minimal collabora

vshn · Oct 18, 2024 · eb3bbd4 · eb3bbd4
1 parent d64b330
commit eb3bbd4
Show file tree

Hide file tree

Showing 63 changed files with 386 additions and 95 deletions.
diff --git a/Makefile b/Makefile
@@ -94,4 +94,26 @@ clean: ## Clean the project
 
 .PHONY: pre-commit-hook
 pre-commit-hook: ## Install pre-commit hook in .git/hooks
-	/usr/bin/cp -fa .githooks/pre-commit .git/hooks/pre-commit
+	/usr/bin/cp -fa .githooks/pre-commit .git/hooks/pre-commit
+
+.PHONY: local-appcat-development
+local-appcat-development : instance=vshn
+local-appcat-development: local-sed-substitution gen-golden kindev-install ## Run local development for appcat
+
+local-sed-substitution:
+	sed -i 's/grpcEndpoint.*/grpcEndpoint: $(LINUX_IP_ADDRESS):9443/g' tests/vshn.yml
+	sed -i 's/proxyFunction.*/proxyFunction: true/g' tests/vshn.yml
+
+kindev-install:
+	kubectl apply -f https://raw.githubusercontent.com/vshn/appcat/refs/heads/master/hack/functionproxy/function.yaml
+	kubectl apply -f https://raw.githubusercontent.com/vshn/appcat/refs/heads/master/hack/functionproxy/proxyconfig.yaml
+
+.PHONY: local-appcat-development-revert
+local-appcat-development-revert : instance=vshn
+local-appcat-development-revert: revert-sed-substitution gen-golden  ## Revert local development for appcat
+	kubectl delete -f https://raw.githubusercontent.com/vshn/appcat/refs/heads/master/hack/functionproxy/function.yaml
+	kubectl delete -f https://raw.githubusercontent.com/vshn/appcat/refs/heads/master/hack/functionproxy/proxyconfig.yaml
+
+
+revert-sed-substitution:
+	git checkout master tests/vshn.yml
diff --git a/Makefile.vars.mk b/Makefile.vars.mk
@@ -52,3 +52,6 @@ YAMLLINT_ARGS   ?= --no-warnings
 YAMLLINT_CONFIG ?= .yamllint.yml
 YAMLLINT_IMAGE  ?= docker.io/cytopia/yamllint:latest
 YAMLLINT_DOCKER ?= $(DOCKER_CMD) $(DOCKER_ARGS) $(root_volume) $(YAMLLINT_IMAGE)
+
+
+LINUX_IP_ADDRESS := $(shell ip -4 addr show dev docker0 | grep inet | awk -F' ' '{print $$2}' | awk -F'/' '{print $$1}')
diff --git a/class/defaults.yml b/class/defaults.yml
@@ -55,7 +55,7 @@ parameters:
       appcat:
         registry: ghcr.io
         repository: vshn/appcat
-        tag: v4.98.0
+        tag: nextcloud_collabora
       functionAppcat:
         registry: ${appcat:images:appcat:registry}
         repository: ${appcat:images:appcat:repository}

diff --git a/component/provider.jsonnet b/component/provider.jsonnet
@@ -54,8 +54,8 @@ local providerRBAC = {
       },
       {
         apiGroups: [ '' ],
-        resources: [ 'namespaces', 'serviceaccounts', 'secrets', 'pods', 'pods/log', 'pods/portforward', 'pods/status', 'services' ],
-        verbs: [ 'get', 'list', 'watch', 'create', 'watch', 'patch', 'update', 'delete' ],
+        resources: [ 'namespaces', 'serviceaccounts', 'secrets', 'pods', 'pods/log', 'pods/portforward', 'pods/status', 'pods/attach', 'pods/exec', 'services' ],
+        verbs: [ '*' ],
       },
       {
         apiGroups: [ 'apps' ],
@@ -65,7 +65,7 @@ local providerRBAC = {
       {
         apiGroups: [ 'apps' ],
         resources: [ 'statefulsets', 'deployments' ],
-        verbs: [ 'get', 'delete', 'watch', 'list', 'patch' ],
+        verbs: [ 'get', 'delete', 'watch', 'list', 'patch', 'update', 'create' ],
       },
       {
         apiGroups: [ 'rbac.authorization.k8s.io' ],
@@ -163,6 +163,22 @@ local providerRBAC = {
         resources: [ 'poddisruptionbudgets' ],
         verbs: [ 'get', 'list', 'watch', 'update', 'patch', 'create', 'delete' ],
       },
+      {
+        apiGroups: [ 'networking.k8s.io' ],
+        resources: [ 'ingresses' ],
+        verbs: [ 'get', 'list', 'watch', 'update', 'patch', 'create', 'delete' ],
+      },
+      {
+        apiGroups: [ '' ],
+        resources: [ 'persistentvolumeclaims' ],
+        verbs: [ 'get', 'list', 'watch', 'create', 'watch', 'patch', 'update', 'delete' ],
+      },
+      {
+        // This is needed for the privileged SCC - Nextcloud -> Collabora
+        apiGroups: [ 'security.openshift.io' ],
+        resources: [ 'securitycontextconstraints' ],
+        verbs: [ '*' ],
+      },
     ],
   },
   helm: {

