Skip to content

Commit ad56440

Browse files
RafalKoreptaRafalKorepta
committed
Add ClusterRole for Users, Topics and Schema custom resource
Reference https://github.com/redpanda-data/redpanda-operator/blob/a1865c2b39cf6f147dff7e7fff947dae6fc39ded/operator/internal/controller/redpanda/user_controller.go#L37-L39 https://github.com/redpanda-data/redpanda-operator/blob/a1865c2b39cf6f147dff7e7fff947dae6fc39ded/operator/internal/controller/redpanda/topic_controller.go#L72-L74 https://github.com/redpanda-data/redpanda-operator/blob/a1865c2b39cf6f147dff7e7fff947dae6fc39ded/operator/internal/controller/redpanda/schema_controller.go#L33-L35
1 parent 9a0f26a commit ad56440

File tree

4 files changed

+4382
-9
lines changed

4 files changed

+4382
-9
lines changed

‎charts/operator/rbac.go‎

Lines changed: 82 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -318,7 +318,64 @@ func ClusterRole(dot *helmette.Dot) []rbacv1.ClusterRole {
318318
}...)
319319
}
320320

321-
return clusterRoles
321+
return append(clusterRoles, rbacv1.ClusterRole{
322+
TypeMeta: metav1.TypeMeta{
323+
APIVersion: "rbac.authorization.k8s.io/v1",
324+
Kind: "ClusterRole",
325+
},
326+
ObjectMeta: metav1.ObjectMeta{
327+
Name: Fullname(dot),
328+
Labels: Labels(dot),
329+
Annotations: values.Annotations,
330+
},
331+
Rules: []rbacv1.PolicyRule{
332+
{
333+
Verbs: []string{"get", "list", "patch", "update", "watch"},
334+
APIGroups: []string{"cluster.redpanda.com"},
335+
Resources: []string{"topics"},
336+
},
337+
{
338+
Verbs: []string{"update"},
339+
APIGroups: []string{"cluster.redpanda.com"},
340+
Resources: []string{"topics/finalizers"},
341+
},
342+
{
343+
Verbs: []string{"get", "patch", "update"},
344+
APIGroups: []string{"cluster.redpanda.com"},
345+
Resources: []string{"topics/status"},
346+
},
347+
{
348+
Verbs: []string{"get", "list", "patch", "update", "watch"},
349+
APIGroups: []string{"cluster.redpanda.com"},
350+
Resources: []string{"users"},
351+
},
352+
{
353+
Verbs: []string{"update"},
354+
APIGroups: []string{"cluster.redpanda.com"},
355+
Resources: []string{"users/finalizers"},
356+
},
357+
{
358+
Verbs: []string{"get", "patch", "update"},
359+
APIGroups: []string{"cluster.redpanda.com"},
360+
Resources: []string{"users/status"},
361+
},
362+
{
363+
Verbs: []string{"get", "list", "patch", "update", "watch"},
364+
APIGroups: []string{"cluster.redpanda.com"},
365+
Resources: []string{"schemas"},
366+
},
367+
{
368+
Verbs: []string{"update"},
369+
APIGroups: []string{"cluster.redpanda.com"},
370+
Resources: []string{"schemas/finalizers"},
371+
},
372+
{
373+
Verbs: []string{"get", "patch", "update"},
374+
APIGroups: []string{"cluster.redpanda.com"},
375+
Resources: []string{"schemas/status"},
376+
},
377+
},
378+
})
322379
}
323380

324381
func ClusterRoleBindings(dot *helmette.Dot) []rbacv1.ClusterRoleBinding {
@@ -355,7 +412,7 @@ func ClusterRoleBindings(dot *helmette.Dot) []rbacv1.ClusterRoleBinding {
355412
}
356413

357414
if values.Scope == Cluster {
358-
binding = append(binding, rbacv1.ClusterRoleBinding{
415+
return append(binding, rbacv1.ClusterRoleBinding{
359416
TypeMeta: metav1.TypeMeta{
360417
APIVersion: "rbac.authorization.k8s.io/v1",
361418
Kind: "ClusterRoleBinding",
@@ -432,7 +489,29 @@ func ClusterRoleBindings(dot *helmette.Dot) []rbacv1.ClusterRoleBinding {
432489
})
433490
}
434491

