{"action":"created","comment":{"url":"https://api.github.com/repos/openshift/release/pulls/comments/186056741","pull_request_review_id":117572888,"id":186056741,"diff_hunk":"@@ -0,0 +1,189 @@\n+---\n+########\n+#\n+# Template for auth (service accounts, roles, bindings) to deploy the cluster operator.\n+#\n+# These objects are in a separate template to allow a cluster admin to set them up one time,\n+# while users with lesser permissions can continue to maintain the Cluster Operator deployment\n+# itself.\n+#\n+########\n+apiVersion: template.openshift.io/v1\n+kind: Template\n+metadata:\n+  name: cluster-operator-auth-template\n+\n+parameters:\n+# Namespace to use for cluster-operator\n+- name: CLUSTER_OPERATOR_NAMESPACE\n+  value: openshift-cluster-operator\n+# Namespace of kube-system. Do not change. Required due to oc process behavior.\n+- name: KUBE_SYSTEM_NAMESPACE\n+  value: kube-system\n+\n+objects:\n+# Service account for the API Server\n+- apiVersion: v1\n+  kind: ServiceAccount\n+  metadata:\n+    name: cluster-operator-apiserver\n+    namespace: ${CLUSTER_OPERATOR_NAMESPACE}\n+\n+# Service account for the Controller Manager\n+- apiVersion: v1\n+  kind: ServiceAccount\n+  metadata:\n+    name: cluster-operator-controller-manager\n+    namespace: ${CLUSTER_OPERATOR_NAMESPACE}\n+\n+# API Server gets the auth-delegator role to delegate auth decisions to\n+# the core API Server\n+- apiVersion: rbac.authorization.k8s.io/v1\n+  kind: ClusterRoleBinding\n+  metadata:\n+    name: \"clusteroperator.openshift.io:apiserver-auth-delegator\"\n+  roleRef:\n+    apiGroup: rbac.authorization.k8s.io\n+    kind: ClusterRole\n+    name: system:auth-delegator\n+  subjects:\n+  - apiGroup: \"\"\n+    kind: ServiceAccount\n+    name: cluster-operator-apiserver\n+    namespace: ${CLUSTER_OPERATOR_NAMESPACE}\n+\n+# We have to create our openshift-cluster-operator namespace outside of \"oc new-project\"\n+# due to restrictions on project names starting with \"openshift-\". This results in the default\n+# service accounts (namely \"deployer\") being unable to view ReplicationControllers in the\n+# namespace, and thus unable to actually deploy. A controller is incoming to monitor for this.\n+#\n+# NOTE: may not be required in 3.10, a controller was added to maintain these bindings.\n+#\n+# Until then we manually bind the deployer/builder service accounts to appropriate roles:\n+- apiVersion: rbac.authorization.k8s.io/v1\n+  kind: RoleBinding\n+  metadata:\n+    name: \"system:deployers\"\n+    namespace: ${CLUSTER_OPERATOR_NAMESPACE}\n+  roleRef:\n+    apiGroup: rbac.authorization.k8s.io\n+    kind: ClusterRole\n+    name: system:deployer\n+  subjects:\n+  - apiGroup: \"\"\n+    kind: ServiceAccount\n+    name: deployer\n+    namespace: ${CLUSTER_OPERATOR_NAMESPACE}\n+  #userNames:\n+  #- system:serviceaccount:${CLUSTER_OPERATOR_NAMESPACE}:deployer\n+- apiVersion: rbac.authorization.k8s.io/v1\n+  kind: RoleBinding\n+  metadata:\n+    name: \"system:image-builders\"\n+    namespace: ${CLUSTER_OPERATOR_NAMESPACE}\n+  roleRef:\n+    apiGroup: rbac.authorization.k8s.io\n+    kind: ClusterRole\n+    name: system:image-builder\n+  subjects:\n+  - apiGroup: \"\"\n+    kind: ServiceAccount\n+    name: builder\n+    namespace: ${CLUSTER_OPERATOR_NAMESPACE}\n+  #userNames:\n+  #- system:serviceaccount:${CLUSTER_OPERATOR_NAMESPACE}:builder\n+- apiVersion: rbac.authorization.k8s.io/v1\n+  kind: RoleBinding\n+  metadata:\n+    name: \"system:image-pullers\"\n+    namespace: ${CLUSTER_OPERATOR_NAMESPACE}\n+  roleRef:\n+    apiGroup: rbac.authorization.k8s.io\n+    kind: ClusterRole\n+    name: system:image-puller\n+  subjects:\n+  - apiGroup: \"\"\n+    kind: Group\n+    name: system:serviceaccounts:${CLUSTER_OPERATOR_NAMESPACE}\n+  #userNames:\n+  #- system:serviceaccount:${CLUSTER_OPERATOR_NAMESPACE}:deployer\n+\n+# API Server gets the ability to read authentication. This allows it to\n+# read the specific configmap that has the requestheader-* entries to\n+# enable api aggregation\n+- apiVersion: rbac.authorization.k8s.io/v1\n+  kind: RoleBinding\n+  metadata:\n+    name: \"clusteroperator.openshift.io:apiserver-authentication-reader\"\n+    namespace: ${KUBE_SYSTEM_NAMESPACE}\n+  roleRef:\n+    apiGroup: rbac.authorization.k8s.io\n+    kind: Role\n+    name: extension-apiserver-authentication-reader\n+  subjects:\n+  - apiGroup: \"\"\n+    kind: ServiceAccount\n+    name: cluster-operator-apiserver\n+    namespace: ${CLUSTER_OPERATOR_NAMESPACE}\n+\n+# Create a role for the Controller Manager to give it permissions to manage\n+# the resources of the clusteroperator\n+- apiVersion: rbac.authorization.k8s.io/v1\n+  kind: ClusterRole\n+  metadata:\n+    name: \"clusteroperator.openshift.io:controller-manager\"\n+  rules:\n+  # configmaps for leader election\n+  - apiGroups: [\"\"]\n+    resources: [\"configmaps\"]\n+    verbs:     [\"create\"]\n+  - apiGroups:     [\"\"]\n+    resources:     [\"configmaps\"]\n+    resourceNames: [\"cluster-operator-controller-manager\"]\n+    verbs: [\"get\",\"update\"]\n+  # events for recording events\n+  - apiGroups: [\"\"]\n+    resources: [\"events\"]\n+    verbs:     [\"create\",\"patch\",\"update\"]\n+  # allow all operations on all resources in our API group\n+  - apiGroups: [\"clusteroperator.openshift.io\"]\n+    resources: [\"*\"]\n+    verbs:     [\"create\", \"get\", \"list\", \"watch\", \"update\", \"patch\", \"delete\"]","path":"projects/cluster-operator/cluster-operator-roles-template.yaml","position":151,"original_position":151,"commit_id":"c8e47465e89aa3b84dbe9ed19e6e73533ad9ac5d","original_commit_id":"c8e47465e89aa3b84dbe9ed19e6e73533ad9ac5d","user":{"login":"dgoodwin","id":51265,"avatar_url":"https://avatars3.githubusercontent.com/u/51265?v=4","gravatar_id":"","url":"https://api.github.com/users/dgoodwin","html_url":"https://github.com/dgoodwin","followers_url":"https://api.github.com/users/dgoodwin/followers","following_url":"https://api.github.com/users/dgoodwin/following{/other_user}","gists_url":"https://api.github.com/users/dgoodwin/gists{/gist_id}","starred_url":"https://api.github.com/users/dgoodwin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dgoodwin/subscriptions","organizations_url":"https://api.github.com/users/dgoodwin/orgs","repos_url":"https://api.github.com/users/dgoodwin/repos","events_url":"https://api.github.com/users/dgoodwin/events{/privacy}","received_events_url":"https://api.github.com/users/dgoodwin/received_events","type":"User","site_admin":false},"body":"Probably not, we will adjust upstream and copy it over next time we sync.","created_at":"2018-05-04T11:36:38Z","updated_at":"2018-05-04T11:36:38Z","html_url":"https://github.com/openshift/release/pull/821#discussion_r186056741","pull_request_url":"https://api.github.com/repos/openshift/release/pulls/821","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/openshift/release/pulls/comments/186056741"},"html":{"href":"https://github.com/openshift/release/pull/821#discussion_r186056741"},"pull_request":{"href":"https://api.github.com/repos/openshift/release/pulls/821"}},"in_reply_to_id":186054289},"pull_request":{"url":"https://api.github.com/repos/openshift/release/pulls/821","id":185014464,"html_url":"https://github.com/openshift/release/pull/821","diff_url":"https://github.com/openshift/release/pull/821.diff","patch_url":"https://github.com/openshift/release/pull/821.patch","issue_url":"https://api.github.com/repos/openshift/release/issues/821","number":821,"state":"closed","locked":false,"title":"Add a make cluster-operator-roles