Skip to content

Commit 0fa927b

Browse files
lucian-tosalucian-tosa
committed
Validations
1 parent d2f0323 commit 0fa927b

File tree

7 files changed

+190
-3
lines changed

7 files changed

+190
-3
lines changed

‎config/rbac/operator-roles.yaml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,20 @@
11
---
22
# Source: mongodb-kubernetes/templates/operator-roles.yaml
3+
kind: ClusterRole
4+
apiVersion: rbac.authorization.k8s.io/v1
5+
metadata:
6+
name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role
7+
rules:
8+
- apiGroups:
9+
- mongodb.com
10+
verbs:
11+
- '*'
12+
resources:
13+
- clustermongodbroles
14+
- clustermongodbroles/finalizers
15+
- clustermongodbroles/status
16+
---
17+
# Source: mongodb-kubernetes/templates/operator-roles.yaml
318
---
419
# Additional ClusterRole for clusterVersionDetection
520
kind: ClusterRole
@@ -29,6 +44,20 @@ rules:
2944
- list
3045
---
3146
# Source: mongodb-kubernetes/templates/operator-roles.yaml
47+
kind: ClusterRoleBinding
48+
apiVersion: rbac.authorization.k8s.io/v1
49+
metadata:
50+
name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role-binding
51+
roleRef:
52+
apiGroup: rbac.authorization.k8s.io
53+
kind: ClusterRole
54+
name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role
55+
subjects:
56+
- kind: ServiceAccount
57+
name: mongodb-kubernetes-operator
58+
namespace: mongodb
59+
---
60+
# Source: mongodb-kubernetes/templates/operator-roles.yaml
3261
# ClusterRoleBinding for clusterVersionDetection
3362
kind: ClusterRoleBinding
3463
apiVersion: rbac.authorization.k8s.io/v1

‎config/rbac/role.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,14 @@ rules:
4141
verbs:
4242
- get
4343
- list
44+
- apiGroups:
45+
- mongodb.com
46+
resources:
47+
- clustermongodbroles
48+
- clustermongodbroles/finalizers
49+
- clustermongodbroles/status
50+
verbs:
51+
- '*'
4452
- apiGroups:
4553
- mongodbcommunity.mongodb.com
4654
resources:

‎helm_chart/templates/operator-roles.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,36 @@ subjects:
142142
namespace: {{ include "mongodb-kubernetes-operator.namespace" $ }}
143143
{{- end }}
144144

145+
---
146+
kind: ClusterRole
147+
apiVersion: rbac.authorization.k8s.io/v1
148+
metadata:
149+
name: {{ .Values.operator.name }}-{{ include "mongodb-kubernetes-operator.namespace" . }}-cluster-mongodb-role
150+
rules:
151+
- apiGroups:
152+
- mongodb.com
153+
verbs:
154+
- '*'
155+
resources:
156+
- clustermongodbroles
157+
- clustermongodbroles/finalizers
158+
{{- if .Values.subresourceEnabled }}
159+
- clustermongodbroles/status
160+
{{- end }}
161+
---
162+
kind: ClusterRoleBinding
163+
apiVersion: rbac.authorization.k8s.io/v1
164+
metadata:
165+
name: {{ .Values.operator.name }}-{{ include "mongodb-kubernetes-operator.namespace" . }}-cluster-mongodb-role-binding
166+
roleRef:
167+
apiGroup: rbac.authorization.k8s.io
168+
kind: ClusterRole
169+
name: {{ .Values.operator.name }}-{{ include "mongodb-kubernetes-operator.namespace" . }}-cluster-mongodb-role
170+
subjects:
171+
- kind: ServiceAccount
172+
name: {{ .Values.operator.name }}
173+
namespace: {{ include "mongodb-kubernetes-operator.namespace" . }}
174+
145175
{{- end }}
146176
---
147177

