Skip to content

Commit 4947c94

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #402 from feichashao/SREP-1616
[SREP-1616] chore: Update openshift/api related dependencies
2 parents fac00d8 + 6ee705a commit 4947c94

File tree

7 files changed

+189
-167
lines changed

7 files changed

+189
-167
lines changed

‎build/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
ARG BASE_IMAGE=registry.ci.openshift.org/openshift/release:rhel-8-release-golang-1.23-openshift-4.19
1+
ARG BASE_IMAGE=registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.24-openshift-4.20
22
FROM ${BASE_IMAGE} AS builder
33

44
RUN mkdir -p /workdir

‎build/selectorsyncset.yaml‎

Lines changed: 0 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,11 @@
11
apiVersion: template.openshift.io/v1
22
kind: Template
33
metadata:
4-
creationTimestamp: null
54
name: selectorsyncset-template
65
objects:
76
- apiVersion: hive.openshift.io/v1
87
kind: SelectorSyncSet
98
metadata:
10-
creationTimestamp: null
119
labels:
1210
managed.openshift.io/gitHash: ${IMAGE_TAG}
1311
managed.openshift.io/gitRepoName: ${REPO_NAME}
@@ -22,7 +20,6 @@ objects:
2220
- apiVersion: v1
2321
kind: Namespace
2422
metadata:
25-
creationTimestamp: null
2623
labels:
2724
openshift.io/cluster-monitoring: "true"
2825
name: openshift-validation-webhook
@@ -31,13 +28,11 @@ objects:
3128
- apiVersion: v1
3229
kind: ServiceAccount
3330
metadata:
34-
creationTimestamp: null
3531
name: validation-webhook
3632
namespace: openshift-validation-webhook
3733
- apiVersion: rbac.authorization.k8s.io/v1
3834
kind: Role
3935
metadata:
40-
creationTimestamp: null
4136
name: validation-webhook
4237
namespace: openshift-validation-webhook
4338
rules:
@@ -56,7 +51,6 @@ objects:
5651
- apiVersion: rbac.authorization.k8s.io/v1
5752
kind: RoleBinding
5853
metadata:
59-
creationTimestamp: null
6054
name: validation-webhook:validation-webhook
6155
namespace: openshift-validation-webhook
6256
roleRef:
@@ -70,7 +64,6 @@ objects:
7064
- apiVersion: rbac.authorization.k8s.io/v1
7165
kind: ClusterRole
7266
metadata:
73-
creationTimestamp: null
7467
name: validation-webhook
7568
rules:
7669
- apiGroups:
@@ -82,7 +75,6 @@ objects:
8275
- apiVersion: rbac.authorization.k8s.io/v1
8376
kind: ClusterRoleBinding
8477
metadata:
85-
creationTimestamp: null
8678
name: validation-webhook:validation-webhook
8779
roleRef:
8880
apiGroup: rbac.authorization.k8s.io
@@ -95,7 +87,6 @@ objects:
9587
- apiVersion: rbac.authorization.k8s.io/v1
9688
kind: Role
9789
metadata:
98-
creationTimestamp: null
9990
name: prometheus-k8s
10091
namespace: openshift-validation-webhook
10192
rules:
@@ -112,7 +103,6 @@ objects:
112103
- apiVersion: rbac.authorization.k8s.io/v1
113104
kind: RoleBinding
114105
metadata:
115-
creationTimestamp: null
116106
name: prometheus-k8s
117107
namespace: openshift-validation-webhook
118108
roleRef:
@@ -126,7 +116,6 @@ objects:
126116
- apiVersion: monitoring.coreos.com/v1
127117
kind: ServiceMonitor
128118
metadata:
129-
creationTimestamp: null
130119
name: validating-webhook-metrics
131120
namespace: openshift-validation-webhook
132121
spec:
@@ -145,15 +134,13 @@ objects:
145134
metadata:
146135
annotations:
147136
service.beta.openshift.io/inject-cabundle: "true"
148-
creationTimestamp: null
149137
name: webhook-cert
150138
namespace: openshift-validation-webhook
151139
- apiVersion: v1
152140
kind: Service
153141
metadata:
154142
annotations:
155143
service.beta.openshift.io/serving-cert-secret-name: webhook-cert
156-
creationTimestamp: null
157144
labels:
158145
hypershift.openshift.io/allow-guest-webhooks: "true"
159146
name: validation-webhook
@@ -173,7 +160,6 @@ objects:
173160
- apiVersion: apps/v1
174161
kind: DaemonSet
175162
metadata:
176-
creationTimestamp: null
177163
labels:
178164
app: validation-webhook
179165
name: validation-webhook
@@ -184,7 +170,6 @@ objects:
184170
app: validation-webhook
185171
template:
186172
metadata:
187-
creationTimestamp: null
188173
labels:
189174
app: validation-webhook
190175
spec:
@@ -249,7 +234,6 @@ objects:
249234
metadata:
250235
annotations:
251236
service.beta.openshift.io/inject-cabundle: "true"
252-
creationTimestamp: null
253237
name: sre-clusterrolebindings-validation
254238
webhooks:
255239
- admissionReviewVersions:
@@ -279,7 +263,6 @@ objects:
279263
metadata:
280264
annotations:
281265
service.beta.openshift.io/inject-cabundle: "true"
282-
creationTimestamp: null
283266
name: sre-clusterroles-validation
284267
webhooks:
285268
