diff --git a/chart/kube-arangodb/templates/deployment-operator/role-binding.yaml b/chart/kube-arangodb/templates/deployment-operator/role-binding.yaml index d06ec7ec0..ed6054f3b 100644 --- a/chart/kube-arangodb/templates/deployment-operator/role-binding.yaml +++ b/chart/kube-arangodb/templates/deployment-operator/role-binding.yaml @@ -2,10 +2,16 @@ {{ if .Values.operator.features.deployment -}} apiVersion: rbac.authorization.k8s.io/v1 +{{ if not (eq .Values.operator.scope "cluster") }} kind: RoleBinding +{{ else }} +kind: ClusterRoleBinding +{{ end }} metadata: name: {{ template "kube-arangodb.rbac" . }}-deployment + {{ if not (eq .Values.operator.scope "cluster") }} namespace: {{ .Release.Namespace }} + {{ end }} labels: app.kubernetes.io/name: {{ template "kube-arangodb.name" . }} helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} @@ -14,7 +20,11 @@ metadata: release: {{ .Release.Name }} roleRef: apiGroup: rbac.authorization.k8s.io + {{ if not (eq .Values.operator.scope "cluster") }} kind: Role + {{ else }} + kind: ClusterRole + {{ end }} name: {{ template "kube-arangodb.rbac" . }}-deployment subjects: - kind: ServiceAccount diff --git a/chart/kube-arangodb/templates/deployment-operator/role.yaml b/chart/kube-arangodb/templates/deployment-operator/role.yaml index 0c164cdc3..2f7c4a359 100644 --- a/chart/kube-arangodb/templates/deployment-operator/role.yaml +++ b/chart/kube-arangodb/templates/deployment-operator/role.yaml @@ -2,10 +2,16 @@ {{ if .Values.operator.features.deployment -}} apiVersion: rbac.authorization.k8s.io/v1 +{{ if not (eq .Values.operator.scope "cluster") }} kind: Role +{{ else }} +kind: ClusterRole +{{ end }} metadata: name: {{ template "kube-arangodb.rbac" . }}-deployment + {{ if not (eq .Values.operator.scope "cluster") }} namespace: {{ .Release.Namespace }} + {{ end }} labels: app.kubernetes.io/name: {{ template "kube-arangodb.name" . }} helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} diff --git a/chart/kube-arangodb/templates/deployment-replications-operator/role-binding.yaml b/chart/kube-arangodb/templates/deployment-replications-operator/role-binding.yaml index f908090c9..bea7cc766 100644 --- a/chart/kube-arangodb/templates/deployment-replications-operator/role-binding.yaml +++ b/chart/kube-arangodb/templates/deployment-replications-operator/role-binding.yaml @@ -2,10 +2,16 @@ {{ if .Values.operator.features.deploymentReplications -}} apiVersion: rbac.authorization.k8s.io/v1 +{{ if not (eq .Values.operator.scope "cluster") }} kind: RoleBinding +{{ else }} +kind: ClusterRoleBinding +{{ end }} metadata: name: {{ template "kube-arangodb.rbac" . }}-deployment-replication + {{ if not (eq .Values.operator.scope "cluster") }} namespace: {{ .Release.Namespace }} + {{ end }} labels: app.kubernetes.io/name: {{ template "kube-arangodb.name" . }} helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} @@ -14,7 +20,11 @@ metadata: release: {{ .Release.Name }} roleRef: apiGroup: rbac.authorization.k8s.io + {{ if not (eq .Values.operator.scope "cluster") }} kind: Role + {{ else }} + kind: ClusterRole + {{ end }} name: {{ template "kube-arangodb.rbac" . }}-deployment-replication subjects: - kind: ServiceAccount diff --git a/chart/kube-arangodb/templates/deployment-replications-operator/role.yaml b/chart/kube-arangodb/templates/deployment-replications-operator/role.yaml index c8cf8f993..5fdbdb7bc 100644 --- a/chart/kube-arangodb/templates/deployment-replications-operator/role.yaml +++ b/chart/kube-arangodb/templates/deployment-replications-operator/role.yaml @@ -2,10 +2,16 @@ {{ if .Values.operator.features.deploymentReplications -}} apiVersion: rbac.authorization.k8s.io/v1 +{{ if not (eq .Values.operator.scope "cluster") }} kind: Role +{{ else }} +kind: ClusterRole +{{ end }} metadata: name: {{ template "kube-arangodb.rbac" . }}-deployment-replication + {{ if not (eq .Values.operator.scope "cluster") }} namespace: {{ .Release.Namespace }} + {{ end }} labels: app.kubernetes.io/name: {{ template "kube-arangodb.name" . }} helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} diff --git a/chart/kube-arangodb/templates/deployment.yaml b/chart/kube-arangodb/templates/deployment.yaml index fd1a69f1f..c92ced771 100644 --- a/chart/kube-arangodb/templates/deployment.yaml +++ b/chart/kube-arangodb/templates/deployment.yaml @@ -1,6 +1,6 @@ {{ if eq .Values.operator.scope "legacy" -}} # Scope "legacy" selected -{{ else if eq .Values.operator.scope "namespaced" -}} +{{ else if or (eq .Values.operator.scope "namespaced") (eq .Values.operator.scope "cluster") -}} # Scope "namespaced" selected {{ if .Values.operator.features.storage -}} {{ fail (printf "Storage Operator not supported in %s scope!" .Values.operator.scope) -}} diff --git a/chart/kube-arangodb/values.yaml b/chart/kube-arangodb/values.yaml index 80da81bee..6e820fa78 100644 --- a/chart/kube-arangodb/values.yaml +++ b/chart/kube-arangodb/values.yaml @@ -6,7 +6,7 @@ operator: imagePullSecrets: [] scope: legacy - + architectures: - amd64 @@ -38,7 +38,7 @@ operator: allowChaos: false nodeSelector: {} - + enableCRDManagement: true features: diff --git a/cmd/main.go b/cmd/main.go index 73f6617cb..58350299b 100644 --- a/cmd/main.go +++ b/cmd/main.go @@ -407,16 +407,24 @@ func newOperatorConfigAndDeps(id, namespace, name string) (operator.Config, oper return operator.Config{}, operator.Dependencies{}, errors.WithStack(fmt.Errorf("Failed to get my pod's service account: %s", err)) } - eventRecorder := createRecorder(cliLog, client.Kubernetes(), name, namespace) - scope, ok := scope.AsScope(operatorOptions.scope) if !ok { return operator.Config{}, operator.Dependencies{}, errors.WithStack(fmt.Errorf("Scope %s is not known by Operator", operatorOptions.scope)) } + var watchNamespace string + if scope.IsCluster() { + watchNamespace = metav1.NamespaceAll + } else { + watchNamespace = namespace + } + + eventRecorder := createRecorder(cliLog, client.Kubernetes(), name, watchNamespace) + cfg := operator.Config{ ID: id, Namespace: namespace, + WatchNamespace: watchNamespace, PodName: name, ServiceAccount: serviceAccount, OperatorImage: image, diff --git a/pkg/operator/operator.go b/pkg/operator/operator.go index 8cc46e583..a741f15ff 100644 --- a/pkg/operator/operator.go +++ b/pkg/operator/operator.go @@ -92,6 +92,7 @@ type Operator struct { type Config struct { ID string Namespace string + WatchNamespace string PodName string ServiceAccount string OperatorImage string diff --git a/pkg/operator/operator_deployment.go b/pkg/operator/operator_deployment.go index da61af658..23549c4bb 100644 --- a/pkg/operator/operator_deployment.go +++ b/pkg/operator/operator_deployment.go @@ -49,7 +49,7 @@ func (o *Operator) runDeployments(stop <-chan struct{}) { o.log, o.Client.Arango().DatabaseV1().RESTClient(), deploymentType.ArangoDeploymentResourcePlural, - o.Config.Namespace, + o.Config.WatchNamespace, &api.ArangoDeployment{}, cache.ResourceEventHandlerFuncs{ AddFunc: o.onAddArangoDeployment, diff --git a/pkg/operator/operator_deployment_relication.go b/pkg/operator/operator_deployment_relication.go index 7266a2ee1..77c34ca60 100644 --- a/pkg/operator/operator_deployment_relication.go +++ b/pkg/operator/operator_deployment_relication.go @@ -49,7 +49,7 @@ func (o *Operator) runDeploymentReplications(stop <-chan struct{}) { o.log, o.Dependencies.Client.Arango().ReplicationV1().RESTClient(), replication2.ArangoDeploymentReplicationResourcePlural, - o.Config.Namespace, + o.Config.WatchNamespace, &api.ArangoDeploymentReplication{}, cache.ResourceEventHandlerFuncs{ AddFunc: o.onAddArangoDeploymentReplication, @@ -201,7 +201,7 @@ func (o *Operator) handleDeploymentReplicationEvent(event *Event) error { // makeDeploymentReplicationConfigAndDeps creates a Config & Dependencies object for a new DeploymentReplication. func (o *Operator) makeDeploymentReplicationConfigAndDeps(apiObject *api.ArangoDeploymentReplication) (replication.Config, replication.Dependencies) { cfg := replication.Config{ - Namespace: o.Config.Namespace, + Namespace: o.Config.WatchNamespace, } deps := replication.Dependencies{ Log: o.Dependencies.LogService.MustGetLogger(logging.LoggerNameDeploymentReplication).With(). diff --git a/pkg/operator/scope/scope.go b/pkg/operator/scope/scope.go index 80da600bc..f1f797096 100644 --- a/pkg/operator/scope/scope.go +++ b/pkg/operator/scope/scope.go @@ -26,6 +26,8 @@ func AsScope(s string) (Scope, bool) { return LegacyScope, true case NamespacedScope.String(): return NamespacedScope, true + case ClusterScope.String(): + return ClusterScope, true } return "", false @@ -37,13 +39,18 @@ func (s Scope) String() string { return string(s) } +func (s Scope) IsCluster() bool { + return s == ClusterScope +} + func (s Scope) IsNamespaced() bool { - return s == NamespacedScope + return s.IsCluster() || s == NamespacedScope } const ( LegacyScope Scope = "legacy" NamespacedScope Scope = "namespaced" + ClusterScope Scope = "cluster" DefaultScope = LegacyScope )