Skip to content

Commit ac31817

Browse files
ryansteakleyryansteakley
authored
Install flag for helm and additional kustomize file for raw yaml for pure Namespace scoping (#149)
Issue #, if available: aws-controllers-k8s/community#770 Description of changes: - Adds `namespacedInstallation` flag for helm` values.yaml` to specify that `Role `and` RoleBinding` should be used instead of `ClusterRole `and `ClusterRoleBinding` - Specifies that `watchNamespace` in helm`values.yaml` must be set if using `namespacedInstallation` flag. - Contains a sed to replace the original output of the `role-controller.yaml` file with the template code that allows for the programmatic setting of `namespacedInstallation` in the helm` values.yaml` - Adds a `overlays/namespaced` directory for the raw yamls in config. This folder contains the json patch files, `role.yaml` and `role-binding.yaml` that will modify the `ClusterRole` and `ClusterRoleBinding` files to be `Role `and `RoleBinding`. This allows the user to apply these changes using raw yaml and not helm if these wish. - Chose to reuse the names of `cluster-role-binding.yaml` and `cluster-role-controller.yaml` so that every service repo doesn't need to rm these files since they already exist in their repo and any other naming of the yaml files will cause multiple roles/bindings to install causing installation failures. Tested locally By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
1 parent afa7fe0 commit ac31817

File tree

12 files changed

+72
-9
lines changed

12 files changed

+72
-9
lines changed

‎pkg/generate/ack/controller.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ var (
3636
"config/rbac/role-writer.yaml.tpl",
3737
"config/rbac/kustomization.yaml.tpl",
3838
"config/crd/kustomization.yaml.tpl",
39+
"config/overlays/namespaced/kustomization.yaml.tpl",
3940
}
4041
controllerIncludePaths = []string{
4142
"config/controller/kustomization_def.yaml.tpl",

‎pkg/generate/ack/release.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ var (
2828
"helm/values.yaml.tpl",
2929
"helm/templates/role-reader.yaml.tpl",
3030
"helm/templates/role-writer.yaml.tpl",
31+
"helm/templates/_controller-role-kind-patch.yaml.tpl",
3132
}
3233
releaseIncludePaths = []string{}
3334
releaseCopyPaths = []string{

‎scripts/build-controller-release.sh‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -199,10 +199,17 @@ pushd $SERVICE_CONTROLLER_SOURCE_PATH/pkg/resource 1>/dev/null
199199
echo "Generating RBAC manifests for $SERVICE"
200200
controller-gen rbac:roleName=$K8S_RBAC_ROLE_NAME paths=./... output:rbac:artifacts:config=$helm_output_dir/templates
201201
# controller-gen rbac outputs a ClusterRole definition in a
202-
# $config_output_dir/rbac/role.yaml file. We have some other standard Role
203-
# files for a reader and writer role, so here we rename the `role.yaml` file to
204-
# `cluster-role-controller.yaml` to better reflect what is in that file.
205-
mv $helm_output_dir/templates/role.yaml $helm_output_dir/templates/cluster-role-controller.yaml
202+
# $config_output_dir/rbac/role.yaml file. We additionally add the ability by
203+
# for the user to specify if they want the role to be ClusterRole or Role by specifying installation scope
204+
# in the helm values.yaml. We do this by having a custom helm template named _controller-role-kind-patch.yaml
205+
# which utilizes the template langauge and adding the auto generated rules to that template.
206+
tail -n +8 $helm_output_dir/templates/role.yaml >> $helm_output_dir/templates/_controller-role-kind-patch.yaml
207+
208+
# We have some other standard Role files for a reader and writer role, so here we rename
209+
# the `_controller-role-kind-patch.yaml ` file to `cluster-role-controller.yaml`
210+
# to better reflect what is in that file.
211+
mv $helm_output_dir/templates/_controller-role-kind-patch.yaml $helm_output_dir/templates/cluster-role-controller.yaml
212+
rm $helm_output_dir/templates/role.yaml
206213

