fix: add admin rbac for pr-preview namespace#492
Merged
Conversation
maksymsur
previously approved these changes
Mar 30, 2026
Consolidated Tests Results 2026-04-02 - 13:03:55Test Results
Details
test-reporter: Run #3729
🎉 All tests passed!TestsView All Tests
🍂 No flaky tests in this run. Github Test Reporter by CTRF 💚 🔄 This comment has been updated |
|
🚀 Preview deployment is deployed in "thresholdWithEnclave" mode You can now port-forward the kms-core to run your tests locally against the preview deployment. Connect to the Tailscale cluster zws-dev: tailscale configure kubeconfig tailscale-operator-zws-dev.diplodocus-boa.ts.netPort-forward the kms-core services to run your tests locally: kubectl port-forward svc/kms-core-1-core-1 -n kms-ci-fegmorte-492 50100:50100 & \
kubectl port-forward svc/kms-core-2-core-2 -n kms-ci-fegmorte-492 50200:50100 & \
kubectl port-forward svc/kms-core-3-core-3 -n kms-ci-fegmorte-492 50300:50100 & \
kubectl port-forward svc/kms-core-4-core-4 -n kms-ci-fegmorte-492 50400:50100 &Copy config.toml from core-client to ./core-client/config/client_local_kind_threshold.toml kubectl cp kms-ci-fegmorte-492/kms-core-client-0:/app/kms-core-client/config.toml ./core-client/config/client_local_kind_threshold.toml && \
sed -i '' -E 's|address = "(http://)?kms-core-([0-9]+)-[^:]+:50100"|address = "http://localhost:50\200"|' ./core-client/config/client_local_kind_threshold.toml🚀 And launch your tests: cargo nextest run --test kubernetes_test_threshold --profile ci --no-fail-fastYou can connect to the core-client with: kubectl exec kms-core-client-0 -n kms-ci-fegmorte-492 -it -- /bin/bashClose your port-forwarding with: pgrep -f "kubectl port-forward" | xargs -n 1 kill |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the PR-preview deployment workflow to ensure teams can access dynamically created preview namespaces by granting namespace-scoped RBAC, and it refines CI concurrency grouping to better de-duplicate runs triggered by different PR events.
Changes:
- Switch PR-preview image references from
ghcr.iotohub.zama.org/ghcr/.... - Add a namespace-scoped RoleBinding for the
kms-dev-accessgroup on the preview namespace. - Adjust
build-and-testconcurrency grouping so “CI-relevant” label events share the same canceling group as pushes/synchronizations.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/pr-preview-deploy.yml | Updates image registry paths and adds a RoleBinding granting group access to each dynamically created PR-preview namespace. |
| .github/workflows/build-and-test.yml | Refines concurrency group calculation to avoid unrelated label events canceling CI runs while keeping CI-relevant events mutually canceling. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of changes
By adding a label
pr-preview-<type-of-deployment>, you can deploy a preview environment in the k8s cluster. But I create dynamic namespace to avoid collision between preview environment.In order to access this k8s namespace deployed for the preview environment, we need to add specific RBAC to the k8s cluster and scoped to the brand new namespace. For the moment it's only a read-only access. With the addition of this RBAC, mpc team will be admin of their namespace.
Issue ticket number and link
PR Checklist
I attest that all checked items are satisfied. Any deviation is clearly justified above.
chore: ...).TODO(#issue).unwrap/expect/paniconly in tests or for invariant bugs (documented if present).devopslabel + infra notified + infra-team reviewer assigned.!and affected teams notified.Zeroize+ZeroizeOnDropimplemented.unsafe; if unavoidable: minimal, justified, documented, and test/fuzz covered.Dependency Update Questionnaire (only if deps changed or added)
Answer in the
Cargo.tomlnext to the dependency (or here if updating):More details and explanations for the checklist and dependency updates can be found in CONTRIBUTING.md