Skip to content

Commit 362e28c

Browse files
lpiwowarlpiwowar
committed
Triage rules assigned to serviceAccounts
This patch triages the rights that are assigned to serviceAccounts that are related to the test-operator: - serviceAccount used by the test-operator controller - serviceAccount that is associated with instances of test-operator related CRs.
1 parent 9b081b3 commit 362e28c

File tree

6 files changed

+109
-155
lines changed

6 files changed

+109
-155
lines changed

‎config/rbac/role.yaml‎

Lines changed: 12 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,10 @@ rules:
88
- apiGroups:
99
- ""
1010
resources:
11-
- persistentvolumeclaims
11+
- configmaps
1212
verbs:
1313
- create
14+
- delete
1415
- get
1516
- list
1617
- patch
@@ -19,7 +20,7 @@ rules:
1920
- apiGroups:
2021
- ""
2122
resources:
22-
- pods
23+
- persistentvolumeclaims
2324
verbs:
2425
- create
2526
- delete
@@ -31,49 +32,38 @@ rules:
3132
- apiGroups:
3233
- ""
3334
resources:
34-
- serviceaccounts
35+
- pods
3536
verbs:
3637
- create
38+
- delete
3739
- get
3840
- list
3941
- patch
4042
- update
4143
- watch
4244
- apiGroups:
43-
- batch
45+
- ""
4446
resources:
45-
- jobs
47+
- secrets
4648
verbs:
47-
- create
48-
- delete
4949
- get
5050
- list
51-
- patch
52-
- update
5351
- watch
5452
- apiGroups:
5553
- ""
5654
resources:
57-
- configmaps
55+
- serviceaccounts
5856
verbs:
5957
- create
60-
- delete
6158
- get
6259
- list
6360
- patch
6461
- update
6562
- watch
6663
- apiGroups:
67-
- ""
68-
resources:
69-
- pods
70-
verbs:
71-
- get
72-
- list
73-
- apiGroups:
74-
- ""
64+
- batch
7565
resources:
76-
- secrets
66+
- jobs
7767
verbs:
7868
- create
7969
- delete
@@ -116,6 +106,8 @@ rules:
116106
- security.openshift.io
117107
resourceNames:
118108
- anyuid
109+
- nonroot
110+
- nonroot-v2
119111
- privileged
120112
resources:
121113
- securitycontextconstraints

‎controllers/ansibletest_controller.go‎

Lines changed: 16 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@ import (
3535
"github.com/openstack-k8s-operators/test-operator/pkg/ansibletest"
3636
batchv1 "k8s.io/api/batch/v1"
3737
corev1 "k8s.io/api/core/v1"
38-
rbacv1 "k8s.io/api/rbac/v1"
3938
k8s_errors "k8s.io/apimachinery/pkg/api/errors"
4039
ctrl "sigs.k8s.io/controller-runtime"
4140
"sigs.k8s.io/controller-runtime/pkg/client"
@@ -54,22 +53,18 @@ func (r *AnsibleTestReconciler) GetLogger(ctx context.Context) logr.Logger {
5453
// +kubebuilder:rbac:groups=test.openstack.org,resources=ansibletests,verbs=get;list;watch;create;update;patch;delete
5554
// +kubebuilder:rbac:groups=test.openstack.org,resources=ansibletests/status,verbs=get;update;patch
5655
// +kubebuilder:rbac:groups=test.openstack.org,resources=ansibletests/finalizers,verbs=update;patch
57-
// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch;delete;
58-
// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete;
59-
// +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;
6056
// +kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;watch;create;patch;update;delete;
6157
// +kubebuilder:rbac:groups=k8s.cni.cncf.io,resources=network-attachment-definitions,verbs=get;list;watch
62-
63-
// service account, role, rolebinding
64-
// +kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch;create;update;patch
6558
// +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=roles,verbs=get;list;watch;create;update;patch
6659
// +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update;patch
67-
// service account permissions that are needed to grant permission to the above
68-
// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid;privileged,resources=securitycontextconstraints,verbs=use
60+
// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid;privileged;nonroot;nonroot-v2,resources=securitycontextconstraints,verbs=use
61+
// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch
62+
// +kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch;create;update;patch;delete;
6963
// +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch
70-
// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=get;list;create;update;watch;patch
64+
// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=get;list;create;update;watch;patch;delete
65+
// +kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch;create;update;patch
7166

