Skip to content

Commit 92f531c

Browse files
a-hilalya-hilaly
authored
Merge pull request #495 from a-hilaly/multinamespace-rbac
Enhance controller RBAC and helm charts generation
2 parents 289f222 + 57b6636 commit 92f531c

File tree

8 files changed

+132
-37
lines changed

8 files changed

+132
-37
lines changed

‎pkg/generate/ack/release.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,15 @@ var (
2626
releaseTemplatePaths = []string{
2727
"config/controller/kustomization.yaml.tpl",
2828
"helm/templates/cluster-role-binding.yaml.tpl",
29+
"helm/templates/cluster-role-controller.yaml.tpl",
2930
"helm/Chart.yaml.tpl",
3031
"helm/values.yaml.tpl",
3132
"helm/values.schema.json",
3233
"helm/templates/NOTES.txt.tpl",
3334
"helm/templates/role-reader.yaml.tpl",
3435
"helm/templates/role-writer.yaml.tpl",
35-
"helm/templates/_controller-role-kind-patch.yaml.tpl",
36+
"helm/templates/caches-role.yaml.tpl",
37+
"helm/templates/caches-role-binding.yaml.tpl",
3638
"helm/templates/leader-election-role.yaml.tpl",
3739
"helm/templates/leader-election-role-binding.yaml.tpl",
3840
}

‎scripts/build-controller-release.sh

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -245,15 +245,28 @@ controller-gen rbac:roleName="$K8S_RBAC_ROLE_NAME" paths=./... output:rbac:artif
245245
# controller-gen rbac outputs a ClusterRole definition in a
246246
# $config_output_dir/rbac/role.yaml file. We additionally add the ability by
247247
# for the user to specify if they want the role to be ClusterRole or Role by specifying installation scope
248-
# in the helm values.yaml. We do this by having a custom helm template named _controller-role-kind-patch.yaml
249-
# which utilizes the template language and adding the auto generated rules to that template.
250-
tail -n +7 "$helm_output_dir/templates/role.yaml" >> "$helm_output_dir/templates/_controller-role-kind-patch.yaml"
251-
252-
# We have some other standard Role files for a reader and writer role, so here we rename
253-
# the `_controller-role-kind-patch.yaml ` file to `cluster-role-controller.yaml`
254-
# to better reflect what is in that file.
255-
mv "$helm_output_dir/templates/_controller-role-kind-patch.yaml" "$helm_output_dir/templates/cluster-role-controller.yaml"
248+
# in the helm values.yaml.
249+
250+
# NOTE(a-hilaly): This is some very bad bash-fu, i'm having thoughts about rewriting this hacky code
251+
# in Go or something else. Maybe we need to rework all our generation scripts to be more modular and
252+
# easier to maintain.
253+
254+
# First we trim the first 6 lines of the role.yaml file (which is the apiVersion, kind, metadata ...)
255+
# this will leave us the rules section of the role.yaml file. We then append the rules section to the
256+
# _helpers-patch.yaml file which is a file that will be included in the _helpers.tpl file. This will
257+
# allow us to use the rules section in the _helpers.tpl file to generate the correct role/clusterrole.
258+
tail -n +7 "$helm_output_dir/templates/role.yaml" > "$helm_output_dir/templates/_helpers-patch.yaml"
259+
helpers_patch_path="$helm_output_dir/templates/_helpers-patch.yaml"
260+
261+
# Some sed-fu to fill the "controller-role-rules" section. Urgh.
262+
sed '/SEDREPLACERULES/{
263+
r '$helpers_patch_path'
264+
d
265+
}' $helm_output_dir/templates/_helpers.tpl > $helm_output_dir/templates/_helpers-new.tpl
266+
mv $helm_output_dir/templates/_helpers-new.tpl $helm_output_dir/templates/_helpers.tpl
267+
256268
rm "$helm_output_dir/templates/role.yaml"
269+
rm "$helpers_patch_path"
257270

258271
popd 1>/dev/null
259272

‎templates/helm/templates/_controller-role-kind-patch.yaml.tpl

Lines changed: 0 additions & 21 deletions
This file was deleted.

‎templates/helm/templates/_helpers.tpl

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,3 +46,8 @@ If release name contains chart name it will be used as a full name.
4646
{{- define "aws.credentials.path" -}}
4747
{{- printf "%s/%s" (include "aws.credentials.secret_mount_path" .) .Values.aws.credentials.secretKey -}}
4848
{{- end -}}
49+
50+
{{/* The rules a of ClusterRole or Role */}}
51+
{{- define "controller-role-rules" }}
52+
SEDREPLACERULES
53+
{{- end }}

‎templates/helm/templates/caches-role-binding.yaml.tpl

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
name: ack-namespaces-cache-{{ .ServicePackageName }}-controller
5+
roleRef:
6+
kind: ClusterRole
7+
apiGroup: rbac.authorization.k8s.io
8+
name: ack-namespaces-cache-{{ .ServicePackageName }}-controller
9+
subjects:
10+
- kind: ServiceAccount
11+
name: ack-{{ .ServicePackageName }}-controller
12+
namespace: {{ "{{ .Release.Namespace }}" }}
13+
---
14+
apiVersion: rbac.authorization.k8s.io/v1
15+
kind: RoleBinding
16+
metadata:
17+
name: ack-configmaps-cache-{{ .ServicePackageName }}-controller
18+
namespace: {{ "{{ .Release.Namespace }}" }}
19+
roleRef:
20+
kind: Role
21+
apiGroup: rbac.authorization.k8s.io
22+
name: ack-configmaps-cache-{{ .ServicePackageName }}-controller
23+
subjects:
24+
- kind: ServiceAccount
25+
name: ack-{{ .ServicePackageName }}-controller
26+
namespace: {{ "{{ .Release.Namespace }}" }}

‎templates/helm/templates/caches-role.yaml.tpl

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: ack-namespaces-cache-{{ .ServicePackageName }}-controller
5+
rules:
6+
- apiGroups:
7+
- ""
8+
resources:
9+
- namespaces
10+
verbs:
11+
- get
12+
- list
13+
- watch
14+
---
15+
apiVersion: rbac.authorization.k8s.io/v1
16+
kind: Role
17+
metadata:
18+
name: ack-configmaps-cache-{{ .ServicePackageName }}-controller
19+
namespace: {{ "{{ .Release.Namespace }}" }}
20+
rules:
21+
- apiGroups:
22+
- ""
23+
resources:
24+
- configmaps
25+
verbs:
26+
- get
27+
- list
28+
- watch

‎templates/helm/templates/cluster-role-binding.yaml.tpl

Lines changed: 21 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,35 @@
1-
apiVersion: rbac.authorization.k8s.io/v1
21
{{ "{{ if eq .Values.installScope \"cluster\" }}" }}
2+
apiVersion: rbac.authorization.k8s.io/v1
33
kind: ClusterRoleBinding
44
metadata:
55
name: {{ "{{ include \"app.fullname\" . }}" }}
66
roleRef:
77
kind: ClusterRole
8-
{{ "{{ else }}" }}
8+
apiGroup: rbac.authorization.k8s.io
9+
name: ack-{{ .ServicePackageName }}-controller
10+
subjects:
11+
- kind: ServiceAccount
12+
name: {{ "{{ include \"service-account.name\" . }}" }}
13+
namespace: {{ "{{ .Release.Namespace }}" }}
14+
{{ "{{ else if .Values.watchNamespace }}" }}
15+
{{ "{{ $namespaces := split \",\" .Values.watchNamespace }}" }}
16+
{{ "{{ $fullname := include \"app.fullname\" . }}" }}
17+
{{ "{{ $releaseNamespace := .Release.Namespace }}" }}
18+
{{ "{{ $serviceAccountName := include \"service-account.name\" . }}" }}
19+
{{ "{{ range $namespaces }}" }}
20+
---
21+
apiVersion: rbac.authorization.k8s.io/v1
922
kind: RoleBinding
1023
metadata:
11-
name: {{ "{{ include \"app.fullname\" . }}" }}
12-
namespace: {{ "{{ .Release.Namespace }}" }}
24+
name: {{ "{{ $fullname }}" }}
25+
namespace: {{ "{{ . }}" }}
1326
roleRef:
1427
kind: Role
15-
{{ "{{ end }}" }}
1628
apiGroup: rbac.authorization.k8s.io
1729
name: ack-{{ .ServicePackageName }}-controller
1830
subjects:
1931
- kind: ServiceAccount
20-
name: {{ "{{ include \"service-account.name\" . }}" }}
21-
namespace: {{ "{{ .Release.Namespace }}" }}
32+
name: {{ "{{ $serviceAccountName }}" }}
33+
namespace: {{ "{{ $releaseNamespace }}" }}
34+
{{ "{{ end }}" }}
35+
{{ "{{ end }}" }}

‎templates/helm/templates/cluster-role-controller.yaml.tpl

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
{{ "{{ $labels := .Values.role.labels }}" }}
2+
{{ "{{ $rules := include \"controller-role-rules\" . }}" }}
3+
{{ "{{ if eq .Values.installScope \"cluster\" }}" }}
4+
apiVersion: rbac.authorization.k8s.io/v1
5+
kind: ClusterRole
6+
metadata:
7+
name: ack-{{ .ServicePackageName }}-controller
8+
labels:
9+
{{ "{{- range $key, $value := $labels }}" }}
10+
{{ "{{ $key }}: {{ $value | quote }}" }}
11+
{{ "{{- end }}" }}
12+
{{ "{{- $rules }}" }}
13+
{{ "{{ else if .Values.watchNamespace }}" }}
14+
{{ "{{ $namespaces := split \",\" .Values.watchNamespace }}" }}
15+
{{ "{{ range $namespaces }}" }}
16+
---
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
kind: Role
19+
metadata:
20+
name: ack-{{ .ServicePackageName }}-controller
21+
namespace: {{ "{{ . }}" }}
22+
labels:
23+
{{ "{{- range $key, $value := $labels }}" }}
24+
{{ "{{ $key }}: {{ $value | quote }}" }}
25+
{{ "{{- end }}" }}
26+
{{ "{{- $rules }}" }}
27+
{{ "{{ end }}" }}
28+
{{ "{{ end }}" }}

0 commit comments

Comments
 (0)