fix: missing permissions when OwnerReferencesPermissionEnforcement admission controller is enabled

[NoOverflow]

Barman plugin creates a role giving the rights for a managed CNPG cluster to interact with Barman-related resources (Objectstore, related secrets...).

plugin-barman-cloud/internal/cnpgi/operator/reconciler.go

Lines 121 to 125 in a225902

	func (r ReconcilerImplementation) ensureRole(
	ctx context.Context,
	cluster *cnpgv1.Cluster,
	barmanObjects []barmancloudv1.ObjectStore,
	) error {

In order for the role to be cleaned up automatically when the related cluster is deleted, an ownerReference is set on the role pointing to that cluster.

plugin-barman-cloud/internal/cnpgi/operator/reconciler.go

Lines 144 to 146 in a225902

	if err := setOwnerReference(cluster, newRole); err != nil {
	return err
	}

This causes an issue on all clusters with the OwnerReferencesPermissionEnforcement admission controller configured, and so by consequence all Openshift / OKD clusters which by default have it enabled.

This is due to the fact that this AdmCon. requires the ServiceAccount creating an object with an ownerReference to also have the rights to update the finalizers subresource of the referenced owner.

In our case, this means that the ServiceAccount used to create the role, must have the rights to update the finalizers field of a CNPG cluster object.

Fixes #425

[mnencia]

The config/rbac/role.yaml file is created by controller-gen. I have committed a change to the internal/controller/objectstore_controller.go, which serves as the source.

[NoOverflow]

The config/rbac/role.yaml file is created by controller-gen. I have committed a change to the internal/controller/objectstore_controller.go, which serves as the source.

Yeah I was pretty sure I was missing something and that those files weren't static. Thanks

[armru]

@mnencia can we merge?

[mnencia]

I think we can.

[NoOverflow]

Hi all, any update ?

[mnencia]

I see that #465 has been merged and does the same things. I apologize for not having merged this before going on holiday.

[NoOverflow]

I see that #465 has been merged and does the same things. I apologize for not having merged this before going on holiday.

No problem, thanks anyways