diff --git a/component/vshn_appcat_services.jsonnet b/component/vshn_appcat_services.jsonnet
@@ -177,7 +177,45 @@ local vshn_appcat_service(name, serviceParams) =
     },
   };
 
+
+  local scc =
+    {
+      allowHostDirVolumePlugin: true,
+      allowHostIPC: true,
+      allowHostNetwork: true,
+      allowHostPID: true,
+      allowHostPorts: true,
+      allowPrivilegeEscalation: false,
+      allowPrivilegedContainer: true,
+      allowedCapabilities: [
+      'MKNOD',
+      'CHOWN',
+      'SYS_CHROOT',
+      'FOWNER',
+      ],
+      apiVersion: 'security.openshift.io/v1',
+      defaultAddCapabilities: [
+      'MKNOD',
+      'CHOWN',
+      'SYS_CHROOT',
+      'FOWNER',
+      ],
+      kind: 'SecurityContextConstraints',
+      metadata: {
+      annotations: {},
+      name: 'appcat-collabora',
+      },
+      readOnlyRootFilesystem: false,
+      runAsUser: {
+      type: 'MustRunAsNonRoot',
+      },
+      seLinuxContext: {
+      type: 'MustRunAs',
+      },
+    };
+
   if params.services.vshn.enabled && serviceParams.enabled then {
+    '20_scc_appcat': scc,
     ['20_xrd_vshn_%s' % name]: xrd,
     ['20_rbac_vshn_%s' % name]: xrds.CompositeClusterRoles(xrd),
     ['21_composition_vshn_%s' % name]: composition,

diff --git a/tests/golden/apiserver/appcat/appcat/10_function_appcat.yaml b/tests/golden/apiserver/appcat/appcat/10_function_appcat.yaml
@@ -3,6 +3,6 @@ kind: Function
 metadata:
   name: function-appcat
 spec:
-  package: ghcr.io/vshn/appcat:v4.98.0-func
+  package: ghcr.io/vshn/appcat:nextcloud_collabora-func
   runtimeConfigRef:
     name: function-appcat
diff --git a/tests/golden/apiserver/appcat/appcat/apiserver/30_deployment.yaml b/tests/golden/apiserver/appcat/appcat/apiserver/30_deployment.yaml
@@ -29,7 +29,7 @@ spec:
             - --secure-port=9443
             - --tls-cert-file=/apiserver.local.config/certificates/tls.crt
             - --tls-private-key-file=/apiserver.local.config/certificates/tls.key
-          image: ghcr.io/vshn/appcat:v4.98.0
+          image: ghcr.io/vshn/appcat:nextcloud_collabora
           livenessProbe:
             failureThreshold: 3
             httpGet:

diff --git a/tests/golden/billing/appcat/appcat/10_function_appcat.yaml b/tests/golden/billing/appcat/appcat/10_function_appcat.yaml
@@ -3,6 +3,6 @@ kind: Function
 metadata:
   name: function-appcat
 spec:
-  package: ghcr.io/vshn/appcat:v4.98.0-func
+  package: ghcr.io/vshn/appcat:nextcloud_collabora-func
   runtimeConfigRef:
     name: function-appcat
diff --git a/tests/golden/billing/appcat/appcat/apiserver/30_deployment.yaml b/tests/golden/billing/appcat/appcat/apiserver/30_deployment.yaml
@@ -29,7 +29,7 @@ spec:
             - --secure-port=9443
             - --tls-cert-file=/apiserver.local.config/certificates/tls.crt
             - --tls-private-key-file=/apiserver.local.config/certificates/tls.key
-          image: ghcr.io/vshn/appcat:v4.98.0
+          image: ghcr.io/vshn/appcat:nextcloud_collabora
           livenessProbe:
             failureThreshold: 3
             httpGet:

