fix(cso): add cert for hook server

README.md

@@ -63,6 +63,7 @@ The prod components include all of the above and additionally include:
 - Kyverno policies
 - secrets for gx-scs, dns, github
 - pre-deployed namespaces with secrets
+- dex
 
 ### Development setup
 

capi-visualizer/installation/helmrelease.yaml

@@ -10,7 +10,7 @@ spec:
     spec:
       chart: cluster-api-visualizer
       reconcileStrategy: ChartVersion
-      version: 1.3.0
+      version: 1.3.1
       sourceRef:
         kind: HelmRepository
         name: capi-visualizer

capi/config/cabp.yaml

@@ -10,4 +10,4 @@ metadata:
   name: kubeadm
   namespace: capi-kubeadm-bootstrap-system
 spec:
-  version: v1.7.2
+  version: v1.8.4

capi/config/cacp.yaml

@@ -16,6 +16,6 @@ spec:
       ClusterTopology: true
       MachinePool: true
       MachineSetPreflightChecks: false
-      RuntimeSDK: false
+      RuntimeSDK: true
     verbosity: 1
-  version: v1.7.2
+  version: v1.8.3

capi/config/cacpp.yaml

@@ -15,4 +15,4 @@ spec:
       MachinePool: true
       ClusterTopology: true
       KubeadmBootstrapFormatIgnition: false
-  version: v1.7.2
+  version: v1.8.4

capi/config/caip.yaml

@@ -2,12 +2,12 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: openstack-infrastructure-system
+  name: capo-system
 ---
 apiVersion: operator.cluster.x-k8s.io/v1alpha2
 kind: InfrastructureProvider
 metadata:
   name: openstack
-  namespace: openstack-infrastructure-system
+  namespace: capo-system
 spec:
-  version: v0.10.2
+  version: v0.10.5

capi/config/kamaji.yaml

@@ -7,7 +7,7 @@ metadata:
 apiVersion: operator.cluster.x-k8s.io/v1alpha2
 kind: ControlPlaneProvider
 metadata:
-  name: kamaji 
+  name: kamaji
   namespace: capi-kamaji-control-plane-system
 spec:
-  version: v0.10.0
+  version: v0.11.0

capi/installation/helmrelease.yaml

@@ -13,7 +13,7 @@ spec:
     spec:
       chart: cluster-api-operator
       reconcileStrategy: ChartVersion
-      version: 0.10.1
+      version: 0.13.0
       sourceRef:
         kind: HelmRepository
         name: capi

cert-manager/installation/helmrelease.yaml

@@ -17,7 +17,7 @@ spec:
   chart:
     spec:
       chart: cert-manager
-      version: "v1.14.5"
+      version: "v1.15.3"
       sourceRef:
         kind: HelmRepository
         name: jetstack

kyverno/config/k8s-version.yaml

@@ -15,6 +15,6 @@ spec:
         deny:
           conditions:
             all:
-              - key: "{{ semver_compare( trim_prefix('{{ request.object.spec.topology.version }}', 'v'),'1.28.6 || 1.28.7 || 1.28.8 || 1.28.9 || 1.28.10 || 1.28.11 || 1.28.12 || 1.28.13 || 1.29.3 || 1.29.4 || 1.29.5 || 1.29.6 || 1.29.7 || 1.29.8 || 1.30.1 || 1.30.2 || 1.30.3 || 1.30.4 || 1.31.0') }}"
+              - key: "{{ semver_compare( trim_prefix('{{ request.object.spec.topology.version }}', 'v'),'1.29.3 || 1.29.4 || 1.29.5 || 1.29.6 || 1.29.7 || 1.29.8 || 1.29.9 || 1.29.10 || 1.30.1 || 1.30.2 || 1.30.3 || 1.30.4 || 1.30.5 || 1.30.6 || 1.31.0') }}"
                 operator: Equals
                 value: false

