Skip to content

Commit 4d56305

Browse files
tbaveliertbavelier
committed
PoC constructor coverage refactor
1 parent f09c127 commit 4d56305

7 files changed

Lines changed: 265 additions & 153 deletions

File tree

‎internal/controller/datadogagent/component/agent/rbac.go‎

Lines changed: 48 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,49 @@ import (
1414

1515
// RBAC for Agent
1616

17+
var (
18+
agentMetricsEndpointPolicyRule = rbacv1.PolicyRule{
19+
NonResourceURLs: []string{
20+
rbac.MetricsURL,
21+
rbac.MetricsSLIsURL,
22+
},
23+
Verbs: []string{rbac.GetVerb},
24+
}
25+
agentFineGrainedKubeletPolicyRule = rbacv1.PolicyRule{
26+
APIGroups: []string{rbac.CoreAPIGroup},
27+
Resources: []string{
28+
rbac.NodeMetricsResource,
29+
rbac.NodeSpecResource,
30+
rbac.NodeStats,
31+
rbac.NodePodsResource,
32+
rbac.NodeHealthzResource,
33+
rbac.NodeConfigzResource,
34+
rbac.NodeLogsResource,
35+
},
36+
Verbs: []string{rbac.GetVerb},
37+
}
38+
agentKubeletPolicyRule = rbacv1.PolicyRule{
39+
APIGroups: []string{rbac.CoreAPIGroup},
40+
Resources: []string{
41+
rbac.NodeMetricsResource,
42+
rbac.NodeSpecResource,
43+
rbac.NodeProxyResource,
44+
rbac.NodeStats,
45+
},
46+
Verbs: []string{rbac.GetVerb},
47+
}
48+
agentEndpointPolicyRule = rbacv1.PolicyRule{
49+
APIGroups: []string{rbac.CoreAPIGroup},
50+
Resources: []string{rbac.EndpointsResource},
51+
Verbs: []string{rbac.GetVerb},
52+
}
53+
agentLeaderElectionPolicyRule = rbacv1.PolicyRule{
54+
APIGroups: []string{rbac.CoordinationAPIGroup},
55+
Resources: []string{rbac.LeasesResource},
56+
Verbs: []string{rbac.GetVerb},
57+
}
58+
)
59+
1760
// GetDefaultAgentClusterRolePolicyRules returns the default policy rules for the Agent cluster role
1861
func GetDefaultAgentClusterRolePolicyRules(excludeNonResourceRules bool, useFineGrainedAuthorization bool) []rbacv1.PolicyRule {
1962
policyRule := []rbacv1.PolicyRule{
@@ -31,55 +74,21 @@ func GetDefaultAgentClusterRolePolicyRules(excludeNonResourceRules bool, useFine
3174
}
3275

3376
func getMetricsEndpointPolicyRule() rbacv1.PolicyRule {
34-
return rbacv1.PolicyRule{
35-
NonResourceURLs: []string{
36-
rbac.MetricsURL,
37-
rbac.MetricsSLIsURL,
38-
},
39-
Verbs: []string{rbac.GetVerb},
40-
}
77+
return rbac.ClonePolicyRule(agentMetricsEndpointPolicyRule)
4178
}
4279

4380
func getKubeletPolicyRule(useFineGrainedAuthorization bool) rbacv1.PolicyRule {
44-
var resources []string
4581
if useFineGrainedAuthorization {
46-
resources = []string{
47-
rbac.NodeMetricsResource,
48-
rbac.NodeSpecResource,
49-
rbac.NodeStats,
50-
rbac.NodePodsResource,
51-
rbac.NodeHealthzResource,
52-
rbac.NodeConfigzResource,
53-
rbac.NodeLogsResource,
54-
}
55-
} else {
56-
resources = []string{
57-
rbac.NodeMetricsResource,
58-
rbac.NodeSpecResource,
59-
rbac.NodeProxyResource,
60-
rbac.NodeStats,
61-
}
82+
return rbac.ClonePolicyRule(agentFineGrainedKubeletPolicyRule)
6283
}
6384

