apiVersion: operators.coreos.com/v1alpha1
kind: ClusterServiceVersion
metadata:
  annotations:
    alm-examples: "[\n  {\n    \"apiVersion\": \"operator.autoscaling.openshift.io/v1\",\n    \"kind\": \"ClusterResourceOverride\",\n    \"metadata\": {\n      \"name\": \"cluster\"\n    },\n    \"spec\": {\n      \"podResourceOverride\": {\n        \"spec\": {\n          \"memoryRequestToLimitPercent\": 50,\n          \"cpuRequestToLimitPercent\": 25,\n          \"limitCPUToMemoryPercent\": 200\n        }\n      }\n    }\n  }\n]"
    capabilities: Seamless Upgrades
    categories: OpenShift Optional
    certifiedLevel: Primed
    olm.skipRange: ">=4.3.0 <4.6.0-202106100606"
    containerImage: image-registry.openshift-image-registry.svc:5000/openshift/ose-clusterresourceoverride-rhel8-operator:v4.6.0.20210610.062532
    createdAt: 2019/11/15
    description: An operator to manage the OpenShift ClusterResourceOverride Mutating Admission Webhook Server
    healthIndex: B
    repository: https://github.com/openshift/cluster-resource-override-operator
    support: Red Hat
  name: clusterresourceoverride-operator.4.6.0-202106100606
  namespace: clusterresourceoverride-operator
spec:
  customresourcedefinitions:
    owned:
      - description: Represents an instance of ClusterResourceOverride Admission Webhook
        displayName: ClusterResourceOverride
        kind: ClusterResourceOverride
        name: clusterresourceoverrides.operator.autoscaling.openshift.io
        version: v1
  description: "ClusterResourceOverride\n==============\n\nContainers can specify compute resource requests and\
     \ limits. Requests are used for scheduling your container and provide a minimum service guarantee. Limits constrain\
     \ the amount of compute resource that may be consumed on your node.\n\nThe scheduler attempts to optimize the compute\
     \ resource use across all nodes in your cluster. It places pods onto specific nodes, taking the pods' compute\
     \ resource requests and nodes' available capacity into consideration.\n\nRequests and limits enable administrators\
     \ to allow and manage the overcommitment of resources on a node, which may be desirable in development environments\
     \ where a trade off of guaranteed performance for capacity is acceptable.\n\n### Requests and Limits\n\nFor each compute\
     \ resource, a container may specify a resource request and limit. Scheduling decisions are made based on the request\
     \ to ensure that a node has enough capacity available to meet the requested value. If a container specifies limits,\
     \ but omits requests, the requests are defaulted to the limits. A container is not able to exceed the specified\
     \ limit on the node.\n\nThe enforcement of limits is dependent upon the compute resource type. If a container makes\
     \ no request or limit, the container is scheduled to a node with no resource guarantees. In practice, the container\
     \ is able to consume as much of the specified resource as is available with the lowest local priority. In low resource\
     \ situations, containers that specify no resource requests are given the lowest quality of\
     \ service.\n\n### Compute Resources\n\nThe node-enforced behavior for compute resources is specific\
     \ to the resource type.\n\n#### CPU\n\nA container is guaranteed the amount of CPU it requests and is additionally\
     \ able to consume excess CPU available on the node, up to any limit specified by the container.\
     \ If multiple containers are attempting to use excess CPU, CPU time is distributed based on the amount\
     \ of CPU requested by each container.\n\nFor example, if one container requested 500m of CPU time and another container\
     \ requested 250m of CPU time, then any extra CPU time available on the node is distributed among the containers\
     \ in a 2:1 ratio. If a container specified a limit, it will be throttled not to use more CPU than the\
     \ specified limit.\n\nCPU requests are enforced using the CFS shares support in the Linux kernel.\
