Merge pull request #17 from stackhpc/feat/parameterisable-resources

Allow the managed resources to be specified in the chart values

charts/operator/templates/clusterrole-operator.yaml

@@ -18,13 +18,13 @@ rules:
   - apiGroups: ["scheduling.azimuth.stackhpc.com"]
     resources: ["*"]
     verbs: ["*"]
-  # allow these things to be deleted by the operator
-  - apiGroups: ["caas.azimuth.stackhpc.com"]
-    resources: ["clusters"]
-    verbs: ["*"]
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["*"]
-  - apiGroups: ["rbac.authorization.k8s.io"]
-    resources: ["clusterrolebindings"]
-    verbs: ["get", "list", "create", "update", "patch"]
+  # Allow the managed resources to be deleted by the operator
+  {{- range .Values.managedResources }}
+  - apiGroups:
+      {{- list .apiGroup | toYaml | nindent 6 }}
+    resources:
+      {{- toYaml .resources | nindent 6 }}
+    verbs:
+      - get
+      - delete
+  {{- end }}

charts/operator/values.yaml

@@ -45,6 +45,14 @@ affinity: {}
 # Tolerations for operator pods
 tolerations: []
 
+# The resources that will be managed by the schedule operator
+# By default, the schedule operator is allowed to manage Azimuth CaaS and Kubernetes clusters
+managedResources:
+  - apiGroup: caas.azimuth.stackhpc.com
+    resources: [clusters]
+  - apiGroup: azimuth.stackhpc.com
+    resources: [clusters]
+
 # Settings for kube-state-metrics
 metrics:
   enabled: false

tools/functional_test.sh

@@ -13,7 +13,8 @@ helm upgrade azimuth-schedule-operator ./charts/operator \
   --install \
   --wait \
   --timeout 10m \
-  --set-string image.tag=${GITHUB_SHA::7}
+  --set-string image.tag=${GITHUB_SHA::7} \
+  --set-json 'managedResources=[{"apiGroup": "", "resources": ["configmaps"]}]'
 
 until [ `kubectl get crds | grep schedules.scheduling.azimuth.stackhpc.com | wc -l` -eq 1 ]; do echo "wait for crds"; sleep 5; done
 kubectl get crds