target.","user":{"login":"dgoodwin","id":51265,"avatar_url":"https://avatars3.githubusercontent.com/u/51265?v=4","gravatar_id":"","url":"https://api.github.com/users/dgoodwin","html_url":"https://github.com/dgoodwin","followers_url":"https://api.github.com/users/dgoodwin/followers","following_url":"https://api.github.com/users/dgoodwin/following{/other_user}","gists_url":"https://api.github.com/users/dgoodwin/gists{/gist_id}","starred_url":"https://api.github.com/users/dgoodwin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dgoodwin/subscriptions","organizations_url":"https://api.github.com/users/dgoodwin/orgs","repos_url":"https://api.github.com/users/dgoodwin/repos","events_url":"https://api.github.com/users/dgoodwin/events{/privacy}","received_events_url":"https://api.github.com/users/dgoodwin/received_events","type":"User","site_admin":false},"body":"This target assumes we have uploaded the template to our namespace.\r\n(which leaves it's contents in our control)","created_at":"2018-04-30T17:23:00Z","updated_at":"2018-05-04T11:36:38Z","closed_at":"2018-05-04T04:07:16Z","merged_at":"2018-05-04T04:07:16Z","merge_commit_sha":"4d3bd0f423bf8fd3a218ffb2eb97043d429f7e44","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":681779135,"url":"https://api.github.com/repos/openshift/release/labels/size/L","name":"size/L","color":"ee9900","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/openshift/release/pulls/821/commits","review_comments_url":"https://api.github.com/repos/openshift/release/pulls/821/comments","review_comment_url":"https://api.github.com/repos/openshift/release/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openshift/release/issues/821/comments","statuses_url":"https://api.github.com/repos/openshift/release/statuses/c8e47465e89aa3b84dbe9ed19e6e73533ad9ac5d","head":{"label":"dgoodwin:cluster-operator-roles","ref":"cluster-operator-roles","sha":"c8e47465e89aa3b84dbe9ed19e6e73533ad9ac5d","user":{"login":"dgoodwin","id":51265,"avatar_url":"https://avatars3.githubusercontent.com/u/51265?v=4","gravatar_id":"","url":"https://api.github.com/users/dgoodwin","html_url":"https://github.com/dgoodwin","followers_url":"https://api.github.com/users/dgoodwin/followers","following_url":"https://api.github.com/users/dgoodwin/following{/other_user}","gists_url":"https://api.github.com/users/dgoodwin/gists{/gist_id}","starred_url":"https://api.github.com/users/dgoodwin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dgoodwin/subscriptions","organizations_url":"https://api.github.com/users/dgoodwin/orgs","repos_url":"https://api.github.com/users/dgoodwin/repos","events_url":"https://api.github.com/users/dgoodwin/events{/privacy}","received_events_url":"https://api.github.com/users/dgoodwin/received_events","type":"User","site_admin":false},"repo":{"id":131624429,"name":"release-1","full_name":"dgoodwin/release-1","owner":{"login":"dgoodwin","id":51265,"avatar_url":"https://avatars3.githubusercontent.com/u/51265?v=4","gravatar_id":"","url":"https://api.github.com/users/dgoodwin","html_url":"https://github.com/dgoodwin","followers_url":"https://api.github.com/users/dgoodwin/followers","following_url":"https://api.github.com/users/dgoodwin/following{/other_user}","gists_url":"https://api.github.com/users/dgoodwin/gists{/gist_id}","starred_url":"https://api.github.com/users/dgoodwin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dgoodwin/subscriptions","organizations_url":"https://api.github.com/users/dgoodwin/orgs","repos_url":"https://api.github.com/users/dgoodwin/repos","events_url":"https://api.github.com/users/dgoodwin/events{/privacy}","received_events_url":"https://api.github.com/users/dgoodwin/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/dgoodwin/release-1","description":"Release tooling for OpenShift