refactor(charts): Change generation of RBAC templates by jvanz · Pull Request #1520 · kubewarden/adm-controller

jvanz · 2026-02-26T22:25:51Z

Description

Updates the controller-gen command used to generated the RBAC manifests into the charts/kubewarden-controller directory. This commit also adds the kubebuilder markers to add the missing permissions in the controller roles that was added using manully created roles definitions.

Fix #1483

codecov · 2026-02-27T01:05:06Z

Codecov Report

❌ Patch coverage is 14.28571% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 75.52%. Comparing base (300ffd9) to head (de6d5f6).
⚠️ Report is 10 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/controller/policyserver_controller.go	0.00%	4 Missing and 4 partials ⚠️
internal/controller/policy_subreconciler.go	33.33%	3 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1520   +/-   ##
=======================================
  Coverage   75.52%   75.52%           
=======================================
  Files         170      170           
  Lines       20902    20898    -4     
=======================================
- Hits        15786    15783    -3     
+ Misses       4904     4902    -2     
- Partials      212      213    +1

Flag	Coverage Δ
go-tests	`57.49% <14.28%> (-0.04%)`	⬇️
rust-tests	`80.45% <ø> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

flavio · 2026-03-02T09:31:26Z

Also, I got a bit confused by the names:

charts/kubewarden-controller/templates/controller-rbac-roles.yaml: this holds all the roles (cluster and not)
charts/kubewarden-controller/templates/controller-rbac-extras.yaml: this holds all the roles bindings and one ClusterRole
charts/kubewarden-controller/templates/audit-scanner-rbac.yaml: contains roles and bindings

I would like, if possible, to end up with something like sbomscanner:

a file with roles
a file with rolebindings

In our case we would have 4 files:

audit-scanner-role.yaml
audit-scanner-rolebinding.yaml
controller-role.yaml
controller-rolebinding.yaml

jvanz · 2026-03-02T13:33:02Z

Also, I got a bit confused by the names:

* `charts/kubewarden-controller/templates/controller-rbac-roles.yaml`: this holds all the roles (cluster and not)

* `charts/kubewarden-controller/templates/controller-rbac-extras.yaml`: this holds all the roles bindings and one `ClusterRole`

* `charts/kubewarden-controller/templates/audit-scanner-rbac.yaml`: contains roles and bindings

I would like, if possible, to end up with something like sbomscanner:

* a file with [roles](https://github.com/kubewarden/sbomscanner/blob/main/charts/sbomscanner/templates/controller/role.yaml)

* a file with [rolebindings](https://github.com/kubewarden/sbomscanner/blob/main/charts/sbomscanner/templates/controller/rolebinding.yaml)

In our case we would have 4 files:

* `audit-scanner-role.yaml`

* `audit-scanner-rolebinding.yaml`

* `controller-role.yaml`

* `controller-rolebinding.yaml`

I'm fine splitting role and rolebindings. I actually did that while I was working on this PR. But I've changed that because I would like to avoid two role files. The controller-rbac-roles.yaml has the roles generated by the controller-gen. It's overwritten every time we run make manifests. Then, instead of having two role files, one for the controller-gen output and another to the "metrics-reader" role, I've decided to rename the file to controller-rbac-extras.yaml. Where it has all the rolebindings and one additional role. Therefore, I avoid more custom code to merge all the roles into a single file.

Copilot

Pull request overview

Copilot reviewed 26 out of 28 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 28 out of 30 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 29 out of 31 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-26T12:48:28Z

+			paths="./api/policies/v1"  paths="./internal/controller" paths="./cmd/controller" \
+			output:crd:artifacts:config=charts/kubewarden-crds/templates \


make manifests now writes CRDs/RBAC into the Helm charts, but it no longer updates the existing kubebuilder/kustomize manifests under config/crd/bases and config/rbac (which are still referenced by config/**/kustomization.yaml). This can leave the kustomize install path stale/out-of-sync (e.g., config/rbac/role.yaml still lacks the webhook get verb). Either keep generating to config/ as well, or remove/deprecate the config/ kustomize overlays to avoid drift.

