Merge branch 'release/v1.2.0' into main

.env.template

@@ -5,7 +5,6 @@
 #
 # The file `.env` is ignored by git. Note: DO NOT COMMIT your personal data.
 
-# It is necessary to set the stage to `development` when developing locally (optional)
-#export STAGE=development
+export STAGE=development
 export LOG_LEVEL=debug
 export NAMESPACE=$(shell kubectl config view --minify -o jsonpath='{..namespace}')

CHANGELOG.md

@@ -6,6 +6,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [v1.2.0] - 2024-11-29
+### Changed
+- [#37] Refactor rbac permissions to be more clear and better match the use cases
+
+### Removed
+- [#37] Leader election and leader election rbac permissions
+- [#37] Metrics rbac permissions
+
+### Fixed
+- Do not abort restore when maintenance mode cannot be activated
+
 ## [v1.1.1] - 2024-10-29
 ### Fixed
 - [#35] Use correct helm dependency constraint for `backup-operator-crd`.

Dockerfile

@@ -34,7 +34,7 @@ RUN make compile-generic
 FROM gcr.io/distroless/static:nonroot
 LABEL maintainer="[email protected]" \
       NAME="k8s-backup-operator" \
-      VERSION="1.1.1"
+      VERSION="1.2.0"
 
 WORKDIR /
 COPY --from=builder /workspace/target/k8s-backup-operator .

Makefile

@@ -1,6 +1,6 @@
 # Set these to the desired values
 ARTIFACT_ID=k8s-backup-operator
-VERSION=1.1.1
+VERSION=1.2.0
 IMAGE=cloudogu/${ARTIFACT_ID}:${VERSION}
 GOTAG?=1.23
 LINT_VERSION=v1.61.0
@@ -26,9 +26,8 @@ CRD_BACKUP_SOURCE = ${HELM_CRD_SOURCE_DIR}/templates/k8s.cloudogu.com_backups.ya
 CRD_RESTORE_SOURCE = ${HELM_CRD_SOURCE_DIR}/templates/k8s.cloudogu.com_restores.yaml
 CRD_SCHEDULE_SOURCE = ${HELM_CRD_SOURCE_DIR}/templates/k8s.cloudogu.com_backupschedules.yaml
 PRE_COMPILE=generate-deepcopy
-HELM_PRE_APPLY_TARGETS=template-stage template-log-level template-image-pull-policy
 HELM_PRE_GENERATE_TARGETS = helm-values-update-image-version
-HELM_POST_GENERATE_TARGETS = helm-values-replace-image-repo
+HELM_POST_GENERATE_TARGETS = helm-values-replace-image-repo template-stage template-log-level template-image-pull-policy
 CRD_POST_MANIFEST_TARGETS = crd-add-labels crd-add-backup-labels
 CHECK_VAR_TARGETS=check-all-vars
 IMAGE_IMPORT_TARGET=image-import

docs/development/installation_de.md

@@ -22,6 +22,8 @@ und einen Access Key `longhorn-test-key` mit dem Secret Key `longhorn-test-secre
 Des Weiteren müssen [k8s-snapshot-controller][snapshot-ctrl-repo] und [k8s-velero][velero-repo] als Komponenten installiert werden.
 Dazu die Repositories auschecken und darin folgende Befehle ausführen:
 ```shell
+# nur in k8s-velero
+cd k8s/helm/templates && helm dependency update
 # nur im snapshot-controller:
 make crd-component-apply
 # für snapshot-controller und velero:

docs/development/installation_en.md

@@ -22,6 +22,8 @@ and an access key `longhorn-test-key` with the secret key `longhorn-test-secret-
 Furthermore, [k8s-snapshot-controller][snapshot-ctrl-repo] and [k8s-velero][velero-repo] have to be installed as components.
 To do this, check out the repositories and execute the following commands inside:
 ```shell
+# only in k8s-velero
+cd k8s/helm/templates && helm dependency update
 # only in the snapshot-controller:
 make crd-component-apply
 # for snapshot-controller and velero:

docs/operations/scheduled_backups_en.md

@@ -5,12 +5,12 @@ This can be achieved with a `BackupSchedule` resource:
 
 ```yaml
 apiVersion: k8s.cloudogu.com/v1
-Type: BackupSchedule
-Metadata:
-name: backupschedule-sample
+kind: BackupSchedule
+metadata:
+  name: backupschedule-sample
 spec:
-schedule: "0 0 * *" # the cron pattern according to which the backups should be executed.
-provider: "velero" # only velero and "" (velero by default) are supported.
+  schedule: "0 0 * *" # the cron pattern according to which the backups should be executed.
+  provider: "velero" # only velero and "" (velero by default) are supported.
 ```
 
