Add expected postgres version and usage docs (#1103 )

Enable configuration of route and ingress api versions (#1098 )
* Introduce ingress_api_version and route_api_version
2026-03-27 13:53:12 +00:00 · 2022-10-28 15:54:14 -04:00 · 2022-10-26 08:51:15 -04:00 · 2022-10-25 16:50:34 -04:00 · 2022-10-25 16:10:33 -04:00 · 2022-10-24 14:37:27 -04:00
103 changed files with 2126 additions and 1194 deletions
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -82,3 +82,18 @@ jobs:
      - name: Install helm chart
        run: |
          helm install --wait my-awx-operator --namespace awx --create-namespace ./charts/awx-operator
+  no-log:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v2
+
+      - name: Check no_log statements
+        run: |
+          set +e
+          no_log=$(grep -nr ' no_log:' roles | grep -v '"{{ no_log }}"')
+          if [ -n "${no_log}" ]; then
+            echo 'Please update the following no_log statement(s) with the "{{ no_log }}" value'
+            echo "${no_log}"
+            exit 1
+          fi
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,4 @@
 /charts
 /.cr-release-packages
 .vscode/
+__pycache__
--- a/.helm/starter/README.md
+++ b/.helm/starter/README.md
@@ -5,7 +5,7 @@ This chart installs the AWX Operator resources configured in [this](https://gith
 ## Getting Started
 To configure your AWX resource using this chart, create your own `yaml` values file. The name is up to personal preference since it will explicitly be passed into the helm chart. Helm will merge whatever values you specify in your file with the default `values.yaml`, overriding any settings you've changed while allowing you to fall back on defaults. Because of this functionality, `values.yaml` should not be edited directly.

-In your values config, enable `AWX.enable` and add `AWX.spec` values based on the awx operator's [documentation](https://github.com/ansible/awx-operator/blob/devel/README.md). Consult the docs below for additional functionality.
+In your values config, enable `AWX.enabled` and add `AWX.spec` values based on the awx operator's [documentation](https://github.com/ansible/awx-operator/blob/devel/README.md). Consult the docs below for additional functionality.

 ### Installing
 The operator's [helm install](https://github.com/ansible/awx-operator/blob/devel/README.md#helm-install-on-existing-cluster) guide provides key installation instructions. 
--- a/.yamllint
+++ b/.yamllint
@@ -12,3 +12,8 @@ rules:
  truthy: disable
  line-length:
    max: 170
+  document-start: disable
+  comments-indentation: disable
+  indentation:
+    level: warning
+    indent-sequences: consistent
--- a/13
+++ b/13
@@ -1,4 +1,10 @@
-FROM quay.io/operator-framework/ansible-operator:v1.12.0
+FROM quay.io/operator-framework/ansible-operator:v1.23.0
+
+USER 0
+
+RUN dnf install -y openssl
+
+USER 1001

 ARG DEFAULT_AWX_VERSION
 ARG OPERATOR_VERSION
@@ -12,3 +18,8 @@ RUN ansible-galaxy collection install -r ${HOME}/requirements.yml \
 COPY watches.yaml ${HOME}/watches.yaml
 COPY roles/ ${HOME}/roles/
 COPY playbooks/ ${HOME}/playbooks/
+
+ENTRYPOINT ["/tini", "--", "/usr/local/bin/ansible-operator", "run", \
+    "--watches-file=./watches.yaml", \
+    "--reconcile-period=0s" \
+    ]
--- a/102
+++ b/102
@@ -44,6 +44,17 @@ IMAGE_TAG_BASE ?= quay.io/ansible/awx-operator
 # You can use it as an arg. (E.g make bundle-build BUNDLE_IMG=<some-registry>/<project-name-bundle>:<tag>)
 BUNDLE_IMG ?= $(IMAGE_TAG_BASE)-bundle:v$(VERSION)

+# BUNDLE_GEN_FLAGS are the flags passed to the operator-sdk generate bundle command
+BUNDLE_GEN_FLAGS ?= -q --overwrite --version $(VERSION) $(BUNDLE_METADATA_OPTS)
+
+# USE_IMAGE_DIGESTS defines if images are resolved via tags or digests
+# You can enable this value if you would like to use SHA Based Digests
+# To enable set flag to true
+USE_IMAGE_DIGESTS ?= false
+ifeq ($(USE_IMAGE_DIGESTS), true)
+       BUNDLE_GEN_FLAGS += --use-image-digests
+endif
+
 # Image URL to use all building/pushing image targets
 IMG ?= $(IMAGE_TAG_BASE):$(VERSION)
 NAMESPACE ?= awx
@@ -56,6 +67,7 @@ CHART_REPO ?= awx-operator
 CHART_BRANCH ?= gh-pages
 CHART_INDEX ?= index.yaml

+.PHONY: all
 all: docker-build

 ##@ General
@@ -71,38 +83,47 @@ all: docker-build
 # More info on the awk command:
 # http://linuxcommand.org/lc3_adv_awk.php

+.PHONY: help
 help: ## Display this help.
 	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)

 ##@ Build

+.PHONY: run
 run: ansible-operator ## Run against the configured Kubernetes cluster in ~/.kube/config
 	ANSIBLE_ROLES_PATH="$(ANSIBLE_ROLES_PATH):$(shell pwd)/roles" $(ANSIBLE_OPERATOR) run

+.PHONY: docker-build
 docker-build: ## Build docker image with the manager.
 	${CONTAINER_CMD} build $(BUILD_ARGS) -t ${IMG} .

+.PHONY: docker-push
 docker-push: ## Push docker image with the manager.
 	${CONTAINER_CMD} push ${IMG}

 ##@ Deployment

+.PHONY: install
 install: kustomize ## Install CRDs into the K8s cluster specified in ~/.kube/config.
 	$(KUSTOMIZE) build config/crd | kubectl apply -f -

+.PHONY: uninstall
 uninstall: kustomize ## Uninstall CRDs from the K8s cluster specified in ~/.kube/config.
 	$(KUSTOMIZE) build config/crd | kubectl delete -f -

+.PHONY: gen-resources
 gen-resources: kustomize ## Generate resources for controller and print to stdout
 	@cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
 	@cd config/default && $(KUSTOMIZE) edit set namespace ${NAMESPACE}
 	@$(KUSTOMIZE) build config/default

+.PHONY: deploy
 deploy: kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
 	@cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
 	@cd config/default && $(KUSTOMIZE) edit set namespace ${NAMESPACE}
 	@$(KUSTOMIZE) build config/default | kubectl apply -f -

+.PHONY: undeploy
 undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config.
 	@cd config/default && $(KUSTOMIZE) edit set namespace ${NAMESPACE}
 	$(KUSTOMIZE) build config/default | kubectl delete -f -
@@ -119,7 +140,7 @@ ifeq (,$(shell which kustomize 2>/dev/null))
 	@{ \
 	set -e ;\
 	mkdir -p $(dir $(KUSTOMIZE)) ;\
-	curl -sSLo - https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v4.5.2/kustomize_v4.5.2_$(OS)_$(ARCHA).tar.gz | \
+	curl -sSLo - https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v4.5.5/kustomize_v4.5.5_$(OS)_$(ARCHA).tar.gz | \
 	tar xzf - -C bin/ ;\
 	}
 else
@@ -135,7 +156,7 @@ ifeq (,$(shell which ansible-operator 2>/dev/null))
 	@{ \
 	set -e ;\
 	mkdir -p $(dir $(ANSIBLE_OPERATOR)) ;\
-	curl -sSLo $(ANSIBLE_OPERATOR) https://github.com/operator-framework/operator-sdk/releases/download/v1.12.0/ansible-operator_$(OS)_$(ARCHA) ;\
+	curl -sSLo $(ANSIBLE_OPERATOR) https://github.com/operator-framework/operator-sdk/releases/download/v1.23.0/ansible-operator_$(OS)_$(ARCHA) ;\
 	chmod +x $(ANSIBLE_OPERATOR) ;\
 	}
 else
@@ -166,7 +187,7 @@ ifeq (,$(shell which opm 2>/dev/null))
 	@{ \
 	set -e ;\
 	mkdir -p $(dir $(OPM)) ;\
-	curl -sSLo $(OPM) https://github.com/operator-framework/operator-registry/releases/download/v1.15.1/$(OS)-$(ARCHA)-opm ;\
+	curl -sSLo $(OPM) https://github.com/operator-framework/operator-registry/releases/download/v1.23.0/$(OS)-$(ARCHA)-opm ;\
 	chmod +x $(OPM) ;\
 	}
 else
@@ -269,41 +290,63 @@ charts:
 	mkdir -p $@

 .PHONY: helm-chart
-helm-chart: helm-chart-generate helm-chart-slice
+helm-chart: helm-chart-generate

 .PHONY: helm-chart-generate
 helm-chart-generate: kustomize helm kubectl-slice yq charts
-	@echo "== KUSTOMIZE (image and namespace) =="
+	@echo "== KUSTOMIZE: Set image and chart label =="
 	cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
+	cd config/manager && $(KUSTOMIZE) edit set label helm.sh/chart:$(CHART_NAME)-$(VERSION)
+	cd config/default && $(KUSTOMIZE) edit set label helm.sh/chart:$(CHART_NAME)-$(VERSION)

-	@echo "== HELM =="
+	@echo "== Gather Helm Chart Metadata =="
+	# remove the existing chart if it exists
+	rm -rf charts/$(CHART_NAME)
+	# create new chart metadata in Chart.yaml
 	cd charts && \
 		$(HELM) create awx-operator --starter $(shell pwd)/.helm/starter ;\
 		$(YQ) -i '.version = "$(VERSION)"' $(CHART_NAME)/Chart.yaml ;\
 		$(YQ) -i '.appVersion = "$(VERSION)" | .appVersion style="double"' $(CHART_NAME)/Chart.yaml ;\
 		$(YQ) -i '.description = "$(CHART_DESCRIPTION)"' $(CHART_NAME)/Chart.yaml ;\

+	@echo "Generated chart metadata:"
 	@cat charts/$(CHART_NAME)/Chart.yaml

-	@echo "== KUSTOMIZE (annotation) =="
-	cd config/manager && $(KUSTOMIZE) edit set annotation helm.sh/chart:$(CHART_NAME)-$(VERSION)
-	cd config/default && $(KUSTOMIZE) edit set annotation helm.sh/chart:$(CHART_NAME)-$(VERSION)
-
-	@echo "== SLICE =="
+	@echo "== KUSTOMIZE: Generate resources and slice into templates =="
+	# place in raw-files directory so they can be modified while they are valid yaml - as soon as they are in templates/,
+	# wild cards pick up the actual templates, which are not real yaml and can't have yq run on them.
 	$(KUSTOMIZE) build --load-restrictor LoadRestrictionsNone config/default | \
 		$(KUBECTL_SLICE) --input-file=- \
-			--output-dir=charts/$(CHART_NAME)/templates \
+			--output-dir=charts/$(CHART_NAME)/raw-files \
 			--sort-by-kind
-	@echo "AWX Operator installed with Helm Chart version $(VERSION)" > charts/$(CHART_NAME)/templates/NOTES.txt
-	mkdir charts/$(CHART_NAME)/crds
-	mv charts/$(CHART_NAME)/templates/customresourcedefinition* charts/$(CHART_NAME)/crds

-.PHONY: helm-chart-edit
-helm-chart-slice:
-	@echo "== EDIT =="
-	$(foreach file, $(wildcard charts/$(CHART_NAME)/templates/*),$(YQ) -i 'del(.. | select(has("namespace")).namespace)' $(file);)
-	$(foreach file, $(wildcard charts/$(CHART_NAME)/templates/*rolebinding*),$(YQ) -i '.subjects[0].namespace = "{{ .Release.Namespace }}"' $(file);)
-	rm -f charts/$(CHART_NAME)/templates/namespace*.yaml
+	@echo "== GIT: Reset kustomize configs =="
+	# reset kustomize configs following kustomize build
+	git checkout -f config/.
+
+	@echo "== Build Templates and CRDS =="
+	# Delete metadata.namespace, release namespace will be automatically inserted by helm
+	for file in charts/$(CHART_NAME)/raw-files/*; do\
+		$(YQ) -i 'del(.metadata.namespace)' $${file};\
+	done
+	# Correct namespace for rolebinding to be release namespace, this must be explicit
+	for file in charts/$(CHART_NAME)/raw-files/*rolebinding*; do\
+		$(YQ) -i '.subjects[0].namespace = "{{ .Release.Namespace }}"' $${file};\
+	done
+	# move all custom resource definitions to crds folder
+	mkdir charts/$(CHART_NAME)/crds
+	mv charts/$(CHART_NAME)/raw-files/customresourcedefinition*.yaml charts/$(CHART_NAME)/crds/.
+	# remove any namespace definitions
+	rm -f charts/$(CHART_NAME)/raw-files/namespace*.yaml
+	# move remaining resources to helm templates
+	mv charts/$(CHART_NAME)/raw-files/* charts/$(CHART_NAME)/templates/.
+	# remove the raw-files folder
+	rm -rf charts/$(CHART_NAME)/raw-files
+
+	# create and populate NOTES.txt
+	@echo "AWX Operator installed with Helm Chart version $(VERSION)" > charts/$(CHART_NAME)/templates/NOTES.txt
+
+	@echo "Helm chart successfully configured for $(CHART_NAME) version $(VERSION)"


 .PHONY: helm-package
@@ -311,6 +354,9 @@ helm-package: cr helm-chart
 	@echo "== CHART RELEASER (package) =="
 	$(CR) package ./charts/awx-operator

+# List all tags oldest to newest.
+TAGS := $(shell git tag -l  --sort=creatordate)
+
 # The actual release happens in ansible/helm-release.yml
 # until https://github.com/helm/chart-releaser/issues/122 happens
 .PHONY: helm-index
@@ -319,6 +365,20 @@ helm-index: cr helm-chart
 	git remote add httpsorigin "https://github.com/$(CHART_OWNER)/$(CHART_REPO).git"
 	git fetch httpsorigin

+	# This step to workaround issues with old releases being dropped.
+	# Until https://github.com/helm/chart-releaser/issues/133 happens
+	@echo "== CHART FETCH previous releases =="
+	# Download all old releases
+	cd .cr-release-packages;\
+	for tag in $(TAGS); do\
+		dl_url="https://github.com/$${CHART_OWNER}/$${CHART_REPO}/releases/download/$${tag}/$${CHART_REPO}-$${tag}.tgz";\
+		curl -RLOs -z "$${CHART_REPO}-$${tag}.tgz" --fail $${dl_url};\
+		result=$$?;\
+		if [ $${result} -eq 0 ]; then\
+			echo "Downloaded $$dl_url";\
+		fi;\
+	done
+
 	@echo "== CHART RELEASER (index) =="
 	$(CR) index \
 		--owner "$(CHART_OWNER)" \
--- a/14
+++ b/14
@@ -13,4 +13,18 @@ resources:
  group: awx
  kind: AWX
  version: v1beta1
+- api:
+    crdVersion: v1
+    namespaced: true
+  domain: ansible.com
+  group: awx
+  kind: AWXBackup
+  version: v1beta1
+- api:
+    crdVersion: v1
+    namespaced: true
+  domain: ansible.com
+  group: awx
+  kind: AWXRestore
+  version: v1beta1
 version: "3"
--- a/README.md
+++ b/README.md
@@ -55,6 +55,8 @@ An [Ansible AWX](https://github.com/ansible/awx) operator for Kubernetes built w
            * [Cluster-scope to Namespace-scope considerations](#cluster-scope-to-namespace-scope-considerations)
            * [Project is now based on v1.x of the operator-sdk project](#project-is-now-based-on-v1x-of-the-operator-sdk-project)
            * [Steps to upgrade](#steps-to-upgrade)
+      * [Add Execution Nodes](#adding-execution-nodes)
+          * [Custom Receptor CA](#custom-receptor-ca)
   * [Contributing](#contributing)
   * [Release Process](#release-process)
   * [Author](#author)
@@ -241,7 +243,7 @@ awx-demo-service    NodePort    10.109.40.38   <none>        80:31006/TCP   3m56
 Once deployed, the AWX instance will be accessible by running:

 ```
-$ minikube service awx-demo-service --url -n $NAMESPACE
+$ minikube service awx-demo-service --url
 ```

