Skip to content

Commit 273179d

Browse files
jhadvigclaude
jhadvig
and
claude
committed
install: Add TechPreviewNoUpgrade cluster-update console plugin
Add manifests to deploy the cluster-update-console-plugin, a web console interface for managing ClusterVersion updates. The plugin is gated behind the TechPreviewNoUpgrade feature set and the Console capability. Manifests include: namespace, serviceaccount, networkpolicy, deployment, service, and consoleplugin resources. The deployment uses readiness and liveness probes, a read-only root filesystem with emptyDir volumes for nginx runtime directories, and a serving-cert annotation for TLS. Extend manifestRenderConfig with an Images map populated from the release payload's image-references, so CVO manifests can resolve component images by short name at deploy time using Go template syntax: {{index .Images "cluster-update-console-plugin"}}. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 12e4168 commit 273179d

9 files changed

Lines changed: 204 additions & 0 deletions

‎install/0000_50_cluster-update-console-plugin_10_namespace.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: openshift-cluster-update-console-plugin
5+
annotations:
6+
kubernetes.io/description: The OpenShift cluster-update console plugin provides a web-console interface for managing ClusterVersion updates.
7+
capability.openshift.io/name: Console
8+
release.openshift.io/feature-set: TechPreviewNoUpgrade
9+
exclude.release.openshift.io/internal-openshift-hosted: "true"
10+
include.release.openshift.io/self-managed-high-availability: "true"
11+
labels:
12+
openshift.io/cluster-monitoring: "true"
13+
pod-security.kubernetes.io/audit: restricted
14+
pod-security.kubernetes.io/enforce: restricted
15+
pod-security.kubernetes.io/warn: restricted

‎install/0000_50_cluster-update-console-plugin_15_serviceaccount.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: cluster-update-console-plugin
5+
namespace: openshift-cluster-update-console-plugin
6+
annotations:
7+
kubernetes.io/description: The OpenShift cluster-update console plugin provides a web-console interface for managing ClusterVersion updates.
8+
capability.openshift.io/name: Console
9+
release.openshift.io/feature-set: TechPreviewNoUpgrade
10+
exclude.release.openshift.io/internal-openshift-hosted: "true"
11+
include.release.openshift.io/self-managed-high-availability: "true"

‎install/0000_50_cluster-update-console-plugin_20_networkpolicy.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: default-deny
5+
namespace: openshift-cluster-update-console-plugin
6+
annotations:
7+
kubernetes.io/description: This NetworkPolicy is used to deny all ingress and egress traffic by default in this namespace, matching all Pods, and serving as a baseline.
8+
capability.openshift.io/name: Console
9+
release.openshift.io/feature-set: TechPreviewNoUpgrade
10+
exclude.release.openshift.io/internal-openshift-hosted: "true"
11+
include.release.openshift.io/self-managed-high-availability: "true"
12+
spec:
13+
podSelector: {}
14+
policyTypes:
15+
- Ingress
16+
- Egress

‎install/0000_50_cluster-update-console-plugin_30_configmap.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: cluster-update-console-plugin
5+
namespace: openshift-cluster-update-console-plugin
6+
annotations:
7+
kubernetes.io/description: Nginx configuration for the cluster-update console plugin.
8+
capability.openshift.io/name: Console
9+
release.openshift.io/feature-set: TechPreviewNoUpgrade
10+
exclude.release.openshift.io/internal-openshift-hosted: "true"
11+
include.release.openshift.io/self-managed-high-availability: "true"
12+
data:
13+
nginx.conf: |
14+
error_log /dev/stderr;
15+
events {}
16+
http {
17+
access_log /dev/stdout;
18+
include /etc/nginx/mime.types;
19+
default_type application/octet-stream;
20+
keepalive_timeout 65;
21+
server {
22+
listen 9001 ssl;
23+
listen [::]:9001 ssl;
24+
ssl_certificate /var/cert/tls.crt;
25+
ssl_certificate_key /var/cert/tls.key;
26+
root /usr/share/nginx/html;
27+
}
28+
}