‎public/mongodb-kubernetes-multi-cluster.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,21 @@
22
# Source: mongodb-kubernetes/templates/operator-roles.yaml
33
kind: ClusterRole
44
apiVersion: rbac.authorization.k8s.io/v1
5+
metadata:
6+
name: mongodb-kubernetes-operator-multi-cluster-mongodb-cluster-mongodb-role
7+
rules:
8+
- apiGroups:
9+
- mongodb.com
10+
verbs:
11+
- '*'
12+
resources:
13+
- clustermongodbroles
14+
- clustermongodbroles/finalizers
15+
- clustermongodbroles/status
16+
---
17+
# Source: mongodb-kubernetes/templates/operator-roles.yaml
18+
kind: ClusterRole
19+
apiVersion: rbac.authorization.k8s.io/v1
520
metadata:
621
name: mongodb-kubernetes-operator-mongodb-webhook
722
rules:
@@ -57,6 +72,20 @@ rules:
5772
# Source: mongodb-kubernetes/templates/operator-roles.yaml
5873
kind: ClusterRoleBinding
5974
apiVersion: rbac.authorization.k8s.io/v1
75+
metadata:
76+
name: mongodb-kubernetes-operator-multi-cluster-mongodb-cluster-mongodb-role-binding
77+
roleRef:
78+
apiGroup: rbac.authorization.k8s.io
79+
kind: ClusterRole
80+
name: mongodb-kubernetes-operator-multi-cluster-mongodb-cluster-mongodb-role
81+
subjects:
82+
- kind: ServiceAccount
83+
name: mongodb-kubernetes-operator-multi-cluster
84+
namespace: mongodb
85+
---
86+
# Source: mongodb-kubernetes/templates/operator-roles.yaml
87+
kind: ClusterRoleBinding
88+
apiVersion: rbac.authorization.k8s.io/v1
6089
metadata:
6190
name: mongodb-kubernetes-operator-multi-cluster-mongodb-webhook-binding
6291
roleRef:
@@ -290,6 +319,7 @@ spec:
290319
- -watch-resource=mongodbusers
291320
- -watch-resource=mongodbcommunity
292321
- -watch-resource=mongodbsearch
322+
- -watch-resource=clustermongodbroles
293323
- -watch-resource=mongodbmulticluster
294324
command:
295325
- /usr/local/bin/mongodb-kubernetes-operator

‎public/mongodb-kubernetes-openshift.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,21 @@
22
# Source: mongodb-kubernetes/templates/operator-roles.yaml
33
kind: ClusterRole
44
apiVersion: rbac.authorization.k8s.io/v1
5+
metadata:
6+
name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role
7+
rules:
8+
- apiGroups:
9+
- mongodb.com
10+
verbs:
11+
- '*'
12+
resources:
13+
- clustermongodbroles
14+
- clustermongodbroles/finalizers
15+
- clustermongodbroles/status
16+
---
17+
# Source: mongodb-kubernetes/templates/operator-roles.yaml
18+
kind: ClusterRole
19+
apiVersion: rbac.authorization.k8s.io/v1
520
metadata:
621
name: mongodb-kubernetes-operator-mongodb-webhook
722
rules:
@@ -57,6 +72,20 @@ rules:
5772
# Source: mongodb-kubernetes/templates/operator-roles.yaml
5873
kind: ClusterRoleBinding
5974
apiVersion: rbac.authorization.k8s.io/v1
75+
metadata:
76+
name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role-binding
77+
roleRef:
78+
apiGroup: rbac.authorization.k8s.io
79+
kind: ClusterRole
80+
name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role
81+
subjects:
82+
- kind: ServiceAccount
83+
name: mongodb-kubernetes-operator
84+
namespace: mongodb
85+
---
86+
# Source: mongodb-kubernetes/templates/operator-roles.yaml
87+
kind: ClusterRoleBinding
88+
apiVersion: rbac.authorization.k8s.io/v1
6089
metadata:
6190
name: mongodb-kubernetes-operator-mongodb-webhook-binding
6291
roleRef:
@@ -287,6 +316,7 @@ spec:
287316
- -watch-resource=mongodbusers
288317
- -watch-resource=mongodbcommunity
289318
- -watch-resource=mongodbsearch
319+
- -watch-resource=clustermongodbroles
290320
command:
291321
- /usr/local/bin/mongodb-kubernetes-operator
292322
resources:

‎public/mongodb-kubernetes.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,21 @@
22
# Source: mongodb-kubernetes/templates/operator-roles.yaml
33
kind: ClusterRole
44
apiVersion: rbac.authorization.k8s.io/v1
5+
metadata:
6+
name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role
7+
rules:
8+
- apiGroups:
9+
- mongodb.com
10+
verbs:
11+
- '*'
12+
resources:
13+
- clustermongodbroles
14+
- clustermongodbroles/finalizers
15+
- clustermongodbroles/status
16+
---
17+
# Source: mongodb-kubernetes/templates/operator-roles.yaml
18+
kind: ClusterRole
19+
apiVersion: rbac.authorization.k8s.io/v1
520
metadata:
621
name: mongodb-kubernetes-operator-mongodb-webhook
722
rules:
@@ -57,6 +72,20 @@ rules:
5772
# Source: mongodb-kubernetes/templates/operator-roles.yaml
5873
kind: ClusterRoleBinding
5974
apiVersion: rbac.authorization.k8s.io/v1
75+
metadata:
76+
name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role-binding
77+
roleRef:
78+
apiGroup: rbac.authorization.k8s.io
79+
kind: ClusterRole
80+
name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role
81+
subjects:
82+
- kind: ServiceAccount
83+
name: mongodb-kubernetes-operator
84+
namespace: mongodb
85+
---
86+
# Source: mongodb-kubernetes/templates/operator-roles.yaml
87+
kind: ClusterRoleBinding
88+
apiVersion: rbac.authorization.k8s.io/v1
6089
metadata:
6190
name: mongodb-kubernetes-operator-mongodb-webhook-binding
6291
roleRef:
@@ -290,6 +319,7 @@ spec:
290319
- -watch-resource=mongodbusers
291320
- -watch-resource=mongodbcommunity
292321
- -watch-resource=mongodbsearch
322+
- -watch-resource=clustermongodbroles
293323
command:
294324
- /usr/local/bin/mongodb-kubernetes-operator
295325
resources:

‎public/tools/multicluster/pkg/common/common.go

Lines changed: 33 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -319,9 +319,6 @@ func EnsureMultiClusterResources(ctx context.Context, flags Flags, clientMap map
319319
}
320320

321321
centralClusterClient := clientMap[flags.CentralCluster]
322-
if err != nil {
323-
return xerrors.Errorf("failed to get central cluster clientset: %w", err)
324-
}
325322

326323
if err := createKubeConfigSecret(ctx, centralClusterClient, kubeConfigBytes, flags); err != nil {
327324
return xerrors.Errorf("failed creating KubeConfig secret: %w", err)
@@ -524,6 +521,22 @@ func buildClusterRoleTelemetry() rbacv1.ClusterRole {
524521
}
525522
}
526523

524+
func buildClusterRoleMongoDBRole() rbacv1.ClusterRole {
525+
return rbacv1.ClusterRole{
526+
ObjectMeta: metav1.ObjectMeta{
527+
Name: DefaultOperatorName + "-multi-cluster-role-mongodb-roles",
528+
Labels: multiClusterLabels(),
529+
},
530+
Rules: []rbacv1.PolicyRule{
531+
{
532+
Verbs: []string{"*"},
533+
Resources: []string{"clustermongodbroles", "clustermongodbroles/finalizers", "clustermongodbroles/status"},
534+
APIGroups: []string{"mongodb.com"},
535+
},
536+
},
537+
}
538+
}
539+
527540
// buildRoleBinding creates the RoleBinding which binds the Role to the given ServiceAccount.
528541
func buildRoleBinding(role rbacv1.Role, serviceAccount string, serviceAccountNamespace string) rbacv1.RoleBinding {
529542
return rbacv1.RoleBinding{
@@ -592,6 +605,23 @@ func createRoles(ctx context.Context, c KubeClient, serviceAccountName, serviceA
592605

593606
}
594607

608+
// Create ClusterRole to access the cluster-scoped resource ClusterMongoDBRole
609+
clusterRoleForMongoDBRole := buildClusterRoleMongoDBRole()
610+
_, err = c.RbacV1().ClusterRoles().Create(ctx, &clusterRoleForMongoDBRole, metav1.CreateOptions{})
611+
if err != nil {
612+
if errors.IsAlreadyExists(err) {
613+
if _, err := c.RbacV1().ClusterRoles().Update(ctx, &clusterRoleForMongoDBRole, metav1.UpdateOptions{}); err != nil {
614+
return xerrors.Errorf("error updating role: %w", err)
615+
}
616+
} else {
617+
return xerrors.Errorf("error creating cluster role: %w", err)
618+
}
619+
}
620+
621+
if err := createClusterRoleBinding(ctx, c, serviceAccountName, serviceAccountNamespace, DefaultOperatorName+"-cluster-mongodb-role-binding", clusterRoleForMongoDBRole); err != nil {
622+
return err
623+
}
624+
595625
if !clusterScoped {
596626
var role rbacv1.Role
597627
if clusterType == clusterTypeCentral {

0 commit comments

Comments
 (0)