207214
popd 1>/dev/null
208215

‎scripts/build-controller.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,11 @@ controller-gen rbac:roleName=$K8S_RBAC_ROLE_NAME paths=./... output:rbac:artifac
209209
# files for a reader and writer role, so here we rename the `role.yaml` file to
210210
# `cluster-role-controller.yaml` to better reflect what is in that file.
211211
mv $config_output_dir/rbac/role.yaml $config_output_dir/rbac/cluster-role-controller.yaml
212+
# Copy definitions for json patches which allow the user to patch the controller
213+
# with Role/Rolebinding and be purely namespaced scoped instead of using Cluster/ClusterRoleBinding
214+
# using kustomize
215+
mkdir -p $config_output_dir/overlays/namespaced
216+
cp -r $ROOT_DIR/templates/config/overlays/namespaced/*.json $config_output_dir/overlays/namespaced
212217

213218
popd 1>/dev/null
214219

‎templates/config/overlays/namespaced/kustomization.yaml.tpl‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
resources:
2+
- ../../default
3+
patches:
4+
- path: role.json
5+
target:
6+
group: rbac.authorization.k8s.io
7+
version: v1
8+
kind: ClusterRole
9+
name: ack-{{ .ServiceIDClean }}-controller
10+
- path: role-binding.json
11+
target:
12+
group: rbac.authorization.k8s.io
13+
version: v1
14+
kind: ClusterRoleBinding
15+
name: ack-{{ .ServiceIDClean }}-controller-rolebinding

‎templates/config/overlays/namespaced/role-binding.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[{"op": "replace", "path": "/kind", "value": "RoleBinding"},
2+
{"op": "add", "path": "/metadata/namespace", "value": "ack-system"},
3+
{"op": "replace", "path": "/roleRef/kind", "value": "Role"}]

‎templates/config/overlays/namespaced/role.json‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
[{"op": "replace", "path": "/kind", "value": "Role"},
2+
{"op": "add", "path": "/metadata/namespace", "value": "ack-system"}]

‎templates/helm/templates/_controller-role-kind-patch.yaml.tpl‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
{{ "{{ if eq .Values.installScope \"cluster\" }}" }}
3+
kind: ClusterRole
4+
metadata:
5+
creationTimestamp: null
6+
name: ack-{{ .ServiceIDClean }}-controller
7+
{{ "{{ else }}" }}
8+
kind: Role
9+
metadata:
10+
creationTimestamp: null
11+
name: ack-{{ .ServiceIDClean }}-controller
12+
namespace: {{ "{{ .Release.Namespace }}" }}
13+
{{ "{{ end }}" }}

‎templates/helm/templates/_helpers.tpl‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,3 +30,9 @@ If release name contains chart name it will be used as a full name.
3030
{{- define "service-account.name" -}}
3131
{{ default "default" .Values.serviceAccount.name }}
3232
{{- end -}}
33+
34+
{{- define "watch-namespace" -}}
35+
{{- if eq .Values.installScope "namespace" -}}
36+
{{- .Release.Namespace -}}
37+
{{- end -}}
38+
{{- end -}}

‎templates/helm/templates/cluster-role-binding.yaml.tpl‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,19 @@
11
apiVersion: rbac.authorization.k8s.io/v1
2+
{{ "{{ if eq .Values.installScope \"cluster\" }}" }}
23
kind: ClusterRoleBinding
34
metadata:
45
name: {{ "{{ include \"app.fullname\" . }}" }}
56
roleRef:
6-
apiGroup: rbac.authorization.k8s.io
77
kind: ClusterRole
8+
{{ "{{ else }}" }}
9+
kind: RoleBinding
10+
metadata:
11+
name: {{ "{{ include \"app.fullname\" . }}" }}
12+
namespace: {{ "{{ .Release.Namespace }}" }}
13+
roleRef:
14+
kind: Role
15+
{{ "{{ end }}" }}
16+
apiGroup: rbac.authorization.k8s.io
817
name: ack-{{ .ServiceIDClean }}-controller
918
subjects:
1019
- kind: ServiceAccount

0 commit comments

Comments
 (0)