Update the Operator to support deploying the collector agent to Openshift 4.11

apis/otel/v1alpha1/splunkotelagent_webhook.go

@@ -43,7 +43,7 @@ func (r *Agent) SetupWebhookWithManager(mgr ctrl.Manager, distro autodetect.Dist
 
 // EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
 
-//+kubebuilder:webhook:path=/mutate-otel-splunk-com-v1alpha1-agent,mutating=true,failurePolicy=fail,sideEffects=None,groups=otel.splunk.com,resources=agents,verbs=create;update,versions=v1alpha1,name=magent.kb.io,admissionReviewVersions={v1,v1beta1}
+// +kubebuilder:webhook:path=/mutate-otel-splunk-com-v1alpha1-agent,mutating=true,failurePolicy=fail,sideEffects=None,groups=otel.splunk.com,resources=agents,verbs=create;update,versions=v1alpha1,name=magent.kb.io,admissionReviewVersions={v1,v1beta1}
 
 var _ webhook.Defaulter = &Agent{}
 
@@ -65,7 +65,7 @@ func (r *Agent) Default() {
 }
 
 // TODO(user): change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
-//+kubebuilder:webhook:path=/validate-otel-splunk-com-v1alpha1-agent,mutating=false,failurePolicy=fail,sideEffects=None,groups=otel.splunk.com,resources=agents,verbs=create;update,versions=v1alpha1,name=vagent.kb.io,admissionReviewVersions={v1,v1beta1}
+// +kubebuilder:webhook:path=/validate-otel-splunk-com-v1alpha1-agent,mutating=false,failurePolicy=fail,sideEffects=None,groups=otel.splunk.com,resources=agents,verbs=create;update,versions=v1alpha1,name=vagent.kb.io,admissionReviewVersions={v1,v1beta1}
 
 var _ webhook.Validator = &Agent{}
 
@@ -213,6 +213,14 @@ func (r *Agent) defaultAgent() {
 		}
 	}
 
+	if spec.SecurityContext == nil {
+		u := int64(0)
+		spec.SecurityContext = &v1.SecurityContext{
+			// Needed for openshift
+			RunAsUser: &u,
+		}
+	}
+
 	setDefaultResources(spec, defaultAgentCPU, defaultAgentMemory)
 	setDefaultEnvVars(spec, r.Spec.Realm, r.Spec.ClusterName)
 

bundle/manifests/splunk-otel-collector-operator.clusterserviceversion.yaml

@@ -17,7 +17,7 @@ metadata:
     operators.operatorframework.io/builder: operator-sdk-v1.23.0
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v3
   name: splunk-otel-collector-operator.v0.0.4
-  namespace: placeholder
+  namespace: splunk-otel-operator-system
 spec:
   apiservicedefinitions: {}
   customresourcedefinitions:
@@ -419,13 +419,18 @@ spec:
                   periodSeconds: 10
                 resources:
                   limits:
-                    cpu: 100m
-                    memory: 30Mi
+                    cpu: 200m
+                    memory: 256Mi
                   requests:
                     cpu: 100m
-                    memory: 20Mi
+                    memory: 64Mi
                 securityContext:
                   allowPrivilegeEscalation: false
+                  capabilities:
+                    drop:
+                    - ALL
+                  readOnlyRootFilesystem: true
+                  runAsNonRoot: true
                 volumeMounts:
                 - mountPath: /tmp/k8s-webhook-server/serving-certs
                   name: cert

bundle/manifests/splunk-otel-operator-binding_rbac.authorization.k8s.io_v1_clusterrolebinding.yaml

@@ -11,5 +11,5 @@ roleRef:
   name: splunk-otel-operator-collector-role
 subjects:
 - kind: ServiceAccount
-  name: splunk-otel-operator-acccount
+  name: splunk-otel-operator-account
   namespace: splunk-otel-operator-system

