Skip to content

Commit 4698bf1

Browse files
armruarmru
committed
feat(rbac)!: prefix all resource names to avoid cluster conflicts
BREAKING CHANGE: All RBAC resource names have been renamed with consistent prefixes to prevent naming conflicts with other cluster components. Users must migrate their existing installations by deleting old resources and applying the new manifest. See the migration guide for detailed instructions: https://cloudnative-pg.io/plugin-barman-cloud/resource-name-migration/ Signed-off-by: Armando Ruocco <[email protected]>
1 parent ea76733 commit 4698bf1

10 files changed

+546
-9
lines changed

‎CHANGELOG.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,13 @@
11
# Changelog
22

3+
## [Unreleased]
4+
5+
### BREAKING CHANGES
6+
7+
* **manifests:** Resource names have been prefixed to avoid cluster conflicts
8+
- All cluster-scoped and namespace-scoped resources now use the `barman-plugin-` prefix for consistency
9+
- See the [Resource Name Migration Guide](https://cloudnative-pg.io/plugin-barman-cloud/resource-name-migration/) for detailed migration instructions
10+
311
## [0.7.0](https://github.com/cloudnative-pg/plugin-barman-cloud/compare/v0.6.0...v0.7.0) (2025-09-25)
412

513

‎config/rbac/leader_election_role.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ metadata:
55
labels:
66
app.kubernetes.io/name: plugin-barman-cloud
77
app.kubernetes.io/managed-by: kustomize
8-
name: leader-election-role
8+
name: barman-plugin-leader-election-role
99
rules:
1010
- apiGroups:
1111
- ""

‎config/rbac/leader_election_role_binding.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@ metadata:
44
labels:
55
app.kubernetes.io/name: plugin-barman-cloud
66
app.kubernetes.io/managed-by: kustomize
7-
name: leader-election-rolebinding
7+
name: barman-plugin-leader-election-rolebinding
88
roleRef:
99
apiGroup: rbac.authorization.k8s.io
1010
kind: Role
11-
name: leader-election-role
11+
name: barman-plugin-leader-election-role
1212
subjects:
1313
- kind: ServiceAccount
1414
name: plugin-barman-cloud

‎config/rbac/metrics_auth_role.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: rbac.authorization.k8s.io/v1
22
kind: ClusterRole
33
metadata:
4-
name: metrics-auth-role
4+
name: barman-plugin-metrics-auth-role
55
rules:
66
- apiGroups:
77
- authentication.k8s.io

‎config/rbac/metrics_auth_role_binding.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
apiVersion: rbac.authorization.k8s.io/v1
22
kind: ClusterRoleBinding
33
metadata:
4-
name: metrics-auth-rolebinding
4+
name: barman-plugin-metrics-auth-rolebinding
55
roleRef:
66
apiGroup: rbac.authorization.k8s.io
77
kind: ClusterRole
8-
name: metrics-auth-role
8+
name: barman-plugin-metrics-auth-role
99
subjects:
1010
- kind: ServiceAccount
1111
name: plugin-barman-cloud

‎config/rbac/metrics_reader_role.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: rbac.authorization.k8s.io/v1
22
kind: ClusterRole
33
metadata:
4-
name: metrics-reader
4+
name: barman-plugin-metrics-reader
55
rules:
66
- nonResourceURLs:
77
- "/metrics"

‎config/rbac/objectstore_editor_role.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ metadata:
55
labels:
66
app.kubernetes.io/name: plugin-barman-cloud
77
app.kubernetes.io/managed-by: kustomize
8-
name: objectstore-editor-role
8+
name: barman-plugin-objectstore-editor-role
99
rules:
1010
- apiGroups:
1111
- barmancloud.cnpg.io

‎config/rbac/objectstore_viewer_role.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ metadata:
55
labels:
66
app.kubernetes.io/name: plugin-barman-cloud
77
app.kubernetes.io/managed-by: kustomize
8-
name: objectstore-viewer-role
8+
name: barman-plugin-objectstore-viewer-role
99
rules:
1010
- apiGroups:
1111
- barmancloud.cnpg.io

