Skip to content

Commit 6078a1e

Browse files
joelanfordjoelanford
committed
03-remove-preflight-permissions
1 parent 2989bf9 commit 6078a1e

File tree

20 files changed

+7
-2699
lines changed

20 files changed

+7
-2699
lines changed

‎Makefile‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -153,10 +153,6 @@ lint-custom: custom-linter-build #EXHELP Call custom linter for the project
153153
lint-api-diff: $(GOLANGCI_LINT) #HELP Validate API changes using kube-api-linter with diff-aware analysis
154154
hack/api-lint-diff/run.sh
155155

156-
.PHONY: k8s-pin
157-
k8s-pin: #EXHELP Pin k8s staging modules based on k8s.io/kubernetes version (in go.mod or from K8S_IO_K8S_VERSION env var) and run go mod tidy.
158-
K8S_IO_K8S_VERSION='$(K8S_IO_K8S_VERSION)' go run hack/tools/k8smaintainer/main.go
159-
160156
.PHONY: tidy #HELP Run go mod tidy.
161157
tidy:
162158
go mod tidy
@@ -204,7 +200,7 @@ generate: $(CONTROLLER_GEN) #EXHELP Generate code containing DeepCopy, DeepCopyI
204200
$(CONTROLLER_GEN) --load-build-tags=$(GO_BUILD_TAGS) object:headerFile="hack/boilerplate.go.txt" paths="./..."
205201

206202
.PHONY: verify
207-
verify: k8s-pin kind-verify-versions fmt generate manifests update-tls-profiles crd-ref-docs update-registryv1-bundle-schema verify-bingo #HELP Verify all generated code is up-to-date. Runs k8s-pin instead of just tidy.
203+
verify: tidy kind-verify-versions fmt generate manifests update-tls-profiles crd-ref-docs update-registryv1-bundle-schema verify-bingo #HELP Verify all generated code is up-to-date.
208204
git diff --exit-code
209205

210206
.PHONY: verify-bingo

‎cmd/operator-controller/main.go‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,6 @@ import (
6060
"github.com/operator-framework/operator-controller/internal/operator-controller/action"
6161
"github.com/operator-framework/operator-controller/internal/operator-controller/applier"
6262
"github.com/operator-framework/operator-controller/internal/operator-controller/authentication"
63-
"github.com/operator-framework/operator-controller/internal/operator-controller/authorization"
6463
"github.com/operator-framework/operator-controller/internal/operator-controller/catalogmetadata/cache"
6564
catalogclient "github.com/operator-framework/operator-controller/internal/operator-controller/catalogmetadata/client"
6665
"github.com/operator-framework/operator-controller/internal/operator-controller/contentmanager"
@@ -599,12 +598,6 @@ func (c *boxcutterReconcilerConfigurator) Configure(ceReconciler *controllers.Cl
599598
return err
600599
}
601600

602-
// determine if PreAuthorizer should be enabled based on feature gate
603-
var preAuth authorization.PreAuthorizer
604-
if features.OperatorControllerFeatureGate.Enabled(features.PreflightPermissions) {
605-
preAuth = authorization.NewRBACPreAuthorizer(c.mgr.GetClient())
606-
}
607-
608601
// TODO: better scheme handling - which types do we want to support?
609602
_ = apiextensionsv1.AddToScheme(c.mgr.GetScheme())
610603
rg := &applier.SimpleRevisionGenerator{
@@ -617,7 +610,6 @@ func (c *boxcutterReconcilerConfigurator) Configure(ceReconciler *controllers.Cl
617610
Scheme: c.mgr.GetScheme(),
618611
RevisionGenerator: rg,
619612
Preflights: c.preflights,
620-
PreAuthorizer: preAuth,
621613
FieldOwner: fieldOwner,
622614
}
623615
revisionStatesGetter := &controllers.BoxcutterRevisionStatesGetter{Reader: c.mgr.GetClient()}
@@ -721,12 +713,6 @@ func (c *helmReconcilerConfigurator) Configure(ceReconciler *controllers.Cluster
721713
return fmt.Errorf("unable to create helm action client getter: %w", err)
722714
}
723715

