[SREP-1045] Develop Clusterrole webhook #379
Conversation
openshift-ci
bot
added
the
do-not-merge/work-in-progress
diakovnec
changed the title
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
diakovnec
changed the title
| } | ||
|
|
||
| // Protected ClusterRoles that should not be deleted | ||
| protectedClusterRoles = []string{ |
There was a problem hiding this comment.
Is this a full list? it mentioned backplane-* in the description.
There was a problem hiding this comment.
The full list will contain any backplane related clusterroles + most openshift critical. Its not fiesible to include all system:* roles as they can change over time, and we still want customers being able to create and remove their own clusterroles. The idea is being able to get access to the cluster if some clusterroles have been deleted.
|
@diakovnec: all tests passed! Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/label tide/merge-method-squash |
openshift-ci
bot
added
the
tide/merge-method-squash
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bmeng, diakovnec The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
This PR is for implementing a new clusterrole webhook. We have a way to test it for Rosa Classic, but it is complicated for HCP because of image embedding and ACM policies that deploy the package to the HCP namespace.
One of the possible ways is to merge PR into the stage and verify if it provisions all resources as expected.
The functionality of the webhook itself has been verified for Rosa Classic and theoretically should work for HCP as long as it's enabled with
func (s *ClusterRoleWebHook) HypershiftEnabled() bool { return true }Also, the purpose of this PR is to check the e-2-e pipeline process.
Note: more context in the Slack Discussion
Test for Classic Rosa