mirror of
https://github.com/cloudnative-pg/plugin-barman-cloud.git
synced 2026-07-09 19:22:21 +02:00
Compare commits
2 Commits
4acc222462
...
89b46acce5
| Author | SHA1 | Date | |
|---|---|---|---|
|
89b46acce5 | ||
|
|
e3835f1c0c |
@ -91,7 +91,7 @@ func EnsureRoleRules(
|
||||
// the desired state.
|
||||
//
|
||||
// This function is called from the Pre hook (gRPC). It creates the RoleBinding
|
||||
// if it does not exist, otherwise it patches Subjects and labels to match
|
||||
// if it does not exist, otherwise it patches RoleRef, Subjects, and labels to match
|
||||
// the desired state.
|
||||
func EnsureRoleBinding(ctx context.Context, c client.Client, cluster *cnpgv1.Cluster) error {
|
||||
contextLogger := log.FromContext(ctx)
|
||||
@ -112,7 +112,6 @@ func EnsureRoleBinding(ctx context.Context, c client.Client, cluster *cnpgv1.Clu
|
||||
"namespace", desiredRoleBinding.Namespace)
|
||||
return c.Create(ctx, desiredRoleBinding)
|
||||
}
|
||||
return err
|
||||
}
|
||||
|
||||
if !roleBindingNeedsUpdate(roleBinding, desiredRoleBinding) {
|
||||
@ -123,12 +122,8 @@ func EnsureRoleBinding(ctx context.Context, c client.Client, cluster *cnpgv1.Clu
|
||||
"name", roleBinding.Name, "namespace", roleBinding.Namespace)
|
||||
|
||||
oldRoleBinding := roleBinding.DeepCopy()
|
||||
if roleBinding.Labels == nil {
|
||||
roleBinding.Labels = make(map[string]string, len(desiredRoleBinding.Labels))
|
||||
}
|
||||
for k, v := range desiredRoleBinding.Labels {
|
||||
roleBinding.Labels[k] = v
|
||||
}
|
||||
roleBinding.Labels = desiredRoleBinding.Labels
|
||||
roleBinding.RoleRef = desiredRoleBinding.RoleRef
|
||||
roleBinding.Subjects = desiredRoleBinding.Subjects
|
||||
|
||||
return c.Patch(ctx, roleBinding, client.MergeFrom(oldRoleBinding))
|
||||
@ -225,8 +220,16 @@ func labelsNeedUpdate(existing, desired map[string]string) bool {
|
||||
}
|
||||
|
||||
// roleBindingNeedsUpdate returns true if the existing RoleBinding's
|
||||
// Subjects differ from the desired or if labels need update.
|
||||
// RoleRef or Subjects differ from the desired, or if labels need update.
|
||||
func roleBindingNeedsUpdate(existing, desired *rbacv1.RoleBinding) bool {
|
||||
if existing == nil || desired == nil {
|
||||
return existing != desired
|
||||
}
|
||||
|
||||
if !equality.Semantic.DeepEqual(existing.RoleRef, desired.RoleRef) {
|
||||
return true
|
||||
}
|
||||
|
||||
if !equality.Semantic.DeepEqual(existing.Subjects, desired.Subjects) {
|
||||
return true
|
||||
}
|
||||
|
||||
@ -25,7 +25,6 @@ import (
|
||||
|
||||
barmanapi "github.com/cloudnative-pg/barman-cloud/pkg/api"
|
||||
cnpgv1 "github.com/cloudnative-pg/cloudnative-pg/api/v1"
|
||||
"github.com/cloudnative-pg/cloudnative-pg/pkg/utils"
|
||||
machineryapi "github.com/cloudnative-pg/machinery/pkg/api"
|
||||
. "github.com/onsi/ginkgo/v2"
|
||||
. "github.com/onsi/gomega"
|
||||
@ -43,15 +42,6 @@ import (
|
||||
"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/operator/rbac"
|
||||
)
|
||||
|
||||
func expectRequiredLabels(labels map[string]string, clusterName string) {
|
||||
ExpectWithOffset(1, labels).To(HaveKeyWithValue(metadata.ClusterLabelName, clusterName))