- admissionReviewVersions:
@@ -309,7 +292,6 @@ objects:
309292
metadata:
310293
annotations:
311294
service.beta.openshift.io/inject-cabundle: "true"
312-
creationTimestamp: null
313295
name: sre-customresourcedefinitions-validation
314296
webhooks:
315297
- admissionReviewVersions:
@@ -341,7 +323,6 @@ objects:
341323
metadata:
342324
annotations:
343325
service.beta.openshift.io/inject-cabundle: "true"
344-
creationTimestamp: null
345326
name: sre-hiveownership-validation
346327
webhooks:
347328
- admissionReviewVersions:
@@ -375,7 +356,6 @@ objects:
375356
metadata:
376357
annotations:
377358
service.beta.openshift.io/inject-cabundle: "true"
378-
creationTimestamp: null
379359
name: sre-imagecontentpolicies-validation
380360
webhooks:
381361
- admissionReviewVersions:
@@ -417,7 +397,6 @@ objects:
417397
metadata:
418398
annotations:
419399
service.beta.openshift.io/inject-cabundle: "true"
420-
creationTimestamp: null
421400
name: sre-ingress-config-validation
422401
webhooks:
423402
- admissionReviewVersions:
@@ -449,7 +428,6 @@ objects:
449428
metadata:
450429
annotations:
451430
service.beta.openshift.io/inject-cabundle: "true"
452-
creationTimestamp: null
453431
name: sre-namespace-validation
454432
webhooks:
455433
- admissionReviewVersions:
@@ -481,7 +459,6 @@ objects:
481459
metadata:
482460
annotations:
483461
service.beta.openshift.io/inject-cabundle: "true"
484-
creationTimestamp: null
485462
name: sre-networkpolicies-validation
486463
webhooks:
487464
- admissionReviewVersions:
@@ -513,7 +490,6 @@ objects:
513490
metadata:
514491
annotations:
515492
service.beta.openshift.io/inject-cabundle: "true"
516-
creationTimestamp: null
517493
name: sre-node-validation-osd
518494
webhooks:
519495
- admissionReviewVersions:
@@ -546,7 +522,6 @@ objects:
546522
metadata:
547523
annotations:
548524
service.beta.openshift.io/inject-cabundle: "true"
549-
creationTimestamp: null
550525
name: sre-pod-validation
551526
webhooks:
552527
- admissionReviewVersions:
@@ -576,7 +551,6 @@ objects:
576551
metadata:
577552
annotations:
578553
service.beta.openshift.io/inject-cabundle: "true"
579-
creationTimestamp: null
580554
name: sre-prometheusrule-validation
581555
webhooks:
582556
- admissionReviewVersions:
@@ -608,7 +582,6 @@ objects:
608582
metadata:
609583
annotations:
610584
service.beta.openshift.io/inject-cabundle: "true"
611-
creationTimestamp: null
612585
name: sre-regular-user-validation
613586
webhooks:
614587
- admissionReviewVersions:
@@ -720,7 +693,6 @@ objects:
720693
metadata:
721694
annotations:
722695
service.beta.openshift.io/inject-cabundle: "true"
723-
creationTimestamp: null
724696
name: sre-scc-validation
725697
webhooks:
726698
- admissionReviewVersions:
@@ -751,7 +723,6 @@ objects:
751723
metadata:
752724
annotations:
753725
service.beta.openshift.io/inject-cabundle: "true"
754-
creationTimestamp: null
755726
name: sre-sdn-migration-validation
756727
webhooks:
757728
- admissionReviewVersions:
@@ -781,7 +752,6 @@ objects:
781752
metadata:
782753
annotations:
783754
service.beta.openshift.io/inject-cabundle: "true"
784-
creationTimestamp: null
785755
name: sre-serviceaccount-validation
786756
webhooks:
787757
- admissionReviewVersions:
@@ -811,7 +781,6 @@ objects:
811781
metadata:
812782
annotations:
813783
service.beta.openshift.io/inject-cabundle: "true"
814-
creationTimestamp: null
815784
name: sre-techpreviewnoupgrade-validation
816785
webhooks:
817786
- admissionReviewVersions:
@@ -841,7 +810,6 @@ objects:
841810
- apiVersion: hive.openshift.io/v1
842811
kind: SelectorSyncSet
843812
metadata:
844-
creationTimestamp: null
845813
labels:
846814
managed.openshift.io/gitHash: ${IMAGE_TAG}
847815
managed.openshift.io/gitRepoName: ${REPO_NAME}
@@ -865,7 +833,6 @@ objects:
865833
metadata:
866834
annotations:
867835
service.beta.openshift.io/inject-cabundle: "true"
868-
creationTimestamp: null
869836
name: sre-clusterlogging-validation
870837
webhooks:
871838
- admissionReviewVersions:
@@ -895,7 +862,6 @@ objects:
895862
- apiVersion: hive.openshift.io/v1
896863
kind: SelectorSyncSet
897864
metadata:
898-
creationTimestamp: null
899865
labels:
900866
managed.openshift.io/gitHash: ${IMAGE_TAG}
901867
managed.openshift.io/gitRepoName: ${REPO_NAME}
@@ -917,7 +883,6 @@ objects:
917883
metadata:
918884
annotations:
919885
service.beta.openshift.io/inject-cabundle: "true"
920-
creationTimestamp: null
921886
name: sre-ingresscontroller-validation
922887
webhooks:
923888
- admissionReviewVersions:

‎docs/webhooks-short.json‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@
77
"webhookName": "clusterrolebindings-validation",
88
"documentString": "Managed OpenShift Customers may not delete the cluster role bindings under the managed namespaces: (^openshift-.*|kube-system)"
99
},
10+
{
11+
"webhookName": "clusterroles-validation",
12+
"documentString": "Managed OpenShift Customers may not delete protected ClusterRoles including cluster-admin, view, edit, admin, specific system roles (system:admin, system:node, system:node-proxier, system:kube-scheduler, system:kube-controller-manager), and backplane-* roles"
13+
},
1014
{
1115
"webhookName": "customresourcedefinitions-validation",
1216
"documentString": "Managed OpenShift Customers may not change CustomResourceDefinitions managed by Red Hat."
@@ -25,7 +29,7 @@
2529
},
2630
{
2731
"webhookName": "ingresscontroller-validation",
28-
"documentString": "Managed OpenShift Customer may create IngressControllers without necessary taints. This can cause those workloads to be provisioned on infra or master nodes."
32+
"documentString": "Managed OpenShift Customer may create IngressControllers without necessary taints. This can cause those workloads to be provisioned on master nodes."
2933
},
3034
{
3135
"webhookName": "namespace-validation",
@@ -43,13 +47,17 @@
4347
"webhookName": "pod-validation",
4448
"documentString": "Managed OpenShift Customers may use tolerations on Pods that could cause those Pods to be scheduled on infra or master nodes."
4549
},
50+
{
51+
"webhookName": "podimagespec-mutation",
52+
"documentString": "OpenShift debugging tools on Managed OpenShift clusters must be available even if internal image registry is removed."
53+
},
4654
{
4755
"webhookName": "prometheusrule-validation",
4856
"documentString": "Managed OpenShift Customers may not create PrometheusRule in namespaces managed by Red Hat."
4957
},
5058
{
5159
"webhookName": "regular-user-validation",
52-
"documentString": "Managed OpenShift customers may not manage any objects in the following APIGroups [admissionregistration.k8s.io managed.openshift.io addons.managed.openshift.io ocmagent.managed.openshift.io upgrade.managed.openshift.io config.openshift.io operator.openshift.io network.openshift.io cloudcredential.openshift.io machine.openshift.io splunkforwarder.managed.openshift.io autoscaling.openshift.io cloudingress.managed.openshift.io machineconfiguration.openshift.io], nor may Managed OpenShift customers alter the APIServer, KubeAPIServer, OpenShiftAPIServer, ClusterVersion, Proxy or SubjectPermission objects."
60+
"documentString": "Managed OpenShift customers may not manage any objects in the following APIGroups [upgrade.managed.openshift.io config.openshift.io operator.openshift.io network.openshift.io admissionregistration.k8s.io addons.managed.openshift.io cloudingress.managed.openshift.io managed.openshift.io splunkforwarder.managed.openshift.io autoscaling.openshift.io machineconfiguration.openshift.io cloudcredential.openshift.io machine.openshift.io ocmagent.managed.openshift.io], nor may Managed OpenShift customers alter the APIServer, KubeAPIServer, OpenShiftAPIServer, ClusterVersion, Proxy or SubjectPermission objects."
5361
},
5462
{
5563
"webhookName": "scc-validation",