‎web/docs/resource-name-migration.md‎

Lines changed: 281 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,281 @@
1+
---
2+
sidebar_position: 41
3+
---
4+
5+
# Resource Name Migration Guide
6+
7+
<!-- SPDX-License-Identifier: CC-BY-4.0 -->
8+
9+
:::warning
10+
Before running the migration script or applying the manifest, please:
11+
1. **Review the complete manifest** on the [Migration Manifest](migration-manifest.md) page to understand what changes will be made
12+
2. **Test in a non-production environment** first if possible
13+
3. **Ensure you have proper backups** of your cluster configuration
14+
4. **Verify the resource names match** your current installation (default namespace is `cnpg-system`)
15+
16+
This migration will delete old RBAC resources and create new ones. While the operation is designed to be safe, you should review and understand the changes before proceeding. The maintainers of this project are not responsible for any issues that may arise during migration.
17+
:::
18+
19+
## Overview
20+
21+
Starting from version 0.8.0, the plugin-barman-cloud deployment manifests use more specific, prefixed resource names to avoid conflicts with other components deployed in the same Kubernetes cluster.
22+
23+
## What Changed
24+
25+
The following resources have been renamed to use proper prefixes:
26+
27+
### Cluster-scoped Resources
28+
29+
| Old Name | New Name |
30+
|----------|----------|
31+
| `metrics-auth-role` | `barman-plugin-metrics-auth-role` |
32+
| `metrics-auth-rolebinding` | `barman-plugin-metrics-auth-rolebinding` |
33+
| `metrics-reader` | `barman-plugin-metrics-reader` |
34+
| `objectstore-viewer-role` | `barman-plugin-objectstore-viewer-role` |
35+
| `objectstore-editor-role` | `barman-plugin-objectstore-editor-role` |
36+
37+
### Namespace-scoped Resources
38+
39+
| Old Name | New Name | Namespace |
40+
|----------|----------|-----------|
41+
| `leader-election-role` | `barman-plugin-leader-election-role` | `cnpg-system` |
42+
| `leader-election-rolebinding` | `barman-plugin-leader-election-rolebinding` | `cnpg-system` |
43+
44+
## Why This Change?
45+
46+
Using generic names for cluster-wide resources is discouraged as they may conflict with other components deployed in the same cluster. The new names make it clear that these resources belong to the barman-cloud plugin and help avoid naming collisions.
47+
48+
## Migration Instructions
49+
50+
### Automated Migration
51+
52+
A migration script is provided below to automate the process. The script will:
53+
1. Delete the old generic-named resources
54+
2. Apply the new prefixed resources from the bundled manifest
55+
56+
Save the following script to a file (e.g., `migrate-resource-names.sh`), make it executable with `chmod +x migrate-resource-names.sh`, and run it:
57+
58+
```bash
59+
#!/usr/bin/env bash
60+
61+
# Migration script for plugin-barman-cloud resource name changes
62+
# This script removes old generic-named resources and applies new prefixed ones
63+
64+
set -e
65+
66+
NAMESPACE="${NAMESPACE:-cnpg-system}"
67+
DRY_RUN="${DRY_RUN:-false}"
68+
MANIFEST_URL="https://cloudnative-pg.io/plugin-barman-cloud/migration-rbac.yaml"
69+
70+
echo "=== Barman Plugin Resource Name Migration Script ==="
71+
echo ""
72+
echo "This script will migrate from generic resource names to prefixed names"
73+
echo "to avoid conflicts with other cluster components."
74+
echo ""
75+
echo "Namespace: ${NAMESPACE}"
76+
echo "Dry run: ${DRY_RUN}"
77+
echo ""
78+
79+
if [ "$DRY_RUN" = "true" ]; then
80+
DRY_RUN_FLAG="--dry-run=client"
81+
echo "Running in DRY RUN mode - no changes will be made"
82+
else
83+
DRY_RUN_FLAG=""
84+
echo "WARNING: This will make actual changes to your cluster"
85+
read -p "Continue? (y/N): " -n 1 -r
86+
echo
87+
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
88+
