Skip to content

Commit aa15a66

Browse files
eddymoultoneddymoulton
committed
Merge branch 'main' into em/add-explicit-enabled-for-script-pod-clusterrole
2 parents 8985809 + de26b67 commit aa15a66

File tree

11 files changed

+228
-10
lines changed

11 files changed

+228
-10
lines changed

‎.changeset/lovely-states-pay.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
"kubernetes-agent": minor
3+
---
4+
5+
Add globals for targetNamespaces

‎charts/kubernetes-agent/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,7 @@ The Kubernetes agent is optionally installed alongside the Kubernetes agent, [re
123123
| global.serverApiUrl | string | `""` | This is overridden by agent.serverUrl if both are set |
124124
| global.serverCertificate | string | `""` | This is overridden by agent.serverCertificate if both are set |
125125
| global.serverCertificateSecretName | string | `""` | This is overridden by agent.serverCertificateSecretName if both are set |
126+
| global.targetNamespaces | list | Uses a ClusterRoleBinding to allow the service account to run in any namespace | This is overridden by scriptPods.serviceAccount.targetNamespaces if both are set |
126127

127128
### Persistence
128129

‎charts/kubernetes-agent/templates/_helpers.tpl‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -304,4 +304,16 @@ The server API url - the global is used unless overridden by the value in values
304304
{{- else if .Values.global.serverApiUrl }}
305305
{{- .Values.global.serverApiUrl }}
306306
{{- end }}
307+
{{- end }}
308+
309+
{{/*
310+
The target namespaces - the global is used unless overridden by the value in values.yaml
311+
Returns the list as JSON array (use fromJsonArray to deserialize)
312+
*/}}
313+
{{- define "kubernetes-agent.targetNamespaces" -}}
314+
{{- if gt (len .Values.scriptPods.serviceAccount.targetNamespaces) 0 }}
315+
{{- .Values.scriptPods.serviceAccount.targetNamespaces | toJson }}
316+
{{- else }}
317+
{{- .Values.global.targetNamespaces | toJson }}
318+
{{- end }}
307319
{{- end }}

‎charts/kubernetes-agent/templates/auto-upgrader-rolebindings.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
{{- $autoUpgraderServiceAccountName := include "kubernetes-agent.autoUpgraderServiceAccountName" . -}}
33
{{- $autoUpgraderSelfRoleName := include "kubernetes-agent.autoUpgraderSelfRoleName" . -}}
44
{{- $autoUpgraderTargetRoleName := include "kubernetes-agent.autoUpgraderTargetRoleName" . -}}
5+
{{- $targetNamespaces := include "kubernetes-agent.targetNamespaces" . | fromJsonArray -}}
56

67
# RoleBinding for managing the agent in its own namespace
78
---
@@ -19,9 +20,9 @@ roleRef:
1920
name: {{ $autoUpgraderSelfRoleName }}
2021
apiGroup: rbac.authorization.k8s.io
2122

22-
{{- if .Values.scriptPods.serviceAccount.targetNamespaces }}
23+
{{- if not (empty $targetNamespaces) }}
2324
# RoleBindings for managing script pod roles/rolebindings in target namespaces
24-
{{- range $targetNamespace := $.Values.scriptPods.serviceAccount.targetNamespaces }}
25+
{{- range $targetNamespace := $targetNamespaces }}
2526
---
2627
apiVersion: rbac.authorization.k8s.io/v1
2728
kind: RoleBinding

‎charts/kubernetes-agent/templates/auto-upgrader-roles.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
{{- if .Values.scriptPods.serviceAccount.useNamespacedRoles }}
22
{{- $autoUpgraderSelfRoleName := include "kubernetes-agent.autoUpgraderSelfRoleName" . -}}
33
{{- $autoUpgraderTargetRoleName := include "kubernetes-agent.autoUpgraderTargetRoleName" . -}}
4+
{{- $targetNamespaces := include "kubernetes-agent.targetNamespaces" . | fromJsonArray -}}
45

56
# Role for managing the agent in its own namespace
67
---
@@ -18,9 +19,9 @@ rules:
1819
verbs: ["*"]
1920
{{- end }}
2021

21-
{{- if .Values.scriptPods.serviceAccount.targetNamespaces }}
22+
{{- if not (empty $targetNamespaces) }}
2223
# Roles for managing script pod roles/rolebindings in target namespaces
23-
{{- range $targetNamespace := $.Values.scriptPods.serviceAccount.targetNamespaces }}
24+
{{- range $targetNamespace := $targetNamespaces }}
2425
---
2526
apiVersion: rbac.authorization.k8s.io/v1
2627
kind: Role