‎docs/webhooks.json‎

Lines changed: 44 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,27 @@
4242
],
4343
"documentString": "Managed OpenShift Customers may not delete the cluster role bindings under the managed namespaces: (^openshift-.*|kube-system)"
4444
},
45+
{
46+
"webhookName": "clusterroles-validation",
47+
"rules": [
48+
{
49+
"operations": [
50+
"DELETE"
51+
],
52+
"apiGroups": [
53+
"rbac.authorization.k8s.io"
54+
],
55+
"apiVersions": [
56+
"v1"
57+
],
58+
"resources": [
59+
"clusterroles"
60+
],
61+
"scope": "Cluster"
62+
}
63+
],
64+
"documentString": "Managed OpenShift Customers may not delete protected ClusterRoles including cluster-admin, view, edit, admin, specific system roles (system:admin, system:node, system:node-proxier, system:kube-scheduler, system:kube-controller-manager), and backplane-* roles"
65+
},
4566
{
4667
"webhookName": "customresourcedefinitions-validation",
4768
"rules": [
@@ -175,7 +196,7 @@
175196
"scope": "Namespaced"
176197
}
177198
],
178-
"documentString": "Managed OpenShift Customer may create IngressControllers without necessary taints. This can cause those workloads to be provisioned on infra or master nodes."
199+
"documentString": "Managed OpenShift Customer may create IngressControllers without necessary taints. This can cause those workloads to be provisioned on master nodes."
179200
},
180201
{
181202
"webhookName": "namespace-validation",
@@ -268,6 +289,27 @@
268289
],
269290
"documentString": "Managed OpenShift Customers may use tolerations on Pods that could cause those Pods to be scheduled on infra or master nodes."
270291
},
292+
{
293+
"webhookName": "podimagespec-mutation",
294+
"rules": [
295+
{
296+
"operations": [
297+
"CREATE"
298+
],
299+
"apiGroups": [
300+
""
301+
],
302+
"apiVersions": [
303+
"v1"
304+
],
305+
"resources": [
306+
"pods"
307+
],
308+
"scope": "Namespaced"
309+
}
310+
],
311+
"documentString": "OpenShift debugging tools on Managed OpenShift clusters must be available even if internal image registry is removed."
312+
},
271313
{
272314
"webhookName": "prometheusrule-validation",
273315
"rules": [
@@ -434,7 +476,7 @@
434476
"scope": "*"
435477
}
436478
],
437-
"documentString": "Managed OpenShift customers may not manage any objects in the following APIGroups [autoscaling.openshift.io network.openshift.io machine.openshift.io admissionregistration.k8s.io addons.managed.openshift.io cloudingress.managed.openshift.io splunkforwarder.managed.openshift.io upgrade.managed.openshift.io managed.openshift.io ocmagent.managed.openshift.io config.openshift.io machineconfiguration.openshift.io operator.openshift.io cloudcredential.openshift.io], nor may Managed OpenShift customers alter the APIServer, KubeAPIServer, OpenShiftAPIServer, ClusterVersion, Proxy or SubjectPermission objects."
479+
"documentString": "Managed OpenShift customers may not manage any objects in the following APIGroups [splunkforwarder.managed.openshift.io autoscaling.openshift.io ocmagent.managed.openshift.io upgrade.managed.openshift.io config.openshift.io machineconfiguration.openshift.io operator.openshift.io network.openshift.io cloudcredential.openshift.io machine.openshift.io admissionregistration.k8s.io addons.managed.openshift.io cloudingress.managed.openshift.io managed.openshift.io], nor may Managed OpenShift customers alter the APIServer, KubeAPIServer, OpenShiftAPIServer, ClusterVersion, Proxy or SubjectPermission objects."
438480
},
439481
{
440482
"webhookName": "scc-validation",

0 commit comments

Comments
 (0)