Skip to content

Commit 9d1ff94

Browse files
jonasz-lasutjonasz-lasut
authored
feat[#2]: allow configuration of ArgoCD RBAC configmap and namespace (#38)
* Allow configuration of ArgoCD RBAC configmap and namespace Signed-off-by: Jonasz Łasut-Balcerzak <jonasz.lasut@gmail.com> * add readme about namespace flag Signed-off-by: Jonasz Łasut-Balcerzak <jonasz.lasut@gmail.com> * remove interface Signed-off-by: Jonasz Łasut-Balcerzak <jonasz.lasut@gmail.com> * fix linter Signed-off-by: Jonasz Łasut-Balcerzak <jonasz.lasut@gmail.com> --------- Signed-off-by: Jonasz Łasut-Balcerzak <jonasz.lasut@gmail.com>
1 parent ca8d3b1 commit 9d1ff94

File tree

13 files changed

+68
-71
lines changed

13 files changed

+68
-71
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,7 @@ To change the policy.csv you have to make changes in the `internal/controller/co
156156
157157
### Deployment types
158158
159-
As for now only single Argo CD deployment type is supported. The default Argo CD namespace is defined as `argocd`, to change that you have to make a change in `internal/controller/common/values.go`.
159+
As for now only single Argo CD deployment type is supported. The default Argo CD namespace is defined as `argocd`, to change that you have to provide a flag --argocd-rbac-cm-namespace="your-argocd-namespace".
160160
161161
## Roadmap
162162

‎cmd/main.go‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -57,9 +57,14 @@ func main() {
5757
var probeAddr string
5858
var secureMetrics bool
5959
var enableHTTP2 bool
60+
var argoCDRBACConfigMapName string
61+
var argoCDRBACConfigMapNamespace string
6062
flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metric endpoint binds to. "+
6163
"Use the port :8080. If not set, it will be 0 in order to disable the metrics server")
6264
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
65+
flag.StringVar(&argoCDRBACConfigMapName, "argocd-rbac-cm-name", "argocd-rbac-cm", "The name of ArgoCD RBAC configmap.")
66+
flag.StringVar(&argoCDRBACConfigMapNamespace, "argocd-rbac-cm-namespace", "argocd",
67+
"The namespace of ArgoCD RBAC configmap.")
6368
flag.BoolVar(&enableLeaderElection, "leader-elect", false,
6469
"Enable leader election for controller manager. "+
6570
"Enabling this will ensure there is only one active controller manager.")
@@ -124,15 +129,19 @@ func main() {
124129
}
125130

126131
if err = (&controller.ArgoCDRoleReconciler{
127-
Client: mgr.GetClient(),
128-
Scheme: mgr.GetScheme(),
132+
Client: mgr.GetClient(),
133+
Scheme: mgr.GetScheme(),
134+
ArgoCDRBACConfigMapName: argoCDRBACConfigMapName,
135+
ArgoCDRBACConfigMapNamespace: argoCDRBACConfigMapNamespace,
129136
}).SetupWithManager(mgr); err != nil {
130137
setupLog.Error(err, "unable to create controller", "controller", "Role")
131138
os.Exit(1)
132139
}
133140
if err = (&controller.ArgoCDRoleBindingReconciler{
134-
Client: mgr.GetClient(),
135-
Scheme: mgr.GetScheme(),
141+
Client: mgr.GetClient(),
142+
Scheme: mgr.GetScheme(),
143+
ArgoCDRBACConfigMapName: argoCDRBACConfigMapName,
144+
ArgoCDRBACConfigMapNamespace: argoCDRBACConfigMapNamespace,
136145
}).SetupWithManager(mgr); err != nil {
137146
setupLog.Error(err, "unable to create controller", "controller", "ArgoCDRoleBinding")
138147
os.Exit(1)

‎config/manager/manager.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,8 @@ spec:
5959
args:
6060
- --leader-elect
6161
- --health-probe-bind-address=:8081
62+
- --argocd-rbac-cm-name=argocd-rbac-cm
63+
- --argocd-rbac-cm-namespace=argocd
6264
image: controller:latest
6365
name: rbac-operator
6466
securityContext:

‎helm/argocd-rbac-operator/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,8 @@ As for now only single Argo CD deployment type is supported. The default Argo CD
147147
| livenessProbe.httpGet.port | int | `8081` | |
148148
| livenessProbe.initialDelaySeconds | int | `15` | |
149149
| livenessProbe.periodSeconds | int | `20` | |
150+
| namespace.create | bool | `true` | |
151+
| namespace.nameOverride | string | `""` | |
150152
| nodeSelector | object | `{}` | |
151153
| readinessProbe.httpGet.path | string | `"/readyz"` | |
152154
| readinessProbe.httpGet.port | int | `8081` | |

