USHIFT-6452: WIP: enabling udn on ovn-kubernetes spike

assets/components/ovn/common/clusterrole-controller.yaml

@@ -0,0 +1,153 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: openshift-ovn-kubernetes-controller
+rules:
+- apiGroups: [""]
+  resources:
+  - namespaces
+  - nodes
+  - pods
+  verbs:
+  - get
+  - list
+  - patch
+  - watch
+  - update
+- apiGroups: [""]
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - patch
+  - watch
+  - delete
+- apiGroups: [""]
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - create
+  - update
+  - patch
+- apiGroups: [""]
+  resources:
+  - services
+  - endpoints
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - discovery.k8s.io
+  resources:
+  - endpointslices
+  verbs:
+  - list
+  - watch
+- apiGroups: ["networking.k8s.io"]
+  resources:
+  - networkpolicies
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups: ["", "events.k8s.io"]
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+  - update
+- apiGroups: ["security.openshift.io"]
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use
+  resourceNames:
+  - privileged
+- apiGroups: [""]
+  resources:
+  - "nodes/status"
+  verbs:
+  - patch
+  - update
+- apiGroups: ["k8s.ovn.org"]
+  resources:
+  - egressfirewalls
+  - egressips
+  - egressqoses
+  - adminpolicybasedexternalroutes
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - patch
+- apiGroups:
+  - k8s.ovn.org
+  resources:
+  - adminpolicybasedexternalroutes/status  
+  verbs: [ "update"]  
+- apiGroups: ["cloud.network.openshift.io"]
+  resources:
+  - cloudprivateipconfigs
+  verbs:
+  - create
+  - patch
+  - update
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups: ["apiextensions.k8s.io"]
+  resources:
+  - customresourcedefinitions
+  verbs:
+    - get
+    - list
+    - watch
+- apiGroups: ['authentication.k8s.io']
+  resources: ['tokenreviews']
+  verbs: ['create']
+- apiGroups: ['authorization.k8s.io']
+  resources: ['subjectaccessreviews']
+  verbs: ['create']
+- apiGroups: [k8s.ovn.org]
+  resources:
+  - userdefinednetworks
+  - clusteruserdefinednetworks
+  verbs:
+  - get
+  - list
+  - watch
+  - patch
+  - update
+- apiGroups:
+  - k8s.ovn.org
+  resources:
+  - routeadvertisements
+  verbs:
+  - list
+  - get
+  - watch
+- apiGroups:
+  - k8s.ovn.org
+  resources:
+  - routeadvertisements/status
+  verbs:
+  - patch
+  - update
+- apiGroups: 
+  - frrk8s.metallb.io
+  resources:
+  - frrconfigurations
+  verbs:
+  - list
+  - get
+  - watch
+  - create
+  - delete
+  - update
+  - patch

assets/components/ovn/common/clusterrole.yaml

@@ -71,121 +71,11 @@ rules:
 - apiGroups: ['authorization.k8s.io']
   resources: ['subjectaccessreviews']
   verbs: ['create']
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: openshift-ovn-kubernetes-controller
-rules:
-- apiGroups: [""]
-  resources:
-  - namespaces
-  - nodes
-  - pods
-  verbs:
-  - get
-  - list
-  - patch
-  - watch
-  - update
-- apiGroups: [""]
-  resources:
-  - pods
-  verbs:
-  - get
-  - list
-  - patch
-  - watch
-  - delete
-- apiGroups: [""]
-  resources:
-  - configmaps
-  verbs:
-  - get
-  - create
-  - update
-  - patch
-- apiGroups: [""]
-  resources:
-  - services
-  - endpoints
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - discovery.k8s.io
-  resources:
-  - endpointslices
-  verbs:
-  - list
-  - watch
-- apiGroups: ["networking.k8s.io"]
-  resources:
-  - networkpolicies
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups: ["", "events.k8s.io"]
-  resources:
-  - events
-  verbs:
-  - create
-  - patch
-  - update
-- apiGroups: ["security.openshift.io"]
-  resources:
-  - securitycontextconstraints
-  verbs:
-  - use
-  resourceNames:
-  - privileged
-- apiGroups: [""]
-  resources:
-  - "nodes/status"
-  verbs:
-  - patch
-  - update
-- apiGroups: ["k8s.ovn.org"]
-  resources:
-  - egressfirewalls
-  - egressips
-  - egressqoses
-  - adminpolicybasedexternalroutes
-  verbs:
-  - get
-  - list
-  - watch
-  - update
-  - patch
 - apiGroups:
   - k8s.ovn.org
   resources:
-  - adminpolicybasedexternalroutes/status  
-  verbs: [ "update"]  
-- apiGroups: ["cloud.network.openshift.io"]
-  resources:
-  - cloudprivateipconfigs
+  - routeadvertisements
   verbs:
-  - create
-  - patch
-  - update
-  - delete
-  - get
   - list
+  - get
   - watch
-- apiGroups: ["apiextensions.k8s.io"]
-  resources:
-  - customresourcedefinitions
-  verbs:
-    - get
-    - list
-    - watch
-- apiGroups: ['authentication.k8s.io']
-  resources: ['tokenreviews']
-  verbs: ['create']
-- apiGroups: ['authorization.k8s.io']
-  resources: ['subjectaccessreviews']
-  verbs: ['create']

assets/components/ovn/common/clusterrolebinding-controller.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: openshift-ovn-kubernetes-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: openshift-ovn-kubernetes-controller
+subjects:
+- kind: ServiceAccount
+  name: ovn-kubernetes-controller
+  namespace: openshift-ovn-kubernetes

assets/components/ovn/common/clusterrolebinding.yaml

@@ -11,17 +11,3 @@ subjects:
 - kind: ServiceAccount
   name: ovn-kubernetes-node
   namespace: openshift-ovn-kubernetes
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: openshift-ovn-kubernetes-controller
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: openshift-ovn-kubernetes-controller
-subjects:
-- kind: ServiceAccount
-  name: ovn-kubernetes-controller
-  namespace: openshift-ovn-kubernetes