UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>

Author: oceanc80

openshift/catalogd/generate-manifests.sh

@@ -73,7 +73,6 @@ for container_name in "${!IMAGE_MAPPINGS[@]}"; do
   $YQ -i 'select(.kind == "Deployment").spec.template.metadata.annotations += {"target.workload.openshift.io/management": "{\"effect\": \"PreferredDuringScheduling\"}"}' "$TMP_KUSTOMIZE_OUTPUT"
   $YQ -i 'select(.kind == "Deployment").spec.template.metadata.annotations += {"openshift.io/required-scc": "privileged"}' "$TMP_KUSTOMIZE_OUTPUT"
   $YQ -i 'select(.kind == "Deployment").spec.template.spec += {"priorityClassName": "system-cluster-critical"}' "$TMP_KUSTOMIZE_OUTPUT"
-  $YQ -i 'select(.kind == "Namespace").metadata.annotations += {"workload.openshift.io/allowed": "management"}' "$TMP_KUSTOMIZE_OUTPUT"
 done
 
 # Loop through any flag updates that need to be made to the manager container

openshift/catalogd/kustomize/overlays/openshift/olmv1-ns/kustomization.yaml

@@ -14,6 +14,7 @@ resources:
 patches:
 - path: patches/manager_namespace_privileged.yaml
 - path: patches/manager_namespace_monitored.yaml
+- path: patches/manager_namespace_annotations.yaml
 - target:
     kind: Service
     name: service

openshift/catalogd/kustomize/overlays/openshift/olmv1-ns/patches/manager_namespace_annotations.yaml

@@ -0,0 +1,8 @@
+$patch: merge
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: system
+  annotations:
+    workload.openshift.io/allowed: "management"
+    openshift.io/node-selector: ""

openshift/catalogd/kustomize/overlays/openshift/olmv1-ns/patches/manager_namespace_monitored.yaml

@@ -5,3 +5,5 @@ metadata:
   name: system
   labels:
     openshift.io/cluster-monitoring: "true"
+  annotations:
+    openshift.io/node-selector: ""

openshift/catalogd/manifests/00-namespace-openshift-catalogd.yml

@@ -1,6 +1,9 @@
 apiVersion: v1
 kind: Namespace
 metadata:
+  annotations:
+    openshift.io/node-selector: ""
+    workload.openshift.io/allowed: management
   labels:
     app.kubernetes.io/part-of: olm
     openshift.io/cluster-monitoring: "true"
@@ -11,5 +14,3 @@ metadata:
     pod-security.kubernetes.io/warn: privileged
     pod-security.kubernetes.io/warn-version: latest
   name: openshift-catalogd
-  annotations:
-    workload.openshift.io/allowed: management

openshift/operator-controller/generate-manifests.sh

@@ -71,7 +71,6 @@ for container_name in "${!IMAGE_MAPPINGS[@]}"; do
   $YQ -i 'select(.kind == "Deployment").spec.template.metadata.annotations += {"target.workload.openshift.io/management": "{\"effect\": \"PreferredDuringScheduling\"}"}' "$TMP_KUSTOMIZE_OUTPUT"
   $YQ -i 'select(.kind == "Deployment").spec.template.metadata.annotations += {"openshift.io/required-scc": "privileged"}' "$TMP_KUSTOMIZE_OUTPUT"
   $YQ -i 'select(.kind == "Deployment").spec.template.spec += {"priorityClassName": "system-cluster-critical"}' "$TMP_KUSTOMIZE_OUTPUT"
-  $YQ -i 'select(.kind == "Namespace").metadata.annotations += {"workload.openshift.io/allowed": "management"}' "$TMP_KUSTOMIZE_OUTPUT"
 done
 
 # Loop through any flag updates that need to be made to the manager container

openshift/operator-controller/kustomize/overlays/openshift/olmv1-ns/kustomization.yaml

@@ -12,6 +12,7 @@ resources:
 patches:
   - path: patches/manager_namespace_privileged.yaml
   - path: patches/manager_namespace_monitored.yaml
+  - path: patches/manager_namespace_annotations.yaml
   - target:
       kind: Service
       name: service

openshift/operator-controller/kustomize/overlays/openshift/olmv1-ns/patches/manager_namespace_annotations.yaml

@@ -0,0 +1,8 @@
+$patch: merge
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: system
+  annotations:
+    workload.openshift.io/allowed: "management"
+    openshift.io/node-selector: ""

openshift/operator-controller/manifests/00-namespace-openshift-operator-controller.yml

@@ -1,6 +1,9 @@
 apiVersion: v1
 kind: Namespace
 metadata:
+  annotations:
+    openshift.io/node-selector: ""
+    workload.openshift.io/allowed: management
   labels:
     app.kubernetes.io/part-of: olm
     openshift.io/cluster-monitoring: "true"
@@ -11,5 +14,3 @@ metadata:
     pod-security.kubernetes.io/warn: privileged
     pod-security.kubernetes.io/warn-version: latest
   name: openshift-operator-controller
-  annotations:
-    workload.openshift.io/allowed: management