diff --git a/.../appcat/appcat/sli_exporter/apps_v1_deployment_appcat-sliexporter-controller-manager.yaml b/.../appcat/appcat/sli_exporter/apps_v1_deployment_appcat-sliexporter-controller-manager.yaml
@@ -36,7 +36,7 @@ spec:
           value: "false"
         - name: APPCAT_SLI_VSHNMARIADB
           value: "false"
-        image: ghcr.io/vshn/appcat:v4.98.0
+        image: ghcr.io/vshn/appcat:nextcloud_collabora
         livenessProbe:
           httpGet:
             path: /healthz

diff --git a/tests/golden/cloudscale-metrics-collector-cloud/appcat/appcat/10_function_appcat.yaml b/tests/golden/cloudscale-metrics-collector-cloud/appcat/appcat/10_function_appcat.yaml
@@ -3,6 +3,6 @@ kind: Function
 metadata:
   name: function-appcat
 spec:
-  package: ghcr.io/vshn/appcat:v4.98.0-func
+  package: ghcr.io/vshn/appcat:nextcloud_collabora-func
   runtimeConfigRef:
     name: function-appcat
diff --git a/tests/golden/cloudscale-metrics-collector-cloud/appcat/appcat/apiserver/30_deployment.yaml b/tests/golden/cloudscale-metrics-collector-cloud/appcat/appcat/apiserver/30_deployment.yaml
@@ -29,7 +29,7 @@ spec:
             - --secure-port=9443
             - --tls-cert-file=/apiserver.local.config/certificates/tls.crt
             - --tls-private-key-file=/apiserver.local.config/certificates/tls.key
-          image: ghcr.io/vshn/appcat:v4.98.0
+          image: ghcr.io/vshn/appcat:nextcloud_collabora
           livenessProbe:
             failureThreshold: 3
             httpGet:

diff --git a/.../appcat/appcat/sli_exporter/apps_v1_deployment_appcat-sliexporter-controller-manager.yaml b/.../appcat/appcat/sli_exporter/apps_v1_deployment_appcat-sliexporter-controller-manager.yaml
@@ -36,7 +36,7 @@ spec:
           value: "false"
         - name: APPCAT_SLI_VSHNMARIADB
           value: "false"
-        image: ghcr.io/vshn/appcat:v4.98.0
+        image: ghcr.io/vshn/appcat:nextcloud_collabora
         livenessProbe:
           httpGet:
             path: /healthz

diff --git a/tests/golden/cloudscale-metrics-collector-managed/appcat/appcat/10_function_appcat.yaml b/tests/golden/cloudscale-metrics-collector-managed/appcat/appcat/10_function_appcat.yaml
@@ -3,6 +3,6 @@ kind: Function
 metadata:
   name: function-appcat
 spec:
-  package: ghcr.io/vshn/appcat:v4.98.0-func
+  package: ghcr.io/vshn/appcat:nextcloud_collabora-func
   runtimeConfigRef:
     name: function-appcat
diff --git a/tests/golden/cloudscale-metrics-collector-managed/appcat/appcat/apiserver/30_deployment.yaml b/tests/golden/cloudscale-metrics-collector-managed/appcat/appcat/apiserver/30_deployment.yaml
@@ -29,7 +29,7 @@ spec:
             - --secure-port=9443
             - --tls-cert-file=/apiserver.local.config/certificates/tls.crt
             - --tls-private-key-file=/apiserver.local.config/certificates/tls.key
-          image: ghcr.io/vshn/appcat:v4.98.0
+          image: ghcr.io/vshn/appcat:nextcloud_collabora
           livenessProbe:
             failureThreshold: 3
             httpGet:

