Skip to content

Commit bfe13ff

Browse files
asmacdoasmacdo
authored
Modify rbac role, rather than patch with kustomize (#3624)
* Modify rbac role, rather than patch with kustomize Ansible was creating kustomize patches to the RBAC role, which was different than the helm/go plugins. Now we simply update role.yaml more like the other plugins. * fix indentation in molecule RBAC mod
1 parent b580bba commit bfe13ff

File tree

7 files changed

+227
-138
lines changed

7 files changed

+227
-138
lines changed

‎hack/tests/e2e-ansible-molecule.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ cat "$ROOTDIR/test/ansible-memcached/watches-finalizer.yaml" >> watches.yaml
4343
header_text "Append v1 kind to watches to test watching already registered GVK"
4444
cat "$ROOTDIR/test/ansible-memcached/watches-v1-kind.yaml" >> watches.yaml
4545
echo $marker >> watches.yaml
46-
sed -i'.bak' -e '/- secrets/a \ \ - services' config/rbac/role.yaml; rm -f config/rbac/role.yaml.bak
46+
sed -i'.bak' -e '/- secrets/a \ \ \ \ \ \ - services' config/rbac/role.yaml; rm -f config/rbac/role.yaml.bak
4747

4848
header_text "Test in kind"
4949
sed -i".bak" -E -e 's/(FROM quay.io\/operator-framework\/ansible-operator)(:.*)?/\1:dev/g' Dockerfile; rm -f Dockerfile.bak

‎internal/plugins/ansible/v1/scaffolds/api.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,8 +97,9 @@ func (s *apiScaffolder) scaffold() error {
9797

9898
var createAPITemplates []file.Builder
9999
createAPITemplates = append(createAPITemplates,
100+
&rbac.CRDViewerRole{},
100101
&rbac.CRDEditorRole{},
101-
&rbac.KustomizeUpdater{},
102+
&rbac.ManagerRoleUpdater{},
102103

103104
&crd.CRD{CRDVersion: s.opts.CRDVersion},
104105
&crd.Kustomization{},

‎internal/plugins/ansible/v1/scaffolds/init.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ func (s *initScaffolder) scaffold() error {
9090
&rbac.AuthProxyService{},
9191
&rbac.LeaderElectionRole{},
9292
&rbac.LeaderElectionRoleBinding{},
93-
&rbac.Role{},
93+
&rbac.ManagerRole{},
9494
&rbac.RoleBinding{},
9595

9696
&prometheus.Kustomization{},

‎internal/plugins/ansible/v1/scaffolds/internal/templates/config/rbac/patch_crd_editor.go‎ renamed to ‎internal/plugins/ansible/v1/scaffolds/internal/templates/config/rbac/crd_editor_rbac.go‎

Lines changed: 26 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
Copyright 2020 The Operator-SDK Authors
2+
Copyright 2018 The Kubernetes Authors.
33
44
Licensed under the Apache License, Version 2.0 (the "License");
55
you may not use this file except in compliance with the License.
@@ -33,7 +33,7 @@ type CRDEditorRole struct {
3333
// SetTemplateDefaults implements input.Template
3434
func (f *CRDEditorRole) SetTemplateDefaults() error {
3535
if f.Path == "" {
36-
f.Path = filepath.Join("config", "rbac", "patches", "%[kind]_editor_role.yaml")
36+
f.Path = filepath.Join("config", "rbac", "%[kind]_editor_role.yaml")
3737
}
3838
f.Path = f.Resource.Replacer().Replace(f.Path)
3939

@@ -42,31 +42,28 @@ func (f *CRDEditorRole) SetTemplateDefaults() error {
4242
return nil
4343
}
4444

45-
const crdRoleEditorTemplate = `---
46-
- op: add
47-
path: /rules/-
48-
value:
49-
apiGroups:
50-
- {{ .Resource.Domain }}
51-
resources:
52-
- {{ .Resource.Plural }}
53-
verbs:
54-
- create
55-
- delete
56-
- get
57-
- list
58-
- patch
59-
- update
60-
- watch
61-
- op: add
62-
path: /rules/-
63-
value:
64-
apiGroups:
65-
- {{ .Resource.Domain }}
66-
resources:
67-
- {{ .Resource.Plural }}/status
68-
verbs:
69-
- get
70-
- patch
71-
- update
45+
const crdRoleEditorTemplate = `# permissions for end users to edit {{ .Resource.Plural }}.
46+
apiVersion: rbac.authorization.k8s.io/v1
47+
kind: ClusterRole
48+
metadata:
49+
name: {{ lower .Resource.Kind }}-editor-role
50+
rules:
51+
- apiGroups:
52+
- {{ .Resource.Domain }}
53+
resources:
54+
- {{ .Resource.Plural }}
55+
verbs:
56+
- create
57+
- delete
58+
- get
59+
- list
60+
- patch
61+
- update
62+
- watch
63+
- apiGroups:
64+
- {{ .Resource.Domain }}
65+
resources:
66+
- {{ .Resource.Plural }}/status
67+
verbs:
68+
- get
7269
`