config/manager/manager.yaml

@@ -30,9 +30,16 @@ spec:
         args:
         - --leader-elect
         image: controller:latest
+        # Useful for debugging
+        # imagePullPolicy: Always
         name: manager
         securityContext:
+          capabilities:
+            drop:
+              - ALL
           allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
         livenessProbe:
           httpGet:
             path: /healthz
@@ -47,10 +54,10 @@ spec:
           periodSeconds: 10
         resources:
           limits:
-            cpu: 100m
-            memory: 30Mi
+            cpu: 200m
+            memory: 256Mi
           requests:
             cpu: 100m
-            memory: 20Mi
+            memory: 64Mi
       serviceAccountName: controller-manager
       terminationGracePeriodSeconds: 10

config/manifests/bases/splunk-otel-collector-operator.clusterserviceversion.yaml

@@ -5,7 +5,7 @@ metadata:
     alm-examples: '[]'
     capabilities: Basic Install
   name: splunk-otel-collector-operator.v0.0.0
-  namespace: placeholder
+  namespace: splunk-otel-operator-system
 spec:
   apiservicedefinitions: {}
   customresourcedefinitions:

config/openshift/security_patch.yaml

@@ -30,9 +30,10 @@ allowedFlexVolumes: []
 defaultAddCapabilities: []
 fsGroup:
   type: MustRunAs
-readOnlyRootFilesystem: false
+readOnlyRootFilesystem: true
 runAsUser:
   type: RunAsAny
 supplementalGroups:
   type: RunAsAny
-requiredDropCapabilities: []
+requiredDropCapabilities:
+- ALL

config/rbac/splunk_role_binding.yaml

@@ -10,5 +10,5 @@ roleRef:
   name: collector-role
 subjects:
 - kind: ServiceAccount
-  name: splunk-otel-operator-acccount
+  name: splunk-otel-operator-account
   namespace: splunk-otel-operator-system

internal/collector/reconcile/serviceaccount_test.go

@@ -33,7 +33,7 @@ func TestExpectedServiceAccounts(t *testing.T) {
 		err := expectedServiceAccounts(context.Background(), params(), []v1.ServiceAccount{desired})
 		assert.NoError(t, err)
 
-		exists, err := populateObjectIfExists(t, &v1.ServiceAccount{}, types.NamespacedName{Namespace: "default", Name: "splunk-otel-operator-acccount"})
+		exists, err := populateObjectIfExists(t, &v1.ServiceAccount{}, types.NamespacedName{Namespace: "default", Name: "splunk-otel-operator-account"})
 		assert.NoError(t, err)
 		assert.True(t, exists)
 	})

tests/e2e/custom_all/01-assert.yaml

@@ -337,8 +337,8 @@ spec:
       restartPolicy: Always
       schedulerName: default-scheduler
       securityContext: {}
-      serviceAccount: splunk-otel-operator-acccount
-      serviceAccountName: splunk-otel-operator-acccount
+      serviceAccount: splunk-otel-operator-account
+      serviceAccountName: splunk-otel-operator-account
       terminationGracePeriodSeconds: 30
       tolerations:
       - effect: NoSchedule

tests/e2e/gateway/01-assert.yaml

@@ -302,8 +302,8 @@ spec:
       restartPolicy: Always
       schedulerName: default-scheduler
       securityContext: { }
-      serviceAccount: splunk-otel-operator-acccount
-      serviceAccountName: splunk-otel-operator-acccount
+      serviceAccount: splunk-otel-operator-account
+      serviceAccountName: splunk-otel-operator-account
       terminationGracePeriodSeconds: 30
       volumes:
         - configMap:

tests/e2e/smoke-default/01-assert.yaml

@@ -378,8 +378,8 @@ spec:
       restartPolicy: Always
       schedulerName: default-scheduler
       securityContext: {}
-      serviceAccount: splunk-otel-operator-acccount
-      serviceAccountName: splunk-otel-operator-acccount
+      serviceAccount: splunk-otel-operator-account
+      serviceAccountName: splunk-otel-operator-account
       terminationGracePeriodSeconds: 30
       volumes:
       - configMap:
@@ -499,8 +499,8 @@ spec:
       restartPolicy: Always
       schedulerName: default-scheduler
       securityContext: {}
-      serviceAccount: splunk-otel-operator-acccount
-      serviceAccountName: splunk-otel-operator-acccount
+      serviceAccount: splunk-otel-operator-account
+      serviceAccountName: splunk-otel-operator-account
       terminationGracePeriodSeconds: 30
       tolerations:
       - effect: NoSchedule