Deploy Fournos in a dedicated namespace

Makefile

@@ -3,6 +3,7 @@ KIND_CLUSTER_NAME              ?= fournos-dev
 KIND_EXPERIMENTAL_PROVIDER     ?= podman
 KIND_CONTEXT                   := kind-$(KIND_CLUSTER_NAME)
 VENV_BIN                       := $(if $(wildcard .venv/bin/),.venv/bin/,)
+FOURNOS_CONTROLLER_NAMESPACE   ?= fournos-controller-local
 FOURNOS_NAMESPACE              ?= fournos-local-dev
 FOURNOS_SECRETS_NAMESPACE      ?= psap-secrets
 
@@ -32,19 +33,26 @@ install:
 	kubectl apply -f manifests/crd.yaml
 
 deploy: install
-	kubectl create ns $(FOURNOS_SECRETS_NAMESPACE) --dry-run -oyaml | kubectl apply -f-
-	for rbac_file in manifests/rbac/*.yaml; do \
-		cat $$rbac_file | NAMESPACE=$(FOURNOS_NAMESPACE) envsubst | kubectl apply -f- -n $(FOURNOS_NAMESPACE); \
+	kubectl create ns $(FOURNOS_CONTROLLER_NAMESPACE) --dry-run=client -oyaml | kubectl apply -f-
+	kubectl create ns $(FOURNOS_NAMESPACE) --dry-run=client -oyaml | kubectl apply -f-
+	kubectl label ns $(FOURNOS_NAMESPACE) fournos.dev/queue-access=true --overwrite
+	kubectl create ns $(FOURNOS_SECRETS_NAMESPACE) --dry-run=client -oyaml | kubectl apply -f-
+	kubectl apply -f manifests/rbac/sa_fournos.yaml -n $(FOURNOS_CONTROLLER_NAMESPACE)
+	kubectl apply -f manifests/rbac/sa_fournos.yaml -n $(FOURNOS_NAMESPACE)
+	for rbac_file in manifests/rbac/role_fournos.yaml manifests/rbac/rolebinding_fournos.yaml; do \
+		cat $$rbac_file | CONTROLLER_NAMESPACE=$(FOURNOS_CONTROLLER_NAMESPACE) envsubst '$$CONTROLLER_NAMESPACE' | kubectl apply -f- -n $(FOURNOS_NAMESPACE); \
 	done
+	cat manifests/rbac/clusterrole_fournos.yaml | kubectl apply -f-
+	cat manifests/rbac/clusterrolebinding_fournos.yaml | CONTROLLER_NAMESPACE=$(FOURNOS_CONTROLLER_NAMESPACE) envsubst '$$CONTROLLER_NAMESPACE' | kubectl apply -f-
 	cat manifests/secrets-ns-rbac.yaml \
-		| NAMESPACE=$(FOURNOS_NAMESPACE) SECRETS_NAMESPACE=$(FOURNOS_SECRETS_NAMESPACE) envsubst \
+		| CONTROLLER_NAMESPACE=$(FOURNOS_CONTROLLER_NAMESPACE) SECRETS_NAMESPACE=$(FOURNOS_SECRETS_NAMESPACE) envsubst \
 		| kubectl apply -f-
 	kubectl apply -f config/kueue-cluster-config.yaml
 	kubectl apply -f config/kueue-config.yaml -n $(FOURNOS_NAMESPACE)
 	for wf in config/forge/workflows/*.yaml; do \
 		cat $$wf | NAMESPACE=$(FOURNOS_NAMESPACE) envsubst '$$NAMESPACE' | kubectl apply -f- -n $(FOURNOS_NAMESPACE); \
 	done
-	kubectl apply -f manifests/deployment.yaml -n $(FOURNOS_NAMESPACE)
+	cat manifests/deployment.yaml | NAMESPACE=$(FOURNOS_NAMESPACE) envsubst '$$NAMESPACE' | kubectl apply -f- -n $(FOURNOS_CONTROLLER_NAMESPACE)
 
