Skip creator owner RBAC step if noCreatorRBAC annotation is present #47259
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
JonCrowther
requested review from
pmatseykanets,
MbolotSuse and
raulcabello
2 tasks
2 tasks
raulcabello
reviewed
Sep 27, 2024
pkg/controllers/management/auth/project_cluster/project_handler.go
Outdated
Show resolved
Hide resolved
raulcabello
reviewed
Sep 27, 2024
pkg/controllers/management/auth/project_cluster/cluster_handler.go
Outdated
Show resolved
Hide resolved
raulcabello
previously approved these changes
Sep 30, 2024
pkg/controllers/management/auth/project_cluster/cluster_handler.go
Outdated
Show resolved
Hide resolved
pmatseykanets
previously approved these changes
Sep 30, 2024
crobby
reviewed
Sep 30, 2024
crobby
previously approved these changes
Oct 1, 2024
pmatseykanets
approved these changes
Oct 2, 2024
crobby
approved these changes
Oct 2, 2024
4 tasks
rohitsakala
pushed a commit
to rohitsakala/rancher
that referenced
this pull request
Oct 31, 2024
…ancher#47259) * Skip creator RBAC step if annotation is present * Add tests * Move annotation check outside of CreatorMadeOwner condition * Rename annotation * Add debug log for when we skip creating owner RBAC * Increase log level from debug to info
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue: #45591
Requires webhook changes: rancher/webhook#511
Problem
When a service account creates a cluster, the project handler and cluster handler both attempt to create ClusterOwner and ProjectOwner roles and bind those roles to the service account. The problem is that we don't support those roles for service accounts, so the logs get flooded with errors as it keeps retrying to add those roles.
Solution
To avoid the errors and the re-queuing, we have added a new annotation
field.cattle.io/no-creator-rbac. If that annotation exists when a cluster is created, it is propagated to the project and neither ProjectOwner or ClusterOwner roles get created. That way users can specify when they want this automated process to occur.Testing
The issue has steps to recreate the problem with turtles. Alternatively, you can:
cluster.provisioning.cattle.ioCRD and the config CRD (in my case it wasdigitaloceanconfig.rke-machine-config.cattle.io)After applying the changes in this PR and the webhook PR, you can add the annotation
field.cattle.io/no-creator-rbacto the cluster CRD and see that the errors don't appear in the logs on creation.Engineering Testing
Manual Testing
As mentioned, creating an annotated cluster with a service account yields no errors.
Automated Testing
Summary:
QA Testing Considerations
Regressions Considerations
TODO
Existing / newly added automated tests that provide evidence there are no regressions: