operator-namespaced.yaml

# This YAML file lists all *namespaced* objects that the operator
# needs to do its job when running inside the cluster.
#
# 💡 The namespace is always `wordpress-test`. Substitute it (as the
# OLM controller does) if you want to run the operator in another
# namespace.
#
# See also `opeator-non-namespaced.yaml`
---
# ServiceAccount/wp-operator
apiVersion: v1
kind: ServiceAccount
metadata:
  name: wp-operator
  namespace: wordpress-test
automountServiceAccountToken: false

---
# Role/wp-operator
#
# ⚠ Each time you add permissions here, you need to also update the
# OLM controller's permissions (in the `ClusterRoleBinding` object in
# olm/controller-deployment-and-rbac.yaml); see comments there to
# explain why.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: wp-operator
  namespace: wordpress-test
rules:
  - apiGroups: ['wordpress.epfl.ch']
    resources:
    - wordpresssites
    - wordpresssites/status
    verbs: ['*']
  - apiGroups: ['networking.k8s.io']
    resources:
    - ingresses
    verbs: ['*']
  - apiGroups: ['']
    resources:
    - events
    verbs: ['create', 'patch']
  - apiGroups: ['']
    resources:
      - pods
      - pods/status
    verbs: ['get', 'list', 'watch', 'create', 'delete']
  - apiGroups: ['']
    resources: ['services']
    verbs: ['get', 'list', 'watch']
  - apiGroups: ['k8s.mariadb.com']
    resources:
    - backups
    - connections
    - databases
    - grants
    - mariadbs
    - sqljobs
    - users
    - restores
    verbs: ['*']
  - apiGroups: ['']
    resources:
    - secrets
    verbs: ['*']
  - apiGroups: ['']
    resources: ['configmaps']
    resourceNames: ['wp-operator-lock']
    verbs: ['*']
  - apiGroups: ['']
    resources: ['configmaps']
    verbs: ["create"]
  - apiGroups: ['route.openshift.io']
    resources: ['routes', "routes/custom-host"]
    verbs: ["*"]

---
# RoleBinding/wp-operator
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: wp-operator
  namespace: wordpress-test
subjects:
- kind: ServiceAccount
  name: wp-operator
  namespace: wordpress-test
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: wp-operator

---
# Deployment/wp-operator
apiVersion: apps/v1
kind: Deployment
metadata:
  name: wp-operator
  namespace: wordpress-test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: wp-operator
  strategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: wp-operator
    spec:
      serviceAccountName: wp-operator
      automountServiceAccountToken: true
      imagePullSecrets:
      - name: wp-operator-pull
      containers:
        - name: wp-operator
          image: quay-its.epfl.ch/svc0041/wp-operator:latest
          args:
          - --namespace=wordpress-test
          - --
          - --wp-dir=/wp
          - --secret-dir=/wp-secrets
          - --media-restore-to-pvc=wordpress-data
          - --image-for-restore=quay-its.epfl.ch/svc0041/rsync
          - --image-pull-secret=svc0041-svc0041-puller-pull-secret
          envFrom:
            - configMapRef:
                  name: wp-operator-config
            - secretRef:
                name: wp-operator-supplemental-environment
                optional: true
          volumeMounts:
            - name: wp-data
              mountPath: /wp-data/
            - name: wp-secrets
              mountPath: /wp-secrets
          resources:
            limits:
              memory: 1Gi
            requests:
              cpu: 300m
              memory: 1Gi
      restartPolicy: Always
      volumes:
        - name: wp-data
          persistentVolumeClaim:
            claimName: wordpress-data
        - name: wp-secrets
          secret:
            secretName: wp-plugin-secrets

# Additional RBAC for the WordPress Deployment starts here
# We have no control over the fact that the `nginx-ingress-controller`
# (that we use unmodified `FROM rancher/nginx-ingress-controller`)
# wants this authority — And no other way to provide these permissions,
# than to piggy-back them with our operator's OLM controller.

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: wp-cron
  namespace: wordpress-test

---
# Role/wp-cron
#
# ⚠ Each time you add permissions here, you need to also update the
# OLM controller's permissions (in the `ClusterRoleBinding` object in
# olm/controller-deployment-and-rbac.yaml); see comments there to
# explain why.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: wp-cron
  namespace: wordpress-test
rules:
  - apiGroups: ['wordpress.epfl.ch']
    resources:
      - wordpresssites
    verbs: ['get', 'list', 'watch']
  - apiGroups: ['wordpress.epfl.ch']
    resources: [ "wordpresssites/status" ]
    verbs: [ "patch" ]
  - apiGroups: ['networking.k8s.io']
    resources:
      - ingresses
    verbs: ['get', 'list', 'watch']

---

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: wp-cron
  namespace: wordpress-test
subjects:
  - kind: ServiceAccount
    name: wp-cron
    namespace: wordpress-test
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: wp-cron

---

# ServiceAccount/wp-nginx
apiVersion: v1
kind: ServiceAccount
metadata:
  name: wp-nginx
  namespace: wordpress-test
automountServiceAccountToken: false

---

# Role/wp-nginx
#
# ⚠ Each time you add permissions here, you need to also update the
# OLM controller's permissions (in the `ClusterRoleBinding` object in
# olm/controller-deployment-and-rbac.yaml); see comments there to
# explain why.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: wp-nginx
  namespace: wordpress-test
rules:
  # Required for `--namespace` flag: the nginx controller wants to read its own namespace.
  - apiGroups: ['']
    resources:
    - namespaces
    verbs: ['get']
  - apiGroups: ['networking.k8s.io']
    resources:
    - ingresses
    verbs: ['get', 'list', 'watch']
  - apiGroups: ['networking.k8s.io']
    resources:
    - ingresses/status
    verbs: ['update']
  - apiGroups: ['']
    resources:
    - events
    verbs: ['create', 'patch']
  # We have no control over `nginx-ingress-controller` throwing a tantrum
  # if it doesn't have these permissions, even though it arguably doesn't
  # need them in our use case:
  - apiGroups: ['']
    resources:
      - pods
      - services
    verbs: ['get', 'list', 'watch']
  - apiGroups: ['discovery.k8s.io']
    resources:
    - endpointslices
    verbs: ['get', 'list', 'watch']
  - apiGroups: ['']
    resources:
    - configmaps
    resourceNames:
    - wp-nginx
    verbs: ['get', 'watch']

---

# RoleBinding/wp-nginx
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: wp-nginx
  namespace: wordpress-test
subjects:
- kind: ServiceAccount
  name: wp-nginx
  namespace: wordpress-test
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: wp-nginx

---

# ClusterRoleBinding/wp-nginx
# 💡 The corresponding ClusterRole is in `operator-non-namespaced.yml`.
# The reason this one is quote-unquote “namespaced”, is that we need to
# have another one for every namespace. The controller's full text substitution
# logic achieves that.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: wp-nginx--wordpress-test
subjects:
- kind: ServiceAccount
  name: wp-nginx
  namespace: wordpress-test
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: wp-nginx


---

# ClusterRoleBinding/wp-operator
# See comment above.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: wp-operator--wordpress-test
subjects:
- kind: ServiceAccount
  name: wp-operator
  namespace: wordpress-test
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: wp-operator

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: wp-fleet
  namespace: wordpress-test

---
# Role/wp-fleet
#
# ⚠ Each time you add permissions here, you need to also update the
# OLM controller's permissions (in the `ClusterRoleBinding` object in
# olm/controller-deployment-and-rbac.yaml); see comments there to
# explain why.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: wp-fleet
  namespace: wordpress-test
rules:
  - apiGroups: ['wordpress.epfl.ch']
    resources:
      - wordpresssites
    verbs: ['get', 'list', 'watch']
  - apiGroups: ['k8s.mariadb.com']
    resources:
      - backups
      - databases
    verbs: ['get', 'list', 'watch']

---

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: wp-fleet
  namespace: wordpress-test
subjects:
  - kind: ServiceAccount
    name: wp-fleet
    namespace: wordpress-test
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: wp-fleet