435-
return binding
492+
return append(binding, rbacv1.ClusterRoleBinding{
493+
TypeMeta: metav1.TypeMeta{
494+
APIVersion: "rbac.authorization.k8s.io/v1",
495+
Kind: "ClusterRoleBinding",
496+
},
497+
ObjectMeta: metav1.ObjectMeta{
498+
Name: Fullname(dot),
499+
Labels: Labels(dot),
500+
Annotations: values.Annotations,
501+
},
502+
RoleRef: rbacv1.RoleRef{
503+
APIGroup: "rbac.authorization.k8s.io",
504+
Kind: "ClusterRole",
505+
Name: Fullname(dot),
506+
},
507+
Subjects: []rbacv1.Subject{
508+
{
509+
Kind: "ServiceAccount",
510+
Name: ServiceAccountName(dot),
511+
Namespace: dot.Release.Namespace,
512+
},
513+
},
514+
})
436515
}
437516

438517
func Roles(dot *helmette.Dot) []rbacv1.Role {

‎charts/operator/templates/_rbac.go.tpl‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
{{- $clusterRoles = (concat (default (list ) $clusterRoles) (default (list ) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "rules" (coalesce nil) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "rbac.authorization.k8s.io/v1" "kind" "ClusterRole" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "operator.cleanForK8sWithSuffix" (dict "a" (list (get (fromJson (include "operator.Fullname" (dict "a" (list $dot) ))) "r") "additional-controllers") ))) "r") "labels" (get (fromJson (include "operator.Labels" (dict "a" (list $dot) ))) "r") "annotations" $values.annotations )) "rules" (list (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "verbs" (list "get" "list" "watch") "apiGroups" (list "") "resources" (list "nodes") )) (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "verbs" (list "get" "list" "patch" "update" "watch" "delete") "apiGroups" (list "") "resources" (list "persistentvolumes") )) (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "verbs" (list "get" "list" "watch") "apiGroups" (list "") "resources" (list "secrets" "configmaps") )) (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "verbs" (list "get" "list" "watch") "apiGroups" (list "") "resources" (list "persistentvolumes") ))) ))))) -}}
2424
{{- end -}}
2525
{{- $_is_returning = true -}}
26-
{{- (dict "r" $clusterRoles) | toJson -}}
26+
{{- (dict "r" (concat (default (list ) $clusterRoles) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "rules" (coalesce nil) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "rbac.authorization.k8s.io/v1" "kind" "ClusterRole" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "operator.Fullname" (dict "a" (list $dot) ))) "r") "labels" (get (fromJson (include "operator.Labels" (dict "a" (list $dot) ))) "r") "annotations" $values.annotations )) "rules" (list (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "verbs" (list "get" "list" "patch" "update" "watch") "apiGroups" (list "cluster.redpanda.com") "resources" (list "topics") )) (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "verbs" (list "update") "apiGroups" (list "cluster.redpanda.com") "resources" (list "topics/finalizers") )) (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "verbs" (list "get" "patch" "update") "apiGroups" (list "cluster.redpanda.com") "resources" (list "topics/status") )) (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "verbs" (list "get" "list" "patch" "update" "watch") "apiGroups" (list "cluster.redpanda.com") "resources" (list "users") )) (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "verbs" (list "update") "apiGroups" (list "cluster.redpanda.com") "resources" (list "users/finalizers") )) (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "verbs" (list "get" "patch" "update") "apiGroups" (list "cluster.redpanda.com") "resources" (list "users/status") )) (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "verbs" (list "get" "list" "patch" "update" "watch") "apiGroups" (list "cluster.redpanda.com") "resources" (list "schemas") )) (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "verbs" (list "update") "apiGroups" (list "cluster.redpanda.com") "resources" (list "schemas/finalizers") )) (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "verbs" (list "get" "patch" "update") "apiGroups" (list "cluster.redpanda.com") "resources" (list "schemas/status") ))) ))))) | toJson -}}
