||
|
return c
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *ZitadelClusterList) DeepCopyInto(out *ZitadelClusterList) {
|
||||||
|
*out = *in
|
||||||
|
out.TypeMeta = in.TypeMeta
|
||||||
|
in.ListMeta.DeepCopyInto(&out.ListMeta)
|
||||||
|
if in.Items != nil {
|
||||||
|
in, out := &in.Items, &out.Items
|
||||||
|
*out = make([]ZitadelCluster, len(*in))
|
||||||
|
for i := range *in {
|
||||||
|
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ZitadelClusterList.
|
||||||
|
func (in *ZitadelClusterList) DeepCopy() *ZitadelClusterList {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(ZitadelClusterList)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||||
|
func (in *ZitadelClusterList) DeepCopyObject() runtime.Object {
|
||||||
|
if c := in.DeepCopy(); c != nil {
|
||||||
|
return c
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *ZitadelClusterRef) DeepCopyInto(out *ZitadelClusterRef) {
|
||||||
|
*out = *in
|
||||||
|
out.ObjectReference = in.ObjectReference
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ZitadelClusterRef.
|
||||||
|
func (in *ZitadelClusterRef) DeepCopy() *ZitadelClusterRef {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(ZitadelClusterRef)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *ZitadelClusterSpec) DeepCopyInto(out *ZitadelClusterSpec) {
|
||||||
|
*out = *in
|
||||||
|
out.DomainSettings = in.DomainSettings
|
||||||
|
in.SMTPConfig.DeepCopyInto(&out.SMTPConfig)
|
||||||
|
out.Image = in.Image
|
||||||
|
in.Resources.DeepCopyInto(&out.Resources)
|
||||||
|
out.CrdbClusterRef = in.CrdbClusterRef
|
||||||
|
if in.PodAnnotations != nil {
|
||||||
|
in, out := &in.PodAnnotations, &out.PodAnnotations
|
||||||
|
*out = make(map[string]string, len(*in))
|
||||||
|
for key, val := range *in {
|
||||||
|
(*out)[key] = val
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if in.ServiceAnnotations != nil {
|
||||||
|
in, out := &in.ServiceAnnotations, &out.ServiceAnnotations
|
||||||
|
*out = make(map[string]string, len(*in))
|
||||||
|
for key, val := range *in {
|
||||||
|
(*out)[key] = val
|
||||||
|
}
|
||||||
|
}
|
||||||
|
out.RootTLSSecret = in.RootTLSSecret
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ZitadelClusterSpec.
|
||||||
|
func (in *ZitadelClusterSpec) DeepCopy() *ZitadelClusterSpec {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(ZitadelClusterSpec)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *ZitadelClusterStatus) DeepCopyInto(out *ZitadelClusterStatus) {
|
||||||
|
*out = *in
|
||||||
|
if in.Conditions != nil {
|
||||||
|
in, out := &in.Conditions, &out.Conditions
|
||||||
|
*out = make([]v1.Condition, len(*in))
|
||||||
|
for i := range *in {
|
||||||
|
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ZitadelClusterStatus.
|
||||||
|
func (in *ZitadelClusterStatus) DeepCopy() *ZitadelClusterStatus {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(ZitadelClusterStatus)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
156
src/cmd/main.go
Normal file
156
src/cmd/main.go
Normal file
@@ -0,0 +1,156 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2024.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"flag"
|
||||||
|
"os"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
|
||||||
|
// to ensure that exec-entrypoint and run can make use of them.
|
||||||
|
crdbv1alpha1 "github.com/cockroachdb/cockroach-operator/apis/v1alpha1"
|
||||||
|
"k8s.io/apimachinery/pkg/runtime"
|
||||||
|
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
|
||||||
|
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
|
||||||
|
_ "k8s.io/client-go/plugin/pkg/client/auth"
|
||||||
|
ctrl "sigs.k8s.io/controller-runtime"
|
||||||
|
"sigs.k8s.io/controller-runtime/pkg/healthz"
|
||||||
|
"sigs.k8s.io/controller-runtime/pkg/log/zap"
|
||||||
|
server "sigs.k8s.io/controller-runtime/pkg/metrics/server"
|
||||||
|
|
||||||
|
zitadelv1alpha1 "bitbucket.org/topmanage-software-engineering/zitadel-k8s-operator/src/api/v1alpha1"
|
||||||
|
"bitbucket.org/topmanage-software-engineering/zitadel-k8s-operator/src/internal/controller"
|
||||||
|
"bitbucket.org/topmanage-software-engineering/zitadel-k8s-operator/src/pkg/builder"
|
||||||
|
conditions "bitbucket.org/topmanage-software-engineering/zitadel-k8s-operator/src/pkg/condition"
|
||||||
|
"bitbucket.org/topmanage-software-engineering/zitadel-k8s-operator/src/pkg/controller/configmap"
|
||||||
|
"bitbucket.org/topmanage-software-engineering/zitadel-k8s-operator/src/pkg/controller/secret"
|
||||||
|
"bitbucket.org/topmanage-software-engineering/zitadel-k8s-operator/src/pkg/controller/service"
|
||||||
|
//+kubebuilder:scaffold:imports
|
||||||
|
)
|
||||||
|
|
||||||
|
var (
|
||||||
|
scheme = runtime.NewScheme()
|
||||||
|
setupLog = ctrl.Log.WithName("setup")
|
||||||
|
)
|
||||||
|
|
||||||
|
func init() {
|
||||||
|
utilruntime.Must(clientgoscheme.AddToScheme(scheme))
|
||||||
|
utilruntime.Must(crdbv1alpha1.AddToScheme(scheme))
|
||||||
|
utilruntime.Must(zitadelv1alpha1.AddToScheme(scheme))
|
||||||
|
//+kubebuilder:scaffold:scheme
|
||||||
|
}
|
||||||
|
|
||||||
|
func main() {
|
||||||
|
var metricsAddr string
|
||||||
|
var enableLeaderElection bool
|
||||||
|
var probeAddr string
|
||||||
|
flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
|
||||||
|
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
|
||||||
|
flag.BoolVar(&enableLeaderElection, "leader-elect", false,
|
||||||
|
"Enable leader election for controller manager. "+
|
||||||
|
"Enabling this will ensure there is only one active controller manager.")
|
||||||
|
opts := zap.Options{
|
||||||
|
Development: true,
|
||||||
|
}
|
||||||
|
opts.BindFlags(flag.CommandLine)
|
||||||
|
flag.Parse()
|
||||||
|
|
||||||
|
ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
|
||||||
|
|
||||||
|
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
|
||||||
|
Scheme: scheme,
|
||||||
|
Metrics: server.Options{BindAddress: metricsAddr},
|
||||||
|
HealthProbeBindAddress: probeAddr,
|
||||||
|
LeaderElection: enableLeaderElection,
|
||||||
|
LeaderElectionID: "88a0b43c.topmanage.com",
|
||||||
|
// LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily
|
||||||
|
// when the Manager ends. This requires the binary to immediately end when the
|
||||||
|
// Manager is stopped, otherwise, this setting is unsafe. Setting this significantly
|
||||||
|
// speeds up voluntary leader transitions as the new leader don't have to wait
|
||||||
|
// LeaseDuration time first.
|
||||||
|
//
|
||||||
|
// In the default scaffold provided, the program ends immediately after
|
||||||
|
// the manager stops, so would be fine to enable this option. However,
|
||||||
|
// if you are doing or is intended to do any operation such as perform cleanups
|
||||||
|
// after the manager stops then its usage might be unsafe.
|
||||||
|
// LeaderElectionReleaseOnCancel: true,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
setupLog.Error(err, "unable to start manager")
|
||||||
|
os.Exit(1)
|
||||||
|
}
|
||||||
|
client := mgr.GetClient()
|
||||||
|
scheme := mgr.GetScheme()
|
||||||
|
builder := builder.NewBuilder(scheme)
|
||||||
|
secretReconciler := secret.NewSecretReconciler(client, builder)
|
||||||
|
configmapReconciler := configmap.NewConfigMapReconciler(client, builder)
|
||||||
|
serviceReconciler := service.NewServiceReconciler(client)
|
||||||
|
refResolver := zitadelv1alpha1.NewRefResolver(client)
|
||||||
|
conditionReady := conditions.NewReady()
|
||||||
|
requeueZitadel := 30 * time.Second
|
||||||
|
if err = (&controller.ZitadelClusterReconciler{
|
||||||
|
Client: client,
|
||||||
|
Scheme: scheme,
|
||||||
|
ConditionReady: conditionReady,
|
||||||
|
Builder: builder,
|
||||||
|
RefResolver: refResolver,
|
||||||
|
SecretReconciler: secretReconciler,
|
||||||
|
ConfigMapReconciler: configmapReconciler,
|
||||||
|
ServiceReconciler: serviceReconciler,
|
||||||
|
}).SetupWithManager(mgr); err != nil {
|
||||||
|
setupLog.Error(err, "unable to create controller", "controller", "ZitadelCluster")
|
||||||
|
os.Exit(1)
|
||||||
|
}
|
||||||
|
if err = controller.NewOrganizationReconciler(client, refResolver, conditionReady, requeueZitadel).SetupWithManager(mgr); err != nil {
|
||||||
|
setupLog.Error(err, "unable to create controller", "controller", "Organization")
|
||||||
|
os.Exit(1)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err = controller.NewProjectReconciler(client, refResolver, conditionReady, requeueZitadel).SetupWithManager(mgr); err != nil {
|
||||||
|
setupLog.Error(err, "unable to create controller", "controller", "Project")
|
||||||
|
os.Exit(1)
|
||||||
|
}
|
||||||
|
if err = controller.NewOIDCAppReconciler(client, refResolver, builder, conditionReady, requeueZitadel).SetupWithManager(mgr); err != nil {
|
||||||
|
setupLog.Error(err, "unable to create controller", "controller", "OIDCApp")
|
||||||
|
os.Exit(1)
|
||||||
|
}
|
||||||
|
if err = controller.NewMachineUserReconciler(client, refResolver, builder, conditionReady, requeueZitadel).SetupWithManager(mgr); err != nil {
|
||||||
|
setupLog.Error(err, "unable to create controller", "controller", "MachineUser")
|
||||||
|
os.Exit(1)
|
||||||
|
}
|
||||||
|
if err = controller.NewAPIAppReconciler(client, refResolver, builder, conditionReady, requeueZitadel).SetupWithManager(mgr); err != nil {
|
||||||
|
setupLog.Error(err, "unable to create controller", "controller", "APIApp")
|
||||||
|
os.Exit(1)
|
||||||
|
}
|
||||||
|
//+kubebuilder:scaffold:builder
|
||||||
|
|
||||||
|
if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
|
||||||
|
setupLog.Error(err, "unable to set up health check")
|
||||||
|
os.Exit(1)
|
||||||
|
}
|
||||||
|
if err := mgr.AddReadyzCheck("readyz", healthz.Ping); err != nil {
|
||||||
|
setupLog.Error(err, "unable to set up ready check")
|
||||||
|
os.Exit(1)
|
||||||
|
}
|
||||||
|
|
||||||
|
setupLog.Info("starting manager")
|
||||||
|
if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {
|
||||||
|
setupLog.Error(err, "problem running manager")
|
||||||
|
os.Exit(1)
|
||||||
|
}
|
||||||
|
}
|
||||||
177
src/config/crd/bases/zitadel.topmanage.com_apiapps.yaml
Normal file
177
src/config/crd/bases/zitadel.topmanage.com_apiapps.yaml
Normal file
@@ -0,0 +1,177 @@
|
|||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
controller-gen.kubebuilder.io/version: v0.11.1
|
||||||
|
creationTimestamp: null
|
||||||
|
name: apiapps.zitadel.topmanage.com
|
||||||
|
spec:
|
||||||
|
group: zitadel.topmanage.com
|
||||||
|
names:
|
||||||
|
kind: APIApp
|
||||||
|
listKind: APIAppList
|
||||||
|
plural: apiapps
|
||||||
|
singular: apiapp
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: APIApp is the Schema for the apiapps API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: APIAppSpec defines the desired state of APIApp
|
||||||
|
properties:
|
||||||
|
authMethodType:
|
||||||
|
enum:
|
||||||
|
- API_AUTH_METHOD_TYPE_BASIC
|
||||||
|
- API_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT
|
||||||
|
type: string
|
||||||
|
projectRef:
|
||||||
|
description: 'INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
|
||||||
|
Important: Run "make" to regenerate code after modifying this file'
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead of
|
||||||
|
an entire object, this string should contain a valid JSON/Go
|
||||||
|
field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container within
|
||||||
|
a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that triggered
|
||||||
|
the event) or if no container name is specified "spec.containers[2]"
|
||||||
|
(container with index 2 in this pod). This syntax is chosen
|
||||||
|
only to have some well-defined way of referencing a part of
|
||||||
|
an object. TODO: this design is not final and this field is
|
||||||
|
subject to change in the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
required:
|
||||||
|
- authMethodType
|
||||||
|
- projectRef
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: APIAppStatus defines the observed state of APIApp
|
||||||
|
properties:
|
||||||
|
appId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
clientId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
conditions:
|
||||||
|
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
|
||||||
|
of cluster Important: Run "make" to regenerate code after modifying
|
||||||
|
this file'
|
||||||
|
items:
|
||||||
|
description: "Condition contains details for one aspect of the current
|
||||||
|
state of this API Resource. --- This struct is intended for direct
|
||||||
|
use as an array at the field path .status.conditions. For example,
|
||||||
|
\n type FooStatus struct{ // Represents the observations of a
|
||||||
|
foo's current state. // Known .status.conditions.type are: \"Available\",
|
||||||
|
\"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
|
||||||
|
// +listType=map // +listMapKey=type Conditions []metav1.Condition
|
||||||
|
`json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
|
||||||
|
protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
|
||||||
|
properties:
|
||||||
|
lastTransitionTime:
|
||||||
|
description: lastTransitionTime is the last time the condition
|
||||||
|
transitioned from one status to another. This should be when
|
||||||
|
the underlying condition changed. If that is not known, then
|
||||||
|
using the time when the API field changed is acceptable.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: message is a human readable message indicating
|
||||||
|
details about the transition. This may be an empty string.