‎install/0000_50_cluster-update-console-plugin_50_deployment.yaml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: cluster-update-console-plugin
5+
namespace: openshift-cluster-update-console-plugin
6+
annotations:
7+
kubernetes.io/description: The OpenShift cluster-update console plugin provides a web-console interface for managing ClusterVersion updates.
8+
capability.openshift.io/name: Console
9+
release.openshift.io/feature-set: TechPreviewNoUpgrade
10+
exclude.release.openshift.io/internal-openshift-hosted: "true"
11+
include.release.openshift.io/self-managed-high-availability: "true"
12+
spec:
13+
selector:
14+
matchLabels:
15+
app: cluster-update-console-plugin
16+
strategy:
17+
rollingUpdate:
18+
maxSurge: 25%
19+
maxUnavailable: 1
20+
type: RollingUpdate
21+
template:
22+
metadata:
23+
annotations:
24+
target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
25+
openshift.io/required-scc: restricted-v3
26+
labels:
27+
app: cluster-update-console-plugin
28+
spec:
29+
serviceAccountName: cluster-update-console-plugin
30+
automountServiceAccountToken: false
31+
containers:
32+
- name: plugin
33+
image: '{{index .Images "cluster-update-console-plugin"}}'
34+
imagePullPolicy: IfNotPresent
35+
ports:
36+
- name: https
37+
containerPort: 9001
38+
resources:
39+
requests:
40+
cpu: 20m
41+
memory: 50Mi
42+
securityContext:
43+
allowPrivilegeEscalation: false
44+
capabilities:
45+
drop:
46+
- ALL
47+
terminationMessagePolicy: FallbackToLogsOnError
48+
volumeMounts:
49+
- mountPath: /var/cert
50+
name: cluster-update-console-plugin-cert
51+
readOnly: true
52+
- mountPath: /etc/nginx/nginx.conf
53+
name: nginx-conf
54+
readOnly: true
55+
subPath: nginx.conf
56+
dnsPolicy: ClusterFirst
57+
hostUsers: false
58+
nodeSelector:
59+
kubernetes.io/os: linux
60+
priorityClassName: system-cluster-critical
61+
securityContext:
62+
runAsNonRoot: true
63+
seccompProfile:
64+
type: RuntimeDefault
65+
terminationGracePeriodSeconds: 30
66+
tolerations:
67+
- effect: NoSchedule
68+
key: node-role.kubernetes.io/infra
69+
operator: Exists
70+
volumes:
71+
- name: cluster-update-console-plugin-cert
72+
secret:
73+
defaultMode: 420
74+
secretName: cluster-update-console-plugin-cert
75+
- name: nginx-conf
76+
configMap:
77+
name: cluster-update-console-plugin
78+
defaultMode: 420

‎install/0000_50_cluster-update-console-plugin_60_service.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: openshift-cluster-update-console-plugin
5+
namespace: openshift-cluster-update-console-plugin
6+
annotations:
7+
kubernetes.io/description: The OpenShift cluster-update console plugin provides a web-console interface for managing ClusterVersion updates.
8+
service.beta.openshift.io/serving-cert-secret-name: cluster-update-console-plugin-cert
9+
capability.openshift.io/name: Console
10+
release.openshift.io/feature-set: TechPreviewNoUpgrade
11+
exclude.release.openshift.io/internal-openshift-hosted: "true"
12+
include.release.openshift.io/self-managed-high-availability: "true"
13+
spec:
14+
type: ClusterIP
15+
selector:
16+
app: cluster-update-console-plugin
17+
ports:
18+
- name: https
19+
port: 9001
20+
targetPort: https

‎install/0000_50_cluster-update-console-plugin_90_consoleplugin.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: console.openshift.io/v1
2+
kind: ConsolePlugin
3+
metadata:
4+
name: openshift-cluster-update-console-plugin
5+
annotations:
6+
kubernetes.io/description: The OpenShift cluster-update console plugin provides a web-console interface for managing ClusterVersion updates.
7+
capability.openshift.io/name: Console
8+
release.openshift.io/feature-set: TechPreviewNoUpgrade
9+
exclude.release.openshift.io/internal-openshift-hosted: "true"
10+
include.release.openshift.io/self-managed-high-availability: "true"
11+
spec:
12+
displayName: Cluster Updates
13+
i18n:
14+
loadType: Preload
15+
backend:
16+
type: Service
17+
service:
18+
name: openshift-cluster-update-console-plugin
19+
namespace: openshift-cluster-update-console-plugin
20+
port: 9001
21+
basePath: /

‎install/image-references‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
kind: ImageStream
2+
apiVersion: image.openshift.io/v1
3+
spec:
4+
tags:
5+
- name: cluster-update-console-plugin
6+
from:
7+
kind: DockerImage
8+
name: placeholder.url.oc.will.replace.this.example.org:cluster-update-console-plugin

‎pkg/payload/render_test.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -381,6 +381,9 @@ func Test_cvoManifests(t *testing.T) {
381381
config := manifestRenderConfig{
382382
ReleaseImage: "quay.io/cvo/release:latest",
383383
ClusterProfile: "some-profile",
384+
Images: map[string]string{
385+
"cluster-update-console-plugin": "quay.io/openshift/cluster-update-console-plugin:latest",
386+
},
384387
}
385388

386389
tests := []struct {
@@ -409,6 +412,10 @@ func Test_cvoManifests(t *testing.T) {
409412
return nil
410413
}
411414

415+
if _, fileName := filepath.Split(path); fileName == "image-references" {
416+
return nil
417+
}
418+
412419
var manifestsWithoutIncludeAnnotation []manifest.Manifest
413420
data, err := os.ReadFile(path)
414421
if err != nil {

0 commit comments

Comments
 (0)