 By default, the admin user is `admin` and the password is available in the `<resourcename>-admin-password` secret. To retrieve the admin password, run:
@@ -442,6 +444,7 @@ The following variables are customizable when `ingress_type=ingress`. The `ingre
 | ------------------- | ---------------------------------------- | --------------------------- |
 | ingress_annotations | Ingress annotations                      | Empty string                |
 | ingress_tls_secret  | Secret that contains the TLS information | Empty string                |
+| ingress_class_name  | Define the ingress class name            | Cluster default             |
 | hostname            | Define the FQDN                          | {{ meta.name }}.example.com |
 | ingress_path        | Define the ingress path to the service   | /                           |
 | ingress_path_type   | Define the type of the path (for LBs)    | Prefix                      |
@@ -478,6 +481,12 @@ spec:

 ### Database Configuration

+#### Postgres Version
+
+The default Postgres version for the version of AWX bundled with the latest version of the awx-operator is Postgres 13. You can find this default for a given version by at the default value for [_postgres_image_version](./roles/installer/defaults/main.yml#L138).
+
+We only have coverage for the default version of Postgres. Newer versions of Postgres (14+) will likely work, but should only be configured as an external database. If your database is managed by the awx-operator (default if you don't specify a `postgres_configuration_secret`), then you should not override the default version as this may cause issues when awx-operator tries to upgrade your postgresql pod.
+
 #### External PostgreSQL Service

 To configure AWX to use an external database, the Custom Resource needs to know about the connection details. To do this, create a k8s secret with those connection details and specify the name of the secret as `postgres_configuration_secret` at the CR spec level.
@@ -785,7 +794,9 @@ To create the secrets, you can use the commands below:

 #### Enabling LDAP Integration at AWX bootstrap

-A sample of extra settings can be found as below:
+A sample of extra settings can be found as below. All possible options can be found here: https://django-auth-ldap.readthedocs.io/en/latest/reference.html#settings
+
+> **NOTE:** These values are inserted into a Python file, so pay close attention to which values need quotes and which do not.

 ```yaml
    - setting: AUTH_LDAP_SERVER_URI
@@ -802,6 +813,9 @@ A sample of extra settings can be found as below:
    - setting: AUTH_LDAP_GROUP_SEARCH
      value: 'LDAPSearch("OU=Groups,DC=abc,DC=com",ldap.SCOPE_SUBTREE,"(objectClass=group)",)'

+    - setting: AUTH_LDAP_GROUP_TYPE
+      value: 'GroupOfNamesType(name_attr="cn")'
+
    - setting: AUTH_LDAP_USER_ATTR_MAP
      value: '{"first_name": "givenName","last_name": "sn","email": "mail"}'

@@ -1075,7 +1089,7 @@ Example configuration of `no_log` parameter