|
||||||
|
maxLength: 32768
|
||||||
|
type: string
|
||||||
|
observedGeneration:
|
||||||
|
description: observedGeneration represents the .metadata.generation
|
||||||
|
that the condition was set based upon. For instance, if .metadata.generation
|
||||||
|
is currently 12, but the .status.conditions[x].observedGeneration
|
||||||
|
is 9, the condition is out of date with respect to the current
|
||||||
|
state of the instance.
|
||||||
|
format: int64
|
||||||
|
minimum: 0
|
||||||
|
type: integer
|
||||||
|
reason:
|
||||||
|
description: reason contains a programmatic identifier indicating
|
||||||
|
the reason for the condition's last transition. Producers
|
||||||
|
of specific condition types may define expected values and
|
||||||
|
meanings for this field, and whether the values are considered
|
||||||
|
a guaranteed API. The value should be a CamelCase string.
|
||||||
|
This field may not be empty.
|
||||||
|
maxLength: 1024
|
||||||
|
minLength: 1
|
||||||
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||||
|
type: string
|
||||||
|
status:
|
||||||
|
description: status of the condition, one of True, False, Unknown.
|
||||||
|
enum:
|
||||||
|
- "True"
|
||||||
|
- "False"
|
||||||
|
- Unknown
|
||||||
|
type: string
|
||||||
|
type:
|
||||||
|
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||||
|
--- Many .condition.type values are consistent across resources
|
||||||
|
like Available, but because arbitrary conditions can be useful
|
||||||
|
(see .node.status.conditions), the ability to deconflict is
|
||||||
|
important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||||
|
maxLength: 316
|
||||||
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- lastTransitionTime
|
||||||
|
- message
|
||||||
|
- reason
|
||||||
|
- status
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
keyId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- appId
|
||||||
|
- clientId
|
||||||
|
- keyId
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
225
src/config/crd/bases/zitadel.topmanage.com_machineusers.yaml
Normal file
225
src/config/crd/bases/zitadel.topmanage.com_machineusers.yaml
Normal file
@@ -0,0 +1,225 @@
|
|||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
controller-gen.kubebuilder.io/version: v0.11.1
|
||||||
|
creationTimestamp: null
|
||||||
|
name: machineusers.zitadel.topmanage.com
|
||||||
|
spec:
|
||||||
|
group: zitadel.topmanage.com
|
||||||
|
names:
|
||||||
|
kind: MachineUser
|
||||||
|
listKind: MachineUserList
|
||||||
|
plural: machineusers
|
||||||
|
singular: machineuser
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: MachineUser is the Schema for the machineusers API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: MachineUserSpec defines the desired state of MachineUser
|
||||||
|
properties:
|
||||||
|
accessTokenType:
|
||||||
|
enum:
|
||||||
|
- ACCESS_TOKEN_TYPE_BEARER
|
||||||
|
- ACCESS_TOKEN_TYPE_JWT
|
||||||
|
type: string
|
||||||
|
organizationRef:
|
||||||
|
description: 'INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
|
||||||
|
Important: Run "make" to regenerate code after modifying this file'
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead of
|
||||||
|
an entire object, this string should contain a valid JSON/Go
|
||||||
|
field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container within
|
||||||
|
a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that triggered
|
||||||
|
the event) or if no container name is specified "spec.containers[2]"
|
||||||
|
(container with index 2 in this pod). This syntax is chosen
|
||||||
|
only to have some well-defined way of referencing a part of
|
||||||
|
an object. TODO: this design is not final and this field is
|
||||||
|
subject to change in the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
userGrants:
|
||||||
|
items:
|
||||||
|
properties:
|
||||||
|
projectRef:
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead
|
||||||
|
of an entire object, this string should contain a valid
|
||||||
|
JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container
|
||||||
|
within a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that
|
||||||
|
triggered the event) or if no container name is specified
|
||||||
|
"spec.containers[2]" (container with index 2 in this pod).
|
||||||
|
This syntax is chosen only to have some well-defined way
|
||||||
|
of referencing a part of an object. TODO: this design
|
||||||
|
is not final and this field is subject to change in the
|
||||||
|
future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
roleKeys:
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- projectRef
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- accessTokenType
|
||||||
|
- organizationRef
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: MachineUserStatus defines the observed state of MachineUser
|
||||||
|
properties:
|
||||||
|
conditions:
|
||||||
|
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
|
||||||
|
of cluster Important: Run "make" to regenerate code after modifying
|
||||||
|
this file'
|
||||||
|
items:
|
||||||
|
description: "Condition contains details for one aspect of the current
|
||||||
|
state of this API Resource. --- This struct is intended for direct
|
||||||
|
use as an array at the field path .status.conditions. For example,
|
||||||
|
\n type FooStatus struct{ // Represents the observations of a
|
||||||
|
foo's current state. // Known .status.conditions.type are: \"Available\",
|
||||||
|
\"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
|
||||||
|
// +listType=map // +listMapKey=type Conditions []metav1.Condition
|
||||||
|
`json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
|
||||||
|
protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
|
||||||
|
properties:
|
||||||
|
lastTransitionTime:
|
||||||
|
description: lastTransitionTime is the last time the condition
|
||||||
|
transitioned from one status to another. This should be when
|
||||||
|
the underlying condition changed. If that is not known, then
|
||||||
|
using the time when the API field changed is acceptable.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: message is a human readable message indicating
|
||||||
|
details about the transition. This may be an empty string.
|
||||||
|
maxLength: 32768
|
||||||
|
type: string
|
||||||
|
observedGeneration:
|
||||||
|
description: observedGeneration represents the .metadata.generation
|
||||||
|
that the condition was set based upon. For instance, if .metadata.generation
|
||||||
|
is currently 12, but the .status.conditions[x].observedGeneration
|
||||||
|
is 9, the condition is out of date with respect to the current
|
||||||
|
state of the instance.
|
||||||
|
format: int64
|
||||||
|
minimum: 0
|
||||||
|
type: integer
|
||||||
|
reason:
|
||||||
|
description: reason contains a programmatic identifier indicating
|
||||||
|
the reason for the condition's last transition. Producers
|
||||||
|
of specific condition types may define expected values and
|
||||||
|
meanings for this field, and whether the values are considered
|
||||||
|
a guaranteed API. The value should be a CamelCase string.
|
||||||
|
This field may not be empty.
|
||||||
|
maxLength: 1024
|
||||||
|
minLength: 1
|
||||||
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||||
|
type: string
|
||||||
|
status:
|
||||||
|
description: status of the condition, one of True, False, Unknown.
