Skip to content

Commit 44fe229

Browse files
gpontejos-csgpontejos-cs
authored
fix(IAR): Ensure annotations added outside of the operator do not cause reconcile loops for service accounts (#749)
1 parent 3210693 commit 44fe229

File tree

4 files changed

+26
-9
lines changed

4 files changed

+26
-9
lines changed

‎docs/deployment/openshift/resources/imageanalyzer/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ spec:
5050
| registry.tls.caCertificate | (optional) A string containing an optionally base64-encoded Certificate Authority Chain for self-signed TLS Registry Certificates |
5151
| registry.tls.caCertificateConfigMap | (optional) The name of a ConfigMap containing CA Certificate Authority Chains under keys ending in ".tls" for self-signed TLS Registry Certificates (ignored when registry.tls.caCertificate is set) |
5252
| registry.acr_name | (optional) Name of ACR for the Falcon Falcon Image Analyzer push. Only applicable to Azure cloud. (`registry.type="acr"`) |
53-
| imageAnalyzerConfig.serviceAccount.annotations | (optional) Configure annotations for the falcon-iar service account (e.g. for IAM role association) |
53+
| imageAnalyzerConfig.serviceAccount.annotations | (optional) Configure annotations for the falcon-iar service account (e.g. for IAM role association). Note: Annotations can be added or updated through the operator, but removing existing annotations requires manual intervention |
5454
| imageAnalyzerConfig.azureConfigPath | (optional) Azure config file path |
5555
| imageAnalyzerConfig.sizeLimit | (optional) Configure the size limit of the temp storage space for scanning. By Default, this is set to `20Gi`. |
5656
| imageAnalyzerConfig.mountPath | (optional) Configure the location of the temp storage space for scanning. By Default, this is set to `/tmp`. |

‎docs/resources/imageanalyzer/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ spec:
5050
| registry.tls.caCertificate | (optional) A string containing an optionally base64-encoded Certificate Authority Chain for self-signed TLS Registry Certificates |
5151
| registry.tls.caCertificateConfigMap | (optional) The name of a ConfigMap containing CA Certificate Authority Chains under keys ending in ".tls" for self-signed TLS Registry Certificates (ignored when registry.tls.caCertificate is set) |
5252
| registry.acr_name | (optional) Name of ACR for the Falcon Falcon Image Analyzer push. Only applicable to Azure cloud. (`registry.type="acr"`) |
53-
| imageAnalyzerConfig.serviceAccount.annotations | (optional) Configure annotations for the falcon-iar service account (e.g. for IAM role association) |
53+
| imageAnalyzerConfig.serviceAccount.annotations | (optional) Configure annotations for the falcon-iar service account (e.g. for IAM role association). Note: Annotations can be added or updated through the operator, but removing existing annotations requires manual intervention |
5454
| imageAnalyzerConfig.azureConfigPath | (optional) Azure config file path |
5555
| imageAnalyzerConfig.sizeLimit | (optional) Configure the size limit of the temp storage space for scanning. By Default, this is set to `20Gi`. |
5656
| imageAnalyzerConfig.mountPath | (optional) Configure the location of the temp storage space for scanning. By Default, this is set to `/tmp`. |

‎docs/src/resources/imageanalyzer.md.tmpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ spec:
5050
| registry.tls.caCertificate | (optional) A string containing an optionally base64-encoded Certificate Authority Chain for self-signed TLS Registry Certificates |
5151
| registry.tls.caCertificateConfigMap | (optional) The name of a ConfigMap containing CA Certificate Authority Chains under keys ending in ".tls" for self-signed TLS Registry Certificates (ignored when registry.tls.caCertificate is set) |
5252
| registry.acr_name | (optional) Name of ACR for the Falcon Falcon Image Analyzer push. Only applicable to Azure cloud. (`registry.type="acr"`) |
53-
| imageAnalyzerConfig.serviceAccount.annotations | (optional) Configure annotations for the falcon-iar service account (e.g. for IAM role association) |
53+
| imageAnalyzerConfig.serviceAccount.annotations | (optional) Configure annotations for the falcon-iar service account (e.g. for IAM role association). Note: Annotations can be added or updated through the operator, but removing existing annotations requires manual intervention |
5454
| imageAnalyzerConfig.azureConfigPath | (optional) Azure config file path |
5555
| imageAnalyzerConfig.sizeLimit | (optional) Configure the size limit of the temp storage space for scanning. By Default, this is set to `20Gi`. |
5656
| imageAnalyzerConfig.mountPath | (optional) Configure the location of the temp storage space for scanning. By Default, this is set to `/tmp`. |

‎internal/controller/falcon_image_analyzer/rbac.go‎

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -51,13 +51,30 @@ func (r *FalconImageAnalyzerReconciler) reconcileServiceAccount(ctx context.Cont
5151
return err
5252
}
5353

54-
if !reflect.DeepEqual(serviceAccount.ObjectMeta.Annotations, existingServiceAccount.ObjectMeta.Annotations) {
55-
existingServiceAccount.ObjectMeta.Annotations = serviceAccount.ObjectMeta.Annotations
56-
update = true
54+
// Check if any annotations from serviceAccount need to be added to existingServiceAccount
55+
if serviceAccount.ObjectMeta.Annotations != nil {
56+
if existingServiceAccount.ObjectMeta.Annotations == nil {
57+
existingServiceAccount.ObjectMeta.Annotations = make(map[string]string)
58+
}
59+
for key, value := range serviceAccount.ObjectMeta.Annotations {
60+
if existingValue, exists := existingServiceAccount.ObjectMeta.Annotations[key]; !exists || existingValue != value {
61+
existingServiceAccount.ObjectMeta.Annotations[key] = value
62+
update = true
63+
}
64+
}
5765
}
58-
if !reflect.DeepEqual(serviceAccount.ObjectMeta.Labels, existingServiceAccount.ObjectMeta.Labels) {
59-
existingServiceAccount.ObjectMeta.Labels = serviceAccount.ObjectMeta.Labels
60-
update = true
66+
67+
// Check if any labels from serviceAccount need to be added to existingServiceAccount
68+
if serviceAccount.ObjectMeta.Labels != nil {
69+
if existingServiceAccount.ObjectMeta.Labels == nil {
70+
existingServiceAccount.ObjectMeta.Labels = make(map[string]string)
71+
}
72+
for key, value := range serviceAccount.ObjectMeta.Labels {
73+
if existingValue, exists := existingServiceAccount.ObjectMeta.Labels[key]; !exists || existingValue != value {
74+
existingServiceAccount.ObjectMeta.Labels[key] = value
75+
update = true
76+
}
77+
}
6178
}
6279

6380
if update {

0 commit comments

Comments
 (0)