 `schedule` is a cron pattern as defined in [Kubernetes CronJob Syntax](https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/#schedule-syntax).

k8s-samples/k8s-backup-operator-dependencies.yaml

@@ -0,0 +1,89 @@
+apiVersion: v1
+data:
+  cloud: W2RlZmF1bHRdCmF3c19hY2Nlc3Nfa2V5X2lkPWxvbmdob3JuLXRlc3Qta2V5CmF3c19zZWNyZXRfYWNjZXNzX2tleT1sb25naG9ybi10ZXN0LXNlY3JldC1rZXkK
+kind: Secret
+metadata:
+  name: velero-backup-target
+  namespace: ecosystem
+type: Opaque
+---
+apiVersion: k8s.cloudogu.com/v1
+kind: Component
+metadata:
+  labels:
+    app: ces
+  name: k8s-velero
+  namespace: ecosystem
+spec:
+  name: k8s-velero
+  namespace: k8s
+  version: 5.0.2-7
+  valuesYamlOverwrite: |
+    velero:
+      credentials:
+        useSecret: true
+        existingSecret: "velero-backup-target"
+      configuration:
+        backupStorageLocation:
+          - name: default
+            provider: aws
+            bucket: velero
+            accessMode: ReadWrite
+            config:
+              region: minio-default
+              s3ForcePathStyle: true
+              s3Url: http://192.168.56.1:9000
+              publicUrl: http://localhost:9000
+---
+apiVersion: v1
+data:
+  AWS_ACCESS_KEY_ID: bG9uZ2hvcm4tdGVzdC1rZXk=
+  AWS_ENDPOINTS: aHR0cDovLzE5Mi4xNjguNTYuMTo5MDAw
+  AWS_SECRET_ACCESS_KEY: bG9uZ2hvcm4tdGVzdC1zZWNyZXQta2V5
+kind: Secret
+metadata:
+  name: longhorn-backup-target
+  namespace: longhorn-system
+type: Opaque
+---
+apiVersion: k8s.cloudogu.com/v1
+kind: Component
+metadata:
+  labels:
+    app: ces
+  name: k8s-longhorn
+  namespace: ecosystem
+spec:
+  deployNamespace: longhorn-system
+  name: k8s-longhorn
+  namespace: k8s
+  version: 1.5.1-8
+  valuesYamlOverwrite: |
+    longhorn:
+      defaultSettings:
+        backupTarget: s3://longhorn@dummyregion/
+        backupTargetCredentialSecret: longhorn-backup-target
+---
+apiVersion: k8s.cloudogu.com/v1
+kind: Component
+metadata:
+  labels:
+    app: ces
+  name: k8s-snapshot-controller-crd
+  namespace: ecosystem
+spec:
+  name: k8s-snapshot-controller-crd
+  namespace: k8s
+  version: 5.0.1-7
+---
+apiVersion: k8s.cloudogu.com/v1
+kind: Component
+metadata:
+  labels:
+    app: ces
+  name: k8s-snapshot-controller
+  namespace: ecosystem
+spec:
+  name: k8s-snapshot-controller
+  namespace: k8s
+  version: 5.0.1-7

k8s-samples/k8s-backup-operator.yaml

@@ -0,0 +1,23 @@
+apiVersion: k8s.cloudogu.com/v1
+kind: Component
+metadata:
+  labels:
+    app: ces
+  name: k8s-backup-operator-crd
+  namespace: ecosystem
+spec:
+  name: k8s-backup-operator-crd
+  namespace: k8s
+  version: 1.1.1
+---
+apiVersion: k8s.cloudogu.com/v1
+kind: Component
+metadata:
+  labels:
+    app: ces
+  name: k8s-backup-operator
+  namespace: ecosystem
+spec:
+  name: k8s-backup-operator
+  namespace: k8s
+  version: 1.1.1