|
||||||
|
enum:
|
||||||
|
- "True"
|
||||||
|
- "False"
|
||||||
|
- Unknown
|
||||||
|
type: string
|
||||||
|
type:
|
||||||
|
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||||
|
--- Many .condition.type values are consistent across resources
|
||||||
|
like Available, but because arbitrary conditions can be useful
|
||||||
|
(see .node.status.conditions), the ability to deconflict is
|
||||||
|
important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||||
|
maxLength: 316
|
||||||
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- lastTransitionTime
|
||||||
|
- message
|
||||||
|
- reason
|
||||||
|
- status
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
keyId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
patId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
userId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- keyId
|
||||||
|
- patId
|
||||||
|
- userId
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
241
src/config/crd/bases/zitadel.topmanage.com_oidcapps.yaml
Normal file
241
src/config/crd/bases/zitadel.topmanage.com_oidcapps.yaml
Normal file
@@ -0,0 +1,241 @@
|
|||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
controller-gen.kubebuilder.io/version: v0.11.1
|
||||||
|
creationTimestamp: null
|
||||||
|
name: oidcapps.zitadel.topmanage.com
|
||||||
|
spec:
|
||||||
|
group: zitadel.topmanage.com
|
||||||
|
names:
|
||||||
|
kind: OIDCApp
|
||||||
|
listKind: OIDCAppList
|
||||||
|
plural: oidcapps
|
||||||
|
singular: oidcapp
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: OIDCApp is the Schema for the oidcapps API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: OIDCAppSpec defines the desired state of OIDCApp
|
||||||
|
properties:
|
||||||
|
accessTokenRoleAssertion:
|
||||||
|
type: boolean
|
||||||
|
accessTokenType:
|
||||||
|
enum:
|
||||||
|
- OIDC_TOKEN_TYPE_BEARER
|
||||||
|
- OIDC_TOKEN_TYPE_JWT
|
||||||
|
type: string
|
||||||
|
additionalOrigins:
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
appType:
|
||||||
|
enum:
|
||||||
|
- OIDC_APP_TYPE_WEB
|
||||||
|
- OIDC_APP_TYPE_USER_AGENT
|
||||||
|
- OIDC_APP_TYPE_NATIVE
|
||||||
|
type: string
|
||||||
|
authMethodType:
|
||||||
|
enum:
|
||||||
|
- OIDC_AUTH_METHOD_TYPE_BASIC
|
||||||
|
- OIDC_AUTH_METHOD_TYPE_POST
|
||||||
|
- OIDC_AUTH_METHOD_TYPE_NONE
|
||||||
|
- OIDC_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT
|
||||||
|
type: string
|
||||||
|
clockSkew:
|
||||||
|
format: duration
|
||||||
|
type: string
|
||||||
|
devMode:
|
||||||
|
type: boolean
|
||||||
|
grantTypes:
|
||||||
|
items:
|
||||||
|
enum:
|
||||||
|
- OIDC_GRANT_TYPE_AUTHORIZATION_CODE
|
||||||
|
- OIDC_GRANT_TYPE_IMPLICIT
|
||||||
|
- OIDC_GRANT_TYPE_REFRESH_TOKEN
|
||||||
|
- OIDC_GRANT_TYPE_DEVICE_CODE
|
||||||
|
- OIDC_GRANT_TYPE_TOKEN_EXCHANGE
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
idTokenRoleAssertion:
|
||||||
|
type: boolean
|
||||||
|
idTokenUserinfoAssertion:
|
||||||
|
type: boolean
|
||||||
|
postLogoutRedirectUris:
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
projectRef:
|
||||||
|
description: 'INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
|
||||||
|
Important: Run "make" to regenerate code after modifying this file'
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead of
|
||||||
|
an entire object, this string should contain a valid JSON/Go
|
||||||
|
field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container within
|
||||||
|
a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that triggered
|
||||||
|
the event) or if no container name is specified "spec.containers[2]"
|
||||||
|
(container with index 2 in this pod). This syntax is chosen
|
||||||
|
only to have some well-defined way of referencing a part of
|
||||||
|
an object. TODO: this design is not final and this field is
|
||||||
|
subject to change in the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
redirectUris:
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
responseTypes:
|
||||||
|
items:
|
||||||
|
enum:
|
||||||
|
- OIDC_RESPONSE_TYPE_CODE
|
||||||
|
- OIDC_RESPONSE_TYPE_ID_TOKEN
|
||||||
|
- OIDC_RESPONSE_TYPE_ID_TOKEN_TOKEN
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
skipNativeAppSuccessPage:
|
||||||
|
type: boolean
|
||||||
|
required:
|
||||||
|
- accessTokenRoleAssertion
|
||||||
|
- accessTokenType
|
||||||
|
- appType
|
||||||
|
- authMethodType
|
||||||
|
- clockSkew
|
||||||
|
- devMode
|
||||||
|
- grantTypes
|
||||||
|
- idTokenRoleAssertion
|
||||||
|
- idTokenUserinfoAssertion
|
||||||
|
- postLogoutRedirectUris
|
||||||
|
- projectRef
|
||||||
|
- redirectUris
|
||||||
|
- responseTypes
|
||||||
|
- skipNativeAppSuccessPage
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: OIDCAppStatus defines the observed state of OIDCApp
|
||||||
|
properties:
|
||||||
|
appId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
clientId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
conditions:
|
||||||
|
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
|
||||||
|
of cluster Important: Run "make" to regenerate code after modifying
|
||||||
|
this file'
|
||||||
|
items:
|
||||||
|
description: "Condition contains details for one aspect of the current
|
||||||
|
state of this API Resource. --- This struct is intended for direct
|
||||||
|
use as an array at the field path .status.conditions. For example,
|
||||||
|
\n type FooStatus struct{ // Represents the observations of a
|
||||||
|
foo's current state. // Known .status.conditions.type are: \"Available\",
|
||||||
|
\"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
|
||||||
|
// +listType=map // +listMapKey=type Conditions []metav1.Condition
|
||||||
|
`json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
|
||||||
|
protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
|
||||||
|
properties:
|
||||||
|
lastTransitionTime:
|
||||||
|
description: lastTransitionTime is the last time the condition
|
||||||
|
transitioned from one status to another. This should be when
|
||||||
|
the underlying condition changed. If that is not known, then
|
||||||
|
using the time when the API field changed is acceptable.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: message is a human readable message indicating
|
||||||
|
details about the transition. This may be an empty string.
|
||||||
|
maxLength: 32768
|
||||||
|
type: string
|
||||||
|
observedGeneration:
|
||||||
|
description: observedGeneration represents the .metadata.generation
|
||||||
|
that the condition was set based upon. For instance, if .metadata.generation
|
||||||
|
is currently 12, but the .status.conditions[x].observedGeneration
|
||||||
|
is 9, the condition is out of date with respect to the current
|
||||||
|
state of the instance.
|
||||||
|
format: int64
|
||||||
|
minimum: 0
|
||||||
|
type: integer
|
||||||
|
reason:
|
||||||
|
description: reason contains a programmatic identifier indicating
|
||||||
|
the reason for the condition's last transition. Producers
|
||||||
|
of specific condition types may define expected values and
|
||||||
|
meanings for this field, and whether the values are considered
|
||||||
|
a guaranteed API. The value should be a CamelCase string.
|
||||||
|
This field may not be empty.
|
||||||
|
maxLength: 1024
|
||||||
|
minLength: 1
|
||||||
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||||
|
type: string
|
||||||
|
status:
|
||||||
|
description: status of the condition, one of True, False, Unknown.
|
||||||
|
enum:
|
||||||
|
- "True"
|
||||||
|
- "False"
|
||||||
|
- Unknown
|
||||||
|
type: string
|
||||||
|
type:
|
||||||
|
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||||
|
--- Many .condition.type values are consistent across resources
|
||||||
|
like Available, but because arbitrary conditions can be useful
|
||||||
|
(see .node.status.conditions), the ability to deconflict is
|
||||||
|
important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||||
|
maxLength: 316
|
||||||
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- lastTransitionTime
|
||||||
|
- message
|
||||||
|
- reason
|
||||||
|
- status
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- appId
|
||||||
|
- clientId
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
184
src/config/crd/bases/zitadel.topmanage.com_organizations.yaml
Normal file
184
src/config/crd/bases/zitadel.topmanage.com_organizations.yaml
Normal file
@@ -0,0 +1,184 @@
|
|||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
controller-gen.kubebuilder.io/version: v0.11.1
|
||||||
|
creationTimestamp: null
|
||||||
|
name: organizations.zitadel.topmanage.com
|
||||||
|
spec:
|
||||||
|
group: zitadel.topmanage.com
|
||||||
|
names:
|
||||||
|
kind: Organization
|
||||||
|
listKind: OrganizationList
|
||||||
|
plural: organizations
|
||||||
|
singular: organization
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: Organization is the Schema for the organizations API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: OrganizationSpec defines the desired state of Organization
|
||||||
|
properties:
|
||||||
|
organizationAdmin:
|
||||||
|
properties:
|
||||||
|
email:
|
||||||
|
type: string
|
||||||
|
firstName:
|
||||||
|
type: string
|
||||||
|
lastName:
|
||||||
|
type: string
|
||||||
|
userName:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- email
|
||||||
|
- firstName
|
||||||
|
- lastName
|
||||||
|
- userName
|
||||||
|
type: object
|
||||||
|
zitadelClusterRef:
|
||||||
|
description: 'INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
|
||||||
|
Important: Run "make" to regenerate code after modifying this file'
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead of
|
||||||
|
an entire object, this string should contain a valid JSON/Go
|
||||||
|
field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container within
|
||||||
|
a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that triggered
|
||||||
|
the event) or if no container name is specified "spec.containers[2]"
|
||||||
|
(container with index 2 in this pod). This syntax is chosen
|
||||||
|
only to have some well-defined way of referencing a part of
|
||||||
|
an object. TODO: this design is not final and this field is
|
||||||
|
subject to change in the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
required:
|
||||||
|
- organizationAdmin
|
||||||
|
- zitadelClusterRef
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: OrganizationStatus defines the observed state of Organization
|
||||||
|
properties:
|
||||||
|
adminId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
conditions:
|
||||||
|
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
|
||||||
|
of cluster Important: Run "make" to regenerate code after modifying
|
||||||
|
this file Conditions for the Database object.'
|
||||||
|
items:
|
||||||
|
description: "Condition contains details for one aspect of the current
|
||||||
|
state of this API Resource. --- This struct is intended for direct
|
||||||
|
use as an array at the field path .status.conditions. For example,
|
||||||
|
\n type FooStatus struct{ // Represents the observations of a
|
||||||
|
foo's current state. // Known .status.conditions.type are: \"Available\",
|
||||||
|
\"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
|
||||||
|
// +listType=map // +listMapKey=type Conditions []metav1.Condition
|
||||||
|
`json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
|
||||||
|
protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
|
||||||
|
properties:
|
||||||
|
lastTransitionTime:
|
||||||
|
description: lastTransitionTime is the last time the condition
|
||||||
|
transitioned from one status to another. This should be when
|
||||||
|
the underlying condition changed. If that is not known, then
|
||||||
|
using the time when the API field changed is acceptable.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: message is a human readable message indicating
|
||||||
|
details about the transition. This may be an empty string.
|
||||||
|
maxLength: 32768
|
||||||
|
type: string
|
||||||
|
observedGeneration:
|
||||||
|
description: observedGeneration represents the .metadata.generation
|
||||||
|
that the condition was set based upon. For instance, if .metadata.generation
|
||||||
|
is currently 12, but the .status.conditions[x].observedGeneration
|
||||||
|
is 9, the condition is out of date with respect to the current
|
||||||
|
state of the instance.
|
||||||
|
format: int64
|
||||||
|
minimum: 0
|
||||||
|
type: integer
|
||||||
|
reason:
|
||||||
|
description: reason contains a programmatic identifier indicating
|
||||||
|
the reason for the condition's last transition. Producers
|
||||||
|
of specific condition types may define expected values and
|
||||||
|
meanings for this field, and whether the values are considered
|
||||||
|
a guaranteed API. The value should be a CamelCase string.
|
||||||
|
This field may not be empty.
|
||||||
|
maxLength: 1024
|
||||||
|
minLength: 1
|
||||||
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||||
|
type: string
|
||||||
|
status:
|
||||||
|
description: status of the condition, one of True, False, Unknown.
|
||||||
|
enum:
|
||||||
|
- "True"
|
||||||
|
- "False"
|
||||||
|
- Unknown
|
||||||
|
type: string
|
||||||
|
type:
|
||||||
|
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||||
|
--- Many .condition.type values are consistent across resources
|
||||||
|
like Available, but because arbitrary conditions can be useful
|
||||||
|
(see .node.status.conditions), the ability to deconflict is
|
||||||
|
important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||||
|
maxLength: 316
|
||||||
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- lastTransitionTime
|
||||||
|
- message
|
||||||
|
- reason
|
||||||
|
- status
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
orgId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- adminId
|
||||||
|
- orgId
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
234
src/config/crd/bases/zitadel.topmanage.com_projects.yaml
Normal file
234
src/config/crd/bases/zitadel.topmanage.com_projects.yaml
Normal file
@@ -0,0 +1,234 @@
|
|||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
controller-gen.kubebuilder.io/version: v0.11.1
|
||||||
|
creationTimestamp: null
|
||||||
|
name: projects.zitadel.topmanage.com
|
||||||
|
spec:
|
||||||
|
group: zitadel.topmanage.com
|
||||||
|
names:
|
||||||
|
kind: Project
|
||||||
|
listKind: ProjectList
|
||||||
|
plural: projects
|
||||||
|
singular: project
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: Project is the Schema for the projects API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: ProjectSpec defines the desired state of Project
|
||||||
|
properties:
|
||||||
|
grants:
|
||||||
|
items:
|
||||||
|
properties:
|
||||||
|
organizationRef:
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead
|
||||||
|
of an entire object, this string should contain a valid
|
||||||
|
JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container
|
||||||
|
within a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that
|
||||||
|
triggered the event) or if no container name is specified
|
||||||
|
"spec.containers[2]" (container with index 2 in this pod).