‎helm/argocd-rbac-operator/templates/deployment.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,8 @@ spec:
4848
- args:
4949
- --leader-elect
5050
- --health-probe-bind-address=:8081
51+
- --argocd-rbac-cm-name={{ .Values.argocd.cmName }}
52+
- --argocd-rbac-cm-namespace={{ .Values.argocd.namespace }}
5153
command:
5254
- /rbac-operator
5355
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"

‎internal/controller/argocdrbac_operator_finalizer.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ func (r *ArgoCDRoleReconciler) handleFinalizer(ctx context.Context, role *rbacop
4545
}
4646

4747
func (r *ArgoCDRoleReconciler) delete(role *rbacoperatorv1alpha1.ArgoCDRole) error {
48-
cm := newConfigMap()
48+
cm := newConfigMap(r.ArgoCDRBACConfigMapName, r.ArgoCDRBACConfigMapNamespace)
4949
overlayKey := fmt.Sprintf("policy.%s.%s.csv", role.Namespace, role.ObjectMeta.Name)
5050
if IsObjectFound(r.Client, cm.Namespace, cm.Name, cm) {
5151
delete(cm.Data, overlayKey)
@@ -78,7 +78,7 @@ func (r *ArgoCDRoleBindingReconciler) handleFinalizer(ctx context.Context, rb *r
7878
func (r *ArgoCDRoleBindingReconciler) delete(rb *rbacoperatorv1alpha1.ArgoCDRoleBinding) error {
7979
roleRefName := rb.Spec.ArgoCDRoleRef.Name
8080
if roleRefName == common.ArgoCDRoleAdmin || roleRefName == common.ArgoCDRoleReadOnly {
81-
cm := newConfigMap()
81+
cm := newConfigMap(r.ArgoCDRBACConfigMapName, r.ArgoCDRBACConfigMapNamespace)
8282
overlayKey := fmt.Sprintf("policy.%s.%s.csv", rb.Namespace, roleRefName)
8383
if IsObjectFound(r.Client, cm.Namespace, cm.Name, cm) {
8484
delete(cm.Data, overlayKey)

‎internal/controller/argocdrole_controller.go‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,10 @@ var _ reconcile.Reconciler = &ArgoCDRoleReconciler{}
3838
// ArgoCDRoleReconciler reconciles a Role object
3939
type ArgoCDRoleReconciler struct {
4040
client.Client
41-
Log logr.Logger
42-
Scheme *runtime.Scheme
41+
Log logr.Logger
42+
Scheme *runtime.Scheme
43+
ArgoCDRBACConfigMapName string
44+
ArgoCDRBACConfigMapNamespace string
4345
}
4446

4547
// +kubebuilder:rbac:groups=rbac-operator.argoproj-labs.io,resources=argocdroles,verbs=*
@@ -97,7 +99,7 @@ func (r *ArgoCDRoleReconciler) Reconcile(ctx context.Context, req ctrl.Request)
9799
return ctrl.Result{}, nil
98100
}
99101

100-
cm := newConfigMap()
102+
cm := newConfigMap(r.ArgoCDRBACConfigMapName, r.ArgoCDRBACConfigMapNamespace)
101103

102104
r.Log.Info("Checking if ConfigMap exists")
103105
if !IsObjectFound(r.Client, cm.Namespace, cm.Name, cm) {

‎internal/controller/argocdrole_controller_test.go‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ import (
2222
"time"
2323

2424
rbacoperatorv1alpha1 "github.com/argoproj-labs/argocd-rbac-operator/api/v1alpha1"
25-
"github.com/argoproj-labs/argocd-rbac-operator/internal/controller/common"
2625
"github.com/stretchr/testify/assert"
2726
corev1 "k8s.io/api/core/v1"
2827
"k8s.io/apimachinery/pkg/types"
@@ -61,7 +60,7 @@ func TestArgoCDRoleReconciler_Reconcile(t *testing.T) {
6160
}
6261

6362
cm := &corev1.ConfigMap{}
64-
err = reconciler.Client.Get(context.TODO(), types.NamespacedName{Name: common.ArgoCDRBACConfigMapName, Namespace: testRBACCMNamespace}, cm)
63+
err = reconciler.Client.Get(context.TODO(), types.NamespacedName{Name: testRBACCMName, Namespace: testRBACCMNamespace}, cm)
6564
assert.NoError(t, err)
6665
resCM := makeTestCMArgoCDRoleExpected()
6766
assert.Equal(t, resCM.Data, cm.Data)
@@ -181,7 +180,7 @@ func TestArgoCDRoleReconciler_HandleFinalizer(t *testing.T) {
181180
}
182181

