kubernetes-sigs / node-feature-discovery-operator

Operator for managing Node Feature Discovery deployment
Apache License 2.0
66 stars 29 forks source link

set permissions for the refactored controller #221

Closed chr15p closed 5 months ago

chr15p commented 5 months ago

This will set up the various service accounts, roles and rolebindings needed by the new (refactored) controller. These will all be applied at install (make deploy) time. For clarity the current manager setup (config/rbac/role.yaml and role_binding.yaml) are renamed, and each account is broken into its own set of files.

If applied before the new controller is made live the old controller will overwrite any changes here at reconcile time and continue to work (or at least will continue to be as broken as it is now...) so this PR can be applied safely without the refactor being completed.

k8s-ci-robot commented 5 months ago

Hi @chr15p. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
yevgeny-shnaidman commented 5 months ago

@chr15p WDYT about creating sub-directories (master, worker, prune etc') under config/rbac ? will make it a little bit clearer to understand which roles/sa relevant for which component

chr15p commented 5 months ago

I've moved the components into their own subdirectories of rbac, and the parts needed for the operator itself (manager and leader_election role/sa etc) into a core directory so hopefully its a little more obvious what files are used be what.

I have also removed the namePrefix: and hardcoded all the names to start with nfd- to be less confusing. Everything in my test setup is working and labels are being applied by the new controller and all the object names look good so I think I've caught all the name changes.

Lastly I've synced the clusterroles/roles with the helm charts.

chr15p commented 5 months ago

Squished the commits and reworded the commit message to cover all the changes.

k8s-ci-robot commented 5 months ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ArangoGutierrez, chr15p, marquiz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/kubernetes-sigs/node-feature-discovery-operator/blob/master/OWNERS)~~ [ArangoGutierrez,marquiz] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment