v2.0.6 cherry-pick into 2.0

README.md

@@ -12,12 +12,12 @@ For Mac
 ```
 brew install noobaa/noobaa/noobaa
 # or
-wget https://github.com/noobaa/noobaa-operator/releases/download/v2.0.4/noobaa-mac-v2.0.4; mv noobaa-mac-* noobaa; chmod +x noobaa
+wget https://github.com/noobaa/noobaa-operator/releases/download/v2.0.6/noobaa-mac-v2.0.6; mv noobaa-mac-* noobaa; chmod +x noobaa
 ```
 
 For Linux
 ```
-wget https://github.com/noobaa/noobaa-operator/releases/download/v2.0.4/noobaa-linux-v2.0.4; mv noobaa-linux-* noobaa; chmod +x noobaa
+wget https://github.com/noobaa/noobaa-operator/releases/download/v2.0.6/noobaa-linux-v2.0.6; mv noobaa-linux-* noobaa; chmod +x noobaa
 ```
 
 - Run: `./noobaa --help` for CLI usage

deploy/cluster_role.yaml

@@ -52,3 +52,15 @@ rules:
   - get
   - list
   - watch
+- apiGroups: # from system:auth-delegator
+  - authentication.k8s.io
+  resources:
+  - tokenreviews
+  verbs:
+  - create
+- apiGroups: # from system:auth-delegator
+  - authorization.k8s.io
+  resources:
+  - subjectaccessreviews
+  verbs:
+  - create

deploy/crds/noobaa_v1alpha1_backingstore_crd.yaml

@@ -178,8 +178,6 @@ spec:
               items:
                 type: object
               type: array
-          required:
-          - phase
           type: object
   version: v1alpha1
   versions:

deploy/crds/noobaa_v1alpha1_bucketclass_crd.yaml

@@ -62,6 +62,9 @@ spec:
                       placement:
                         description: Placement specifies the type of placement for
                           the tier If empty it should have a single backing store.
+                        enum:
+                        - Spread
+                        - Mirror
                         type: string
                     type: object
                   type: array
@@ -109,8 +112,6 @@ spec:
               items:
                 type: object
               type: array
-          required:
-          - phase
           type: object
   version: v1alpha1
   versions:

deploy/crds/noobaa_v1alpha1_noobaa_crd.yaml

@@ -53,6 +53,9 @@ spec:
         spec:
           description: Specification of the desired behavior of the noobaa system.
           properties:
+            affinity:
+              description: Affinity (optional) passed through to noobaa's pods
+              type: object
             coreResources:
               description: CoreResources (optional) overrides the default resource
                 requirements for the server container
@@ -106,6 +109,7 @@ spec:
           description: Most recently observed status of the noobaa system.
           properties:
             accounts:
+              description: Accounts reports accounts info for the admin account
               properties:
                 admin:
                   properties:
@@ -167,6 +171,7 @@ spec:
                 type: object
               type: array
             services:
+              description: Services reports addresses for the services
               properties:
                 serviceMgmt:
                   properties:
@@ -274,13 +279,6 @@ spec:
               - serviceMgmt
               - serviceS3
               type: object
-          required:
-          - observedGeneration
-          - phase
-          - actualImage
-          - accounts
-          - services
-          - readme
           type: object
   version: v1alpha1
   versions:

deploy/internal/statefulset-core.yaml

@@ -113,6 +113,10 @@ spec:
           value: ""
         - name: OAUTH_TOKEN_ENDPOINT
           value: ""
+        - name: NOOBAA_SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
         - name: container_dbg
           value: "" # any non-empty value will set the container to dbg mode
         - name: CONTAINER_CPU_REQUEST

deploy/operator.yaml

@@ -16,7 +16,7 @@ spec:
       serviceAccountName: noobaa
       containers:
         - name: noobaa-operator
-          image: noobaa/noobaa-operator:2.0.5
+          image: noobaa/noobaa-operator:2.0.6
           imagePullPolicy: IfNotPresent
           resources:
             limits:

deploy/role.yaml

@@ -25,14 +25,7 @@ rules:
   - events
   - configmaps
   - secrets
-  verbs:
-  - '*'
-- apiGroups:
-  - ""
-  resources:
   - serviceaccounts
-  resourceNames:
-    - noobaa
   verbs:
   - '*'
 - apiGroups:

deploy/service_account.yaml

@@ -2,3 +2,5 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: noobaa
+  annotations:
+    serviceaccounts.openshift.io/oauth-redirectreference.noobaa-mgmt: '{"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"noobaa-mgmt"}}'

go.mod

@@ -21,6 +21,7 @@ require (
 	github.com/sirupsen/logrus v1.4.2
 	github.com/spf13/cobra v0.0.5
 	github.com/spf13/pflag v1.0.3
+	go.uber.org/multierr v1.2.0 // indirect
 	golang.org/x/crypto v0.0.0-20190829043050-9756ffdc2472
 	golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297 // indirect
 	golang.org/x/sys v0.0.0-20190904005037-43c01164e931 // indirect