Suggested change

paths="./api/policies/v1" paths="./internal/controller" paths="./cmd/controller" \

output:crd:artifacts:config=charts/kubewarden-crds/templates \

paths="./api/policies/v1" paths="./internal/controller" paths="./cmd/controller" \

output:crd:artifacts:config=config/crd/bases \

output:crd:artifacts:config=charts/kubewarden-crds/templates \

output:rbac:artifacts:config=config/rbac \

We plan to remove the config directory in the future. So, we can ignore this comment for now.

Split the monolithic rbac.yaml into dedicated files for controller roles, bindings, metrics, and audit scanner. Redirect controller-gen output directly into chart templates with sed post-processing for Helm labels, annotations, and namespace templating. Rename CRD files to include the API group prefix and fix CRD comments. Signed-off-by: José Guilherme Vanz <jguilhermevanz@suse.com> Assited-by: Github Copilot

Clean up main.go imports and add kubebuilder RBAC markers for controller-level permissions (leases, configmaps, events, tokenreviews, subjectaccessreviews). Signed-off-by: José Guilherme Vanz <jguilhermevanz@suse.com> Assited-by: Github Copilot

Fix error handling in getPolicies() which was only returning errors for IsNotFound, silently swallowing all other error types. Now all errors are properly propagated. Add explicit namespace scoping to List calls for ReplicaSets and Pods in isPolicyUniquelyReachable() to avoid unnecessary cluster-wide lookups. Signed-off-by: José Guilherme Vanz <jguilhermevanz@suse.com> Assited-by: Github Copilot

The controller calls Get() on ValidatingWebhookConfiguration and MutatingWebhookConfiguration during reconciliation and deletion, but the kubebuilder RBAC markers were missing the 'get' verb. With caching enabled this went unnoticed because list/watch cache served the reads. Add 'get' to the markers and regenerate the chart RBAC manifest. Signed-off-by: José Guilherme Vanz <jguilhermevanz@suse.com> Assited-by: Github Copilot

Add helm unit tests that validate the generated CRD and RBAC manifests. CRD tests verify resource type, name, and API group. RBAC tests verify that ClusterRoles and Roles include the expected Helm labels and that additionalLabels and additionalAnnotations are correctly propagated. Signed-off-by: José Guilherme Vanz <jguilhermevanz@suse.com> Assited-by: Github Copilot

Add a new additionalEnvironmentVariables Helm value that allows users to inject arbitrary environment variables into the controller deployment. Includes schema validation and helm unit tests. Signed-off-by: José Guilherme Vanz <jguilhermevanz@suse.com> Assited-by: Github Copilot

Pin the kwctl-installer GitHub Action to v4.6.1 for reproducible e2e test environments. Add a CI step that runs 'make manifests' and verifies the generated chart files are up to date. Fix autolabeler workflow permissions to use job-level scoping. Signed-off-by: José Guilherme Vanz <jguilhermevanz@suse.com> Assited-by: Github Copilot

viccuad

LGTM!

jvanz self-assigned this Feb 26, 2026

jvanz added the ci-full Run all CI jobs for all languages. label Feb 26, 2026

github-project-automation Bot added this to Kubewarden Admission Controller Feb 26, 2026

github-project-automation Bot moved this to Pending review in Kubewarden Admission Controller Feb 26, 2026

jvanz removed this from Kubewarden Admission Controller Feb 26, 2026

github-actions Bot added the kind/bug label Feb 26, 2026

jvanz force-pushed the issue1483 branch from 965936d to ae2a489 Compare February 26, 2026 22:26

jvanz changed the title ~~fix(charts): controller-gen output file into charts.~~ chore(charts): controller-gen output file into charts. Feb 26, 2026

github-project-automation Bot added this to Kubewarden Admission Controller Feb 26, 2026

github-project-automation Bot moved this to Pending review in Kubewarden Admission Controller Feb 26, 2026

github-actions Bot added the kind/chore label Feb 26, 2026

jvanz removed the kind/bug label Feb 26, 2026

jvanz removed this from Kubewarden Admission Controller Feb 26, 2026

jvanz force-pushed the issue1483 branch from ae2a489 to db9ad3d Compare February 27, 2026 18:59

