metal3-io / cluster-api-provider-metal3

Metal³ integration with https://github.com/kubernetes-sigs/cluster-api
Apache License 2.0
212 stars 96 forks source link

🌱 Redundant IP claims and related RBAC policies #2056

Open ksahil12 opened 1 month ago

ksahil12 commented 1 month ago

Removed RBAC rules are not being utilized by operator and hence can be cleaned up. It includes:

  1. ipclaims
  2. ipaddresses
  3. ipaddressclaims

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged): Fixes #

metal3-io-bot commented 1 month ago

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Once this PR has been reviewed and has the lgtm label, please assign tuminoid for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files: - **[OWNERS](https://github.com/metal3-io/cluster-api-provider-metal3/blob/main/OWNERS)** Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment
metal3-io-bot commented 1 month ago

Hi @ksahil12. Thanks for your PR.

I'm waiting for a metal3-io member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
tuminoid commented 1 month ago

/ok-to-test /test metal3-centos-e2e-integration-test-main

Please sign off the commit to pass DCO.

/cc @kashifest

Rozzii commented 1 month ago

/retest

metal3-io-bot commented 1 month ago

@ksahil12: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
generate 5fa1e8a8d8c4e25f3f2b1e9094c93fdf9e467551 link true /test generate

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
adilGhaffarDev commented 1 month ago

I don't think this is actually correct. These comments are not in the file that I would expect them to be but they are also no repeated elswhere. Simply deleting them won't be enough, I will look into this in a bit more detail.

@ksahil12 you have to run "make generate" after removing the comments, this will update rbacs in the config. However, I think this change will break CAPM3 because we need these rbacs for Metal3Data.

Rozzii commented 1 month ago

After looking into it a bit more, these are package level kubebuilder tags: https://book.kubebuilder.io/reference/markers/rbac.html . Functionally nothing would change if we would move these commands to a different file, and these tags are certainly not redundant this is the only place where they are listed.

This change would only make sense if the tags would be moved to an other .go file within the package where the IPAM related resources are actually accessed but even then it would be just a syntax change no functional change .

Also just by removing the kubebuilder tag commands without running "make generate" on the repo, the actual RBAC boilerplate code wouldn't be re-generated.