Skip to content

Commit 4cf7496

Browse files
ThomasK33ThomasK33
committed
fix: preserve explicit false for RBAC flags
1 parent b395b6e commit 4cf7496

6 files changed

Lines changed: 76 additions & 32 deletions

File tree

‎api/v1alpha1/types_shared.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,11 +48,13 @@ type ServiceAccountSpec struct {
4848
// RBACSpec configures namespace-scoped RBAC for workspace provisioning.
4949
type RBACSpec struct {
5050
// WorkspacePerms enables Role/RoleBinding creation for workspace resources.
51+
// When omitted, the default is true.
5152
// +kubebuilder:default=true
52-
WorkspacePerms bool `json:"workspacePerms,omitempty"`
53+
WorkspacePerms *bool `json:"workspacePerms,omitempty"`
5354
// EnableDeployments grants apps/deployments permissions (only when WorkspacePerms is true).
55+
// When omitted, the default is true.
5456
// +kubebuilder:default=true
55-
EnableDeployments bool `json:"enableDeployments,omitempty"`
57+
EnableDeployments *bool `json:"enableDeployments,omitempty"`
5658
// ExtraRules are appended to the managed Role rules.
5759
ExtraRules []rbacv1.PolicyRule `json:"extraRules,omitempty"`
5860
// WorkspaceNamespaces lists additional namespaces for Role/RoleBinding creation.

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 10 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/coder.com_codercontrolplanes.yaml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1601,8 +1601,9 @@ spec:
16011601
properties:
16021602
enableDeployments:
16031603
default: true
1604-
description: EnableDeployments grants apps/deployments permissions
1605-
(only when WorkspacePerms is true).
1604+
description: |-
1605+
EnableDeployments grants apps/deployments permissions (only when WorkspacePerms is true).
1606+
When omitted, the default is true.
16061607
type: boolean
16071608
extraRules:
16081609
description: ExtraRules are appended to the managed Role rules.
@@ -1663,8 +1664,9 @@ spec:
16631664
type: array
16641665
workspacePerms:
16651666
default: true
1666-
description: WorkspacePerms enables Role/RoleBinding creation
1667-
for workspace resources.
1667+
description: |-
1668+
WorkspacePerms enables Role/RoleBinding creation for workspace resources.
1669+
When omitted, the default is true.
16681670
type: boolean
16691671
type: object
16701672
readinessProbe:

‎docs/reference/api/codercontrolplane.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -156,8 +156,8 @@ RBACSpec configures namespace-scoped RBAC for workspace provisioning.
156156

157157
| Field | Type | Description |
158158
| --- | --- | --- |
159-
| `workspacePerms` | boolean | WorkspacePerms enables Role/RoleBinding creation for workspace resources. |
160-
| `enableDeployments` | boolean | EnableDeployments grants apps/deployments permissions (only when WorkspacePerms is true). |
159+
| `workspacePerms` | boolean | WorkspacePerms enables Role/RoleBinding creation for workspace resources. When omitted, the default is true. |
160+
| `enableDeployments` | boolean | EnableDeployments grants apps/deployments permissions (only when WorkspacePerms is true). When omitted, the default is true. |
161161
| `extraRules` | [PolicyRule](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#policyrule-v1-rbac) array | ExtraRules are appended to the managed Role rules. |
162162
| `workspaceNamespaces` | string array | WorkspaceNamespaces lists additional namespaces for Role/RoleBinding creation. |
163163

‎internal/controller/codercontrolplane_controller.go‎

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -294,6 +294,22 @@ func resolveServiceAccountName(cp *coderv1alpha1.CoderControlPlane) string {
294294
return cp.Name
295295
}
296296

297+
func boolOrDefault(explicit *bool, defaultValue bool) bool {
298+
if explicit == nil {
299+
return defaultValue
300+
}
301+
302+
return *explicit
303+
}
304+
305+
func workspacePermsEnabled(explicit *bool) bool {
306+
return boolOrDefault(explicit, true)
307+
}
308+
309+
func workspaceDeploymentsEnabled(explicit *bool) bool {
310+
return boolOrDefault(explicit, true)
311+
}
312+
297313
func controlPlaneTLSEnabled(cp *coderv1alpha1.CoderControlPlane) bool {
298314
if cp == nil {
299315
return false
@@ -302,7 +318,7 @@ func controlPlaneTLSEnabled(cp *coderv1alpha1.CoderControlPlane) bool {
302318
}
303319

304320
func requiresWorkspaceRBACDriftRequeue(cp *coderv1alpha1.CoderControlPlane) bool {
305-
if cp == nil || !cp.Spec.RBAC.WorkspacePerms {
321+
if cp == nil || !workspacePermsEnabled(cp.Spec.RBAC.WorkspacePerms) {
306322
return false
307323
}
308324

@@ -559,7 +575,7 @@ func (r *CoderControlPlaneReconciler) reconcileWorkspaceRBAC(ctx context.Context
559575
roleName := fmt.Sprintf("%s-workspace-perms", serviceAccountName)
560576
roleBindingName := serviceAccountName
561577

562-
if !coderControlPlane.Spec.RBAC.WorkspacePerms {
578+
if !workspacePermsEnabled(coderControlPlane.Spec.RBAC.WorkspacePerms) {
563579
return r.cleanupManagedWorkspaceRBAC(ctx, coderControlPlane, nil, nil)
564580
}
565581

@@ -575,7 +591,7 @@ func (r *CoderControlPlaneReconciler) reconcileWorkspaceRBAC(ctx context.Context
575591
Verbs: []string{"get", "list", "watch", "create", "update", "patch", "delete", "deletecollection"},
576592
},
577593
}
578-
if coderControlPlane.Spec.RBAC.EnableDeployments {
594+
if workspaceDeploymentsEnabled(coderControlPlane.Spec.RBAC.EnableDeployments) {
579595
rules = append(rules, rbacv1.PolicyRule{
580596
APIGroups: []string{"apps"},
581597
Resources: []string{"deployments"},
@@ -722,11 +738,7 @@ func (r *CoderControlPlaneReconciler) cleanupManagedWorkspaceRBAC(
722738
}
723739

724740
func probeEnabled(explicit *bool, defaultEnabled bool) bool {
725-
if explicit == nil {
726-
return defaultEnabled
727-
}
728-
729-
return *explicit
741+
return boolOrDefault(explicit, defaultEnabled)
730742
}
731743

732744
func buildProbe(spec coderv1alpha1.ProbeSpec, path, portName string) *corev1.Probe {

‎internal/controller/codercontrolplane_controller_test.go‎

Lines changed: 34 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2320,8 +2320,8 @@ func TestReconcile_WorkspaceRBAC(t *testing.T) {
23202320
Name: "test-workspace-rbac-default-sa",
23212321
},
23222322
RBAC: coderv1alpha1.RBACSpec{
2323-
WorkspacePerms: true,
2324-
EnableDeployments: true,
2323+
WorkspacePerms: ptrTo(true),
2324+
EnableDeployments: ptrTo(true),
23252325
},
23262326
},
23272327
}
@@ -2370,15 +2370,24 @@ func TestReconcile_WorkspaceRBAC(t *testing.T) {
23702370
})
23712371

23722372
t.Run("DeploymentsRuleDisabled", func(t *testing.T) {
2373-
cp := createCoderControlPlaneUnstructured(ctx, t, "test-workspace-rbac-no-deployments", "default", map[string]any{
2374-
"image": "test-workspace-rbac:latest",
2375-
"serviceAccount": map[string]any{
2376-
"name": "test-workspace-rbac-no-deployments-sa",
2377-
},
2378-
"rbac": map[string]any{
2379-
"workspacePerms": true,
2380-
"enableDeployments": false,
2373+
cp := &coderv1alpha1.CoderControlPlane{
2374+
ObjectMeta: metav1.ObjectMeta{Name: "test-workspace-rbac-no-deployments", Namespace: "default"},
2375+
Spec: coderv1alpha1.CoderControlPlaneSpec{
2376+
Image: "test-workspace-rbac:latest",
2377+
ServiceAccount: coderv1alpha1.ServiceAccountSpec{
2378+
Name: "test-workspace-rbac-no-deployments-sa",
2379+
},
2380+
RBAC: coderv1alpha1.RBACSpec{
2381+
WorkspacePerms: ptrTo(true),
2382+
EnableDeployments: ptrTo(false),
2383+
},
23812384
},
2385+
}
2386+
if err := k8sClient.Create(ctx, cp); err != nil {
2387+
t.Fatalf("create control plane: %v", err)
2388+
}
2389+
t.Cleanup(func() {
2390+
_ = k8sClient.Delete(ctx, cp)
23822391
})
23832392

23842393
r := &controller.CoderControlPlaneReconciler{Client: k8sClient, Scheme: scheme}
@@ -2397,11 +2406,20 @@ func TestReconcile_WorkspaceRBAC(t *testing.T) {
23972406
})
23982407

23992408
t.Run("RBACDisabled", func(t *testing.T) {
2400-
cp := createCoderControlPlaneUnstructured(ctx, t, "test-workspace-rbac-disabled", "default", map[string]any{
2401-
"image": "test-workspace-rbac:latest",
2402-
"rbac": map[string]any{
2403-
"workspacePerms": false,
2409+
cp := &coderv1alpha1.CoderControlPlane{
2410+
ObjectMeta: metav1.ObjectMeta{Name: "test-workspace-rbac-disabled", Namespace: "default"},
2411+
Spec: coderv1alpha1.CoderControlPlaneSpec{
2412+
Image: "test-workspace-rbac:latest",
2413+
RBAC: coderv1alpha1.RBACSpec{
2414+
WorkspacePerms: ptrTo(false),
2415+
},
24042416
},
2417+
}
2418+
if err := k8sClient.Create(ctx, cp); err != nil {
2419+
t.Fatalf("create control plane: %v", err)
2420+
}
2421+
t.Cleanup(func() {
2422+
_ = k8sClient.Delete(ctx, cp)
24052423
})
24062424

24072425
r := &controller.CoderControlPlaneReconciler{Client: k8sClient, Scheme: scheme}
@@ -2667,8 +2685,8 @@ func TestReconcile_WorkspaceRBAC(t *testing.T) {
26672685
Name: "test-workspace-rbac-extra-rules-sa",
26682686
},
26692687
RBAC: coderv1alpha1.RBACSpec{
2670-
WorkspacePerms: true,
2671-
EnableDeployments: true,
2688+
WorkspacePerms: ptrTo(true),
2689+
EnableDeployments: ptrTo(true),
26722690
ExtraRules: []rbacv1.PolicyRule{extraRule},
26732691
},
26742692
},

0 commit comments

Comments
 (0)