 ##@ Testing
 
@@ -66,12 +74,14 @@ sync-vault-secrets-dry-run:
 dev-setup:
 	@KIND_CLUSTER_NAME=$(KIND_CLUSTER_NAME) \
 	 KIND_EXPERIMENTAL_PROVIDER=$(KIND_EXPERIMENTAL_PROVIDER) \
+	 FOURNOS_CONTROLLER_NAMESPACE=$(FOURNOS_CONTROLLER_NAMESPACE) \
 	 FOURNOS_NAMESPACE=$(or $(FOURNOS_NAMESPACE),fournos-local-dev) \
 	 FOURNOS_SECRETS_NAMESPACE=$(or $(FOURNOS_SECRETS_NAMESPACE),psap-secrets) \
 	 bash dev/setup.sh
 
 dev-run:
 	FOURNOS_GC_INTERVAL_SEC=5 \
+	FOURNOS_CONTROLLER_NAMESPACE=$(FOURNOS_CONTROLLER_NAMESPACE) \
 	FOURNOS_NAMESPACE=$(or $(FOURNOS_NAMESPACE),fournos-local-dev) \
 	FOURNOS_SECRETS_NAMESPACE=$(or $(FOURNOS_SECRETS_NAMESPACE),psap-secrets) \
 	FOURNOS_RESOLVE_JOB_TEMPLATE=dev/mock-resolve/resolve_job.yaml \
@@ -85,12 +95,14 @@ dev-teardown:
 ci-setup:
 	@KIND_CLUSTER_NAME=$(KIND_CLUSTER_NAME) \
 	 KIND_EXPERIMENTAL_PROVIDER=docker \
+	 FOURNOS_CONTROLLER_NAMESPACE=$(or $(FOURNOS_CONTROLLER_NAMESPACE),fournos-controller-ci-test) \
 	 FOURNOS_NAMESPACE=$(or $(FOURNOS_NAMESPACE),psap-automation-ci-test) \
 	 FOURNOS_SECRETS_NAMESPACE=$(or $(FOURNOS_SECRETS_NAMESPACE),psap-secrets) \
 	 bash dev/setup.sh
 
 ci-run:
 	FOURNOS_GC_INTERVAL_SEC=5 \
+	FOURNOS_CONTROLLER_NAMESPACE=$(or $(FOURNOS_CONTROLLER_NAMESPACE),fournos-controller-ci-test) \
 	FOURNOS_NAMESPACE=$(or $(FOURNOS_NAMESPACE),psap-automation-ci-test) \
 	FOURNOS_SECRETS_NAMESPACE=$(or $(FOURNOS_SECRETS_NAMESPACE),psap-secrets) \
 	FOURNOS_RESOLVE_JOB_TEMPLATE=dev/mock-resolve/resolve_job.yaml \

README.md

@@ -152,26 +152,15 @@ make test                        # integration tests (operator must be running)
 
 **Execution engine on the hub:** [`config/forge/`](config/forge/) is the real OpenShift configuration for this repo — ImageStreams, Builds, Tekton Tasks and Pipelines, and sample jobs you apply to a cluster. It is **not** the same as the lightweight stand-ins under [`dev/mock-pipelines/`](dev/mock-pipelines/), which [`make dev-setup`](#local-development) installs on kind for local testing only.
 
-Prepare the namespaces
-```bash
-FOURNOS_NAMESPACE=fournos-$USER-dev
-FOURNOS_SECRETS_NAMESPACE=psap-secrets
-oc create ns $FOURNOS_NAMESPACE
-oc label ns/$FOURNOS_NAMESPACE fournos.dev/queue-access=true
-oc create ns $FOURNOS_SECRETS_NAMESPACE
-```
-
-Deploy the operator:
+Deploy the full stack (namespaces, CRD, RBAC, Kueue config, workflows, Deployment).
+The operator runs in a dedicated controller namespace; execution resources
+(Tekton, Kueue, FournosJobs) live in the execution namespace:
 
 ```bash
-oc apply -n $FOURNOS_NAMESPACE -f manifests/crd.yaml
-for rbac_file in manifests/rbac/*.yaml; do
-  cat $rbac_file | NAMESPACE=$FOURNOS_NAMESPACE envsubst | oc apply -f- -n $FOURNOS_NAMESPACE
-done
-cat manifests/secrets-ns-rbac.yaml \
-  | NAMESPACE=$FOURNOS_NAMESPACE SECRETS_NAMESPACE=$FOURNOS_SECRETS_NAMESPACE envsubst \
-  | oc apply -f-
-oc apply -n $FOURNOS_NAMESPACE -f manifests/deployment.yaml
+make deploy \
+  FOURNOS_CONTROLLER_NAMESPACE=fournos-controller-$USER \
+  FOURNOS_NAMESPACE=fournos-$USER-dev \
+  FOURNOS_SECRETS_NAMESPACE=psap-secrets
 ```
 
