You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "gansheer (via GitHub)" <gi...@apache.org> on 2023/11/10 16:28:23 UTC
[PR] feat(install): Separate namespaced and descoped rbacs [camel-k]
gansheer opened a new pull request, #4914:
URL: https://github.com/apache/camel-k/pull/4914
Ref #3165
<!-- Description -->
<!--
Enter your extended release note in the below block. If the PR requires
additional action from users switching to the new release, include the string
"action required". If no release note is required, write "NONE".
You can (optionally) mark this PR with labels "kind/bug" or "kind/feature" to make sure
the text is added to the right section of the release notes.
-->
**Release Note**
```release-note
NONE
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(install): Separate namespaced and descoped rbacs [camel-k]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #4914:
URL: https://github.com/apache/camel-k/pull/4914#issuecomment-1818730663
:camel: **Thank you for contributing!**
Code Coverage Report :warning: - Coverage changed: 33.6% --> 33.5% (Coverage difference: **-.1%**)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(install): Separate namespaced and descoped rbacs [camel-k]
Posted by "squakez (via GitHub)" <gi...@apache.org>.
squakez commented on code in PR #4914:
URL: https://github.com/apache/camel-k/pull/4914#discussion_r1423908950
##########
config/rbac/kustomization.yaml:
##########
@@ -23,23 +23,22 @@ kind: Kustomization
resources:
- user-cluster-role.yaml
-- operator-role-events.yaml
-- operator-role-knative.yaml
-- operator-role.yaml
-- operator-role-keda.yaml
-- operator-role-leases.yaml
-- operator-role-podmonitors.yaml
-- operator-role-strimzi.yaml
-- operator-role-binding-events.yaml
-- operator-role-binding-keda.yaml
-- operator-role-binding-knative.yaml
-- operator-role-binding-leases.yaml
-- operator-role-binding-local-registry.yaml
-- operator-role-binding-podmonitors.yaml
-- operator-role-binding-strimzi.yaml
-- operator-role-binding.yaml
- operator-cluster-role-custom-resource-definitions.yaml
- operator-cluster-role-binding-custom-resource-definitions.yaml
- operator-cluster-role-addressable-resolver.yaml
- operator-cluster-role-binding-addressable-resolver.yaml
- operator-cluster-role-local-registry.yaml
+- operator-role-binding-local-registry.yaml
+
+
+transformers:
Review Comment:
Is this one something which would require user's attention by any chance? I mean, does it deserve some kind of documentation?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(install): Separate namespaced and descoped rbacs [camel-k]
Posted by "gansheer (via GitHub)" <gi...@apache.org>.
gansheer commented on code in PR #4914:
URL: https://github.com/apache/camel-k/pull/4914#discussion_r1423956152
##########
config/rbac/kustomization.yaml:
##########
@@ -23,23 +23,22 @@ kind: Kustomization
resources:
- user-cluster-role.yaml
-- operator-role-events.yaml
-- operator-role-knative.yaml
-- operator-role.yaml
-- operator-role-keda.yaml
-- operator-role-leases.yaml
-- operator-role-podmonitors.yaml
-- operator-role-strimzi.yaml
-- operator-role-binding-events.yaml
-- operator-role-binding-keda.yaml
-- operator-role-binding-knative.yaml
-- operator-role-binding-leases.yaml
-- operator-role-binding-local-registry.yaml
-- operator-role-binding-podmonitors.yaml
-- operator-role-binding-strimzi.yaml
-- operator-role-binding.yaml
- operator-cluster-role-custom-resource-definitions.yaml
- operator-cluster-role-binding-custom-resource-definitions.yaml
- operator-cluster-role-addressable-resolver.yaml
- operator-cluster-role-binding-addressable-resolver.yaml
- operator-cluster-role-local-registry.yaml
+- operator-role-binding-local-registry.yaml
+
+
+transformers:
Review Comment:
Actually this is a fix. This RoleBinding should not have been transformed in a ClusterRoleBinding in the first place as it is supposed to only give access to a configmap in the "kube-public" namespace.
The current documentation only reference the "high-level" kustomization files (or the install script https://camel.apache.org/camel-k/2.1.x/installation/advanced/kustomize.html), but you are right I will update [this part](https://camel.apache.org/camel-k/2.1.x/installation/installation.html#kustomize) to add some explanation.
