apply-all script: allow specifying additional flags (#685)

* apply-all script: allow specifying additional flags

* add label value for rbac-admin for non-cluster role resources

* revert label in test storage class

* revert label in test storage class 2

* add deploy=sourcegraph label to all pods

* rename label rbac-admin

* code review stephen

Author: uwedeportivo

.gitignore

@@ -7,3 +7,4 @@ generated/
 .pulumi
 Pulumi.*.yaml
 /pkg/gen/openapi-specs
+generated-cluster/

base/backend.Service.yaml

@@ -6,6 +6,7 @@ metadata:
       the same node if possible.
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
     group: backend
   name: backend
 spec:

base/frontend/sourcegraph-frontend-internal.Service.yaml

@@ -4,6 +4,7 @@ metadata:
   labels:
     app: sourcegraph-frontend
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: sourcegraph-frontend-internal
 spec:
   ports:

base/frontend/sourcegraph-frontend.Deployment.yaml

@@ -5,6 +5,7 @@ metadata:
     description: Serves the frontend of Sourcegraph via HTTP(S).
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: sourcegraph-frontend
 spec:
   minReadySeconds: 10
@@ -22,6 +23,7 @@ spec:
     metadata:
       labels:
         app: sourcegraph-frontend
+        deploy: sourcegraph
     spec:
       containers:
       - args:

base/frontend/sourcegraph-frontend.Ingress.yaml

@@ -11,6 +11,7 @@ metadata:
   labels:
     app: sourcegraph-frontend
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: sourcegraph-frontend
 spec:
   # See the customization guide (../../../docs/configure.md) for information

base/frontend/sourcegraph-frontend.Role.yaml

@@ -4,7 +4,7 @@ metadata:
   labels:
     category: rbac
     deploy: sourcegraph
-    rbac-admin: escalated
+    sourcegraph-resource-requires: cluster-admin
   name: sourcegraph-frontend
 rules:
 - apiGroups:

base/frontend/sourcegraph-frontend.RoleBinding.yaml

@@ -4,7 +4,7 @@ metadata:
   labels:
     category: rbac
     deploy: sourcegraph
-    rbac-admin: escalated
+    sourcegraph-resource-requires: cluster-admin
   name: sourcegraph-frontend
 roleRef:
   apiGroup: ""

base/frontend/sourcegraph-frontend.Service.yaml

@@ -7,6 +7,7 @@ metadata:
   labels:
     app: sourcegraph-frontend
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: sourcegraph-frontend
 spec:
   ports:

base/frontend/sourcegraph-frontend.ServiceAccount.yaml

@@ -6,4 +6,5 @@ metadata:
   labels:
     category: rbac
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: sourcegraph-frontend

base/github-proxy/github-proxy.Deployment.yaml

@@ -5,6 +5,7 @@ metadata:
     description: Rate-limiting proxy for the GitHub API.
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: github-proxy
 spec:
   minReadySeconds: 10
@@ -22,6 +23,7 @@ spec:
     metadata:
       labels:
         app: github-proxy
+        deploy: sourcegraph
     spec:
       containers:
       - env:

base/github-proxy/github-proxy.Service.yaml

@@ -7,6 +7,7 @@ metadata:
   labels:
     app: github-proxy
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: github-proxy
 spec:
   ports:

base/gitserver/gitserver.Service.yaml

@@ -8,6 +8,7 @@ metadata:
     sourcegraph.prometheus/scrape: "true"
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
     type: gitserver
     app: gitserver
   name: gitserver

base/gitserver/gitserver.StatefulSet.yaml

@@ -5,6 +5,7 @@ metadata:
     description: Stores clones of repositories to perform Git operations.
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: gitserver
 spec:
   replicas: 1
@@ -19,6 +20,7 @@ spec:
         app: gitserver
         group: backend
         type: gitserver
+        deploy: sourcegraph
     spec:
       containers:
       - args:

base/grafana/grafana.ConfigMap.yaml

@@ -14,4 +14,5 @@ kind: ConfigMap
 metadata:
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: grafana

base/grafana/grafana.Service.yaml

@@ -4,6 +4,7 @@ metadata:
   labels:
     app: grafana
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: grafana
 spec:
   ports:

base/grafana/grafana.ServiceAccount.yaml

@@ -6,4 +6,5 @@ metadata:
   labels:
     category: rbac
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: grafana

base/grafana/grafana.StatefulSet.yaml

@@ -5,6 +5,7 @@ metadata:
     description: Metrics/monitoring dashboards and alerts.
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: grafana
 spec:
   replicas: 1
@@ -19,6 +20,7 @@ spec:
     metadata:
       labels:
         app: grafana
+        deploy: sourcegraph
     spec:
       containers:
       - image: index.docker.io/sourcegraph/grafana:3.15.0@sha256:94ef3e7673d12e92487ca8966ab74b456f685edfc54fb163e1d49c7eaf064e70

base/indexed-search/indexed-search.Service.yaml

@@ -8,6 +8,7 @@ metadata:
   labels:
     app: indexed-search
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: indexed-search
 spec:
   clusterIP: None

base/indexed-search/indexed-search.StatefulSet.yaml

@@ -5,6 +5,7 @@ metadata:
     description: Backend for indexed text search operations.
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: indexed-search
 spec:
   replicas: 1
@@ -17,6 +18,7 @@ spec:
     metadata:
       labels:
         app: indexed-search
+        deploy: sourcegraph
     spec:
       containers:
       - env:

base/jaeger/jaeger-collector.Service.yaml

@@ -4,6 +4,7 @@ metadata:
   name: jaeger-collector
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
     app: jaeger
     app.kubernetes.io/name: jaeger
     app.kubernetes.io/component: collector

base/jaeger/jaeger-query.Service.yaml

@@ -4,6 +4,7 @@ metadata:
   name: jaeger-query
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
     app: jaeger
     app.kubernetes.io/name: jaeger
     app.kubernetes.io/component: query

base/jaeger/jaeger.Deployment.yaml

@@ -4,6 +4,7 @@ metadata:
   name: jaeger
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
     app: jaeger
     app.kubernetes.io/name: jaeger
     app.kubernetes.io/component: all-in-one
@@ -20,6 +21,7 @@ spec:
     metadata:
       labels:
         app: jaeger
+        deploy: sourcegraph
         app.kubernetes.io/name: jaeger
         app.kubernetes.io/component: all-in-one
       annotations:

base/pgsql/pgsql.ConfigMap.yaml

@@ -5,6 +5,7 @@ metadata:
     description: Configuration for PostgreSQL
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: pgsql-conf
 data:
   postgresql.conf: |

base/pgsql/pgsql.Deployment.yaml

@@ -5,6 +5,7 @@ metadata:
     description: Postgres database for various data.
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: pgsql
 spec:
   minReadySeconds: 10
@@ -18,6 +19,7 @@ spec:
   template:
     metadata:
       labels:
+        deploy: sourcegraph
         app: pgsql
         group: backend
     spec:

base/pgsql/pgsql.PersistentVolumeClaim.yaml

@@ -3,6 +3,7 @@ kind: PersistentVolumeClaim
 metadata:
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: pgsql
 spec:
   accessModes:

base/pgsql/pgsql.Service.yaml

@@ -7,6 +7,7 @@ metadata:
   labels:
     app: pgsql
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: pgsql
 spec:
   ports:

base/precise-code-intel/api-server.Deployment.yaml

@@ -5,6 +5,7 @@ metadata:
     description: Serves precise code intelligence requests.
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: precise-code-intel-api-server
 spec:
   minReadySeconds: 10
@@ -21,6 +22,7 @@ spec:
   template:
     metadata:
       labels:
+        deploy: sourcegraph
         app: precise-code-intel-api-server
     spec:
       containers:

base/precise-code-intel/api-server.Service.yaml

@@ -7,6 +7,7 @@ metadata:
   labels:
     app: precise-code-intel-api-server
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: precise-code-intel-api-server
 spec:
   ports:

base/precise-code-intel/bundle-manager.Deployment.yaml

@@ -5,6 +5,7 @@ metadata:
     description: Stores and manages precise code intelligence bundles.
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: precise-code-intel-bundle-manager
 spec:
   minReadySeconds: 10
@@ -18,6 +19,7 @@ spec:
   template:
     metadata:
       labels:
+        deploy: sourcegraph
         app: precise-code-intel-bundle-manager
     spec:
       containers:

base/precise-code-intel/bundle-manager.PersistentVolumeClaim.yaml

@@ -3,6 +3,7 @@ kind: PersistentVolumeClaim
 metadata:
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: bundle-manager
 spec:
   accessModes:

base/precise-code-intel/bundle-manager.Service.yaml

@@ -7,6 +7,7 @@ metadata:
   labels:
     app: precise-code-intel-bundle-manager
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: precise-code-intel-bundle-manager
 spec:
   ports:

base/precise-code-intel/worker.Deployment.yaml

@@ -5,6 +5,7 @@ metadata:
     description: Handles conversion of uploaded precise code intelligence bundles.
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: precise-code-intel-worker
 spec:
   minReadySeconds: 10
@@ -21,6 +22,7 @@ spec:
   template:
     metadata:
       labels:
+        deploy: sourcegraph
         app: precise-code-intel-worker
     spec:
       containers:

base/precise-code-intel/worker.Service.yaml

@@ -7,6 +7,7 @@ metadata:
   labels:
     app: precise-code-intel-worker
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: precise-code-intel-worker
 spec:
   ports:

base/prometheus/prometheus.ClusterRole.yaml

@@ -4,7 +4,7 @@ metadata:
   labels:
     category: rbac
     deploy: sourcegraph
-    rbac-admin: escalated
+    sourcegraph-resource-requires: cluster-admin
   name: prometheus
 rules:
 - apiGroups:

base/prometheus/prometheus.ClusterRoleBinding.yaml

@@ -4,7 +4,7 @@ metadata:
   labels:
     category: rbac
     deploy: sourcegraph
-    rbac-admin: escalated
+    sourcegraph-resource-requires: cluster-admin
   name: prometheus
 roleRef:
   apiGroup: ""

base/prometheus/prometheus.ConfigMap.yaml

@@ -344,4 +344,5 @@ kind: ConfigMap
 metadata:
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: prometheus

base/prometheus/prometheus.Deployment.yaml

@@ -5,6 +5,7 @@ metadata:
     description: Collects metrics and aggregates them into graphs.
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: prometheus
 spec:
   minReadySeconds: 10
@@ -18,6 +19,7 @@ spec:
   template:
     metadata:
       labels:
+        deploy: sourcegraph
         app: prometheus
     spec:
       containers:

base/prometheus/prometheus.PersistentVolumeClaim.yaml

@@ -3,6 +3,7 @@ kind: PersistentVolumeClaim
 metadata:
   labels:
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: prometheus
 spec:
   accessModes:

base/prometheus/prometheus.Service.yaml

@@ -4,6 +4,7 @@ metadata:
   labels:
     app: prometheus
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: prometheus
 spec:
   ports:

base/prometheus/prometheus.ServiceAccount.yaml

@@ -6,4 +6,5 @@ metadata:
   labels:
     category: rbac
     deploy: sourcegraph
+    sourcegraph-resource-requires: no-cluster-admin
   name: prometheus