Skip to content

Commit e543f61

Browse files
eric200428eric200428
committed
Adding missing RBAC resources
1 parent 513f906 commit e543f61

3 files changed

Lines changed: 129 additions & 0 deletions

File tree

‎install/0000_80_machine-config_06_clusteroperator.yaml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,5 +27,55 @@ status:
2727
resource: kubeletconfigs
2828
- group: machineconfiguration.openshift.io
2929
resource: containerruntimeconfigs
30+
- group: operator.openshift.io
31+
resource: machineconfigurations
3032
- group: ""
3133
resource: nodes
34+
- group: rbac.authorization.k8s.io
35+
name: machine-config-controller
36+
resource: clusterroles
37+
- group: rbac.authorization.k8s.io
38+
name: machine-config-controller-events
39+
resource: clusterroles
40+
- group: rbac.authorization.k8s.io
41+
name: machine-config-daemon
42+
resource: clusterroles
43+
- group: rbac.authorization.k8s.io
44+
name: machine-config-daemon-events
45+
resource: clusterroles
46+
- group: rbac.authorization.k8s.io
47+
name: machine-config-server
48+
resource: clusterroles
49+
- group: rbac.authorization.k8s.io
50+
name: machine-os-builder
51+
resource: clusterroles
52+
- group: rbac.authorization.k8s.io
53+
name: machine-os-builder-events
54+
resource: clusterroles
55+
- group: rbac.authorization.k8s.io
56+
name: "system:openshift:machine-config-operator:cluster-reader"
57+
resource: clusterroles
58+
- group: rbac.authorization.k8s.io
59+
name: machine-config-controller
60+
resource: clusterrolebindings
61+
- group: rbac.authorization.k8s.io
62+
name: machine-config-daemon
63+
resource: clusterrolebindings
64+
- group: rbac.authorization.k8s.io
65+
name: machine-config-server
66+
resource: clusterrolebindings
67+
- group: rbac.authorization.k8s.io
68+
name: machine-os-builder
69+
resource: clusterrolebindings
70+
- group: rbac.authorization.k8s.io
71+
name: machine-os-builder-anyuid
72+
resource: clusterrolebindings
73+
- group: rbac.authorization.k8s.io
74+
name: custom-account-openshift-machine-config-operator
75+
resource: clusterrolebindings
76+
- group: rbac.authorization.k8s.io
77+
name: system-bootstrap-node-bootstrapper
78+
resource: clusterrolebindings
79+
- group: rbac.authorization.k8s.io
80+
name: system-bootstrap-node-renewal
81+
resource: clusterrolebindings

‎pkg/operator/status.go‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,23 @@ func (optr *Operator) syncRelatedObjects(co *configv1.ClusterOperator) {
7272
{Resource: "namespaces", Name: "openshift-vsphere-infra"},
7373
{Resource: "namespaces", Name: "openshift-nutanix-infra"},
7474
{Resource: "namespaces", Name: "openshift-cloud-platform-infra"},
75+
// ClusterRoles and ClusterRoleBindings are cluster-scoped and not implicitly gathered via namespace inspection.
76+
{Group: "rbac.authorization.k8s.io", Resource: "clusterroles", Name: "machine-config-controller"},
77+
{Group: "rbac.authorization.k8s.io", Resource: "clusterroles", Name: "machine-config-controller-events"},
78+
{Group: "rbac.authorization.k8s.io", Resource: "clusterroles", Name: "machine-config-daemon"},
79+
{Group: "rbac.authorization.k8s.io", Resource: "clusterroles", Name: "machine-config-daemon-events"},
80+
{Group: "rbac.authorization.k8s.io", Resource: "clusterroles", Name: "machine-config-server"},
81+
{Group: "rbac.authorization.k8s.io", Resource: "clusterroles", Name: "machine-os-builder"},
82+
{Group: "rbac.authorization.k8s.io", Resource: "clusterroles", Name: "machine-os-builder-events"},
83+
{Group: "rbac.authorization.k8s.io", Resource: "clusterroles", Name: "system:openshift:machine-config-operator:cluster-reader"},
84+
{Group: "rbac.authorization.k8s.io", Resource: "clusterrolebindings", Name: "machine-config-controller"},
85+
{Group: "rbac.authorization.k8s.io", Resource: "clusterrolebindings", Name: "machine-config-daemon"},
86+
{Group: "rbac.authorization.k8s.io", Resource: "clusterrolebindings", Name: "machine-config-server"},
87+
{Group: "rbac.authorization.k8s.io", Resource: "clusterrolebindings", Name: "machine-os-builder"},
88+
{Group: "rbac.authorization.k8s.io", Resource: "clusterrolebindings", Name: "machine-os-builder-anyuid"},
89+
{Group: "rbac.authorization.k8s.io", Resource: "clusterrolebindings", Name: "custom-account-openshift-machine-config-operator"},
90+
{Group: "rbac.authorization.k8s.io", Resource: "clusterrolebindings", Name: "system-bootstrap-node-bootstrapper"},
91+
{Group: "rbac.authorization.k8s.io", Resource: "clusterrolebindings", Name: "system-bootstrap-node-renewal"},
7592
}
7693