|
||||
ExpectWithOffset(1, labels).To(HaveKeyWithValue(utils.KubernetesAppLabelName, utils.AppName))
|
||||
ExpectWithOffset(1, labels).To(HaveKeyWithValue(utils.KubernetesAppInstanceLabelName, clusterName))
|
||||
ExpectWithOffset(1, labels).To(HaveKeyWithValue(utils.KubernetesAppManagedByLabelName, "plugin-barman-cloud"))
|
||||
ExpectWithOffset(1, labels).To(HaveKeyWithValue(utils.KubernetesAppComponentLabelName, utils.DatabaseComponentName))
|
||||
ExpectWithOffset(1, labels).To(HaveKey(utils.KubernetesAppVersionLabelName))
|
||||
}
|
||||
|
||||
func newScheme() *runtime.Scheme {
|
||||
s := runtime.NewScheme()
|
||||
utilruntime.Must(rbacv1.AddToScheme(s))
|
||||
@ -134,7 +124,7 @@ var _ = Describe("EnsureRole", func() {
|
||||
Expect(role.OwnerReferences[0].Name).To(Equal("test-cluster"))
|
||||
Expect(role.OwnerReferences[0].Kind).To(Equal("Cluster"))
|
||||
|
||||
expectRequiredLabels(role.Labels, "test-cluster")
|
||||
Expect(role.Labels).To(HaveKeyWithValue(metadata.ClusterLabelName, "test-cluster"))
|
||||
})
|
||||
})
|
||||
|
||||
@ -220,7 +210,7 @@ var _ = Describe("EnsureRole", func() {
|
||||
Name: "test-cluster-barman-cloud",
|
||||
Namespace: "default",
|
||||
Labels: map[string]string{
|
||||
"custom-label": "custom-value",
|
||||
"app.kubernetes.io/managed-by": "helm",
|
||||
},
|
||||
},
|
||||
}
|
||||
@ -237,8 +227,8 @@ var _ = Describe("EnsureRole", func() {
|
||||
Name: "test-cluster-barman-cloud",
|
||||
}, &role)).To(Succeed())
|
||||
|
||||
Expect(role.Labels).To(HaveKeyWithValue("custom-label", "custom-value"))
|
||||
expectRequiredLabels(role.Labels, "test-cluster")
|
||||
Expect(role.Labels).To(HaveKeyWithValue("app.kubernetes.io/managed-by", "helm"))
|
||||
Expect(role.Labels).To(HaveKeyWithValue(metadata.ClusterLabelName, "test-cluster"))
|
||||
})
|
||||
})
|
||||
|
||||
@ -267,202 +257,12 @@ var _ = Describe("EnsureRole", func() {
|
||||
Name: "test-cluster-barman-cloud",
|
||||
}, &role)).To(Succeed())
|
||||
|
||||
expectRequiredLabels(role.Labels, "test-cluster")
|
||||
Expect(role.Labels).To(HaveKeyWithValue(metadata.ClusterLabelName, "test-cluster"))
|
||||
Expect(role.Rules).To(HaveLen(3))
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
var _ = Describe("EnsureRoleBinding", func() {
|
||||
var (
|
||||
ctx context.Context
|
||||
cluster *cnpgv1.Cluster
|
||||
fakeClient client.Client
|
||||
)
|
||||
|
||||
BeforeEach(func() {
|
||||
ctx = context.Background()
|
||||
cluster = newCluster("test-cluster", "default")
|
||||
})
|
||||
|
||||
Context("when the RoleBinding does not exist", func() {
|
||||
BeforeEach(func() {
|
||||
fakeClient = fake.NewClientBuilder().WithScheme(newScheme()).Build()
|
||||
})
|
||||
|
||||
It("should create the RoleBinding with owner reference, labels, and correct subjects", func() {
|
||||
err := rbac.EnsureRoleBinding(ctx, fakeClient, cluster)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
var rb rbacv1.RoleBinding
|
||||
Expect(fakeClient.Get(ctx, client.ObjectKey{
|
||||
Namespace: "default",
|
||||
Name: "test-cluster-barman-cloud",
|
||||
}, &rb)).To(Succeed())
|
||||
|
||||
Expect(rb.OwnerReferences).To(HaveLen(1))
|
||||