kyverno/config/per-playground-resources.yaml

@@ -13,86 +13,146 @@ spec:
   validationFailureAction: Audit
   generateExisting: true
   rules:
-    - name: generate-clusterstack
+    - name: generate-cspotemplate
       match:
         any:
           - resources:
               kinds:
                 - Namespace
               names:
-                - '*playground*'
+                - "*playground*"
       generate:
-        apiVersion: clusterstack.x-k8s.io/v1alpha1
+        apiVersion: infrastructure.clusterstack.x-k8s.io/v1alpha1
+        kind: OpenStackClusterStackReleaseTemplate
+        name: cspotemplate
+        namespace: "{{request.object.metadata.name}}"
+        synchronize: true
         data:
           metadata:
-            name: scs-cluster-stack
-            namespace: '{{request.object.metadata.name}}'
+            name: cspotemplate
+            namespace: "{{request.object.metadata.name}}"
           spec:
-            autoSubscribe: false
-            channel: stable
-            kubernetesVersion: '1.27'
-            name: scs
-            noProvider: true
-            provider: openstack
-            versions:
-              - v4
-        kind: ClusterStack
-        name: scs-cluster-stack
-        namespace: '{{request.object.metadata.name}}'
-        synchronize: true
+            template:
+              spec:
+                identityRef:
+                  kind: Secret
+                  name: openstack
+    #- name: generate-clusterstack-131
+    #  match:
+    #    any:
+    #      - resources:
+    #          kinds:
+    #            - Namespace
+    #          names:
+    #            - "*playground*"
+    #  generate:
+    #    apiVersion: clusterstack.x-k8s.io/v1alpha1
+    #    kind: ClusterStack
+    #    name: scs-cluster-stack-1-31
+    #    namespace: "{{request.object.metadata.name}}"
+    #    synchronize: true
+    #    data:
+    #      metadata:
+    #        name: scs-cluster-stack-1-31
+    #        namespace: "{{request.object.metadata.name}}"
+    #      spec:
+    #        autoSubscribe: false
+    #        channel: stable
+    #        kubernetesVersion: "1.31"
+    #        name: scs
+    #        provider: openstack
+    #        providerRef:
+    #          apiVersion: infrastructure.clusterstack.x-k8s.io/v1alpha1
+    #          kind: OpenStackClusterStackReleaseTemplate
+    #          name: cspotemplate
+    #        versions:
+    #          - v0-sha.ve8qmt7
+    #- name: generate-clusterstack-130
+    #  match:
+    #    any:
+    #      - resources:
+    #          kinds:
+    #            - Namespace
+    #          names:
+    #            - "*playground*"
+    #  generate:
+    #    apiVersion: clusterstack.x-k8s.io/v1alpha1
+    #    data:
+    #      metadata:
+    #        name: openstack-scs-130
+    #        namespace: "{{request.object.metadata.name}}"
+    #      spec:
+    #        autoSubscribe: false
+    #        channel: stable
+    #        kubernetesVersion: "1.30"
+    #        name: scs
+    #        providerRef:
+    #          apiVersion: infrastructure.clusterstack.x-k8s.io/v1alpha1
+    #          kind: OpenStackClusterStackReleaseTemplate
+    #          name: cspotemplate
+    #        provider: openstack
+    #        versions:
+    #          - v0-sha.pxfmezw
+    #    kind: ClusterStack
+    #    name: openstack-scs-130
+    #    namespace: "{{request.object.metadata.name}}"
+    #    synchronize: true
     - name: generate-rolebinding
       match:
         any:
           - resources:
               kinds:
                 - Namespace
               names:
-                - '*playground*'
+                - "*playground*"
       generate:
         synchronize: true
         apiVersion: rbac.authorization.k8s.io/v1
         kind: RoleBinding
         name: scs-tenant-rolebinding
-        namespace: '{{request.object.metadata.name}}'
+        namespace: "{{request.object.metadata.name}}"
         data:
           metadata:
             name: scs-tenant-rolebinding
-            namespace: '{{request.object.metadata.name}}'
+            namespace: "{{request.object.metadata.name}}"
           roleRef:
             apiGroup: rbac.authorization.k8s.io
             kind: ClusterRole
             name: scs-tenant-clusterrole
           subjects:
             - apiGroup: rbac.authorization.k8s.io
               kind: Group
-              name: 'oidc:SovereignCloudStack:moin-cluster-all-playgrounds'
-    - name: generate-kamaji-clusterstack
-      match:
-        any:
-          - resources:
-              kinds:
-                - Namespace
-              names:
-                - '*playground*'
-      generate:
-        apiVersion: clusterstack.x-k8s.io/v1alpha1
-        data:
-          metadata:
-            name: kamaji
-            namespace: '{{request.object.metadata.name}}'
-          spec:
-            provider: openstack
-            name: kamaji
-            kubernetesVersion: "1.30"
-            channel: custom
-            autoSubscribe: false
-            providerRef:
-              apiVersion: infrastructure.clusterstack.x-k8s.io/v1alpha1
-              kind: OpenStackClusterStackReleaseTemplate
-              name: cspotemplate
-            versions:
-              - v0-sha.11930ee
-        kind: ClusterStack
-        name: kamaji
-        namespace: '{{request.object.metadata.name}}'
-        synchronize: true
+              name: "oidc:SovereignCloudStack:moin-cluster-all-playgrounds"
+            - apiGroup: rbac.authorization.k8s.io
+              kind: Group
+              name: "oidc:sovereigncloudstack/moin-cluster"
+    #- name: generate-kamaji-clusterstack
+    #  match:
+    #    any:
+    #      - resources:
+    #          kinds:
+    #            - Namespace
+    #          names:
+    #            - "*playground*"
+    #  generate:
+    #    apiVersion: clusterstack.x-k8s.io/v1alpha1
+    #    data:
+    #      metadata:
+    #        name: kamaji
+    #        namespace: "{{request.object.metadata.name}}"
+    #      spec:
+    #        provider: openstack
+    #        name: kamaji
+    #        kubernetesVersion: "1.30"
+    #        channel: stable
+    #        autoSubscribe: false
+    #        providerRef:
+    #          apiVersion: infrastructure.clusterstack.x-k8s.io/v1alpha1
+    #          kind: OpenStackClusterStackReleaseTemplate
+    #          name: cspotemplate
+    #        versions:
+    #          - v0-sha.frco630
+    #    kind: ClusterStack
+    #    name: kamaji
+    #    namespace: "{{request.object.metadata.name}}"
+    #    synchronize: true

