Imagehub.deploy (#2214)

* rename makefile.img name

* add rbac.yaml

* update README.md

controllers/imagehub/Makefile

@@ -1,6 +1,6 @@
 
 # Image URL to use all building/pushing image targets
-IMG ?= ghcr.io/labring/imagehub-controller:dev
+IMG ?= ghcr.io/labring/sealos-imagehub-controller:dev
 TARGETARCH ?= amd64
 
 # ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.

controllers/imagehub/config/manager/kustomization.yaml

@@ -4,5 +4,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 images:
 - name: controller
-  newName: ghcr.io/labring/imagehub-controller
+  newName: ghcr.io/labring/sealos-imagehub-controller
   newTag: dev

controllers/imagehub/deploy/README.md

@@ -5,9 +5,9 @@ make docker-build IMG=$(YourImageName)
 
 ### Deploy
 ```bash
-make pre-deploy IMG=$(YourImageName) && kubectl apply -f deploy/manifests/deploy.yaml && kubectl apply -f deploy/cluster-admin.yaml
+make pre-deploy IMG=$(YourImageName) && kubectl apply -f deploy/manifests/deploy.yaml && kubectl apply -f deploy/rbac/rbac.yaml
 ```
 or just
 ```bash
-make deploy IMG=$(YourImageName) &&  kubectl apply -f deploy/cluster-admin.yaml
+make deploy IMG=$(YourImageName) &&  kubectl apply -f deploy/rbac/rbac.yaml
 ```

controllers/imagehub/deploy/cluster-admin-rolebinding.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: imagehub-controller-manager-clusterrolebinding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cluster-admin
-subjects:
-  - kind: ServiceAccount
-    name: imagehub-controller-manager
-    namespace: imagehub-system

controllers/imagehub/deploy/manifests/deploy.yaml

@@ -815,7 +815,7 @@ spec:
         - --leader-elect
         command:
         - /manager
-        image: ghcr.io/labring/imagehub-controller:dev
+        image: ghcr.io/labring/sealos-imagehub-controller:dev
         imagePullPolicy: Always
         livenessProbe:
           httpGet:

controllers/imagehub/deploy/rbac/rbac.yaml

@@ -0,0 +1,37 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: imagehub-controller-manager-clusterrolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: imagehub-controller-manager
+    namespace: imagehub-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: imagehub-default-user
+rules:
+  - apiGroups: ["imagehub.sealos.io"]
+    resources: [ "organizations" ]
+    verbs: [ "get", "watch", "list", "create"] # have no limit to create org.
+  - apiGroups: ["imagehub.sealos.io"]
+    resources: [ "repositories" , "images"]
+    verbs: [ "get", "watch", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: imagehub-default-user-clusterrolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: imagehub-default-user
+subjects:
+  - kind: Group
+    name: system:serviceaccounts:user-system
+    apiGroup: rbac.authorization.k8s.io