echo "Aborted."
89+
exit 1
90+
fi
91+
fi
92+
93+
echo ""
94+
echo "=== Step 1: Deleting old cluster-scoped resources ==="
95+
echo ""
96+
97+
# Delete old ClusterRoles
98+
echo "Deleting old ClusterRole: metrics-auth-role"
99+
kubectl delete clusterrole metrics-auth-role ${DRY_RUN_FLAG} --ignore-not-found=true
100+
101+
echo "Deleting old ClusterRole: metrics-reader"
102+
kubectl delete clusterrole metrics-reader ${DRY_RUN_FLAG} --ignore-not-found=true
103+
104+
echo "Deleting old ClusterRole: objectstore-viewer-role"
105+
kubectl delete clusterrole objectstore-viewer-role ${DRY_RUN_FLAG} --ignore-not-found=true
106+
107+
echo "Deleting old ClusterRole: objectstore-editor-role"
108+
kubectl delete clusterrole objectstore-editor-role ${DRY_RUN_FLAG} --ignore-not-found=true
109+
110+
# Delete old ClusterRoleBindings
111+
echo "Deleting old ClusterRoleBinding: metrics-auth-rolebinding"
112+
kubectl delete clusterrolebinding metrics-auth-rolebinding ${DRY_RUN_FLAG} --ignore-not-found=true
113+
114+
echo ""
115+
echo "=== Step 2: Deleting old namespace-scoped resources ==="
116+
echo ""
117+
118+
# Delete old Role
119+
echo "Deleting old Role: leader-election-role in namespace ${NAMESPACE}"
120+
kubectl delete role leader-election-role -n ${NAMESPACE} ${DRY_RUN_FLAG} --ignore-not-found=true
121+
122+
# Delete old RoleBinding
123+
echo "Deleting old RoleBinding: leader-election-rolebinding in namespace ${NAMESPACE}"
124+
kubectl delete rolebinding leader-election-rolebinding -n ${NAMESPACE} ${DRY_RUN_FLAG} --ignore-not-found=true
125+
126+
echo ""
127+
echo "=== Step 3: Applying new resources ==="
128+
echo ""
129+
130+
if [ "$DRY_RUN" = "true" ]; then
131+
echo "Skipping resource creation in dry-run mode"
132+
echo "To apply new resources, run this script without DRY_RUN=true"
133+
else
134+
echo "Applying new resources from bundled manifest..."
135+
136+
# Try to apply from the documentation URL
137+
if curl -fsSL "${MANIFEST_URL}" | kubectl apply -f - -n ${NAMESPACE}; then
138+
echo "Successfully applied new resources from ${MANIFEST_URL}"
139+
else
140+
echo "Failed to download manifest from ${MANIFEST_URL}"
141+
echo "Please download the manifest manually from:"
142+
echo " https://cloudnative-pg.io/plugin-barman-cloud/migration-manifest/"
143+
echo ""
144+
echo "Or copy it from the documentation and save it to a file, then run:"
145+
echo " kubectl apply -f <manifest-file> -n ${NAMESPACE}"
146+
exit 1
147+
fi
148+
fi
149+
150+
echo ""
151+
echo "=== Migration complete! ==="
152+
echo ""
153+
echo "Summary of changes:"
154+
echo " Cluster-scoped resources:"
155+
echo " - metrics-auth-role → barman-plugin-metrics-auth-role"
156+
echo " - metrics-auth-rolebinding → barman-plugin-metrics-auth-rolebinding"
157+
echo " - metrics-reader → barman-plugin-metrics-reader"
158+
echo " - objectstore-viewer-role → barman-plugin-objectstore-viewer-role"
159+
echo " - objectstore-editor-role → barman-plugin-objectstore-editor-role"
160+
echo ""
161+
echo " Namespace-scoped resources (in ${NAMESPACE}):"
162+
echo " - leader-election-role → barman-plugin-leader-election-role"
163+
echo " - leader-election-rolebinding → barman-plugin-leader-election-rolebinding"
164+
echo ""
165+
```
166+
167+
#### Dry Run (Recommended First Step)
168+
169+
Test the migration without making changes:
170+
171+
```bash
172+
export DRY_RUN=true
173+
./migrate-resource-names.sh
174+
```
175+
176+
#### Actual Migration
177+
178+
Once you're satisfied with the dry run output:
179+
180+
```bash
181+
./migrate-resource-names.sh
182+
```
183+
184+
By default, the script assumes the plugin is installed in the `cnpg-system` namespace. If you're using a different namespace, set the `NAMESPACE` environment variable:
185+
186+
```bash
187+
export NAMESPACE=my-namespace
188+
./migrate-resource-names.sh
189+
```
190+
191+