|
||||||
|
This syntax is chosen only to have some well-defined way
|
||||||
|
of referencing a part of an object. TODO: this design
|
||||||
|
is not final and this field is subject to change in the
|
||||||
|
future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
roleKeys:
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- organizationRef
|
||||||
|
- roleKeys
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
hasProjectCheck:
|
||||||
|
type: boolean
|
||||||
|
organizationRef:
|
||||||
|
description: 'INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
|
||||||
|
Important: Run "make" to regenerate code after modifying this file
|
||||||
|
https://zitadel.com/docs/apis/resources/mgmt/management-service-add-project'
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead of
|
||||||
|
an entire object, this string should contain a valid JSON/Go
|
||||||
|
field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container within
|
||||||
|
a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that triggered
|
||||||
|
the event) or if no container name is specified "spec.containers[2]"
|
||||||
|
(container with index 2 in this pod). This syntax is chosen
|
||||||
|
only to have some well-defined way of referencing a part of
|
||||||
|
an object. TODO: this design is not final and this field is
|
||||||
|
subject to change in the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
projectRoleAssertion:
|
||||||
|
type: boolean
|
||||||
|
projectRoleCheck:
|
||||||
|
type: boolean
|
||||||
|
roles:
|
||||||
|
items:
|
||||||
|
properties:
|
||||||
|
displayName:
|
||||||
|
type: string
|
||||||
|
group:
|
||||||
|
type: string
|
||||||
|
key:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- displayName
|
||||||
|
- group
|
||||||
|
- key
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- organizationRef
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: ProjectStatus defines the observed state of Project
|
||||||
|
properties:
|
||||||
|
conditions:
|
||||||
|
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
|
||||||
|
of cluster Important: Run "make" to regenerate code after modifying
|
||||||
|
this file Conditions for the Database object.'
|
||||||
|
items:
|
||||||
|
description: "Condition contains details for one aspect of the current
|
||||||
|
state of this API Resource. --- This struct is intended for direct
|
||||||
|
use as an array at the field path .status.conditions. For example,
|
||||||
|
\n type FooStatus struct{ // Represents the observations of a
|
||||||
|
foo's current state. // Known .status.conditions.type are: \"Available\",
|
||||||
|
\"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
|
||||||
|
// +listType=map // +listMapKey=type Conditions []metav1.Condition
|
||||||
|
`json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
|
||||||
|
protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
|
||||||
|
properties:
|
||||||
|
lastTransitionTime:
|
||||||
|
description: lastTransitionTime is the last time the condition
|
||||||
|
transitioned from one status to another. This should be when
|
||||||
|
the underlying condition changed. If that is not known, then
|
||||||
|
using the time when the API field changed is acceptable.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: message is a human readable message indicating
|
||||||
|
details about the transition. This may be an empty string.
|
||||||
|
maxLength: 32768
|
||||||
|
type: string
|
||||||
|
observedGeneration:
|
||||||
|
description: observedGeneration represents the .metadata.generation
|
||||||
|
that the condition was set based upon. For instance, if .metadata.generation
|
||||||
|
is currently 12, but the .status.conditions[x].observedGeneration
|
||||||
|
is 9, the condition is out of date with respect to the current
|
||||||
|
state of the instance.
|
||||||
|
format: int64
|
||||||
|
minimum: 0
|
||||||
|
type: integer
|
||||||
|
reason:
|
||||||
|
description: reason contains a programmatic identifier indicating
|
||||||
|
the reason for the condition's last transition. Producers
|
||||||
|
of specific condition types may define expected values and
|
||||||
|
meanings for this field, and whether the values are considered
|
||||||
|
a guaranteed API. The value should be a CamelCase string.
|
||||||
|
This field may not be empty.
|
||||||
|
maxLength: 1024
|
||||||
|
minLength: 1
|
||||||
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||||
|
type: string
|
||||||
|
status:
|
||||||
|
description: status of the condition, one of True, False, Unknown.
|
||||||
|
enum:
|
||||||
|
- "True"
|
||||||
|
- "False"
|
||||||
|
- Unknown
|
||||||
|
type: string
|
||||||
|
type:
|
||||||
|
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||||
|
--- Many .condition.type values are consistent across resources
|
||||||
|
like Available, but because arbitrary conditions can be useful
|
||||||
|
(see .node.status.conditions), the ability to deconflict is
|
||||||
|
important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||||
|
maxLength: 316
|
||||||
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- lastTransitionTime
|
||||||
|
- message
|
||||||
|
- reason
|
||||||
|
- status
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
projectId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- projectId
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
348
src/config/crd/bases/zitadel.topmanage.com_zitadelclusters.yaml
Normal file
348
src/config/crd/bases/zitadel.topmanage.com_zitadelclusters.yaml
Normal file
@@ -0,0 +1,348 @@
|
|||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
controller-gen.kubebuilder.io/version: v0.11.1
|
||||||
|
creationTimestamp: null
|
||||||
|
name: zitadelclusters.zitadel.topmanage.com
|
||||||
|
spec:
|
||||||
|
group: zitadel.topmanage.com
|
||||||
|
names:
|
||||||
|
kind: ZitadelCluster
|
||||||
|
listKind: ZitadelClusterList
|
||||||
|
plural: zitadelclusters
|
||||||
|
singular: zitadelcluster
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: ZitadelCluster is the Schema for the zitadelclusters API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: ZitadelClusterSpec defines the desired state of ZitadelCluster
|
||||||
|
properties:
|
||||||
|
crdbClusterRef:
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead of
|
||||||
|
an entire object, this string should contain a valid JSON/Go
|
||||||
|
field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container within
|
||||||
|
a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that triggered
|
||||||
|
the event) or if no container name is specified "spec.containers[2]"
|
||||||
|
(container with index 2 in this pod). This syntax is chosen
|
||||||
|
only to have some well-defined way of referencing a part of
|
||||||
|
an object. TODO: this design is not final and this field is
|
||||||
|
subject to change in the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
domainSettings:
|
||||||
|
properties:
|
||||||
|
smtpSenderAddressMatchesInstanceDomain:
|
||||||
|
default: true
|
||||||
|
type: boolean
|
||||||
|
userLoginMustBeDomain:
|
||||||
|
default: true
|
||||||
|
type: boolean
|
||||||
|
validateOrgDomains:
|
||||||
|
default: true
|
||||||
|
type: boolean
|
||||||
|
required:
|
||||||
|
- smtpSenderAddressMatchesInstanceDomain
|
||||||
|
- userLoginMustBeDomain
|
||||||
|
- validateOrgDomains
|
||||||
|
type: object
|
||||||
|
externalPort:
|
||||||
|
default: 443
|
||||||
|
format: int64
|
||||||
|
type: integer
|
||||||
|
externalSecure:
|
||||||
|
default: true
|
||||||
|
type: boolean
|
||||||
|
firstOrgName:
|
||||||
|
default: DEFAULT
|
||||||
|
description: 'INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
|
||||||
|
Important: Run "make" to regenerate code after modifying this file'
|
||||||
|
type: string
|
||||||
|
host:
|
||||||
|
type: string
|
||||||
|
image:
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
type: string
|
||||||
|
tag:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
- tag
|
||||||
|
type: object
|
||||||
|
podAnnotations:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: PodAnnotations to add to the Pods metadata.
|
||||||
|
type: object
|
||||||
|
purpose:
|
||||||
|
enum:
|
||||||
|
- demo
|
||||||
|
- trial
|
||||||
|
- staging
|
||||||
|
- productive
|
||||||
|
- testing
|
||||||
|
type: string
|
||||||
|
replicas:
|
||||||
|
default: 3
|
||||||
|
format: int32
|
||||||
|
type: integer
|
||||||
|
resources:
|
||||||
|
description: ResourceRequirements describes the compute resource requirements.
|
||||||
|
properties:
|
||||||
|
claims:
|
||||||
|
description: "Claims lists the names of resources, defined in
|
||||||
|
spec.resourceClaims, that are used by this container. \n This
|
||||||
|
is an alpha field and requires enabling the DynamicResourceAllocation
|
||||||
|
feature gate. \n This field is immutable. It can only be set
|
||||||
|
for containers."
|
||||||
|
items:
|
||||||
|
description: ResourceClaim references one entry in PodSpec.ResourceClaims.
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
description: Name must match the name of one entry in pod.spec.resourceClaims
|
||||||
|
of the Pod where this field is used. It makes that resource
|
||||||
|
available inside a container.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
x-kubernetes-list-map-keys:
|
||||||
|
- name
|
||||||
|
x-kubernetes-list-type: map
|
||||||
|
limits:
|
||||||
|
additionalProperties:
|
||||||
|
anyOf:
|
||||||
|
- type: integer
|
||||||
|
- type: string
|
||||||
|
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||||
|
x-kubernetes-int-or-string: true
|
||||||
|
description: 'Limits describes the maximum amount of compute resources
|
||||||
|
allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
|
||||||
|
type: object
|
||||||
|
requests:
|
||||||
|
additionalProperties:
|
||||||
|
anyOf:
|
||||||
|
- type: integer
|
||||||
|
- type: string
|
||||||
|
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||||
|
x-kubernetes-int-or-string: true
|
||||||
|
description: 'Requests describes the minimum amount of compute
|
||||||
|
resources required. If Requests is omitted for a container,
|
||||||
|
it defaults to Limits if that is explicitly specified, otherwise
|
||||||
|
to an implementation-defined value. Requests cannot exceed Limits.
|
||||||
|
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
rootTLSSecret:
|
||||||
|
description: SecretReference represents a Secret Reference. It has
|
||||||
|
enough information to retrieve secret in any namespace
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
description: name is unique within a namespace to reference a
|
||||||
|
secret resource.
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: namespace defines the space within which the secret
|
||||||
|
name must be unique.
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
serviceAnnotations:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: ServiceAnnotations to add to the service metadata.
|
||||||
|
type: object
|
||||||
|
smtpConfig:
|
||||||
|
properties:
|
||||||
|
host:
|
||||||
|
type: string
|
||||||
|
password:
|
||||||
|
properties:
|
||||||
|
secretRef:
|
||||||
|
description: SecretKeySelector selects a key of a Secret.
|
||||||
|
properties:
|
||||||
|
key:
|
||||||
|
description: The key of the secret to select from. Must
|
||||||
|
be a valid secret key.
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||||
|
TODO: Add other useful fields. apiVersion, kind, uid?'
|
||||||
|
type: string
|
||||||
|
optional:
|
||||||
|
description: Specify whether the Secret or its key must
|
||||||
|
be defined
|
||||||
|
type: boolean
|
||||||
|
required:
|
||||||
|
- key
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
required:
|
||||||
|
- secretRef
|
||||||
|
type: object
|
||||||
|
replyToAddress:
|
||||||
|
type: string
|
||||||
|
senderAddress:
|
||||||
|
type: string
|
||||||
|
senderName:
|
||||||
|
type: string
|
||||||
|
tls:
|
||||||
|
default: true
|
||||||
|
type: boolean
|
||||||
|
user:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- host
|
||||||
|
- senderAddress
|
||||||
|
- senderName
|
||||||
|
- tls
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- crdbClusterRef
|
||||||
|
- domainSettings
|
||||||
|
- externalPort
|
||||||
|
- externalSecure
|
||||||
|
- firstOrgName
|
||||||
|
- host
|
||||||
|
- image
|
||||||
|
- purpose
|
||||||
|
- resources
|
||||||
|
- rootTLSSecret
|
||||||
|
- smtpConfig
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: ZitadelClusterStatus defines the observed state of ZitadelCluster
|
||||||
|
properties:
|
||||||
|
conditions:
|
||||||
|
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
|
||||||
|
of cluster Important: Run "make" to regenerate code after modifying
|
||||||
|
this file'
|
||||||
|
items:
|
||||||
|
description: "Condition contains details for one aspect of the current
|
||||||
|
state of this API Resource. --- This struct is intended for direct
|
||||||
|
use as an array at the field path .status.conditions. For example,
|
||||||
|
\n type FooStatus struct{ // Represents the observations of a
|
||||||
|
foo's current state. // Known .status.conditions.type are: \"Available\",
|
||||||
|
\"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
|
||||||
|
// +listType=map // +listMapKey=type Conditions []metav1.Condition
|
||||||
|
`json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
|
||||||
|
protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
|
||||||
|
properties:
|
||||||
|
lastTransitionTime:
|
||||||
|
description: lastTransitionTime is the last time the condition
|
||||||
|
transitioned from one status to another. This should be when
|
||||||
|
the underlying condition changed. If that is not known, then
|
||||||
|
using the time when the API field changed is acceptable.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: message is a human readable message indicating
|
||||||
|
details about the transition. This may be an empty string.
|
||||||
|
maxLength: 32768
|
||||||
|
type: string
|
||||||
|
observedGeneration:
|
||||||
|
description: observedGeneration represents the .metadata.generation
|
||||||
|
that the condition was set based upon. For instance, if .metadata.generation
|
||||||
|
is currently 12, but the .status.conditions[x].observedGeneration
|
||||||
|
is 9, the condition is out of date with respect to the current
|
||||||
|
state of the instance.
|
||||||
|
format: int64
|
||||||
|
minimum: 0
|
||||||
|
type: integer
|
||||||
|
reason:
|
||||||
|
description: reason contains a programmatic identifier indicating
|
||||||
|
the reason for the condition's last transition. Producers
|
||||||
|
of specific condition types may define expected values and
|
||||||
|
meanings for this field, and whether the values are considered
|
||||||
|
a guaranteed API. The value should be a CamelCase string.
|
||||||
|
This field may not be empty.
|
||||||
|
maxLength: 1024
|
||||||
|
minLength: 1
|
||||||
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||||
|
type: string
|
||||||
|
status:
|
||||||
|
description: status of the condition, one of True, False, Unknown.
|
||||||
|
enum:
|
||||||
|
- "True"
|
||||||
|
- "False"
|
||||||
|
- Unknown
|
||||||
|
type: string
|
||||||
|
type:
|
||||||
|
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||||
|
--- Many .condition.type values are consistent across resources
|
||||||
|
like Available, but because arbitrary conditions can be useful
|
||||||
|
(see .node.status.conditions), the ability to deconflict is
|
||||||
|
important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
||||||
|
maxLength: 316
|
||||||
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- lastTransitionTime
|
||||||
|
- message
|
||||||
|
- reason
|
||||||
|
- status
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
defaultInstanceId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
replicas:
|
||||||
|
default: 3
|
||||||
|
format: int32
|
||||||
|
type: integer
|
||||||
|
smtpProviderId:
|
||||||
|
default: ""
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- defaultInstanceId
|
||||||
|
- smtpProviderId
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
36
src/config/crd/kustomization.yaml
Normal file
36
src/config/crd/kustomization.yaml
Normal file
@@ -0,0 +1,36 @@
|
|||||||
|
# This kustomization.yaml is not intended to be run by itself,
|
||||||
|
# since it depends on service name and namespace that are out of this kustomize package.
|
||||||
|
# It should be run by config/default
|
||||||
|
resources:
|
||||||
|
- bases/zitadel.topmanage.com_zitadelclusters.yaml
|
||||||
|
- bases/zitadel.topmanage.com_organizations.yaml
|
||||||
|
- bases/zitadel.topmanage.com_projects.yaml
|
||||||
|
- bases/zitadel.topmanage.com_oidcapps.yaml
|
||||||
|
- bases/zitadel.topmanage.com_machineusers.yaml
|
||||||
|
- bases/zitadel.topmanage.com_apiapps.yaml
|
||||||
|
#+kubebuilder:scaffold:crdkustomizeresource
|
||||||
|
|
||||||
|
patchesStrategicMerge:
|
||||||
|
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix.
|
||||||
|
# patches here are for enabling the conversion webhook for each CRD
|
||||||
|
#- patches/webhook_in_zitadelclusters.yaml
|
||||||
|
#- patches/webhook_in_organizations.yaml
|
||||||
|
#- patches/webhook_in_projects.yaml
|
||||||
|
#- patches/webhook_in_oidcapps.yaml
|
||||||
|
#- patches/webhook_in_machineusers.yaml
|
||||||
|
#- patches/webhook_in_apiapps.yaml
|
||||||
|
#+kubebuilder:scaffold:crdkustomizewebhookpatch
|
||||||
|
|
||||||
|
# [CERTMANAGER] To enable cert-manager, uncomment all the sections with [CERTMANAGER] prefix.
|
||||||
|
# patches here are for enabling the CA injection for each CRD
|
||||||
|
#- patches/cainjection_in_zitadelclusters.yaml
|
||||||
|
#- patches/cainjection_in_organizations.yaml
|
||||||
|
#- patches/cainjection_in_projects.yaml
|
||||||
|
#- patches/cainjection_in_oidcapps.yaml
|
||||||
|
#- patches/cainjection_in_machineusers.yaml
|
||||||
|
#- patches/cainjection_in_apiapps.yaml
|
||||||
|
#+kubebuilder:scaffold:crdkustomizecainjectionpatch
|
||||||
|
|
||||||
|
# the following config is for teaching kustomize how to do kustomization for CRDs.
|
||||||
|
configurations:
|
||||||
|
- kustomizeconfig.yaml
|
||||||
19
src/config/crd/kustomizeconfig.yaml
Normal file
19
src/config/crd/kustomizeconfig.yaml
Normal file
@@ -0,0 +1,19 @@
|
|||||||
|
# This file is for teaching kustomize how to substitute name and namespace reference in CRD
|
||||||
|
nameReference:
|
||||||
|
- kind: Service
|
||||||
|
version: v1
|
||||||
|
fieldSpecs:
|
||||||
|
- kind: CustomResourceDefinition
|
||||||
|
version: v1
|
||||||
|
group: apiextensions.k8s.io
|
||||||
|
path: spec/conversion/webhook/clientConfig/service/name
|
||||||
|
|
||||||
|
namespace:
|
||||||
|
- kind: CustomResourceDefinition
|
||||||
|
version: v1
|
||||||
|
group: apiextensions.k8s.io
|
||||||
|
path: spec/conversion/webhook/clientConfig/service/namespace
|
||||||
|
create: false
|
||||||
|
|
||||||
|
varReference:
|
||||||
|
- path: metadata/annotations
|
||||||
7
src/config/crd/patches/cainjection_in_apiapps.yaml
Normal file
7
src/config/crd/patches/cainjection_in_apiapps.yaml
Normal file
@@ -0,0 +1,7 @@
|
|||||||
|
# The following patch adds a directive for certmanager to inject CA into the CRD
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
cert-manager.io/inject-ca-from: CERTIFICATE_NAMESPACE/CERTIFICATE_NAME
|
||||||
|
name: apiapps.zitadel.topmanage.com
|
||||||
7
src/config/crd/patches/cainjection_in_machineusers.yaml
Normal file
7
src/config/crd/patches/cainjection_in_machineusers.yaml
Normal file
@@ -0,0 +1,7 @@
|
|||||||
|
# The following patch adds a directive for certmanager to inject CA into the CRD
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
cert-manager.io/inject-ca-from: CERTIFICATE_NAMESPACE/CERTIFICATE_NAME
|
||||||
|
name: machineusers.zitadel.topmanage.com
|
||||||
7
src/config/crd/patches/cainjection_in_oidcapps.yaml
Normal file
7
src/config/crd/patches/cainjection_in_oidcapps.yaml
Normal file
@@ -0,0 +1,7 @@
|
|||||||
|
# The following patch adds a directive for certmanager to inject CA into the CRD
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
cert-manager.io/inject-ca-from: CERTIFICATE_NAMESPACE/CERTIFICATE_NAME
|
||||||
|
name: oidcapps.zitadel.topmanage.com
|
||||||
7
src/config/crd/patches/cainjection_in_organizations.yaml
Normal file
7
src/config/crd/patches/cainjection_in_organizations.yaml
Normal file
@@ -0,0 +1,7 @@
|
|||||||
|
# The following patch adds a directive for certmanager to inject CA into the CRD
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
cert-manager.io/inject-ca-from: CERTIFICATE_NAMESPACE/CERTIFICATE_NAME
|
||||||
|
name: organizations.zitadel.topmanage.com
|
||||||
7
src/config/crd/patches/cainjection_in_projects.yaml
Normal file
7
src/config/crd/patches/cainjection_in_projects.yaml
Normal file
@@ -0,0 +1,7 @@
|
|||||||
|
# The following patch adds a directive for certmanager to inject CA into the CRD
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
cert-manager.io/inject-ca-from: CERTIFICATE_NAMESPACE/CERTIFICATE_NAME
|
||||||
|
name: projects.zitadel.topmanage.com
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
# The following patch adds a directive for certmanager to inject CA into the CRD
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
cert-manager.io/inject-ca-from: CERTIFICATE_NAMESPACE/CERTIFICATE_NAME
|
||||||
|
name: zitadelclusters.zitadel.topmanage.com
|
||||||
16
src/config/crd/patches/webhook_in_apiapps.yaml
Normal file
16
src/config/crd/patches/webhook_in_apiapps.yaml
Normal file
@@ -0,0 +1,16 @@
|
|||||||
|
# The following patch enables a conversion webhook for the CRD
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
name: apiapps.zitadel.topmanage.com
|
||||||
|
spec:
|
||||||
|
conversion:
|
||||||
|
strategy: Webhook
|
||||||
|
webhook:
|
||||||
|
clientConfig:
|
||||||
|
service:
|
||||||
|
namespace: system
|
||||||
|
name: webhook-service
|
||||||
|
path: /convert
|
||||||
|
conversionReviewVersions:
|
||||||
|
- v1
|
||||||
16
src/config/crd/patches/webhook_in_machineusers.yaml
Normal file
16
src/config/crd/patches/webhook_in_machineusers.yaml
Normal file
@@ -0,0 +1,16 @@
|
|||||||
|
# The following patch enables a conversion webhook for the CRD
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
name: machineusers.zitadel.topmanage.com
|
||||||
|
spec:
|
||||||
|
conversion:
|
||||||
|
strategy: Webhook
|
||||||
|
webhook:
|
||||||
|
clientConfig:
|
||||||
|
service:
|
||||||
|
namespace: system
|
||||||
|
name: webhook-service
|
||||||
|
path: /convert
|
||||||
|
conversionReviewVersions:
|
||||||
|
- v1
|
||||||
16
src/config/crd/patches/webhook_in_oidcapps.yaml
Normal file
16
src/config/crd/patches/webhook_in_oidcapps.yaml
Normal file
@@ -0,0 +1,16 @@
|
|||||||
|
# The following patch enables a conversion webhook for the CRD
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
name: oidcapps.zitadel.topmanage.com
|
||||||
|
spec:
|
||||||
|
conversion:
|
||||||
|
strategy: Webhook
|
||||||
|
webhook:
|
||||||
|
clientConfig:
|
||||||
|
service:
|
||||||
|
namespace: system
|
||||||
|
name: webhook-service
|
||||||
|
path: /convert
|
||||||
|
conversionReviewVersions:
|
||||||
|
- v1
|
||||||
16
src/config/crd/patches/webhook_in_organizations.yaml
Normal file
16
src/config/crd/patches/webhook_in_organizations.yaml
Normal file
@@ -0,0 +1,16 @@
|
|||||||
|
# The following patch enables a conversion webhook for the CRD
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
name: organizations.zitadel.topmanage.com
|
||||||
|
spec:
|
||||||
|
conversion:
|
||||||
|
strategy: Webhook
|
||||||
|
webhook:
|
||||||
|
clientConfig:
|
||||||
|
service:
|
||||||
|
namespace: system
|
||||||
|
name: webhook-service
|
||||||
|
path: /convert
|
||||||
|
conversionReviewVersions:
|
||||||
|
- v1
|
||||||
16
src/config/crd/patches/webhook_in_projects.yaml
Normal file
16
src/config/crd/patches/webhook_in_projects.yaml
Normal file
@@ -0,0 +1,16 @@
|
|||||||
|
# The following patch enables a conversion webhook for the CRD
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
name: projects.zitadel.topmanage.com
|
||||||
|
spec:
|
||||||
|
conversion:
|
||||||
|
strategy: Webhook
|
||||||
|
webhook:
|
||||||
|
clientConfig:
|
||||||
|
service:
|
||||||
|
namespace: system
|
||||||
|
name: webhook-service
|
||||||
|
path: /convert
|
||||||
|
conversionReviewVersions:
|
||||||
|
- v1
|
||||||
16
src/config/crd/patches/webhook_in_zitadelclusters.yaml
Normal file
16
src/config/crd/patches/webhook_in_zitadelclusters.yaml
Normal file
@@ -0,0 +1,16 @@
|
|||||||
|
# The following patch enables a conversion webhook for the CRD
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
name: zitadelclusters.zitadel.topmanage.com
|
||||||
|
spec:
|
||||||
|
conversion:
|
||||||
|
strategy: Webhook
|
||||||
|
webhook:
|
||||||
|
clientConfig:
|
||||||
|
service:
|
||||||
|
namespace: system
|
||||||
|
name: webhook-service
|
||||||
|
path: /convert
|
||||||
|
conversionReviewVersions:
