mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-20 06:00:06 +08:00
ansjindal
d009f30121
The gateway chart always rendered the ClusterRole and ClusterRoleBinding, so
every install and upgrade required cluster-admin even when only namespaced
objects were needed. Installers that are namespace-admin GitOps or platform
controllers could not run the release at all, and clusters where cluster-scoped
RBAC is owned by a separate team had no supported way to split the install.
Add an rbac values block so a cluster-admin can apply the cluster-scoped objects
once and a namespace-admin can install and upgrade the release without
cluster-scoped permissions:
rbac:
create: true
clusterScoped:
create: true
clusterRoleName: ""
clusterRoleBindingName: ""
rbac.clusterScoped.create gates the ClusterRole and ClusterRoleBinding, and is
independent of the workspace mode. rbac.create additionally gates the namespaced
sandbox Role and RoleBinding, which matters because Kubernetes escalation
prevention stops an installer holding only the built-in admin role from creating
a Role that grants agents.x-k8s.io verbs it does not itself hold. The certgen
hook and credential driver RBAC keep their existing flags.
Both flags default to true, so current installs are unchanged. The helpers treat
a missing rbac block as enabled so upgrades with --reuse-values do not drop RBAC,
matching the existing workspaceResources pattern. The ClusterRoleBinding roleRef
follows clusterRoleName so a separately applied ClusterRole can carry a name the
cluster-admin chooses.
Document the migration for a release that already owns the cluster-scoped
objects: Helm deletes objects that leave the manifest, so annotate them with
helm.sh/resource-policy=keep before setting the flag, otherwise the gateway
loses TokenReview until a cluster-admin re-applies them.
Signed-off-by: ansjindal <ansjindal@nvidia.com>
77 lines
2.1 KiB
YAML
77 lines
2.1 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
suite: ClusterRoleBinding RBAC
|
|
templates:
|
|
- templates/clusterrolebinding.yaml
|
|
release:
|
|
name: openshell
|
|
namespace: my-namespace
|
|
|
|
tests:
|
|
- it: includes the release namespace in the ClusterRoleBinding name
|
|
asserts:
|
|
- equal:
|
|
path: metadata.name
|
|
value: openshell-node-reader-my-namespace
|
|
|
|
- it: references the namespace-scoped ClusterRole in roleRef
|
|
asserts:
|
|
- equal:
|
|
path: roleRef.name
|
|
value: openshell-node-reader-my-namespace
|
|
|
|
- it: binds the service account in the release namespace
|
|
asserts:
|
|
- contains:
|
|
path: subjects
|
|
content:
|
|
kind: ServiceAccount
|
|
name: openshell
|
|
namespace: my-namespace
|
|
|
|
- it: omits the ClusterRoleBinding when cluster-scoped RBAC is disabled
|
|
set:
|
|
rbac.clusterScoped.create: false
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 0
|
|
|
|
- it: omits the ClusterRoleBinding when all chart-managed RBAC is disabled
|
|
set:
|
|
rbac.create: false
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 0
|
|
|
|
- it: uses the configured ClusterRoleBinding and ClusterRole names
|
|
set:
|
|
rbac.clusterScoped.clusterRoleName: platform-openshell-node-reader
|
|
rbac.clusterScoped.clusterRoleBindingName: platform-openshell-node-reader-binding
|
|
asserts:
|
|
- equal:
|
|
path: metadata.name
|
|
value: platform-openshell-node-reader-binding
|
|
- equal:
|
|
path: roleRef.name
|
|
value: platform-openshell-node-reader
|
|
|
|
- it: binds the custom gateway service account created by the namespaced release
|
|
set:
|
|
serviceAccount.create: false
|
|
serviceAccount.name: my-existing-sa
|
|
asserts:
|
|
- contains:
|
|
path: subjects
|
|
content:
|
|
kind: ServiceAccount
|
|
name: my-existing-sa
|
|
namespace: my-namespace
|
|
|
|
- it: creates the ClusterRoleBinding when legacy values omit the rbac block
|
|
set:
|
|
rbac: null
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 1
|