72-
// Reconcile - AnsibleTestReconciler
67+
// Reconcile - AnsibleTest
7368
func (r *AnsibleTestReconciler) Reconcile(ctx context.Context, req ctrl.Request) (result ctrl.Result, _err error) {
7469
Log := r.GetLogger(ctx)
7570

@@ -176,34 +171,6 @@ func (r *AnsibleTestReconciler) Reconcile(ctx context.Context, req ctrl.Request)
176171
}
177172
}
178173

179-
// Service account, role, binding
180-
rbacRules := []rbacv1.PolicyRule{
181-
{
182-
APIGroups: []string{"security.openshift.io"},
183-
ResourceNames: []string{"anyuid", "privileged"},
184-
Resources: []string{"securitycontextconstraints"},
185-
Verbs: []string{"use"},
186-
},
187-
{
188-
APIGroups: []string{""},
189-
Resources: []string{"pods"},
190-
Verbs: []string{"create", "get", "list", "watch", "update", "patch", "delete"},
191-
},
192-
{
193-
APIGroups: []string{""},
194-
Resources: []string{"persistentvolumeclaims"},
195-
Verbs: []string{"get", "list", "create", "update", "watch", "patch"},
196-
},
197-
}
198-
rbacResult, err := common_rbac.ReconcileRbac(ctx, helper, instance, rbacRules)
199-
if err != nil {
200-
return rbacResult, err
201-
} else if (rbacResult != ctrl.Result{}) {
202-
return rbacResult, nil
203-
}
204-
205-
// Service account, role, binding - end
206-
207174
serviceLabels := map[string]string{
208175
common.AppSelector: ansibletest.ServiceName,
209176
"workflowStep": strconv.Itoa(externalWorkflowCounter),
@@ -271,6 +238,16 @@ func (r *AnsibleTestReconciler) Reconcile(ctx context.Context, req ctrl.Request)
271238
}
272239
}
273240

241+
// Service account, role, binding
242+
rbacRules := GetCommonRbacRules(privileged)
243+
rbacResult, err := common_rbac.ReconcileRbac(ctx, helper, instance, rbacRules)
244+
if err != nil {
245+
return rbacResult, err
246+
} else if (rbacResult != ctrl.Result{}) {
247+
return rbacResult, nil
248+
}
249+
// Service account, role, binding - end
250+
274251
jobDef := ansibletest.Job(
275252
instance,
276253
serviceLabels,

‎controllers/common.go‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ import (
1818
v1beta1 "github.com/openstack-k8s-operators/test-operator/api/v1beta1"
1919
batchv1 "k8s.io/api/batch/v1"
2020
corev1 "k8s.io/api/core/v1"
21+
rbacv1 "k8s.io/api/rbac/v1"
2122
k8s_errors "k8s.io/apimachinery/pkg/api/errors"
2223
k8sresource "k8s.io/apimachinery/pkg/api/resource"
2324
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -532,3 +533,20 @@ func (r *Reconciler) OverwriteValueWithWorkflow(
532533

533534
return nil
534535
}
536+
537+
func GetCommonRbacRules(privileged bool) []rbacv1.PolicyRule {
538+
rbacPolicyRule := rbacv1.PolicyRule{
539+
APIGroups: []string{"security.openshift.io"},
540+
ResourceNames: []string{"nonroot", "nonroot-v2"},
541+
Resources: []string{"securitycontextconstraints"},
542+
Verbs: []string{"use"},
543+
}
544+
545+
if privileged {
546+
rbacPolicyRule.ResourceNames = append(
547+
rbacPolicyRule.ResourceNames,
548+
[]string{"anyuid", "privileged"}...)
549+
}
550+
551+
return []rbacv1.PolicyRule{rbacPolicyRule}
552+
}

‎controllers/horizontest_controller.go‎

Lines changed: 23 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@ import (
3434
"gopkg.in/yaml.v3"
3535
batchv1 "k8s.io/api/batch/v1"
3636
corev1 "k8s.io/api/core/v1"
37-
rbacv1 "k8s.io/api/rbac/v1"
3837
k8s_errors "k8s.io/apimachinery/pkg/api/errors"
3938
ctrl "sigs.k8s.io/controller-runtime"
4039
"sigs.k8s.io/controller-runtime/pkg/client"
@@ -51,11 +50,19 @@ func (r *HorizonTestReconciler) GetLogger(ctx context.Context) logr.Logger {
5150
return log.FromContext(ctx).WithName("Controllers").WithName("HorizonTest")
5251
}
5352

54-
//+kubebuilder:rbac:groups=test.openstack.org,resources=horizontests,verbs=get;list;watch;create;update;patch;delete
55-
//+kubebuilder:rbac:groups=test.openstack.org,resources=horizontests/status,verbs=get;update;patch
56-
//+kubebuilder:rbac:groups=test.openstack.org,resources=horizontests/finalizers,verbs=update;patch
57-
//+kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch
58-
//+kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=get;list;create;update;watch;patch
53+
// +kubebuilder:rbac:groups=test.openstack.org,resources=horizontests,verbs=get;list;watch;create;update;patch;delete
54+
// +kubebuilder:rbac:groups=test.openstack.org,resources=horizontests/status,verbs=get;update;patch
55+
// +kubebuilder:rbac:groups=test.openstack.org,resources=horizontests/finalizers,verbs=update;patch
56+
// +kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;watch;create;patch;update;delete;
57+
// +kubebuilder:rbac:groups=k8s.cni.cncf.io,resources=network-attachment-definitions,verbs=get;list;watch
58+
// +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=roles,verbs=get;list;watch;create;update;patch
59+
// +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update;patch
60+
// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid;privileged;nonroot;nonroot-v2,resources=securitycontextconstraints,verbs=use
61+
// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch
62+
// +kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch;create;update;patch;delete;
63+
// +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch
64+
// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=get;list;create;update;watch;patch;delete
65+
// +kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch;create;update;patch
5966

6067
// Reconcile - HorizonTest
6168
func (r *HorizonTestReconciler) Reconcile(ctx context.Context, req ctrl.Request) (result ctrl.Result, _err error) {
@@ -137,27 +144,6 @@ func (r *HorizonTestReconciler) Reconcile(ctx context.Context, req ctrl.Request)
137144
}
138145
}
139146

140-
rbacRules := []rbacv1.PolicyRule{
141-
{
142-
APIGroups: []string{"security.openshift.io"},
143-
ResourceNames: []string{"anyuid", "privileged"},
144-
Resources: []string{"securitycontextconstraints"},
145-
Verbs: []string{"use"},
146-
},
147-
{
148-
APIGroups: []string{""},
149-
Resources: []string{"pods"},
150-
Verbs: []string{"create", "get", "list", "watch", "update", "patch", "delete"},
151-
},
152-
}
153-
154-
rbacResult, err := common_rbac.ReconcileRbac(ctx, helper, instance, rbacRules)
155-
if err != nil {
156-
return rbacResult, err
157-
} else if (rbacResult != ctrl.Result{}) {
158-
return rbacResult, nil
159-
}
160-
161147
serviceLabels := map[string]string{
162148
common.AppSelector: horizontest.ServiceName,
163149
"instanceName": instance.Name,
@@ -224,6 +210,16 @@ func (r *HorizonTestReconciler) Reconcile(ctx context.Context, req ctrl.Request)
224210
return ctrl.Result{}, err
225211
}
226212

213+
// Service account, role, binding
214+
rbacRules := GetCommonRbacRules(instance.Spec.Privileged)
215+
rbacResult, err := common_rbac.ReconcileRbac(ctx, helper, instance, rbacRules)
216+
if err != nil {
217+
return rbacResult, err
218+
} else if (rbacResult != ctrl.Result{}) {
219+
return rbacResult, nil
220+
}
221+
// Service account, role, binding - end
222+
227223
jobDef := horizontest.Job(
228224
instance,
229225
serviceLabels,

