FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

ROX-33465: Remove OCP3 from install and more reliable autosensing (#1… · stackrox/stackrox@4881eec · GitHub

/ stackrox Public

Commit 4881eec

Browse files
mclasmeier
authored
ROX-33465: Remove OCP3 from install and more reliable autosensing (#19996)
Co-authored-by: Moritz Clasmeier <mclasmeier@redhat.com>
1 parent d721274 commit 4881eec

42 files changed

Lines changed: 126 additions & 406 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎CHANGELOG.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ Changes should still be described appropriately in JIRA/doc input pages, for inc
3030

3131
### Technical Changes
3232

33+
- OpenShift 3 support removed from all installation methods.
34+
3335
## [4.10.0]
3436

3537

‎central/clusters/zip/render_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ func TestRenderWithNoCollection(t *testing.T) {
135135
cluster := &storage.Cluster{
136136
Name: "cluster",
137137
MainImage: "stackrox/main:abc",
138-
Type: storage.ClusterType_OPENSHIFT_CLUSTER,
138+
Type: storage.ClusterType_OPENSHIFT4_CLUSTER,
139139
CollectionMethod: storage.CollectionMethod_NO_COLLECTION,
140140
}
141141

‎image/embed_charts.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -271,7 +271,7 @@ func (i *Image) GetSensorChart(values *charts.MetaValues, certs *sensor.Certs) (
271271
func (i *Image) addScripts(values *charts.MetaValues) ([]*loader.BufferedFile, error) {
272272
if values.ClusterType == storage.ClusterType_KUBERNETES_CLUSTER.String() {
273273
return i.scripts(values, k8sScriptsFileMap)
274-
} else if values.ClusterType == storage.ClusterType_OPENSHIFT_CLUSTER.String() || values.ClusterType == storage.ClusterType_OPENSHIFT4_CLUSTER.String() {
274+
} else if values.ClusterType == storage.ClusterType_OPENSHIFT4_CLUSTER.String() {
275275
return i.scripts(values, osScriptsFileMap)
276276
}
277277
return nil, errors.Errorf("unable to create sensor bundle, invalid cluster type for cluster %s",

‎image/templates/helm/shared/templates/02-scanner-v4-01-security.yaml‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,9 @@
22

33
{{- if or ._rox.scannerV4._indexerEnabled ._rox.scannerV4._matcherEnabled }}
44
{{- if ._rox.env.openshift }}
5-
{{- if eq ._rox.env.openshift 3 }}
6-
{{ include "srox.warn" (list . "On OpenShift 3.x no SecurityContextConstraint will be configured for Scanner V4.") }}
7-
{{- else }}
8-
{{/* Use a default SCC that ships with OpenShift 4.x.
9-
We only need to create a Role and a RoleBinding for
10-
associating the SCC with the Scanner V4 deployment. */}}
5+
{{/* Use a default SCC that ships with OpenShift 4.x.
6+
We only need to create a Role and a RoleBinding for
7+
associating the SCC with the Scanner V4 deployment. */}}
118
apiVersion: rbac.authorization.k8s.io/v1
129
kind: Role
1310
metadata:
@@ -47,6 +44,5 @@ subjects:
4744
- kind: ServiceAccount
4845
name: scanner-v4
4946
namespace: {{ .Release.Namespace }}
50-
{{- end }}
5147
{{- end }}
5248
{{- end }}

‎image/templates/helm/shared/templates/_openshift.tpl‎

Lines changed: 14 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,11 @@
44
This function detects the OpenShift version automatically based on the cluster the Helm chart is installed onto.
55
It writes the result to ._rox.env.openshift as an integer.
66
Possible results are:
7-
- 3 (OpenShift 3)
87
- 4 (OpenShift 4)
98
- 0 (Non-Openshift cluster)
109
11-
If "true" is passed for $._rox.env.openshift the OpenShift version is detected based on the Kubernetes cluster version.
12-
If the Kubernetes version is not available (i.e. when using Helm template) auto-sensing falls back on OpenShift 3 to be
13-
backward compatible.
10+
If "true" is passed for $._rox.env.openshift, this is unconditionally mapped to OpenShift version "4", because that is the only
11+
major version we currently support.
1412
*/}}
1513

1614
{{ define "srox.autoSenseOpenshiftVersion" }}
@@ -20,31 +18,25 @@
2018

2119
{{/* Infer OpenShift, if needed */}}
2220
{{ if kindIs "invalid" $env.openshift }}
23-
{{/* The API GroupVersion project.openshift.io/v1 contains the core OpenShift API 'Project' of
24-
compatibility level 1, which comes with the strongest stability guarantees among the OpenShift APIs.
25-
This API is available in OpenShift 3.x and 4.x. */}}
26-
{{ $_ := set $env "openshift" (has "project.openshift.io/v1" $._rox._apiServer.apiResources) }}
21+
{{/* This CRD API reliably indicates OpenShift 4. */}}
22+
{{ $_ := set $env "openshift" (has "config.openshift.io/v1" $._rox._apiServer.apiResources) }}
23+
{{- if $env.openshift -}}
24+
{{- include "srox.note" (list $ (printf "Based on API server properties, we have inferred that you are deploying into an OpenShift 4.x cluster.")) -}}
25+
{{- end -}}
2726
{{ end }}
28-
29-
{{/* Infer openshift version */}}
3027
{{ if and $env.openshift (kindIs "bool" $env.openshift) }}
31-
{{/* Parse and add KubeVersion as semver from built-in resources. This is necessary to compare valid integer numbers. */}}
32-
{{ $kubeVersion := semver $.Capabilities.KubeVersion.Version }}
33-
34-
{{/* Default to OpenShift 3 if no openshift resources are available, i.e. in helm template commands */}}
35-
{{ if not (has "project.openshift.io/v1" $._rox._apiServer.apiResources) }}
36-
{{ $_ := set $._rox.env "openshift" 3 }}
37-
{{ else if gt $kubeVersion.Minor 11 }}
38-
{{ $_ := set $env "openshift" 4 }}
39-
{{ else }}
40-
{{ $_ := set $env "openshift" 3 }}
41-
{{ end }}
42-
{{ include "srox.note" (list $ (printf "Based on API server properties, we have inferred that you are deploying into an OpenShift %d.x cluster. Set the `env.openshift` property explicitly to 3 or 4 to override the auto-sensed value." $env.openshift)) }}
28+
{{/* We only support OpenShift 4. */}}
29+
{{ $_ := set $env "openshift" 4 }}
4330
{{ end }}
31+
4432
{{ if not (kindIs "bool" $env.openshift) }}
4533
{{ $_ := set $env "openshift" (int $env.openshift) }}
4634
{{ else if not $env.openshift }}
4735
{{ $_ := set $env "openshift" 0 }}
4836
{{ end }}
4937

38+
{{- if and (ne $env.openshift 0) (ne $env.openshift 4) -}}
39+
{{- include "srox.fail" (printf "You have specified OpenShift version %d.x, but only version 4.x is currently supported." $env.openshift) -}}
40+
{{- end -}}
41+
5042
{{ end }}

‎image/templates/helm/stackrox-secured-cluster/internal/cluster-config.yaml.tpl.htpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ clusterConfig:
77
{{- if not ._rox.env.openshift }}
88
type: KUBERNETES_CLUSTER
99
{{- else }}
10-
type: {{ if eq (int ._rox.env.openshift) 4 -}} OPENSHIFT4_CLUSTER {{- else -}} OPENSHIFT_CLUSTER {{ end }}
10+
type: OPENSHIFT4_CLUSTER
1111
{{- end }}
1212
mainImage: {{ coalesce ._rox.image.main._abbrevImageRef ._rox.image.main.fullRef }}
1313
collectorImage: {{ coalesce ._rox.image.collector._abbrevImageRef ._rox.image.collector.fullRef }}

‎image/templates/helm/stackrox-secured-cluster/internal/defaults/30-base-config.yaml.htpl‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -60,13 +60,7 @@ admissionControl:
6060
[<- if .FeatureFlags.ROX_ADMISSION_CONTROLLER_CONFIG >]
6161
listenOnCreates: true
6262
listenOnUpdates: true
63-
{{/* At this point, when defaults are applied, we can expect env.openshift to be false or a major version number (3, 4). */}}
64-
{{- if or (not ._rox.env.openshift) (gt ._rox.env.openshift 3) }}
6563
listenOnEvents: true
66-
{{- else }}
67-
{{/* OpenShift 3.x does not support this. */}}
68-
listenOnEvents: false
69-
{{- end }}
7064
[<- else >]
7165
listenOnCreates: false
7266
listenOnUpdates: false

