mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-22 06:19:47 +08:00
Brandon Squizzato
99e83a535e
* feat(helm): scope ClusterRole/ClusterRoleBinding names by release namespace The chart creates cluster-scoped ClusterRole and ClusterRoleBinding resources with a fixed name derived from the release name. When multiple Helm releases coexist on the same cluster (multi-tenant), only one release can own these resources due to Helm ownership annotations -- the second install fails with a conflict. Append .Release.Namespace to the ClusterRole and ClusterRoleBinding names so each release gets its own cluster-scoped resources. The duplication is harmless (the rules are identical and small) and eliminates multi-tenant conflicts entirely without requiring external RBAC management. Signed-off-by: Brandon Squizzato <bsquizza@redhat.com> * test(helm): add regression tests for namespace-scoped ClusterRole names Assert the generated ClusterRole name, ClusterRoleBinding name, and roleRef all include the release namespace suffix so multi-namespace installations cannot silently regress to conflicting fixed names. Signed-off-by: Brandon Squizzato <bsquizza@redhat.com> --------- Signed-off-by: Brandon Squizzato <bsquizza@redhat.com>
131 lines
3.8 KiB
YAML
131 lines
3.8 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
suite: ClusterRole RBAC
|
|
templates:
|
|
- templates/clusterrole.yaml
|
|
release:
|
|
name: openshell
|
|
namespace: my-namespace
|
|
|
|
tests:
|
|
- it: includes the release namespace in the ClusterRole name
|
|
asserts:
|
|
- equal:
|
|
path: metadata.name
|
|
value: openshell-node-reader-my-namespace
|
|
|
|
- it: grants managed namespace NetworkPolicy apply permissions
|
|
set:
|
|
server.drivers.kubernetes.workspaceMode: managed
|
|
asserts:
|
|
- contains:
|
|
path: rules
|
|
content:
|
|
apiGroups: ["networking.k8s.io"]
|
|
resources: ["networkpolicies"]
|
|
verbs: ["get", "create", "patch", "update"]
|
|
|
|
- it: omits managed NetworkPolicy permissions when isolation is disabled
|
|
set:
|
|
server.drivers.kubernetes.workspaceMode: managed
|
|
networkPolicy.enabled: false
|
|
asserts:
|
|
- notContains:
|
|
path: rules
|
|
content:
|
|
apiGroups: ["networking.k8s.io"]
|
|
resources: ["networkpolicies"]
|
|
any: true
|
|
|
|
- it: grants broad secret access when credential driver is enabled (operator)
|
|
set:
|
|
server.drivers.kubernetes.workspaceMode: operator
|
|
server.credentialDrivers.kubernetesSecrets.enabled: true
|
|
asserts:
|
|
- contains:
|
|
path: rules
|
|
content:
|
|
apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "create", "patch", "delete"]
|
|
|
|
- it: restricts operator TLS sync to the configured secret
|
|
set:
|
|
server.drivers.kubernetes.workspaceMode: operator
|
|
server.tls.clientTlsSecretName: custom-client-tls
|
|
asserts:
|
|
- contains:
|
|
path: rules
|
|
content:
|
|
apiGroups: [""]
|
|
resources: ["secrets"]
|
|
resourceNames: ["custom-client-tls"]
|
|
verbs: ["get", "patch"]
|
|
|
|
- it: omits operator secret access when TLS and credential storage are disabled
|
|
set:
|
|
server.drivers.kubernetes.workspaceMode: operator
|
|
server.disableTls: true
|
|
asserts:
|
|
- notContains:
|
|
path: rules
|
|
content:
|
|
apiGroups: [""]
|
|
resources: ["secrets"]
|
|
any: true
|
|
|
|
- it: restricts managed copies to TLS and configured image-pull secrets
|
|
set:
|
|
server.drivers.kubernetes.workspaceMode: managed
|
|
server.tls.clientTlsSecretName: custom-client-tls
|
|
server.sandboxImagePullSecrets:
|
|
- name: registry-one
|
|
- name: registry-two
|
|
asserts:
|
|
- contains:
|
|
path: rules
|
|
content:
|
|
apiGroups: [""]
|
|
resources: ["secrets"]
|
|
resourceNames: ["custom-client-tls", "registry-one", "registry-two"]
|
|
verbs: ["get", "patch"]
|
|
- contains:
|
|
path: rules
|
|
content:
|
|
apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["create"]
|
|
|
|
- it: restricts managed copies to image-pull secrets when TLS is disabled
|
|
set:
|
|
server.drivers.kubernetes.workspaceMode: managed
|
|
server.disableTls: true
|
|
server.sandboxImagePullSecrets:
|
|
- name: registry-one
|
|
asserts:
|
|
- contains:
|
|
path: rules
|
|
content:
|
|
apiGroups: [""]
|
|
resources: ["secrets"]
|
|
resourceNames: ["registry-one"]
|
|
verbs: ["get", "patch"]
|
|
- contains:
|
|
path: rules
|
|
content:
|
|
apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["create"]
|
|
|
|
- it: omits secrets rule entirely in shared mode
|
|
set:
|
|
server.drivers.kubernetes.workspaceMode: shared
|
|
asserts:
|
|
- notContains:
|
|
path: rules
|
|
content:
|
|
apiGroups: [""]
|
|
resources: ["secrets"]
|
|
any: true
|