 ```yaml
  spec:
-    no_log: 'true'
+    no_log: true
 ```

 #### Auto upgrade
@@ -1194,6 +1208,33 @@ Then install the new AWX Operator by following the instructions in [Basic Instal

 Once the new AWX Operator is up and running, your AWX deployment will also be upgraded.

+### Adding Execution Nodes
+Starting with AWX Operator v0.30.0 and AWX v21.7.0, standalone execution nodes can be added to your deployments.
+See [AWX execution nodes docs](https://github.com/ansible/awx/blob/devel/docs/execution_nodes.md) for information about this feature.
+
+#### Custom Receptor CA
+The control nodes on the K8S cluster will communicate with execution nodes via mutual TLS TCP connections, running via Receptor.
+Execution nodes will verify incoming connections by ensuring the x509 certificate was issued by a trusted Certificate Authority (CA).
+
+A user may wish to provide their own CA for this validation. If no CA is provided, AWX Operator will automatically generate one using OpenSSL.
+
+Given custom `ca.crt` and `ca.key` stored locally, run the following,
+
+```bash
+kubectl create secret tls awx-demo-receptor-ca \
+   --cert=/path/to/ca.crt --key=/path/to/ca.key
+```
+
+The secret should be named `{AWX Custom Resource name}-receptor-ca`. In the above the AWX CR name is "awx-demo". Please replace "awx-demo" with your AWX Custom Resource name.
+
+If this secret is created after AWX is deployed, run the following to restart the deployment,
+
+```bash
+kubectl rollout restart deployment awx-demo
+```
+
+**Important Note**, changing the receptor CA will break connections to any existing execution nodes. These nodes will enter an `unavailable` state, and jobs will not be able to run on them. Users will need to download and re-run the install bundle for each execution node. This will replace the TLS certificate files with those signed by the new CA. The execution nodes should then appear in a `ready` state after a few minutes.
+
 ## Contributing

 Please visit [our contributing guidelines](https://github.com/ansible/awx-operator/blob/devel/CONTRIBUTING.md).
--- a/ansible/helm-release.yml
+++ b/ansible/helm-release.yml
@@ -16,7 +16,7 @@

    - name: Build and package helm chart
      command: |
-        make helm-chart helm-package
+        make helm-package
      environment:
        VERSION: "{{ tag }}"
        IMAGE_TAG_BASE: "{{ operator_image }}"
--- a/config/crd/bases/awx.ansible.com_awxbackups.yaml
+++ b/config/crd/bases/awx.ansible.com_awxbackups.yaml
@@ -0,0 +1,121 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: awxbackups.awx.ansible.com
+spec:
+  group: awx.ansible.com
+  names:
+    kind: AWXBackup
+    listKind: AWXBackupList
+    plural: awxbackups
+    singular: awxbackup
+  scope: Namespaced
+  versions:
+  - name: v1beta1
+    served: true
+    storage: true
+    subresources:
+      status: {}
+    schema:
+      openAPIV3Schema:
+        type: object
+        description: Schema validation for the AWXBackup CRD
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            type: object
+            x-kubernetes-preserve-unknown-fields: true
+            required:
+            - deployment_name
+            properties:
+              deployment_name:
+                description: Name of the deployment to be backed up
+                type: string
+              backup_pvc:
+                description: Name of the backup PVC
+                type: string
+              backup_pvc_namespace:
+                description: (Deprecated) Namespace the PVC is in
+                type: string
+              backup_storage_requirements:
+                description: Storage requirements for backup PVC (may be similar to existing postgres PVC backing up from)
+                type: string
+              backup_resource_requirements:
+                description: Resource requirements for the management pod used to create a backup
+                properties:
+                  requests:
+                    properties:
+                      cpu:
+                        type: string
+                      memory:
+                        type: string
+                    type: object
+                  limits:
+                    properties:
+                      cpu:
+                        type: string
+                      memory:
+                        type: string
+                    type: object
+                type: object
+              backup_storage_class:
+                description: Storage class to use when creating PVC for backup
+                type: string
+              clean_backup_on_delete:
+                description: Flag to indicate if backup should be deleted on PVC if AWXBackup object is deleted
+                type: boolean
+              postgres_label_selector:
+                description: Label selector used to identify postgres pod for backing up data
+                type: string
+              postgres_image:
+                description: Registry path to the PostgreSQL container to use
+                type: string
+              postgres_image_version:
+                description: PostgreSQL container image version to use
+                type: string
+              no_log:
+                description: Configure no_log for no_log tasks
+                type: boolean
+                default: true
+              set_self_labels:
+                description: Maintain some of the recommended `app.kubernetes.io/*` labels on the resource (self)
+                type: boolean
+                default: true
+          status:
+            type: object
+            x-kubernetes-preserve-unknown-fields: true
+            properties:
+              conditions:
+                description: The resulting conditions when a Service Telemetry is instantiated
+                items:
+                  properties:
+                    lastTransitionTime:
+                      type: string
+                    reason:
+                      type: string
+                    status:
+                      type: string
+                    type:
+                      type: string
+                  type: object
+                type: array
+              backupDirectory:
+                description: Backup directory name on the specified pvc
+                type: string
+              backupClaim:
+                description: Backup persistent volume claim
+                type: string
--- a/config/crd/bases/awx.ansible.com_awxrestores.yaml
+++ b/config/crd/bases/awx.ansible.com_awxrestores.yaml
@@ -0,0 +1,120 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: awxrestores.awx.ansible.com
+spec:
+  group: awx.ansible.com
+  names:
+    kind: AWXRestore
+    listKind: AWXRestoreList
+    plural: awxrestores
+    singular: awxrestore
+  scope: Namespaced
+  versions:
+  - name: v1beta1
+    served: true
+    storage: true
+    subresources:
+      status: {}
+    schema:
+      openAPIV3Schema:
+        type: object
+        description: Schema validation for the AWXRestore CRD
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            type: object
+            x-kubernetes-preserve-unknown-fields: true
+            properties:
+              backup_source:
+                description: Backup source
+                type: string
+                enum:
+                - CR
+                - PVC
+              deployment_name:
+                description: Name of the restored deployment. This should be different from the original deployment name
+                  if the original deployment still exists.
+                type: string
+              backup_name:
+                description: AWXBackup object name
+                type: string
+              backup_pvc:
+                description: Name of the PVC to be restored from, set as a status found on the awxbackup object (backupClaim)
+                type: string
+              backup_pvc_namespace:
+                description: (Deprecated) Namespace the PVC is in
+                type: string
+              backup_dir:
+                description: Backup directory name, set as a status found on the awxbackup object (backupDirectory)
+                type: string
+              restore_resource_requirements:
+                description: Resource requirements for the management pod that restores AWX from a backup
+                properties:
+                  requests:
+                    properties:
+                      cpu:
+                        type: string
+                      memory:
+                        type: string
+                    type: object
+                  limits:
+                    properties:
+                      cpu:
+                        type: string
+                      memory:
+                        type: string
+                    type: object
+                type: object
+              postgres_label_selector:
+                description: Label selector used to identify postgres pod for backing up data
+                type: string
+              postgres_image:
+                description: Registry path to the PostgreSQL container to use
+                type: string
+              postgres_image_version:
+                description: PostgreSQL container image version to use
+                type: string
+              no_log:
+                description: Configure no_log for no_log tasks
+                type: boolean
+                default: true
+              set_self_labels:
+                description: Maintain some of the recommended `app.kubernetes.io/*` labels on the resource (self)
+                type: boolean
+                default: true
+          status:
+            type: object
+            x-kubernetes-preserve-unknown-fields: true
+            properties:
+              conditions:
+                description: The resulting conditions when a Service Telemetry is instantiated
+                items:
+                  properties:
+                    lastTransitionTime:
+                      type: string
+                    reason:
+                      type: string
+                    status:
+                      type: string
+                    type:
+                      type: string
+                  type: object
+                type: array
+              restoreComplete:
+                description: Restore process complete
+                type: boolean
--- a/config/crd/bases/awx.ansible.com_awxs.yaml
+++ b/config/crd/bases/awx.ansible.com_awxs.yaml
--- a/config/crd/bases/awxbackup.ansible.com_awxbackups.yaml
+++ b/config/crd/bases/awxbackup.ansible.com_awxbackups.yaml
@@ -1,87 +0,0 @@
---
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: awxbackups.awx.ansible.com
-spec:
-  group: awx.ansible.com
-  names:
-    kind: AWXBackup
-    listKind: AWXBackupList
-    plural: awxbackups
-    singular: awxbackup
-  scope: Namespaced
-  versions:
-    - name: v1beta1
-      served: true
-      storage: true
-      subresources:
-        status: {}
-      schema:
-        openAPIV3Schema:
-          type: object
-          x-kubernetes-preserve-unknown-fields: true
-          description: Schema validation for the AWXBackup CRD
-          properties:
-            spec:
-              type: object
-              required:
-                - deployment_name
-              properties:
-                deployment_name:
-                  description: Name of the deployment to be backed up
-                  type: string
-                backup_pvc:
-                  description: Name of the backup PVC
-                  type: string
-                backup_pvc_namespace:
-                  description: (Deprecated) Namespace the PVC is in
-                  type: string
-                backup_storage_requirements:
-                  description: Storage requirements for backup PVC (may be similar to existing postgres PVC backing up from)
-                  type: string
-                backup_storage_class:
-                  description: Storage class to use when creating PVC for backup
-                  type: string
-                clean_backup_on_delete:
-                  description: Flag to indicate if backup should be deleted on PVC if AWXBackup object is deleted
-                  type: boolean
-                postgres_label_selector:
-                  description: Label selector used to identify postgres pod for backing up data
-                  type: string
-                postgres_image:
-                  description: Registry path to the PostgreSQL container to use
-                  type: string
-                postgres_image_version:
-                  description: PostgreSQL container image version to use
-                  type: string
-                no_log:
-                  description: Configure no_log for no_log tasks
-                  type: string
-                set_self_labels:
-                  description: Maintain some of the recommended `app.kubernetes.io/*` labels on the resource (self)
-                  type: boolean
-                  default: true
-            status:
-              type: object
-              properties:
-                conditions:
-                  description: The resulting conditions when a Service Telemetry is instantiated
-                  items:
-                    properties:
-                      lastTransitionTime:
-                        type: string
-                      reason:
-                        type: string
-                      status:
-                        type: string
-                      type:
-                        type: string
-                    type: object
-                  type: array
-                backupDirectory:
-                  description: Backup directory name on the specified pvc
-                  type: string
-                backupClaim:
-                  description: Backup persistent volume claim
-                  type: string
--- a/config/crd/bases/awxrestore.ansible.com_awxrestores.yaml
+++ b/config/crd/bases/awxrestore.ansible.com_awxrestores.yaml
@@ -1,86 +0,0 @@
---
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: awxrestores.awx.ansible.com
-spec:
-  group: awx.ansible.com
-  names:
-    kind: AWXRestore
-    listKind: AWXRestoreList
-    plural: awxrestores
-    singular: awxrestore
-  scope: Namespaced
-  versions:
-    - name: v1beta1
-      served: true
-      storage: true
-      subresources:
-        status: {}
-      schema:
-        openAPIV3Schema:
-          type: object
-          x-kubernetes-preserve-unknown-fields: true
-          description: Schema validation for the AWXRestore CRD
-          properties:
-            spec:
-              type: object
-              properties:
-                backup_source:
-                  description: Backup source
-                  type: string
-                  enum:
-                    - CR
-                    - PVC
-                deployment_name:
-                  description: Name of the restored deployment. This should be different from the original deployment name
-                    if the original deployment still exists.
-                  type: string
-                backup_name:
-                  description: AWXBackup object name
-                  type: string
-                backup_pvc:
-                  description: Name of the PVC to be restored from, set as a status found on the awxbackup object (backupClaim)
-                  type: string
-                backup_pvc_namespace:
-                  description: (Deprecated) Namespace the PVC is in
-                  type: string
-                backup_dir:
-                  description: Backup directory name, set as a status found on the awxbackup object (backupDirectory)
-                  type: string
-                postgres_label_selector:
-                  description: Label selector used to identify postgres pod for backing up data
-                  type: string
-                postgres_image:
-                  description: Registry path to the PostgreSQL container to use
-                  type: string
-                postgres_image_version:
-                  description: PostgreSQL container image version to use
-                  type: string
-                no_log:
-                  description: Configure no_log for no_log tasks
-                  type: string
-                set_self_labels:
-                  description: Maintain some of the recommended `app.kubernetes.io/*` labels on the resource (self)
-                  type: boolean
-                  default: true
-            status:
-              type: object
-              properties:
-                conditions:
-                  description: The resulting conditions when a Service Telemetry is instantiated
-                  items:
-                    properties:
-                      lastTransitionTime:
-                        type: string
-                      reason:
-                        type: string
-                      status:
-                        type: string
-                      type:
-                        type: string
-                    type: object
-                  type: array
-                restoreComplete:
-                  description: Restore process complete
-                  type: boolean
--- a/config/crd/kustomization.yaml
+++ b/config/crd/kustomization.yaml
@@ -1,9 +1,8 @@
---
 # This kustomization.yaml is not intended to be run by itself,
 # since it depends on service name and namespace that are out of this kustomize package.
 # It should be run by config/default
 resources:
-  - bases/awx.ansible.com_awxs.yaml
-  - bases/awxbackup.ansible.com_awxbackups.yaml
-  - bases/awxrestore.ansible.com_awxrestores.yaml
-# +kubebuilder:scaffold:crdkustomizeresource
+- bases/awx.ansible.com_awxs.yaml
+- bases/awx.ansible.com_awxbackups.yaml
+- bases/awx.ansible.com_awxrestores.yaml
+#+kubebuilder:scaffold:crdkustomizeresource
--- a/config/default/kustomization.yaml
+++ b/config/default/kustomization.yaml
@@ -1,24 +1,32 @@
 # Adds namespace to all resources.
 namespace: awx
+
 # Value of this field is prepended to the
 # names of all resources, e.g. a deployment named
 # "wordpress" becomes "alices-wordpress".
 # Note that it should also match with the prefix (text before '-') of the namespace
 # field above.
 namePrefix: awx-operator-
+
 # Labels to add to all resources and selectors.
-# commonLabels:
-#   someName: someValue
-  # [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
-  # - ../prometheus
-  # Protect the /metrics endpoint by putting it behind auth.
-  # If you want your controller-manager to expose the /metrics
-  # endpoint w/o any authn/z, please comment the following line.
-patchesStrategicMerge:
- manager_auth_proxy_patch.yaml
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
+#labels:
+#- includeSelectors: true
+#  pairs:
+#    someName: someValue
+
 resources:
 - ../crd
 - ../rbac
 - ../manager
+# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
+#- ../prometheus
+
+patchesStrategicMerge:
+# Protect the /metrics endpoint by putting it behind auth.
+# If you want your controller-manager to expose the /metrics
+# endpoint w/o any authn/z, please comment the following line.
+- manager_auth_proxy_patch.yaml
+
+# Mount the controller config file for loading manager configurations
+# through a ComponentConfig type
+#- manager_config_patch.yaml
--- a/config/default/manager_auth_proxy_patch.yaml
+++ b/config/default/manager_auth_proxy_patch.yaml
@@ -1,4 +1,3 @@
---
 # This patch inject a sidecar container which is a HTTP proxy for the
 # controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
 apiVersion: apps/v1
@@ -10,20 +9,33 @@ spec:
  template:
    spec:
      containers:
-        - name: kube-rbac-proxy
-          image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0
-          args:
-            - "--secure-listen-address=0.0.0.0:8443"
-            - "--upstream=http://127.0.0.1:8080/"
-            - "--logtostderr=true"
-            - "--v=10"
-          ports:
-            - containerPort: 8443
-              protocol: TCP
-              name: https
-        - name: awx-manager
-          args:
-            - "--health-probe-bind-address=:6789"
-            - "--metrics-bind-address=127.0.0.1:8080"
-            - "--leader-elect"
-            - "--leader-election-id=awx-operator"
+      - name: kube-rbac-proxy
+        securityContext:
+          allowPrivilegeEscalation: false
+        # TODO(user): uncomment for common cases that do not require escalating privileges
+        # capabilities:
+        #   drop:
+        #     - "ALL"
+        image: gcr.io/kubebuilder/kube-rbac-proxy:v0.13.0
+        args:
+        - "--secure-listen-address=0.0.0.0:8443"
+        - "--upstream=http://127.0.0.1:8080/"
+        - "--logtostderr=true"
+        - "--v=0"
+        ports:
+        - containerPort: 8443
+          protocol: TCP
+          name: https
+        resources:
+          limits:
+            cpu: 500m
+            memory: 128Mi
+          requests:
+            cpu: 5m
+            memory: 64Mi
+      - name: awx-manager
+        args:
+        - "--health-probe-bind-address=:6789"
+        - "--metrics-bind-address=127.0.0.1:8080"
+        - "--leader-elect"
+        - "--leader-election-id=awx-operator"
--- a/config/default/manager_config_patch.yaml
+++ b/config/default/manager_config_patch.yaml
@@ -1,4 +1,3 @@
---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -8,14 +7,14 @@ spec:
  template:
    spec:
      containers:
-        - name: awx-manager
-          args:
-            - "--config=controller_manager_config.yaml"
-          volumeMounts:
-            - name: awx-manager-config
-              mountPath: /controller_manager_config.yaml
-              subPath: controller_manager_config.yaml
-      volumes:
+      - name: awx-manager
+        args:
+        - "--config=controller_manager_config.yaml"
+        volumeMounts:
        - name: awx-manager-config
-          configMap:
-            name: awx-manager-config
+          mountPath: /controller_manager_config.yaml
+          subPath: controller_manager_config.yaml
+      volumes:
+      - name: awx-manager-config
+        configMap:
+          name: awx-manager-config
--- a/config/manager/controller_manager_config.yaml
+++ b/config/manager/controller_manager_config.yaml
@@ -1,10 +1,20 @@
---
-apiVersion: controller-runtime.sigs.k8s.io/v1beta1
+apiVersion: controller-runtime.sigs.k8s.io/v1alpha1
 kind: ControllerManagerConfig
 health:
  healthProbeBindAddress: :6789
 metrics:
  bindAddress: 127.0.0.1:8080
+
 leaderElection:
  leaderElect: true
  resourceName: 811c9dc5.ansible.com
+# leaderElectionReleaseOnCancel defines if the leader should step down volume
+# when the Manager ends. This requires the binary to immediately end when the
+# Manager is stopped, otherwise, this setting is unsafe. Setting this significantly
+# speeds up voluntary leader transitions as the new leader don't have to wait
+# LeaseDuration time first.
+# In the default scaffold provided, the program ends immediately after
+# the manager stops, so would be fine to enable this option. However,
+# if you are doing or is intended to do any operation such as perform cleanups
+# after the manager stops then its usage might be unsafe.
+# leaderElectionReleaseOnCancel: true
--- a/config/manager/kustomization.yaml
+++ b/config/manager/kustomization.yaml
@@ -1,11 +1,14 @@
 resources:
 - manager.yaml
+
 generatorOptions:
  disableNameSuffixHash: true
+
 configMapGenerator:
- files:
+- name: awx-manager-config
+  files:
  - controller_manager_config.yaml
-  name: awx-manager-config
+
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 images:
--- a/config/manager/manager.yaml
+++ b/config/manager/manager.yaml
@@ -20,48 +20,62 @@ spec:
  replicas: 1
  template:
    metadata:
+      annotations:
+        kubectl.kubernetes.io/default-container: manager
      labels:
        control-plane: controller-manager
    spec:
      securityContext:
        runAsNonRoot: true
+        # For common cases that do not require escalating privileges
+        # it is recommended to ensure that all your Pods/Containers are restrictive.
+        # More info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
+        # Please uncomment the following code if your project does NOT have to work on old Kubernetes
+        # versions < 1.19 or on vendors versions which do NOT support this field by default (i.e. Openshift < 4.11 ).
+        # seccompProfile:
+        #   type: RuntimeDefault
      containers:
-        - args:
-            - --leader-elect
-            - --leader-election-id=awx-operator
-          image: controller:latest
-          name: awx-manager
-          env:
-            - name: ANSIBLE_GATHERING
-              value: explicit
-            - name: ANSIBLE_DEBUG_LOGS
-              value: 'false'
-            - name: WATCH_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          securityContext:
-            allowPrivilegeEscalation: false
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: 6789
-            initialDelaySeconds: 15
-            periodSeconds: 20
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: 6789
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          resources:
-            requests:
-              memory: "32Mi"
-              cpu: "50m"
-            limits:
-              memory: "4096Mi"
-              cpu: "2000m"
+      - args:
+        - --leader-elect
+        - --leader-election-id=awx-operator
+        image: controller:latest
+        name: awx-manager
+        env:
+        - name: ANSIBLE_GATHERING
+          value: explicit
+        - name: ANSIBLE_DEBUG_LOGS
+          value: 'false'
+        - name: WATCH_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        securityContext:
+          allowPrivilegeEscalation: false
+        # TODO(user): uncomment for common cases that do not require escalating privileges
+          capabilities:
+            drop:
+            - "ALL"
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 6789
+          initialDelaySeconds: 15
+          periodSeconds: 20
+        readinessProbe:
+          httpGet:
+            path: /readyz
+            port: 6789
+          initialDelaySeconds: 5
+          periodSeconds: 10
+        # More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+        resources:
+          requests:
+            memory: "32Mi"
+            cpu: "50m"
+          limits:
+            memory: "4096Mi"
+            cpu: "2000m"
      serviceAccountName: controller-manager
      imagePullSecrets:
-        - name: redhat-operators-pull-secret
+      - name: redhat-operators-pull-secret
      terminationGracePeriodSeconds: 10
--- a/config/manifests/bases/awx-operator.clusterserviceversion.yaml
+++ b/config/manifests/bases/awx-operator.clusterserviceversion.yaml
--- a/config/manifests/kustomization.yaml
+++ b/config/manifests/kustomization.yaml
@@ -1,8 +1,7 @@
---
 # These resources constitute the fully configured set of manifests
 # used to generate the 'manifests/' directory in a bundle.
 resources:
-  - bases/awx-operator.clusterserviceversion.yaml
-  - ../default
-  - ../samples
-  - ../scorecard
+- bases/awx-operator.clusterserviceversion.yaml
+- ../default
+- ../samples
+- ../scorecard
--- a/config/prometheus/kustomization.yaml
+++ b/config/prometheus/kustomization.yaml
@@ -1,3 +1,2 @@
---
 resources:
-  - monitor.yaml
+- monitor.yaml
--- a/config/prometheus/monitor.yaml
+++ b/config/prometheus/monitor.yaml
@@ -1,4 +1,3 @@
---
 # Prometheus Monitor Service (Metrics)
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
--- a/config/rbac/auth_proxy_client_clusterrole.yaml
+++ b/config/rbac/auth_proxy_client_clusterrole.yaml
@@ -1,10 +1,9 @@
---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
  name: metrics-reader
 rules:
-  - nonResourceURLs:
-      - "/metrics"
-    verbs:
-      - get
+- nonResourceURLs:
+  - "/metrics"
+  verbs:
+  - get
--- a/config/rbac/auth_proxy_role.yaml
+++ b/config/rbac/auth_proxy_role.yaml
@@ -1,18 +1,17 @@
---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
  name: proxy-role
 rules:
-  - apiGroups:
-      - authentication.k8s.io
-    resources:
-      - tokenreviews
-    verbs:
-      - create
-  - apiGroups:
-      - authorization.k8s.io
-    resources:
-      - subjectaccessreviews
-    verbs:
-      - create
+- apiGroups:
+  - authentication.k8s.io
+  resources:
+  - tokenreviews
+  verbs:
+  - create
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - subjectaccessreviews
+  verbs:
+  - create
--- a/config/rbac/auth_proxy_role_binding.yaml
+++ b/config/rbac/auth_proxy_role_binding.yaml
@@ -1,4 +1,3 @@
---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -8,6 +7,6 @@ roleRef:
  kind: ClusterRole
  name: proxy-role
 subjects:
-  - kind: ServiceAccount
-    name: controller-manager
-    namespace: system
+- kind: ServiceAccount
+  name: controller-manager
+  namespace: system
--- a/config/rbac/auth_proxy_service.yaml
+++ b/config/rbac/auth_proxy_service.yaml
@@ -1,4 +1,3 @@
---
 apiVersion: v1
 kind: Service
 metadata:
@@ -8,9 +7,9 @@ metadata:
  namespace: system
 spec:
  ports:
-    - name: https
-      port: 8443
-      protocol: TCP
-      targetPort: https
+  - name: https
+    port: 8443
+    protocol: TCP
+    targetPort: https
  selector:
    control-plane: controller-manager
--- a/config/rbac/awx_editor_role.yaml
+++ b/config/rbac/awx_editor_role.yaml
@@ -1,25 +1,24 @@
---
 # permissions for end users to edit awxs.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
  name: awx-editor-role
 rules:
-  - apiGroups:
-      - awx.ansible.com
-    resources:
-      - awxs
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
-  - apiGroups:
-      - awx.ansible.com
-    resources:
-      - awxs/status
-    verbs:
-      - get
+- apiGroups:
+  - awx.ansible.com
+  resources:
+  - awxs
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - awx.ansible.com
+  resources:
+  - awxs/status
+  verbs:
+  - get
--- a/config/rbac/awx_viewer_role.yaml
+++ b/config/rbac/awx_viewer_role.yaml
@@ -1,21 +1,20 @@
---
 # permissions for end users to view awxs.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
  name: awx-viewer-role
 rules:
-  - apiGroups:
-      - awx.ansible.com
-    resources:
-      - awxs
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - awx.ansible.com
-    resources:
-      - awxs/status
-    verbs:
-      - get
+- apiGroups:
+  - awx.ansible.com
+  resources:
+  - awxs
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - awx.ansible.com
+  resources:
+  - awxs/status
+  verbs:
+  - get
--- a/config/rbac/awxbackup_editor_role.yaml
+++ b/config/rbac/awxbackup_editor_role.yaml
@@ -0,0 +1,24 @@
+# permissions for end users to edit awxbackups.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: awxbackup-editor-role
+rules:
+- apiGroups:
+  - awx.ansible.com
+  resources:
+  - awxbackups
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - awx.ansible.com
+  resources:
+  - awxbackups/status
+  verbs:
+  - get
--- a/config/rbac/awxbackup_viewer_role.yaml
+++ b/config/rbac/awxbackup_viewer_role.yaml
@@ -0,0 +1,20 @@
+# permissions for end users to view awxbackups.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: awxbackup-viewer-role
+rules:
+- apiGroups:
+  - awx.ansible.com
+  resources:
+  - awxbackups
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - awx.ansible.com
+  resources:
+  - awxbackups/status
+  verbs:
+  - get
--- a/config/rbac/awxrestore_editor_role.yaml
+++ b/config/rbac/awxrestore_editor_role.yaml
@@ -0,0 +1,24 @@
+# permissions for end users to edit awxrestores.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: awxrestore-editor-role
+rules:
+- apiGroups:
+  - awx.ansible.com
+  resources:
+  - awxrestores
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - awx.ansible.com
+  resources:
+  - awxrestores/status
+  verbs:
+  - get
--- a/config/rbac/awxrestore_viewer_role.yaml
+++ b/config/rbac/awxrestore_viewer_role.yaml
@@ -0,0 +1,20 @@
+# permissions for end users to view awxrestores.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: awxrestore-viewer-role
+rules:
+- apiGroups:
+  - awx.ansible.com
+  resources:
+  - awxrestores
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - awx.ansible.com
+  resources:
+  - awxrestores/status
+  verbs:
+  - get
--- a/config/rbac/kustomization.yaml
+++ b/config/rbac/kustomization.yaml
@@ -1,19 +1,18 @@
---
 resources:
-  # All RBAC will be applied under this service account in
-  # the deployment namespace. You may comment out this resource
-  # if your manager will use a service account that exists at
-  # runtime. Be sure to update RoleBinding and ClusterRoleBinding
-  # subjects if changing service account names.
-  - service_account.yaml
-  - role.yaml
-  - role_binding.yaml
-  - leader_election_role.yaml
-  - leader_election_role_binding.yaml
-  # Comment the following 4 lines if you want to disable
-  # the auth proxy (https://github.com/brancz/kube-rbac-proxy)
-  # which protects your /metrics endpoint.
-  - auth_proxy_service.yaml
-  - auth_proxy_role.yaml
-  - auth_proxy_role_binding.yaml
-  - auth_proxy_client_clusterrole.yaml
+# All RBAC will be applied under this service account in
+# the deployment namespace. You may comment out this resource
+# if your manager will use a service account that exists at
+# runtime. Be sure to update RoleBinding and ClusterRoleBinding
+# subjects if changing service account names.
+- service_account.yaml
+- role.yaml
+- role_binding.yaml
+- leader_election_role.yaml
+- leader_election_role_binding.yaml
+# Comment the following 4 lines if you want to disable
+# the auth proxy (https://github.com/brancz/kube-rbac-proxy)
+# which protects your /metrics endpoint.
+- auth_proxy_service.yaml
+- auth_proxy_role.yaml
+- auth_proxy_role_binding.yaml
+- auth_proxy_client_clusterrole.yaml
--- a/config/rbac/leader_election_role.yaml
+++ b/config/rbac/leader_election_role.yaml
@@ -1,38 +1,37 @@
---
 # permissions to do leader election.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: leader-election-role
 rules:
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - patch
-      - delete
-  - apiGroups:
-      - coordination.k8s.io
-    resources:
-      - leases
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - patch
-      - delete
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - create
-      - patch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
--- a/config/rbac/leader_election_role_binding.yaml
+++ b/config/rbac/leader_election_role_binding.yaml
@@ -1,4 +1,3 @@
---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
@@ -8,6 +7,6 @@ roleRef:
  kind: Role
  name: leader-election-role
 subjects:
-  - kind: ServiceAccount
-    name: controller-manager
-    namespace: system
+- kind: ServiceAccount
+  name: controller-manager
+  namespace: system
--- a/config/rbac/service_account.yaml
+++ b/config/rbac/service_account.yaml
@@ -1,4 +1,3 @@
---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
--- a/config/samples/awx_v1beta1_awxbackup.yaml
+++ b/config/samples/awx_v1beta1_awxbackup.yaml
@@ -0,0 +1,13 @@
+apiVersion: awx.ansible.com/v1beta1
+kind: AWXBackup
+metadata:
+  name: example-awx-backup
+spec:
+  deployment_name: example-awx
+  backup_resource_requirements:
+    limits:
+      cpu: "1000m"
+      memory: "4096Mi"
+    requests:
+      cpu: "25m"
+      memory: "32Mi"
--- a/config/samples/awx_v1beta1_awxrestore.yaml
+++ b/config/samples/awx_v1beta1_awxrestore.yaml
@@ -0,0 +1,14 @@
+apiVersion: awx.ansible.com/v1beta1
+kind: AWXRestore
+metadata:
+  name: awxrestore-sample
+spec:
+  deployment_name: example-awx-2
+  backup_name: example-awx-backup
+  restore_resource_requirements:
+    limits:
+      cpu: "1000m"
+      memory: "4096Mi"
+    requests:
+      cpu: "25m"
+      memory: "32Mi"
--- a/config/samples/kustomization.yaml
+++ b/config/samples/kustomization.yaml
@@ -1,5 +1,6 @@
---
 ## Append samples you want in your CSV to this file as resources ##
 resources:
-  - awx_v1beta1_awx.yaml
-# +kubebuilder:scaffold:manifestskustomizesamples
+- awx_v1beta1_awx.yaml
+- awx_v1beta1_awxbackup.yaml
+- awx_v1beta1_awxrestore.yaml
+#+kubebuilder:scaffold:manifestskustomizesamples
--- a/config/scorecard/bases/config.yaml
+++ b/config/scorecard/bases/config.yaml
@@ -1,8 +1,7 @@
---
 apiVersion: scorecard.operatorframework.io/v1alpha3
 kind: Configuration
 metadata:
  name: config
 stages:
-  - parallel: true
-    tests: []
+- parallel: true
+  tests: []
--- a/config/scorecard/kustomization.yaml
+++ b/config/scorecard/kustomization.yaml
@@ -1,17 +1,16 @@
---
 resources:
-  - bases/config.yaml
+- bases/config.yaml
 patchesJson6902:
-  - path: patches/basic.config.yaml
-    target:
-      group: scorecard.operatorframework.io
-      version: v1alpha3
-      kind: Configuration
-      name: config
-  - path: patches/olm.config.yaml
-    target:
-      group: scorecard.operatorframework.io
-      version: v1alpha3
-      kind: Configuration
-      name: config
-# +kubebuilder:scaffold:patchesJson6902
+- path: patches/basic.config.yaml
+  target:
+    group: scorecard.operatorframework.io
+    version: v1alpha3
+    kind: Configuration
+    name: config
+- path: patches/olm.config.yaml
+  target:
+    group: scorecard.operatorframework.io
+    version: v1alpha3
+    kind: Configuration
+    name: config
+#+kubebuilder:scaffold:patchesJson6902
--- a/config/scorecard/patches/basic.config.yaml
+++ b/config/scorecard/patches/basic.config.yaml
@@ -1,11 +1,10 @@
---
 - op: add
  path: /stages/0/tests/-
  value:
    entrypoint:
-      - scorecard-test
-      - basic-check-spec
-    image: quay.io/operator-framework/scorecard-test:v1.12.0
+    - scorecard-test
+    - basic-check-spec
+    image: quay.io/operator-framework/scorecard-test:v1.23.0
    labels:
      suite: basic
      test: basic-check-spec-test
--- a/config/scorecard/patches/olm.config.yaml
+++ b/config/scorecard/patches/olm.config.yaml
@@ -1,11 +1,10 @@
---
 - op: add
  path: /stages/0/tests/-
  value:
    entrypoint:
-      - scorecard-test
-      - olm-bundle-validation
-    image: quay.io/operator-framework/scorecard-test:v1.12.0
+    - scorecard-test
+    - olm-bundle-validation
+    image: quay.io/operator-framework/scorecard-test:v1.23.0
    labels:
      suite: olm
      test: olm-bundle-validation-test
@@ -13,9 +12,9 @@
  path: /stages/0/tests/-
  value:
    entrypoint:
-      - scorecard-test
-      - olm-crds-have-validation
-    image: quay.io/operator-framework/scorecard-test:v1.12.0
+    - scorecard-test
+    - olm-crds-have-validation
+    image: quay.io/operator-framework/scorecard-test:v1.23.0
    labels:
      suite: olm
      test: olm-crds-have-validation-test
@@ -23,9 +22,9 @@
  path: /stages/0/tests/-
  value:
    entrypoint:
-      - scorecard-test
-      - olm-crds-have-resources
-    image: quay.io/operator-framework/scorecard-test:v1.12.0
+    - scorecard-test
+    - olm-crds-have-resources
+    image: quay.io/operator-framework/scorecard-test:v1.23.0
    labels:
      suite: olm
      test: olm-crds-have-resources-test
@@ -33,9 +32,9 @@
  path: /stages/0/tests/-
  value:
    entrypoint:
-      - scorecard-test
-      - olm-spec-descriptors
-    image: quay.io/operator-framework/scorecard-test:v1.12.0
+    - scorecard-test
+    - olm-spec-descriptors
+    image: quay.io/operator-framework/scorecard-test:v1.23.0
    labels:
      suite: olm
      test: olm-spec-descriptors-test
@@ -43,9 +42,9 @@
  path: /stages/0/tests/-
  value:
    entrypoint:
-      - scorecard-test
-      - olm-status-descriptors
-    image: quay.io/operator-framework/scorecard-test:v1.12.0
+    - scorecard-test
+    - olm-status-descriptors
+    image: quay.io/operator-framework/scorecard-test:v1.23.0
    labels:
      suite: olm
      test: olm-status-descriptors-test
--- a/config/testing/kustomization.yaml
+++ b/config/testing/kustomization.yaml
@@ -1,13 +1,17 @@
 # Adds namespace to all resources.
 namespace: osdk-test
+
 namePrefix: osdk-
+
 # Labels to add to all resources and selectors.
-# commonLabels:
-#   someName: someValue
+#commonLabels:
+#  someName: someValue
+
 patchesStrategicMerge:
 - manager_image.yaml
 - debug_logs_patch.yaml
 - ../default/manager_auth_proxy_patch.yaml
+
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
@@ -17,5 +21,3 @@ resources:
 images:
 - name: testing
  newName: testing-operator
-patches:
- path: pull_policy/Never.yaml
--- a/molecule/default/destroy.yml
+++ b/molecule/default/destroy.yml
@@ -19,6 +19,6 @@
        state: absent

    - name: Unset pull policy
-      command: '{{ kustomize }} edit remove patch pull_policy/{{ operator_pull_policy }}.yaml'
+      command: '{{ kustomize }} edit remove patch --path pull_policy/{{ operator_pull_policy }}.yaml'
      args:
        chdir: '{{ config_dir }}/testing'
--- a/molecule/default/kustomize.yml
+++ b/molecule/default/kustomize.yml
@@ -1,6 +1,6 @@
 ---
 - name: Build kustomize testing overlay
-  # load_restrictor must be set to none so we can load patch files from the default overlay
+  # load-restrictor must be set to none so we can load patch files from the default overlay
  command: '{{ kustomize }} build  --load-restrictor LoadRestrictionsNone .'
  args:
    chdir: '{{ config_dir }}/testing'
--- a/molecule/default/tasks/awxbackup_test.yml
+++ b/molecule/default/tasks/awxbackup_test.yml
@@ -0,0 +1,18 @@
+---
+# - name: Create the awx.ansible.com/v1beta1.AWXBackup
+#   k8s:
+#     state: present
+#     namespace: '{{ namespace }}'
+#     definition: "{{ lookup('template', '/'.join([samples_dir, cr_file])) | from_yaml }}"
+#     wait: yes
+#     wait_timeout: 300
+#     wait_condition:
+#       type: Successful
+#       status: "True"
+#   vars:
+#     cr_file: 'awx_v1beta1_awxbackup.yaml'
+#
+# - name: Add assertions here
+#   assert:
+#     that: false
+#     fail_msg: FIXME Add real assertions for your operator
--- a/molecule/default/tasks/awxrestore_test.yml
+++ b/molecule/default/tasks/awxrestore_test.yml
@@ -0,0 +1,18 @@
+---
+# - name: Create the awx.ansible.com/v1beta1.AWXRestore
+#   k8s:
+#     state: present
+#     namespace: '{{ namespace }}'
+#     definition: "{{ lookup('template', '/'.join([samples_dir, cr_file])) | from_yaml }}"
+#     wait: yes
+#     wait_timeout: 300
+#     wait_condition:
+#       type: Successful
+#       status: "True"
+#   vars:
+#     cr_file: 'awx_v1beta1_awxrestore.yaml'
+#
+# - name: Add assertions here
+#   assert:
+#     that: false
+#     fail_msg: FIXME Add real assertions for your operator
--- a/molecule/kind/destroy.yml
+++ b/molecule/kind/destroy.yml
@@ -11,6 +11,6 @@
      command: kind delete cluster --name osdk-test --kubeconfig {{ kubeconfig }}

    - name: Unset pull policy
-      command: '{{ kustomize }} edit remove patch pull_policy/{{ operator_pull_policy }}.yaml'
+      command: '{{ kustomize }} edit remove patch --path pull_policy/{{ operator_pull_policy }}.yaml'
      args:
        chdir: '{{ config_dir }}/testing'
--- a/molecule/requirements.txt
+++ b/molecule/requirements.txt
@@ -1,4 +1,4 @@
-molecule
+molecule<4.0.2
 molecule-docker
 yamllint
 ansible-lint
--- a/molecule/requirements.yml
+++ b/molecule/requirements.yml
@@ -2,7 +2,7 @@
 collections:
  - name: community.general
  - name: kubernetes.core
-    version: 1.2.1
+    version: 2.3.2
  - name: operator_sdk.util
  - name: community.docker
  - name: awx.awx
--- a/playbooks/awx.yml
+++ b/playbooks/awx.yml
@@ -0,0 +1,31 @@
+---
+- hosts: localhost
+  gather_facts: no
+  collections:
+    - kubernetes.core
+    - operator_sdk.util
+  vars:
+    no_log: true
+  pre_tasks:
+    - name: Verify imagePullSecrets
+      k8s_info:
+        kind: Secret
+        namespace: '{{ ansible_operator_meta.namespace }}'
+        name: redhat-operators-pull-secret
+      register: _rh_ops_secret
+      no_log: "{{ no_log }}"
+    - name: Create imagePullSecret
+      k8s:
+        state: present
+        definition:
+          apiVersion: v1
+          kind: Secret
+          metadata:
+            name: redhat-operators-pull-secret
+            namespace: '{{ ansible_operator_meta.namespace }}'
+          stringData:
+            operator: awx
+      when:
+        - (_rh_ops_secret is not defined) or not (_rh_ops_secret['resources'] | length)
+  roles:
+    - installer
--- a/requirements.yml
+++ b/requirements.yml
@@ -1,6 +1,6 @@
 ---
 collections:
  - name: kubernetes.core
-    version: '==1.2.1'
+    version: '>=2.3.2'
  - name: operator_sdk.util
-    version: "0.2.0"
+    version: "0.4.0"
--- a/roles/backup/README.md
+++ b/roles/backup/README.md
@@ -45,7 +45,7 @@ The resulting pvc will contain a backup tar that can be used to restore to a new
 Role Variables
 --------------

-A custom, pre-created pvc can be used by setting the following variables.  
+A custom, pre-created pvc can be used by setting the following variables.

 ```
 backup_pvc: 'awx-backup-volume-claim'
@@ -60,10 +60,17 @@ backup_storage_class: 'standard'
 backup_storage_requirements: '20Gi'
 ```

+By default, the backup pvc will be created in the same namespace the awxbackup object is created in.  If you want your backup to be stored
+in a specific namespace, you can do so by specifying `backup_pvc_namespace`.  Keep in mind that you will
+need to provide the same namespace when restoring.
+
+```
+backup_pvc_namespace: 'custom-namespace'
+```
 The backup pvc will be created in the same namespace the awxbackup object is created in.

-If a custom postgres configuration secret was used when deploying AWX, it will automatically be used by the backup role.  
-To check the name of this secret, look at the postgresConfigurationSecret status on your AWX object.  
+If a custom postgres configuration secret was used when deploying AWX, it will automatically be used by the backup role.
+To check the name of this secret, look at the postgresConfigurationSecret status on your AWX object.

 The postgresql pod for the old deployment is used when backing up data to the new postgresql pod.  If your postgresql pod has a custom label,
 you can pass that via the `postgres_label_selector` variable to make sure the postgresql pod can be found.
@@ -74,6 +81,18 @@ It is also possible to tie the lifetime of the backup files to that of the AWXBa
 ```
 clean_backup_on_delete: true
 ```
+
+Variable to define resources limits and request for backup CR.
+```
+backup_resource_requirements:
+  limits:
+    cpu: "1000m"
+    memory: "4096Mi"
+  requests:
+    cpu: "25m"
+    memory: "32Mi"
+```
+
 Testing
 ----------------

--- a/roles/backup/defaults/main.yml
+++ b/roles/backup/defaults/main.yml
@@ -12,7 +12,7 @@ backup_pvc_namespace: "{{ ansible_operator_meta.namespace }}"
 backup_storage_requirements: ''

 # Set no_log settings on certain tasks
-no_log: 'true'
+no_log: true

 # Variable to set when you want backups to be cleaned up when the CRD object is deleted
 clean_backup_on_delete: false
@@ -20,8 +20,17 @@ clean_backup_on_delete: false
 # Variable to signal that this role is being run as a finalizer
 finalizer_run: false

+# Default resource requirements
+backup_resource_requirements:
+  limits:
+    cpu: "1000m"
+    memory: "4096Mi"
+  requests:
+    cpu: "25m"
+    memory: "32Mi"
 # Allow additional parameters to be added to the pg_dump backup command
 pg_dump_suffix: ''

 # Maintain some of the recommended `app.kubernetes.io/*` labels on the resource (self)
 set_self_labels: true
+...
--- a/roles/backup/tasks/finalizer.yml
+++ b/roles/backup/tasks/finalizer.yml
@@ -14,6 +14,7 @@

    - include_tasks: cleanup.yml
  vars:
-    backup_dir: "{{ this_backup['resources'][0]['status']['backupDirectory'] }}"
+    backup_dir: "{{ this_backup['resources'][0]['status']['backupDirectory'] | default() }}"
  when:
-    - clean_backup_on_delete and backup_dir is defined
+    - clean_backup_on_delete
+    - backup_dir | length > 0
--- a/roles/backup/templates/management-pod.yml.j2
+++ b/roles/backup/templates/management-pod.yml.j2
@@ -20,6 +20,10 @@ spec:
    - name: {{ ansible_operator_meta.name }}-backup
      mountPath: /backups
      readOnly: false
+{% if backup_resource_requirements is defined %}
+    resources:
+      {{ backup_resource_requirements | to_nice_yaml(indent=2) | indent(width=6, first=False) }}
+{%- endif %}
  volumes:
    - name: {{ ansible_operator_meta.name }}-backup
      persistentVolumeClaim:
--- a/roles/common/defaults/main.yml
+++ b/roles/common/defaults/main.yml
@@ -0,0 +1,8 @@
+---
+deployment_type: awx
+kind: 'AWX'
+api_version: '{{ deployment_type }}.ansible.com/v1beta1'
+
+# Used to determine some cluster specific logic regarding projects_persistence pvc permissions
+is_k8s: false
+is_openshift: false
--- a/roles/common/meta/main.yml
+++ b/roles/common/meta/main.yml
@@ -0,0 +1,32 @@
+---
+galaxy_info:
+  author: Ansible
+  description: AWX role for AWX Operator for Kubernetes.
+  company: Red Hat, Inc.
+
+  license: MIT
+
+  min_ansible_version: 2.8
+
+  platforms:
+    - name: EL
+      versions:
+        - all
+    - name: Debian
+      versions:
+        - all
+
+  galaxy_tags:
+    - tower
+    - awx
+    - ansible
+    - automation
+    - ci
+    - cd
+    - deployment
+
+dependencies: []
+
+collections:
+  - kubernetes.core
+  - operator_sdk.util
--- a/roles/common/tasks/main.yml
+++ b/roles/common/tasks/main.yml
@@ -0,0 +1,20 @@
+---
+
+- name: Get information about the cluster
+  set_fact:
+    api_groups: "{{ lookup('k8s', cluster_info='api_groups') }}"
+  when:
+  - not is_openshift | bool
+  - not is_k8s | bool
+
+- name: Determine the cluster type
+  set_fact:
+    is_openshift: "{{ True if 'route.openshift.io' in api_groups else False }}"
+    is_k8s: "{{ False if 'route.openshift.io' in api_groups else True }}"
+  when:
+  - not is_openshift | bool
+  - not is_k8s | bool
+
+# Indicate what kind of cluster we are in (OpenShift or Kubernetes).
+- debug:
+    msg: "CLUSTER TYPE: is_openshift={{ is_openshift }}; is_k8s={{ is_k8s }}"
--- a/roles/installer/defaults/main.yml
+++ b/roles/installer/defaults/main.yml
@@ -1,6 +1,6 @@
 ---
 deployment_type: awx
-kind: '{{ deployment_type | upper }}'
+kind: 'AWX'
 api_version: '{{ deployment_type }}.ansible.com/v1beta1'

 database_name: "{{ deployment_type }}"
@@ -9,8 +9,10 @@ database_username: "{{ deployment_type }}"
 task_privileged: false
 service_type: ClusterIP
 ingress_type: none
+ingress_class_name: ''
 ingress_path: '/'
 ingress_path_type: 'Prefix'
+ingress_api_version: 'networking.k8s.io/v1'
 # Add annotations to the service account. Specify as literal block. E.g.:
 # service_account_annotations: |
 #   eks.amazonaws.com/role-arn: arn:aws:iam::<ACCOUNT_ID>:role/<IAM_ROLE_NAME>
@@ -49,6 +51,10 @@ route_tls_termination_mechanism: edge
 #
 route_tls_secret: ''

+# Route API Version to support older version
+# of the kubernetes services
+route_api_version: 'route.openshift.io/v1'
+
 # Host to create the root with.
 # If not specific will default to <instance-name>-<namespace>-<routerCanonicalHostname>
 #
@@ -130,8 +136,6 @@ _redis_image: docker.io/redis
 _redis_image_version: 7
 _postgres_image: postgres
 _postgres_image_version: 13
-_init_container_image: quay.io/centos/centos
-_init_container_image_version: stream8
 image_pull_policy: IfNotPresent
 image_pull_secrets: []

@@ -157,6 +161,9 @@ ee_images:

 _control_plane_ee_image: quay.io/ansible/awx-ee:latest

+_init_container_image: "{{ _control_plane_ee_image.split(':')[0] }}"
+_init_container_image_version: "{{ _control_plane_ee_image.split(':')[1] }}"
+
 create_preload_data: true

 replicas: "1"
@@ -286,7 +293,7 @@ development_mode: false
 security_context_settings: {}

 # Set no_log settings on certain tasks
-no_log: 'true'
+no_log: true

 # Should AWX instances be automatically upgraded when operator gets upgraded
 #
--- a/roles/installer/filter_plugins/cpu_string_to_decimal.py
+++ b/roles/installer/filter_plugins/cpu_string_to_decimal.py
@@ -0,0 +1,27 @@
+# Copyright (c) 2017 Ansible Project
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+from ansible.errors import AnsibleFilterError
+
+__ERROR_MSG = "Not a valid cpu value. Cannot process value"
+
+class FilterModule(object):
+    def filters(self):
+        return {
+            'cpu_string_to_decimal': self.cpu_string_to_decimal
+        }
+    def cpu_string_to_decimal(self, cpu_string):
+
+        # verify if task_output is a dict
+        if not isinstance(cpu_string, str):
+            raise AnsibleFilterError(__ERROR_MSG)
+
+        if cpu_string[-1] == 'm':
+            cpu = int(cpu_string[:-1])//1000
+        else:
+         cpu = int(cpu_string)
+
+        return cpu
--- a/roles/installer/meta/main.yml
+++ b/roles/installer/meta/main.yml
@@ -25,7 +25,8 @@ galaxy_info:
    - cd
    - deployment

-dependencies: []
+dependencies:
+  - role: common

 collections:
  - kubernetes.core
--- a/roles/installer/tasks/admin_password_configuration.yml
+++ b/roles/installer/tasks/admin_password_configuration.yml
@@ -25,7 +25,7 @@
    - name: Create admin password secret
      k8s:
        apply: true
-        definition: "{{ lookup('template', 'admin_password_secret.yaml.j2') }}"
+        definition: "{{ lookup('template', 'secrets/admin_password_secret.yaml.j2') }}"
      no_log: "{{ no_log }}"

    - name: Read admin password secret
--- a/roles/installer/tasks/broadcast_websocket_configuration.yml
+++ b/roles/installer/tasks/broadcast_websocket_configuration.yml
@@ -26,7 +26,7 @@
    - name: Create broadcast websocket secret
      k8s:
        apply: true
-        definition: "{{ lookup('template', 'broadcast_websocket_secret.yaml.j2') }}"
+        definition: "{{ lookup('template', 'secrets/broadcast_websocket_secret.yaml.j2') }}"
      no_log: "{{ no_log }}"

    - name: Read broadcast websocket secret
--- a/roles/installer/tasks/database_configuration.yml
+++ b/roles/installer/tasks/database_configuration.yml
@@ -71,7 +71,7 @@
    - name: Create Database configuration
      k8s:
        apply: true
-        definition: "{{ lookup('template', 'postgres_secret.yaml.j2') }}"
+        definition: "{{ lookup('template', 'secrets/postgres_secret.yaml.j2') }}"
      no_log: "{{ no_log }}"

    - name: Read Database Configuration
@@ -152,7 +152,7 @@
    - name: Create Database if no database is specified
      k8s:
        apply: true
-        definition: "{{ lookup('template', 'postgres.yaml.j2') }}"
+        definition: "{{ lookup('template', 'statefulsets/postgres.yaml.j2') }}"
      register: create_statefulset_result

    - name: Scale down Deployment for migration
@@ -185,7 +185,7 @@
    - name: Recreate PostgreSQL statefulset with updated values
      k8s:
        apply: true
-        definition: "{{ lookup('template', 'postgres.yaml.j2') }}"
+        definition: "{{ lookup('template', 'statefulsets/postgres.yaml.j2') }}"
  when: managed_database

 - name: Set Default label selector for custom resource generated postgres
--- a/roles/installer/tasks/initialize_django.yml
+++ b/roles/installer/tasks/initialize_django.yml
@@ -34,6 +34,7 @@
      bash -c "awx-manage list_instances | grep '^\[tower capacity=[0-9]*\]'"
  register: legacy_queue
  changed_when: false
+  ignore_errors: true

 - name: Unregister legacy queue
  k8s_exec:
--- a/roles/installer/tasks/install.yml
+++ b/roles/installer/tasks/install.yml
@@ -10,12 +10,7 @@
      metadata:
        name: '{{ ansible_operator_meta.name }}'
        namespace: '{{ ansible_operator_meta.namespace }}'
-        labels:
-          app.kubernetes.io/name: '{{ ansible_operator_meta.name }}'
-          app.kubernetes.io/part-of: '{{ ansible_operator_meta.name }}'
-          app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
-          app.kubernetes.io/component: '{{ deployment_type }}'
-          app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
+        labels: '{{ lookup("template", "labels/common.yaml.j2") | from_yaml }}'
  when: set_self_labels | bool

 - name: Include secret key configuration tasks
--- a/roles/installer/tasks/resources_configuration.yml
+++ b/roles/installer/tasks/resources_configuration.yml
@@ -27,6 +27,139 @@
  set_fact:
    _control_plane_ee_image: "{{ _custom_control_plane_ee_image | default(lookup('env', 'RELATED_IMAGE_CONTROL_PLANE_EE')) | default(_control_plane_ee_image, true) }}"

+- name: Check for Receptor CA Secret
+  k8s_info:
+    kind: Secret
+    namespace: '{{ ansible_operator_meta.namespace }}'
+    name: '{{ ansible_operator_meta.name }}-receptor-ca'
+  register: _receptor_ca
+  no_log: "{{ no_log }}"
+
+- name: Migrate Receptor CA Secret
+  when:
+    - _receptor_ca['resources'] | default([]) | length
+    - _receptor_ca['resources'][0]['type'] != "kubernetes.io/tls"
+  block:
+    - name: Delete old Receptor CA Secret
+      k8s:
+        state: absent
+        kind: Secret
+        namespace: '{{ ansible_operator_meta.namespace }}'
+        name: '{{ ansible_operator_meta.name }}-receptor-ca'
+    - name: Create tempfile for receptor-ca.key
+      tempfile:
+        state: file
+        suffix: .key
+      register: _receptor_ca_key_file
+    - name: Copy Receptor CA key from old secret to tempfile
+      copy:
+        content: "{{ _receptor_ca['resources'][0]['data']['receptor-ca.key'] | b64decode }}"
+        dest: "{{ _receptor_ca_key_file.path }}"
+      no_log: "{{ no_log }}"
+    - name: Create tempfile for receptor-ca.crt
+      tempfile:
+        state: file
+        suffix: .crt
+      register: _receptor_ca_crt_file
+    - name: Copy Receptor CA cert from old secret to tempfile
+      copy:
+        content: "{{ _receptor_ca['resources'][0]['data']['receptor-ca.crt'] | b64decode }}"
+        dest: "{{ _receptor_ca_crt_file.path }}"
+      no_log: "{{ no_log }}"
+    - name: Create New Receptor CA secret
+      k8s:
+        apply: true
+        definition: "{{ lookup('template', 'secrets/receptor_ca_secret.yaml.j2') }}"
+      no_log: "{{ no_log }}"
+    - name: Remove tempfiles
+      file:
+        path: "{{ item }}"
+        state: absent
+      loop:
+        - "{{ _receptor_ca_key_file.path }}"
+        - "{{ _receptor_ca_crt_file.path }}"
+
+- name: Create Receptor Mesh CA
+  block:
+    - name: Create tempfile for receptor-ca.key
+      tempfile:
+        state: file
+        suffix: .key
+      register: _receptor_ca_key_file
+    - name: Generate Receptor CA key
+      command: |
+        openssl genrsa -out {{ _receptor_ca_key_file.path }} 4096
+      no_log: "{{ no_log }}"
+    - name: Create tempfile for receptor-ca.crt
+      tempfile:
+        state: file
+        suffix: .crt
+      register: _receptor_ca_crt_file
+    - name: Generate Receptor CA cert
+      command: |
+        openssl req -x509 -new -nodes -key {{ _receptor_ca_key_file.path }} \
+          -subj "/CN={{ ansible_operator_meta.name }} Receptor Root CA" \
+          -sha256 -days 3650 -out {{ _receptor_ca_crt_file.path }}
+      no_log: "{{ no_log }}"
+    - name: Create Receptor CA secret
+      k8s:
+        apply: true
+        definition: "{{ lookup('template', 'secrets/receptor_ca_secret.yaml.j2') }}"
+      no_log: "{{ no_log }}"
+    - name: Remove tempfiles
+      file:
+        path: "{{ item }}"
+        state: absent
+      loop:
+        - "{{ _receptor_ca_key_file.path }}"
+        - "{{ _receptor_ca_crt_file.path }}"
+  when: not _receptor_ca['resources'] | default([]) | length
+
+- name: Check for Receptor work signing Secret
+  k8s_info:
+    kind: Secret
+    namespace: '{{ ansible_operator_meta.namespace }}'
+    name: '{{ ansible_operator_meta.name }}-receptor-work-signing'
+  register: _receptor_work_signing
+  no_log: "{{ no_log }}"
+
+- name: Generate Receptor work signing RSA key pair
+  block:
+    - name: Create tempfile for receptor work signing private key
+      tempfile:
+        state: file
+        suffix: .pem
+      register: _receptor_work_signing_private_key_file
+    - name: Generate Receptor work signing private key
+      command: |
+        openssl genrsa -out {{ _receptor_work_signing_private_key_file.path }} 4096
+      no_log: "{{ no_log }}"
+    - name: Create tempfile for receptor work signing public key
+      tempfile:
+        state: file
+        suffix: .pem
+      register: _receptor_work_signing_public_key_file
+    - name: Generate Receptor work signing public key
+      command: |
+        openssl rsa \
+          -in {{ _receptor_work_signing_private_key_file.path }} \
+          -out {{ _receptor_work_signing_public_key_file.path }} \
+          -outform PEM -pubout
+      no_log: "{{ no_log }}"
+    - name: Create Receptor work signing Secret
+      k8s:
+        apply: true
+        definition: "{{ lookup('template', 'secrets/receptor_work_signing_secret.yaml.j2') }}"
+      no_log: "{{ no_log }}"
+    - name: Remove tempfiles
+      file:
+        path: "{{ item }}"
+        state: absent
+      loop:
+        - "{{ _receptor_work_signing_private_key_file.path }}"
+        - "{{ _receptor_work_signing_public_key_file.path }}"
+  when: not _receptor_work_signing['resources'] | default([]) | length
+
 - name: Apply Resources
  k8s:
    apply: yes
@@ -34,12 +167,12 @@
    wait: yes
  register: tower_resources_result
  loop:
-    - 'config'
-    - 'app_credentials'
-    - 'service_account'
-    - 'persistent'
-    - 'service'
-    - 'ingress'
+    - 'configmaps/config'
+    - 'secrets/app_credentials'
+    - 'rbac/service_account'
+    - 'storage/persistent'
+    - 'networking/service'
+    - 'networking/ingress'
  no_log: "{{ no_log }}"

 - name: Set default awx app image
@@ -75,7 +208,7 @@
 - name: Apply deployment resources
  k8s:
    apply: yes
-    definition: "{{ lookup('template', 'deployment.yaml.j2') }}"
+    definition: "{{ lookup('template', 'deployments/deployment.yaml.j2') }}"
    wait: yes
  register: this_deployment_result

--- a/roles/installer/tasks/secret_key_configuration.yml
+++ b/roles/installer/tasks/secret_key_configuration.yml
@@ -25,7 +25,7 @@
    - name: Create secret key secret
      k8s:
        apply: true
-        definition: "{{ lookup('template', 'secret_key.yaml.j2') }}"
+        definition: "{{ lookup('template', 'secrets/secret_key.yaml.j2') }}"
      no_log: "{{ no_log }}"

    - name: Read secret key secret
--- a/roles/installer/tasks/upgrade_postgres.yml
+++ b/roles/installer/tasks/upgrade_postgres.yml
@@ -22,7 +22,7 @@
 - name: Create Database configuration with new -postgres-{{ supported_pg_version }} hostname
  k8s:
    apply: true
-    definition: "{{ lookup('template', 'postgres_upgrade_secret.yaml.j2') }}"
+    definition: "{{ lookup('template', 'secrets/postgres_upgrade_secret.yaml.j2') }}"
  no_log: "{{ no_log }}"

 - name: Set new database var to be used when configuring app credentials (resources_configuration.yml)
@@ -33,7 +33,7 @@
 - name: Create Database if no database is specified
  k8s:
    apply: true
-    definition: "{{ lookup('template', 'postgres.yaml.j2') }}"
+    definition: "{{ lookup('template', 'statefulsets/postgres.yaml.j2') }}"
    wait: true
  register: create_statefulset_result

@@ -64,7 +64,7 @@

 - name: Set full resolvable host name for postgres pod
  set_fact:
-    resolvable_db_host: "{{ ansible_operator_meta.name }}-postgres.{{ ansible_operator_meta.namespace }}.svc.cluster.local"  # yamllint disable-line rule:line-length
+    resolvable_db_host: "{{ ansible_operator_meta.name }}-postgres.{{ ansible_operator_meta.namespace }}.svc"  # yamllint disable-line rule:line-length
  no_log: "{{ no_log }}"

 - name: Set pg_dump command
--- a/roles/installer/templates/configmaps/config.yaml.j2
+++ b/roles/installer/templates/configmaps/config.yaml.j2
@@ -18,7 +18,8 @@ data:
  settings: |
    import os
    import socket
-    from django_auth_ldap.config import LDAPSearch
+    # Import all so that extra_settings works properly
+    from django_auth_ldap.config import *
    
    def get_secret():
        if os.path.exists("/etc/tower/SECRET_KEY"):
@@ -32,20 +33,29 @@ data:

    IS_K8S = True

+{% if "limits" in task_resource_requirements and "memory" in task_resource_requirements["limits"] %}
    # Set memory available based off of resource request/limit for the task pod
-    memory_limit = '{{ task_resource_requirements["limits"]["memory"] if "limits" in task_resource_requirements and "memory" in task_resource_requirements["limits"] }}'
-    if memory_limit:
-        SYSTEM_TASK_ABS_MEM = memory_limit
+    SYSTEM_TASK_ABS_MEM = '{{ task_resource_requirements["limits"]["memory"] }}'
+{% endif %}

+{% if "limits" in task_resource_requirements and "cpu" in task_resource_requirements["limits"] %}
    # Set cpu available based off of resource request/limit for the task pod
-    cpu_limit = '{{ task_resource_requirements["limits"]["cpu"] if "limits" in task_resource_requirements and "cpu" in task_resource_requirements["limits"] }}'
-    if cpu_limit:
-        SYSTEM_TASK_ABS_CPU = cpu_limit
+    SYSTEM_TASK_ABS_CPU = '{{ task_resource_requirements["limits"]["cpu"] }}'
+{% endif %}
+
+{%- set cpu_limit = task_resource_requirements["limits"]["cpu"] if "limits" in task_resource_requirements and "cpu" in task_resource_requirements["limits"] -%}
+{%- if cpu_limit is defined -%}
+{%- set callback_receiver_cpu = cpu_limit | cpu_string_to_decimal -%}
+{%- if callback_receiver_cpu |int > 4 %}
+    # Set callback receiver workers based off cpu limit, default workers are 4, but if we have more than 4 cpu we can set higher value for workers
+    JOB_EVENT_WORKERS = {{ callback_receiver_cpu }}
+{%- endif -%}
+{%- endif %}

    SECRET_KEY = get_secret()
-    
+
    ALLOWED_HOSTS = ['*']
-    
+
    INTERNAL_API_URL = 'http://127.0.0.1:8052'

    # Sets Ansible Collection path
@@ -72,35 +82,12 @@ data:
    EMAIL_HOST_USER = ''
    EMAIL_HOST_PASSWORD = ''
    EMAIL_USE_TLS = False
-    
-    LOGGING['handlers']['console'] = {
-        '()': 'logging.StreamHandler',
-        'level': 'DEBUG',
-        'formatter': 'simple',
-        'filters': ['guid'],
-    }
-    
-    LOGGING['loggers']['django.request']['handlers'] = ['console']
-    LOGGING['loggers']['rest_framework.request']['handlers'] = ['console']
-    LOGGING['loggers']['awx']['handlers'] = ['console', 'external_logger']
-    LOGGING['loggers']['awx.main.commands.run_callback_receiver']['handlers'] = ['console']
-    LOGGING['loggers']['awx.main.tasks']['handlers'] = ['console', 'external_logger']
-    LOGGING['loggers']['awx.main.scheduler']['handlers'] = ['console', 'external_logger']
-    LOGGING['loggers']['django_auth_ldap']['handlers'] = ['console']
-    LOGGING['loggers']['social']['handlers'] = ['console']
-    LOGGING['loggers']['system_tracking_migrations']['handlers'] = ['console']
-    LOGGING['loggers']['rbac_migrations']['handlers'] = ['console']
-    LOGGING['handlers']['callback_receiver'] = {'class': 'logging.NullHandler'}
-    LOGGING['handlers']['task_system'] = {'class': 'logging.NullHandler'}
-    LOGGING['handlers']['tower_warnings'] = {'class': 'logging.NullHandler'}
-    LOGGING['handlers']['rbac_migrations'] = {'class': 'logging.NullHandler'}
-    LOGGING['handlers']['system_tracking_migrations'] = {'class': 'logging.NullHandler'}
-    LOGGING['handlers']['management_playbooks'] = {'class': 'logging.NullHandler'}

    USE_X_FORWARDED_PORT = True
    BROADCAST_WEBSOCKET_PORT = 8052
    BROADCAST_WEBSOCKET_PROTOCOL = 'http'

+
 {% for item in extra_settings | default([]) %}
    {{ item.setting }} = {{ item.value }}
 {% endfor %}
@@ -249,30 +236,38 @@ data:
  receptor_conf: |
    ---
    - log-level: debug
-
+    - local-only: null
+    - node:
+       firewallrules:
+        - action: reject
+          tonode: HOSTNAME
+          toservice: control
    - control-service:
        service: control
        filename: /var/run/receptor/receptor.sock
-        permissions: 0660
-
-    - local-only:
-
+        permissions: '0660'
    - work-command:
        worktype: local
        command: ansible-runner
        params: worker
        allowruntimeparams: true
-
    - work-kubernetes:
        worktype: kubernetes-runtime-auth
        authmethod: runtime
        allowruntimeauth: true
        allowruntimepod: true
        allowruntimeparams: true
-
    - work-kubernetes:
        worktype: kubernetes-incluster-auth
        authmethod: incluster
        allowruntimeauth: true
        allowruntimepod: true
        allowruntimeparams: true
+    - tls-client:
+        cert: /etc/receptor/tls/receptor.crt
+        key: /etc/receptor/tls/receptor.key
+        name: tlsclient
+        rootcas: /etc/receptor/tls/ca/receptor-ca.crt
+    - work-signing:
+        privatekey: /etc/receptor/signing/work-private-key.pem
+        tokenexpiration: 1m
--- a/roles/installer/templates/deployments/deployment.yaml.j2
+++ b/roles/installer/templates/deployments/deployment.yaml.j2
@@ -6,12 +6,8 @@ metadata:
  name: '{{ ansible_operator_meta.name }}'
  namespace: '{{ ansible_operator_meta.namespace }}'
  labels:
-    app.kubernetes.io/name: '{{ ansible_operator_meta.name }}'
-    app.kubernetes.io/version: '{{ _image.split(':')[-1] | truncate(63, True, '') }}'
-    app.kubernetes.io/part-of: '{{ ansible_operator_meta.name }}'
-    app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
-    app.kubernetes.io/component: '{{ deployment_type }}'
-    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
+    {{ lookup("template", "labels/common.yaml.j2")  | indent(width=4) | trim }}
+    {{ lookup("template", "labels/version.yaml.j2") | indent(width=4) | trim }}
 spec:
  replicas: {{ replicas }}
  selector:
@@ -22,11 +18,8 @@ spec:
  template:
    metadata:
      labels:
-        app.kubernetes.io/name: '{{ ansible_operator_meta.name }}'
-        app.kubernetes.io/version: '{{ _image.split(':')[-1] | truncate(63, True, '') }}'
-        app.kubernetes.io/part-of: '{{ ansible_operator_meta.name }}'
-        app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
-        app.kubernetes.io/component: '{{ deployment_type }}'
+        {{ lookup("template", "labels/common.yaml.j2")  | indent(width=8) | trim }}
+        {{ lookup("template", "labels/version.yaml.j2") | indent(width=8) | trim }}
 {% if annotations %}
      annotations:
        {{ annotations | indent(width=8) }}
@@ -46,26 +39,44 @@ spec:
      priorityClassName: '{{ control_plane_priority_class }}'
 {% endif %}
      initContainers:
-{% if bundle_ca_crt or projects_persistence|bool or init_container_extra_commands %}
        - name: init
          image: '{{ _init_container_image }}'
          imagePullPolicy: '{{ image_pull_policy }}'
+          resources: {{ task_resource_requirements }}
          command:
            - /bin/sh
            - -c
            - |
+              hostname=$MY_POD_NAME
+              receptor --cert-makereq bits=2048 commonname=$hostname dnsname=$hostname nodeid=$hostname outreq=/etc/receptor/tls/receptor.req outkey=/etc/receptor/tls/receptor.key
+              receptor --cert-signreq req=/etc/receptor/tls/receptor.req cacert=/etc/receptor/tls/ca/receptor-ca.crt cakey=/etc/receptor/tls/ca/receptor-ca.key outcert=/etc/receptor/tls/receptor.crt verify=yes
 {% if bundle_ca_crt  %}
              mkdir -p /etc/pki/ca-trust/extracted/{java,pem,openssl,edk2}
              update-ca-trust
 {% endif %}
-{% if projects_persistence|bool %}
+{% if projects_persistence|bool and is_k8s|bool %}
              chmod 775 /var/lib/awx/projects
              chgrp 1000 /var/lib/awx/projects
 {% endif %}
 {% if init_container_extra_commands %}
              {{ init_container_extra_commands | indent(width=14) }}
 {% endif %}
+          env:
+            - name: MY_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
          volumeMounts:
+            - name: "{{ ansible_operator_meta.name }}-receptor-ca"
+              mountPath: "/etc/receptor/tls/ca/receptor-ca.crt"
+              subPath: "tls.crt"
+              readOnly: true
+            - name: "{{ ansible_operator_meta.name }}-receptor-ca"
+              mountPath: "/etc/receptor/tls/ca/receptor-ca.key"
+              subPath: "tls.key"
+              readOnly: true
+            - name: "{{ ansible_operator_meta.name }}-receptor-tls"
+              mountPath: "/etc/receptor/tls/"
 {% if bundle_ca_crt  %}
            - name: "ca-trust-extracted"
              mountPath: "/etc/pki/ca-trust/extracted"
@@ -74,13 +85,12 @@ spec:
              subPath: bundle-ca.crt
              readOnly: true
 {% endif %}
-{% if projects_persistence|bool %}
+{% if projects_persistence|bool and is_k8s|bool %}
            - name: "{{ ansible_operator_meta.name }}-projects"
              mountPath: "/var/lib/awx/projects"
 {% endif %}
 {% if init_container_extra_volume_mounts -%}
-            {{ init_container_extra_volume_mounts | indent(width=12, indentfirst=True) }}
-{% endif %}
+            {{ init_container_extra_volume_mounts | indent(width=12, first=True) }}
 {% endif %}
      containers:
        - image: '{{ _redis_image }}'
@@ -170,12 +180,24 @@ spec:
              mountPath: "/var/lib/awx/rsyslog"
            - name: "{{ ansible_operator_meta.name }}-projects"
              mountPath: "/var/lib/awx/projects"
+            - name: "{{ ansible_operator_meta.name }}-receptor-work-signing"
+              mountPath: "/etc/receptor/signing/work-public-key.pem"
+              subPath: "work-public-key.pem"
+              readOnly: true
+            - name: "{{ ansible_operator_meta.name }}-receptor-ca"
+              mountPath: "/etc/receptor/tls/ca/receptor-ca.crt"
+              subPath: "tls.crt"
+              readOnly: true
+            - name: "{{ ansible_operator_meta.name }}-receptor-ca"
+              mountPath: "/etc/receptor/tls/ca/receptor-ca.key"
+              subPath: "tls.key"
+              readOnly: true
 {% if development_mode | bool %}
            - name: awx-devel
              mountPath: "/awx_devel"
 {% endif %}
 {% if web_extra_volume_mounts -%}
-            {{ web_extra_volume_mounts | indent(width=12, indentfirst=True) }}
+            {{ web_extra_volume_mounts | indent(width=12, first=True) }}
 {% endif %}
          env:
            - name: MY_POD_NAMESPACE
@@ -189,7 +211,7 @@ spec:
              value: "1"
 {% endif %}
 {% if web_extra_env -%}
-            {{ web_extra_env | indent(width=12, indentfirst=True) }}
+            {{ web_extra_env | indent(width=12, first=True) }}
 {% endif %}
          resources: {{ web_resource_requirements }}
        - image: '{{ _image }}'
@@ -243,8 +265,10 @@ spec:
            - name: rsyslog-dir
              mountPath: "/var/lib/awx/rsyslog"
            - name: "{{ ansible_operator_meta.name }}-receptor-config"
-              mountPath: "/etc/receptor/receptor.conf"
-              subPath: receptor.conf
+              mountPath: "/etc/receptor/"
+            - name: "{{ ansible_operator_meta.name }}-receptor-work-signing"
+              mountPath: "/etc/receptor/signing/work-private-key.pem"
+              subPath: "work-private-key.pem"
              readOnly: true
            - name: receptor-socket
              mountPath: "/var/run/receptor"
@@ -255,7 +279,7 @@ spec:
              mountPath: "/awx_devel"
 {% endif %}
 {% if task_extra_volume_mounts -%}
-            {{ task_extra_volume_mounts | indent(width=12, indentfirst=True) }}
+            {{ task_extra_volume_mounts | indent(width=12, first=True) }}
 {% endif %}
          env:
            - name: SUPERVISOR_WEB_CONFIG_PATH
@@ -279,14 +303,22 @@ spec:
              value: "1"
 {% endif %}
 {% if task_extra_env -%}
-            {{ task_extra_env | indent(width=12, indentfirst=True) }}
+            {{ task_extra_env | indent(width=12, first=True) }}
 {% endif %}
          resources: {{ task_resource_requirements }}
        - image: '{{ _control_plane_ee_image }}'
          name: '{{ ansible_operator_meta.name }}-ee'
          imagePullPolicy: '{{ image_pull_policy }}'
          resources: {{ ee_resource_requirements }}
-          args: ['receptor', '--config', '/etc/receptor/receptor.conf']
+          args:
+            - /bin/sh
+            - -c
+            - |
+              if [ ! -f /etc/receptor/receptor.conf ]; then
+                cp /etc/receptor/receptor-default.conf /etc/receptor/receptor.conf
+                sed -i "s/HOSTNAME/$HOSTNAME/g" /etc/receptor/receptor.conf
+              fi
+              exec receptor --config /etc/receptor/receptor.conf
          volumeMounts:
 {% if bundle_ca_crt %}
            - name: "ca-trust-extracted"
@@ -296,16 +328,27 @@ spec:
              subPath: bundle-ca.crt
              readOnly: true
 {% endif %}
-            - name: "{{ ansible_operator_meta.name }}-receptor-config"
-              mountPath: "/etc/receptor/receptor.conf"
+            - name: "{{ ansible_operator_meta.name }}-default-receptor-config"
+              mountPath: "/etc/receptor/receptor-default.conf"
              subPath: receptor.conf
+            - name: "{{ ansible_operator_meta.name }}-receptor-config"
+              mountPath: "/etc/receptor/"
+            - name: "{{ ansible_operator_meta.name }}-receptor-ca"
+              mountPath: "/etc/receptor/tls/ca/receptor-ca.crt"
+              subPath: "tls.crt"
              readOnly: true
+            - name: "{{ ansible_operator_meta.name }}-receptor-work-signing"
+              mountPath: "/etc/receptor/signing/work-private-key.pem"
+              subPath: "work-private-key.pem"
+              readOnly: true
+            - name: "{{ ansible_operator_meta.name }}-receptor-tls"
+              mountPath: "/etc/receptor/tls/"
            - name: receptor-socket
              mountPath: "/var/run/receptor"
            - name: "{{ ansible_operator_meta.name }}-projects"
              mountPath: "/var/lib/awx/projects"
 {% if ee_extra_volume_mounts -%}
-            {{ ee_extra_volume_mounts | indent(width=12, indentfirst=True) }}
+            {{ ee_extra_volume_mounts | indent(width=12, first=True) }}
 {% endif %}
          env:
 {% if development_mode | bool %}
@@ -315,7 +358,7 @@ spec:
                  fieldPath: status.podIP
 {% endif %}
 {% if ee_extra_env -%}
-            {{ ee_extra_env | indent(width=12, indentfirst=True) }}
+            {{ ee_extra_env | indent(width=12, first=True) }}
 {% endif %}
 {% if node_selector %}
      nodeSelector:
@@ -329,9 +372,9 @@ spec:
      tolerations:
        {{ tolerations | indent(width=8) }}
 {% endif %}
-{% if projects_persistence|bool or (security_context_settings|length) %}
+{% if (projects_persistence|bool and is_k8s|bool) or (security_context_settings|length) %}
      securityContext:
-{% if projects_persistence|bool %}
+{% if projects_persistence|bool and is_k8s|bool %}
        fsGroup: 1000
 {% endif %}
 {% if security_context_settings|length %}
@@ -377,6 +420,14 @@ spec:
                path: 'ldap.py'
              - key: execution_environments.py
                path: 'execution_environments.py'
+        - name: "{{ ansible_operator_meta.name }}-receptor-tls"
+          emptyDir: {}
+        - name: "{{ ansible_operator_meta.name }}-receptor-ca"
+          secret:
+            secretName: "{{ ansible_operator_meta.name }}-receptor-ca"
+        - name: "{{ ansible_operator_meta.name }}-receptor-work-signing"
+          secret:
+            secretName: "{{ ansible_operator_meta.name }}-receptor-work-signing"
        - name: "{{ secret_key_secret_name }}"
          secret:
            secretName: '{{ secret_key_secret_name }}'
@@ -414,6 +465,8 @@ spec:
        - name: rsyslog-dir
          emptyDir: {}
        - name: {{ ansible_operator_meta.name }}-receptor-config
+          emptyDir: {}
+        - name: {{ ansible_operator_meta.name }}-default-receptor-config
          configMap:
            name: '{{ ansible_operator_meta.name }}-{{ deployment_type }}-configmap'
            items:
@@ -436,5 +489,5 @@ spec:
            path: /awx_devel
 {% endif %}
 {% if extra_volumes -%}
-        {{ extra_volumes | indent(width=8, indentfirst=True) }}
+        {{ extra_volumes | indent(width=8, first=True) }}
 {% endif %}
--- a/roles/installer/templates/labels/common.yaml.j2
+++ b/roles/installer/templates/labels/common.yaml.j2
@@ -0,0 +1,6 @@
+# https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/
+app.kubernetes.io/name: '{{ ansible_operator_meta.name }}'
+app.kubernetes.io/part-of: '{{ ansible_operator_meta.name }}'
+app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
+app.kubernetes.io/component: '{{ deployment_type }}'
+app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
--- a/roles/installer/templates/labels/version.yaml.j2
+++ b/roles/installer/templates/labels/version.yaml.j2
@@ -0,0 +1 @@
+app.kubernetes.io/version: '{{ _image.split(':')[-1] | truncate(63, True, '', 0) }}'
--- a/roles/installer/templates/networking/ingress.yaml.j2
+++ b/roles/installer/templates/networking/ingress.yaml.j2
@@ -1,6 +1,8 @@
 {% if ingress_type|lower == "ingress" %}
 ---
-apiVersion: networking.k8s.io/v1
+{% if ingress_api_version is defined %}
+apiVersion: '{{ ingress_api_version }}'
+{% endif %}
 kind: Ingress
 metadata:
  name: '{{ ansible_operator_meta.name }}-ingress'
@@ -16,6 +18,9 @@ metadata:
    {{ ingress_annotations | indent(width=4) }}
 {% endif %}
 spec:
+{% if ingress_class_name %}
+  ingressClassName: '{{ ingress_class_name }}'
+{% endif %}
  rules:
    - http:
        paths:
@@ -39,7 +44,9 @@ spec:

 {% if ingress_type|lower == "route" %}
 ---
-apiVersion: route.openshift.io/v1
+{% if route_api_version is defined %}
+apiVersion: '{{ route_api_version }}'
+{% endif %}
 kind: Route
 metadata:
  name: '{{ ansible_operator_meta.name }}'
@@ -61,12 +68,12 @@ spec:
    termination: {{ route_tls_termination_mechanism | lower }}
 {% if route_tls_termination_mechanism | lower == 'edge' and route_tls_secret != '' %}
    key: |-
-{{ route_tls_key | indent(width=6, indentfirst=True) }}
+{{ route_tls_key | indent(width=6, first=True) }}
    certificate: |-
-{{ route_tls_crt | indent(width=6, indentfirst=True) }}
+{{ route_tls_crt | indent(width=6, first=True) }}
 {% if route_ca_crt is defined %}
    caCertificate: |-
-{{ route_ca_crt | indent(width=6, indentfirst=True) }}
+{{ route_ca_crt | indent(width=6, first=True) }}
 {% endif %}
 {% endif %}
  to:
--- a/roles/installer/templates/networking/service.yaml.j2
+++ b/roles/installer/templates/networking/service.yaml.j2
--- a/roles/installer/templates/rbac/service_account.yaml.j2
+++ b/roles/installer/templates/rbac/service_account.yaml.j2
--- a/roles/installer/templates/secrets/admin_password_secret.yaml.j2
+++ b/roles/installer/templates/secrets/admin_password_secret.yaml.j2
--- a/roles/installer/templates/secrets/app_credentials.yaml.j2
+++ b/roles/installer/templates/secrets/app_credentials.yaml.j2
@@ -12,6 +12,6 @@ metadata:
    app.kubernetes.io/component: '{{ deployment_type }}'
    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
 data:
-  credentials.py: "{{ lookup('template', 'credentials.py.j2') | b64encode }}"
-  ldap.py: "{{ lookup('template', 'ldap.py.j2') | b64encode }}"
-  execution_environments.py: "{{ lookup('template', 'execution_environments.py.j2') | b64encode }}"
+  credentials.py: "{{ lookup('template', 'settings/credentials.py.j2') | b64encode }}"
+  ldap.py: "{{ lookup('template', 'settings/ldap.py.j2') | b64encode }}"
+  execution_environments.py: "{{ lookup('template', 'settings/execution_environments.py.j2') | b64encode }}"
--- a/roles/installer/templates/secrets/broadcast_websocket_secret.yaml.j2
+++ b/roles/installer/templates/secrets/broadcast_websocket_secret.yaml.j2
--- a/roles/installer/templates/secrets/postgres_secret.yaml.j2
+++ b/roles/installer/templates/secrets/postgres_secret.yaml.j2
--- a/roles/installer/templates/secrets/postgres_upgrade_secret.yaml.j2
+++ b/roles/installer/templates/secrets/postgres_upgrade_secret.yaml.j2
--- a/roles/installer/templates/secrets/receptor_ca_secret.yaml.j2
+++ b/roles/installer/templates/secrets/receptor_ca_secret.yaml.j2
@@ -0,0 +1,16 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: '{{ ansible_operator_meta.name }}-receptor-ca'
+  namespace: '{{ ansible_operator_meta.namespace }}'
+  labels:
+    app.kubernetes.io/name: '{{ ansible_operator_meta.name }}'
+    app.kubernetes.io/part-of: '{{ ansible_operator_meta.name }}'
+    app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
+    app.kubernetes.io/component: '{{ deployment_type }}'
+    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
+type: kubernetes.io/tls
+data:
+  tls.crt: '{{ lookup('file', '{{ _receptor_ca_crt_file.path }}') | b64encode }}'
+  tls.key: '{{ lookup('file', '{{ _receptor_ca_key_file.path }}') | b64encode }}'
--- a/roles/installer/templates/secrets/receptor_work_signing_secret.yaml.j2
+++ b/roles/installer/templates/secrets/receptor_work_signing_secret.yaml.j2
@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: '{{ ansible_operator_meta.name }}-receptor-work-signing'
+  namespace: '{{ ansible_operator_meta.namespace }}'
+  labels:
+    app.kubernetes.io/name: '{{ ansible_operator_meta.name }}'
+    app.kubernetes.io/part-of: '{{ ansible_operator_meta.name }}'
+    app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
+    app.kubernetes.io/component: '{{ deployment_type }}'
+    app.kubernetes.io/operator-version: '{{ lookup("env", "OPERATOR_VERSION") }}'
+data:
+  work-private-key.pem: '{{ lookup('file', '{{ _receptor_work_signing_private_key_file.path }}') | b64encode }}'
+  work-public-key.pem: '{{ lookup('file', '{{ _receptor_work_signing_public_key_file.path }}') | b64encode }}'
--- a/roles/installer/templates/secrets/secret_key.yaml.j2
+++ b/roles/installer/templates/secrets/secret_key.yaml.j2
--- a/roles/installer/templates/settings/credentials.py.j2
+++ b/roles/installer/templates/settings/credentials.py.j2
--- a/roles/installer/templates/settings/execution_environments.py.j2
+++ b/roles/installer/templates/settings/execution_environments.py.j2
--- a/roles/installer/templates/settings/ldap.py.j2
+++ b/roles/installer/templates/settings/ldap.py.j2
--- a/roles/installer/templates/statefulsets/postgres.yaml.j2
+++ b/roles/installer/templates/statefulsets/postgres.yaml.j2
--- a/roles/installer/templates/storage/persistent.yaml.j2
+++ b/roles/installer/templates/storage/persistent.yaml.j2
--- a/roles/restore/README.md
+++ b/roles/restore/README.md
@@ -35,9 +35,9 @@ spec:
  backup_name: awxbackup-2021-04-22
 ```

-Note that the `deployment_name` above is the name of the AWX deployment you intend to create and restore to.  
+Note that the `deployment_name` above is the name of the AWX deployment you intend to create and restore to.

-The namespace specified is the namespace the resulting AWX deployment will be in.  The namespace you specified must be pre-created.  
+The namespace specified is the namespace the resulting AWX deployment will be in.  The namespace you specified must be pre-created.

 ```
 kubectl create ns my-namespace
@@ -57,7 +57,7 @@ This will create a new deployment and restore your backup to it.
 Role Variables
 --------------

-The name of the backup directory can be found as a status on your AWXBackup object.  This can be found in your cluster's console, or with the client as shown below.  
+The name of the backup directory can be found as a status on your AWXBackup object.  This can be found in your cluster's console, or with the client as shown below.

 ```bash
 $ kubectl get awxbackup awxbackup1 -o jsonpath="{.items[0].status.backupDirectory}"
@@ -69,7 +69,7 @@ backup_dir: '/backups/tower-openshift-backup-2021-04-02-03:25:08'
 ```


-The name of the PVC can also be found by looking at the backup object.  
+The name of the PVC can also be found by looking at the backup object.

 ```bash
 $ kubectl get awxbackup awxbackup1 -o jsonpath="{.items[0].status.backupClaim}"
@@ -95,6 +95,17 @@ backup_pvc: myoldtower-backup-claim
 backup_dir: /backups/tower-openshift-backup-2021-04-02-03:25:08
 ```

+Variable to define resources limits and request for restore CR.
+
+```
+restore_resource_requirements:
+  limits:
+    cpu: "1000m"
+    memory: "4096Mi"
+  requests:
+    cpu: "25m"
+    memory: "32Mi"
+```

 Testing
 ----------------
--- a/roles/restore/defaults/main.yml
+++ b/roles/restore/defaults/main.yml
@@ -12,7 +12,17 @@ backup_pvc_namespace: '{{ ansible_operator_meta.namespace }}'
 backup_dir: ''

 # Set no_log settings on certain tasks
-no_log: 'true'
+no_log: true
+
+# Default resource requirements
+restore_resource_requirements:
+  limits:
+    cpu: "1000m"
+    memory: "4096Mi"
+  requests:
+    cpu: "25m"
+    memory: "32Mi"

 # Maintain some of the recommended `app.kubernetes.io/*` labels on the resource (self)
 set_self_labels: true
+...
--- a/roles/restore/tasks/init.yml
+++ b/roles/restore/tasks/init.yml
@@ -2,37 +2,37 @@

 - name: Set variables from awxbackup object statuses if provided
  block:
-  - name: Look up details for the backup
-    k8s_info:
-      api_version: "{{ backup_api_version }}"
-      kind: "{{ backup_kind }}"
-      name: "{{ backup_name }}"
-      namespace: "{{ backup_pvc_namespace }}"
-    register: this_backup
+    - name: Look up details for the backup
+      k8s_info:
+        api_version: "{{ backup_api_version }}"
+        kind: "{{ backup_kind }}"
+        name: "{{ backup_name }}"
+        namespace: "{{ backup_pvc_namespace }}"
+      register: this_backup

-  - name: Surface error to user
-    block:
-      - name: Set error message
-        set_fact:
-          error_msg: "Cannot read the backup status variables for {{ backup_kind }} {{ backup_name  }}."
+    - name: Surface error to user
+      block:
+        - name: Set error message
+          set_fact:
+            error_msg: "Cannot read the backup status variables for {{ backup_kind }} {{ backup_name  }}."

-      - name: Handle error
-        import_tasks: error_handling.yml
+        - name: Handle error
+          import_tasks: error_handling.yml

-      - name: Fail early if pvc is defined but does not exist
-        fail:
-          msg: "{{ error_msg }}"
-    when:
-      - this_backup['resources'] | length == 0
-      - this_backup['resources'][0] is not defined
-      - this_backup['resources'][0]['status'] is not defined
-      - this_backup['resources'][0]['status']['backupClaim'] is not defined
-      - this_backup['resources'][0]['status']['backupDirectory'] is not defined
+        - name: Fail early if pvc is defined but does not exist
+          fail:
+            msg: "{{ error_msg }}"
+      when:
+        - this_backup['resources'] | length == 0
+        - this_backup['resources'][0] is not defined
+        - this_backup['resources'][0]['status'] is not defined
+        - this_backup['resources'][0]['status']['backupClaim'] is not defined
+        - this_backup['resources'][0]['status']['backupDirectory'] is not defined

-  - name: Set backup facts
-    set_fact:
-      backup_pvc: "{{ this_backup['resources'][0]['status']['backupClaim'] }}"
-      backup_dir: "{{ this_backup['resources'][0]['status']['backupDirectory'] }}"
+    - name: Set backup facts
+      set_fact:
+        backup_pvc: "{{ this_backup['resources'][0]['status']['backupClaim'] }}"
+        backup_dir: "{{ this_backup['resources'][0]['status']['backupDirectory'] }}"
  when:
    - backup_name != '' or backup_name is defined

--- a/roles/restore/templates/management-pod.yml.j2
+++ b/roles/restore/templates/management-pod.yml.j2
@@ -20,6 +20,10 @@ spec:
    - name: {{ ansible_operator_meta.name }}-backup
      mountPath: /backups
      readOnly: false
+{% if restore_resource_requirements is defined %}
+    resources:
+      {{ restore_resource_requirements | to_nice_yaml(indent=2) | indent(width=6, first=False) }}
+{%- endif %}
  volumes:
    - name: {{ ansible_operator_meta.name }}-backup
      persistentVolumeClaim:
--- a/vendor/galaxy.ansible.com/kubernetes/core/kubernetes-core-1.1.1.tar.gz
+++ b/vendor/galaxy.ansible.com/kubernetes/core/kubernetes-core-1.1.1.tar.gz
--- a/vendor/galaxy.ansible.com/kubernetes/core/kubernetes-core-2.3.2.tar.gz
+++ b/vendor/galaxy.ansible.com/kubernetes/core/kubernetes-core-2.3.2.tar.gz
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Christian Adams	1cf466def2	Add expected postgres version and usage docs (#1103 )	2022-10-28 15:54:14 -04:00
sivateja04	0fc145b6aa	Enable configuration of route and ingress api versions (#1098 ) * Introduce ingress_api_version and route_api_version	2022-10-26 08:51:15 -04:00
Shane McDonald	e30d26cf7b	Merge pull request #1100 from AlanCoding/still_not_fixed Version 4.0.3 still not fixed, pin to before	2022-10-25 16:50:34 -04:00
Alan Rominger	7c4a731995	Version 4.0.3 still not fixed, pin to before	2022-10-25 16:10:33 -04:00
Dimitri Savineau	d2efea08e6	ci: Add check for no_log statement (#1096 ) Since `e966e92` we're using the `no_log` variable to control the no_log statement value. This job will check if the no_log statements are correctly set. Signed-off-by: Dimitri Savineau <dsavinea@redhat.com>	2022-10-24 14:37:27 -04:00
Julen Landa Alustiza	23e94f82c0	Merge pull request #1091 from Zokormazo/pin-molecule Avoid molecule 4.0.2	2022-10-18 12:43:40 +02:00
Julen Landa Alustiza	de2e58f222	Avoid molecule 4.0.2 Signed-off-by: Julen Landa Alustiza <jlanda@redhat.com>	2022-10-18 12:29:19 +02:00
Christian Adams	1c7c89efb3	Use Task container resource requirements for init container (#1084 )	2022-10-13 12:27:51 -04:00
Ompragash Viswanathan	096fe100f7	Update config/manifests/bases/awx-operator.clusterserviceversion.yaml (#1083 )	2022-10-12 14:12:06 -04:00
Christian Adams	58ee2f0c74	Be consistent when naming form entries and with capitalization (#1082 )	2022-10-12 11:52:45 -04:00
Shane McDonald	93f7484f38	Merge pull request #1077 from chris93111/patch-1 fix templating config 0.30	2022-10-06 19:37:42 -04:00
chris93111	225c47dbbc	fix templating config indent the comment and remove last -	2022-10-06 13:21:52 +02:00
Christian Adams	2daf8a1320	Add CSV description for OperatorHub (#1072 )	2022-10-05 09:17:18 -04:00
Julen Landa Alustiza	5772c706d3	Merge pull request #1073 from Zokormazo/truncate-labels Fix version label truncating	2022-10-05 11:02:26 +02:00
Julen Landa Alustiza	ae0a74bea3	Fix version label truncating Signed-off-by: Julen Landa Alustiza <jlanda@redhat.com>	2022-10-05 10:49:47 +02:00
Christian Adams	97cd7a9b7a	Clarify Restore options in Openshift UI interface (#924 )	2022-10-05 00:40:40 -04:00
Dimitri Savineau	0975663a52	csv: Use booleanSwitch for no_log parameter (#1071 ) Set the no_log default value in the CRDs and switch from hidden to boolean in the CSV file so this can be display properly in the UI. Signed-off-by: Dimitri Savineau <dsavinea@redhat.com>	2022-10-04 23:59:43 -04:00
Dimitri Savineau	efdbd61860	csv: Add missing no_log to backup/restore (#1070 ) `e966e92` adds the configurable no_log parameter to all CRDs (install, backup and restore) but only once in the CSV file (for installer). Signed-off-by: Dimitri Savineau <dsavinea@redhat.com>	2022-10-04 14:10:07 -04:00
Dimitri Savineau	13b45cbb12	Merge pull request #1069 from rooftopcellist/no_log_more More no_log default updates	2022-10-04 11:49:54 -04:00
Christian M. Adams	d3ca9c57c9	One more no_log default update	2022-10-04 11:36:56 -04:00
Christian Adams	9b1b5e676d	Change no_log type to boolean (#1068 )	2022-10-04 10:48:51 -04:00
Hao Liu	17eb9cf8e8	Merge pull request #1061 from fosterseth/add_custom_ca_docs Add docs for adding execution nodes and custom CA	2022-10-03 16:23:42 -04:00
Seth Foster	ed7e2b2a28	Add docs for adding execution nodes and custom CA	2022-09-29 15:54:29 -04:00
Hao Liu	5b7589accd	Merge pull request #1063 from TheRealHaoLiu/receptor-ca-secret-alternative	2022-09-29 02:04:50 -04:00
janorn	a1e289e189	Add workaround to populate index.yaml (#1065 ) This will download all releases before cr index is being run. fixes #1053	2022-09-28 23:51:05 -04:00
Hao Liu	0611f3efaa	add migration code for receptor ca secret Signed-off-by: Hao Liu <haoli@redhat.com>	2022-09-28 16:22:20 -04:00
Hao Liu	a94a6f045d	change receptor ca secret to tls secret change the type of secret use for receptor ca to tls secret, to be more "proper" Signed-off-by: Hao Liu <haoli@redhat.com>	2022-09-27 21:38:07 -04:00
Christian Adams	1892b8f0ea	Explicitly set kind value to AWX (#1056 )	2022-09-20 23:09:13 -04:00
Christian Adams	57b5795aab	Determine if k8s or ocp and set var accordingly (#1051 ) * conditionally set fsGroup for projects_persistence based on cluster type	2022-09-20 23:03:05 -04:00
Christian Adams	e8096a5f33	Pre-create dummy rh secret to avoid errors (#952 )	2022-09-14 19:04:32 -04:00
Israel Blancas	271bce48bd	Upgrade operator-sdk version from 1.22.2 to 1.23.0 (#1038 ) Signed-off-by: Israel Blancas <iblancasa@gmail.com>	2022-09-12 10:04:07 -04:00
Hao Liu	d64c34f8a4	Add receptor firewall rules to control nodes (#1012 ) Support external execution nodes - Allow receptor.conf to be editable at runtime - Create CA cert and key as a k8s secret - Create work signing RSA keypair as a k8s secret - Setup volume mounts for containers to have access to the needed Receptor keys / certs to facilitate generating the install bundle for a new execution node - added firewall rule, work signing and tls cert configuration to default receptor.conf The volume mount changes in this PR fulfill the following: - `receptor.conf` need to be shared between task container and ee container - task container writes the `receptor.conf` - ee consume the `receptor.conf` - receptor ca cert/key need to be mounted by both ee container and web container - ee container need the ca cert - web container will need the ca key to sign client cert for remote execution node - web container will need the ca cert to generate install bundle for remote execution node - receptor work private/public key need to be mounted by both ee container and web container - ee container need to private key to sign the work - web container need the public key to generate install bundle for remote execution node - task container need the private key to sign the work Signed-off-by: Hao Liu <haoli@redhat.com> Co-Authored-By: Seth Foster <fosterbseth@gmail.com> Co-Authored-By: Shane McDonald <me@shanemcd.com> Signed-off-by: Hao Liu <haoli@redhat.com> Co-authored-by: Shane McDonald <me@shanemcd.com> Co-authored-by: Seth Foster <fosterbseth@gmail.com>	2022-09-09 15:13:05 -04:00
Christian Adams	1bddb98476	Update requirements.yml and vendor new collections (#1045 )	2022-08-31 18:46:33 -04:00
Christian Adams	5f183999d0	Fix restore resource requirements field name for management pod resources (#1044 )	2022-08-31 17:06:01 -04:00
Shane McDonald	3769897131	Merge pull request #1041 from shanemcd/ignore-pycache Add __pycache__ to gitignore	2022-08-30 11:26:02 -04:00
Shane McDonald	7f86231009	Add __pycache__ to gitignore	2022-08-30 11:14:49 -04:00
Shane McDonald	f59dac829a	Merge pull request #1040 from shanemcd/reusable-labels Move labels into reusable templates	2022-08-30 11:13:47 -04:00
Shane McDonald	edecf4d2fe	Move labels into reusable templates	2022-08-30 11:00:43 -04:00
Shane McDonald	4120b5e2b0	Merge pull request #977 from somebadcode/add-ingress-class-name-to-ingress-template Adding ingress class name to ingress template (#716)	2022-08-29 09:12:52 -04:00
Tobias Dahlberg	8dabca5418	Adding ingress class name to ingress template (#716 )	2022-08-29 11:11:19 +02:00
Fedor V	1d341a21d0	feat(readme): remove use of NAMESPACE var (#1028 ) - it was used previously, but not anymore	2022-08-25 16:21:58 -04:00
Shane McDonald	f8719db954	Merge pull request #1013 from miles-w-3/debug-helm Streamlined chart build	2022-08-25 11:59:04 -04:00
SweetGeneral	89425826e8	AWX.enable corrected to AWX.enabled (#1035 ) Co-authored-by: sandesh.gupta <sandesh.gupta@olacabs.com>	2022-08-25 09:26:26 -04:00
Shane McDonald	5c572a9ba6	Merge pull request #1033 from mateuszdrab/patch-1 Remove reference to cluster.local	2022-08-25 08:44:32 -04:00
Shane McDonald	b7bbfd432d	Merge pull request #1034 from whitej6/jlw-jinj3-filter-update Fixes #1032 - Update filter to jinja 3.x format	2022-08-25 08:42:42 -04:00
Shane McDonald	b17cd16fb7	Merge pull request #1008 from rooftopcellist/fix-helm-pkg-build Fix helm package build redundancy and release automation	2022-08-25 08:38:09 -04:00
Mac Chaffee	dc6cbab501	Import all ldap config classes in settings.py (#961 ) * Import all ldap config classes in settings.py * Add AUTH_LDAP_GROUP_TYPE example to readme Signed-off-by: Mac Chaffee <machaffe@renci.org>	2022-08-24 18:00:08 -04:00
Jeremy White	a81be586db	update filter to jinja 3.x format	2022-08-24 14:56:08 -05:00
Mateusz Drab	f2a9e967cc	Remove reference to cluster.local	2022-08-24 20:07:11 +01:00
Christian Adams	9f017d03e6	Make Backup & restore requests and limits configurable (#1030 ) * Add resource specification options to the backup objects * Add resource specification options to the restore object Co-authored-by: Ivan Aragonés <26822043+ivarmu@users.noreply.github.com> Co-authored-by: silvinux <silvinux7@gmail.com> Co-authored-by: Ivan Aragonés Muniesa <iaragone@redhat.com>	2022-08-23 23:23:01 -04:00
Christian Adams	7d2d1b3c5e	Upgrade to Operator SDK v1.22.2 (#1001 ) * Upgrade to Operator SDK 1.16.0 * Upgrade Operator SDK to v1.22.2 & bump base image version	2022-08-22 18:54:56 -04:00
Shane McDonald	5d0ebd0121	Merge pull request #1029 from shanemcd/delete-logging-code Delete logging overrides in configmap	2022-08-22 11:48:05 -04:00
Shane McDonald	f368a539a9	Delete logging overrides in configmap	2022-08-22 10:56:37 -04:00
Shane McDonald	0aef4cc35f	Merge pull request #1026 from shanemcd/respect-LOG_AGGREGATOR_LEVEL Respect LOG_AGGREGATOR_LEVEL	2022-08-19 13:25:33 -04:00
Shane McDonald	e3701dd3db	Respect LOG_AGGREGATOR_LEVEL	2022-08-18 19:10:54 -04:00
Elijah DeLee	cf98edc282	Merge pull request #976 from jainnikhil30/scale_callback_receiver_workers configure callback receiver workers based on CPU	2022-08-09 07:23:08 -04:00
Nikhil	58a4778c89	configure callback receiver workers based on CPU	2022-08-09 13:18:41 +05:30
Shane McDonald	8e50bdde9b	Merge pull request #1015 from shanemcd/installer-templates-cleanup Organize installer templates into subdirectories	2022-08-05 12:49:51 -04:00
Shane McDonald	60386bc928	Organize installer templates into subdirectories	2022-08-05 10:45:15 -04:00
kurokobo	f1df88dc53	fix: change to safely skip task if backupDirectory is not defined (#1003 ) (#1004 )	2022-08-04 10:42:43 -04:00
Miles Wilson	8de6179ac7	Streamlined chart build	2022-08-03 22:48:27 -04:00
Dimitri Savineau	8a3c8e727a	Merge pull request #929 from dsavineau/undefined_limits_key installer: fix undefined limit key in config	2022-08-02 10:05:47 -04:00
Christian Adams	c230016819	Fix helm package build redundancy and release automation (#1010 )	2022-08-01 21:27:15 +00:00
Christian M. Adams	bea05c97ee	Fix helm package build redundancy and release automation	2022-08-01 16:00:51 -04:00
Dimitri Savineau	ba3b6f5436	installer: fix undefined limit key in config When the task_resource_requirements variable has no "limits" key (which is the default value) then the config template generation fails ---------------------------------- looking for "config.yaml.j2" at "/opt/ansible/roles/installer/templates/config.yaml.j2" File lookup using /opt/ansible/roles/installer/templates/config.yaml.j2 as file fatal: [localhost]: FAILED! => { "msg": "The task includes an option with an undefined variable. The error was: the inline if-expression on line 36 evaluated to false and no else section was defined. The error appears to be in /opt/ansible/roles/installer/tasks/resources_configuration.yml: line 30, column 3, but may be elsewhere in the file depending on the exact syntax problem. The offending line appears to be: - name: Apply Resources ^ here ---------------------------------- The current condition doesn't have a else statement so the template fails when the "limits" key isn't present. This rewrite the current if/else statement in jinja template. Signed-off-by: Dimitri Savineau <dsavinea@redhat.com>	2022-05-24 09:29:36 -04:00
				`@@ -0,0 +1 @@`
				`app.kubernetes.io/version: '{{ _image.split(':')[-1] \| truncate(63, True, '', 0) }}'`