OCPBUGS-111416: Moved node sync job creation from manifest to operator controller

cmd/config-sync-controllers/main.go

@@ -29,6 +29,7 @@ import (
 	"k8s.io/client-go/kubernetes"
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 
+	batchv1 "k8s.io/api/batch/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
@@ -37,6 +38,7 @@ import (
 	"k8s.io/utils/clock"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/cache"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
 
@@ -99,6 +101,12 @@ func main() {
 
 	ctrl.SetLogger(klog.NewKlogr().WithName("CCCMOConfigSyncControllers"))
 
+	operatorImage := os.Getenv("OPERATOR_IMAGE")
+	if operatorImage == "" {
+		setupLog.Error(nil, "OPERATOR_IMAGE environment variable is required")
+		os.Exit(1)
+	}
+
 	restConfig := ctrl.GetConfigOrDie()
 	le := util.GetLeaderElectionDefaults(restConfig, configv1.LeaderElection{
 		Disable:       !leaderElectionConfig.LeaderElect,
@@ -114,7 +122,19 @@ func main() {
 		DefaultNamespaces: map[string]cache.Config{
 			*managedNamespace:                           {},
 			controllers.OpenshiftConfigNamespace:        {},
-			controllers.OpenshiftManagedConfigNamespace: {}},
+			controllers.OpenshiftManagedConfigNamespace: {},
+		},
+		// The node-label-sync Job only ever lives in the operator's own namespace. Without this
+		// override, the multi-namespace cache built from DefaultNamespaces above would otherwise
+		// try to list/watch Jobs in every one of those namespaces too, which the operator has no
+		// RBAC for.
+		ByObject: map[client.Object]cache.ByObject{
+			&batchv1.Job{}: {
+				Namespaces: map[string]cache.Config{
+					controllers.OperatorNamespace: {},
+				},
+			},
+		},
 	}
 
 	mgr, err := ctrl.NewManager(restConfig, ctrl.Options{
@@ -126,6 +146,7 @@ func main() {
 		MapperProvider: restmapper.NewPartialRestMapperProvider(
 			restmapper.Or(
 				restmapper.KubernetesCoreGroup,
+				restmapper.KubernetesBatchGroup,
 				restmapper.OpenshiftOperatorGroup,
 				restmapper.OpenshiftConfigGroup,
 			),
@@ -202,6 +223,17 @@ func main() {
 		setupLog.Error(err, "unable to create Trusted CA sync controller", "controller", "ClusterOperator")
 		os.Exit(1)
 	}
+
+	if err = (&controllers.NodeLabelSyncJobReconciler{
+		Client:            mgr.GetClient(),
+		Namespace:         controllers.OperatorNamespace,
+		Image:             operatorImage,
+		ReleaseVersion:    controllers.GetReleaseVersion(),
+		FeatureGateAccess: featureGateAccessor,
+	}).SetupWithManager(mgr); err != nil {
+		setupLog.Error(err, "unable to create node-label-sync Job controller", "controller", "NodeLabelSyncJob")
+		os.Exit(1)
+	}
 	// +kubebuilder:scaffold:builder
 
 	if err := mgr.AddHealthzCheck("health", healthz.Ping); err != nil {

cmd/node-label-sync-job/main.go

@@ -15,10 +15,10 @@ limitations under the License.
 */
 
 // Command node-label-sync-job runs to completion once, backfilling the
-// node.openshift.io/platform-type=vsphere label onto vSphere nodes that are missing it. It is
-// installed as a Kubernetes Job by the CVO (see
-// manifests/0000_90_cloud-controller-manager-operator_00_job.yaml) rather
-// than run as an ongoing in-process controller.
+// node.openshift.io/platform-type=vsphere label onto vSphere nodes that are missing it. The
+// operator's own NodeLabelSyncJobReconciler (see
+// pkg/controllers/node_label_sync_job_controller.go) creates this as a Kubernetes Job on demand,
+// rather than running it as an ongoing in-process controller.
 package main
 
 import (

manifests/0000_26_cloud-controller-manager-operator_02_rbac_operator.yaml

@@ -232,6 +232,17 @@ rules:
       - list
       - patch
 
+  # For the operator to create (and never update) the one-shot node-label-sync Job.
+  - apiGroups:
+      - batch
+    resources:
+      - jobs
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role

manifests/0000_26_cloud-controller-manager-operator_50_deployment.yaml

@@ -108,6 +108,8 @@ spec:
         env:
         - name: RELEASE_VERSION
           value: "0.0.1-snapshot"
+        - name: OPERATOR_IMAGE
+          value: quay.io/openshift/origin-cluster-cloud-controller-manager-operator
         resources:
           requests:
             cpu: 10m

pkg/controllers/common_consts.go

@@ -3,12 +3,18 @@ package controllers
 const (
 	DefaultManagedNamespace = "openshift-cloud-controller-manager"
 
+	// OperatorNamespace is the namespace the operator's own Deployment (and the
+	// resources it creates directly, e.g. the node-label-sync Job) run in.
+	OperatorNamespace = "openshift-cloud-controller-manager-operator"
+
 	infrastructureResourceName = "cluster"
 
 	OpenshiftConfigNamespace        = "openshift-config"
 	OpenshiftManagedConfigNamespace = "openshift-config-managed"
 
 	syncedCloudConfigMapName = "cloud-conf"
 
+	nodeLabelSyncJobName = "node-label-sync"
+
 	proxyResourceName = "cluster"
 )