Expect(rb.OwnerReferences[0].Name).To(Equal("test-cluster"))
|
||||
Expect(rb.OwnerReferences[0].Kind).To(Equal("Cluster"))
|
||||
|
||||
expectRequiredLabels(rb.Labels, "test-cluster")
|
||||
|
||||
Expect(rb.Subjects).To(HaveLen(1))
|
||||
Expect(rb.Subjects[0].Name).To(Equal("test-cluster"))
|
||||
Expect(rb.Subjects[0].Kind).To(Equal("ServiceAccount"))
|
||||
|
||||
Expect(rb.RoleRef.Kind).To(Equal("Role"))
|
||||
Expect(rb.RoleRef.Name).To(Equal("test-cluster-barman-cloud"))
|
||||
})
|
||||
})
|
||||
|
||||
Context("when the RoleBinding exists with matching state", func() {
|
||||
BeforeEach(func() {
|
||||
fakeClient = fake.NewClientBuilder().WithScheme(newScheme()).Build()
|
||||
Expect(rbac.EnsureRoleBinding(ctx, fakeClient, cluster)).To(Succeed())
|
||||
})
|
||||
|
||||
It("should not patch the RoleBinding", func() {
|
||||
var before rbacv1.RoleBinding
|
||||
Expect(fakeClient.Get(ctx, client.ObjectKey{
|
||||
Namespace: "default",
|
||||
Name: "test-cluster-barman-cloud",
|
||||
}, &before)).To(Succeed())
|
||||
|
||||
err := rbac.EnsureRoleBinding(ctx, fakeClient, cluster)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
var after rbacv1.RoleBinding
|
||||
Expect(fakeClient.Get(ctx, client.ObjectKey{
|
||||
Namespace: "default",
|
||||
Name: "test-cluster-barman-cloud",
|
||||
}, &after)).To(Succeed())
|
||||
|
||||
Expect(after.ResourceVersion).To(Equal(before.ResourceVersion))
|
||||
})
|
||||
})
|
||||
|
||||
Context("when the RoleBinding exists with different subjects", func() {
|
||||
BeforeEach(func() {
|
||||
fakeClient = fake.NewClientBuilder().WithScheme(newScheme()).Build()
|
||||
existing := &rbacv1.RoleBinding{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: "test-cluster-barman-cloud",
|
||||
Namespace: "default",
|
||||
},
|
||||
Subjects: []rbacv1.Subject{
|
||||
{
|
||||
Kind: "ServiceAccount",
|
||||
Name: "old-sa",
|
||||
APIGroup: "",
|
||||
},
|
||||
},
|
||||
RoleRef: rbacv1.RoleRef{
|
||||
APIGroup: "rbac.authorization.k8s.io",
|
||||
Kind: "Role",
|
||||
Name: "test-cluster-barman-cloud",
|
||||
},
|
||||
}
|
||||
Expect(fakeClient.Create(ctx, existing)).To(Succeed())
|
||||
})
|
||||
|
||||
It("should patch the subjects to match the desired state", func() {
|
||||
err := rbac.EnsureRoleBinding(ctx, fakeClient, cluster)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
var rb rbacv1.RoleBinding
|
||||
Expect(fakeClient.Get(ctx, client.ObjectKey{
|
||||
Namespace: "default",
|
||||
Name: "test-cluster-barman-cloud",
|
||||
}, &rb)).To(Succeed())
|
||||
|
||||
Expect(rb.Subjects).To(HaveLen(1))
|
||||
Expect(rb.Subjects[0].Name).To(Equal("test-cluster"))
|
||||
})
|
||||
})
|
||||
|
||||
Context("when the RoleBinding has pre-existing unrelated labels", func() {
|
||||
BeforeEach(func() {
|
||||
fakeClient = fake.NewClientBuilder().WithScheme(newScheme()).Build()
|
||||
existing := &rbacv1.RoleBinding{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: "test-cluster-barman-cloud",
|
||||
Namespace: "default",
|
||||
Labels: map[string]string{
|
||||
"custom-label": "custom-value",
|
||||
},
|
||||
},
|
||||
Subjects: []rbacv1.Subject{
|
||||
{
|
||||
Kind: "ServiceAccount",
|
||||