‎internal/plugins/ansible/v1/scaffolds/internal/templates/config/rbac/crd_viewer_rbac.go‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
/*
2+
Copyright 2018 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package rbac
18+
19+
import (
20+
"path/filepath"
21+
22+
"sigs.k8s.io/kubebuilder/pkg/model/file"
23+
)
24+
25+
var _ file.Template = &CRDViewerRole{}
26+
27+
// CRDViewerRole scaffolds the config/rbac/<kind>_viewer_role.yaml
28+
type CRDViewerRole struct {
29+
file.TemplateMixin
30+
file.ResourceMixin
31+
}
32+
33+
// SetTemplateDefaults implements input.Template
34+
func (f *CRDViewerRole) SetTemplateDefaults() error {
35+
if f.Path == "" {
36+
f.Path = filepath.Join("config", "rbac", "%[kind]_viewer_role.yaml")
37+
}
38+
f.Path = f.Resource.Replacer().Replace(f.Path)
39+
40+
f.TemplateBody = crdRoleViewerTemplate
41+
42+
return nil
43+
}
44+
45+
const crdRoleViewerTemplate = `# permissions for end users to view {{ .Resource.Plural }}.
46+
apiVersion: rbac.authorization.k8s.io/v1
47+
kind: ClusterRole
48+
metadata:
49+
name: {{ lower .Resource.Kind }}-viewer-role
50+
rules:
51+
- apiGroups:
52+
- {{ .Resource.Domain }}
53+
resources:
54+
- {{ .Resource.Plural }}
55+
verbs:
56+
- get
57+
- list
58+
- watch
59+
- apiGroups:
60+
- {{ .Resource.Domain }}
61+
resources:
62+
- {{ .Resource.Plural }}/status
63+
verbs:
64+
- get
65+
`

‎internal/plugins/ansible/v1/scaffolds/internal/templates/config/rbac/kustomization.go‎

Lines changed: 15 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
/*
22
Copyright 2019 The Kubernetes Authors.
3-
Modifications copyright 2020 The Operator-SDK Authors
43
54
Licensed under the Apache License, Version 2.0 (the "License");
65
you may not use this file except in compliance with the License.
@@ -18,18 +17,13 @@ limitations under the License.
1817
package rbac
1918

2019
import (
21-
"fmt"
2220
"path/filepath"
2321

2422
"sigs.k8s.io/kubebuilder/pkg/model/file"
2523
)
2624

2725
var _ file.Template = &Kustomization{}
2826

29-
var rbacKustomizePath = filepath.Join("config", "rbac", "kustomization.yaml")
30-
31-
const patch6902Marker = "patch6902"
32-
3327
// Kustomization scaffolds the Kustomization file in rbac folder.
3428
type Kustomization struct {
3529
file.TemplateMixin
@@ -38,73 +32,26 @@ type Kustomization struct {
3832
// SetTemplateDefaults implements input.Template
3933
func (f *Kustomization) SetTemplateDefaults() error {
4034
if f.Path == "" {
41-
f.Path = rbacKustomizePath
35+
f.Path = filepath.Join("config", "rbac", "kustomization.yaml")
4236
}
4337

44-
f.TemplateBody = fmt.Sprintf(kustomizeTemplate,
45-
file.NewMarkerFor(f.Path, patch6902Marker),
46-
)
38+
f.TemplateBody = kustomizeRBACTemplate
39+
4740
f.IfExistsAction = file.Error
4841

4942
return nil
5043
}
5144

52-
type KustomizeUpdater struct {
53-
file.TemplateMixin
54-
file.ResourceMixin
55-
}
56-
57-
func (*KustomizeUpdater) GetIfExistsAction() file.IfExistsAction {
58-
return file.Overwrite
59-
}
60-
61-
func (*KustomizeUpdater) GetPath() string {
62-
return rbacKustomizePath
63-
}
64-
65-
func (f *KustomizeUpdater) GetMarkers() []file.Marker {
66-
return []file.Marker{
67-
file.NewMarkerFor(rbacKustomizePath, patch6902Marker),
68-
}
69-
}
70-
71-
func (f *KustomizeUpdater) GetCodeFragments() file.CodeFragmentsMap {
72-
fragments := make(file.CodeFragmentsMap, 1)
73-
74-
// If resource is not being provided we are creating the file, not updating it
75-
if f.Resource == nil {
76-
return fragments
77-
}
78-
79-
// Generate patch6902 fragments
80-
patches := make([]string, 0)
81-
patches = append(patches, f.Resource.Replacer().Replace(patch6902Fragment))
82-
83-
if len(patches) != 0 {
84-
fragments[file.NewMarkerFor(rbacKustomizePath, patch6902Marker)] = patches
85-
}
86-
return fragments
87-
}
88-
89-
const kustomizeTemplate = `resources:
90-
- role.yaml
91-
- role_binding.yaml
92-
- leader_election_role.yaml
93-
- leader_election_role_binding.yaml
94-
# Comment the following 4 lines if you want to disable
95-
# the auth proxy (https://github.com/brancz/kube-rbac-proxy)
96-
# which protects your /metrics endpoint.
97-
- auth_proxy_service.yaml
98-
- auth_proxy_role.yaml
99-
- auth_proxy_role_binding.yaml
100-
- auth_proxy_client_clusterrole.yaml
101-
patchesJson6902:
102-
%s
103-
`
104-
const patch6902Fragment = ` - target:
105-
group: rbac.authorization.k8s.io
106-
version: v1
107-
kind: ClusterRole
108-
name: manager-role
109-
path: patches/%[kind]_editor_role.yaml
45+
const kustomizeRBACTemplate = `resources:
46+
- role.yaml
47+
- role_binding.yaml
48+
- leader_election_role.yaml
49+
- leader_election_role_binding.yaml
50+
# Comment the following 4 lines if you want to disable
51+
# the auth proxy (https://github.com/brancz/kube-rbac-proxy)
52+
# which protects your /metrics endpoint.
53+
- auth_proxy_service.yaml
54+
- auth_proxy_role.yaml
55+
- auth_proxy_role_binding.yaml
56+
- auth_proxy_client_clusterrole.yaml
11057
`

0 commit comments

Comments
 (0)