|
||||||
|
- v1
|
||||||
144
src/config/default/kustomization.yaml
Normal file
144
src/config/default/kustomization.yaml
Normal file
@@ -0,0 +1,144 @@
|
|||||||
|
# Adds namespace to all resources.
|
||||||
|
namespace: src-system
|
||||||
|
|
||||||
|
# Value of this field is prepended to the
|
||||||
|
# names of all resources, e.g. a deployment named
|
||||||
|
# "wordpress" becomes "alices-wordpress".
|
||||||
|
# Note that it should also match with the prefix (text before '-') of the namespace
|
||||||
|
# field above.
|
||||||
|
namePrefix: src-
|
||||||
|
|
||||||
|
# Labels to add to all resources and selectors.
|
||||||
|
#labels:
|
||||||
|
#- includeSelectors: true
|
||||||
|
# pairs:
|
||||||
|
# someName: someValue
|
||||||
|
|
||||||
|
resources:
|
||||||
|
- ../crd
|
||||||
|
- ../rbac
|
||||||
|
- ../manager
|
||||||
|
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
|
||||||
|
# crd/kustomization.yaml
|
||||||
|
#- ../webhook
|
||||||
|
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
|
||||||
|
#- ../certmanager
|
||||||
|
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
|
||||||
|
#- ../prometheus
|
||||||
|
|
||||||
|
patchesStrategicMerge:
|
||||||
|
# Protect the /metrics endpoint by putting it behind auth.
|
||||||
|
# If you want your controller-manager to expose the /metrics
|
||||||
|
# endpoint w/o any authn/z, please comment the following line.
|
||||||
|
- manager_auth_proxy_patch.yaml
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
|
||||||
|
# crd/kustomization.yaml
|
||||||
|
#- manager_webhook_patch.yaml
|
||||||
|
|
||||||
|
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'.
|
||||||
|
# Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA injection in the admission webhooks.
|
||||||
|
# 'CERTMANAGER' needs to be enabled to use ca injection
|
||||||
|
#- webhookcainjection_patch.yaml
|
||||||
|
|
||||||
|
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
|
||||||
|
# Uncomment the following replacements to add the cert-manager CA injection annotations
|
||||||
|
#replacements:
|
||||||
|
# - source: # Add cert-manager annotation to ValidatingWebhookConfiguration, MutatingWebhookConfiguration and CRDs
|
||||||
|
# kind: Certificate
|
||||||
|
# group: cert-manager.io
|
||||||
|
# version: v1
|
||||||
|
# name: serving-cert # this name should match the one in certificate.yaml
|
||||||
|
# fieldPath: .metadata.namespace # namespace of the certificate CR
|
||||||
|
# targets:
|
||||||
|
# - select:
|
||||||
|
# kind: ValidatingWebhookConfiguration
|
||||||
|
# fieldPaths:
|
||||||
|
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
|
||||||
|
# options:
|
||||||
|
# delimiter: '/'
|
||||||
|
# index: 0
|
||||||
|
# create: true
|
||||||
|
# - select:
|
||||||
|
# kind: MutatingWebhookConfiguration
|
||||||
|
# fieldPaths:
|
||||||
|
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
|
||||||
|
# options:
|
||||||
|
# delimiter: '/'
|
||||||
|
# index: 0
|
||||||
|
# create: true
|
||||||
|
# - select:
|
||||||
|
# kind: CustomResourceDefinition
|
||||||
|
# fieldPaths:
|
||||||
|
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
|
||||||
|
# options:
|
||||||
|
# delimiter: '/'
|
||||||
|
# index: 0
|
||||||
|
# create: true
|
||||||
|
# - source:
|
||||||
|
# kind: Certificate
|
||||||
|
# group: cert-manager.io
|
||||||
|
# version: v1
|
||||||
|
# name: serving-cert # this name should match the one in certificate.yaml
|
||||||
|
# fieldPath: .metadata.name
|
||||||
|
# targets:
|
||||||
|
# - select:
|
||||||
|
# kind: ValidatingWebhookConfiguration
|
||||||
|
# fieldPaths:
|
||||||
|
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
|
||||||
|
# options:
|
||||||
|
# delimiter: '/'
|
||||||
|
# index: 1
|
||||||
|
# create: true
|
||||||
|
# - select:
|
||||||
|
# kind: MutatingWebhookConfiguration
|
||||||
|
# fieldPaths:
|
||||||
|
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
|
||||||
|
# options:
|
||||||
|
# delimiter: '/'
|
||||||
|
# index: 1
|
||||||
|
# create: true
|
||||||
|
# - select:
|
||||||
|
# kind: CustomResourceDefinition
|
||||||
|
# fieldPaths:
|
||||||
|
# - .metadata.annotations.[cert-manager.io/inject-ca-from]
|
||||||
|
# options:
|
||||||
|
# delimiter: '/'
|
||||||
|
# index: 1
|
||||||
|
# create: true
|
||||||
|
# - source: # Add cert-manager annotation to the webhook Service
|
||||||
|
# kind: Service
|
||||||
|
# version: v1
|
||||||
|
# name: webhook-service
|
||||||
|
# fieldPath: .metadata.name # namespace of the service
|
||||||
|
# targets:
|
||||||
|
# - select:
|
||||||
|
# kind: Certificate
|
||||||
|
# group: cert-manager.io
|
||||||
|
# version: v1
|
||||||
|
# fieldPaths:
|
||||||
|
# - .spec.dnsNames.0
|
||||||
|
# - .spec.dnsNames.1
|
||||||
|
# options:
|
||||||
|
# delimiter: '.'
|
||||||
|
# index: 0
|
||||||
|
# create: true
|
||||||
|
# - source:
|
||||||
|
# kind: Service
|
||||||
|
# version: v1
|
||||||
|
# name: webhook-service
|
||||||
|
# fieldPath: .metadata.namespace # namespace of the service
|
||||||
|
# targets:
|
||||||
|
# - select:
|
||||||
|
# kind: Certificate
|
||||||
|
# group: cert-manager.io
|
||||||
|
# version: v1
|
||||||
|
# fieldPaths:
|
||||||
|
# - .spec.dnsNames.0
|
||||||
|
# - .spec.dnsNames.1
|
||||||
|
# options:
|
||||||
|
# delimiter: '.'
|
||||||
|
# index: 1
|
||||||
|
# create: true
|
||||||
55
src/config/default/manager_auth_proxy_patch.yaml
Normal file
55
src/config/default/manager_auth_proxy_patch.yaml
Normal file
@@ -0,0 +1,55 @@
|
|||||||
|
# This patch inject a sidecar container which is a HTTP proxy for the
|
||||||
|
# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: controller-manager
|
||||||
|
namespace: system
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
spec:
|
||||||
|
affinity:
|
||||||
|
nodeAffinity:
|
||||||
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
nodeSelectorTerms:
|
||||||
|
- matchExpressions:
|
||||||
|
- key: kubernetes.io/arch
|
||||||
|
operator: In
|
||||||
|
values:
|
||||||
|
- amd64
|
||||||
|
- arm64
|
||||||
|
- ppc64le
|
||||||
|
- s390x
|
||||||
|
- key: kubernetes.io/os
|
||||||
|
operator: In
|
||||||
|
values:
|
||||||
|
- linux
|
||||||
|
containers:
|
||||||
|
- name: kube-rbac-proxy
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.13.1
|
||||||
|
args:
|
||||||
|
- "--secure-listen-address=0.0.0.0:8443"
|
||||||
|
- "--upstream=http://127.0.0.1:8080/"
|
||||||
|
- "--logtostderr=true"
|
||||||
|
- "--v=0"
|
||||||
|
ports:
|
||||||
|
- containerPort: 8443
|
||||||
|
protocol: TCP
|
||||||
|
name: https
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 128Mi
|
||||||
|
requests:
|
||||||
|
cpu: 5m
|
||||||
|
memory: 64Mi
|
||||||
|
- name: manager
|
||||||
|
args:
|
||||||
|
- "--health-probe-bind-address=:8081"
|
||||||
|
- "--metrics-bind-address=127.0.0.1:8080"
|
||||||
|
- "--leader-elect"
|
||||||
10
src/config/default/manager_config_patch.yaml
Normal file
10
src/config/default/manager_config_patch.yaml
Normal file
@@ -0,0 +1,10 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: controller-manager
|
||||||
|
namespace: system
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: manager
|
||||||
2
src/config/manager/kustomization.yaml
Normal file
2
src/config/manager/kustomization.yaml
Normal file
@@ -0,0 +1,2 @@
|
|||||||
|
resources:
|
||||||
|
- manager.yaml
|
||||||
102
src/config/manager/manager.yaml
Normal file
102
src/config/manager/manager.yaml
Normal file
@@ -0,0 +1,102 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
control-plane: controller-manager
|
||||||
|
app.kubernetes.io/name: namespace
|
||||||
|
app.kubernetes.io/instance: system
|
||||||
|
app.kubernetes.io/component: manager
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: system
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: controller-manager
|
||||||
|
namespace: system
|
||||||
|
labels:
|
||||||
|
control-plane: controller-manager
|
||||||
|
app.kubernetes.io/name: deployment
|
||||||
|
app.kubernetes.io/instance: controller-manager
|
||||||
|
app.kubernetes.io/component: manager
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
control-plane: controller-manager
|
||||||
|
replicas: 1
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
kubectl.kubernetes.io/default-container: manager
|
||||||
|
labels:
|
||||||
|
control-plane: controller-manager
|
||||||
|
spec:
