MK8S-140 - Always create two Role and RoleBinding SeviceAccount for Prometheus and Alertmanager

Author: ChengYanJin

salt/metalk8s/addons/prometheus-operator/deployed/oidc-proxy-alertmanager.sls

@@ -42,7 +42,7 @@ Create oauth2-proxy-alertmanager Deployment:
               labels:
                 app: oauth2-proxy-alertmanager
             spec:
-              serviceAccountName: oidc-proxy
+              serviceAccountName: oidc-proxy-alertmanager
               {%- if ca_configured %}
               initContainers:
               - name: k8s-sidecar

salt/metalk8s/addons/prometheus-operator/deployed/oidc-proxy-prometheus.sls

@@ -42,7 +42,7 @@ Create oauth2-proxy-prometheus Deployment:
               labels:
                 app: oauth2-proxy-prometheus
             spec:
-              serviceAccountName: oidc-proxy
+              serviceAccountName: oidc-proxy-prometheus
               {%- if ca_configured %}
               initContainers:
               - name: k8s-sidecar

salt/metalk8s/addons/prometheus-operator/deployed/oidc-proxy-rbac.sls

@@ -23,50 +23,120 @@
 {%- set prometheus_oidc_enabled = prometheus.spec.config.get('enable_oidc_authentication', False) %}
 {%- set alertmanager_oidc_enabled = alertmanager.spec.get('config', {}).get('enable_oidc_authentication', False) %}
 
-{%- set oidc_enabled = prometheus_oidc_enabled or alertmanager_oidc_enabled %}
+{%- set prometheus_ca_namespace = prometheus.spec.config.get('oidc', {}).get('caSecret', {}).get('namespace', '') %}
+{%- set alertmanager_ca_namespace = alertmanager.spec.get('config', {}).get('oidc', {}).get('caSecret', {}).get('namespace', '') %}
+
+{%- if prometheus_oidc_enabled %}
+
+Create oidc-proxy-prometheus ServiceAccount:
+  metalk8s_kubernetes.object_present:
+    - manifest:
+        apiVersion: v1
+        kind: ServiceAccount
+        metadata:
+          name: oidc-proxy-prometheus
+          namespace: metalk8s-monitoring
+
+{%- if prometheus_ca_namespace %}
+
+Create oidc-proxy-secret-reader Role in {{ prometheus_ca_namespace }} for Prometheus:
+  metalk8s_kubernetes.object_present:
+    - manifest:
+        apiVersion: rbac.authorization.k8s.io/v1
+        kind: Role
+        metadata:
+          name: oidc-proxy-secret-reader
+          namespace: {{ prometheus_ca_namespace }}
+        rules:
+        - apiGroups: [""]
+          resources: ["secrets"]
+          verbs: ["get", "list", "watch"]
+
+Create oidc-proxy-secret-reader-binding RoleBinding in {{ prometheus_ca_namespace }} for Prometheus:
+  metalk8s_kubernetes.object_present:
+    - manifest:
+        apiVersion: rbac.authorization.k8s.io/v1
+        kind: RoleBinding
+        metadata:
+          name: oidc-proxy-secret-reader-binding
+          namespace: {{ prometheus_ca_namespace }}
+        subjects:
+        - kind: ServiceAccount
+          name: oidc-proxy-prometheus
+          namespace: metalk8s-monitoring
+        roleRef:
+          kind: Role
+          name: oidc-proxy-secret-reader
+          apiGroup: rbac.authorization.k8s.io
+
+{%- endif %}
+
+{%- else %}
+
+Ensure oidc-proxy-prometheus ServiceAccount does not exist:
+  metalk8s_kubernetes.object_absent:
+    - name: oidc-proxy-prometheus
+    - namespace: metalk8s-monitoring
+    - kind: ServiceAccount
+    - apiVersion: v1
+
+{%- if prometheus_ca_namespace %}
+
+Ensure oidc-proxy-secret-reader Role does not exist in {{ prometheus_ca_namespace }}:
+  metalk8s_kubernetes.object_absent:
+    - name: oidc-proxy-secret-reader
+    - namespace: {{ prometheus_ca_namespace }}
+    - kind: Role
+    - apiVersion: rbac.authorization.k8s.io/v1
+
+Ensure oidc-proxy-secret-reader-binding RoleBinding does not exist in {{ prometheus_ca_namespace }}:
+  metalk8s_kubernetes.object_absent:
+    - name: oidc-proxy-secret-reader-binding
+    - namespace: {{ prometheus_ca_namespace }}
+    - kind: RoleBinding
+    - apiVersion: rbac.authorization.k8s.io/v1
+
+{%- endif %}
 
