Implemented permission checker

Author: owais

cmd/operator-opamp-bridge/internal/standalone/client.go

@@ -183,6 +183,61 @@ func eventObject(obj any) client.Object {
 	return object
 }
 
+func (c *Client) checkPermissions(ctx context.Context, agents []config.StandaloneAgentConfig, remoteConfigEnabled bool) error {
+	perms := []permission{}
+	for _, rule := range []struct {
+		apiGroup string
+		resource string
+	}{
+		{resource: "configmaps"},
+		{apiGroup: "apps", resource: "deployments"},
+		{apiGroup: "apps", resource: "daemonsets"},
+		{apiGroup: "apps", resource: "statefulsets"},
+	} {
+		for _, verb := range []string{"list", "watch"} {
+			perms = append(perms, permission{verb: verb, apiGroup: rule.apiGroup, resource: rule.resource})
+		}
+	}
+
+	for _, agent := range agents {
+		workloadResource, err := standaloneWorkloadResource(agent.WorkloadType)
+		if err != nil {
+			return err
+		}
+		perms = append(perms, permission{verb: "get", apiGroup: "apps", resource: workloadResource, namespace: agent.Namespace, name: agent.WorkloadName})
+		if remoteConfigEnabled {
+			perms = append(perms, permission{verb: "update", apiGroup: "apps", resource: workloadResource, namespace: agent.Namespace, name: agent.WorkloadName})
+		}
+		for _, entry := range agent.Config {
+			if !strings.EqualFold(entry.Kind, standaloneConfigMapKind) {
+				continue
+			}
+			perms = append(perms, permission{verb: "get", resource: "configmaps", namespace: agent.Namespace, name: entry.Name})
+			if remoteConfigEnabled {
+				perms = append(perms, permission{verb: "update", resource: "configmaps", namespace: agent.Namespace, name: entry.Name})
+			}
+		}
+	}
+
+	if err := newPermissionsChecker(c.k8sClient).Check(ctx, perms); err != nil {
+		return fmt.Errorf("standalone permission check failed: %w", err)
+	}
+	return nil
+}
+
+func standaloneWorkloadResource(workloadType string) (string, error) {
+	switch strings.ToLower(workloadType) {
+	case "deployment":
+		return "deployments", nil
+	case "daemonset":
+		return "daemonsets", nil
+	case "statefulset":
+		return "statefulsets", nil
+	default:
+		return "", fmt.Errorf("unsupported workload type %q", workloadType)
+	}
+}
+
 func (c *Client) getConfigMapFile(namespace string, entry config.StandaloneConfigEntry) ([]byte, error) {
 	cm := &v1.ConfigMap{}
 	if err := c.k8sClient.Get(context.Background(), client.ObjectKey{Name: entry.Name, Namespace: namespace}, cm); err != nil {

cmd/operator-opamp-bridge/internal/standalone/client_test.go

@@ -15,12 +15,14 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	appsv1 "k8s.io/api/apps/v1"
+	authorizationv1 "k8s.io/api/authorization/v1"
 	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
 
 	"github.com/open-telemetry/opentelemetry-operator/cmd/operator-opamp-bridge/internal/config"
 	"github.com/open-telemetry/opentelemetry-operator/cmd/operator-opamp-bridge/internal/operator"
@@ -45,13 +47,37 @@ func getFakeK8sClient(t *testing.T, objs ...client.Object) client.Client {
 	scheme := runtime.NewScheme()
 	require.NoError(t, v1.AddToScheme(scheme))
 	require.NoError(t, appsv1.AddToScheme(scheme))
+	require.NoError(t, authorizationv1.AddToScheme(scheme))
 	builder := fake.NewClientBuilder().WithScheme(scheme)
 	for _, obj := range objs {
 		builder = builder.WithObjects(obj)
 	}
 	return builder.Build()
 }
 
+func getPermissionReviewClient(t *testing.T, allowed func(authorizationv1.ResourceAttributes) bool) client.Client {
+	scheme := runtime.NewScheme()
+	require.NoError(t, v1.AddToScheme(scheme))
+	require.NoError(t, appsv1.AddToScheme(scheme))
+	require.NoError(t, authorizationv1.AddToScheme(scheme))
+	return fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithInterceptorFuncs(interceptor.Funcs{
+			Create: func(ctx context.Context, c client.WithWatch, obj client.Object, opts ...client.CreateOption) error {
+				review, ok := obj.(*authorizationv1.SelfSubjectAccessReview)
+				if !ok {
+					return c.Create(ctx, obj, opts...)
+				}
+				review.Status.Allowed = allowed(*review.Spec.ResourceAttributes)
+				if !review.Status.Allowed {
+					review.Status.Reason = "denied by test"
+				}
+				return nil
+			},
+		}).
+		Build()
+}
+
 func testConfigMap() *v1.ConfigMap {
 	return &v1.ConfigMap{
 		ObjectMeta: metav1.ObjectMeta{
@@ -284,6 +310,45 @@ func TestClientNotifyWorkloadHealthUpdate(t *testing.T) {
 	assert.True(t, called)
 }
 
+func TestClientCheckPermissionsAllowsConfiguredStandaloneResources(t *testing.T) {
+	c := newTestClient(getPermissionReviewClient(t, func(_ authorizationv1.ResourceAttributes) bool {
+		return true
+	}))
+
+	err := c.checkPermissions(context.Background(), []config.StandaloneAgentConfig{testAgentConfig()}, true)
+
+	require.NoError(t, err)
+}
+
+func TestClientCheckPermissionsRejectsMissingConfiguredResourcePermission(t *testing.T) {
+	c := newTestClient(getPermissionReviewClient(t, func(attrs authorizationv1.ResourceAttributes) bool {
+		return attrs.Verb != "update" || attrs.Resource != "deployments" || attrs.Name != "standalone-collector"
+	}))
+
+	err := c.checkPermissions(context.Background(), []config.StandaloneAgentConfig{testAgentConfig()}, true)
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "standalone permission check failed")
+	assert.Contains(t, err.Error(), "missing update permission for apps/deployments default/standalone-collector")
+}
+
+func TestPermissionsCheckerRejectsDeniedPermission(t *testing.T) {
+	checker := newPermissionsChecker(getPermissionReviewClient(t, func(_ authorizationv1.ResourceAttributes) bool {
+		return false
+	}))
+
+	err := checker.Check(context.Background(), []permission{{
+		verb:      "update",
+		apiGroup:  "apps",
+		resource:  "deployments",
+		namespace: "default",
+		name:      "standalone-collector",
+	}})
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "missing update permission for apps/deployments default/standalone-collector")
+}
+
 func TestScopedApplierApplyUpdatesConfiguredConfigMapKeyAndRestartsWorkload(t *testing.T) {
 	cm := testConfigMap()
 	deploy := testDeployment()

cmd/operator-opamp-bridge/internal/standalone/configmap_instance.go

@@ -30,7 +30,7 @@ func (p *standaloneCollectorInstance) GetNamespace() string {
 	return p.namespace
 }
 
-func (p *standaloneCollectorInstance) GetDeletionTimestamp() *metav1.Time {
+func (*standaloneCollectorInstance) GetDeletionTimestamp() *metav1.Time {
 	return nil
 }
 

cmd/operator-opamp-bridge/internal/standalone/manager.go

@@ -47,6 +47,9 @@ func NewManager(log logr.Logger, cfg *config.Config, c client.Client, restCfg *r
 }
 
 func (m *Manager) Start(ctx context.Context) error {
+	if err := m.client.checkPermissions(ctx, m.cfg.Standalone.Agents, m.cfg.RemoteConfigEnabled()); err != nil {
+		return err
+	}
 	if err := m.startHealthServer(ctx); err != nil {
 		return err
 	}

cmd/operator-opamp-bridge/internal/standalone/permissions_checker.go

@@ -0,0 +1,82 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package standalone
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+
+	authorizationv1 "k8s.io/api/authorization/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+type permission struct {
+	verb      string
+	apiGroup  string
+	resource  string
+	namespace string
+	name      string
+}
+
+type permissionsChecker struct {
+	k8sClient client.Client
+}
+
+func newPermissionsChecker(k8sClient client.Client) permissionsChecker {
+	return permissionsChecker{k8sClient: k8sClient}
+}
+
+func (p permissionsChecker) Check(ctx context.Context, perms []permission) error {
+	var errs []error
+	for _, perm := range perms {
+		if err := p.check(ctx, perm); err != nil {
+			errs = append(errs, err)
+		}
+	}
+	return errors.Join(errs...)
+}
+
+func (p permissionsChecker) check(ctx context.Context, perm permission) error {
+	review := &authorizationv1.SelfSubjectAccessReview{
+		Spec: authorizationv1.SelfSubjectAccessReviewSpec{
+			ResourceAttributes: &authorizationv1.ResourceAttributes{
+				Verb:      perm.verb,
+				Group:     perm.apiGroup,
+				Resource:  perm.resource,
+				Namespace: perm.namespace,
+				Name:      perm.name,
+			},
+		},
+	}
+	if err := p.k8sClient.Create(ctx, review); err != nil {
+		return fmt.Errorf("failed to check %s permission for %s: %w", perm.verb, perm.description(), err)
+	}
+	if review.Status.Allowed {
+		return nil
+	}
+	reason := review.Status.Reason
+	if review.Status.EvaluationError != "" {
+		reason = strings.TrimSpace(reason + ": " + review.Status.EvaluationError)
+	}
+	if reason == "" {
+		reason = "access denied"
+	}
+	return fmt.Errorf("missing %s permission for %s: %s", perm.verb, perm.description(), reason)
+}
+
+func (p permission) description() string {
+	resource := p.resource
+	if p.apiGroup != "" {
+		resource = p.apiGroup + "/" + resource
+	}
+	if p.namespace == "" && p.name == "" {
+		return resource
+	}
+	if p.name == "" {
+		return fmt.Sprintf("%s in namespace %s", resource, p.namespace)
+	}
+	return fmt.Sprintf("%s %s/%s", resource, p.namespace, p.name)
+}

config/standalone-bridge/kustomization.yaml

@@ -13,4 +13,4 @@ resources:
 images:
 - name: operator-opamp-bridge
   newName: ghcr.io/open-telemetry/opentelemetry-operator/operator-opamp-bridge
-  newTag: v0.150.0-96-g0360ab9e
+  newTag: v0.150.0-120-gf71eb58d