|
||||||
|
# TODO(user): Uncomment the following code to configure the nodeAffinity expression
|
||||||
|
# according to the platforms which are supported by your solution.
|
||||||
|
# It is considered best practice to support multiple architectures. You can
|
||||||
|
# build your manager image using the makefile target docker-buildx.
|
||||||
|
# affinity:
|
||||||
|
# nodeAffinity:
|
||||||
|
# requiredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
# nodeSelectorTerms:
|
||||||
|
# - matchExpressions:
|
||||||
|
# - key: kubernetes.io/arch
|
||||||
|
# operator: In
|
||||||
|
# values:
|
||||||
|
# - amd64
|
||||||
|
# - arm64
|
||||||
|
# - ppc64le
|
||||||
|
# - s390x
|
||||||
|
# - key: kubernetes.io/os
|
||||||
|
# operator: In
|
||||||
|
# values:
|
||||||
|
# - linux
|
||||||
|
securityContext:
|
||||||
|
runAsNonRoot: true
|
||||||
|
# TODO(user): For common cases that do not require escalating privileges
|
||||||
|
# it is recommended to ensure that all your Pods/Containers are restrictive.
|
||||||
|
# More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
|
||||||
|
# Please uncomment the following code if your project does NOT have to work on old Kubernetes
|
||||||
|
# versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ).
|
||||||
|
# seccompProfile:
|
||||||
|
# type: RuntimeDefault
|
||||||
|
containers:
|
||||||
|
- command:
|
||||||
|
- /manager
|
||||||
|
args:
|
||||||
|
- --leader-elect
|
||||||
|
image: controller:latest
|
||||||
|
name: manager
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /healthz
|
||||||
|
port: 8081
|
||||||
|
initialDelaySeconds: 15
|
||||||
|
periodSeconds: 20
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /readyz
|
||||||
|
port: 8081
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 10
|
||||||
|
# TODO(user): Configure the resources accordingly based on the project requirements.
|
||||||
|
# More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 128Mi
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 64Mi
|
||||||
|
serviceAccountName: controller-manager
|
||||||
|
terminationGracePeriodSeconds: 10
|
||||||
28
src/config/manifests/kustomization.yaml
Normal file
28
src/config/manifests/kustomization.yaml
Normal file
@@ -0,0 +1,28 @@
|
|||||||
|
# These resources constitute the fully configured set of manifests
|
||||||
|
# used to generate the 'manifests/' directory in a bundle.
|
||||||
|
resources:
|
||||||
|
- bases/src.clusterserviceversion.yaml
|
||||||
|
- ../default
|
||||||
|
- ../samples
|
||||||
|
- ../scorecard
|
||||||
|
|
||||||
|
# [WEBHOOK] To enable webhooks, uncomment all the sections with [WEBHOOK] prefix.
|
||||||
|
# Do NOT uncomment sections with prefix [CERTMANAGER], as OLM does not support cert-manager.
|
||||||
|
# These patches remove the unnecessary "cert" volume and its manager container volumeMount.
|
||||||
|
#patchesJson6902:
|
||||||
|
#- target:
|
||||||
|
# group: apps
|
||||||
|
# version: v1
|
||||||
|
# kind: Deployment
|
||||||
|
# name: controller-manager
|
||||||
|
# namespace: system
|
||||||
|
# patch: |-
|
||||||
|
# # Remove the manager container's "cert" volumeMount, since OLM will create and mount a set of certs.
|
||||||
|
# # Update the indices in this path if adding or removing containers/volumeMounts in the manager's Deployment.
|
||||||
|
# - op: remove
|
||||||
|
|
||||||
|
# path: /spec/template/spec/containers/0/volumeMounts/0
|
||||||
|
# # Remove the "cert" volume, since OLM will create and mount a set of certs.
|
||||||
|
# # Update the indices in this path if adding or removing volumes in the manager's Deployment.
|
||||||
|
# - op: remove
|
||||||
|
# path: /spec/template/spec/volumes/0
|
||||||
2
src/config/prometheus/kustomization.yaml
Normal file
2
src/config/prometheus/kustomization.yaml
Normal file
@@ -0,0 +1,2 @@
|
|||||||
|
resources:
|
||||||
|
- monitor.yaml
|
||||||
26
src/config/prometheus/monitor.yaml
Normal file
26
src/config/prometheus/monitor.yaml
Normal file
@@ -0,0 +1,26 @@
|
|||||||
|
|
||||||
|
# Prometheus Monitor Service (Metrics)
|
||||||
|
apiVersion: monitoring.coreos.com/v1
|
||||||
|
kind: ServiceMonitor
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
control-plane: controller-manager
|
||||||
|
app.kubernetes.io/name: servicemonitor
|
||||||
|
app.kubernetes.io/instance: controller-manager-metrics-monitor
|
||||||
|
app.kubernetes.io/component: metrics
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: controller-manager-metrics-monitor
|
||||||
|
namespace: system
|
||||||
|
spec:
|
||||||
|
endpoints:
|
||||||
|
- path: /metrics
|
||||||
|
port: https
|
||||||
|
scheme: https
|
||||||
|
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||||
|
tlsConfig:
|
||||||
|
insecureSkipVerify: true
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
control-plane: controller-manager
|
||||||
31
src/config/rbac/apiapp_editor_role.yaml
Normal file
31
src/config/rbac/apiapp_editor_role.yaml
Normal file
@@ -0,0 +1,31 @@
|
|||||||
|
# permissions for end users to edit apiapps.
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: clusterrole
|
||||||
|
app.kubernetes.io/instance: apiapp-editor-role
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: apiapp-editor-role
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- apiapps
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- apiapps/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
27
src/config/rbac/apiapp_viewer_role.yaml
Normal file
27
src/config/rbac/apiapp_viewer_role.yaml
Normal file
@@ -0,0 +1,27 @@
|
|||||||
|
# permissions for end users to view apiapps.
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: clusterrole
|
||||||
|
app.kubernetes.io/instance: apiapp-viewer-role
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: apiapp-viewer-role
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- apiapps
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- apiapps/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
16
src/config/rbac/auth_proxy_client_clusterrole.yaml
Normal file
16
src/config/rbac/auth_proxy_client_clusterrole.yaml
Normal file
@@ -0,0 +1,16 @@
|
|||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: clusterrole
|
||||||
|
app.kubernetes.io/instance: metrics-reader
|
||||||
|
app.kubernetes.io/component: kube-rbac-proxy
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: metrics-reader
|
||||||
|
rules:
|
||||||
|
- nonResourceURLs:
|
||||||
|
- "/metrics"
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
24
src/config/rbac/auth_proxy_role.yaml
Normal file
24
src/config/rbac/auth_proxy_role.yaml
Normal file
@@ -0,0 +1,24 @@
|
|||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: clusterrole
|
||||||
|
app.kubernetes.io/instance: proxy-role
|
||||||
|
app.kubernetes.io/component: kube-rbac-proxy
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: proxy-role
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- authentication.k8s.io
|
||||||
|
resources:
|
||||||
|
- tokenreviews
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- apiGroups:
|
||||||
|
- authorization.k8s.io
|
||||||
|
resources:
|
||||||
|
- subjectaccessreviews
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
19
src/config/rbac/auth_proxy_role_binding.yaml
Normal file
19
src/config/rbac/auth_proxy_role_binding.yaml
Normal file
@@ -0,0 +1,19 @@
|
|||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: clusterrolebinding
|
||||||
|
app.kubernetes.io/instance: proxy-rolebinding
|
||||||
|
app.kubernetes.io/component: kube-rbac-proxy
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: proxy-rolebinding
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: proxy-role
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: controller-manager
|
||||||
|
namespace: system
|
||||||
21
src/config/rbac/auth_proxy_service.yaml
Normal file
21
src/config/rbac/auth_proxy_service.yaml
Normal file
@@ -0,0 +1,21 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
control-plane: controller-manager
|
||||||
|
app.kubernetes.io/name: service
|
||||||
|
app.kubernetes.io/instance: controller-manager-metrics-service
|
||||||
|
app.kubernetes.io/component: kube-rbac-proxy
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: controller-manager-metrics-service
|
||||||
|
namespace: system
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- name: https
|
||||||
|
port: 8443
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: https
|
||||||
|
selector:
|
||||||
|
control-plane: controller-manager
|
||||||
18
src/config/rbac/kustomization.yaml
Normal file
18
src/config/rbac/kustomization.yaml
Normal file
@@ -0,0 +1,18 @@
|
|||||||
|
resources:
|
||||||
|
# All RBAC will be applied under this service account in
|
||||||
|
# the deployment namespace. You may comment out this resource
|
||||||
|
# if your manager will use a service account that exists at
|
||||||
|
# runtime. Be sure to update RoleBinding and ClusterRoleBinding
|
||||||
|
# subjects if changing service account names.
|
||||||
|
- service_account.yaml
|
||||||
|
- role.yaml
|
||||||
|
- role_binding.yaml
|
||||||
|
- leader_election_role.yaml
|
||||||
|
- leader_election_role_binding.yaml
|
||||||
|
# Comment the following 4 lines if you want to disable
|
||||||
|
# the auth proxy (https://github.com/brancz/kube-rbac-proxy)
|
||||||
|
# which protects your /metrics endpoint.
|
||||||
|
- auth_proxy_service.yaml
|
||||||
|
- auth_proxy_role.yaml
|
||||||
|
- auth_proxy_role_binding.yaml
|
||||||
|
- auth_proxy_client_clusterrole.yaml
|
||||||
44
src/config/rbac/leader_election_role.yaml
Normal file
44
src/config/rbac/leader_election_role.yaml
Normal file
@@ -0,0 +1,44 @@
|
|||||||
|
# permissions to do leader election.
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: role
|
||||||
|
app.kubernetes.io/instance: leader-election-role
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: leader-election-role
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- create
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- delete
|
||||||
|
- apiGroups:
|
||||||
|
- coordination.k8s.io
|
||||||
|
resources:
|
||||||
|
- leases
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- create
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- delete
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- patch
|
||||||
19
src/config/rbac/leader_election_role_binding.yaml
Normal file
19
src/config/rbac/leader_election_role_binding.yaml
Normal file
@@ -0,0 +1,19 @@
|
|||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: rolebinding
|
||||||
|
app.kubernetes.io/instance: leader-election-rolebinding
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: leader-election-rolebinding
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: leader-election-role
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: controller-manager
|
||||||
|
namespace: system
|
||||||
31
src/config/rbac/machineuser_editor_role.yaml
Normal file
31
src/config/rbac/machineuser_editor_role.yaml
Normal file
@@ -0,0 +1,31 @@
|
|||||||
|
# permissions for end users to edit machineusers.
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: clusterrole
|
||||||
|
app.kubernetes.io/instance: machineuser-editor-role
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: machineuser-editor-role
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- machineusers
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- machineusers/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
27
src/config/rbac/machineuser_viewer_role.yaml
Normal file
27
src/config/rbac/machineuser_viewer_role.yaml
Normal file
@@ -0,0 +1,27 @@
|
|||||||
|
# permissions for end users to view machineusers.
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: clusterrole
|
||||||
|
app.kubernetes.io/instance: machineuser-viewer-role
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: machineuser-viewer-role
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- machineusers
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- machineusers/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
31
src/config/rbac/oidcapp_editor_role.yaml
Normal file
31
src/config/rbac/oidcapp_editor_role.yaml
Normal file
@@ -0,0 +1,31 @@
|
|||||||
|
# permissions for end users to edit oidcapps.
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: clusterrole
|
||||||
|
app.kubernetes.io/instance: oidcapp-editor-role
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: oidcapp-editor-role
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- oidcapps
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- oidcapps/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