go.sum

@@ -485,6 +485,8 @@ go.uber.org/atomic v1.4.0 h1:cxzIVoETapQEqDhQu3QfnvXAV4AlzcvUCxkVUFw3+EU=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/multierr v1.1.0 h1:HoEmRHQPVSqub6w2z2d2EOVs2fjyFRGyofhKuyDq0QI=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/multierr v1.2.0 h1:6I+W7f5VwC5SV9dNrZ3qXrDB9mD0dyGOi/ZJmYw03T4=
+go.uber.org/multierr v1.2.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
 go.uber.org/zap v1.9.1/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 go.uber.org/zap v1.10.0 h1:ORx85nbTijNz8ljznvCMR1ZBIPKFn3jQrag10X2AsuM=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=

pkg/apis/noobaa/v1alpha1/backingstore_types.go

@@ -87,7 +87,8 @@ type BackingStoreSpec struct {
 type BackingStoreStatus struct {
 
 	// Phase is a simple, high-level summary of where the backing store is in its lifecycle
-	Phase BackingStorePhase `json:"phase"`
+	// +optional
+	Phase BackingStorePhase `json:"phase,omitempty"`
 
 	// Conditions is a list of conditions related to operator reconciliation
 	// +patchMergeKey=type
@@ -96,6 +97,7 @@ type BackingStoreStatus struct {
 	Conditions []conditionsv1.Condition `json:"conditions,omitempty"  patchStrategy:"merge" patchMergeKey:"type"`
 
 	// RelatedObjects is a list of objects related to this operator.
+	// +optional
 	RelatedObjects []corev1.ObjectReference `json:"relatedObjects,omitempty"`
 }
 

pkg/apis/noobaa/v1alpha1/bucketclass_types.go

@@ -65,7 +65,8 @@ type BucketClassSpec struct {
 // +k8s:openapi-gen=true
 type BucketClassStatus struct {
 	// Phase is a simple, high-level summary of where the System is in its lifecycle
-	Phase BucketClassPhase `json:"phase"`
+	// +optional
+	Phase BucketClassPhase `json:"phase,omitempty"`
 
 	// Conditions is a list of conditions related to operator reconciliation
 	// +patchMergeKey=type
@@ -74,6 +75,7 @@ type BucketClassStatus struct {
 	Conditions []conditionsv1.Condition `json:"conditions,omitempty"  patchStrategy:"merge" patchMergeKey:"type"`
 
 	// RelatedObjects is a list of objects related to this operator.
+	// +optional
 	RelatedObjects []corev1.ObjectReference `json:"relatedObjects,omitempty"`
 }
 
@@ -91,10 +93,13 @@ type Tier struct {
 
 	// Placement specifies the type of placement for the tier
 	// If empty it should have a single backing store.
+	// +optional
+	// +kubebuilder:validation:Enum=Spread,Mirror
 	Placement TierPlacement `json:"placement,omitempty"`
 
 	// BackingStores is an unordered list of backing store names.
 	// The meaning of the list depends on the placement.
+	// +optional
 	BackingStores []BackingStoreName `json:"backingStores,omitempty"`
 }
 

pkg/apis/noobaa/v1alpha1/noobaa_types.go

@@ -104,6 +104,10 @@ type NooBaaSpec struct {
 	// +optional
 	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
 
+	// Affinity (optional) passed through to noobaa's pods
+	// +optional
+	Affinity *corev1.Affinity `json:"affinity,omitempty"`
+
 	// ImagePullSecret (optional) sets a pull secret for the system image
 	// +optional
 	ImagePullSecret *corev1.LocalObjectReference `json:"imagePullSecret,omitempty"`
@@ -115,10 +119,12 @@ type NooBaaStatus struct {
 
 	// ObservedGeneration is the most recent generation observed for this noobaa system.
 	// It corresponds to the CR generation, which is updated on mutation by the API Server.
-	ObservedGeneration int64 `json:"observedGeneration"`
+	// +optional
+	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
 
 	// Phase is a simple, high-level summary of where the System is in its lifecycle
-	Phase SystemPhase `json:"phase"`
+	// +optional
+	Phase SystemPhase `json:"phase,omitempty"`
 
 	// Conditions is a list of conditions related to operator reconciliation
 	// +patchMergeKey=type
@@ -127,17 +133,24 @@ type NooBaaStatus struct {
 	Conditions []conditionsv1.Condition `json:"conditions,omitempty"  patchStrategy:"merge" patchMergeKey:"type"`
 
 	// RelatedObjects is a list of objects related to this operator.
+	// +optional
 	RelatedObjects []corev1.ObjectReference `json:"relatedObjects,omitempty"`
 
 	// ActualImage is set to report which image the operator is using
-	ActualImage string `json:"actualImage"`
+	// +optional
+	ActualImage string `json:"actualImage,omitempty"`
 
-	Accounts AccountsStatus `json:"accounts"`
+	// Accounts reports accounts info for the admin account
+	// +optional
+	Accounts *AccountsStatus `json:"accounts,omitempty"`
 