### Manual Migration
192+
193+
If you prefer to migrate manually:
194+
195+
1. **Delete old cluster-scoped resources:**
196+
197+
```bash
198+
kubectl delete clusterrole metrics-auth-role
199+
kubectl delete clusterrole metrics-reader
200+
kubectl delete clusterrole objectstore-viewer-role
201+
kubectl delete clusterrole objectstore-editor-role
202+
kubectl delete clusterrolebinding metrics-auth-rolebinding
203+
```
204+
205+
2. **Delete old namespace-scoped resources:**
206+
207+
```bash
208+
kubectl delete role leader-election-role -n cnpg-system
209+
kubectl delete rolebinding leader-election-rolebinding -n cnpg-system
210+
```
211+
212+
3. **Apply the new RBAC manifest:**
213+
214+
See the [Migration Manifest](migration-manifest.md) page for the complete bundled YAML. You can either:
215+
216+
- Download and apply from the documentation:
217+
```bash
218+
kubectl apply -f https://cloudnative-pg.io/plugin-barman-cloud/migration-rbac.yaml -n cnpg-system
219+
```
220+
221+
- Or copy the YAML from the [Migration Manifest](migration-manifest.md) page, save it to a file, and apply:
222+
```bash
223+
kubectl apply -f barman-rbac-new.yaml -n cnpg-system
224+
```
225+
226+
## Impact
227+
228+
- **Downtime:** The migration requires a brief interruption as the old resources are deleted and new ones are created. The plugin controller may need to restart.
229+
- **Permissions:** If you have custom RBAC rules or tools that reference the old resource names, they will need to be updated.
230+
- **External Users:** If end users have been granted the `objectstore-viewer-role` or `objectstore-editor-role`, they will need to be re-granted the new role names (`barman-plugin-objectstore-viewer-role` and `barman-plugin-objectstore-editor-role`).
231+
232+
## Verification
233+
234+
After migration, verify that the new resources are created:
235+
236+
```bash
237+
# Check cluster-scoped resources
238+
kubectl get clusterrole | grep barman
239+
kubectl get clusterrolebinding | grep barman
240+
241+
# Check namespace-scoped resources
242+
kubectl get role,rolebinding -n cnpg-system | grep barman
243+
```
244+
245+
You should see the new prefixed resource names.
246+
247+
## Troubleshooting
248+
249+
### Plugin Not Starting After Migration
250+
251+
If the plugin fails to start after migration, check:
252+
253+
1. **ServiceAccount permissions:** Ensure the `plugin-barman-cloud` ServiceAccount is bound to the new roles:
254+
```bash
255+
kubectl get clusterrolebinding barman-plugin-metrics-auth-rolebinding -o yaml
256+
kubectl get rolebinding barman-plugin-leader-election-rolebinding -n cnpg-system -o yaml
257+
```
258+
259+
2. **Role references:** Verify that the rolebindings reference the correct role names:
260+
```bash
261+
kubectl describe rolebinding barman-plugin-leader-election-rolebinding -n cnpg-system
262+
kubectl describe clusterrolebinding barman-plugin-metrics-auth-rolebinding
263+
```
264+
265+
### Old Resources Still Present
266+
267+
If old resources weren't deleted properly, you can force delete them:
268+
269+
```bash
270+
kubectl delete clusterrole metrics-auth-role --ignore-not-found
271+
kubectl delete clusterrole metrics-reader --ignore-not-found
272+
kubectl delete clusterrole objectstore-viewer-role --ignore-not-found
273+
kubectl delete clusterrole objectstore-editor-role --ignore-not-found
274+
kubectl delete clusterrolebinding metrics-auth-rolebinding --ignore-not-found
275+
kubectl delete role leader-election-role -n cnpg-system --ignore-not-found
276+
kubectl delete rolebinding leader-election-rolebinding -n cnpg-system --ignore-not-found
277+
```
278+
279+
## Support
280+
281+
If you encounter issues during migration, please open an issue on the [GitHub repository](https://github.com/cloudnative-pg/plugin-barman-cloud/issues).

0 commit comments

Comments
 (0)