64-
return rbacv1.PolicyRule{
65-
APIGroups: []string{rbac.CoreAPIGroup},
66-
Resources: resources,
67-
Verbs: []string{rbac.GetVerb},
68-
}
85+
return rbac.ClonePolicyRule(agentKubeletPolicyRule)
6986
}
7087

7188
func getEndpointsPolicyRule() rbacv1.PolicyRule {
72-
return rbacv1.PolicyRule{
73-
APIGroups: []string{rbac.CoreAPIGroup},
74-
Resources: []string{rbac.EndpointsResource},
75-
Verbs: []string{rbac.GetVerb},
76-
}
89+
return rbac.ClonePolicyRule(agentEndpointPolicyRule)
7790
}
7891

7992
func getLeaderElectionPolicyRule() rbacv1.PolicyRule {
80-
return rbacv1.PolicyRule{
81-
APIGroups: []string{rbac.CoordinationAPIGroup},
82-
Resources: []string{rbac.LeasesResource},
83-
Verbs: []string{rbac.GetVerb},
84-
}
93+
return rbac.ClonePolicyRule(agentLeaderElectionPolicyRule)
8594
}

‎internal/controller/datadogagent/component/clusterchecksrunner/rbac.go‎

Lines changed: 37 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,8 @@ import (
1717

1818
// RBAC for Cluster Checks Runner
1919

20-
// GetDefaultClusterChecksRunnerClusterRolePolicyRules returns the default Cluster Role Policy Rules for the Cluster Checks Runner
21-
func GetDefaultClusterChecksRunnerClusterRolePolicyRules(dda metav1.Object, excludeNonResourceRules bool) []rbacv1.PolicyRule {
22-
policyRule := []rbacv1.PolicyRule{
20+
var (
21+
clusterChecksRunnerClusterRolePolicyRulesBeforeLeaderElection = []rbacv1.PolicyRule{
2322
{
2423
APIGroups: []string{rbac.CoreAPIGroup},
2524
Resources: []string{
@@ -47,19 +46,9 @@ func GetDefaultClusterChecksRunnerClusterRolePolicyRules(dda metav1.Object, excl
4746
rbac.CreateVerb,
4847
},
4948
},
50-
{
51-
APIGroups: []string{rbac.CoreAPIGroup},
52-
Resources: []string{
53-
rbac.ConfigMapsResource,
54-
},
55-
ResourceNames: []string{
56-
utils.GetDatadogLeaderElectionResourceName(dda),
57-
},
58-
Verbs: []string{
59-
rbac.GetVerb,
60-
rbac.UpdateVerb,
61-
},
62-
},
49+
}
50+
51+
clusterChecksRunnerClusterRolePolicyRulesAfterLeaderElection = []rbacv1.PolicyRule{
6352
{
6453
APIGroups: []string{rbac.OpenShiftQuotaAPIGroup},
6554
Resources: []string{
@@ -118,15 +107,40 @@ func GetDefaultClusterChecksRunnerClusterRolePolicyRules(dda metav1.Object, excl
118107
component.GetEKSControlPlaneMetricsPolicyRule(),
119108
}
120109

110+
clusterChecksRunnerMetricsEndpointPolicyRule = rbacv1.PolicyRule{
111+
NonResourceURLs: []string{
112+
rbac.MetricsURL,
113+
rbac.MetricsSLIsURL,
114+
},
115+
Verbs: []string{rbac.GetVerb},
116+
}
117+
)
118+
119+
// GetDefaultClusterChecksRunnerClusterRolePolicyRules returns the default Cluster Role Policy Rules for the Cluster Checks Runner.
120+
func GetDefaultClusterChecksRunnerClusterRolePolicyRules(dda metav1.Object, excludeNonResourceRules bool) []rbacv1.PolicyRule {
121+
policyRule := rbac.ClonePolicyRules(clusterChecksRunnerClusterRolePolicyRulesBeforeLeaderElection)
122+
policyRule = append(policyRule, clusterChecksRunnerLeaderElectionPolicyRule(dda))
123+
policyRule = append(policyRule, rbac.ClonePolicyRules(clusterChecksRunnerClusterRolePolicyRulesAfterLeaderElection)...)
124+
121125
if !excludeNonResourceRules {
122-
policyRule = append(policyRule, rbacv1.PolicyRule{
123-
NonResourceURLs: []string{
124-
rbac.MetricsURL,
125-
rbac.MetricsSLIsURL,
126-
},
127-
Verbs: []string{rbac.GetVerb},
128-
})
126+
policyRule = append(policyRule, rbac.ClonePolicyRule(clusterChecksRunnerMetricsEndpointPolicyRule))
129127
}
130128

