Skip to content

Commit 8664bab

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #748 from everettraven/feature/manage-rbrs
CNTRLPLANE-71: update cao to manage rolebindingrestriction crd
2 parents e44a923 + 2dc36e0 commit 8664bab

File tree

28 files changed

+1006
-65
lines changed

28 files changed

+1006
-65
lines changed

‎Makefile

+14-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ include $(addprefix ./vendor/github.com/openshift/build-machinery-go/make/, \
1515
#
1616
# Example:
1717
# make check
18-
check: | verify test-unit
18+
check: | verify verify-bindata test-unit
1919
.PHONY: check
2020

2121
IMAGE_REGISTRY?=registry.svc.ci.openshift.org
@@ -86,3 +86,16 @@ export TP_CMD_PATH ?=./cmd/authentication-operator
8686
export TP_CMD_ARGS ?=operator --config=/var/run/configmaps/config/operator-config.yaml --v=2 --terminate-on-files=/var/run/configmaps/trusted-ca-bundle/ca-bundle.crt
8787
export TP_LOCK_CONFIGMAP ?=cluster-authentication-operator-lock
8888
export TP_BUILD_FLAGS ?=-tags ocp
89+
90+
# ensure the rolebindingrestriction CRD is included in bindata
91+
RBR_CRD_SOURCE := vendor/github.com/openshift/api/authorization/v1/zz_generated.crd-manifests/0000_03_config-operator_01_rolebindingrestrictions.crd.yaml
92+
RBR_CRD_TARGET := bindata/oauth-openshift/authorization.openshift.io_rolebindingrestrictions.yaml
93+
update-bindata: $(RBR_CRD_TARGET)
94+
$(RBR_CRD_TARGET): $(RBR_CRD_SOURCE)
95+
cp $< $@
96+
97+
verify-bindata: verify-rbr-crd
98+
.PHONY: verify-bindata
99+
100+
verify-rbr-crd:
101+
diff -Naup $(RBR_CRD_SOURCE) $(RBR_CRD_TARGET)