724-
// determine if PreAuthorizer should be enabled based on feature gate
725-
var preAuth authorization.PreAuthorizer
726-
if features.OperatorControllerFeatureGate.Enabled(features.PreflightPermissions) {
727-
preAuth = authorization.NewRBACPreAuthorizer(c.mgr.GetClient())
728-
}
729-
730716
cm := contentmanager.NewManager(clientRestConfigMapper, c.mgr.GetConfig(), c.mgr.GetRESTMapper())
731717
err = c.finalizers.Register(controllers.ClusterExtensionCleanupContentManagerCacheFinalizer, finalizers.FinalizerFunc(func(ctx context.Context, obj client.Object) (crfinalizer.Result, error) {
732718
ext := obj.(*ocv1.ClusterExtension)
@@ -738,15 +724,13 @@ func (c *helmReconcilerConfigurator) Configure(ceReconciler *controllers.Cluster
738724
return err
739725
}
740726

741-
// now initialize the helmApplier, assigning the potentially nil preAuth
742727
appl := &applier.Helm{
743728
ActionClientGetter: acg,
744729
Preflights: c.preflights,
745730
HelmChartProvider: &applier.RegistryV1HelmChartProvider{
746731
ManifestProvider: c.regv1ManifestProvider,
747732
},
748733
HelmReleaseToObjectsConverter: &applier.HelmReleaseToObjectsConverter{},
749-
PreAuthorizer: preAuth,
750734
Watcher: c.watcher,
751735
Manager: cm,
752736
}

‎docs/draft/howto/rbac-permissions-checking.md‎

Lines changed: 0 additions & 54 deletions
This file was deleted.

‎go.mod‎

Lines changed: 2 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ require (
3131
github.com/stretchr/testify v1.11.1
3232
go.podman.io/image/v5 v5.39.1
3333
golang.org/x/exp v0.0.0-20260209203927-2842357ff358
34-
golang.org/x/mod v0.33.0
34+
golang.org/x/mod v0.33.0 // indirect
3535
golang.org/x/sync v0.19.0
3636
golang.org/x/tools v0.42.0
3737
helm.sh/helm/v3 v3.20.0
@@ -43,7 +43,6 @@ require (
4343
k8s.io/client-go v0.35.0
4444
k8s.io/component-base v0.35.0
4545
k8s.io/klog/v2 v2.130.1
46-
k8s.io/kubernetes v1.35.0
4746
k8s.io/utils v0.0.0-20260108192941-914a6e750570
4847
pkg.package-operator.run/boxcutter v0.10.0
4948
sigs.k8s.io/controller-runtime v0.23.1
@@ -53,10 +52,7 @@ require (
5352
sigs.k8s.io/yaml v1.6.0
5453
)
5554

56-
require (
57-
k8s.io/component-helpers v0.35.0 // indirect
58-
k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4 // indirect
59-
)
55+
require k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4 // indirect
6056

6157
require (
6258
cel.dev/expr v0.25.1 // indirect
@@ -244,7 +240,6 @@ require (
244240
gopkg.in/warnings.v0 v0.1.2 // indirect
245241
gopkg.in/yaml.v2 v2.4.0 // indirect
246242
gopkg.in/yaml.v3 v3.0.1 // indirect
247-
k8s.io/controller-manager v0.33.2 // indirect
248243
k8s.io/kubectl v0.35.0 // indirect
249244
oras.land/oras-go/v2 v2.6.0 // indirect
250245
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 // indirect
@@ -256,63 +251,3 @@ require (
256251
)
257252