-{%- set oidc_ca_namespace = prometheus.spec.config.get('oidc', {}).get('caSecret', {}).get('namespace', '') %}
-{%- if not oidc_ca_namespace %}
-  {%- set oidc_ca_namespace = alertmanager.spec.get('config', {}).get('oidc', {}).get('caSecret', {}).get('namespace', '') %}
 {%- endif %}
 
-{%- if oidc_enabled %}
+{%- if alertmanager_oidc_enabled %}
 
-Create oidc-proxy ServiceAccount:
+Create oidc-proxy-alertmanager ServiceAccount:
   metalk8s_kubernetes.object_present:
     - manifest:
         apiVersion: v1
         kind: ServiceAccount
         metadata:
-          name: oidc-proxy
+          name: oidc-proxy-alertmanager
           namespace: metalk8s-monitoring
 
-{%- if oidc_ca_namespace %}
+{%- if alertmanager_ca_namespace %}
 
-Create oidc-proxy-secret-reader Role in {{ oidc_ca_namespace }}:
+Create oidc-proxy-secret-reader Role in {{ alertmanager_ca_namespace }} for Alertmanager:
   metalk8s_kubernetes.object_present:
     - manifest:
         apiVersion: rbac.authorization.k8s.io/v1
         kind: Role
         metadata:
           name: oidc-proxy-secret-reader
-          namespace: {{ oidc_ca_namespace }}
+          namespace: {{ alertmanager_ca_namespace }}
         rules:
         - apiGroups: [""]
           resources: ["secrets"]
           verbs: ["get", "list", "watch"]
 
-Create oidc-proxy-secret-reader-binding RoleBinding in {{ oidc_ca_namespace }}:
+Create oidc-proxy-secret-reader-binding RoleBinding in {{ alertmanager_ca_namespace }} for Alertmanager:
   metalk8s_kubernetes.object_present:
     - manifest:
         apiVersion: rbac.authorization.k8s.io/v1
         kind: RoleBinding
         metadata:
           name: oidc-proxy-secret-reader-binding
-          namespace: {{ oidc_ca_namespace }}
+          namespace: {{ alertmanager_ca_namespace }}
         subjects:
         - kind: ServiceAccount
-          name: oidc-proxy
+          name: oidc-proxy-alertmanager
           namespace: metalk8s-monitoring
         roleRef:
           kind: Role
@@ -77,26 +147,26 @@ Create oidc-proxy-secret-reader-binding RoleBinding in {{ oidc_ca_namespace }}:
 
 {%- else %}
 
-Ensure oidc-proxy ServiceAccount does not exist:
+Ensure oidc-proxy-alertmanager ServiceAccount does not exist:
   metalk8s_kubernetes.object_absent:
-    - name: oidc-proxy
+    - name: oidc-proxy-alertmanager
     - namespace: metalk8s-monitoring
     - kind: ServiceAccount
     - apiVersion: v1
 
-{%- if oidc_ca_namespace %}
+{%- if alertmanager_ca_namespace %}
 
-Ensure oidc-proxy-secret-reader Role does not exist:
+Ensure oidc-proxy-secret-reader Role does not exist in {{ alertmanager_ca_namespace }}:
   metalk8s_kubernetes.object_absent:
     - name: oidc-proxy-secret-reader
-    - namespace: {{ oidc_ca_namespace }}
+    - namespace: {{ alertmanager_ca_namespace }}
     - kind: Role
     - apiVersion: rbac.authorization.k8s.io/v1
 
-Ensure oidc-proxy-secret-reader-binding RoleBinding does not exist:
+Ensure oidc-proxy-secret-reader-binding RoleBinding does not exist in {{ alertmanager_ca_namespace }}:
   metalk8s_kubernetes.object_absent:
     - name: oidc-proxy-secret-reader-binding
-    - namespace: {{ oidc_ca_namespace }}
+    - namespace: {{ alertmanager_ca_namespace }}
     - kind: RoleBinding
     - apiVersion: rbac.authorization.k8s.io/v1