 ### Onboarding a new cluster
@@ -220,14 +209,14 @@ details.
 
 ### Deploying the execution engine workflow configuration
 
-Apply the production execution engine assets from `config/forge/` (not the kind mocks in `dev/mock-pipelines/`). Deploy the cluster configuration (Builds + Tekton):
+Apply the production execution engine assets from `config/forge/` (not the kind mocks in `dev/mock-pipelines/`). Deploy the cluster configuration (Builds + Tekton) to the **execution namespace**:
 
 ```bash
 oc apply -n $FOURNOS_NAMESPACE -f config/forge/images/is_forge.yaml
 cat config/forge/images/build_forge-main.yaml \
-   | sed 's/psap-automation/'$FOURNOS_NAMESPACE'/g' \
-   | oc apply -n $FOURNOS_NAMESPACE
-oc create -n $FOURNOS_NAMESPACE  -f config/forge/images/buildrun_forge-main.yaml
+  | NAMESPACE=$FOURNOS_NAMESPACE envsubst '$NAMESPACE' \
+  | oc apply -f- -n $FOURNOS_NAMESPACE
+oc create -n $FOURNOS_NAMESPACE -f config/forge/images/buildrun_forge-main.yaml
 
 for wf_file in config/forge/workflows/*.yaml; do
   cat "$wf_file" | NAMESPACE=$FOURNOS_NAMESPACE envsubst '$NAMESPACE' | oc apply -f- -n $FOURNOS_NAMESPACE

dev/setup.sh

@@ -67,7 +67,14 @@ done
 # ---------------------
 
 : "${FOURNOS_NAMESPACE:?FOURNOS_NAMESPACE must be set}"
-kubectl create ns "$FOURNOS_NAMESPACE" --dry-run -oyaml | kubectl apply -f-
+# In local dev, controller and execution share the same namespace for simplicity
+CONTROLLER_NAMESPACE="${FOURNOS_CONTROLLER_NAMESPACE:-$FOURNOS_NAMESPACE}"
+export CONTROLLER_NAMESPACE
+
+kubectl create ns "$CONTROLLER_NAMESPACE" --dry-run -oyaml | kubectl apply -f-
+if [ "$CONTROLLER_NAMESPACE" != "$FOURNOS_NAMESPACE" ]; then
+  kubectl create ns "$FOURNOS_NAMESPACE" --dry-run -oyaml | kubectl apply -f-
+fi
 kubectl label ns/$FOURNOS_NAMESPACE fournos.dev/queue-access=true
 kubectl create ns "$SECRETS_NAMESPACE" --dry-run -oyaml | kubectl apply -f-
 
@@ -83,11 +90,15 @@ kubectl apply -f manifests/crd.yaml -n $FOURNOS_NAMESPACE
 # ---------------------------------------------------------------
 echo ""
 echo "Applying Fournos manifests..."
-for rbac_file in manifests/rbac/*.yaml; do
-  cat "$rbac_file" | NAMESPACE=$FOURNOS_NAMESPACE envsubst | kubectl apply -f- -n $FOURNOS_NAMESPACE
+kubectl apply -f manifests/rbac/sa_fournos.yaml -n "$CONTROLLER_NAMESPACE"
+kubectl apply -f manifests/rbac/sa_fournos.yaml -n "$FOURNOS_NAMESPACE"
+for rbac_file in manifests/rbac/role_fournos.yaml manifests/rbac/rolebinding_fournos.yaml; do
+  cat "$rbac_file" | CONTROLLER_NAMESPACE=$CONTROLLER_NAMESPACE envsubst '$CONTROLLER_NAMESPACE' | kubectl apply -f- -n $FOURNOS_NAMESPACE
 done
+cat manifests/rbac/clusterrole_fournos.yaml | kubectl apply -f-
+cat manifests/rbac/clusterrolebinding_fournos.yaml | CONTROLLER_NAMESPACE=$CONTROLLER_NAMESPACE envsubst '$CONTROLLER_NAMESPACE' | kubectl apply -f-
 cat manifests/secrets-ns-rbac.yaml \
-  | NAMESPACE=$FOURNOS_NAMESPACE SECRETS_NAMESPACE=$SECRETS_NAMESPACE envsubst \
+  | CONTROLLER_NAMESPACE=$CONTROLLER_NAMESPACE SECRETS_NAMESPACE=$SECRETS_NAMESPACE envsubst \
   | kubectl apply -f-
 
 # ---------------------------------------------------------------

hacks/generate-ocpci-kubeconfig.sh

@@ -6,7 +6,7 @@ set -o nounset
 set -o errtrace
 
 # Configuration
-NAMESPACE="psap-automation"
+NAMESPACE="fournos-controller"
 SERVICE_ACCOUNT="ocpci"
 SECRET_NAME="ocpci-token"
 CONTEXT=$(kubectl config current-context)

manifests/deployment.yaml

@@ -20,6 +20,8 @@ spec:
           image: quay.io/rh_perfscale/fournos:latest
           env:
             - name: FOURNOS_NAMESPACE
+              value: "${NAMESPACE}"
+            - name: FOURNOS_CONTROLLER_NAMESPACE
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace

manifests/ocpci-sa/rbac-wip-ns.yaml

@@ -22,7 +22,7 @@ metadata:
 subjects:
   - kind: ServiceAccount
     name: ocpci
-    namespace: psap-automation
