Fix(helm): align ClusterRole with controller-gen and add AuthBridge SCC - #456
Conversation
Bobbins228
changed the title
f5b4d19 to
169bb93
Compare
ChristianZaccaria
left a comment
ChristianZaccaria
left a comment
There was a problem hiding this comment.
Great work Mark! - I left one requested change. After that, lgtm!
pdettori
left a comment
pdettori
left a comment
There was a problem hiding this comment.
Reviewed the RBAC alignment and AuthBridge SCC addition. The ClusterRole changes correctly match controller-gen output, the SCC template is well-structured (proper capability guard, minimal privileges, operator SA delegation pattern), and CI is all green.
The only blocking issue (missing endpoints rule) has already been identified by @ChristianZaccaria — the controller performs a Get on corev1.Endpoints at agentcard_networkpolicy_controller.go:346 but lacks a corresponding +kubebuilder:rbac marker, so controller-gen legitimately excludes it. The fix should add the marker and re-run make manifests to keep the Helm chart and kustomize output in sync.
Sync the Helm chart ClusterRole to exactly match controller-gen output. Remove unused endpoints rule, excess verbs on namespaces/services/ networks/roles, and merge configmaps+secrets and serviceaccounts+ services to match kustomize grouping. Add AuthBridge SCC template for OpenShift (guarded by Capabilities check), mirroring config/security/kagenti-authbridge-scc.yaml. Signed-off-by: Bobbins228 <mcampbel@redhat.com>
169bb93 to
8f2664c
Compare
|
@pdettori, @ChristianZaccaria updated the PR thanks for the reviews |
ChristianZaccaria
left a comment
ChristianZaccaria
left a comment
There was a problem hiding this comment.
/lgtm /approve
|
Related to #460 right? |
4 participants
Summary
The Helm chart's ClusterRole has drifted from the controller-gen output (
config/rbac/role.yaml), granting excess permissions. The RBAC markers in the Go source (+kubebuilder:rbac) are the single source of truth —make manifestsgeneratesconfig/rbac/role.yamlfrom them, but the Helm chart's copy is manually maintained with no sync step (unlike CRDs which havesync-chart-crds). This PR realigns them.Additionally, the AuthBridge SecurityContextConstraints — required for OpenShift deployments — exists in the kustomize path (
config/security/kagenti-authbridge-scc.yaml) but is missing from the Helm chart.Changes
ClusterRole alignment (
role.yaml)Rewrite the Helm chart ClusterRole to exactly match
config/rbac/role.yaml(verified viamake manifests+ diff). Specific fixes:endpointsrule — no+kubebuilder:rbacmarker exists for core endpoints in the codebaseupdatefrom namespaces — controller-gen only grantscreate/get/list/patch/watchpatch/watchfrom services — controller-gen only grantscreate/get/list/update/watchlistfromoperator.openshift.io/networks— controller-gen only grantsgetdeletefrom roles — onlyrolebindingsneedsdeleteconfigmaps+secretsinto one rule (same verbs, matches controller-gen)serviceaccounts+servicesinto one rule (same verbs, matches controller-gen)Also regenerates
config/rbac/role.yamlviamake manifeststo pick up controller-gen's latest normalisation (no permission changes, just grouping/ordering).AuthBridge SCC template (
authbridge-scc.yaml) — new fileAdds three resources for OpenShift, mirroring
config/security/kagenti-authbridge-scc.yaml:kagenti-authbridge) — least-privilege SCC allowing CSI volumes for SPIRE workload identitysystem:openshift:scc:kagenti-authbridge) — grantsuseverb scoped toresourceNames: ["kagenti-authbridge"]All three are guarded by
{{- if and .Values.rbac.enable (.Capabilities.APIVersions.Has "security.openshift.io/v1") }}so they only render on OpenShift.Test Plan
helm lint charts/kagenti-operator/passeshelm templatewithout--api-versions security.openshift.io/v1does not renderauthbridge-scc.yamlhelm template --api-versions security.openshift.io/v1renders SCC, ClusterRole, and ClusterRoleBindingdiff <(sed -n '/^rules:/,$p' config/rbac/role.yaml) <(sed -n '/^rules:/,$p' charts/.../role.yaml)produces no output