     \ By default, CPU limits are enforced using the CFS quota support in the Linux kernel over a\
     \ 100ms measuring interval, though this can be disabled.\n\n#### Memory\n\nA container is guaranteed\
     \ the amount of memory it requests. A container may use more memory than requested, but once it exceeds\
     \ its requested amount, it could be killed in a low memory situation on the node.\n\nIf a container uses less memory\
     \ than requested, it will not be killed unless system tasks or daemons need more memory than was accounted\
     \ for in the node’s resource reservation. If a container specifies a limit on memory,\
     \ it is immediately killed if it exceeds the limit amount.\n\n### Configuring the Cluster for Overcommitment\n\nScheduling\
     \ is based on resources requested, while quota and hard limits refer to resource limits, which can be set higher than requested\
     \ resources. The difference between request and limit determines the level of overcommit; for instance,\
     \ if a container is given a memory request of 1Gi and a memory limit of 2Gi, it is scheduled based on\
     \ the 1Gi request being available on the node, but could use up to 2Gi; so it is 200% overcommitted.\
     \ If OpenShift Container Platform administrators would like to control the level of overcommit and manage\
     \ container density on nodes, ClusterResourceOverride Admission Webhook can be configured to override\
     \ the ratio between request and limit set on developer containers. In conjunction with a per-project LimitRange\
     \ specifying limits and defaults, this adjusts the container limit and request to achieve the desired level\
     \ of overcommit.\n\nThis requires creating a custom resource of `ClusterResourceOverride` type as in the following\
     \ example:\n\n    \n    - apiVersion: operator.autoscaling.openshift.io/v1\n    - kind: ClusterResourceOverride\n    - metadata:\n    -   name: cluster\n    - spec:\n    -   podResourceOverride:\n    -     spec:\n    -       memoryRequestToLimitPercent: 25\n    -       cpuRequestToLimitPercent: 25\n    -       limitCPUToMemoryPercent: 200\n    \n\
     \ **memoryRequestToLimitPercent**: (optional, 1-100) If a container memory limit has been specified or defaulted,\
     \ the memory request is overridden to this percentage of the limit.\n\n\
     \ **cpuRequestToLimitPercent**: (optional, 1-100) If a container CPU limit has been specified or defaulted,\
     \ the CPU request is overridden to this percentage of the limit.\n\n\
     \ **limitCPUToMemoryPercent**: (optional, positive integer) If a container memory limit has been specified or defaulted,\
     \ the CPU limit is overridden to a percentage of the memory limit, with a 100 percentage scaling 1Gi of RAM to equal 1 CPU\
     \ core. This is processed prior to overriding CPU request (if configured).\n\n\
     \ Note that these overrides have no effect if no limits have been set on containers. [Create a LimitRange object]\
     \ (https://docs.openshift.com/container-platform/3.3/admin_guide/limits.html#admin-guide-limits) with default limits\
     \ (per individual project, or in the [project template](https://docs.openshift.com/container-platform/3.3/admin_guide/managing_projects.html#modifying-the-template-for-new-projects))\
     \ in order to ensure that the overrides apply.\n\nWhen configured, overrides can be enabled per-project by applying the following\
     \ label.\n    ```\n    clusterresourceoverrides.admission.autoscaling.openshift.io/enabled: \"true\"\n    ```\n\n"
  displayName: ClusterResourceOverride Operator
  install:
    strategy: deployment
    spec:
      permissions:
      - rules:
        # to have the power to ensure RBAC for the operand
        - apiGroups:
            - rbac.authorization.k8s.io
          resources:
            - roles
            - rolebindings
          verbs:
            - create
            - update
            - patch
            - get

        # to have the power to watch secondary resources
        - apiGroups:
            - ''
          resources:
            - configmaps
            - secrets
            - services
            - serviceaccounts
            - pods
          verbs:
            - get
            - create
            - update
            - patch
            - list
            - watch

        # to have the power to watch secondary resources
        - apiGroups:
            - apps
          resources:
            - daemonsets
            - deployments
          verbs:
            - create
            - get
            - update
            - patch
            - list
            - watch
        serviceAccountName: clusterresourceoverride-operator
      clusterPermissions:
      - rules:
        # to have the power to create 'RoleBinding' that refs extension-apiserver-authentication-reader
        # in kube-system namespace.
        # to give the operand power to read the config for terminating authentication.
        - apiGroups:
            - rbac.authorization.k8s.io
          resources:
            - rolebindings
          verbs:
            - create
            - update
            - patch
            - get

        # to have the power to read configmaps in the kube-system namespace
        - apiGroups:
            - ''
          resources:
            - configmaps
          verbs:
            - get
            - list
            - watch

        # to have the power to ensure RBAC for the operand
        - apiGroups:
            - rbac.authorization.k8s.io
          resources:
            - clusterroles
            - clusterrolebindings
          verbs:
            - create
            - update
            - patch
            - get

        # to have the power to reconcile request(s)
        - apiGroups:
            - operator.autoscaling.openshift.io
          resources:
            - clusterresourceoverrides
            - clusterresourceoverrides/status
            - clusterresourceoverrides/finalizers
          verbs:
            - update
            - get
            - list
            - watch

        # to have the power to manage configuration for admission webhook
        - apiGroups:
            - admissionregistration.k8s.io
          resources:
            - mutatingwebhookconfigurations
          verbs:
            - create
            - update
            - patch
            - delete
            - list
            - watch

        # to have the power to manage APIService object(s)
        - apiGroups:
            - apiregistration.k8s.io
          resources:
            - apiservices
          verbs:
            - create
            - update
            - patch
            - get
            - list
            - watch

        # to grant the operand power to create admission reviews
        - apiGroups:
            - autoscaling.openshift.io
          resources:
            - clusterresourceoverride
          verbs:
            - create

        # default for an aggregated apiserver
        - apiGroups:
            - admissionregistration.k8s.io
          resources:
            - validatingwebhookconfigurations
            - mutatingwebhookconfigurations
          verbs:
            - get
            - list
            - watch

        # to grant power to the operand to watch Namespace(s) and LimitRange(s)
        - apiGroups:
            - ""
          resources:
            - namespaces
            - limitranges
          verbs:
            - get
            - list
            - watch

        # to grant power to the operand to delegate authentication and authorization
        - apiGroups:
            - authentication.k8s.io
          resources:
            - tokenreviews
          verbs:
            - create
        - apiGroups:
            - authorization.k8s.io
          resources:
            - subjectaccessreviews
          verbs:
            - create

        # to grant power to the operand to use hostnetwork scc
        - apiGroups:
            - security.openshift.io
          resources:
            - securitycontextconstraints
          verbs:
            - use
          resourceNames:
            - hostnetwork

        # to grant power to the operand to allow anonymous access to the admission server
        - apiGroups:
            - admission.autoscaling.openshift.io
          resources:
            - clusterresourceoverrides
          verbs:
            - create
            - get
        serviceAccountName: clusterresourceoverride-operator
      deployments:
        - name: clusterresourceoverride-operator
          spec:
            replicas: 1
            selector:
              matchLabels:
                clusterresourceoverride.operator: "true"
            template:
              metadata:
                name: clusterresourceoverride
                labels:
                  clusterresourceoverride.operator: "true"
              spec:
                serviceAccountName: clusterresourceoverride-operator
                containers:
                  - name: clusterresourceoverride-operator
                    image: image-registry.openshift-image-registry.svc:5000/openshift/ose-clusterresourceoverride-rhel8-operator:v4.6.0.20210610.062532
                    imagePullPolicy: Always
                    command:
                      - /usr/bin/cluster-resource-override-admission-operator
                    args:
                      - "start"
                      - "--namespace=$(OPERAND_NAMESPACE)"
                      - "--v=2"
                    env:
                      - name: OPERATOR_POD_NAMESPACE
                        valueFrom:
                          fieldRef:
                            fieldPath: metadata.namespace
                      - name: OPERAND_NAMESPACE
                        valueFrom:
                          fieldRef:
                            fieldPath: metadata.namespace
                      - name: OPERAND_IMAGE
                        value: image-registry.openshift-image-registry.svc:5000/openshift/ose-clusterresourceoverride-rhel8:v4.6.0-202106021513.p0.git.fabfa8b
                      - name: OPERAND_VERSION
                        value: 1.0.0
                    ports:
                      - containerPort: 8080
                    readinessProbe:
                      httpGet:
                        path: /healthz
                        port: 8080
                    livenessProbe:
                      httpGet:
                        path: /healthz
                        port: 8080
                      initialDelaySeconds: 5
  installModes:
    - supported: true
      type: OwnNamespace
    - supported: true
      type: SingleNamespace
    - supported: false
      type: MultiNamespace
    - supported: false
      type: AllNamespaces
  keywords:
    - deschedule
    - scale
    - binpack
    - efficiency
  labels:
    olm-owner-enterprise-app: clusterresourceoverride-operator
    olm-status-descriptors: clusterresourceoverride-operator.4.6.0-202106100606
  maintainers:
    - email: support@redhat.com
      name: Red Hat
  provider:
    name: Red Hat
  version: 4.6.0-202106100606