‎bindata/oauth-openshift/authorization.openshift.io_rolebindingrestrictions.yaml

+225
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,225 @@
1+
apiVersion: apiextensions.k8s.io/v1
2+
kind: CustomResourceDefinition
3+
metadata:
4+
annotations:
5+
api-approved.openshift.io: https://github.com/openshift/api/pull/470
6+
api.openshift.io/merged-by-featuregates: "true"
7+
include.release.openshift.io/ibm-cloud-managed: "true"
8+
include.release.openshift.io/self-managed-high-availability: "true"
9+
release.openshift.io/bootstrap-required: "true"
10+
name: rolebindingrestrictions.authorization.openshift.io
11+
spec:
12+
group: authorization.openshift.io
13+
names:
14+
kind: RoleBindingRestriction
15+
listKind: RoleBindingRestrictionList
16+
plural: rolebindingrestrictions
17+
singular: rolebindingrestriction
18+
scope: Namespaced
19+
versions:
20+
- name: v1
21+
schema:
22+
openAPIV3Schema:
23+
description: |-
24+
RoleBindingRestriction is an object that can be matched against a subject
25+
(user, group, or service account) to determine whether rolebindings on that
26+
subject are allowed in the namespace to which the RoleBindingRestriction
27+
belongs. If any one of those RoleBindingRestriction objects matches
28+
a subject, rolebindings on that subject in the namespace are allowed.
29+
30+
Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
31+
properties:
32+
apiVersion:
33+
description: |-
34+
APIVersion defines the versioned schema of this representation of an object.
35+
Servers should convert recognized schemas to the latest internal value, and
36+
may reject unrecognized values.
37+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
38+
type: string
39+
kind:
40+
description: |-
41+
Kind is a string value representing the REST resource this object represents.
42+
Servers may infer this from the endpoint the client submits requests to.
43+
Cannot be updated.
44+
In CamelCase.
45+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
46+
type: string
47+
metadata:
48+
type: object
49+
spec:
50+
description: spec defines the matcher.
51+
properties:
52+
grouprestriction:
53+
description: grouprestriction matches against group subjects.
54+
nullable: true
55+
properties:
56+
groups:
57+
description: |-
58+
groups is a list of groups used to match against an individual user's
59+
groups. If the user is a member of one of the whitelisted groups, the user
60+
is allowed to be bound to a role.
61+
items:
62+
type: string
63+
nullable: true
64+
type: array
65+
labels:
66+
description: Selectors specifies a list of label selectors over
67+
group labels.
68+
items:
69+
description: |-
70+
A label selector is a label query over a set of resources. The result of matchLabels and
71+
matchExpressions are ANDed. An empty label selector matches all objects. A null
72+
label selector matches no objects.
73+
properties:
74+
matchExpressions:
75+
description: matchExpressions is a list of label selector
76+
requirements. The requirements are ANDed.
77+
items:
78+
description: |-
79+
A label selector requirement is a selector that contains values, a key, and an operator that
80+
relates the key and values.
81+
properties:
82+
key:
83+
description: key is the label key that the selector
84+
applies to.
85+
type: string
86+
operator:
87+
description: |-
88+
operator represents a key's relationship to a set of values.
89+
Valid operators are In, NotIn, Exists and DoesNotExist.
90+
type: string
91+
values:
92+
description: |-
93+
values is an array of string values. If the operator is In or NotIn,
94+
the values array must be non-empty. If the operator is Exists or DoesNotExist,
95+
the values array must be empty. This array is replaced during a strategic
96+
merge patch.
97+
items:
98+
type: string
99+
type: array
100+
x-kubernetes-list-type: atomic
101+
required:
102+
- key
103+
- operator
104+
type: object
105+
type: array
106+
x-kubernetes-list-type: atomic
107+
matchLabels:
108+
additionalProperties:
109+
type: string
110+
description: |-
111+
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
112+
map is equivalent to an element of matchExpressions, whose key field is "key", the
113+
operator is "In", and the values array contains only "value". The requirements are ANDed.
114+
type: object
115+
type: object
116+
x-kubernetes-map-type: atomic
117+
nullable: true
118+
type: array
119+
type: object
120+
serviceaccountrestriction:
121+
description: serviceaccountrestriction matches against service-account
122+
subjects.
123+
nullable: true
124+
properties:
125+
namespaces:
126+
description: namespaces specifies a list of literal namespace
127+
names.
128+
items:
129+
type: string
130+
type: array
131+
serviceaccounts:
132+
description: serviceaccounts specifies a list of literal service-account
133+
names.
134+
items:
135+
description: |-
136+
ServiceAccountReference specifies a service account and namespace by their
137+
names.
138+
properties:
139+
name:
140+
description: name is the name of the service account.
141+
type: string
142+
namespace:
143+
description: |-
144+
namespace is the namespace of the service account. Service accounts from
145+
inside the whitelisted namespaces are allowed to be bound to roles. If
146+
Namespace is empty, then the namespace of the RoleBindingRestriction in
147+
which the ServiceAccountReference is embedded is used.
148+
type: string
149+
type: object
150+
type: array
151+
type: object
152+
userrestriction:
153+
description: userrestriction matches against user subjects.
154+
nullable: true
155+
properties:
156+
groups:
157+
description: groups specifies a list of literal group names.
158+
items:
159+
type: string
160+
nullable: true
161+
type: array
162+
labels:
163+
description: Selectors specifies a list of label selectors over
164+
user labels.
165+
items:
166+
description: |-
167+
A label selector is a label query over a set of resources. The result of matchLabels and
168+
matchExpressions are ANDed. An empty label selector matches all objects. A null
169+
label selector matches no objects.
170+
properties:
171+
matchExpressions:
172+
description: matchExpressions is a list of label selector
173+
requirements. The requirements are ANDed.
174+
items:
175+
description: |-
176+
A label selector requirement is a selector that contains values, a key, and an operator that
177+
relates the key and values.
178+
properties:
179+
key:
180+
description: key is the label key that the selector
181+
applies to.
182+
type: string
183+
operator:
184+
description: |-
185+
operator represents a key's relationship to a set of values.
186+
Valid operators are In, NotIn, Exists and DoesNotExist.
187+
type: string
188+
values:
189+
description: |-
190+
values is an array of string values. If the operator is In or NotIn,
191+
the values array must be non-empty. If the operator is Exists or DoesNotExist,
192+
the values array must be empty. This array is replaced during a strategic
193+
merge patch.
194+
items:
195+
type: string
196+
type: array
197+
x-kubernetes-list-type: atomic
198+
required:
199+
- key
200+
- operator
201+
type: object
202+
type: array
203+
x-kubernetes-list-type: atomic
204+
matchLabels:
205+
additionalProperties:
206+
type: string
207+
description: |-
208+
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
209+
map is equivalent to an element of matchExpressions, whose key field is "key", the
210+
operator is "In", and the values array contains only "value". The requirements are ANDed.
211+
type: object
212+
type: object
213+
x-kubernetes-map-type: atomic
214+
nullable: true
215+
type: array
216+
users:
217+
description: users specifies a list of literal user names.
218+
items:
219+
type: string
220+
type: array
221+
type: object
222+
type: object
223+
type: object
224+
served: true
225+
storage: true

‎cmd/authentication-operator/main.go

+2
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55

66
"github.com/openshift/cluster-authentication-operator/pkg/cmd/mom"
77
"github.com/openshift/cluster-authentication-operator/pkg/cmd/operator"
8+
"github.com/openshift/cluster-authentication-operator/pkg/cmd/render"
89
"github.com/spf13/cobra"
910
"k8s.io/cli-runtime/pkg/genericiooptions"
1011
"k8s.io/component-base/cli"
@@ -34,6 +35,7 @@ func NewAuthenticationOperatorCommand() *cobra.Command {
3435
cmd.AddCommand(mom.NewApplyConfigurationCommand(ioStreams))
3536
cmd.AddCommand(mom.NewInputResourcesCommand(ioStreams))
3637
cmd.AddCommand(mom.NewOutputResourcesCommand(ioStreams))
38+
cmd.AddCommand(render.NewRender())
3739

3840
return cmd
3941
}

‎go.mod

+2-2
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,13 @@ require (
1212
github.com/openshift/library-go v0.0.0-20250113163708-355465391f40
1313
github.com/openshift/multi-operator-manager v0.0.0-20241205181422-20aa3906b99d
1414
github.com/spf13/cobra v1.8.1
15+
github.com/spf13/pflag v1.0.5
1516
github.com/stretchr/testify v1.9.0
1617
go.etcd.io/etcd/client/v3 v3.5.14
1718
golang.org/x/net v0.29.0
1819
gopkg.in/yaml.v2 v2.4.0
1920
k8s.io/api v0.31.1
21+
k8s.io/apiextensions-apiserver v0.31.1
2022
k8s.io/apimachinery v0.31.1
2123
k8s.io/apiserver v0.31.1
2224
k8s.io/cli-runtime v0.31.1
@@ -81,7 +83,6 @@ require (
8183
github.com/robfig/cron v1.2.0 // indirect
8284
github.com/shopspring/decimal v1.3.1 // indirect
8385
github.com/sirupsen/logrus v1.9.3 // indirect
84-
github.com/spf13/pflag v1.0.5 // indirect
8586
github.com/stoewer/go-strcase v1.2.0 // indirect
8687
github.com/x448/float16 v0.8.4 // indirect
8788
go.etcd.io/etcd/api/v3 v3.5.14 // indirect
@@ -113,7 +114,6 @@ require (
113114
gopkg.in/inf.v0 v0.9.1 // indirect
114115
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
115116
gopkg.in/yaml.v3 v3.0.1 // indirect
116-
k8s.io/apiextensions-apiserver v0.31.1 // indirect
117117
k8s.io/kms v0.31.1 // indirect
118118
k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
119119
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3 // indirect

‎pkg/cmd/mom/input_resources_command.go

+2
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55

66
"github.com/openshift/multi-operator-manager/pkg/library/libraryinputresources"
77
"github.com/spf13/cobra"
8+
apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
89
"k8s.io/cli-runtime/pkg/genericiooptions"
910
)
1011

@@ -63,6 +64,7 @@ func runInputResources(ctx context.Context) (*libraryinputresources.InputResourc
6364
libraryinputresources.ExactServiceAccount("openshift-authentication", "oauth-openshift"),
6465
libraryinputresources.ExactRoleBinding("openshift-config-managed", "system:openshift:oauth-servercert-trust"),
6566
libraryinputresources.ExactRole("openshift-config-managed", "system:openshift:oauth-servercert-trust"),
67+
libraryinputresources.ExactResource(apiextensionsv1.SchemeGroupVersion.Group, apiextensionsv1.SchemeGroupVersion.Version, "customresourcedefinitions", "", "rolebindingrestrictions.authorization.openshift.io"),
6668
},
6769
},
6870
}, nil

‎pkg/cmd/mom/output_resources_command.go

+3
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55

66
"github.com/openshift/multi-operator-manager/pkg/library/libraryoutputresources"
77
"github.com/spf13/cobra"
8+
apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
89
"k8s.io/cli-runtime/pkg/genericiooptions"
910
)
1011

@@ -56,6 +57,8 @@ func runOutputResources(ctx context.Context) (*libraryoutputresources.OutputReso
5657
// these are used to access resources in the user workload cluster
5758
libraryoutputresources.ExactServiceAccount("openshift-oauth-apiserver", "oauth-apiserver-sa"),
5859
libraryoutputresources.ExactService("openshift-oauth-apiserver", "api"),
60+
61+
libraryoutputresources.ExactResource(apiextensionsv1.SchemeGroupVersion.Group, apiextensionsv1.SchemeGroupVersion.Version, "customresourcedefinitions", "", "rolebindingrestrictions.authorization.openshift.io"),
5962
},
6063
GeneratedNameResources: []libraryoutputresources.GeneratedResourceID{
6164
libraryoutputresources.GeneratedCSR("system:openshift:openshift-authenticator-"),

0 commit comments

Comments
 (0)