‎charts/kubernetes-agent/templates/pod-clusterbinding.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if and .Values.scriptPods.serviceAccount.clusterRole.enabled (empty .Values.scriptPods.serviceAccount.targetNamespaces) (not .Values.agent.worker.enabled) (not .Values.scriptPods.serviceAccount.useNamespacedRoles) }}
1+
{{- if and .Values.scriptPods.serviceAccount.clusterRole.enabled (empty (include "kubernetes-agent.targetNamespaces" . | fromJsonArray)) (not .Values.agent.worker.enabled) (not .Values.scriptPods.serviceAccount.useNamespacedRoles) }}
22
apiVersion: rbac.authorization.k8s.io/v1
33
kind: ClusterRoleBinding
44
metadata:

‎charts/kubernetes-agent/templates/pod-rolebindings.yaml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,11 @@
22
{{- $podServiceAccountFullName := include "kubernetes-agent.scriptPodServiceAccountFullName" . -}}
33
{{- $podClusterRoleName := include "kubernetes-agent.scriptPodClusterRoleName" . -}}
44
{{- $podRoleName := include "kubernetes-agent.scriptPodRoleName" . -}}
5-
{{- $podDeleterClusterRoleName := include "kubernetes-agent.scriptPodDeleterClusterRoleName" . -}}
5+
{{- $podDeleterClusterRoleName := include "kubernetes-agent.scriptPodDeleterClusterRoleName" . -}}
6+
{{- $targetNamespaces := include "kubernetes-agent.targetNamespaces" . | fromJsonArray -}}
67

78
{{- if .Values.agent.deploymentTarget.enabled }}
8-
{{- range $targetNamespace := $.Values.scriptPods.serviceAccount.targetNamespaces }}
9+
{{- range $targetNamespace := $targetNamespaces }}
910
---
1011
apiVersion: rbac.authorization.k8s.io/v1
1112
kind: RoleBinding
@@ -25,7 +26,7 @@ roleRef:
2526
name: {{ $podClusterRoleName }}
2627
{{- end }}
2728
apiGroup: rbac.authorization.k8s.io
28-
{{- end -}}
29+
{{- end }}
2930
{{- end -}}
3031
{{- if and .Values.persistence.nfs.watchdog.enabled (not (include "kubernetes-agent.useCustomPvc" .)) }}
3132
---

‎charts/kubernetes-agent/templates/pod-roles.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,10 @@ rules:
1616
{{- $podServiceAccountName := include "kubernetes-agent.scriptPodServiceAccountName" . -}}
1717
{{- $podServiceAccountFullName := include "kubernetes-agent.scriptPodServiceAccountFullName" . -}}
1818
{{- $podRoleName := include "kubernetes-agent.scriptPodRoleName" . -}}
19+
{{- $targetNamespaces := include "kubernetes-agent.targetNamespaces" . | fromJsonArray -}}
1920

20-
{{- if and .Values.scriptPods.serviceAccount.useNamespacedRoles .Values.scriptPods.serviceAccount.targetNamespaces }}
21-
{{- range $targetNamespace := $.Values.scriptPods.serviceAccount.targetNamespaces }}
21+
{{- if and .Values.scriptPods.serviceAccount.useNamespacedRoles (not (empty $targetNamespaces)) }}
22+
{{- range $targetNamespace := $targetNamespaces }}
2223
---
2324
apiVersion: rbac.authorization.k8s.io/v1
2425
kind: Role

‎charts/kubernetes-agent/tests/__snapshot__/targetnamespaces-global_test.yaml.snap‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
matches snapshot with global targetNamespaces:
2+
1: |
3+
apiVersion: rbac.authorization.k8s.io/v1
4+
kind: RoleBinding
5+
metadata:
6+
name: octopus-agent-scripts-RELEASE-NAME-binding
7+
namespace: global-ns-1
8+
roleRef:
9+
apiGroup: rbac.authorization.k8s.io
10+
kind: ClusterRole
11+
name: octopus-agent-scripts-RELEASE-NAME-role
12+
subjects:
13+
- kind: ServiceAccount
14+
name: octopus-agent-scripts
15+
namespace: NAMESPACE
16+
2: |
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
kind: RoleBinding
19+
metadata:
20+
name: octopus-agent-scripts-RELEASE-NAME-deleter-binding
21+
namespace: NAMESPACE
22+
roleRef:
23+
apiGroup: rbac.authorization.k8s.io
24+
kind: ClusterRole
25+
name: octopus-agent-scripts-RELEASE-NAME-delete-role
26+
subjects:
27+
- kind: ServiceAccount
28+
name: octopus-agent-scripts
29+
namespace: NAMESPACE