27
src/config/rbac/oidcapp_viewer_role.yaml
Normal file
27
src/config/rbac/oidcapp_viewer_role.yaml
Normal file
@@ -0,0 +1,27 @@
|
|||||||
|
# permissions for end users to view oidcapps.
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: clusterrole
|
||||||
|
app.kubernetes.io/instance: oidcapp-viewer-role
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: oidcapp-viewer-role
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- oidcapps
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- oidcapps/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
31
src/config/rbac/organization_editor_role.yaml
Normal file
31
src/config/rbac/organization_editor_role.yaml
Normal file
@@ -0,0 +1,31 @@
|
|||||||
|
# permissions for end users to edit organizations.
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: clusterrole
|
||||||
|
app.kubernetes.io/instance: organization-editor-role
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: organization-editor-role
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- organizations
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- organizations/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
27
src/config/rbac/organization_viewer_role.yaml
Normal file
27
src/config/rbac/organization_viewer_role.yaml
Normal file
@@ -0,0 +1,27 @@
|
|||||||
|
# permissions for end users to view organizations.
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: clusterrole
|
||||||
|
app.kubernetes.io/instance: organization-viewer-role
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: organization-viewer-role
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- organizations
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- organizations/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
31
src/config/rbac/project_editor_role.yaml
Normal file
31
src/config/rbac/project_editor_role.yaml
Normal file
@@ -0,0 +1,31 @@
|
|||||||
|
# permissions for end users to edit projects.
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: clusterrole
|
||||||
|
app.kubernetes.io/instance: project-editor-role
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: project-editor-role
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- projects
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- projects/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
27
src/config/rbac/project_viewer_role.yaml
Normal file
27
src/config/rbac/project_viewer_role.yaml
Normal file
@@ -0,0 +1,27 @@
|
|||||||
|
# permissions for end users to view projects.
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: clusterrole
|
||||||
|
app.kubernetes.io/instance: project-viewer-role
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: project-viewer-role
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- projects
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- projects/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
328
src/config/rbac/role.yaml
Normal file
328
src/config/rbac/role.yaml
Normal file
@@ -0,0 +1,328 @@
|
|||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
creationTimestamp: null
|
||||||
|
name: manager-role
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- endpoints
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- endpoints/restricted
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- pods
|
||||||
|
verbs:
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- serviceaccounts
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- services
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- apps
|
||||||
|
resources:
|
||||||
|
- deployments
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- batch
|
||||||
|
resources:
|
||||||
|
- jobs
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- certificates.k8s.io
|
||||||
|
resources:
|
||||||
|
- certificatesigningrequests
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- certificates.k8s.io
|
||||||
|
resources:
|
||||||
|
- certificatesigningrequests/approval
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- certificates.k8s.io
|
||||||
|
resources:
|
||||||
|
- certificatesigningrequests/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- crdb.cockroachlabs.com
|
||||||
|
resources:
|
||||||
|
- crdbclusters
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- crdb.cockroachlabs.com
|
||||||
|
resources:
|
||||||
|
- crdbclusters/finalizers
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- crdb.cockroachlabs.com
|
||||||
|
resources:
|
||||||
|
- crdbclusters/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- policy
|
||||||
|
resources:
|
||||||
|
- poddisruptionbudgets
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- rbac.authorization.k8s.io
|
||||||
|
resources:
|
||||||
|
- clusterrolebindings
|
||||||
|
- rolebindings
|
||||||
|
- roles
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- apiapps
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- apiapps/finalizers
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- apiapps/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- machineusers
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- machineusers/finalizers
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- machineusers/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- oidcapps
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- oidcapps/finalizers
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- oidcapps/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- organizations
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- organizations/finalizers
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- organizations/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- projects
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- projects/finalizers
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- projects/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- zitadelclusters
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- zitadelclusters/finalizers
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- zitadelclusters/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
19
src/config/rbac/role_binding.yaml
Normal file
19
src/config/rbac/role_binding.yaml
Normal file
@@ -0,0 +1,19 @@
|
|||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: clusterrolebinding
|
||||||
|
app.kubernetes.io/instance: manager-rolebinding
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: manager-rolebinding
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: manager-role
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: controller-manager
|
||||||
|
namespace: system
|
||||||
12
src/config/rbac/service_account.yaml
Normal file
12
src/config/rbac/service_account.yaml
Normal file
@@ -0,0 +1,12 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: serviceaccount
|
||||||
|
app.kubernetes.io/instance: controller-manager-sa
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: controller-manager
|
||||||
|
namespace: system
|
||||||
31
src/config/rbac/zitadelcluster_editor_role.yaml
Normal file
31
src/config/rbac/zitadelcluster_editor_role.yaml
Normal file
@@ -0,0 +1,31 @@
|
|||||||
|
# permissions for end users to edit zitadelclusters.
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: clusterrole
|
||||||
|
app.kubernetes.io/instance: zitadelcluster-editor-role
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: zitadelcluster-editor-role
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- zitadelclusters
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- zitadelclusters/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
27
src/config/rbac/zitadelcluster_viewer_role.yaml
Normal file
27
src/config/rbac/zitadelcluster_viewer_role.yaml
Normal file
@@ -0,0 +1,27 @@
|
|||||||
|
# permissions for end users to view zitadelclusters.
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: clusterrole
|
||||||
|
app.kubernetes.io/instance: zitadelcluster-viewer-role
|
||||||
|
app.kubernetes.io/component: rbac
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
name: zitadelcluster-viewer-role
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- zitadelclusters
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- zitadel.topmanage.com
|
||||||
|
resources:
|
||||||
|
- zitadelclusters/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
9
src/config/samples/kustomization.yaml
Normal file
9
src/config/samples/kustomization.yaml
Normal file
@@ -0,0 +1,9 @@
|
|||||||
|
## Append samples of your project ##
|
||||||
|
resources:
|
||||||
|
- zitadel_v1alpha1_zitadelcluster.yaml
|
||||||
|
- zitadel_v1alpha1_organization.yaml
|
||||||
|
- zitadel_v1alpha1_project.yaml
|
||||||
|
- zitadel_v1alpha1_oidcapp.yaml
|
||||||
|
- zitadel_v1alpha1_machineuser.yaml
|
||||||
|
- zitadel_v1alpha1_apiapp.yaml
|
||||||
|
#+kubebuilder:scaffold:manifestskustomizesamples
|
||||||
12
src/config/samples/zitadel_v1alpha1_apiapp.yaml
Normal file
12
src/config/samples/zitadel_v1alpha1_apiapp.yaml
Normal file
@@ -0,0 +1,12 @@
|
|||||||
|
apiVersion: zitadel.topmanage.com/v1alpha1
|
||||||
|
kind: APIApp
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: apiapp
|
||||||
|
app.kubernetes.io/instance: apiapp-sample
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
name: apiapp-sample
|
||||||
|
spec:
|
||||||
|
# TODO(user): Add fields here
|
||||||
12
src/config/samples/zitadel_v1alpha1_machineuser.yaml
Normal file
12
src/config/samples/zitadel_v1alpha1_machineuser.yaml
Normal file
@@ -0,0 +1,12 @@
|
|||||||
|
apiVersion: zitadel.topmanage.com/v1alpha1
|
||||||
|
kind: MachineUser
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: machineuser
|
||||||
|
app.kubernetes.io/instance: machineuser-sample
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
name: machineuser-sample
|
||||||
|
spec:
|
||||||
|
# TODO(user): Add fields here
|
||||||
12
src/config/samples/zitadel_v1alpha1_oidcapp.yaml
Normal file
12
src/config/samples/zitadel_v1alpha1_oidcapp.yaml
Normal file
@@ -0,0 +1,12 @@
|
|||||||
|
apiVersion: zitadel.topmanage.com/v1alpha1
|
||||||
|
kind: OIDCApp
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: oidcapp
|
||||||
|
app.kubernetes.io/instance: oidcapp-sample
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
name: oidcapp-sample
|
||||||
|
spec:
|
||||||
|
# TODO(user): Add fields here
|
||||||
12
src/config/samples/zitadel_v1alpha1_organization.yaml
Normal file
12
src/config/samples/zitadel_v1alpha1_organization.yaml
Normal file
@@ -0,0 +1,12 @@
|
|||||||
|
apiVersion: zitadel.topmanage.com/v1alpha1
|
||||||
|
kind: Organization
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: organization
|
||||||
|
app.kubernetes.io/instance: organization-sample
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
name: organization-sample
|
||||||
|
spec:
|
||||||
|
# TODO(user): Add fields here
|
||||||
12
src/config/samples/zitadel_v1alpha1_project.yaml
Normal file
12
src/config/samples/zitadel_v1alpha1_project.yaml
Normal file
@@ -0,0 +1,12 @@
|
|||||||
|
apiVersion: zitadel.topmanage.com/v1alpha1
|
||||||
|
kind: Project
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: project
|
||||||
|
app.kubernetes.io/instance: project-sample
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
name: project-sample
|
||||||
|
spec:
|
||||||
|
# TODO(user): Add fields here
|
||||||
12
src/config/samples/zitadel_v1alpha1_zitadelcluster.yaml
Normal file
12
src/config/samples/zitadel_v1alpha1_zitadelcluster.yaml
Normal file
@@ -0,0 +1,12 @@
|
|||||||
|
apiVersion: zitadel.topmanage.com/v1alpha1
|
||||||
|
kind: ZitadelCluster
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: zitadelcluster
|
||||||
|
app.kubernetes.io/instance: zitadelcluster-sample
|
||||||
|
app.kubernetes.io/part-of: src
|
||||||
|
app.kubernetes.io/managed-by: kustomize
|
||||||
|
app.kubernetes.io/created-by: src
|
||||||
|
name: zitadelcluster-sample
|
||||||
|
spec:
|
||||||
|
# TODO(user): Add fields here
|
||||||
7
src/config/scorecard/bases/config.yaml
Normal file
7
src/config/scorecard/bases/config.yaml
Normal file
@@ -0,0 +1,7 @@
|
|||||||
|
apiVersion: scorecard.operatorframework.io/v1alpha3
|
||||||
|
kind: Configuration
|
||||||
|
metadata:
|
||||||
|
name: config
|
||||||
|
stages:
|
||||||
|
- parallel: true
|
||||||
|
tests: []
|
||||||
16
src/config/scorecard/kustomization.yaml
Normal file
16
src/config/scorecard/kustomization.yaml
Normal file
@@ -0,0 +1,16 @@
|
|||||||
|
resources:
|
||||||
|
- bases/config.yaml
|
||||||
|
patchesJson6902:
|
||||||
|
- path: patches/basic.config.yaml
|
||||||
|
target:
|
||||||
|
group: scorecard.operatorframework.io
|
||||||
|
version: v1alpha3
|
||||||
|
kind: Configuration
|
||||||
|
name: config
|
||||||
|
- path: patches/olm.config.yaml
|
||||||
|
target:
|
||||||
|
group: scorecard.operatorframework.io
|
||||||
|
version: v1alpha3
|
||||||
|
kind: Configuration
|
||||||
|
name: config
|
||||||
|
#+kubebuilder:scaffold:patchesJson6902
|
||||||
10
src/config/scorecard/patches/basic.config.yaml
Normal file
10
src/config/scorecard/patches/basic.config.yaml
Normal file
@@ -0,0 +1,10 @@
|
|||||||
|
- op: add
|
||||||
|
path: /stages/0/tests/-
|
||||||
|
value:
|
||||||
|
entrypoint:
|
||||||
|
- scorecard-test
|
||||||
|
- basic-check-spec
|
||||||
|
image: quay.io/operator-framework/scorecard-test:unknown
|
||||||
|
labels:
|
||||||
|
suite: basic
|
||||||
|
test: basic-check-spec-test
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user