Add upgrade controller to Kustomize install

Issue: [sc-14201]

kustomize/install/crd/kustomization.yaml

@@ -1,2 +1,3 @@
 resources:
 - bases/postgres-operator.crunchydata.com_postgresclusters.yaml
+- bases/postgres-operator.crunchydata.com_pgupgrades.yaml

kustomize/install/default/kustomization.yaml

@@ -1,7 +1,6 @@
 namespace: postgres-operator
 
 commonLabels:
-  postgres-operator.crunchydata.com/control-plane: postgres-operator
   app.kubernetes.io/name: pgo
   app.kubernetes.io/version: 5.1.0
 
@@ -14,11 +13,12 @@ images:
 - name: postgres-operator
   newName: registry.developers.crunchydata.com/crunchydata/postgres-operator
   newTag: ubi8-5.1.0-0
+- name: postgres-operator-upgrade
+  newName: registry.developers.crunchydata.com/crunchydata/postgres-operator-upgrade
+  newTag: ubi8-5.1.0-0
 
 patchesJson6902:
-- target:
-    group: apps
-    version: v1
-    kind: Deployment
-    name: pgo
-  path: manager-selector.yaml
+- target: { group: apps, version: v1, kind: Deployment, name: pgo }
+  path: selectors.yaml
+- target: { group: apps, version: v1, kind: Deployment, name: pgo-upgrade }
+  path: selectors.yaml

kustomize/install/default/selectors.yaml

@@ -0,0 +1,8 @@
+# We add the app version as a "commonLabel" and change it with each release.
+# Remove it from selectors until we use "labels" of Kustomize v4.1.
+# See: https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/commonlabels/
+# See: https://github.com/kubernetes-sigs/kustomize/releases/tag/kustomize%2Fv4.1.0
+- op: remove
+  path: /spec/selector/matchLabels/app.kubernetes.io~1name
+- op: remove
+  path: /spec/selector/matchLabels/app.kubernetes.io~1version

kustomize/install/manager/kustomization.yaml

@@ -1,2 +1,3 @@
 resources:
 - manager.yaml
+- manager-upgrade.yaml

kustomize/install/manager/manager-upgrade.yaml

@@ -0,0 +1,35 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pgo-upgrade
+  labels:
+    postgres-operator.crunchydata.com/control-plane: postgres-operator-upgrade
+spec:
+  replicas: 1
+  strategy: { type: Recreate }
+  selector:
+    matchLabels:
+      postgres-operator.crunchydata.com/control-plane: postgres-operator-upgrade
+  template:
+    metadata:
+      labels:
+        postgres-operator.crunchydata.com/control-plane: postgres-operator-upgrade
+    spec:
+      containers:
+      - name: operator
+        image: postgres-operator-upgrade
+        env:
+        - name: PGO_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: CRUNCHY_DEBUG
+          value: "true"
+        - name: RELATED_IMAGE_PGUPGRADE
+          value: "registry.developers.crunchydata.com/crunchydata/crunchy-upgrade:ubi8-5.1.0-0"
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+      serviceAccountName: postgres-operator-upgrade

kustomize/install/manager/manager.yaml

@@ -3,10 +3,18 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pgo
+  labels:
+    postgres-operator.crunchydata.com/control-plane: postgres-operator
 spec:
   replicas: 1
   strategy: { type: Recreate }
+  selector:
+    matchLabels:
+      postgres-operator.crunchydata.com/control-plane: postgres-operator
   template:
+    metadata:
+      labels:
+        postgres-operator.crunchydata.com/control-plane: postgres-operator
     spec:
       containers:
       - name: operator

kustomize/install/rbac/cluster/kustomization.yaml

@@ -2,3 +2,6 @@ resources:
 - service_account.yaml
 - role.yaml
 - role_binding.yaml
+- service_account-upgrade.yaml
+- role-upgrade.yaml
+- role_binding-upgrade.yaml

kustomize/install/rbac/cluster/role-upgrade.yaml

@@ -0,0 +1,71 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  name: postgres-operator-upgrade
+  labels:
+    postgres-operator.crunchydata.com/control-plane: postgres-operator-upgrade
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - endpoints
+  verbs:
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - statefulsets
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - batch
+  resources:
+  - jobs
+  verbs:
+  - create
+  - delete
+  - list
+  - patch
+  - watch
+- apiGroups:
+  - postgres-operator.crunchydata.com
+  resources:
+  - pgupgrades
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - postgres-operator.crunchydata.com
+  resources:
+  - pgupgrades/finalizers
+  verbs:
+  - patch
+  - update
+- apiGroups:
+  - postgres-operator.crunchydata.com
+  resources:
+  - pgupgrades/status
+  verbs:
+  - get
+  - patch
+- apiGroups:
+  - postgres-operator.crunchydata.com
+  resources:
+  - postgresclusters
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - postgres-operator.crunchydata.com
+  resources:
+  - postgresclusters/status
+  verbs:
+  - patch

kustomize/install/rbac/cluster/role.yaml

@@ -3,6 +3,8 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: postgres-operator
+  labels:
+    postgres-operator.crunchydata.com/control-plane: postgres-operator
 rules:
 - apiGroups:
   - ''

kustomize/install/rbac/cluster/role_binding-upgrade.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: postgres-operator-upgrade
+  labels:
+    postgres-operator.crunchydata.com/control-plane: postgres-operator-upgrade
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: postgres-operator-upgrade
+subjects:
+- kind: ServiceAccount
+  name: postgres-operator-upgrade

kustomize/install/rbac/cluster/role_binding.yaml

@@ -3,6 +3,8 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: postgres-operator
+  labels:
+    postgres-operator.crunchydata.com/control-plane: postgres-operator
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole

kustomize/install/rbac/cluster/service_account-upgrade.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: postgres-operator-upgrade
+  labels:
+    postgres-operator.crunchydata.com/control-plane: postgres-operator-upgrade

kustomize/install/rbac/cluster/service_account.yaml

@@ -3,3 +3,5 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: pgo
+  labels:
+    postgres-operator.crunchydata.com/control-plane: postgres-operator

kustomize/install/rbac/namespace/kustomization.yaml

@@ -2,3 +2,6 @@ resources:
 - service_account.yaml
 - role.yaml
 - role_binding.yaml
+- service_account-upgrade.yaml
+- role-upgrade.yaml
+- role_binding-upgrade.yaml

kustomize/install/rbac/namespace/role-upgrade.yaml

@@ -0,0 +1,71 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  creationTimestamp: null
+  name: postgres-operator-upgrade
+  labels:
+    postgres-operator.crunchydata.com/control-plane: postgres-operator-upgrade
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - endpoints
+  verbs:
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - statefulsets
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - batch
+  resources:
+  - jobs
+  verbs:
+  - create
+  - delete
+  - list
+  - patch
+  - watch
+- apiGroups:
+  - postgres-operator.crunchydata.com
+  resources:
+  - pgupgrades
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - postgres-operator.crunchydata.com
+  resources:
+  - pgupgrades/finalizers
+  verbs:
+  - patch
+  - update
+- apiGroups:
+  - postgres-operator.crunchydata.com
+  resources:
+  - pgupgrades/status
+  verbs:
+  - get
+  - patch
+- apiGroups:
+  - postgres-operator.crunchydata.com
+  resources:
+  - postgresclusters
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - postgres-operator.crunchydata.com
+  resources:
+  - postgresclusters/status
+  verbs:
+  - patch

kustomize/install/rbac/namespace/role.yaml

@@ -3,6 +3,8 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: postgres-operator
+  labels:
+    postgres-operator.crunchydata.com/control-plane: postgres-operator
 rules:
 - apiGroups:
   - ''

kustomize/install/rbac/namespace/role_binding-upgrade.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: postgres-operator-upgrade
+  labels:
+    postgres-operator.crunchydata.com/control-plane: postgres-operator-upgrade
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: postgres-operator-upgrade
+subjects:
+- kind: ServiceAccount
+  name: postgres-operator-upgrade

kustomize/install/rbac/namespace/role_binding.yaml

@@ -3,6 +3,8 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: postgres-operator
+  labels:
+    postgres-operator.crunchydata.com/control-plane: postgres-operator
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role

kustomize/install/rbac/namespace/service_account-upgrade.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: postgres-operator-upgrade
+  labels:
+    postgres-operator.crunchydata.com/control-plane: postgres-operator-upgrade

kustomize/install/rbac/namespace/service_account.yaml

@@ -3,3 +3,5 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: pgo
+  labels:
+    postgres-operator.crunchydata.com/control-plane: postgres-operator

kustomize/install/singlenamespace/kustomization.yaml

@@ -1,7 +1,6 @@
 namespace: postgres-operator
 
 commonLabels:
-  postgres-operator.crunchydata.com/control-plane: postgres-operator
   app.kubernetes.io/name: pgo
   app.kubernetes.io/version: 5.1.0
 
@@ -10,18 +9,20 @@ bases:
 - ../rbac/namespace
 - ../manager
 
-patches:
-- manager-target.yaml
-
 images:
 - name: postgres-operator
   newName: registry.developers.crunchydata.com/crunchydata/postgres-operator
   newTag: ubi8-5.1.0-0
+- name: postgres-operator-upgrade
+  newName: registry.developers.crunchydata.com/crunchydata/postgres-operator-upgrade
+  newTag: ubi8-5.1.0-0
 
 patchesJson6902:
-- target:
-    group: apps
-    version: v1
-    kind: Deployment
-    name: pgo
-  path: manager-selector.yaml
+- target: { group: apps, version: v1, kind: Deployment, name: pgo }
+  path: selectors.yaml
+- target: { group: apps, version: v1, kind: Deployment, name: pgo-upgrade }
+  path: selectors.yaml
+
+patchesStrategicMerge:
+- manager-target.yaml
+- manager-target-upgrade.yaml