‎image/templates/helm/stackrox-secured-cluster/sensor-chart-upgrade.md.htpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ Here is the list of old and new configuration options:
106106
|Old configuration option |New configuration option |
107107
|-------------------------|-------------------------|
108108
| `cluster.name` | `clusterName` |
109-
| `cluster.type` | Set `env.openshift` to `true` for `cluster.type=OPENSHIFT_CLUSTER` and `false` for `cluster.type=KUBERNETES_CLUSTER`. Leave unset to automatically detect (recommended). |
109+
| `cluster.type` | Set `env.openshift` to `true` for `cluster.type=OPENSHIFT4_CLUSTER` and `false` for `cluster.type=KUBERNETES_CLUSTER`. Leave unset to automatically detect (recommended). |
110110
| `endpoint.central` | `centralEndpoint` |
111111
| `endpoint.advertised` | `sensor.endpoint` |
112112
| `image.repository.main` | `image.main.name` |

‎image/templates/helm/stackrox-secured-cluster/templates/_init.tpl.htpl‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -210,12 +210,6 @@
210210
{{ include "srox.warn" (list $ "Incompatible settings: 'admissionControl.dynamic.enforceOnUpdates' is set to true, while `admissionControl.listenOnUpdates` is set to false. For the feature to be active, enable both settings by setting them to true.") }}
211211
{{ end }}
212212

213-
[<- if not .FeatureFlags.ROX_ADMISSION_CONTROLLER_CONFIG >]
214-
{{ if and (eq $._rox.env.openshift 3) $._rox.admissionControl.listenOnEvents }}
215-
{{ include "srox.fail" "'admissionControl.listenOnEvents' is set to true, but the chart is being deployed in OpenShift 3.x compatibility mode, which does not work with this feature. Set 'env.openshift' to '4' in order to enable OpenShift 4.x features." }}
216-
{{ end }}
217-
[<- end >]
218-
219213
{{ if $._rox.collector.slimMode }}
220214
{{ include "srox.warn" (list $ "collector.slimMode is set to true, but it has been removed in 4.7 after being deprecated since 4.5. This setting will be ignored.") }}
221215
{{ end }}

‎image/templates/helm/stackrox-secured-cluster/templates/admission-controller.yaml‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ spec:
2525
{{- include "srox.podLabels" (list . "deployment" "admission-control") | nindent 8 }}
2626
annotations:
2727
{{- $annotations := dict "traffic.sidecar.istio.io/excludeInboundPorts" "8443" -}}
28-
{{- if eq ._rox.env.openshift 4 }}
28+
{{- if ._rox.env.openshift }}
2929
{{- $_ := set $annotations "openshift.io/required-scc" "restricted-v2" -}}
3030
{{- end }}
3131
{{- include "srox.podAnnotations" (list . "deployment" "admission-control" $annotations) | nindent 8 }}
@@ -215,11 +215,7 @@ spec:
215215
type: ClusterIP
216216
sessionAffinity: None
217217
---
218-
{{- if ne ._rox.env.openshift 3 }}
219218
apiVersion: admissionregistration.k8s.io/v1
220-
{{- else }}
221-
apiVersion: admissionregistration.k8s.io/v1beta1
222-
{{- end }}
223219
kind: ValidatingWebhookConfiguration
224220
metadata:
225221
name: stackrox
@@ -231,11 +227,9 @@ metadata:
231227
webhooks:
232228
{{- if or ._rox.admissionControl.dynamic.enforceOnCreates ._rox.admissionControl.dynamic.enforceOnUpdates }}
233229
- name: policyeval.stackrox.io
234-
{{- if ne ._rox.env.openshift 3 }}
235230
sideEffects: NoneOnDryRun
236231
admissionReviewVersions: [ "v1", "v1beta1" ]
237232
timeoutSeconds: {{ add 2 ._rox.admissionControl.dynamic.timeout }}
238-
{{- end }}
239233
rules:
240234
- apiGroups:
241235
- '*'
@@ -280,11 +274,9 @@ webhooks:
280274
{{- end}}
281275
{{- if ._rox.admissionControl.listenOnEvents }}
282276
- name: k8sevents.stackrox.io
283-
{{- if ne ._rox.env.openshift 3 }}
284277
sideEffects: NoneOnDryRun
285278
admissionReviewVersions: [ "v1", "v1beta1" ]
286279
timeoutSeconds: {{ add 2 ._rox.admissionControl.dynamic.timeout }}
287-
{{- end }}
288280
rules:
289281
- apiGroups:
290282
- '*'

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL