@@ -21,6 +21,7 @@ import (
21
21
"crypto/sha256"
22
22
"encoding/hex"
23
23
"reflect"
24
+ "regexp"
24
25
"strings"
25
26
"time"
26
27
@@ -128,18 +129,18 @@ func (r *NamespaceScopeReconciler) Reconcile(req ctrl.Request) (ctrl.Result, err
128
129
return ctrl.Result {}, err
129
130
}
130
131
132
+ reg , _ := regexp .Compile (`^nss-managed-role-from.*` )
131
133
for _ , namespaceMember := range instance .Spec .NamespaceMembers {
132
134
if rolesList , _ := r .GetRolesFromNamespace (namespaceMember ); len (rolesList ) != 0 {
133
135
var summarizedRules []rbacv1.PolicyRule
134
136
for _ , role := range rolesList {
135
- if role . Name != constant . NamespaceScopeManagedPrefix + instance . Namespace {
137
+ if ! reg . MatchString ( role . Name ) {
136
138
summarizedRules = append (summarizedRules , role .Rules ... )
137
139
}
138
140
}
139
-
140
141
if err := r .CreateRuntimeRoleToNamespace (instance , namespaceMember , summarizedRules ); err != nil {
141
142
klog .Infof ("Failed to create runtime role: %v" , err )
142
- return ctrl.Result {}, nil
143
+ return ctrl.Result {RequeueAfter : 60 * time . Second }, nil
143
144
}
144
145
}
145
146
}
@@ -206,10 +207,7 @@ func (r *NamespaceScopeReconciler) UpdateConfigMap(instance *operatorv1.Namespac
206
207
}
207
208
klog .Infof ("Created ConfigMap %s" , cmKey .String ())
208
209
209
- if err := r .RestartPods (instance .Spec .RestartLabels , cm , instance .Namespace ); err != nil {
210
- return err
211
- }
212
- return nil
210
+ return r .RestartPods (instance .Spec .RestartLabels , cm , instance .Namespace )
213
211
}
214
212
return err
215
213
}
@@ -282,11 +280,7 @@ func (r *NamespaceScopeReconciler) CreateRuntimeRoleToNamespace(instance *operat
282
280
if toNs == operatorNs {
283
281
return nil
284
282
}
285
- if err := r .generateRuntimeRoleForNSS (instance , summarizedRules , fromNs , toNs ); err != nil {
286
- return err
287
- }
288
-
289
- return nil
283
+ return r .generateRuntimeRoleForNSS (instance , summarizedRules , fromNs , toNs )
290
284
}
291
285
292
286
func (r * NamespaceScopeReconciler ) DeleteRbacFromUnmanagedNamespace (instance * operatorv1.NamespaceScope ) error {
@@ -406,10 +400,7 @@ func (r *NamespaceScopeReconciler) generateRBACForNSS(instance *operatorv1.Names
406
400
func (r * NamespaceScopeReconciler ) generateRuntimeRoleForNSS (instance * operatorv1.NamespaceScope , summarizedRules []rbacv1.PolicyRule , fromNs , toNs string ) error {
407
401
if err := r .createRuntimeRoleForNSS (summarizedRules , fromNs , toNs ); err != nil {
408
402
if errors .IsAlreadyExists (err ) {
409
- if err := r .updateRuntimeRoleForNSS (summarizedRules , fromNs , toNs ); err != nil {
410
- return err
411
- }
412
- return nil
403
+ return r .updateRuntimeRoleForNSS (summarizedRules , fromNs , toNs )
413
404
}
414
405
if errors .IsForbidden (err ) {
415
406
r .Recorder .Eventf (instance , corev1 .EventTypeWarning , "Forbidden" , "cannot create resource roles in API group rbac.authorization.k8s.io in the namespace %s. Please authorize service account ibm-namespace-scope-operator namespace admin permission of %s namespace" , toNs , toNs )
@@ -1001,9 +992,8 @@ func (r *NamespaceScopeReconciler) getValidatedNamespaces(instance *operatorv1.N
1001
992
if errors .IsNotFound (err ) {
1002
993
klog .Infof ("Namespace %s does not exist and will be ignored" , nsMem )
1003
994
continue
1004
- } else {
1005
- return nil , err
1006
995
}
996
+ return nil , err
1007
997
}
1008
998
if ns .Status .Phase == corev1 .NamespaceTerminating {
1009
999
klog .Infof ("Namespace %s is terminating. Ignore this namespace" , nsMem )
0 commit comments