Skip to content

Commit 99fe9fc

Browse files
kuiwang02kuiwang02
committed
add create verb to boxcutter preflight
1 parent a307a6d commit 99fe9fc

4 files changed

Lines changed: 135 additions & 1 deletion

File tree

‎cmd/operator-controller/main.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -617,7 +617,10 @@ func (c *boxcutterReconcilerConfigurator) Configure(ceReconciler *controllers.Cl
617617
// determine if PreAuthorizer should be enabled based on feature gate
618618
var preAuth authorization.PreAuthorizer
619619
if features.OperatorControllerFeatureGate.Enabled(features.PreflightPermissions) {
620-
preAuth = authorization.NewRBACPreAuthorizer(c.mgr.GetClient())
620+
preAuth = authorization.NewRBACPreAuthorizer(
621+
c.mgr.GetClient(),
622+
authorization.WithNamespacedCollectionVerbs("create"),
623+
)
621624
}
622625

623626
// TODO: better scheme handling - which types do we want to support?

‎test/e2e/features/install.feature‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -535,3 +535,38 @@ Feature: Install ClusterExtension
535535
nodeSelector:
536536
kubernetes.io/os: linux
537537
"""
538+
539+
@BoxcutterRuntime
540+
@PreflightPermissions
541+
Scenario: Boxcutter preflight check detects missing CREATE permissions
542+
Given ServiceAccount "olm-sa" without create permissions is available in ${TEST_NAMESPACE}
543+
And ClusterExtension is applied
544+
"""
545+
apiVersion: olm.operatorframework.io/v1
546+
kind: ClusterExtension
547+
metadata:
548+
name: ${NAME}
549+
spec:
550+
namespace: ${TEST_NAMESPACE}
551+
serviceAccount:
552+
name: olm-sa
553+
source:
554+
sourceType: Catalog
555+
catalog:
556+
packageName: test
557+
selector:
558+
matchLabels:
559+
"olm.operatorframework.io/metadata.name": test-catalog
560+
"""
561+
And ClusterExtension reports Progressing as True with Reason Retrying and Message includes:
562+
"""
563+
pre-authorization failed: service account requires the following permissions to manage cluster extension
564+
"""
565+
And ClusterExtension reports Progressing as True with Reason Retrying and Message includes:
566+
"""
567+
Verbs:[create]
568+
"""
569+
When ServiceAccount "olm-sa" with needed permissions is available in ${TEST_NAMESPACE}
570+
Then ClusterExtension is available
571+
And ClusterExtension reports Progressing as True with Reason Succeeded
572+
And ClusterExtension reports Installed as True

‎test/e2e/steps/steps.go‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ import (
3434
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
3535
"k8s.io/apimachinery/pkg/util/sets"
3636
k8sresource "k8s.io/cli-runtime/pkg/resource"
37+
"k8s.io/component-base/featuregate"
3738
"k8s.io/utils/ptr"
3839
"sigs.k8s.io/controller-runtime/pkg/client"
3940
"sigs.k8s.io/yaml"
@@ -120,6 +121,7 @@ func RegisterSteps(sc *godog.ScenarioContext) {
120121
sc.Step(`^(?i)ServiceAccount "([^"]*)" with permissions to install extensions is available in "([^"]*)" namespace$`, ServiceAccountWithNeededPermissionsIsAvailableInGivenNamespace)
121122
sc.Step(`^(?i)ServiceAccount "([^"]*)" with needed permissions is available in test namespace$`, ServiceAccountWithNeededPermissionsIsAvailableInTestNamespace)
122123
sc.Step(`^(?i)ServiceAccount "([^"]*)" with needed permissions is available in \${TEST_NAMESPACE}$`, ServiceAccountWithNeededPermissionsIsAvailableInTestNamespace)
124+
sc.Step(`^(?i)ServiceAccount "([^"]*)" without create permissions is available in \${TEST_NAMESPACE}$`, ServiceAccountWithoutCreatePermissionsIsAvailableInTestNamespace)
123125
sc.Step(`^(?i)ServiceAccount "([^"]*)" is available in \${TEST_NAMESPACE}$`, ServiceAccountIsAvailableInNamespace)
124126
sc.Step(`^(?i)ServiceAccount "([^"]*)" in test namespace is cluster admin$`, ServiceAccountWithClusterAdminPermissionsIsAvailableInNamespace)
125127
sc.Step(`^(?i)ServiceAccount "([^"]+)" in test namespace has permissions to fetch "([^"]+)" metrics$`, ServiceAccountWithFetchMetricsPermissions)
@@ -418,6 +420,11 @@ type msgMatchFn func(string) bool
418420

419421
func alwaysMatch(_ string) bool { return true }
420422

423+
func isFeatureGateEnabled(feature featuregate.Feature) bool {
424+
enabled, found := featureGates[feature]
425+
return enabled && found
426+
}
427+
421428
func messageComparison(ctx context.Context, msg *godog.DocString) msgMatchFn {
422429
msgCmp := alwaysMatch
423430
if msg != nil {
@@ -877,6 +884,23 @@ func ServiceAccountWithNeededPermissionsIsAvailableInTestNamespace(ctx context.C
877884
return applyPermissionsToServiceAccount(ctx, serviceAccount, rbacTemplate)
878885
}
879886

887+
// ServiceAccountWithoutCreatePermissionsIsAvailableInTestNamespace creates a ServiceAccount with permissions that
888+
// intentionally exclude the "create" verb to test preflight permission validation for Boxcutter applier.
889+
// This is used to verify that the preflight check properly detects missing CREATE permissions.
890+
// Note: This function requires both @BoxcutterRuntime and @PreflightPermissions tags.
891+
func ServiceAccountWithoutCreatePermissionsIsAvailableInTestNamespace(ctx context.Context, serviceAccount string) error {
892+
// This test is only valid with Boxcutter runtime enabled
893+
if !isFeatureGateEnabled(features.BoxcutterRuntime) {
894+
return fmt.Errorf("this step requires BoxcutterRuntime feature gate to be enabled")
895+
}
896+
// It also requires preflight permissions checks to be enabled
897+
if !isFeatureGateEnabled(features.PreflightPermissions) {
898+
return fmt.Errorf("this step requires PreflightPermissions feature gate to be enabled")
899+
}
900+
rbacTemplate := fmt.Sprintf("%s-boxcutter-no-create-rbac-template.yaml", serviceAccount)
901+
return applyPermissionsToServiceAccount(ctx, serviceAccount, rbacTemplate)
902+
}
903+
880904
// ServiceAccountWithNeededPermissionsIsAvailableInGivenNamespace creates a ServiceAccount and enables creation of any cluster extension on behalf of this account.
881905
func ServiceAccountWithNeededPermissionsIsAvailableInGivenNamespace(ctx context.Context, serviceAccount string, ns string) error {
882906
sc := scenarioCtx(ctx)

‎test/e2e/steps/testdata/olm-sa-boxcutter-no-create-rbac-template.yaml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
apiVersion: v1
3+
kind: Namespace
4+
metadata:
5+
name: ${TEST_NAMESPACE}
6+
---
7+
apiVersion: rbac.authorization.k8s.io/v1
8+
kind: ClusterRole
9+
metadata:
10+
name: ${TEST_NAMESPACE}-${SERVICEACCOUNT_NAME}-olm-admin-clusterrole
11+
rules:
12+
# Allow management of ClusterExtensionRevision finalizers (e.g. by the Boxcutter applier)
13+
- apiGroups: [olm.operatorframework.io]
14+
resources: [clusterextensionrevisions/finalizers]
15+
verbs: [update, patch]
16+
# OLMv0 compatibility requirement for AllNamespaces install
17+
# https://github.com/operator-framework/operator-lifecycle-manager/blob/dfd0b2bea85038d3c0d65348bc812d297f16b8d2/pkg/controller/operators/olm/operatorgroup.go#L530
18+
- apiGroups: [ "" ]
19+
resources:
20+
- namespaces
21+
verbs: [ get, list, watch ]
22+
# Bundle resource management RBAC derived from bundle resource and permissions described in the ClusterServiceVersion
23+
# NOTE: Intentionally MISSING "create" verb to test preflight check
24+
- apiGroups: [apiextensions.k8s.io]
25+
resources: [customresourcedefinitions]
26+
verbs: [update, get, delete, patch]
27+
- apiGroups: [""]
28+
resources:
29+
- configmaps
30+
- serviceaccounts
31+
verbs: [update, list, watch, get, delete, patch]
32+
- apiGroups: [ "" ]
33+
resources:
34+
- events
35+
verbs: [ patch ]
36+
- apiGroups: ["apps"]
37+
resources:
38+
- deployments
39+
verbs: [ update, get, delete, patch ]
40+
- apiGroups: ["networking.k8s.io"]
41+
resources:
42+
- networkpolicies
43+
verbs: [update, list, get, delete, patch]
44+
- apiGroups: ["rbac.authorization.k8s.io"]
45+
resources:
46+
- clusterroles
47+
- roles
48+
- clusterrolebindings
49+
- rolebindings
50+
verbs: [ update, get, delete, patch ]
51+
- apiGroups: ["coordination.k8s.io"]
52+
resources: ["leases"]
53+
verbs: [update, list, watch, get, delete, patch]
54+
- apiGroups: ["authorization.k8s.io"]
55+
resources: ["subjectaccessreviews"]
56+
verbs: [create]
57+
- apiGroups: ["authentication.k8s.io"]
58+
resources: ["tokenreviews"]
59+
verbs: [create]
60+
---
61+
apiVersion: rbac.authorization.k8s.io/v1
62+
kind: ClusterRoleBinding
63+
metadata:
64+
name: ${TEST_NAMESPACE}-${SERVICEACCOUNT_NAME}-install-binding
65+
roleRef:
66+
apiGroup: rbac.authorization.k8s.io
67+
kind: ClusterRole
68+
name: ${TEST_NAMESPACE}-${SERVICEACCOUNT_NAME}-olm-admin-clusterrole
69+
subjects:
70+
- kind: ServiceAccount
71+
name: ${SERVICEACCOUNT_NAME}
72+
namespace: ${TEST_NAMESPACE}

0 commit comments

Comments
 (0)