7794
if !equality.Semantic.DeepEqual(coStatusCopy.RelatedObjects, co.Status.RelatedObjects) {
@@ -475,6 +492,23 @@ func (optr *Operator) initializeClusterOperator() (*configv1.ClusterOperator, er
475492
{Group: "machineconfiguration.openshift.io", Resource: "machineconfigpools", Name: "worker"},
476493
{Group: "machineconfiguration.openshift.io", Resource: "controllerconfigs", Name: "machine-config-controller"},
477494
{Group: "operator.openshift.io", Resource: "machineconfigurations"},
495+
// ClusterRoles and ClusterRoleBindings are cluster-scoped and not implicitly gathered via namespace inspection.
496+
{Group: "rbac.authorization.k8s.io", Resource: "clusterroles", Name: "machine-config-controller"},
497+
{Group: "rbac.authorization.k8s.io", Resource: "clusterroles", Name: "machine-config-controller-events"},
498+
{Group: "rbac.authorization.k8s.io", Resource: "clusterroles", Name: "machine-config-daemon"},
499+
{Group: "rbac.authorization.k8s.io", Resource: "clusterroles", Name: "machine-config-daemon-events"},
500+
{Group: "rbac.authorization.k8s.io", Resource: "clusterroles", Name: "machine-config-server"},
501+
{Group: "rbac.authorization.k8s.io", Resource: "clusterroles", Name: "machine-os-builder"},
502+
{Group: "rbac.authorization.k8s.io", Resource: "clusterroles", Name: "machine-os-builder-events"},
503+
{Group: "rbac.authorization.k8s.io", Resource: "clusterroles", Name: "system:openshift:machine-config-operator:cluster-reader"},
504+
{Group: "rbac.authorization.k8s.io", Resource: "clusterrolebindings", Name: "machine-config-controller"},
505+
{Group: "rbac.authorization.k8s.io", Resource: "clusterrolebindings", Name: "machine-config-daemon"},
506+
{Group: "rbac.authorization.k8s.io", Resource: "clusterrolebindings", Name: "machine-config-server"},
507+
{Group: "rbac.authorization.k8s.io", Resource: "clusterrolebindings", Name: "machine-os-builder"},
508+
{Group: "rbac.authorization.k8s.io", Resource: "clusterrolebindings", Name: "machine-os-builder-anyuid"},
509+
{Group: "rbac.authorization.k8s.io", Resource: "clusterrolebindings", Name: "custom-account-openshift-machine-config-operator"},
510+
{Group: "rbac.authorization.k8s.io", Resource: "clusterrolebindings", Name: "system-bootstrap-node-bootstrapper"},
511+
{Group: "rbac.authorization.k8s.io", Resource: "clusterrolebindings", Name: "system-bootstrap-node-renewal"},
478512
}
479513
// During an installation we report the RELEASE_VERSION as soon as the component is created.
480514
// For both normal runs and upgrades, this code isn't hit and we get the right version every

‎pkg/operator/status_test.go‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1329,3 +1329,48 @@ func TestCheckBootImageSkewUpgradeableGuard(t *testing.T) {
13291329
})
13301330
}
13311331
}
1332+
1333+
func TestSyncRelatedObjectsContainsRBAC(t *testing.T) {
1334+
optr := &Operator{
1335+
namespace: "openshift-machine-config-operator",
1336+
}
1337+
co := &configv1.ClusterOperator{}
1338+
optr.syncRelatedObjects(co)
1339+
1340+
var clusterRoles, clusterRoleBindings []string
1341+
for _, obj := range co.Status.RelatedObjects {
1342+
if obj.Group != "rbac.authorization.k8s.io" {
1343+
continue
1344+
}
1345+
switch obj.Resource {
1346+
case "clusterroles":
1347+
clusterRoles = append(clusterRoles, obj.Name)
1348+
case "clusterrolebindings":
1349+
clusterRoleBindings = append(clusterRoleBindings, obj.Name)
1350+
}
1351+
}
1352+
1353+
expectedClusterRoles := []string{
1354+
"machine-config-controller",
1355+
"machine-config-controller-events",
1356+
"machine-config-daemon",
1357+
"machine-config-daemon-events",
1358+
"machine-config-server",
1359+
"machine-os-builder",
1360+
"machine-os-builder-events",
1361+
"system:openshift:machine-config-operator:cluster-reader",
1362+
}
1363+
expectedClusterRoleBindings := []string{
1364+
"machine-config-controller",
1365+
"machine-config-daemon",
1366+
"machine-config-server",
1367+
"machine-os-builder",
1368+
"machine-os-builder-anyuid",
1369+
"custom-account-openshift-machine-config-operator",
1370+
"system-bootstrap-node-bootstrapper",
1371+
"system-bootstrap-node-renewal",
1372+
}
1373+
1374+
assert.ElementsMatch(t, expectedClusterRoles, clusterRoles, "relatedObjects must include all MCO ClusterRoles for oc adm inspect to collect them")
1375+
assert.ElementsMatch(t, expectedClusterRoleBindings, clusterRoleBindings, "relatedObjects must include all MCO ClusterRoleBindings for oc adm inspect to collect them")
1376+
}

0 commit comments

Comments
 (0)