kyverno/installation/helmrelease.yaml

@@ -11,7 +11,7 @@ spec:
     spec:
       chart: kyverno
       reconcileStrategy: ChartVersion
-      version: v3.2.2
+      version: v3.2.7
       sourceRef:
         kind: HelmRepository
         name: kyverno
@@ -25,52 +25,54 @@ spec:
         clusterRole:
           extraResources:
             - apiGroups:
-              - cluster.x-k8s.io
+                - cluster.x-k8s.io
               resources:
-              - "*"
+                - "*"
               verbs:
-              - get
-              - create
-              - update
-              - delete
-              - watch
-              - list
-              - patch
+                - get
+                - create
+                - update
+                - delete
+                - watch
+                - list
+                - patch
             - apiGroups:
-              - ""
+                - ""
               resources:
-              - "secrets"
+                - "secrets"
               verbs:
-              - get
-              - create
-              - update
-              - delete
-              - watch
-              - list
-              - patch
+                - get
+                - create
+                - update
+                - delete
+                - watch
+                - list
+                - patch
             - apiGroups:
-              - clusterstack.x-k8s.io
+                - clusterstack.x-k8s.io
               resources:
-              - "*"
+                - "*"
               verbs:
-              - get
-              - create
-              - update
-              - delete
-              - watch
-              - list
-              - patch
+                - get
+                - create
+                - update
+                - delete
+                - watch
+                - list
+                - patch
             - apiGroups:
-              - infrastructure.clusterstack.x-k8s.io
+                - infrastructure.clusterstack.x-k8s.io
+                - infrastructure.cluster.x-k8s.io
+                - addons.cluster.x-k8s.io
               resources:
-              - "*"
+                - "*"
               verbs:
-              - get
-              - create
-              - update
-              - delete
-              - watch
-              - list
-              - patch
+                - get
+                - create
+                - update
+                - delete
+                - watch
+                - list
+                - patch
   interval: 10s
   targetNamespace: kyverno

prod/cluster-gen/installation/helmrelease.yaml

@@ -30,4 +30,4 @@ spec:
       retries: -1
   targetNamespace: cluster-gen
   values:
-    image: registry.scs.community/cluster-gen/cluster-gen:v0.0.2
+    image: registry.scs.community/cluster-gen/cluster-gen:v0.0.8