✨ Add installer policy rule generators #1774
Conversation
openshift-ci
bot
added
the
do-not-merge/work-in-progress
✅ Deploy Preview for olmv1 ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1774 +/- ##
==========================================
+ Coverage 69.04% 69.58% +0.53%
==========================================
Files 65 67 +2
Lines 5263 5363 +100
==========================================
+ Hits 3634 3732 +98
- Misses 1396 1397 +1
- Partials 233 234 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
perdasilva
force-pushed
the
bundle-rbac
branch
2 times, most recently
from
38843e5 to
24b9633
Compare
perdasilva
changed the title
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
| return slices.Contains(clusterScopedResources, o.GetObjectKind().GroupVersionKind().Kind) | ||
| } | ||
|
|
||
| func isNamespaceScopedResource(o client.Object) bool { |
There was a problem hiding this comment.
since we expect the rendered manifests as input, I'm wondering if we could just check whether .metadata.namespace is set as the discriminant....
| @@ -29,6 +29,10 @@ import ( | |||
| "github.com/operator-framework/operator-controller/internal/operator-controller/rukpak/util" | |||
| ) | |||
|
|
|||
| const ( | |||
| AnnotationRegistryV1GeneratedManifest = "io.operatorframework.olm.generated-manifest" | |||
There was a problem hiding this comment.
So it is a new annotation.
What happens when we use this new annotation?
Are we allowing the creation of RBAC rules for the Cluster Extension?
Is that? Can you please clarify when it is required and why? (for the POV of the Cluster Extension User)
There was a problem hiding this comment.
This is something we can talk about. This annotation exists only to inform the client of convert.Convert which of the resources where generated by it as opposed to coming directly from the bundle. Other than that, it does nothing. It's really just a signal to say "this resource was generated when rendering the bundle - it is not part of the bundle itself"
Signed-off-by: Per Goncalves da Silva <[email protected]>
Signed-off-by: Per Goncalves da Silva <[email protected]>
Signed-off-by: Per Goncalves da Silva <[email protected]>
Signed-off-by: Per Goncalves da Silva <[email protected]>
Signed-off-by: Per Goncalves da Silva <[email protected]>
Description
Adds functions to the rukpak/convert package to generate policy rules that can be used by the installer service account / user to manage a cluster extension.
Reviewer Checklist