bugfix: Support configauditing for rbac resource with capital letter name (#1356)

This code changes has following fixes
- When rbac resource is created with capital letter, then configaudit report were not generated for that resource bcoz of configaudit report name limitation. To resolve it, we are making sure that we will create configaudit report with lower case
- Starboard started support for Ingress resource, but in 1.18 ingress resources are present in old apis. So handled it as part of compatibility flow, so starboard can run and support k8s 1.18 onwards

fixes #1355

Author: deven0t

deploy/helm/templates/rbac.yaml

@@ -122,6 +122,7 @@ rules:
       - delete
   - apiGroups:
       - networking.k8s.io
+      - extensions
     resources:
       - networkpolicies
       - ingresses

deploy/static/02-starboard-operator.rbac.yaml

@@ -121,6 +121,7 @@ rules:
       - delete
   - apiGroups:
       - networking.k8s.io
+      - extensions
     resources:
       - networkpolicies
       - ingresses

deploy/static/starboard.yaml

@@ -715,6 +715,7 @@ rules:
       - delete
   - apiGroups:
       - networking.k8s.io
+      - extensions
     resources:
       - networkpolicies
       - ingresses

pkg/configauditreport/builder.go

@@ -191,7 +191,7 @@ func (b *ReportBuilder) Data(data v1alpha1.ConfigAuditReportData) *ReportBuilder
 func (b *ReportBuilder) reportName() string {
 	kind := b.controller.GetObjectKind().GroupVersionKind().Kind
 	name := b.controller.GetName()
-	reportName := fmt.Sprintf("%s-%s", strings.ToLower(kind), name)
+	reportName := fmt.Sprintf("%s-%s", strings.ToLower(kind), strings.ToLower(name))
 	if len(validation.IsValidLabelValue(reportName)) == 0 {
 		return reportName
 	}

pkg/configauditreport/controller.go

@@ -63,7 +63,7 @@ func (r *ResourceController) SetupWithManager(mgr ctrl.Manager) error {
 		{kind: kube.KindRole, forObject: &rbacv1.Role{}, ownsObject: &v1alpha1.ConfigAuditReport{}},
 		{kind: kube.KindRoleBinding, forObject: &rbacv1.RoleBinding{}, ownsObject: &v1alpha1.ConfigAuditReport{}},
 		{kind: kube.KindNetworkPolicy, forObject: &networkingv1.NetworkPolicy{}, ownsObject: &v1alpha1.ConfigAuditReport{}},
-		{kind: kube.KindIngress, forObject: &networkingv1.Ingress{}, ownsObject: &v1alpha1.ConfigAuditReport{}},
+		{kind: kube.KindIngress, forObject: r.ObjectResolver.GetSupportedObjectByKind(kube.KindIngress), ownsObject: &v1alpha1.ConfigAuditReport{}},
 		{kind: kube.KindResourceQuota, forObject: &corev1.ResourceQuota{}, ownsObject: &v1alpha1.ConfigAuditReport{}},
 		{kind: kube.KindLimitRange, forObject: &corev1.LimitRange{}, ownsObject: &v1alpha1.ConfigAuditReport{}},
 	}

pkg/kube/object.go

@@ -13,7 +13,9 @@ import (
 	batchv1 "k8s.io/api/batch/v1"
 	batchv1beta1 "k8s.io/api/batch/v1beta1"
 	corev1 "k8s.io/api/core/v1"
+	extensionv1beta1 "k8s.io/api/extensions/v1beta1"
 	networkingv1 "k8s.io/api/networking/v1"
+	networkingbetav1 "k8s.io/api/networking/v1beta1"
 	policyv1beta1 "k8s.io/api/policy/v1beta1"
 	rbacv1 "k8s.io/api/rbac/v1"
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
@@ -70,9 +72,13 @@ const (
 )
 
 const (
-	cronJobResource        = "cronjobs"
-	apiBatchV1beta1CronJob = "batch/v1beta1, Kind=CronJob"
-	apiBatchV1CronJob      = "batch/v1, Kind=CronJob"
+	cronJobResource           = "cronjobs"
+	ingressResource           = "ingress"
+	apiBatchV1beta1CronJob    = "batch/v1beta1, Kind=CronJob"
+	apiBatchV1CronJob         = "batch/v1, Kind=CronJob"
+	apiNetworkV1betaIngress   = "networking.k8s.io/v1beta1, Kind=Ingress"
+	apiNetworkV1Ingress       = "networking.k8s.io/v1, Kind=Ingress"
+	apiExtensionV1betaIngress = "extensions/v1beta1, Kind=Ingress"
 )
 
 const (
@@ -350,6 +356,12 @@ func supportedObjectsByK8sKind(api string, kind string, kindObjectMap map[string
 		resource = &batchv1beta1.CronJob{}
 	case apiBatchV1CronJob:
 		resource = &batchv1.CronJob{}
+	case apiNetworkV1betaIngress:
+		resource = &networkingbetav1.Ingress{}
+	case apiNetworkV1Ingress:
+		resource = &networkingv1.Ingress{}
+	case apiExtensionV1betaIngress:
+		resource = &extensionv1beta1.Ingress{}
 	default:
 		return fmt.Errorf("api %s is not suooprted compatibale resource", api)
 	}
@@ -358,7 +370,7 @@ func supportedObjectsByK8sKind(api string, kind string, kindObjectMap map[string
 }
 
 func getCompatibleResources() []string {
-	return []string{cronJobResource}
+	return []string{cronJobResource, ingressResource}
 }
 
 // GetSupportedObjectByKind accept kind and return the supported object (group/api/kind) of the cluster

pkg/starboard/config.go

@@ -16,6 +16,7 @@ import (
 	batchv1beta1 "k8s.io/api/batch/v1beta1"
 	coordinationv1 "k8s.io/api/coordination/v1"
 	corev1 "k8s.io/api/core/v1"
+	extensionv1beta1 "k8s.io/api/extensions/v1beta1"
 	networkingv1 "k8s.io/api/networking/v1"
 	policyv1beta1 "k8s.io/api/policy/v1beta1"
 	rbacv1 "k8s.io/api/rbac/v1"
@@ -40,6 +41,7 @@ func NewScheme() *runtime.Scheme {
 	_ = coordinationv1.AddToScheme(scheme)
 	_ = apiextensionsv1.AddToScheme(scheme)
 	_ = ocpappsv1.AddToScheme(scheme)
+	_ = extensionv1beta1.AddToScheme(scheme)
 	return scheme
 }