salt: move common olmv1 components to new folder

buildchain/buildchain/salt_tree.py

@@ -350,6 +350,9 @@ def task(self) -> types.TaskDict:
     Path("salt/metalk8s/addons/olm/catalogd/deployed/init.sls"),
     Path("salt/metalk8s/addons/olm/catalogd/deployed/rbac.sls"),
     Path("salt/metalk8s/addons/olm/catalogd/deployed/webhook.sls"),
+    Path("salt/metalk8s/addons/olm/common/deployed/cert.sls"),
+    Path("salt/metalk8s/addons/olm/common/deployed/init.sls"),
+    Path("salt/metalk8s/addons/olm/common/deployed/namespace.sls"),
     Path("salt/metalk8s/addons/olm/operator-controller/deployed/cert.sls"),
     Path("salt/metalk8s/addons/olm/operator-controller/deployed/crds.sls"),
     Path("salt/metalk8s/addons/olm/operator-controller/deployed/init.sls"),

salt/metalk8s/addons/olm/catalogd/deployed/cert.sls

@@ -1,25 +1,5 @@
 #!jinja | metalk8s_kubernetes
 
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: olmv1-ca
-  namespace: metalk8s-certs
-spec:
-  commonName: olmv1-ca
-  isCA: true
-  issuerRef:
-    group: cert-manager.io
-    kind: Issuer
-    name: self-sign-issuer
-  privateKey:
-    algorithm: ECDSA
-    size: 256
-  secretName: olmv1-ca
-  secretTemplate:
-    annotations:
-      cert-manager.io/allow-direct-injection: "true"
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -39,19 +19,3 @@ spec:
     algorithm: ECDSA
     size: 256
   secretName: catalogd-service-cert-v1.0.0
----
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: olmv1-ca
-spec:
-  ca:
-    secretName: olmv1-ca
----
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: self-sign-issuer
-  namespace: metalk8s-certs
-spec:
-  selfSigned: {}

salt/metalk8s/addons/olm/catalogd/deployed/init.sls

@@ -1,4 +1,5 @@
 include:
+  - ...common.deployed
   - .crds
   - .rbac
   - .cert
@@ -15,6 +16,7 @@ Wait for the Catalogd Controller Manager deployment to be Ready:
     - retry:
         attempts: 30
     - require:
+      - test: Deploy common OLMv1 components
       - sls: metalk8s.addons.olm.catalogd.deployed.crds
       - sls: metalk8s.addons.olm.catalogd.deployed.rbac
       - sls: metalk8s.addons.olm.catalogd.deployed.cert

salt/metalk8s/addons/olm/catalogd/deployed/rbac.sls

@@ -1,16 +1,5 @@
 #!jinja | metalk8s_kubernetes
 
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    app.kubernetes.io/part-of: olm
-    pod-security.kubernetes.io/enforce: baseline
-    pod-security.kubernetes.io/enforce-version: latest
-  name: olmv1-system
-  annotations:
-    scheduler.alpha.kubernetes.io/defaultTolerations: '[{"operator": "Exists", "effect": "NoSchedule", "key": "node-role.kubernetes.io/bootstrap"}, {"operator": "Exists", "effect": "NoSchedule", "key": "node-role.kubernetes.io/infra"}]'
 ---
 apiVersion: v1
 kind: ServiceAccount

salt/metalk8s/addons/olm/common/deployed/cert.sls

@@ -0,0 +1,38 @@
+#!jinja | metalk8s_kubernetes
+
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: olmv1-ca
+  namespace: metalk8s-certs
+spec:
+  commonName: olmv1-ca
+  isCA: true
+  issuerRef:
+    group: cert-manager.io
+    kind: Issuer
+    name: self-sign-issuer
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  secretName: olmv1-ca
+  secretTemplate:
+    annotations:
+      cert-manager.io/allow-direct-injection: "true"
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: olmv1-ca
+spec:
+  ca:
+    secretName: olmv1-ca
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: self-sign-issuer
+  namespace: metalk8s-certs
+spec:
+  selfSigned: {}

salt/metalk8s/addons/olm/common/deployed/init.sls

@@ -0,0 +1,9 @@
+include:
+  - .namespace
+  - .cert
+
+Deploy common OLMv1 components:
+  test.succeed_without_changes:
+    - require:
+      - sls: metalk8s.addons.olm.common.deployed.namespace
+      - sls: metalk8s.addons.olm.common.deployed.cert

salt/metalk8s/addons/olm/common/deployed/namespace.sls

@@ -0,0 +1,13 @@
+#!jinja | metalk8s_kubernetes
+
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/part-of: olm
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/enforce-version: latest
+  name: olmv1-system
+  annotations:
+    scheduler.alpha.kubernetes.io/defaultTolerations: '[{"operator": "Exists", "effect": "NoSchedule", "key": "node-role.kubernetes.io/bootstrap"}, {"operator": "Exists", "effect": "NoSchedule", "key": "node-role.kubernetes.io/infra"}]'

salt/metalk8s/addons/olm/operator-controller/deployed/cert.sls

@@ -1,22 +1,5 @@
 #!jinja | metalk8s_kubernetes
 
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: olmv1-ca
-  namespace: metalk8s-certs
-spec:
-  commonName: olmv1-ca
-  isCA: true
-  issuerRef:
-    group: cert-manager.io
-    kind: Issuer
-    name: self-sign-issuer
-  privateKey:
-    algorithm: ECDSA
-    size: 256
-  secretName: olmv1-ca
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -35,19 +18,3 @@ spec:
     algorithm: ECDSA
     size: 256
   secretName: olmv1-cert
----
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: olmv1-ca
-spec:
-  ca:
-    secretName: olmv1-ca
----
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: self-sign-issuer
-  namespace: metalk8s-certs
-spec:
-  selfSigned: {}

salt/metalk8s/addons/olm/operator-controller/deployed/init.sls

@@ -1,4 +1,5 @@
 include:
+  - ...common.deployed
   - ...catalogd.deployed
   - .crds
   - .rbac
@@ -15,6 +16,7 @@ Wait for the Operator Controller Controller Manager Deployment to be Ready:
     - retry:
         attempts: 30
     - require:
+      - test: Deploy common OLMv1 components
       - test: Wait for the Catalogd Controller Manager deployment to be Ready
       - sls: metalk8s.addons.olm.operator-controller.deployed.crds
       - sls: metalk8s.addons.olm.operator-controller.deployed.rbac

salt/metalk8s/addons/olm/operator-controller/deployed/rbac.sls

@@ -1,15 +1,5 @@
 #!jinja | metalk8s_kubernetes
 
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    pod-security.kubernetes.io/enforce: restricted
-    pod-security.kubernetes.io/enforce-version: latest
-  name: olmv1-system
-  annotations:
-    scheduler.alpha.kubernetes.io/defaultTolerations: '[{"operator": "Exists", "effect": "NoSchedule", "key": "node-role.kubernetes.io/bootstrap"}, {"operator": "Exists", "effect": "NoSchedule", "key": "node-role.kubernetes.io/infra"}]'
 ---
 apiVersion: v1
 kind: ServiceAccount