258253
retract v1.5.0 // contains filename with ':' which causes failure creating module zip file
259-
260-
replace k8s.io/api => k8s.io/api v0.35.0
261-
262-
replace k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.35.0
263-
264-
replace k8s.io/apimachinery => k8s.io/apimachinery v0.35.0
265-
266-
replace k8s.io/apiserver => k8s.io/apiserver v0.35.0
267-
268-
replace k8s.io/cli-runtime => k8s.io/cli-runtime v0.35.0
269-
270-
replace k8s.io/client-go => k8s.io/client-go v0.35.0
271-
272-
replace k8s.io/cloud-provider => k8s.io/cloud-provider v0.35.0
273-
274-
replace k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.35.0
275-
276-
replace k8s.io/code-generator => k8s.io/code-generator v0.35.0
277-
278-
replace k8s.io/component-base => k8s.io/component-base v0.35.0
279-
280-
replace k8s.io/component-helpers => k8s.io/component-helpers v0.35.0
281-
282-
replace k8s.io/controller-manager => k8s.io/controller-manager v0.35.0
283-
284-
replace k8s.io/cri-api => k8s.io/cri-api v0.35.0
285-
286-
replace k8s.io/cri-client => k8s.io/cri-client v0.35.0
287-
288-
replace k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.35.0
289-
290-
replace k8s.io/dynamic-resource-allocation => k8s.io/dynamic-resource-allocation v0.35.0
291-
292-
replace k8s.io/endpointslice => k8s.io/endpointslice v0.35.0
293-
294-
replace k8s.io/externaljwt => k8s.io/externaljwt v0.35.0
295-
296-
replace k8s.io/kms => k8s.io/kms v0.35.0
297-
298-
replace k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.35.0
299-
300-
replace k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.35.0
301-
302-
replace k8s.io/kube-proxy => k8s.io/kube-proxy v0.35.0
303-
304-
replace k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.35.0
305-
306-
replace k8s.io/kubectl => k8s.io/kubectl v0.35.0
307-
308-
replace k8s.io/kubelet => k8s.io/kubelet v0.35.0
309-
310-
replace k8s.io/kubernetes => k8s.io/kubernetes v1.35.0
311-
312-
replace k8s.io/metrics => k8s.io/metrics v0.35.0
313-
314-
replace k8s.io/mount-utils => k8s.io/mount-utils v0.35.0
315-
316-
replace k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.35.0
317-
318-
replace k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.35.0

‎go.sum‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -780,18 +780,12 @@ k8s.io/client-go v0.35.0 h1:IAW0ifFbfQQwQmga0UdoH0yvdqrbwMdq9vIFEhRpxBE=
780780
k8s.io/client-go v0.35.0/go.mod h1:q2E5AAyqcbeLGPdoRB+Nxe3KYTfPce1Dnu1myQdqz9o=
781781
k8s.io/component-base v0.35.0 h1:+yBrOhzri2S1BVqyVSvcM3PtPyx5GUxCK2tinZz1G94=
782782
k8s.io/component-base v0.35.0/go.mod h1:85SCX4UCa6SCFt6p3IKAPej7jSnF3L8EbfSyMZayJR0=
783-
k8s.io/component-helpers v0.35.0 h1:wcXv7HJRksgVjM4VlXJ1CNFBpyDHruRI99RrBtrJceA=
784-
k8s.io/component-helpers v0.35.0/go.mod h1:ahX0m/LTYmu7fL3W8zYiIwnQ/5gT28Ex4o2pymF63Co=
785-
k8s.io/controller-manager v0.35.0 h1:KteodmfVIRzfZ3RDaxhnHb72rswBxEngvdL9vuZOA9A=
786-
k8s.io/controller-manager v0.35.0/go.mod h1:1bVuPNUG6/dpWpevsJpXioS0E0SJnZ7I/Wqc9Awyzm4=
787783
k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
788784
k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
789785
k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4 h1:HhDfevmPS+OalTjQRKbTHppRIz01AWi8s45TMXStgYY=
790786
k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
791787
k8s.io/kubectl v0.35.0 h1:cL/wJKHDe8E8+rP3G7avnymcMg6bH6JEcR5w5uo06wc=
792788
k8s.io/kubectl v0.35.0/go.mod h1:VR5/TSkYyxZwrRwY5I5dDq6l5KXmiCb+9w8IKplk3Qo=
793-
k8s.io/kubernetes v1.35.0 h1:PUOojD8c8E3csMP5NX+nLLne6SGqZjrYCscptyBfWMY=
794-
k8s.io/kubernetes v1.35.0/go.mod h1:Tzk9Y9W/XUFFFgTUVg+BAowoFe+Pc7koGLuaiLHdcFg=
795789
k8s.io/utils v0.0.0-20260108192941-914a6e750570 h1:JT4W8lsdrGENg9W+YwwdLJxklIuKWdRm+BC+xt33FOY=
796790
k8s.io/utils v0.0.0-20260108192941-914a6e750570/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
797791
oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=

‎hack/tools/k8smaintainer/README.md‎

Lines changed: 0 additions & 43 deletions
This file was deleted.

0 commit comments

Comments
 (0)