In any case a lot of documentation for specific cases are lacking in favor of the script usage.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(install): Separate namespaced and descoped rbacs [camel-k]
Posted by "squakez (via GitHub)" <gi...@apache.org>.
squakez merged PR #4914:
URL: https://github.com/apache/camel-k/pull/4914
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(install): Separate namespaced and descoped rbacs [camel-k]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #4914:
URL: https://github.com/apache/camel-k/pull/4914#issuecomment-1816411380
:camel: **Thank you for contributing!**
Code Coverage Report :warning: - Coverage changed: 33.6% --> 33.5% (Coverage difference: **-.1%**)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(install): Separate namespaced and descoped rbacs [camel-k]
Posted by "gansheer (via GitHub)" <gi...@apache.org>.
gansheer commented on code in PR #4914:
URL: https://github.com/apache/camel-k/pull/4914#discussion_r1392570618
##########
pkg/install/operator.go:
##########
@@ -200,44 +199,6 @@ func OperatorOrCollect(ctx context.Context, cmd *cobra.Command, c client.Client,
envvar.SetVal(&d.Spec.Template.Spec.Containers[0].Env, "WATCH_NAMESPACE", "")
}
}
-
- // Turn Role & RoleBinding into their equivalent cluster types
- if r, ok := o.(*rbacv1.Role); ok {
- if strings.HasPrefix(r.Name, "camel-k-operator") {
- o = &rbacv1.ClusterRole{
- ObjectMeta: metav1.ObjectMeta{
- Namespace: cfg.Namespace,
- Name: r.Name,
- Labels: map[string]string{
- "app": "camel-k",
- },
- },
- Rules: r.Rules,
- }
- }
- }
-
- if rb, ok := o.(*rbacv1.RoleBinding); ok {
- if strings.HasPrefix(rb.Name, "camel-k-operator") {
- rb.Subjects[0].Namespace = cfg.Namespace
-
- o = &rbacv1.ClusterRoleBinding{
- ObjectMeta: metav1.ObjectMeta{
- Namespace: cfg.Namespace,
- Name: fmt.Sprintf("%s-%s", rb.Name, cfg.Namespace),
Review Comment:
@lburgazzoli @phantomjinx Do you know why the global cluster role bindings name are replaces with the namespace suffix ?
##########
pkg/install/operator.go:
##########
@@ -200,44 +199,6 @@ func OperatorOrCollect(ctx context.Context, cmd *cobra.Command, c client.Client,
envvar.SetVal(&d.Spec.Template.Spec.Containers[0].Env, "WATCH_NAMESPACE", "")
}
}
-
- // Turn Role & RoleBinding into their equivalent cluster types
- if r, ok := o.(*rbacv1.Role); ok {
- if strings.HasPrefix(r.Name, "camel-k-operator") {
- o = &rbacv1.ClusterRole{
- ObjectMeta: metav1.ObjectMeta{
- Namespace: cfg.Namespace,
- Name: r.Name,
- Labels: map[string]string{
- "app": "camel-k",
- },
- },
- Rules: r.Rules,
- }
- }
- }
-
- if rb, ok := o.(*rbacv1.RoleBinding); ok {
- if strings.HasPrefix(rb.Name, "camel-k-operator") {
- rb.Subjects[0].Namespace = cfg.Namespace
-
- o = &rbacv1.ClusterRoleBinding{
- ObjectMeta: metav1.ObjectMeta{
- Namespace: cfg.Namespace,
- Name: fmt.Sprintf("%s-%s", rb.Name, cfg.Namespace),
Review Comment:
@lburgazzoli @phantomjinx Do you know why the global cluster role bindings name are tranformed with the namespace suffix ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(install): Separate namespaced and descoped rbacs [camel-k]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #4914:
URL: https://github.com/apache/camel-k/pull/4914#issuecomment-1840285278
:camel: **Thank you for contributing!**
Code Coverage Report :warning: - Coverage changed: 33.6% --> 33.5% (Coverage difference: **-.1%**)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(install): Separate namespaced and descoped rbacs [camel-k]
Posted by "gansheer (via GitHub)" <gi...@apache.org>.
gansheer commented on PR #4914:
URL: https://github.com/apache/camel-k/pull/4914#issuecomment-1851919244
It is ready for merge. From my tests, on vanilla kubernetes and Openshift, it is transparent on existing installation methods CLI and Kustomize (I didn't test helm as helm uses its own files).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(install): Separate namespaced and descoped rbacs [camel-k]
Posted by "gansheer (via GitHub)" <gi...@apache.org>.
