Skip to content

Commit 4ad2f43

Browse files
kahirokunnkahirokunn
committed
automate Helm chart RBAC sync from generated ClusterRoles
Signed-off-by: kahirokunn <okinakahiro@gmail.com>
1 parent 18736fa commit 4ad2f43

File tree

9 files changed

+763
-648
lines changed

9 files changed

+763
-648
lines changed

‎config/charts/knative-operator/templates/operator.yaml‎

Lines changed: 0 additions & 648 deletions
Large diffs are not rendered by default.

‎config/charts/knative-operator/templates/rbac/eventing-operator-role.yaml‎

Lines changed: 403 additions & 0 deletions
Large diffs are not rendered by default.

‎config/charts/knative-operator/templates/rbac/serving-operator-role.yaml‎

Lines changed: 267 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,267 @@
1+
# Code generated by hack/sync-helm-rbac.sh; DO NOT EDIT.
2+
# Copyright 2025 The Knative Authors
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
kind: ClusterRole
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
metadata:
19+
name: knative-serving-operator
20+
labels:
21+
app.kubernetes.io/version: '{{ .Chart.Version }}'
22+
app.kubernetes.io/name: knative-operator
23+
rules:
24+
- apiGroups:
25+
- operator.knative.dev
26+
resources:
27+
- '*'
28+
verbs:
29+
- '*'
30+
# Bootstrapping permissions.
31+
# Roles that are explicitly bound buch which are specified by this Operator
32+
# MUST be specified here with 'get' and 'bind'.
33+
- apiGroups:
34+
- rbac.authorization.k8s.io
35+
resources:
36+
- clusterroles
37+
resourceNames:
38+
- system:auth-delegator
39+
verbs:
40+
- bind
41+
- get
42+
- apiGroups:
43+
- rbac.authorization.k8s.io
44+
resources:
45+
- roles
46+
resourceNames:
47+
- extension-apiserver-authentication-reader
48+
verbs:
49+
- bind
50+
- get
51+
- apiGroups:
52+
- rbac.authorization.k8s.io
53+
resources:
54+
- clusterroles
55+
- roles
56+
verbs:
57+
- create
58+
- delete
59+
# Escalate is necessary in order to create a role using cluster role aggregation,
60+
# and to allow the Operator to bootstrap itself into the necessary set of
61+
# permissions, even as those continue to evolve upstream.
62+
- escalate
63+
- get
64+
- list
65+
- update
66+
- apiGroups:
67+
- rbac.authorization.k8s.io
68+
resources:
69+
- clusterrolebindings
70+
- rolebindings
71+
verbs:
72+
- create
73+
- delete
74+
- list
75+
- get
76+
- update
77+
# Permissions required for Knative controller
78+
# infra.
79+
- apiGroups:
80+
- apiregistration.k8s.io
81+
resources:
82+
- apiservices
83+
verbs:
84+
- update
85+
- apiGroups:
86+
- ""
87+
resources:
88+
- services
89+
verbs:
90+
- create
91+
- delete
92+
- get
93+
- list
94+
- watch
95+
- apiGroups:
96+
- caching.internal.knative.dev
97+
resources:
98+
- images
99+
verbs:
100+
- '*'
101+
- apiGroups:
102+
- ""
103+
resources:
104+
- namespaces
105+
verbs:
106+
- get
107+
- update
108+
- watch
109+
- apiGroups:
110+
- ''
111+
resources:
112+
- events
113+
verbs:
114+
- create
115+
- update
116+
- patch
117+
- apiGroups:
118+
- ''
119+
resources:
120+
- configmaps
121+
verbs:
122+
- create
123+
- delete
124+
- get
125+
- list
126+
- watch
127+
- apiGroups:
128+
- security.istio.io
129+
- apps
130+
- policy
131+
resources:
132+
- poddisruptionbudgets
133+
- peerauthentications
134+
- deployments
135+
- daemonsets
136+
- replicasets
137+
- statefulsets
138+
verbs:
139+
- create
140+
- delete
141+
- get
142+
- list
143+
- watch
144+
- update
145+
- apiGroups:
146+
- apiregistration.k8s.io
147+
resources:
148+
- apiservices
149+
verbs:
150+
- create
151+
- delete
152+
- get
153+
- list
154+
- apiGroups:
155+
- autoscaling
156+
resources:
157+
- horizontalpodautoscalers
158+
verbs:
159+
- create
160+
- delete
161+
- get
162+
- list
163+
- apiGroups:
164+
- coordination.k8s.io
165+
resources:
166+
- leases
167+
verbs:
168+
- '*'
169+
- apiGroups:
170+
- apiextensions.k8s.io
171+
resources:
172+
- customresourcedefinitions
173+
verbs:
174+
- '*'
175+
# Old resources that need cleaning up that are not in the knative-serving
176+
# namespace.
177+
- apiGroups:
178+
- ""
179+
resources:
180+
- services
181+
- deployments
182+
- horizontalpodautoscalers
183+
resourceNames:
184+
- knative-ingressgateway
185+
verbs:
186+
- delete
187+
- apiGroups:
188+
- ""
189+
resources:
190+
- configmaps
191+
resourceNames:
192+
- config-controller
193+
verbs:
194+
- delete
195+
- apiGroups:
196+
- ""
197+
resources:
198+
- serviceaccounts
199+
resourceNames:
200+
- knative-serving-operator
201+
verbs:
202+
- delete
203+
# for contour TLS
204+
- apiGroups:
205+
- projectcontour.io
206+
resources:
207+
- httpproxies
208+
- tlscertificatedelegations
209+
verbs:
210+
- get
211+
- list
212+
- watch
213+
- update
214+
- create
215+
- delete
216+
- deletecollection
217+
- patch
218+
# for security-guard
219+
- apiGroups:
220+
- guard.security.knative.dev
221+
resources:
222+
- guardians
223+
verbs:
224+
- get
225+
- list
226+
- watch
227+
- create
228+
- update
229+
- patch
230+
- delete
231+
- apiGroups:
232+
- ""
233+
resources:
234+
- configmaps
235+
verbs:
236+
- get
237+
- list
238+
- watch
239+
- create
240+
- update
241+
- patch
242+
- delete
243+
- apiGroups:
244+
- authentication.k8s.io
245+
resources:
246+
- tokenreviews
247+
verbs:
248+
- create
249+
- apiGroups:
250+
- ""
251+
resources:
252+
- pods
253+
verbs:
254+
- get
255+
# Copyright 2020 The Knative Authors
256+
#
257+
# Licensed under the Apache License, Version 2.0 (the "License");
258+
# you may not use this file except in compliance with the License.
259+
# You may obtain a copy of the License at
260+
#
261+
# https://www.apache.org/licenses/LICENSE-2.0
262+
#
263+
# Unless required by applicable law or agreed to in writing, software
264+
# distributed under the License is distributed on an "AS IS" BASIS,
265+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
266+
# See the License for the specific language governing permissions and
267+
# limitations under the License.

‎config/rbac/role.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -254,6 +254,20 @@ rules:
254254
verbs:
255255
- get
256256
---
257+
# Copyright 2020 The Knative Authors
258+
#
259+
# Licensed under the Apache License, Version 2.0 (the "License");
260+
# you may not use this file except in compliance with the License.
261+
# You may obtain a copy of the License at
262+
#
263+
# https://www.apache.org/licenses/LICENSE-2.0
264+
#
265+
# Unless required by applicable law or agreed to in writing, software
266+
# distributed under the License is distributed on an "AS IS" BASIS,
267+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
268+
# See the License for the specific language governing permissions and
269+
# limitations under the License.
270+
257271
kind: ClusterRole
258272
apiVersion: rbac.authorization.k8s.io/v1
259273
metadata:

‎hack/sync-helm-rbac.sh‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
#!/usr/bin/env bash
2+
3+
# Copyright 2025 The Knative Authors
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
# Syncs ClusterRole definitions from config/rbac/role.yaml to the Helm chart.
18+
# Replaces app.kubernetes.io/version: devel with "{{ .Chart.Version }}" for Helm.
19+
#
20+
# Usage: hack/sync-helm-rbac.sh
21+
22+
set -o errexit
23+
set -o nounset
24+
set -o pipefail
25+
26+
REPO_ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
27+
28+
ROLE_SRC="${REPO_ROOT_DIR}/config/rbac/role.yaml"
29+
HELM_RBAC_DIR="${REPO_ROOT_DIR}/config/charts/knative-operator/templates/rbac"
30+
BOILERPLATE_YAML="${REPO_ROOT_DIR}/hack/boilerplate/boilerplate.yaml.txt"
31+
32+
mkdir -p "${HELM_RBAC_DIR}"
33+
34+
# Ensure a recent mikefarah/yq.
35+
GOFLAGS=-mod=mod go install github.com/mikefarah/yq/v4@v4.52.5
36+
YQ_BIN_DIR="$(go env GOBIN)"
37+
YQ_BIN_DIR="${YQ_BIN_DIR:-$(go env GOPATH)/bin}"
38+
export PATH="${YQ_BIN_DIR}:$PATH"
39+
40+
echo "Syncing ClusterRoles from ${ROLE_SRC} to ${HELM_RBAC_DIR}"
41+
42+
write_clusterrole() {
43+
local name="$1"
44+
local target="$2"
45+
46+
echo " Processing ClusterRole ${name} -> rbac/$(basename "${target}")"
47+
48+
local tmp
49+
tmp="$(mktemp)"
50+
if ! yq eval "(select(.metadata.name == \"${name}\")) | .metadata.labels.\"app.kubernetes.io/version\" = \"{{ .Chart.Version }}\"" "${ROLE_SRC}" > "${tmp}"; then
51+
echo "ERROR: yq failed to extract ClusterRole ${name}"
52+
rm -f "${tmp}"
53+
exit 1
54+
fi
55+
56+
if ! grep -qE '^kind:[[:space:]]+ClusterRole' "${tmp}"; then
57+
echo "ERROR: no ClusterRole document found for ${name} in ${ROLE_SRC}"
58+
rm -f "${tmp}"
59+
exit 1
60+
fi
61+
62+
# Drop any leading comments from yq output so every chart template gets the same
63+
# Apache-2.0 header (eventing's ClusterRole in role.yaml may not preserve comments).
64+
{
65+
echo "# Code generated by hack/sync-helm-rbac.sh; DO NOT EDIT."
66+
cat "${BOILERPLATE_YAML}"
67+
awk '/^kind:/{p=1} p' "${tmp}"
68+
} > "${target}"
69+
rm -f "${tmp}"
70+
}
71+
72+
write_clusterrole "knative-serving-operator" "${HELM_RBAC_DIR}/serving-operator-role.yaml"
73+
write_clusterrole "knative-eventing-operator" "${HELM_RBAC_DIR}/eventing-operator-role.yaml"
74+
75+
echo "Done. RBAC synced to ${HELM_RBAC_DIR}"

‎hack/update-codegen.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,10 @@ group "Sync CRDs to Helm chart"
7070

7171
"${REPO_ROOT_DIR}/hack/sync-helm-crds.sh"
7272

73+
group "Sync RBAC to Helm chart"
74+
75+
"${REPO_ROOT_DIR}/hack/sync-helm-rbac.sh"
76+
7377
group "Update deps post-codegen"
7478

7579
# Make sure our dependencies are up-to-date

‎vendor/k8s.io/code-generator/generate-groups.sh‎

100755100644
File mode changed.

‎vendor/k8s.io/code-generator/generate-internal-groups.sh‎

100755100644
File mode changed.

‎vendor/knative.dev/pkg/hack/generate-knative.sh‎

100755100644
File mode changed.

0 commit comments

Comments
 (0)