Name: "test-cluster",
|
||||
Namespace: "default",
|
||||
APIGroup: "",
|
||||
},
|
||||
},
|
||||
RoleRef: rbacv1.RoleRef{
|
||||
APIGroup: "rbac.authorization.k8s.io",
|
||||
Kind: "Role",
|
||||
Name: "test-cluster-barman-cloud",
|
||||
},
|
||||
}
|
||||
Expect(fakeClient.Create(ctx, existing)).To(Succeed())
|
||||
})
|
||||
|
||||
It("should preserve unrelated labels while adding the required labels", func() {
|
||||
err := rbac.EnsureRoleBinding(ctx, fakeClient, cluster)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
var rb rbacv1.RoleBinding
|
||||
Expect(fakeClient.Get(ctx, client.ObjectKey{
|
||||
Namespace: "default",
|
||||
Name: "test-cluster-barman-cloud",
|
||||
}, &rb)).To(Succeed())
|
||||
|
||||
Expect(rb.Labels).To(HaveKeyWithValue("custom-label", "custom-value"))
|
||||
expectRequiredLabels(rb.Labels, "test-cluster")
|
||||
})
|
||||
})
|
||||
|
||||
Context("when the RoleBinding exists without labels (upgrade scenario)", func() {
|
||||
BeforeEach(func() {
|
||||
fakeClient = fake.NewClientBuilder().WithScheme(newScheme()).Build()
|
||||
existing := &rbacv1.RoleBinding{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: "test-cluster-barman-cloud",
|
||||
Namespace: "default",
|
||||
},
|
||||
Subjects: []rbacv1.Subject{
|
||||
{
|
||||
Kind: "ServiceAccount",
|
||||
Name: "test-cluster",
|
||||
Namespace: "default",
|
||||
APIGroup: "",
|
||||
},
|
||||
},
|
||||
RoleRef: rbacv1.RoleRef{
|
||||
APIGroup: "rbac.authorization.k8s.io",
|
||||
Kind: "Role",
|
||||
Name: "test-cluster-barman-cloud",
|
||||
},
|
||||
}
|
||||
Expect(fakeClient.Create(ctx, existing)).To(Succeed())
|
||||
})
|
||||
|
||||
It("should add the required labels", func() {
|
||||
err := rbac.EnsureRoleBinding(ctx, fakeClient, cluster)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
var rb rbacv1.RoleBinding
|
||||
Expect(fakeClient.Get(ctx, client.ObjectKey{
|
||||
Namespace: "default",
|
||||
Name: "test-cluster-barman-cloud",
|
||||
}, &rb)).To(Succeed())
|
||||
|
||||
expectRequiredLabels(rb.Labels, "test-cluster")
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
var _ = Describe("EnsureRoleRules", func() {
|
||||
var (
|
||||
ctx context.Context
|
||||
|
||||
@ -24,7 +24,6 @@ import (
|
||||
|
||||
cnpgv1 "github.com/cloudnative-pg/cloudnative-pg/api/v1"
|
||||
"github.com/cloudnative-pg/cloudnative-pg/pkg/utils"
|
||||
|
||||
"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/metadata"
|
||||
)
|
||||
|
||||
|
||||
@ -43,10 +43,9 @@
|
||||
]
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=20.0.0"
|
||||
"node": ">=18.0"
|
||||
},
|
||||
"resolutions": {
|
||||
"webpackbar": "^7.0.0",
|
||||
"serialize-javascript": ">=7.0.5"
|
||||
"webpackbar": "^7.0.0"
|
||||
}
|
||||
}
|
||||
|
||||
@ -3389,9 +3389,9 @@ array-union@^2.1.0:
|
||||
integrity sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==
|
||||
|
||||
asn1js@^3.0.6:
|
||||
version "3.0.10"
|
||||
resolved "https://registry.yarnpkg.com/asn1js/-/asn1js-3.0.10.tgz#df26c874c8a8b41ca605efea47b2ad07551013dd"
|
||||
integrity sha512-S2s3aOytiKdFRdulw2qPE51MzjzVOisppcVv7jVFR+Kw0kxwvFrDcYA0h7Ndqbmj0HkMIXYWaoj7fli8kgx1eg==
|
||||
version "3.0.9"
|
||||
resolved "https://registry.yarnpkg.com/asn1js/-/asn1js-3.0.9.tgz#d48f454d263a0c9f5fe8c6c66057a4d69bccfece"
|
||||
integrity sha512-g35Ef4IMkE3mDaMAYd3GOJ/c41LKcaiJuuLZ9BF0EXkZwYc0tkFpmZqxWsKlmXS3Um42dAkyx//kibIETBjfqg==
|
||||
dependencies:
|
||||
pvtsutils "^1.3.6"
|
||||
pvutils "^1.1.5"
|
||||
@ -5849,9 +5849,9 @@ json5@^2.1.2, json5@^2.2.3:
|
||||
integrity sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==
|
||||
|
||||
jsonfile@^6.0.1:
|
||||
version "6.2.1"
|
||||
resolved "https://registry.yarnpkg.com/jsonfile/-/jsonfile-6.2.1.tgz#b6e31717f22cc37330b081ce0051ed5de53af2f6"
|
||||
integrity sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==
|
||||
version "6.2.0"
|
||||
resolved "https://registry.yarnpkg.com/jsonfile/-/jsonfile-6.2.0.tgz#7c265bd1b65de6977478300087c99f1c84383f62"
|
||||
integrity sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==
|
||||
dependencies:
|
||||
universalify "^2.0.0"
|
||||
optionalDependencies:
|
||||
@ -7854,6 +7854,13 @@ quick-lru@^5.1.1:
|
||||
resolved "https://registry.yarnpkg.com/quick-lru/-/quick-lru-5.1.1.tgz#366493e6b3e42a3a6885e2e99d18f80fb7a8c932"
|
||||
integrity sha512-WuyALRjWPDGtt/wzJiadO5AXY+8hZ80hVpe6MyivgraREW751X3SbhRvG3eLKOYN+8VEvqLcf3wdnt44Z4S4SA==
|
||||
|
||||
randombytes@^2.1.0:
|
||||
version "2.1.0"
|
||||
resolved "https://registry.yarnpkg.com/randombytes/-/randombytes-2.1.0.tgz#df6f84372f0270dc65cdf6291349ab7a473d4f2a"
|
||||
integrity sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==
|
||||
dependencies:
|
||||
safe-buffer "^5.1.0"
|
||||
|
||||
range-parser@1.2.0:
|
||||
version "1.2.0"
|
||||
resolved "https://registry.yarnpkg.com/range-parser/-/range-parser-1.2.0.tgz#f49be6b487894ddc40dcc94a322f611092e00d5e"
|
||||
@ -8289,7 +8296,7 @@ run-parallel@^1.1.9:
|
||||
dependencies:
|
||||
queue-microtask "^1.2.2"
|
||||
|
||||
safe-buffer@5.2.1, safe-buffer@>=5.1.0, safe-buffer@~5.2.0:
|
||||
safe-buffer@5.2.1, safe-buffer@>=5.1.0, safe-buffer@^5.1.0, safe-buffer@~5.2.0:
|
||||
version "5.2.1"
|
||||
resolved "https://registry.yarnpkg.com/safe-buffer/-/safe-buffer-5.2.1.tgz#1eaf9fa9bdb1fdd4ec75f58f9cdb4e6b7827eec6"
|
||||
integrity sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==
|
||||
@ -8395,10 +8402,12 @@ send@~0.19.0, send@~0.19.1:
|
||||
range-parser "~1.2.1"
|
||||
statuses "~2.0.2"
|
||||
|
||||
serialize-javascript@>=7.0.5, serialize-javascript@^6.0.0, serialize-javascript@^6.0.1:
|
||||
version "7.0.5"
|
||||
resolved "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-7.0.5.tgz#c798cc0552ffbb08981914a42a8756e339d0d5b1"
|
||||
integrity sha512-F4LcB0UqUl1zErq+1nYEEzSHJnIwb3AF2XWB94b+afhrekOUijwooAYqFyRbjYkm2PAKBabx6oYv/xDxNi8IBw==
|
||||
serialize-javascript@^6.0.0, serialize-javascript@^6.0.1:
|
||||
version "6.0.2"
|
||||
resolved "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-6.0.2.tgz#defa1e055c83bf6d59ea805d8da862254eb6a6c2"
|
||||
integrity sha512-Saa1xPByTTq2gdeFZYLLo+RFE35NHZkAbqZeWNd3BpzppeVisAqpDjcp8dyf6uIvEqJRd46jemmyA4iFIeVk8g==
|
||||
dependencies:
|
||||
randombytes "^2.1.0"
|
||||
|
||||
serve-handler@^6.1.7:
|
||||
version "6.1.7"
|
||||
|
||||
Loading…
Reference in New Issue
Block a user