Origin","fork":true,"url":"https://api.github.com/repos/dgoodwin/release-1","forks_url":"https://api.github.com/repos/dgoodwin/release-1/forks","keys_url":"https://api.github.com/repos/dgoodwin/release-1/keys{/key_id}","collaborators_url":"https://api.github.com/repos/dgoodwin/release-1/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/dgoodwin/release-1/teams","hooks_url":"https://api.github.com/repos/dgoodwin/release-1/hooks","issue_events_url":"https://api.github.com/repos/dgoodwin/release-1/issues/events{/number}","events_url":"https://api.github.com/repos/dgoodwin/release-1/events","assignees_url":"https://api.github.com/repos/dgoodwin/release-1/assignees{/user}","branches_url":"https://api.github.com/repos/dgoodwin/release-1/branches{/branch}","tags_url":"https://api.github.com/repos/dgoodwin/release-1/tags","blobs_url":"https://api.github.com/repos/dgoodwin/release-1/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/dgoodwin/release-1/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/dgoodwin/release-1/git/refs{/sha}","trees_url":"https://api.github.com/repos/dgoodwin/release-1/git/trees{/sha}","statuses_url":"https://api.github.com/repos/dgoodwin/release-1/statuses/{sha}","languages_url":"https://api.github.com/repos/dgoodwin/release-1/languages","stargazers_url":"https://api.github.com/repos/dgoodwin/release-1/stargazers","contributors_url":"https://api.github.com/repos/dgoodwin/release-1/contributors","subscribers_url":"https://api.github.com/repos/dgoodwin/release-1/subscribers","subscription_url":"https://api.github.com/repos/dgoodwin/release-1/subscription","commits_url":"https://api.github.com/repos/dgoodwin/release-1/commits{/sha}","git_commits_url":"https://api.github.com/repos/dgoodwin/release-1/git/commits{/sha}","comments_url":"https://api.github.com/repos/dgoodwin/release-1/comments{/number}","issue_comment_url":"https://api.github.com/repos/dgoodwin/release-1/issues/comments{/number}","contents_url":"https://api.github.com/repos/dgoodwin/release-1/contents/{+path}","compare_url":"https://api.github.com/repos/dgoodwin/release-1/compare/{base}...{head}","merges_url":"https://api.github.com/repos/dgoodwin/release-1/merges","archive_url":"https://api.github.com/repos/dgoodwin/release-1/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/dgoodwin/release-1/downloads","issues_url":"https://api.github.com/repos/dgoodwin/release-1/issues{/number}","pulls_url":"https://api.github.com/repos/dgoodwin/release-1/pulls{/number}","milestones_url":"https://api.github.com/repos/dgoodwin/release-1/milestones{/number}","notifications_url":"https://api.github.com/repos/dgoodwin/release-1/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/dgoodwin/release-1/labels{/name}","releases_url":"https://api.github.com/repos/dgoodwin/release-1/releases{/id}","deployments_url":"https://api.github.com/repos/dgoodwin/release-1/deployments","created_at":"2018-04-30T17:16:27Z","updated_at":"2018-04-30T17:16:30Z","pushed_at":"2018-05-03T16:14:51Z","git_url":"git://github.com/dgoodwin/release-1.git","ssh_url":"git@github.com:dgoodwin/release-1.git","clone_url":"https://github.com/dgoodwin/release-1.git","svn_url":"https://github.com/dgoodwin/release-1","homepage":null,"size":23319,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":null,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"openshift:master","ref":"master","sha":"6d4ff8c2125cb01aeb6ac685b8ecb4bb94fc1bf2","user":{"login":"openshift","id":792337,"avatar_url":"https://avatars3.githubusercontent.com/u/792337?v=4","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"repo":{"id":75224144,"name":"release","full_name":"openshift/release","owner":{"login":"openshift","id":792337,"avatar_url":"https://avatars3.githubusercontent.com/u/792337?v=4","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/openshift/release","description":"Release tooling for OpenShift Origin","fork":false,"url":"https://api.github.com/repos/openshift/release","forks_url":"https://api.github.com/repos/openshift/release/forks","keys_url":"https://api.github.com/repos/openshift/release/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openshift/release/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openshift/release/teams","hooks_url":"https://api.github.com/repos/openshift/release/hooks","issue_events_url":"https://api.github.com/repos/openshift/release/issues/events{/number}","events_url":"https://api.github.com/repos/openshift/release/events","assignees_url":"https://api.github.com/repos/openshift/release/assignees{/user}","branches_url":"https://api.github.com/repos/openshift/release/branches{/branch}","tags_url":"https://api.github.com/repos/openshift/release/tags","blobs_url":"https://api.github.com/repos/openshift/release/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openshift/release/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openshift/release/git/refs{/sha}","trees_url":"https://api.github.com/repos/openshift/release/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openshift/release/statuses/{sha}","languages_url":"https://api.github.com/repos/openshift/release/languages","stargazers_url":"https://api.github.com/repos/openshift/release/stargazers","contributors_url":"https://api.github.com/repos/openshift/release/contributors","subscribers_url":"https://api.github.com/repos/openshift/release/subscribers","subscription_url":"https://api.github.com/repos/openshift/release/subscription","commits_url":"https://api.github.com/repos/openshift/release/commits{/sha}","git_commits_url":"https://api.github.com/repos/openshift/release/git/commits{/sha}","comments_url":"https://api.github.com/repos/openshift/release/comments{/number}","issue_comment_url":"https://api.github.com/repos/openshift/release/issues/comments{/number}","contents_url":"https://api.github.com/repos/openshift/release/contents/{+path}","compare_url":"https://api.github.com/repos/openshift/release/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openshift/release/merges","archive_url":"https://api.github.com/repos/openshift/release/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openshift/release/downloads","issues_url":"https://api.github.com/repos/openshift/release/issues{/number}","pulls_url":"https://api.github.com/repos/openshift/release/pulls{/number}","milestones_url":"https://api.github.com/repos/openshift/release/milestones{/number}","notifications_url":"https://api.github.com/repos/openshift/release/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openshift/release/labels{/name}","releases_url":"https://api.github.com/repos/openshift/release/releases{/id}","deployments_url":"https://api.github.com/repos/openshift/release/deployments","created_at":"2016-11-30T20:25:21Z","updated_at":"2018-05-04T04:07:21Z","pushed_at":"2018-05-04T04:07:17Z","git_url":"git://github.com/openshift/release.git","ssh_url":"git@github.com:openshift/release.git","clone_url":"https://github.com/openshift/release.git","svn_url":"https://github.com/openshift/release","homepage":null,"size":23355,"stargazers_count":18,"watchers_count":18,"language":"Go","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":68,"mirror_url":null,"archived":false,"open_issues_count":36,"license":null,"forks":68,"open_issues":36,"watchers":18,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openshift/release/pulls/821"},"html":{"href":"https://github.com/openshift/release/pull/821"},"issue":{"href":"https://api.github.com/repos/openshift/release/issues/821"},"comments":{"href":"https://api.github.com/repos/openshift/release/issues/821/comments"},"review_comments":{"href":"https://api.github.com/repos/openshift/release/pulls/821/comments"},"review_comment":{"href":"https://api.github.com/repos/openshift/release/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openshift/release/pulls/821/commits"},"statuses":{"href":"https://api.github.com/repos/openshift/release/statuses/c8e47465e89aa3b84dbe9ed19e6e73533ad9ac5d"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"dgoodwin"}}