diff --git a/.../appcat/appcat/sli_exporter/apps_v1_deployment_appcat-sliexporter-controller-manager.yaml b/.../appcat/appcat/sli_exporter/apps_v1_deployment_appcat-sliexporter-controller-manager.yaml
@@ -36,7 +36,7 @@ spec:
           value: "false"
         - name: APPCAT_SLI_VSHNMARIADB
           value: "false"
-        image: ghcr.io/vshn/appcat:v4.98.0
+        image: ghcr.io/vshn/appcat:nextcloud_collabora
         livenessProbe:
           httpGet:
             path: /healthz

diff --git a/tests/golden/cloudscale/appcat/appcat/10_function_appcat.yaml b/tests/golden/cloudscale/appcat/appcat/10_function_appcat.yaml
@@ -3,6 +3,6 @@ kind: Function
 metadata:
   name: function-appcat
 spec:
-  package: ghcr.io/vshn/appcat:v4.98.0-func
+  package: ghcr.io/vshn/appcat:nextcloud_collabora-func
   runtimeConfigRef:
     name: function-appcat
diff --git a/tests/golden/cloudscale/appcat/appcat/10_provider_kubernetes.yaml b/tests/golden/cloudscale/appcat/appcat/10_provider_kubernetes.yaml
@@ -102,16 +102,11 @@ rules:
       - pods/log
       - pods/portforward
       - pods/status
+      - pods/attach
+      - pods/exec
       - services
     verbs:
-      - get
-      - list
-      - watch
-      - create
-      - watch
-      - patch
-      - update
-      - delete
+      - '*'
   - apiGroups:
       - apps
     resources:
@@ -130,6 +125,8 @@ rules:
       - watch
       - list
       - patch
+      - update
+      - create
   - apiGroups:
       - rbac.authorization.k8s.io
     resourceNames:
@@ -351,6 +348,37 @@ rules:
       - patch
       - create
       - delete
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+      - patch
+      - create
+      - delete
+  - apiGroups:
+      - ''
+    resources:
+      - persistentvolumeclaims
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - watch
+      - patch
+      - update
+      - delete
+  - apiGroups:
+      - security.openshift.io
+    resources:
+      - securitycontextconstraints
+    verbs:
+      - '*'
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding

diff --git a/tests/golden/cloudscale/appcat/appcat/apiserver/30_deployment.yaml b/tests/golden/cloudscale/appcat/appcat/apiserver/30_deployment.yaml
@@ -29,7 +29,7 @@ spec:
             - --secure-port=9443
             - --tls-cert-file=/apiserver.local.config/certificates/tls.crt
             - --tls-private-key-file=/apiserver.local.config/certificates/tls.key
-          image: ghcr.io/vshn/appcat:v4.98.0
+          image: ghcr.io/vshn/appcat:nextcloud_collabora
           livenessProbe:
             failureThreshold: 3
             httpGet:

diff --git a/tests/golden/controllers/appcat/appcat/10_function_appcat.yaml b/tests/golden/controllers/appcat/appcat/10_function_appcat.yaml
@@ -3,6 +3,6 @@ kind: Function
 metadata:
   name: function-appcat
 spec:
-  package: ghcr.io/vshn/appcat:v4.98.0-func
+  package: ghcr.io/vshn/appcat:nextcloud_collabora-func
   runtimeConfigRef:
     name: function-appcat
diff --git a/tests/golden/controllers/appcat/appcat/apiserver/30_deployment.yaml b/tests/golden/controllers/appcat/appcat/apiserver/30_deployment.yaml
@@ -29,7 +29,7 @@ spec:
             - --secure-port=9443
             - --tls-cert-file=/apiserver.local.config/certificates/tls.crt
             - --tls-private-key-file=/apiserver.local.config/certificates/tls.key
-          image: ghcr.io/vshn/appcat:v4.98.0
+          image: ghcr.io/vshn/appcat:nextcloud_collabora
           livenessProbe:
             failureThreshold: 3
             httpGet:

diff --git a/tests/golden/controllers/appcat/appcat/controllers/appcat/30_deployment.yaml b/tests/golden/controllers/appcat/appcat/controllers/appcat/30_deployment.yaml
@@ -23,7 +23,7 @@ spec:
           env:
             - name: PLANS_NAMESPACE
               value: syn-appcat
-          image: ghcr.io/vshn/appcat:v4.98.0
+          image: ghcr.io/vshn/appcat:nextcloud_collabora
           livenessProbe:
             httpGet:
               path: /healthz

