mirror of
https://github.com/cloudnative-pg/plugin-barman-cloud.git
synced 2026-07-06 17:52:21 +02:00
8971a397f4
When an ObjectStore's credentials change (e.g., secret rename), the RBAC Role granting the Cluster's ServiceAccount access to those secrets was not updated because nothing triggered a Cluster reconciliation. Implement the ObjectStore controller's Reconcile to detect affected Roles and update their rules directly, without needing access to Cluster objects. The controller lists Roles by a label set by the Pre hook, inspects their rules to find which ObjectStores they reference, fetches those ObjectStores, and patches the rules to match the current specs. Replace the custom setOwnerReference helper with controllerutil.SetControllerReference. Add dynamic CNPG scheme registration (internal/scheme) to the operator, instance, and restore managers. Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com> Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com> Signed-off-by: Gabriele Quaresima <gabriele.quaresima@enterprisedb.com> Co-authored-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com> Co-authored-by: Gabriele Quaresima <gabriele.quaresima@enterprisedb.com>
65 lines
2.1 KiB
Go
65 lines
2.1 KiB
Go
/*
|
|
Copyright © contributors to CloudNativePG, established as
|
|
CloudNativePG a Series of LF Projects, LLC.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
|
|
SPDX-License-Identifier: Apache-2.0
|
|
*/
|
|
|
|
package specs
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/apimachinery/pkg/runtime"
|
|
"k8s.io/utils/ptr"
|
|
)
|
|
|
|
// SetControllerReference sets an owner reference on controlled
|
|
// pointing to owner, reading the GVK from the owner object's
|
|
// metadata rather than from a scheme. This is necessary because
|
|
// the operator does not know the CNPG API group at compile time
|
|
// (it may be customized), while the Cluster object decoded from
|
|
// the gRPC request carries the correct GVK in its TypeMeta.
|
|
//
|
|
// This function replaces all existing owner references rather than
|
|
// merging, so it assumes the controlled object has a single owner.
|
|
// This holds for plugin-managed Roles and RoleBindings, which are
|
|
// exclusively owned by one Cluster.
|
|
func SetControllerReference(owner, controlled metav1.Object) error {
|
|
ro, ok := owner.(runtime.Object)
|
|
if !ok {
|
|
return fmt.Errorf("%T is not a runtime.Object, cannot call SetControllerReference", owner)
|
|
}
|
|
|
|
gvk := ro.GetObjectKind().GroupVersionKind()
|
|
if gvk.Kind == "" {
|
|
return fmt.Errorf("%T has no GVK set in its metadata, cannot call SetControllerReference", owner)
|
|
}
|
|
|
|
controlled.SetOwnerReferences([]metav1.OwnerReference{
|
|
{
|
|
APIVersion: gvk.GroupVersion().String(),
|
|
Kind: gvk.Kind,
|
|
Name: owner.GetName(),
|
|
UID: owner.GetUID(),
|
|
BlockOwnerDeletion: ptr.To(true),
|
|
Controller: ptr.To(true),
|
|
},
|
|
})
|
|
|
|
return nil
|
|
}
|