From 48575f5f8c2261f1242e9fe0c304efbab9349efd Mon Sep 17 00:00:00 2001 From: Gabriele Fedi Date: Tue, 21 Apr 2026 10:01:25 +0200 Subject: [PATCH] fix: merge labels instead of replacing Signed-off-by: Gabriele Fedi --- internal/cnpgi/operator/rbac/ensure.go | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/internal/cnpgi/operator/rbac/ensure.go b/internal/cnpgi/operator/rbac/ensure.go index 588d145..a39432f 100644 --- a/internal/cnpgi/operator/rbac/ensure.go +++ b/internal/cnpgi/operator/rbac/ensure.go @@ -91,7 +91,7 @@ func EnsureRoleRules( // the desired state. // // This function is called from the Pre hook (gRPC). It creates the RoleBinding -// if it does not exist, otherwise it patches RoleRef, Subjects, and labels to match +// if it does not exist, otherwise it patches Subjects and labels to match // the desired state. func EnsureRoleBinding(ctx context.Context, c client.Client, cluster *cnpgv1.Cluster) error { contextLogger := log.FromContext(ctx) @@ -112,6 +112,7 @@ func EnsureRoleBinding(ctx context.Context, c client.Client, cluster *cnpgv1.Clu "namespace", desiredRoleBinding.Namespace) return c.Create(ctx, desiredRoleBinding) } + return err } if !roleBindingNeedsUpdate(roleBinding, desiredRoleBinding) { @@ -122,8 +123,12 @@ func EnsureRoleBinding(ctx context.Context, c client.Client, cluster *cnpgv1.Clu "name", roleBinding.Name, "namespace", roleBinding.Namespace) oldRoleBinding := roleBinding.DeepCopy() - roleBinding.Labels = desiredRoleBinding.Labels - roleBinding.RoleRef = desiredRoleBinding.RoleRef + if roleBinding.Labels == nil { + roleBinding.Labels = make(map[string]string, len(desiredRoleBinding.Labels)) + } + for k, v := range desiredRoleBinding.Labels { + roleBinding.Labels[k] = v + } roleBinding.Subjects = desiredRoleBinding.Subjects return c.Patch(ctx, roleBinding, client.MergeFrom(oldRoleBinding)) @@ -222,14 +227,6 @@ func labelsNeedUpdate(existing, desired map[string]string) bool { // roleBindingNeedsUpdate returns true if the existing RoleBinding's // RoleRef or Subjects differ from the desired, or if labels need update. func roleBindingNeedsUpdate(existing, desired *rbacv1.RoleBinding) bool { - if existing == nil || desired == nil { - return existing != desired - } - - if !equality.Semantic.DeepEqual(existing.RoleRef, desired.RoleRef) { - return true - } - if !equality.Semantic.DeepEqual(existing.Subjects, desired.Subjects) { return true }