+    namespace: fournos-controller
   - kind: ServiceAccount
     name: pipeline
     namespace: psap-automation-wip

manifests/ocpci-sa/rolebinding.yaml

@@ -6,7 +6,7 @@ metadata:
 subjects:
   - kind: ServiceAccount
     name: ocpci
-    namespace: psap-automation
+    namespace: fournos-controller
 roleRef:
   kind: Role
   name: ocpci-fournos-job-manager

manifests/ocpci-sa/sa.yaml

@@ -2,4 +2,4 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: ocpci
-  namespace: psap-automation
+  namespace: fournos-controller

manifests/ocpci-sa/secret.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: ocpci-token
-  namespace: psap-automation
+  namespace: fournos-controller
   annotations:
     kubernetes.io/service-account.name: ocpci
 type: kubernetes.io/service-account-token

manifests/rbac/clusterrolebinding_fournos.yaml

@@ -1,13 +1,13 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: fournos-cluster-${NAMESPACE}
+  name: fournos-cluster-${CONTROLLER_NAMESPACE}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: fournos-cluster
 subjects:
   - kind: ServiceAccount
     name: fournos
-    namespace: ${NAMESPACE}
+    namespace: ${CONTROLLER_NAMESPACE}
 

manifests/rbac/rolebinding_fournos.yaml

@@ -9,3 +9,6 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: fournos
+    namespace: ${CONTROLLER_NAMESPACE}
+  - kind: ServiceAccount
+    name: fournos

manifests/secrets-ns-rbac.yaml

@@ -1,17 +1,17 @@
 # RBAC for reading secrets from a dedicated secrets namespace.
 #
-# Apply once per operator namespace:
+# Apply once per operator deployment:
 #   cat manifests/secrets-ns-rbac.yaml \
-#     | NAMESPACE=<operator-ns> SECRETS_NAMESPACE=<secrets-ns> envsubst \
+#     | CONTROLLER_NAMESPACE=<controller-ns> SECRETS_NAMESPACE=<secrets-ns> envsubst \
 #     | kubectl apply -f-
 #
-# The resource names include ${NAMESPACE} so multiple operator instances
-# can coexist in the same secrets namespace without collisions.
+# The resource names include ${CONTROLLER_NAMESPACE} so multiple operator
+# instances can coexist in the same secrets namespace without collisions.
 
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: fournos-secrets-reader-${NAMESPACE}
+  name: fournos-secrets-reader-${CONTROLLER_NAMESPACE}
   namespace: ${SECRETS_NAMESPACE}
 rules:
   - apiGroups: [""]
@@ -22,13 +22,13 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: fournos-secrets-reader-${NAMESPACE}
+  name: fournos-secrets-reader-${CONTROLLER_NAMESPACE}
   namespace: ${SECRETS_NAMESPACE}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: fournos-secrets-reader-${NAMESPACE}
+  name: fournos-secrets-reader-${CONTROLLER_NAMESPACE}
 subjects:
   - kind: ServiceAccount
     name: fournos
-    namespace: ${NAMESPACE}
+    namespace: ${CONTROLLER_NAMESPACE}

tests/forge/deploy/orchestration/config.yaml

@@ -11,6 +11,9 @@ secrets:
       key: kubeconfig
 
 fournos_deploy:
+  controller_namespace:
+    name: fournos-controller-wip
+
   namespace:
     name: psap-automation-wip
     labels:
@@ -42,12 +45,18 @@ fournos_deploy:
     - WorkloadPriorityClass
     # BuildRun are triggered manually
     - BuildRun
+
+    # Manifests deployed to the controller namespace
+    controller_rbac:
+    - manifests/rbac/sa_fournos.yaml
+
+    # Manifests deployed to the execution namespace
     rbac:
     - manifests/rbac/clusterrolebinding_fournos.yaml # will be skipped
     - manifests/rbac/clusterrole_fournos.yaml # will be skipped
     - manifests/rbac/rolebinding_fournos.yaml
     - manifests/rbac/role_fournos.yaml
-    - manifests/rbac/sa_fournos.yaml
+
     crd:
     - manifests/crd.yaml # will be skipped
 
@@ -72,6 +81,7 @@ fournos_deploy:
 
     replace:
       NAMESPACE: "@fournos_deploy.namespace.name"
+      CONTROLLER_NAMESPACE: "@fournos_deploy.controller_namespace.name"
 
   # Deployment configuration
   deploy: