Project: Operator Framework (App Definition and Development / Application Definition & Image Build)
File: v1.6.1.md

title: v1.6.1 weight: 998994000 To add this option your project you will need to: Create the file . Create the file . Update the `config/default/kustomization.yaml` by adding the following to `resources`: ```yaml resources: ... managerconfigpatch.yaml ``` Update the `config/manager/kustomization.yaml` by adding: ```yaml generatorOptions: disableNameSuffixHash: true configMapGenerator: files: controllermanagerconfig.yaml name: manager-config apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization images: name: controller newName: quay.io/example/memcached-operator newTag: v0.0.1 ``` See for more details. Add the rule for the `apiGroups` `coordination.k8s.io` and the resource `leases` in config/rbac/leaderelectionrole.yaml: ```yaml rules: apiGroups: "" coordination.k8s.io resources: configmaps leases ``` See for more details. In your requirements.yml, change the `version` field for community.kubernetes to `1.2.1`, and the `version` field for `operator_sdk.util` to `0.2.0`. See for more details. Replace deprecated flags `--enable-leader-election` and `--metrics-addr` with `--leader-elect` and `--metrics-bind-address`, respectively. See for more details. Add the arg `--health-probe-bind-address=:8081` to the `config/default/managerauthproxy_patch.yaml`: ```yaml spec: template: spec: containers: name: manager args: "--health-probe-bind-address=:8081" ... ``` See for more details. Add the arg `--health-probe-bind-address=:6789` to the `config/default/managerauthproxy_patch.yaml`: ```yaml spec: template: spec: containers: name: manager args: "--health-probe-bind-address=:6789" ... ``` See for more details. Ansible/Helm projects now provide a Makefile `help` target, similar to a `--help` flag. You can copy and paste this target from the relevant sample's Makefile (, ). See for more details. In `config/manager/manager.yaml`, add the following security contexts: ```yaml spec: ... template: ... spec: securityContext: runAsNonRoot: true containers: name: manager securityContext: allowPrivilegeEscalation: false ``` See for more details. OLM does , so a JSON patch was added to remove this volume and mount such that OLM can itself create and manage certs for your Operator. In `config/manifests/kustomization.yaml`, add the following: ```yaml ``` If you have configured your operator to use webhooks, add this YAML block uncommented. See for more details. The `/metrics` endpoint, while specifying the `https` port on the manager Pod, was not actually configured to serve over https because no tlsConfig was set. Since kube-rbac-proxy secures this endpoint as a manager sidecar, using the service account token mounted into the Pod by default corrects this problem. The changes should look like: ```diff spec: endpoints: path: /metrics port: https scheme: https bearerTokenFile:

tlsConfig: insecureSkipVerify: true selector: matchLabels: control-plane: controller-manager ``` Note: if you have removed kube-rbac-proxy from your project, make sure to secure the `/metrics` endpoint using a proper . See for more details. The `opm` and `catalog-build` Makefile targets were added so operator developers who want to create their own catalogs for their operator or add their operator's bundle(s) to an existing catalog can do so. If this sounds like you, add the following lines to the bottom of your Makefile: ```make .PHONY: opm OPM = ./bin/opm opm: ifeq (,$(wildcard $(OPM))) ifeq (,$(shell which opm 2>/dev/null)) @{ \ set -e ;\ mkdir -p $(dir $(OPM)) ;\ curl -sSLo $(OPM) https://github.com/operator-framework/operator-registry/releases/download/v1.19.1/$(OS)-$(ARCH)-opm ;\ chmod +x $(OPM) ;\ } else OPM = $(shell which opm) endif endif BUNDLEIMGS ?= $(BUNDLEIMG) CATALOGIMG ?= $(IMAGETAGBASE)-catalog:v$(VERSION) ifneq ($(origin CATALOGBASEIMG), undefined) FROMINDEXOPT := --from-index $(CATALOGBASE_IMG) endif .PHONY: catalog-build catalog-build: opm $(OPM) index add --container-tool docker --mode semver --tag $(CATALOGIMG) --bundles $(BUNDLEIMGS) $(FROMINDEXOPT) .PHONY: catalog-push catalog-push: ## Push the catalog image. $(MAKE) docker-push IMG=$(CATALOG_IMG) ``` If updating a Go operator project, additionally add the following Makefile variables: ```make OS = $(shell go env GOOS) ARCH = $(shell go env GOARCH) ``` See for more details. The following Makefile changes were made to allow `make bundle-build bundle-push catalog-build catalog-push` and encode image repo/namespace information in the Makefile by default: ```diff +IMAGETAGBASE ?= <registry>/<operator name> -BUNDLE_IMG ?= controller-bundle:$(VERSION) +BUNDLEIMG ?= $(IMAGETAG_BASE)-bundle:v$(VERSION) ``` For example, if `IMAGETAGBASE ?= foo/bar-operator` then running `make bundle-build bundle-push catalog-build catalog-push` would build `foo/bar-operator-bundle:v0.0.1` and `foo/bar-operator-catalog:v0.0.1` then push them to the `docker.io/foo` namespaced registry. See for more details. A non-default ServiceAccount `controller-manager` is scaffolded on `operator-sdk init`, to improve security for operators installed in shared namespaces. To add this ServiceAccount to your project, do the following: ```sh cat <<EOF > config/rbac/service_account.yaml apiVersion: v1 kind: ServiceAccount metadata: name: controller-manager namespace: system EOF echo "- service_account.yaml" >> config/rbac/kustomization.yaml find config/rbac -name *_binding.yaml -exec sed -i -E 's/ name: default/ name: controller-manager/g' {} \; sed -i -E 's/([ ]+)(terminationGracePeriodSeconds:)/\1serviceAccountName: controller-manager\n\1\2/g' config/manager/manager.yaml ``` The changes should look like: ```diff requests: cpu: 100m memory: 20Mi serviceAccountName: controller-manager terminationGracePeriodSeconds: 10 name: proxy-role subjects: kind: ServiceAccount name: default name: controller-manager namespace: system resources: +- service_account.yaml role.yaml role_binding.yaml leaderelectionrole.yaml name: leader-election-role subjects: kind: ServiceAccount name: default name: controller-manager namespace: system name: manager-role subjects: kind: ServiceAccount name: default name: controller-manager namespace: system +apiVersion: v1 +kind: ServiceAccount +metadata: name: controller-manager namespace: system ``` See for more details.