-	Services ServicesStatus `json:"services"`
+	// Services reports addresses for the services
+	// +optional
+	Services *ServicesStatus `json:"services,omitempty"`
 
 	// Readme is a user readable string with explanations on the system
-	Readme string `json:"readme"`
+	// +optional
+	Readme string `json:"readme,omitempty"`
 }
 
 // SystemPhase is a string enum type for system phases

pkg/apis/noobaa/v1alpha1/zz_generated.openapi.go

@@ -167,7 +167,6 @@ func schema_pkg_apis_noobaa_v1alpha1_BackingStoreStatus(ref common.ReferenceCall
 						},
 					},
 				},
-				Required: []string{"phase"},
 			},
 		},
 		Dependencies: []string{
@@ -288,7 +287,6 @@ func schema_pkg_apis_noobaa_v1alpha1_BucketClassStatus(ref common.ReferenceCallb
 						},
 					},
 				},
-				Required: []string{"phase"},
 			},
 		},
 		Dependencies: []string{
@@ -407,6 +405,12 @@ func schema_pkg_apis_noobaa_v1alpha1_NooBaaSpec(ref common.ReferenceCallback) co
 							},
 						},
 					},
+					"affinity": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Affinity (optional) passed through to noobaa's pods",
+							Ref:         ref("k8s.io/api/core/v1.Affinity"),
+						},
+					},
 					"imagePullSecret": {
 						SchemaProps: spec.SchemaProps{
 							Description: "ImagePullSecret (optional) sets a pull secret for the system image",
@@ -417,7 +421,7 @@ func schema_pkg_apis_noobaa_v1alpha1_NooBaaSpec(ref common.ReferenceCallback) co
 			},
 		},
 		Dependencies: []string{
-			"k8s.io/api/core/v1.LocalObjectReference", "k8s.io/api/core/v1.ResourceRequirements", "k8s.io/api/core/v1.Toleration"},
+			"k8s.io/api/core/v1.Affinity", "k8s.io/api/core/v1.LocalObjectReference", "k8s.io/api/core/v1.ResourceRequirements", "k8s.io/api/core/v1.Toleration"},
 	}
 }
 
@@ -482,12 +486,14 @@ func schema_pkg_apis_noobaa_v1alpha1_NooBaaStatus(ref common.ReferenceCallback)
 					},
 					"accounts": {
 						SchemaProps: spec.SchemaProps{
-							Ref: ref("github.com/noobaa/noobaa-operator/pkg/apis/noobaa/v1alpha1.AccountsStatus"),
+							Description: "Accounts reports accounts info for the admin account",
+							Ref:         ref("github.com/noobaa/noobaa-operator/pkg/apis/noobaa/v1alpha1.AccountsStatus"),
 						},
 					},
 					"services": {
 						SchemaProps: spec.SchemaProps{
-							Ref: ref("github.com/noobaa/noobaa-operator/pkg/apis/noobaa/v1alpha1.ServicesStatus"),
+							Description: "Services reports addresses for the services",
+							Ref:         ref("github.com/noobaa/noobaa-operator/pkg/apis/noobaa/v1alpha1.ServicesStatus"),
 						},
 					},
 					"readme": {
@@ -498,7 +504,6 @@ func schema_pkg_apis_noobaa_v1alpha1_NooBaaStatus(ref common.ReferenceCallback)
 						},
 					},
 				},
-				Required: []string{"observedGeneration", "phase", "actualImage", "accounts", "services", "readme"},
 			},
 		},
 		Dependencies: []string{

pkg/backingstore/backingstore.go

@@ -198,9 +198,10 @@ func CmdList() *cobra.Command {
 // CmdReconcile returns a CLI command
 func CmdReconcile() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "reconcile",
-		Short: "Runs a reconcile attempt like noobaa-operator",
-		Run:   RunReconcile,
+		Hidden: true,
+		Use:    "reconcile",
+		Short:  "Runs a reconcile attempt like noobaa-operator",
+		Run:    RunReconcile,
 	}
 	return cmd
 }

pkg/backingstore/reconciler.go

@@ -350,10 +350,6 @@ func (r *Reconciler) ReadSystemInfo() error {
 	}
 	r.SystemInfo = &systemInfo
 
-	if r.BackingStore.DeletionTimestamp != nil {
-		return nil
-	}
-
 	conn, err := r.MakeExternalConnectionParams()
 	if err != nil {
 		return err
@@ -511,6 +507,11 @@ func (r *Reconciler) MakeExternalConnectionParams() (*nb.AddExternalConnectionPa
 			fmt.Sprintf("Invalid backing store type %q", r.BackingStore.Spec.Type))
 	}
 
+	if !util.IsStringGraphicCharsOnly(conn.Identity) || !util.IsStringGraphicCharsOnly(conn.Secret) {
+		return nil, util.NewPersistentError("InvalidSecret",
+			fmt.Sprintf("Invalid secret containing non graphic characters (perhaps not base64 encoded?) %q", r.Secret.Name))
+	}
+
 	return conn, nil
 }