[Manual Sync] Syncing #151

.github/workflows/kind.yml

@@ -90,11 +90,15 @@ jobs:
         KIND_VERSION: ${{ matrix.kind }}
       run: |
         make kind-bootstrap-cluster-dev
+
+    - name: Ensure Service Account kubeconfig
+      run: |
+        KUBECONFIG=${PWD}/kubeconfig_hub make kind-ensure-sa
 
     - name: E2E Tests
       run: |
         export GOPATH=$(go env GOPATH)
-        make e2e-test-coverage
+        KUBECONFIG=${PWD}/kubeconfig_hub make e2e-test-coverage
 
     - name: Upload E2E Test Coverage
       if: ${{ github.event_name == 'pull_request' && matrix.kind == 'latest'}}
@@ -106,7 +110,7 @@ jobs:
     - name: E2E Tests for Compliance Events API
       run: |
         make postgres
-        make e2e-test-coverage-compliance-events-api
+        KUBECONFIG=${PWD}/kubeconfig_hub make e2e-test-coverage-compliance-events-api
 
     - name: Upload Compliance Events API Test Coverage
       if: ${{ github.event_name == 'pull_request' && matrix.kind == 'latest'}}
@@ -115,18 +119,21 @@ jobs:
         name: coverage_e2e_compliance_events_api
         path: governance-policy-propagator/coverage_e2e_compliance_events_api.out
 
+    - name: Verify Deployment Configuration
+      run: |
+        make webhook
+        make build-images
+        KUBECONFIG=${PWD}/kubeconfig_hub_e2e make kind-deploy-controller-dev
+
+    - name: E2E Tests for Webhook
+      run: |
+        KUBECONFIG=${PWD}/kubeconfig_hub make e2e-test-webhook
+
     - name: Debug
       if: ${{ failure() }}
       run: |
         make e2e-debug
 
-    - name: E2E Tests for Webhook
-      run: |
-        make webhook
-        make build-images
-        make kind-deploy-controller-dev
-        make e2e-test-webhook
-
     - name: Clean up cluster
       if: ${{ always() }}
       run: |
@@ -161,7 +168,7 @@ jobs:
     - name: PolicyAutomation E2E Tests
       run: |
         export GOPATH=$(go env GOPATH)
-        make e2e-test-coverage-policyautomation
+        KUBECONFIG=${PWD}/kubeconfig_hub make e2e-test-coverage-policyautomation
 
     - name: Upload PolicyAutomation Test Coverage
       if: ${{ github.event_name == 'pull_request' && matrix.kind == 'latest'}}

Makefile

@@ -28,9 +28,11 @@ TESTARGS_DEFAULT := "-v"
 export TESTARGS ?= $(TESTARGS_DEFAULT)
 VERSION ?= $(shell cat COMPONENT_VERSION 2> /dev/null)
 IMAGE_NAME_AND_VERSION ?= $(REGISTRY)/$(IMG)
+CONTROLLER_NAME = $(shell cat COMPONENT_NAME 2> /dev/null)
+CONTROLLER_NAMESPACE ?= open-cluster-management
 # Handle KinD configuration
 CLUSTER_NAME ?= hub
-KIND_NAMESPACE ?= open-cluster-management
+KIND_NAMESPACE ?= $(CONTROLLER_NAMESPACE)
 
 # Test coverage threshold
 export COVERAGE_MIN ?= 75
@@ -60,7 +62,7 @@ clean:
 	-rm build/_output/bin/*
 	-rm coverage*.out
 	-rm report*.json
-	-rm kubeconfig_managed
+	-rm kubeconfig_*
 	-rm -r vendor/
 
 ############################################################
@@ -141,10 +143,10 @@ generate-operator-yaml: kustomize manifests
 ############################################################
 
 .PHONY: kind-bootstrap-cluster
-kind-bootstrap-cluster: kind-create-cluster install-crds webhook kind-deploy-controller install-resources
+kind-bootstrap-cluster: kind-bootstrap-cluster-dev webhook kind-deploy-controller install-resources
 
 .PHONY: kind-bootstrap-cluster-dev
-kind-bootstrap-cluster-dev: kind-create-cluster install-crds install-resources
+kind-bootstrap-cluster-dev: kind-create-cluster install-crds kind-controller-kubeconfig
 
 cert-manager:
 	@echo Installing cert-manager
@@ -200,9 +202,6 @@ kind-deploy-controller-dev: kind-deploy-controller
 # Specify KIND_VERSION to indicate the version tag of the KinD image
 .PHONY: kind-create-cluster
 kind-create-cluster: KIND_ARGS += --config build/kind/kind-config.yaml
-kind-create-cluster:
-	@echo "creating cluster"
-	kind create cluster --name $(KIND_NAME) $(KIND_ARGS)
 
 .PHONY: kind-delete-cluster
 kind-delete-cluster:
@@ -229,9 +228,13 @@ install-crds: manifests
 install-resources:
 	@echo creating namespaces
 	kubectl create ns policy-propagator-test
+	kubectl create ns $(KIND_NAMESPACE)
 	kubectl create ns managed1
 	kubectl create ns managed2
 	kubectl create ns managed3
+	@echo deploying roles and service account
+	kubectl apply -k deploy/rbac -n $(KIND_NAMESPACE)
+	kubectl apply -f deploy/manager/service-account.yaml -n $(KIND_NAMESPACE)
 	@echo creating cluster resources
 	kubectl apply -f test/resources/managed1-cluster.yaml
 	kubectl apply -f test/resources/managed2-cluster.yaml

deploy/manager/kustomization.yaml

@@ -1,3 +1,4 @@
 resources:
 - ./manager.yaml
+- ./service-account.yaml
 - ../rbac/

deploy/manager/manager.yaml

@@ -59,35 +59,3 @@ spec:
         secret:
           defaultMode: 420
           secretName: propagator-webhook-server-cert
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: governance-policy-propagator-global
-subjects:
-- kind: ServiceAccount
-  name: governance-policy-propagator
-  namespace: open-cluster-management
-roleRef:
-  kind: ClusterRole
-  name: governance-policy-propagator
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: governance-policy-propagator-leader-election-rolebinding
-subjects:
-- kind: ServiceAccount
-  name: governance-policy-propagator
-  namespace: open-cluster-management
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: governance-policy-propagator-leader-election-role
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: governance-policy-propagator
-  namespace: open-cluster-management

deploy/manager/service-account.yaml

@@ -0,0 +1,32 @@
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: governance-policy-propagator-global
+subjects:
+- kind: ServiceAccount
+  name: governance-policy-propagator
+  namespace: open-cluster-management
+roleRef:
+  kind: ClusterRole
+  name: governance-policy-propagator
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: governance-policy-propagator-leader-election-rolebinding
+subjects:
+- kind: ServiceAccount
+  name: governance-policy-propagator
+  namespace: open-cluster-management
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: governance-policy-propagator-leader-election-role
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: governance-policy-propagator
+  namespace: open-cluster-management