k8s-samples/test-scheduled-backup.yaml

@@ -0,0 +1,7 @@
+apiVersion: k8s.cloudogu.com/v1
+kind: BackupSchedule
+metadata:
+  name: backupschedule-sample
+spec:
+  schedule: "20 11 * * *"
+  provider: "velero"

k8s-samples/testbackup.yaml

@@ -0,0 +1,6 @@
+apiVersion: k8s.cloudogu.com/v1
+kind: Backup
+metadata:
+  name: backup-sample
+spec:
+  provider: velero

k8s-samples/testrestore.yaml

@@ -0,0 +1,7 @@
+apiVersion: k8s.cloudogu.com/v1
+kind: Restore
+metadata:
+  name: restore-sample
+spec:
+  provider: velero
+  backupName: backup-sample

k8s/helm/component-patch-tpl.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 values:
   images:
-    backupOperator: cloudogu/k8s-backup-operator:1.1.1
+    backupOperator: cloudogu/k8s-backup-operator:1.2.0
     kubeRbacProxy: gcr.io/kubebuilder/kube-rbac-proxy:v0.14.1
 patches:
   values.yaml:

k8s/helm/templates/backup-editor-rbac.yaml → k8s/helm/templates/backup-editor-role-binding.yaml

@@ -1,39 +1,4 @@
 apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ include "k8s-backup-operator.name" . }}-backup-editor-role
-  labels:
-    app.kubernetes.io/component: rbac
-  {{- include "k8s-backup-operator.labels" . | nindent 4 }}
-rules:
-- apiGroups:
-  - k8s.cloudogu.com
-  resources:
-  - backups
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - k8s.cloudogu.com
-  resources:
-  - backups/finalizers
-  verbs:
-  - update
-- apiGroups:
-  - k8s.cloudogu.com
-  resources:
-  - backups/status
-  verbs:
-  - get
-  - patch
-  - update
----
-apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: {{ include "k8s-backup-operator.name" . }}-backup-editor-role-binding

k8s/helm/templates/backup-viewer-rbac.yaml → k8s/helm/templates/backup-editor-role.yaml

@@ -1,7 +1,8 @@
+# This role is necessary to create cloudogu backups
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: {{ include "k8s-backup-operator.name" . }}-backup-viewer-role
+  name: {{ include "k8s-backup-operator.name" . }}-backup-editor-role
   labels:
     app.kubernetes.io/component: rbac
   {{- include "k8s-backup-operator.labels" . | nindent 4 }}
@@ -11,12 +12,24 @@ rules:
   resources:
   - backups
   verbs:
+  - create
+  - delete
   - get
   - list
+  - patch
+  - update
   - watch
+- apiGroups:
+  - k8s.cloudogu.com
+  resources:
+  - backups/finalizers
+  verbs:
+  - update
 - apiGroups:
   - k8s.cloudogu.com
   resources:
   - backups/status
   verbs:
-  - get
+  - get
+  - patch
+  - update

k8s/helm/templates/backupschedule-editor-role-binding.yaml

@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "k8s-backup-operator.name" . }}-backupschedule-editor-role-binding
+  labels:
+    app.kubernetes.io/component: rbac
+  {{- include "k8s-backup-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: '{{ include "k8s-backup-operator.name" . }}-backupschedule-editor-role'
+subjects:
+  - kind: ServiceAccount
+    name: '{{ include "k8s-backup-operator.name" . }}-controller-manager'
+    namespace: '{{ .Release.Namespace }}'

k8s/helm/templates/backupschedule-editor-role.yaml

@@ -0,0 +1,47 @@
+# This role is necessary to create scheduled cloudogu backups
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "k8s-backup-operator.name" . }}-backupschedule-editor-role
+  labels:
+    app.kubernetes.io/component: rbac
+  {{- include "k8s-backup-operator.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - k8s.cloudogu.com
+    resources:
+      - backupschedules
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - k8s.cloudogu.com
+    resources:
+      - backupschedules/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - k8s.cloudogu.com
+    resources:
+      - backupschedules/status
+    verbs:
+      - get
+      - patch
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - cronjobs
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch