Implement Admin-operator for auth-admin team

.gitignore

@@ -55,3 +55,4 @@ __pycache__/
 
 mcp/admin-auth-server/audit.log
 mcp/admin-auth-server/uv.lock
+pkg/gateway

Makefile

@@ -7,6 +7,7 @@
 .PHONY: goose-up goose-down goose-status goose-create
 .PHONY: docker-build docker-build-business-operator docker-push-business-operator
 .PHONY: k8s-secrets k8s-up k8s-down k8s-migrate
+.PHONY: run-admin-service stop-admin-service run-admin-operator stop-admin-operator apply-cr
 
 REGISTRY ?= mykolashevchenko
 TAG ?= latest
@@ -210,4 +211,24 @@ k8s-down:
 	kubectl delete namespace $(K8S_NAMESPACE) --ignore-not-found=true
 
 run-guest-operator:
-	go run cmd/guest-operator/main.go
+	go run cmd/guest-operator/main.go
+
+run-admin-service:
+	kubectl apply -k deploy/k8s/admin-auth
+
+stop-admin-service:
+	kubectl delete -k deploy/k8s/admin-auth --ignore-not-found=true
+
+run-admin-operator:
+	docker build -t admin-operator:latest -f build/Dockerfile.admin-operator .
+	kubectl apply -f deploy/k8s/operators/admin-auth/crd.yaml
+	kubectl apply -f deploy/k8s/operators/admin-auth/rbac.yaml
+	kubectl apply -f deploy/k8s/operators/admin-auth/operator-deployment.yaml
+
+stop-admin-operator:
+	kubectl delete -f deploy/k8s/operators/admin-auth/operator-deployment.yaml --ignore-not-found=true
+	kubectl delete -f deploy/k8s/operators/admin-auth/rbac.yaml --ignore-not-found=true
+	kubectl delete -f deploy/k8s/operators/admin-auth/crd.yaml --ignore-not-found=true
+
+apply-cr:
+	kubectl apply -f deploy/k8s/operators/admin-auth/example-cr.yaml

build/Dockerfile.admin-operator

@@ -0,0 +1,22 @@
+FROM golang:1.26.1-bookworm AS builder
+
+WORKDIR /workspace
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+ARG TARGETOS=linux
+ARG TARGETARCH
+
+RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -a -o manager ./cmd/admin-operator/main.go
+
+FROM alpine:3.20
+
+WORKDIR /
+COPY --from=builder /workspace/manager .
+
+USER 65532:65532
+
+ENTRYPOINT ["/manager"]

cmd/admin-operator/main.go

@@ -0,0 +1,65 @@
+package main
+
+import (
+	"flag"
+	"os"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/log/zap"
+	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
+
+	adminv1alpha1 "github.com/ua-academy-projects/share-bite/operators/admin-operator/api/v1alpha1"
+	"github.com/ua-academy-projects/share-bite/operators/admin-operator/controller"
+)
+
+var scheme = runtime.NewScheme()
+var setupLog = ctrl.Log.WithName("setup")
+
+func init() {
+	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
+	utilruntime.Must(adminv1alpha1.AddToScheme(scheme))
+}
+
+func main() {
+	var metricsAddr string
+	var enableLeaderElection bool
+	flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
+	flag.BoolVar(&enableLeaderElection, "leader-elect", false, "Enable leader election for controller manager.")
+
+	opts := zap.Options{Development: true}
+	opts.BindFlags(flag.CommandLine)
+	flag.Parse()
+
+	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
+
+	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
+		Scheme: scheme,
+		Metrics: metricsserver.Options{
+			BindAddress: metricsAddr,
+		},
+		HealthProbeBindAddress: ":8081",
+		LeaderElection:         enableLeaderElection,
+		LeaderElectionID:       "admin-operator.sharebite.dev",
+	})
+	if err != nil {
+		setupLog.Error(err, "unable to start manager")
+		os.Exit(1)
+	}
+
+	if err = (&controller.AdminAppProfileReconciler{
+		Client: mgr.GetClient(),
+		Scheme: mgr.GetScheme(),
+	}).SetupWithManager(mgr); err != nil {
+		setupLog.Error(err, "unable to create controller", "controller", "AdminAppProfile")
+		os.Exit(1)
+	}
+
+	setupLog.Info("starting manager")
+	if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {
+		setupLog.Error(err, "problem running manager")
+		os.Exit(1)
+	}
+}

deploy/k8s/operators/admin-auth/crd.yaml

@@ -0,0 +1,57 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: adminappprofiles.admin.sharebite.dev
+spec:
+  group: admin.sharebite.dev
+  names:
+    kind: AdminAppProfile
+    listKind: AdminAppProfileList
+    plural: adminappprofiles
+    singular: adminappprofile
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          type: object
+          required:
+            - spec
+          properties:
+            spec:
+              type: object
+              properties:
+                replicas:
+                  type: integer
+                  format: int32
+                  minimum: 0
+                enabled:
+                  type: boolean
+                deploymentName:
+                  type: string
+              required:
+                - replicas
+                - enabled
+            status:
+              type: object
+              properties:
+                conditions:
+                  type: array
+                  items:
+                    type: object
+                    properties:
+                      type:
+                        type: string
+                      status:
+                        type: string
+                      reason:
+                        type: string
+                      message:
+                        type: string
+                      lastTransitionTime:
+                        type: string
+                        format: date-time

deploy/k8s/operators/admin-auth/example-cr.yaml

@@ -0,0 +1,8 @@
+apiVersion: admin.sharebite.dev/v1alpha1
+kind: AdminAppProfile
+metadata:
+  name: admin-auth-profile
+  namespace: share-bite-local
+spec:
+  replicas: 2
+  enabled: true

deploy/k8s/operators/admin-auth/operator-deployment.yaml

@@ -0,0 +1,39 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: admin-operator
+  namespace: share-bite-local
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: admin-operator
+  template:
+    metadata:
+      labels:
+        app: admin-operator
+    spec:
+      serviceAccountName: admin-operator-sa
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: operator
+          image: admin-operator:latest
+          imagePullPolicy: IfNotPresent
+          command:
+            - /manager
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          resources:
+            limits:
+              cpu: 200m
+              memory: 128Mi
+            requests:
+              cpu: 50m
+              memory: 64Mi

deploy/k8s/operators/admin-auth/rbac.yaml

@@ -0,0 +1,39 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: admin-operator-sa
+  namespace: share-bite-local
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: admin-operator-role
+rules:
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["watch", "update", "get", "list", "patch"]
+  - apiGroups: ["admin.sharebite.dev"]
+    resources: ["adminappprofiles"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["admin.sharebite.dev"]
+    resources: ["adminappprofiles/status"]
+    verbs: ["get", "update", "patch"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["create", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: admin-operator-rb
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: admin-operator-role
+subjects:
+  - kind: ServiceAccount
+    name: admin-operator-sa
+    namespace: share-bite-local