183182
cm := &corev1.ConfigMap{}
184-
err = reconciler.Client.Get(context.TODO(), types.NamespacedName{Name: common.ArgoCDRBACConfigMapName, Namespace: testRBACCMNamespace}, cm)
183+
err = reconciler.Client.Get(context.TODO(), types.NamespacedName{Name: testRBACCMName, Namespace: testRBACCMNamespace}, cm)
185184
assert.NoError(t, err)
186185
wantCM := makeTestRBACConfigMap()
187186
assert.Equal(t, wantCM.Data, cm.Data)
@@ -217,7 +216,7 @@ func TestArgoCDRoleReconciler_RoleHasRoleBinding(t *testing.T) {
217216
}
218217

219218
cm := &corev1.ConfigMap{}
220-
err = reconciler.Client.Get(context.TODO(), types.NamespacedName{Name: common.ArgoCDRBACConfigMapName, Namespace: testRBACCMNamespace}, cm)
219+
err = reconciler.Client.Get(context.TODO(), types.NamespacedName{Name: testRBACCMName, Namespace: testRBACCMNamespace}, cm)
221220
assert.NoError(t, err)
222221
resCM := makeTestCM_ArgoCDRole_WithRoleBindingRoleSubject_Expected()
223222
assert.Equal(t, resCM.Data, cm.Data)

‎internal/controller/argocdrolebinding_controller.go‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,10 @@ import (
3535
// ArgoCDRoleBindingReconciler reconciles a ArgoCDRoleBinding object
3636
type ArgoCDRoleBindingReconciler struct {
3737
client.Client
38-
Log logr.Logger
39-
Scheme *runtime.Scheme
38+
Log logr.Logger
39+
Scheme *runtime.Scheme
40+
ArgoCDRBACConfigMapName string
41+
ArgoCDRBACConfigMapNamespace string
4042
}
4143

4244
// +kubebuilder:rbac:groups=rbac-operator.argoproj-labs.io,resources=argocdrolebindings,verbs=*
@@ -95,7 +97,7 @@ func (r *ArgoCDRoleBindingReconciler) Reconcile(ctx context.Context, req ctrl.Re
9597
return ctrl.Result{}, nil
9698
}
9799

98-
cm := newConfigMap()
100+
cm := newConfigMap(r.ArgoCDRBACConfigMapName, r.ArgoCDRBACConfigMapNamespace)
99101

100102
r.Log.Info("Checking if ConfigMap exists")
101103
if !IsObjectFound(r.Client, cm.Namespace, cm.Name, cm) {
@@ -155,9 +157,9 @@ func (r *ArgoCDRoleBindingReconciler) Reconcile(ctx context.Context, req ctrl.Re
155157

156158
switch roleName {
157159
case "admin":
158-
role = createBuiltInAdminRole()
160+
role = r.createBuiltInAdminRole()
159161
case "readonly":
160-
role = createBuiltInReadOnlyRole()
162+
role = r.createBuiltInReadOnlyRole()
161163
}
162164

163165
r.Log.Info("Reconciling RBAC ConfigMap")

‎internal/controller/argocdrolebinding_controller_test.go‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ import (
2222
"time"
2323

2424
rbacoperatorv1alpha1 "github.com/argoproj-labs/argocd-rbac-operator/api/v1alpha1"
25-
"github.com/argoproj-labs/argocd-rbac-operator/internal/controller/common"
2625
"github.com/stretchr/testify/assert"
2726
corev1 "k8s.io/api/core/v1"
2827
"k8s.io/apimachinery/pkg/types"
@@ -63,7 +62,7 @@ func TestArgoCDRoleBindingReconciler_ReconcileRoleSubject(t *testing.T) {
6362
}
6463

6564
cm := &corev1.ConfigMap{}
66-
err = reconciler.Client.Get(context.TODO(), types.NamespacedName{Name: common.ArgoCDRBACConfigMapName, Namespace: testRBACCMNamespace}, cm)
65+
err = reconciler.Client.Get(context.TODO(), types.NamespacedName{Name: testRBACCMName, Namespace: testRBACCMNamespace}, cm)
6766
assert.NoError(t, err)
6867
resCM := makeTestCM_ArgoCDRole_WithRoleBindingRoleSubject_Expected()
6968
assert.Equal(t, resCM.Data, cm.Data)
@@ -198,7 +197,7 @@ func TestArgoCDRoleBindingReconciler_HandleFinalizer(t *testing.T) {
198197
}
199198