2727
{{- break -}}
2828
{{- end -}}
2929
{{- end -}}
@@ -40,7 +40,9 @@
4040
{{- end -}}
4141
{{- $binding := (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "roleRef" (dict "apiGroup" "" "kind" "" "name" "" ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "rbac.authorization.k8s.io/v1" "kind" "ClusterRoleBinding" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "operator.cleanForK8sWithSuffix" (dict "a" (list (get (fromJson (include "operator.Fullname" (dict "a" (list $dot) ))) "r") "proxy-role") ))) "r") "labels" (get (fromJson (include "operator.Labels" (dict "a" (list $dot) ))) "r") "annotations" $values.annotations )) "roleRef" (mustMergeOverwrite (dict "apiGroup" "" "kind" "" "name" "" ) (dict "apiGroup" "rbac.authorization.k8s.io" "kind" "ClusterRole" "name" (get (fromJson (include "operator.cleanForK8sWithSuffix" (dict "a" (list (get (fromJson (include "operator.Fullname" (dict "a" (list $dot) ))) "r") "proxy-role") ))) "r") )) "subjects" (list (mustMergeOverwrite (dict "kind" "" "name" "" ) (dict "kind" "ServiceAccount" "name" (get (fromJson (include "operator.ServiceAccountName" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace ))) ))) -}}
4242
{{- if (eq $values.scope "Cluster") -}}
43-
{{- $binding = (concat (default (list ) $binding) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "roleRef" (dict "apiGroup" "" "kind" "" "name" "" ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "rbac.authorization.k8s.io/v1" "kind" "ClusterRoleBinding" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "operator.Fullname" (dict "a" (list $dot) ))) "r") "labels" (get (fromJson (include "operator.Labels" (dict "a" (list $dot) ))) "r") "annotations" $values.annotations )) "roleRef" (mustMergeOverwrite (dict "apiGroup" "" "kind" "" "name" "" ) (dict "apiGroup" "rbac.authorization.k8s.io" "kind" "ClusterRole" "name" (get (fromJson (include "operator.Fullname" (dict "a" (list $dot) ))) "r") )) "subjects" (list (mustMergeOverwrite (dict "kind" "" "name" "" ) (dict "kind" "ServiceAccount" "name" (get (fromJson (include "operator.ServiceAccountName" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace ))) )))) -}}
43+
{{- $_is_returning = true -}}
44+
{{- (dict "r" (concat (default (list ) $binding) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "roleRef" (dict "apiGroup" "" "kind" "" "name" "" ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "rbac.authorization.k8s.io/v1" "kind" "ClusterRoleBinding" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "operator.Fullname" (dict "a" (list $dot) ))) "r") "labels" (get (fromJson (include "operator.Labels" (dict "a" (list $dot) ))) "r") "annotations" $values.annotations )) "roleRef" (mustMergeOverwrite (dict "apiGroup" "" "kind" "" "name" "" ) (dict "apiGroup" "rbac.authorization.k8s.io" "kind" "ClusterRole" "name" (get (fromJson (include "operator.Fullname" (dict "a" (list $dot) ))) "r") )) "subjects" (list (mustMergeOverwrite (dict "kind" "" "name" "" ) (dict "kind" "ServiceAccount" "name" (get (fromJson (include "operator.ServiceAccountName" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace ))) ))))) | toJson -}}
45+
{{- break -}}
4446
{{- end -}}
4547
{{- if (and (eq $values.scope "Namespace") $values.rbac.createAdditionalControllerCRs) -}}
4648
{{- $binding = (concat (default (list ) $binding) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "roleRef" (dict "apiGroup" "" "kind" "" "name" "" ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "rbac.authorization.k8s.io/v1" "kind" "ClusterRoleBinding" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "operator.cleanForK8sWithSuffix" (dict "a" (list (get (fromJson (include "operator.Fullname" (dict "a" (list $dot) ))) "r") "additional-controllers") ))) "r") "labels" (get (fromJson (include "operator.Labels" (dict "a" (list $dot) ))) "r") "annotations" $values.annotations )) "roleRef" (mustMergeOverwrite (dict "apiGroup" "" "kind" "" "name" "" ) (dict "apiGroup" "rbac.authorization.k8s.io" "kind" "ClusterRole" "name" (get (fromJson (include "operator.cleanForK8sWithSuffix" (dict "a" (list (get (fromJson (include "operator.Fullname" (dict "a" (list $dot) ))) "r") "additional-controllers") ))) "r") )) "subjects" (list (mustMergeOverwrite (dict "kind" "" "name" "" ) (dict "kind" "ServiceAccount" "name" (get (fromJson (include "operator.ServiceAccountName" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace ))) )))) -}}
@@ -49,7 +51,7 @@
4951
{{- $binding = (concat (default (list ) $binding) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "roleRef" (dict "apiGroup" "" "kind" "" "name" "" ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "rbac.authorization.k8s.io/v1" "kind" "ClusterRoleBinding" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "operator.cleanForK8sWithSuffix" (dict "a" (list (get (fromJson (include "operator.Fullname" (dict "a" (list $dot) ))) "r") "rpk-bundle") ))) "r") "labels" (get (fromJson (include "operator.Labels" (dict "a" (list $dot) ))) "r") "annotations" $values.annotations )) "roleRef" (mustMergeOverwrite (dict "apiGroup" "" "kind" "" "name" "" ) (dict "apiGroup" "rbac.authorization.k8s.io" "kind" "ClusterRole" "name" (get (fromJson (include "operator.cleanForK8sWithSuffix" (dict "a" (list (get (fromJson (include "operator.Fullname" (dict "a" (list $dot) ))) "r") "rpk-bundle") ))) "r") )) "subjects" (list (mustMergeOverwrite (dict "kind" "" "name" "" ) (dict "kind" "ServiceAccount" "name" (get (fromJson (include "operator.ServiceAccountName" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace ))) )))) -}}
5052
{{- end -}}
5153
{{- $_is_returning = true -}}
52-
{{- (dict "r" $binding) | toJson -}}
54+
{{- (dict "r" (concat (default (list ) $binding) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "roleRef" (dict "apiGroup" "" "kind" "" "name" "" ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "rbac.authorization.k8s.io/v1" "kind" "ClusterRoleBinding" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "operator.Fullname" (dict "a" (list $dot) ))) "r") "labels" (get (fromJson (include "operator.Labels" (dict "a" (list $dot) ))) "r") "annotations" $values.annotations )) "roleRef" (mustMergeOverwrite (dict "apiGroup" "" "kind" "" "name" "" ) (dict "apiGroup" "rbac.authorization.k8s.io" "kind" "ClusterRole" "name" (get (fromJson (include "operator.Fullname" (dict "a" (list $dot) ))) "r") )) "subjects" (list (mustMergeOverwrite (dict "kind" "" "name" "" ) (dict "kind" "ServiceAccount" "name" (get (fromJson (include "operator.ServiceAccountName" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace ))) ))))) | toJson -}}
5355
{{- break -}}
5456
{{- end -}}
5557
{{- end -}}

‎charts/operator/testdata/kustomization.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
apiVersion: kustomize.config.k8s.io/v1beta1
22
kind: Kustomization
33
resources:
4-
- https://raw.githubusercontent.com/redpanda-data/redpanda-operator/rk/split-rbac-generation/operator/config/rbac/leader-election-role/role.yaml
5-
- https://raw.githubusercontent.com/redpanda-data/redpanda-operator/rk/split-rbac-generation/operator/config/rbac/v2-manager-role/role.yaml
6-
- https://raw.githubusercontent.com/redpanda-data/redpanda-operator/rk/split-rbac-generation/operator/config/rbac/bases/auth_proxy/auth_proxy_role.yaml
4+
- https://raw.githubusercontent.com/redpanda-data/redpanda-operator/main/operator/config/rbac/leader-election-role/role.yaml
5+
- https://raw.githubusercontent.com/redpanda-data/redpanda-operator/main/operator/config/rbac/v2-manager-role/role.yaml
6+
- https://raw.githubusercontent.com/redpanda-data/redpanda-operator/main/operator/config/rbac/bases/auth_proxy/auth_proxy_role.yaml
77
generatorOptions:
88
disableNameSuffixHash: true
99
namePrefix: redpanda-

0 commit comments

Comments
 (0)