fix of argo perms and storage

bootstrap/README.md

@@ -0,0 +1,18 @@
+# Permission fix
+OpenShift GitOps has an expectation that the person applying applications at the cluster level is a kube-admin. The following allows for users that are in the cluster's RBAC group instructlab-admins to get the privileges needed to deploy this GitOps applicationset and view it in the argocd UI.
+
+https://access.redhat.com/solutions/6989516
+
+
+```
+oc -n openshift-gitops patch argocd openshift-gitops --type=merge --patch "$(cat policies.yaml)"
+```
+
+
+## Clusterrole
+
+Modify and add the following. This will allow for the management of knative and project assets.
+
+```
+oc create -f additional-cluster-role.yaml
+```

bootstrap/addition-cluster-role.yaml

@@ -0,0 +1,34 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations:
+    argocds.argoproj.io/name: openshift-gitops
+    argocds.argoproj.io/namespace: openshift-gitops
+  name: openshift-gitops-openshift-gitops-argocd-application-controller-parasol
+rules:
+- apiGroups:
+  - project.openshift.io
+  resources:
+  - '*'
+  verbs:
+  - '*'
+- apiGroups:
+  - serving.kserve.io
+  resources:
+  - '*'
+  verbs:
+  - '*'
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: gitops-service-cluster-parasol
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: openshift-gitops-openshift-gitops-argocd-application-controller-parasol
+subjects:
+- kind: ServiceAccount
+  name: openshift-gitops-argocd-application-controller
+  namespace: openshift-gitops

bootstrap/applicationset/applicationset-bootstrap.yaml

@@ -7,11 +7,6 @@ spec:
   generators:
   - list:
       elements:
-      - cluster: in-cluster
-        name: ic-shared-minio-app
-        repoURL: https://github.com/rh-aiservices-bu/parasol-insurance.git
-        targetRevision: main
-        path: bootstrap/ic-shared-minio
       - cluster: in-cluster
         name: ic-shared-database-app
         repoURL: https://github.com/rh-aiservices-bu/parasol-insurance.git
@@ -67,4 +62,4 @@ spec:
           prune: true
           selfHeal: true
         syncOptions:
-          - RespectIgnoreDifferences=true
+          - RespectIgnoreDifferences=true

bootstrap/ic-rhoai-configuration/kustomization.yaml

@@ -7,14 +7,11 @@ commonLabels:
 
 resources:
 # wave 0
-- gp3-remove-default.yaml
-- ceph-rbd-set-default.yaml
-# wave 1
 - workbench-imagestream.yaml
 - workbench-vscode-is.yaml
 - odhdashboardconfig.yaml
 - accelerator-profile.yaml
-# wave 2
+# wave 1
 - images-puller.yaml
 
 

bootstrap/ic-user-projects/create-projects-and-resources-job.yaml

@@ -305,7 +305,6 @@ spec:
             resources:
               requests:
                 storage: 5Gi
-            storageClassName: ocs-storagecluster-ceph-rbd
             volumeMode: Filesystem
           EOF
 
@@ -521,6 +520,6 @@ spec:
           EOF
 
           sleep 20
-          
+
           done
       restartPolicy: Never

bootstrap/ic-user-projects/create-projects-and-resources.bash

@@ -283,7 +283,6 @@ spec:
   resources:
     requests:
       storage: 5Gi
-  storageClassName: ocs-storagecluster-ceph-rbd
   volumeMode: Filesystem
 EOF
 

bootstrap/ic-user-projects/tools/check-and-recreate-projects.sh

@@ -36,7 +36,7 @@ while true; do
 done
 
 
-for USER_PROJECT in "${projects_without_running_pods[@]}"; 
+for USER_PROJECT in "${projects_without_running_pods[@]}";
 do
 
 # Assume username and user project is the same
@@ -307,7 +307,6 @@ spec:
   resources:
     requests:
       storage: 5Gi
-  storageClassName: ocs-storagecluster-ceph-rbd
   volumeMode: Filesystem
 EOF
 

bootstrap/ic-user-projects/tools/create-single-user-project.sh

@@ -281,7 +281,6 @@ spec:
   resources:
     requests:
       storage: 5Gi
-  storageClassName: ocs-storagecluster-ceph-rbd
   volumeMode: Filesystem
 EOF
 

bootstrap/policies.yaml

@@ -0,0 +1,12 @@
+spec:
+ rbac:
+   policy: |-
+     g, system:cluster-admins, role:admin
+     g, cluster-admins, role:admin
+     g, instructlab-admins, role:admin
+     p, role:all-actions, applications, create, */*, allow
+     p, role:all-actions, applications, sync, */*, allow
+     p, role:all-actions, applications, get, */*, allow
+     p, role:all-actions, applications, update, */*, allow
+     p, role:all-actions, applications, override, */*, allow
+     p, role:all-actions, applications, delete, */*, allow

docs/README.md

@@ -0,0 +1 @@
+This will be the location of documents defining how ET changed the existing Parasol application