diff --git a/tests/golden/defaults/appcat/appcat/10_function_appcat.yaml b/tests/golden/defaults/appcat/appcat/10_function_appcat.yaml
@@ -3,6 +3,6 @@ kind: Function
 metadata:
   name: function-appcat
 spec:
-  package: ghcr.io/vshn/appcat:v4.98.0-func
+  package: ghcr.io/vshn/appcat:nextcloud_collabora-func
   runtimeConfigRef:
     name: function-appcat
diff --git a/tests/golden/defaults/appcat/appcat/apiserver/30_deployment.yaml b/tests/golden/defaults/appcat/appcat/apiserver/30_deployment.yaml
@@ -29,7 +29,7 @@ spec:
             - --secure-port=9443
             - --tls-cert-file=/apiserver.local.config/certificates/tls.crt
             - --tls-private-key-file=/apiserver.local.config/certificates/tls.key
-          image: ghcr.io/vshn/appcat:v4.98.0
+          image: ghcr.io/vshn/appcat:nextcloud_collabora
           livenessProbe:
             failureThreshold: 3
             httpGet:

diff --git a/.../appcat/appcat/sli_exporter/apps_v1_deployment_appcat-sliexporter-controller-manager.yaml b/.../appcat/appcat/sli_exporter/apps_v1_deployment_appcat-sliexporter-controller-manager.yaml
@@ -36,7 +36,7 @@ spec:
           value: "false"
         - name: APPCAT_SLI_VSHNMARIADB
           value: "false"
-        image: ghcr.io/vshn/appcat:v4.98.0
+        image: ghcr.io/vshn/appcat:nextcloud_collabora
         livenessProbe:
           httpGet:
             path: /healthz

diff --git a/tests/golden/exoscale-metrics-collector-cloud/appcat/appcat/10_function_appcat.yaml b/tests/golden/exoscale-metrics-collector-cloud/appcat/appcat/10_function_appcat.yaml
@@ -3,6 +3,6 @@ kind: Function
 metadata:
   name: function-appcat
 spec:
-  package: ghcr.io/vshn/appcat:v4.98.0-func
+  package: ghcr.io/vshn/appcat:nextcloud_collabora-func
   runtimeConfigRef:
     name: function-appcat
diff --git a/tests/golden/exoscale-metrics-collector-cloud/appcat/appcat/apiserver/30_deployment.yaml b/tests/golden/exoscale-metrics-collector-cloud/appcat/appcat/apiserver/30_deployment.yaml
@@ -29,7 +29,7 @@ spec:
             - --secure-port=9443
             - --tls-cert-file=/apiserver.local.config/certificates/tls.crt
             - --tls-private-key-file=/apiserver.local.config/certificates/tls.key
-          image: ghcr.io/vshn/appcat:v4.98.0
+          image: ghcr.io/vshn/appcat:nextcloud_collabora
           livenessProbe:
             failureThreshold: 3
             httpGet:

diff --git a/.../appcat/appcat/sli_exporter/apps_v1_deployment_appcat-sliexporter-controller-manager.yaml b/.../appcat/appcat/sli_exporter/apps_v1_deployment_appcat-sliexporter-controller-manager.yaml
@@ -36,7 +36,7 @@ spec:
           value: "false"
         - name: APPCAT_SLI_VSHNMARIADB
           value: "false"
-        image: ghcr.io/vshn/appcat:v4.98.0
+        image: ghcr.io/vshn/appcat:nextcloud_collabora
         livenessProbe:
           httpGet:
             path: /healthz

diff --git a/tests/golden/exoscale-metrics-collector-managed/appcat/appcat/10_function_appcat.yaml b/tests/golden/exoscale-metrics-collector-managed/appcat/appcat/10_function_appcat.yaml
@@ -3,6 +3,6 @@ kind: Function
 metadata:
   name: function-appcat
 spec:
-  package: ghcr.io/vshn/appcat:v4.98.0-func
+  package: ghcr.io/vshn/appcat:nextcloud_collabora-func
   runtimeConfigRef:
     name: function-appcat