‎controllers/tempest_controller.go‎

Lines changed: 15 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,6 @@ import (
3636
"github.com/openstack-k8s-operators/test-operator/pkg/tempest"
3737
batchv1 "k8s.io/api/batch/v1"
3838
corev1 "k8s.io/api/core/v1"
39-
rbacv1 "k8s.io/api/rbac/v1"
4039
k8s_errors "k8s.io/apimachinery/pkg/api/errors"
4140
ctrl "sigs.k8s.io/controller-runtime"
4241
"sigs.k8s.io/controller-runtime/pkg/client"
@@ -56,20 +55,16 @@ func (r *TempestReconciler) GetLogger(ctx context.Context) logr.Logger {
5655
// +kubebuilder:rbac:groups=test.openstack.org,resources=tempests,verbs=get;list;watch;create;update;patch;delete
5756
// +kubebuilder:rbac:groups=test.openstack.org,resources=tempests/status,verbs=get;update;patch
5857
// +kubebuilder:rbac:groups=test.openstack.org,resources=tempests/finalizers,verbs=update;patch
59-
// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch;delete;
60-
// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete;
61-
// +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;
6258
// +kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;watch;create;patch;update;delete;
6359
// +kubebuilder:rbac:groups=k8s.cni.cncf.io,resources=network-attachment-definitions,verbs=get;list;watch
64-
65-
// service account, role, rolebinding
66-
// +kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch;create;update;patch
6760
// +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=roles,verbs=get;list;watch;create;update;patch
6861
// +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update;patch
69-
// service account permissions that are needed to grant permission to the above
70-
// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid;privileged,resources=securitycontextconstraints,verbs=use
62+
// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid;privileged;nonroot;nonroot-v2,resources=securitycontextconstraints,verbs=use
63+
// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch
64+
// +kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch;create;update;patch;delete;
7165
// +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch
72-
// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=get;list;create;update;watch;patch
66+
// +kubebuilder:rbac:groups="",resources=persistentvolumeclaims,verbs=get;list;create;update;watch;patch;delete
67+
// +kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch;create;update;patch
7368

7469
// Reconcile - Tempest
7570
func (r *TempestReconciler) Reconcile(ctx context.Context, req ctrl.Request) (result ctrl.Result, _err error) {
@@ -191,33 +186,6 @@ func (r *TempestReconciler) Reconcile(ctx context.Context, req ctrl.Request) (re
191186
}
192187
}
193188

194-
// Service account, role, binding
195-
rbacRules := []rbacv1.PolicyRule{
196-
{
197-
APIGroups: []string{"security.openshift.io"},
198-
ResourceNames: []string{"anyuid", "privileged"},
199-
Resources: []string{"securitycontextconstraints"},
200-
Verbs: []string{"use"},
201-
},
202-
{
203-
APIGroups: []string{""},
204-
Resources: []string{"pods"},
205-
Verbs: []string{"create", "get", "list", "watch", "update", "patch", "delete"},
206-
},
207-
{
208-
APIGroups: []string{""},
209-
Resources: []string{"persistentvolumeclaims"},
210-
Verbs: []string{"get", "list", "create", "update", "watch", "patch"},
211-
},
212-
}
213-
rbacResult, err := common_rbac.ReconcileRbac(ctx, helper, instance, rbacRules)
214-
if err != nil {
215-
return rbacResult, err
216-
} else if (rbacResult != ctrl.Result{}) {
217-
return rbacResult, nil
218-
}
219-
// Service account, role, binding - end
220-
221189
serviceLabels := map[string]string{
222190
common.AppSelector: tempest.ServiceName,
223191
"workflowStep": strconv.Itoa(externalWorkflowCounter),
@@ -339,6 +307,16 @@ func (r *TempestReconciler) Reconcile(ctx context.Context, req ctrl.Request) (re
339307
return ctrl.Result{}, err
340308
}
341309

310+
// Service account, role, binding
311+
rbacRules := GetCommonRbacRules(instance.Spec.Privileged)
312+
rbacResult, err := common_rbac.ReconcileRbac(ctx, helper, instance, rbacRules)
313+
if err != nil {
314+
return rbacResult, err
315+
} else if (rbacResult != ctrl.Result{}) {
316+
return rbacResult, nil
317+
}
318+
// Service account, role, binding - end
319+
342320
// Note(lpiwowar): Remove all the workflow merge code to webhook once it is done.
343321
// It will simplify the logic and duplicite code (Tempest vs Tobiko)
344322
if externalWorkflowCounter < len(instance.Spec.Workflow) {

0 commit comments

Comments
 (0)