jvanz marked this pull request as ready for review February 27, 2026 19:04

jvanz requested a review from a team as a code owner February 27, 2026 19:04

jvanz force-pushed the issue1483 branch from db9ad3d to cb28bad Compare February 27, 2026 19:21

jvanz commented Feb 27, 2026

View reviewed changes

Comment thread charts/kubewarden-controller/templates/NOTES.txt Outdated

jvanz force-pushed the issue1483 branch 5 times, most recently from 91c845d to 4e819cd Compare February 27, 2026 23:29

jvanz commented Feb 27, 2026

View reviewed changes

Comment thread charts/kubewarden-controller/templates/controller-rbac-extras.yaml Outdated

flavio requested changes Mar 2, 2026

View reviewed changes

Comment thread scripts/post-generate-manifests.sh Outdated

Comment thread scripts/post-generate-manifests.sh Outdated

jvanz force-pushed the issue1483 branch from 4e819cd to b7de9ec Compare March 2, 2026 15:31

jvanz mentioned this pull request Mar 2, 2026

Check the usage of kubewarden-controller-metrics-reader. #1532

Open

jvanz force-pushed the issue1483 branch from c74ae13 to ce6c393 Compare March 25, 2026 19:05

Copilot AI reviewed Mar 25, 2026

View reviewed changes

Comment thread e2e/main_test.go Outdated

Comment thread cmd/controller/main.go Outdated

Comment thread internal/controller/policyserver_controller.go Outdated

Comment thread charts/kubewarden-controller/values.yaml

jvanz force-pushed the issue1483 branch 4 times, most recently from 4c1795a to 8892c00 Compare March 26, 2026 02:54

jvanz requested a review from Copilot March 26, 2026 02:54

Copilot started reviewing on behalf of jvanz March 26, 2026 02:55 View session

Copilot AI reviewed Mar 26, 2026

View reviewed changes

Comment thread cmd/controller/main.go Outdated

Comment thread .github/workflows/ci.yml

jvanz force-pushed the issue1483 branch from 8892c00 to 8e1574c Compare March 26, 2026 12:34

jvanz requested a review from Copilot March 26, 2026 12:34

Copilot started reviewing on behalf of jvanz March 26, 2026 12:38 View session

Copilot AI reviewed Mar 26, 2026

View reviewed changes

jvanz force-pushed the issue1483 branch 2 times, most recently from 6d68425 to 2519539 Compare March 26, 2026 12:56

flavio reviewed Mar 26, 2026

View reviewed changes

Comment thread internal/controller/client_interceptor.go Outdated

jvanz force-pushed the issue1483 branch from 2519539 to 22b2319 Compare March 27, 2026 13:24

jvanz added 6 commits March 27, 2026 10:27

jvanz force-pushed the issue1483 branch from 22b2319 to de6d5f6 Compare March 27, 2026 13:27

viccuad approved these changes Mar 27, 2026

View reviewed changes

flavio approved these changes Mar 30, 2026

View reviewed changes

viccuad merged commit 4f6ce34 into kubewarden:main Mar 30, 2026
47 of 49 checks passed

viccuad changed the title ~~chore(charts): controller-gen output file into charts.~~ refactor(charts): Change generation of RBAC templates Apr 7, 2026

flavio mentioned this pull request Apr 8, 2026

1.34.0 blogpost kubewarden/kubewarden.io#414

Closed

		paths="./api/policies/v1" paths="./internal/controller" paths="./cmd/controller" \
		output:crd:artifacts:config=charts/kubewarden-crds/templates \

Conversation

jvanz commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Uh oh!

codecov Bot commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

flavio commented Mar 2, 2026

Uh oh!

jvanz commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

jvanz Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

viccuad left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

jvanz commented Feb 26, 2026 •

edited

Loading

codecov Bot commented Feb 27, 2026 •

edited

Loading

jvanz commented Mar 2, 2026 •

edited

Loading