feat(olm): add kustomize overlay for the OLM bundle manifests

.gitignore

@@ -41,5 +41,11 @@ test/e2e/kustomization.yaml
 
 # Test registry certificates
 certs/
+
 # Utility dir for manifest build
 manifest-build/
+
+# OLM rendered files
+config/olm/generated/
+olm-bundle/
+olm-manifests/

Taskfile.yml

@@ -495,6 +495,22 @@ tasks:
     generates:
       - ./manifest.yaml
 
+  olm:kustomization-patches:
+    desc: Render the OLM kustomize patches with the plugin and sidecar images
+    requires:
+      vars:
+        - PLUGIN_IMAGE
+        - SIDECAR_IMAGE
+    env:
+      PLUGIN_IMAGE: '{{.PLUGIN_IMAGE}}'
+      SIDECAR_IMAGE: '{{.SIDECAR_IMAGE}}'
+    cmds:
+      - mkdir -p config/olm/generated
+      - >
+        for f in config/olm/templates/*.yaml.tmpl; do
+        envsubst '${PLUGIN_IMAGE} ${SIDECAR_IMAGE}' < "$f" > "config/olm/generated/$(basename "$f" .tmpl)" || exit 1;
+        done
+
   upload-manifest-to-release:
     desc: Upload the manifest to the release
     requires:
@@ -523,3 +539,4 @@ tasks:
     desc: Remove autogenerated artifacts
     cmds:
       - rm -rf .task/
+      - rm -rf config/olm/generated/

config/olm/kustomization.yaml

@@ -0,0 +1,32 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - bases/plugin-barman-cloud.clusterserviceversion.yaml
+  - ../../kubernetes
+  - ../samples
+  - ../scorecard
+
+patches:
+  - path: patches/plugin_certs_optional.yaml
+  - path: patches/remove_cert_manager.yaml
+  - path: patches/remove_sidecar_secret.yaml
+  - path: generated/plugin_image.yaml
+    target:
+      kind: Deployment
+      name: barman-cloud
+  - path: generated/sidecar_image.yaml
+    target:
+      kind: Deployment
+      name: barman-cloud
+
+replacements:
+  - source:
+      kind: Deployment
+      name: barman-cloud
+      fieldPath: spec.template.spec.containers.[name=barman-cloud].image
+    targets:
+      - select:
+          kind: ClusterServiceVersion
+        fieldPaths:
+          - metadata.annotations.containerImage

config/olm/patches/plugin_certs_optional.yaml

@@ -0,0 +1,19 @@
+# On the OLM install path cert-manager is unavailable, so the plugin cert
+# secrets are absent at pod start. Marking the volumes optional lets the pod
+# start; the plugin loads the certificates on each TLS handshake, so it starts
+# serving as soon as the barman-cloud-server-tls and barman-cloud-client-tls
+# secrets are created. Until then, CNPG fails registering the plugin.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: barman-cloud
+spec:
+  template:
+    spec:
+      volumes:
+        - name: server
+          secret:
+            optional: true
+        - name: client
+          secret:
+            optional: true

config/olm/patches/remove_cert_manager.yaml

@@ -0,0 +1,19 @@
+# An OLM bundle can't contain cert-manager resources. The user creates the
+# plugin TLS secrets after installing (see the CSV description).
+$patch: delete
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: selfsigned-issuer
+---
+$patch: delete
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: barman-cloud-server
+---
+$patch: delete
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: barman-cloud-client

config/olm/patches/remove_sidecar_secret.yaml

@@ -0,0 +1,7 @@
+# On the OLM install path SIDECAR_IMAGE is a plain env var
+# (see templates/sidecar_image.yaml.tmpl), so the generated secret is unused.
+$patch: delete
+apiVersion: v1
+kind: Secret
+metadata:
+  name: plugin-barman-cloud

config/olm/templates/plugin_image.yaml.tmpl

@@ -0,0 +1,5 @@
+# A patch rather than an `images` entry: the kubernetes/ base already
+# rewrites the plugin image, and a patch applies after it.
+- op: replace
+  path: /spec/template/spec/containers/0/image
+  value: ${PLUGIN_IMAGE}

config/olm/templates/sidecar_image.yaml.tmpl

@@ -0,0 +1,10 @@
+- op: replace
+  path: /spec/template/spec/containers/0/env
+  value:
+  # Not read by the plugin: operator-sdk lists RELATED_IMAGE_* env vars in
+  # the CSV relatedImages, so the sidecar image, which the plugin injects at
+  # runtime and is otherwise invisible to OLM, gets mirrored and pinned.
+  - name: RELATED_IMAGE_SIDECAR
+    value: ${SIDECAR_IMAGE}
+  - name: SIDECAR_IMAGE
+    value: ${SIDECAR_IMAGE}