131129
return policyRule
132130
}
131+
132+
func clusterChecksRunnerLeaderElectionPolicyRule(dda metav1.Object) rbacv1.PolicyRule {
133+
return rbacv1.PolicyRule{
134+
APIGroups: []string{rbac.CoreAPIGroup},
135+
Resources: []string{
136+
rbac.ConfigMapsResource,
137+
},
138+
ResourceNames: []string{
139+
utils.GetDatadogLeaderElectionResourceName(dda),
140+
},
141+
Verbs: []string{
142+
rbac.GetVerb,
143+
rbac.UpdateVerb,
144+
},
145+
}
146+
}

‎internal/controller/datadogagent/component/otelagentgateway/rbac.go‎

Lines changed: 27 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -14,34 +14,34 @@ import (
1414

1515
// RBAC for OTel Agent Gateway
1616

17-
// GetDefaultOtelAgentGatewayClusterRolePolicyRules returns the default Cluster Role Policy Rules for the OTel Agent Gateway
18-
// These rules support the k8sattributes processor for enriching telemetry with Kubernetes metadata
19-
func GetDefaultOtelAgentGatewayClusterRolePolicyRules(dda metav1.Object, excludeNonResourceRules bool) []rbacv1.PolicyRule {
20-
policyRule := []rbacv1.PolicyRule{
21-
{
22-
APIGroups: []string{rbac.CoreAPIGroup},
23-
Resources: []string{
24-
rbac.PodsResource,
25-
rbac.NamespaceResource,
26-
},
27-
Verbs: []string{
28-
rbac.GetVerb,
29-
rbac.WatchVerb,
30-
rbac.ListVerb,
31-
},
17+
var defaultOtelAgentGatewayClusterRolePolicyRules = []rbacv1.PolicyRule{
18+
{
19+
APIGroups: []string{rbac.CoreAPIGroup},
20+
Resources: []string{
21+
rbac.PodsResource,
22+
rbac.NamespaceResource,
3223
},
33-
{
34-
APIGroups: []string{rbac.AppsAPIGroup},
35-
Resources: []string{
36-
rbac.ReplicasetsResource,
37-
},
38-
Verbs: []string{
39-
rbac.GetVerb,
40-
rbac.ListVerb,
41-
rbac.WatchVerb,
42-
},
24+
Verbs: []string{
25+
rbac.GetVerb,
26+
rbac.WatchVerb,
27+
rbac.ListVerb,
4328
},
44-
}
29+
},
30+
{
31+
APIGroups: []string{rbac.AppsAPIGroup},
32+
Resources: []string{
33+
rbac.ReplicasetsResource,
34+
},
35+
Verbs: []string{
36+
rbac.GetVerb,
37+
rbac.ListVerb,
38+
rbac.WatchVerb,
39+
},
40+
},
41+
}
4542

46-
return policyRule
43+
// GetDefaultOtelAgentGatewayClusterRolePolicyRules returns the default Cluster Role Policy Rules for the OTel Agent Gateway.
44+
// These rules support the k8sattributes processor for enriching telemetry with Kubernetes metadata.
45+
func GetDefaultOtelAgentGatewayClusterRolePolicyRules(_ metav1.Object, _ bool) []rbacv1.PolicyRule {
46+
return rbac.ClonePolicyRules(defaultOtelAgentGatewayClusterRolePolicyRules)
4747
}

0 commit comments

Comments
 (0)