gansheer commented on code in PR #4914:
URL: https://github.com/apache/camel-k/pull/4914#discussion_r1424119707
##########
config/rbac/kustomization.yaml:
##########
@@ -23,23 +23,22 @@ kind: Kustomization
resources:
- user-cluster-role.yaml
-- operator-role-events.yaml
-- operator-role-knative.yaml
-- operator-role.yaml
-- operator-role-keda.yaml
-- operator-role-leases.yaml
-- operator-role-podmonitors.yaml
-- operator-role-strimzi.yaml
-- operator-role-binding-events.yaml
-- operator-role-binding-keda.yaml
-- operator-role-binding-knative.yaml
-- operator-role-binding-leases.yaml
-- operator-role-binding-local-registry.yaml
-- operator-role-binding-podmonitors.yaml
-- operator-role-binding-strimzi.yaml
-- operator-role-binding.yaml
- operator-cluster-role-custom-resource-definitions.yaml
- operator-cluster-role-binding-custom-resource-definitions.yaml
- operator-cluster-role-addressable-resolver.yaml
- operator-cluster-role-binding-addressable-resolver.yaml
- operator-cluster-role-local-registry.yaml
+- operator-role-binding-local-registry.yaml
+
+
+transformers:
Review Comment:
@squakez I added the documentation :book:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(install): Separate namespaced and descoped rbacs [camel-k]
Posted by "gansheer (via GitHub)" <gi...@apache.org>.
gansheer commented on PR #4914:
URL: https://github.com/apache/camel-k/pull/4914#issuecomment-1813966332
@oscerd @christophd @squakez Could you trigger the e2e tests please :pray:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(install): Separate namespaced and descoped rbacs [camel-k]
Posted by "claudio4j (via GitHub)" <gi...@apache.org>.
claudio4j commented on code in PR #4914:
URL: https://github.com/apache/camel-k/pull/4914#discussion_r1396501841
##########
pkg/install/operator.go:
##########
@@ -200,44 +199,6 @@ func OperatorOrCollect(ctx context.Context, cmd *cobra.Command, c client.Client,
envvar.SetVal(&d.Spec.Template.Spec.Containers[0].Env, "WATCH_NAMESPACE", "")
}
}
-
- // Turn Role & RoleBinding into their equivalent cluster types
- if r, ok := o.(*rbacv1.Role); ok {
- if strings.HasPrefix(r.Name, "camel-k-operator") {
- o = &rbacv1.ClusterRole{
- ObjectMeta: metav1.ObjectMeta{
- Namespace: cfg.Namespace,
- Name: r.Name,
- Labels: map[string]string{
- "app": "camel-k",
- },
- },
- Rules: r.Rules,
- }
- }
- }
-
- if rb, ok := o.(*rbacv1.RoleBinding); ok {
- if strings.HasPrefix(rb.Name, "camel-k-operator") {
- rb.Subjects[0].Namespace = cfg.Namespace
-
- o = &rbacv1.ClusterRoleBinding{
- ObjectMeta: metav1.ObjectMeta{
- Namespace: cfg.Namespace,
- Name: fmt.Sprintf("%s-%s", rb.Name, cfg.Namespace),
Review Comment:
It comes from #2683, to allow multiple global operators in multiple namespaces, to create a CRB and associate to a SA which was installed in the global operator namespace.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(install): Separate namespaced and descoped rbacs [camel-k]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #4914:
URL: https://github.com/apache/camel-k/pull/4914#issuecomment-1819073303
:camel: **Thank you for contributing!**
Code Coverage Report :warning: - Coverage changed: 33.6% --> 33.5% (Coverage difference: **-.1%**)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(install): Separate namespaced and descoped rbacs [camel-k]
Posted by "squakez (via GitHub)" <gi...@apache.org>.
squakez commented on PR #4914:
URL: https://github.com/apache/camel-k/pull/4914#issuecomment-1851879623
@gansheer is this good to merge? how is this affecting the installation procedures (if it does affect in any manner)?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(install): Separate namespaced and descoped rbacs [camel-k]
Posted by "gansheer (via GitHub)" <gi...@apache.org>.
gansheer commented on PR #4914:
URL: https://github.com/apache/camel-k/pull/4914#issuecomment-1851702772
@squakez can you launch the tests again please 🙏 ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org