config/samples/barmancloud_v1_objectstore.yaml

@@ -0,0 +1,17 @@
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: objectstore-sample
+spec:
+  configuration:
+    destinationPath: s3://my-bucket/backups/
+    s3Credentials:
+      accessKeyId:
+        name: aws-credentials
+        key: ACCESS_KEY_ID
+      secretAccessKey:
+        name: aws-credentials
+        key: ACCESS_SECRET_KEY
+    wal:
+      compression: gzip
+  retentionPolicy: 30d

config/scorecard/bases/config.yaml

@@ -0,0 +1,7 @@
+apiVersion: scorecard.operatorframework.io/v1alpha3
+kind: Configuration
+metadata:
+  name: config
+stages:
+- parallel: true
+  tests: []

config/scorecard/kustomization.yaml

@@ -0,0 +1,19 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - bases/config.yaml
+
+patches:
+  - path: patches/basic.config.yaml
+    target:
+      group: scorecard.operatorframework.io
+      version: v1alpha3
+      kind: Configuration
+      name: config
+  - path: patches/olm.config.yaml
+    target:
+      group: scorecard.operatorframework.io
+      version: v1alpha3
+      kind: Configuration
+      name: config

config/scorecard/patches/basic.config.yaml

@@ -0,0 +1,12 @@
+- op: add
+  path: /stages/0/tests/-
+  value:
+    entrypoint:
+    - scorecard-test
+    - basic-check-spec
+    # renovate: datasource=docker depName=quay.io/operator-framework/scorecard-test versioning=docker
+    # Version: v1.42.3
+    image: quay.io/operator-framework/scorecard-test@sha256:2370b520e3ca95b25544191d618b8b7fbe5a7c438ed84f729351847aee0ca6ea
+    labels:
+      suite: basic
+      test: basic-check-spec-test

config/scorecard/patches/olm.config.yaml

@@ -0,0 +1,48 @@
+- op: add
+  path: /stages/0/tests/-
+  value:
+    entrypoint:
+    - scorecard-test
+    - olm-bundle-validation
+    # renovate: datasource=docker depName=quay.io/operator-framework/scorecard-test versioning=docker
+    # Version: v1.42.3
+    image: quay.io/operator-framework/scorecard-test@sha256:2370b520e3ca95b25544191d618b8b7fbe5a7c438ed84f729351847aee0ca6ea
+    labels:
+      suite: olm
+      test: olm-bundle-validation-test
+- op: add
+  path: /stages/0/tests/-
+  value:
+    entrypoint:
+    - scorecard-test
+    - olm-crds-have-validation
+    # renovate: datasource=docker depName=quay.io/operator-framework/scorecard-test versioning=docker
+    # Version: v1.42.3
+    image: quay.io/operator-framework/scorecard-test@sha256:2370b520e3ca95b25544191d618b8b7fbe5a7c438ed84f729351847aee0ca6ea
+    labels:
+      suite: olm
+      test: olm-crds-have-validation-test
+- op: add
+  path: /stages/0/tests/-
+  value:
+    entrypoint:
+    - scorecard-test
+    - olm-spec-descriptors
+    # renovate: datasource=docker depName=quay.io/operator-framework/scorecard-test versioning=docker
+    # Version: v1.42.3
+    image: quay.io/operator-framework/scorecard-test@sha256:2370b520e3ca95b25544191d618b8b7fbe5a7c438ed84f729351847aee0ca6ea
+    labels:
+      suite: olm
+      test: olm-spec-descriptors-test
+- op: add
+  path: /stages/0/tests/-
+  value:
+    entrypoint:
+    - scorecard-test
+    - olm-status-descriptors
+    # renovate: datasource=docker depName=quay.io/operator-framework/scorecard-test versioning=docker
+    # Version: v1.42.3
+    image: quay.io/operator-framework/scorecard-test@sha256:2370b520e3ca95b25544191d618b8b7fbe5a7c438ed84f729351847aee0ca6ea
+    labels:
+      suite: olm
+      test: olm-status-descriptors-test

renovate.json5

@@ -71,6 +71,7 @@
       customType: 'regex',
       managerFilePatterns: [
         '/(^|/)hack/.+\\.yaml$/',
+        '/(^|/)config/scorecard/patches/.+\\.yaml$/',
       ],
       matchStrings: [
         '#\\s*renovate:\\s*datasource=(?<datasource>[a-z-.]+?)\\s+depName=(?<depName>[^\\s]+?)(?:\\s+versioning=(?<versioning>[^\\s]+?))?\\s*\\n\\s*#\\s*Version:\\s*(?<currentValue>[^\\s]+?)\\s*\\n\\s*image:\\s*[^@\\s]+@(?<currentDigest>sha256:[a-f0-9]+)',