‎charts/kubernetes-agent/tests/targetnamespaces-global_test.yaml‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
suite: "global targetNamespaces"
2+
templates:
3+
- templates/pod-rolebindings.yaml
4+
- templates/pod-roles.yaml
5+
- templates/auto-upgrader-rolebindings.yaml
6+
- templates/auto-upgrader-roles.yaml
7+
tests:
8+
- it: "uses global targetNamespaces when local is not set"
9+
set:
10+
global:
11+
targetNamespaces: ["global-ns-1", "global-ns-2"]
12+
scriptPods:
13+
serviceAccount:
14+
targetNamespaces: []
15+
agent.deploymentTarget.enabled: true
16+
persistence.nfs.watchdog.enabled: false
17+
template: templates/pod-rolebindings.yaml
18+
asserts:
19+
- hasDocuments:
20+
count: 2
21+
- equal:
22+
path: metadata.namespace
23+
value: global-ns-1
24+
documentIndex: 0
25+
- equal:
26+
path: metadata.namespace
27+
value: global-ns-2
28+
documentIndex: 1
29+
30+
- it: "local targetNamespaces override global"
31+
set:
32+
global:
33+
targetNamespaces: ["global-ns-1", "global-ns-2"]
34+
scriptPods:
35+
serviceAccount:
36+
targetNamespaces: ["local-ns-1", "local-ns-2", "local-ns-3"]
37+
agent.deploymentTarget.enabled: true
38+
persistence.nfs.watchdog.enabled: false
39+
template: templates/pod-rolebindings.yaml
40+
asserts:
41+
- hasDocuments:
42+
count: 3
43+
- equal:
44+
path: metadata.namespace
45+
value: local-ns-1
46+
documentIndex: 0
47+
- equal:
48+
path: metadata.namespace
49+
value: local-ns-2
50+
documentIndex: 1
51+
- equal:
52+
path: metadata.namespace
53+
value: local-ns-3
54+
documentIndex: 2
55+
56+
- it: "creates no rolebindings when both global and local are empty"
57+
set:
58+
global:
59+
targetNamespaces: []
60+
scriptPods:
61+
serviceAccount:
62+
targetNamespaces: []
63+
agent.deploymentTarget.enabled: true
64+
template: templates/pod-rolebindings.yaml
65+
asserts:
66+
- hasDocuments:
67+
count: 1
68+
69+
- it: "global targetNamespaces work with namespace-scoped roles"
70+
set:
71+
global:
72+
targetNamespaces: ["global-ns-1", "global-ns-2"]
73+
scriptPods:
74+
serviceAccount:
75+
targetNamespaces: []
76+
useNamespacedRoles: true
77+
template: templates/pod-roles.yaml
78+
asserts:
79+
- hasDocuments:
80+
count: 2
81+
- equal:
82+
path: kind
83+
value: Role
84+
documentIndex: 0
85+
- equal:
86+
path: metadata.namespace
87+
value: global-ns-1
88+
documentIndex: 0
89+
- equal:
90+
path: metadata.namespace
91+
value: global-ns-2
92+
documentIndex: 1
93+
94+
- it: "global targetNamespaces work with auto-upgrader rolebindings"
95+
set:
96+
global:
97+
targetNamespaces: ["global-ns-1", "global-ns-2"]
98+
scriptPods:
99+
serviceAccount:
100+
targetNamespaces: []
101+
useNamespacedRoles: true
102+
template: templates/auto-upgrader-rolebindings.yaml
103+
asserts:
104+
- hasDocuments:
105+
count: 3
106+
- equal:
107+
path: kind
108+
value: RoleBinding
109+
documentIndex: 0
110+
- matchRegex:
111+
path: metadata.name
112+
pattern: self-binding$
113+
documentIndex: 0
114+
- equal:
115+
path: metadata.namespace
116+
value: global-ns-1
117+
documentIndex: 1
118+
- equal:
119+
path: metadata.namespace
120+
value: global-ns-2
121+
documentIndex: 2
122+
123+
- it: "global targetNamespaces work with auto-upgrader roles"
124+
set:
125+
global:
126+
targetNamespaces: ["global-ns-1", "global-ns-2"]
127+
scriptPods:
128+
serviceAccount:
129+
targetNamespaces: []
130+
useNamespacedRoles: true
131+
template: templates/auto-upgrader-roles.yaml
132+
asserts:
133+
- hasDocuments:
134+
count: 3
135+
- equal:
136+
path: kind
137+
value: Role
138+
documentIndex: 0
139+
- matchRegex:
140+
path: metadata.name
141+
pattern: self-role$
142+
documentIndex: 0
143+
- equal:
144+
path: metadata.namespace
145+
value: global-ns-1
146+
documentIndex: 1
147+
- equal:
148+
path: metadata.namespace
149+
value: global-ns-2
150+
documentIndex: 2
151+
152+
- it: "matches snapshot with global targetNamespaces"
153+
set:
154+
global:
155+
targetNamespaces: ["global-ns-1"]
156+
scriptPods:
157+
serviceAccount:
158+
targetNamespaces: []
159+
agent.deploymentTarget.enabled: true
160+
template: templates/pod-rolebindings.yaml
161+
asserts:
162+
- matchSnapshot: {}

0 commit comments

Comments
 (0)