Hard coded for openshift

[devinbost]

This operator is hard coded for openshift. Please ensure compatibility for non-openshift clusters for both the operator and its helm chart.

[shivamerla]

@devinbost Could you clarify what you're seeing? The operator is designed to support multiple Kubernetes-based orchestrators, including upstream K8s, OpenShift, TKGS, and various CSP distributions. It's not hardcoded for any single platform.

[devinbost]

The biggest issue was this part of nimcache_controller.go:

// ~line 314 in upstream/k8s-nim-operator/internal/controller/nimcache_controller.go
func (r *NIMCacheReconciler) reconcileRole(ctx context.Context, nimCache *appsv1alpha1.NIMCache) error {
    // ... other setup ...

    // Desired Role configuration
    desiredRole := &rbacv1.Role{
        ObjectMeta: metav1.ObjectMeta{
            Name:      "nim-cache-role", // Constant NIMCacheRole
            Namespace: nimCache.GetNamespace(),
            // ... labels ...
        },
        // ****** This 'Rules' section is the key part ******
        Rules: []rbacv1.PolicyRule{
            {
                // This rule unconditionally includes OpenShift-specific APIs/Resources
                APIGroups:     []string{"security.openshift.io"},         // OpenShift API Group
                Resources:     []string{"securitycontextconstraints"},     // OpenShift Resource
                ResourceNames: []string{"nonroot"},                       // Specific OpenShift SCC
                Verbs:         []string{"use"},                           // Verb needed for SCCs
            },
            // Potentially other rules could be here, but this is the problematic one
        },
    }

    // ... rest of the logic to create/update this role ...
}

I also had to add these conditions to the manager-rbac.yaml in the Helm chart. (I would create an issue in that repo, but it's not public to my knowledge.)

{{- if .Values.openshift.enabled }}
# OpenShift-specific config permissions
- apiGroups:
  - config.openshift.io
  resources:
  - clusterversions
  - proxies
  verbs:
  - get
  - list
  - watch
{{- end }}

{{- if .Values.openshift.enabled }}
- apiGroups:
  - route.openshift.io
  resources:
  - routes
  verbs:
  - create
  - get
  - list
  - patch
  - update
  - watch
{{- end }}

{{- if .Values.openshift.enabled }}
- apiGroups:
  - security.openshift.io
  resourceNames:
  - nonroot
  resources:
  - securitycontextconstraints
  verbs:
  - use
- apiGroups:
  - security.openshift.io
  resources:
  - securitycontextconstraints
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
{{- end }}

[shivamerla]

Thanks @devinbost we will conditionally add these rules for openshift platform in the controller. We don't really use Helm with OpenShift, we use OLM, so we can remove them from the Helm chart.