200199
cm := &corev1.ConfigMap{}
201-
err = reconciler.Client.Get(context.TODO(), types.NamespacedName{Name: common.ArgoCDRBACConfigMapName, Namespace: testRBACCMNamespace}, cm)
200+
err = reconciler.Client.Get(context.TODO(), types.NamespacedName{Name: testRBACCMName, Namespace: testRBACCMNamespace}, cm)
202201
assert.NoError(t, err)
203202
wantCM := makeTestCMArgoCDRoleExpected()
204203
assert.Equal(t, wantCM.Data, cm.Data)
@@ -262,7 +261,7 @@ func TestArgoCDRoleBindingReconciler_ReconcileSSOSubject(t *testing.T) {
262261
}
263262

264263
cm := &corev1.ConfigMap{}
265-
err = reconciler.Client.Get(context.TODO(), types.NamespacedName{Name: common.ArgoCDRBACConfigMapName, Namespace: testRBACCMNamespace}, cm)
264+
err = reconciler.Client.Get(context.TODO(), types.NamespacedName{Name: testRBACCMName, Namespace: testRBACCMNamespace}, cm)
266265
assert.NoError(t, err)
267266
resCM := makeTestCM_ArgoCDRole_WithRoleBindingSSOSubject_Expected()
268267
assert.Equal(t, resCM.Data, cm.Data)
@@ -297,7 +296,7 @@ func TestArgoCDRoleBindingReconciler_ReconcileLocalSubject(t *testing.T) {
297296
}
298297

299298
cm := &corev1.ConfigMap{}
300-
err = reconciler.Client.Get(context.TODO(), types.NamespacedName{Name: common.ArgoCDRBACConfigMapName, Namespace: testRBACCMNamespace}, cm)
299+
err = reconciler.Client.Get(context.TODO(), types.NamespacedName{Name: testRBACCMName, Namespace: testRBACCMNamespace}, cm)
301300
assert.NoError(t, err)
302301
resCM := makeTestCM_ArgoCDRole_WithRoleBindingLocalSubject_Expected()
303302
assert.Equal(t, resCM.Data, cm.Data)
@@ -331,7 +330,7 @@ func TestArgoCDRoleBindingReconciler_ReconcileBuiltInAdmin(t *testing.T) {
331330
}
332331

333332
cm := &corev1.ConfigMap{}
334-
err = reconciler.Client.Get(context.TODO(), types.NamespacedName{Name: common.ArgoCDRBACConfigMapName, Namespace: testRBACCMNamespace}, cm)
333+
err = reconciler.Client.Get(context.TODO(), types.NamespacedName{Name: testRBACCMName, Namespace: testRBACCMNamespace}, cm)
335334
assert.NoError(t, err)
336335
resCM := makeTestCM_BuiltInAdmin_WithRoleBinding_Expected()
337336
assert.Equal(t, resCM.Data, cm.Data)
@@ -365,7 +364,7 @@ func TestArgoCDRoleBindingReconciler_ReconcileBuiltInReadOnly(t *testing.T) {
365364
}
366365

367366
cm := &corev1.ConfigMap{}
368-
err = reconciler.Client.Get(context.TODO(), types.NamespacedName{Name: common.ArgoCDRBACConfigMapName, Namespace: testRBACCMNamespace}, cm)
367+
err = reconciler.Client.Get(context.TODO(), types.NamespacedName{Name: testRBACCMName, Namespace: testRBACCMNamespace}, cm)
369368
assert.NoError(t, err)
370369
resCM := makeTestCM_BuiltInReadOnly_WithRoleBinding_Expected()
371370
assert.Equal(t, resCM.Data, cm.Data)
@@ -399,7 +398,7 @@ func TestArgoCDRoleBindingReconciler_HandleFinalizerBuiltInRole(t *testing.T) {
399398
}
400399

401400
cm := &corev1.ConfigMap{}
402-
err = reconciler.Client.Get(context.TODO(), types.NamespacedName{Name: common.ArgoCDRBACConfigMapName, Namespace: testRBACCMNamespace}, cm)
401+
err = reconciler.Client.Get(context.TODO(), types.NamespacedName{Name: testRBACCMName, Namespace: testRBACCMNamespace}, cm)
403402
assert.NoError(t, err)
404403
resCM := makeTestRBACConfigMap()
405404
assert.Equal(t, resCM.Data, cm.Data)

0 commit comments

Comments
 (0)