sync-bindata.sh

#!/bin/bash

# extract select data from bundles:
#  -CSV's
#  -TODO: role data
set -ex

BINDATA_GIT_ADD=${BINDATA_GIT_ADD:-""}
OUT_DATA=bindata
EXTRACT_DIR=tmp/bindata
LOCAL_BINARIES=${LOCAL_BINARIES:?}

mkdir -p "$EXTRACT_DIR"
mkdir -p "$OUT_DATA/crds"

function extract_bundle {
    local IN_DIR=$1
    local OUT_DIR=$2
    for X in $(file ${IN_DIR}/* | grep gzip | cut -f 1 -d ':'); do
        tar xvf $X -C ${OUT_DIR}/;
    done
}


function extract_webhooks {
local CSV_FILENAME=$1
local OPERATOR_NAME=$2
local TYPE=$3

cat $CSV_FILENAME | $LOCAL_BINARIES/yq -r ".spec.webhookdefinitions.[] | select(.type == \"$TYPE\")" | \
    sed -e '/^containerPort:/d' | \
    sed -e '/^deploymentName:/d' | \
    sed -e '/^targetPort:/d' | \
    sed -e '/^type:/d' | \
    sed -e 's|^|  |' | sed -e 's|.*admissionReviewVersions:|- admissionReviewVersions:|' | \
    sed -e 's|.*generateName:|  name:|' | \
    sed -e 's|    - v1|  - v1|' | \
    sed -e "s|.*webhookPath:|  clientConfig:\n    service:\n      name: ${OPERATOR_NAME}-webhook-service\n      namespace: '{{ .OperatorNamespace }}'\n      path:|"

}


function write_webhooks {
local CSV_FILENAME=$1
local OPERATOR_NAME=$2

MUTATING_WEBHOOKS=$(extract_webhooks "$CSV_FILENAME" "$OPERATOR_NAME" "MutatingAdmissionWebhook")
VALIDATING_WEBHOOKS=$(extract_webhooks "$CSV_FILENAME" "$OPERATOR_NAME" "ValidatingAdmissionWebhook")

cat > operator/$OPERATOR_NAME-webhooks.yaml <<EOF_CAT
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: webhook
    app.kubernetes.io/created-by: openstack-operator
    app.kubernetes.io/instance: webhook-service
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: $OPERATOR_NAME
    app.kubernetes.io/part-of: $OPERATOR_NAME
  name: $OPERATOR_NAME-webhook-service
  namespace: '{{ .OperatorNamespace }}'
spec:
  ports:
  - port: 443
    protocol: TCP
    targetPort: 9443
  selector:
    app.kubernetes.io/name: $OPERATOR_NAME
    control-plane: controller-manager
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  labels:
    app.kubernetes.io/component: certificate
    app.kubernetes.io/created-by: openstack-operator
    app.kubernetes.io/instance: serving-cert
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: $OPERATOR_NAME
  name: $OPERATOR_NAME-serving-cert
  namespace: '{{ .OperatorNamespace }}'
spec:
  dnsNames:
  - $OPERATOR_NAME-webhook-service.{{ .OperatorNamespace }}.svc
  - $OPERATOR_NAME-webhook-service.{{ .OperatorNamespace }}.svc.cluster.local
  issuerRef:
    kind: Issuer
    name: $OPERATOR_NAME-selfsigned-issuer
  privateKey:
    algorithm: ECDSA
    size: 256
  secretName: $OPERATOR_NAME-webhook-server-cert
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  annotations:
    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/$OPERATOR_NAME-serving-cert'
  creationTimestamp: null
  labels:
    app.kubernetes.io/component: webhook
    app.kubernetes.io/created-by: openstack-operator
    app.kubernetes.io/instance: mutating-webhook-configuration
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: mutatingwebhookconfiguration
    app.kubernetes.io/part-of: $OPERATOR_NAME
  name: $OPERATOR_NAME-mutating-webhook-configuration
webhooks:
${MUTATING_WEBHOOKS}
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  annotations:
    cert-manager.io/inject-ca-from: '{{ .OperatorNamespace }}/$OPERATOR_NAME-serving-cert'
  creationTimestamp: null
  labels:
    app.kubernetes.io/component: webhook
    app.kubernetes.io/created-by: openstack-operator
    app.kubernetes.io/instance: validating-webhook-configuration
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: validatingwebhookconfiguration
    app.kubernetes.io/part-of: $OPERATOR_NAME
  name: $OPERATOR_NAME-validating-webhook-configuration
webhooks:
${VALIDATING_WEBHOOKS}
EOF_CAT

}

if ! BUNDLES="$(hack/pin-bundle-images.sh)"; then
    exit 1
fi

for BUNDLE in $(echo "$BUNDLES" | tr "," " "); do
    (
        set +e
        n=0
        RC=1
        while :; do
            skopeo copy "docker://$BUNDLE" dir:${EXTRACT_DIR}/tmp
            RC=$?
            if [ $RC -eq 0 -o "$n" -ge 5 ]; then
                exit $RC
            fi
            n=$((n+1))
            echo "Command failed. retrying ... $n/5"
            sleep 15
        done
    )
    extract_bundle "${EXTRACT_DIR}/tmp" "${OUT_DATA}/"
done

cd "$OUT_DATA"
# copy CRDS into crds basedir
grep -l CustomResourceDefinition manifests/* | xargs -I % sh -c 'cp % ./crds/'

# extract role, clusterRole, and deployment from CSV's
for X in $(ls manifests/*clusterserviceversion.yaml); do
        OPERATOR_NAME=$(echo $X | sed -e "s|manifests\/\([^\.]*\)\..*|\1|")
        echo $OPERATOR_NAME
        OPERATOR_SDK_VERSION=$(cat $X | $LOCAL_BINARIES/yq -r '.metadata.annotations."operators.operatorframework.io/builder"')
        LEADER_ELECTION_ROLE_RULES=$(cat $X | $LOCAL_BINARIES/yq -r .spec.install.spec.permissions | sed -e 's|- rules:|rules:|' | sed -e 's|    ||' | sed -e '/  serviceAccountName.*/d'
)
        CLUSTER_ROLE_RULES=$(cat $X | $LOCAL_BINARIES/yq -r .spec.install.spec.clusterPermissions| sed -e 's|- rules:|rules:|' | sed -e 's|    ||' | sed -e '/  serviceAccountName.*/d'
)

if [[ "$OPERATOR_NAME" == "infra-operator" || "$OPERATOR_NAME" == "openstack-baremetal-operator" ]]; then
    write_webhooks "$X" "$OPERATOR_NAME"
fi

mkdir -p rbac
cat > rbac/$OPERATOR_NAME-rbac.yaml <<EOF_CAT
# NOTE: this file is automatically generated by hack/sync-bindata.sh!
#
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  labels:
    app.kubernetes.io/component: certificate
    app.kubernetes.io/created-by: openstack-operator
    app.kubernetes.io/instance: selfsigned-issuer
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: issuer
    app.kubernetes.io/part-of: $OPERATOR_NAME
  name: $OPERATOR_NAME-selfsigned-issuer
  namespace: '{{ .OperatorNamespace }}'
spec:
  selfSigned: {}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ${OPERATOR_NAME}-controller-manager
  namespace: '{{ .OperatorNamespace }}'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: ${OPERATOR_NAME}-leader-election-role
  namespace: '{{ .OperatorNamespace }}'
${LEADER_ELECTION_ROLE_RULES}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: null
  name: ${OPERATOR_NAME}-manager-role
${CLUSTER_ROLE_RULES}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: ${OPERATOR_NAME}-leader-election-rolebinding
  namespace: '{{ .OperatorNamespace }}'
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: ${OPERATOR_NAME}-leader-election-role
subjects:
- kind: ServiceAccount
  name: ${OPERATOR_NAME}-controller-manager
  namespace: '{{ .OperatorNamespace }}'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: ${OPERATOR_NAME}-manager-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ${OPERATOR_NAME}-manager-role
subjects:
- kind: ServiceAccount
  name: ${OPERATOR_NAME}-controller-manager
  namespace: '{{ .OperatorNamespace }}'
EOF_CAT

# drop this logic once all operators are upgraded to operator-sdk 1.41.1
if [[ "$OPERATOR_SDK_VERSION" == "operator-sdk-v1.31.0" ]]; then
cat >> rbac/$OPERATOR_NAME-rbac.yaml <<EOF_CAT
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: ${OPERATOR_NAME}-proxy-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ${OPERATOR_NAME}-proxy-role
subjects:
- kind: ServiceAccount
  name: ${OPERATOR_NAME}-controller-manager
  namespace: '{{ .OperatorNamespace }}'
EOF_CAT
else
cat >> rbac/$OPERATOR_NAME-rbac.yaml <<EOF_CAT
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ${OPERATOR_NAME}-operator-metrics-auth-role
rules:
- apiGroups:
  - authentication.k8s.io
  resources:
  - tokenreviews
  verbs:
  - create
- apiGroups:
  - authorization.k8s.io
  resources:
  - subjectaccessreviews
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ${OPERATOR_NAME}-operator-metrics-reader
rules:
- nonResourceURLs:
  - /metrics
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: ${OPERATOR_NAME}-operator-metrics-auth-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ${OPERATOR_NAME}-operator-metrics-auth-role
subjects:
- kind: ServiceAccount
  name: ${OPERATOR_NAME}-operator-controller-manager
  namespace: '{{ .OperatorNamespace }}'
EOF_CAT
fi

cat >> rbac/$OPERATOR_NAME-rbac.yaml <<EOF_CAT
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/name: $OPERATOR_NAME
    control-plane: controller-manager
  name: ${OPERATOR_NAME}-controller-manager-metrics-service
  namespace: '{{ .OperatorNamespace }}'
spec:
  ports:
  - name: https
    port: 8443
    protocol: TCP
    targetPort: 8443
  selector:
    app.kubernetes.io/name: ${OPERATOR_NAME}
    control-plane: controller-manager
EOF_CAT

if [[ "$OPERATOR_SDK_VERSION" != "operator-sdk-v1.31.0" ]]; then
cat >> rbac/$OPERATOR_NAME-rbac.yaml <<EOF_CAT
---
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  labels:
    app.kubernetes.io/component: certificate
    app.kubernetes.io/created-by: openstack-operator
    app.kubernetes.io/instance: metrics-certs
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: $OPERATOR_NAME
  name: $OPERATOR_NAME-metrics-certs
  namespace: '{{ .OperatorNamespace }}'
spec:
  dnsNames:
  - $OPERATOR_NAME-metrics-service.{{ .OperatorNamespace }}.svc
  - $OPERATOR_NAME-metrics-service.{{ .OperatorNamespace }}.svc.cluster.local
  issuerRef:
    kind: Issuer
    name: $OPERATOR_NAME-selfsigned-issuer
  privateKey:
    algorithm: ECDSA
    size: 256
  secretName: $OPERATOR_NAME-metrics-server-cert
EOF_CAT

fi

done

# generate config/operator/manager_operator_images.yaml
cat > ../config/operator/manager_operator_images.yaml <<EOF_CAT
# NOTE: this file is automatically generated by hack/sync-bindata.sh!
#
# This patch inject custom ENV settings to the manager container
# Used to set our operator locations
apiVersion: apps/v1
kind: Deployment
metadata:
  name: openstack-operator-controller-init
  namespace: system
spec:
  template:
    spec:
      containers:
      - name: operator
        env:
EOF_CAT

cat > ../hack/export_operator_related_images.sh <<EOF_CAT
# NOTE: this file is automatically generated by hack/sync-bindata.sh!

EOF_CAT

for X in $(ls manifests/*clusterserviceversion.yaml); do
        OPERATOR_NAME=$(echo $X | sed -e "s|manifests\/\([^\.]*\)\..*|\1|" | sed -e "s|-|_|g" | tr '[:lower:]' '[:upper:]' )
        echo $OPERATOR_NAME
        # The name of the actual operator container in the openstack operators is manager
        IMAGE=$(cat $X | $LOCAL_BINARIES/yq -r '.spec.install.spec.deployments[0].spec.template.spec.containers.[] | select(.name == "manager") | .image')
        echo $IMAGE


cat >> ../config/operator/manager_operator_images.yaml <<EOF_CAT
        - name: RELATED_IMAGE_${OPERATOR_NAME}_MANAGER_IMAGE_URL
          value: ${IMAGE}
EOF_CAT

cat >> ../hack/export_operator_related_images.sh <<EOF_CAT
export RELATED_IMAGE_${OPERATOR_NAME}_MANAGER_IMAGE_URL=${IMAGE}
EOF_CAT

done

cd ..

# cleanup
rm -Rf "$EXTRACT_DIR"
rm -Rf "$OUT_DATA/manifests"
rm -Rf "$OUT_DATA/metadata"
rm -Rf "$OUT_DATA/tests"

# stage new files for addition via git
if [[ "$BINDATA_GIT_ADD" == "true" ]]; then
    git ls-files -o --exclude-standard | xargs --no-run-if-empty git add
fi