disposab1e/sealed-secrets-operator-helm

[DEPRECATED] Sealed Secrets Operator (Helm) installs Sealed Secrets in OpenShift and Kubernetes.

sealed-secrets-operator-helm's Issues

Rolle concept

Hi,

Can you please go into detail about the role concept of the Operator?
Seeing the file at https://github.com/disposab1e/sealed-secrets-operator-helm/blob/master/guides/ocp4/manual/role.yaml it seems like that the operator requires quite a lot of access to work. Or could the resources and verbs be broken down into more detail to reduce the permissions of the operator and the operator still work fine?

• What kind of resources does the Operator, list, get, create, watch, update, delete and patch during normal operation?

Thanks

Installation of sealed-secrets-operator stuck on status "UpgradePending" in a fresh openshift cluster

Steps to reproduce

Step 1:
Spinup a fresh 4.6 openshift cluster

Step 2:
Login to the cluster as kubeadmin

Step 3:
Apply the sealed-secrets-operator subscription through oc command

oc create -f - <<EOF
  apiVersion: operators.coreos.com/v1alpha1
  kind: Subscription
  metadata: 
    labels: 
      operators.coreos.com/sealed-secrets-operator-helm.cicd: ""
    managedFields: 
      - 
        apiVersion: operators.coreos.com/v1alpha1
        manager: olm
        operation: Update
      - 
        apiVersion: operators.coreos.com/v1alpha1
        manager: catalog
        operation: Update
    name: sealed-secrets-operator-helm
    namespace: cicd
  spec: 
    channel: alpha
    installPlanApproval: Automatic
    name: sealed-secrets-operator-helm
    source: community-operators
    sourceNamespace: openshift-marketplace
    startingCSV: sealed-secrets-operator-helm.v0.0.2
EOF

Step 4:
Check the operator status from the openshift console

missing rbac for handling ingress

The operator cannot create ingress:

{"level":"error","ts":1631867415.8278918,"logger":"helm.controller","msg":"Release failed","namespace":"sealed-secrets","name":"sealed-secret-controller","apiVersion":"bitnami.com/v1alpha1","kind":"SealedSecretController","release":"sealed-secret-controller","error":"failed to install release: rendered manifests contain a resource that already exists. Unable to continue with install: could not get information about the resource: ingresses.networking.k8s.io \"sealed-secret-controller-sealed-secrets\" is forbidden: User \"system:serviceaccount:sealed-secrets:sealed-secrets-operator-helm\" cannot get resource \"ingresses\" in API group \"networking.k8s.io\" in the namespace \"sealed-secrets\"","stacktrace":"github.com/go-logr/zapr.(*zapLogger).Error\n\tpkg/mod/github.com/go-logr/[email protected]/zapr.go:128\ngithub.com/operator-framework/operator-sdk/pkg/helm/controller.HelmOperatorReconciler.Reconcile\n\tsrc/github.com/operator-framework/operator-sdk/pkg/helm/controller/reconcile.go:197\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\tpkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:256\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\tpkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:232\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).worker\n\tpkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:211\nk8s.io/apimachinery/pkg/util/wait.JitterUntil.func1\n\tpkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:152\nk8s.io/apimachinery/pkg/util/wait.JitterUntil\n\tpkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:153\nk8s.io/apimachinery/pkg/util/wait.Until\n\tpkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:88"}
{"level":"error","ts":1631867415.8357806,"logger":"controller-runtime.controller","msg":"Reconciler error","controller":"sealedsecretcontroller-controller","request":"sealed-secrets/sealed-secret-controller","error":"failed to install release: rendered manifests contain a resource that already exists. Unable to continue with install: could not get information about the resource: ingresses.networking.k8s.io \"sealed-secret-controller-sealed-secrets\" is forbidden: User \"system:serviceaccount:sealed-secrets:sealed-secrets-operator-helm\" cannot get resource \"ingresses\" in API group \"networking.k8s.io\" in the namespace \"sealed-secrets\"","stacktrace":"github.com/go-logr/zapr.(*zapLogger).Error\n\tpkg/mod/github.com/go-logr/[email protected]/zapr.go:128\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\tpkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:258\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\tpkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:232\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).worker\n\tpkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:211\nk8s.io/apimachinery/pkg/util/wait.JitterUntil.func1\n\tpkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:152\nk8s.io/apimachinery/pkg/util/wait.JitterUntil\n\tpkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:153\nk8s.io/apimachinery/pkg/util/wait.Until\n\tpkg/mod/k8s.io/[email protected]/pkg/util/wait/wait.go:88"}

Support restricted enviroments

https://docs.openshift.com/container-platform/4.4/operators/operator_sdk/osdk-generating-csvs.html#olm-enabling-operator-for-restricted-network_osdk-generating-csvs

Today

#- @I have a meeting with my friend at the house for a while now she's in the car and she's getting ready to go to the bathroom so I can get her to dominate me and my possibly my wife too. It will be good for a couple of hours to get it done now but it will be a good end to the last time we get high on our own and then we can get a break from the next week

Error with multiple sealed secrets instances

When the operator from OperatorHub is installed in multiple namespaces and CR instances are created in their respective namespaces. The instances fail with the following error

failed to install release: rendered manifests contain a resource that already exists. Unable to continue with install: existing resource conflict: namespace: , name: sealedsecrets.bitnami.com, existing_kind: apiextensions.k8s.io/v1beta1, Kind=CustomResourceDefinition, new_kind: apiextensions.k8s.io/v1beta1, Kind=CustomResourceDefinition

Steps to reproduce:

1. Create a namespace foo. Install the operator in namespace foo and create the CR in foo
2. Create a new namespace bar. Install the operator in namespace bar and create the CR in bar

Operator Version: 0.0.2
Environment: OpenShift 4.6

Aggregate sealed secrets to admin cluster role

On OpenShift the sealed secrets resource is not aggregated to the admin cluster role. This prevents service accounts (eg Argo CD) from managing sealed secret resources even though they have admin privileges in that namespace This could be achieved by adding the label

"rbac.authorization.k8s.io/aggregate-to-admin": "true",