Skip to content

Commit d88f76e

Browse files
joelanfordjoelanford
committed
03-remove-preflight-permissions
1 parent 734cbe2 commit d88f76e

File tree

20 files changed

+19
-2963
lines changed

20 files changed

+19
-2963
lines changed

‎Makefile‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -153,10 +153,6 @@ lint-custom: custom-linter-build #EXHELP Call custom linter for the project
153153
lint-api-diff: $(GOLANGCI_LINT) #HELP Validate API changes using kube-api-linter with diff-aware analysis
154154
hack/api-lint-diff/run.sh
155155

156-
.PHONY: k8s-pin
157-
k8s-pin: #EXHELP Pin k8s staging modules based on k8s.io/kubernetes version (in go.mod or from K8S_IO_K8S_VERSION env var) and run go mod tidy.
158-
K8S_IO_K8S_VERSION='$(K8S_IO_K8S_VERSION)' go run hack/tools/k8smaintainer/main.go
159-
160156
.PHONY: tidy #HELP Run go mod tidy.
161157
tidy:
162158
go mod tidy
@@ -204,7 +200,7 @@ generate: $(CONTROLLER_GEN) #EXHELP Generate code containing DeepCopy, DeepCopyI
204200
$(CONTROLLER_GEN) --load-build-tags=$(GO_BUILD_TAGS) object:headerFile="hack/boilerplate.go.txt" paths="./..."
205201

206202
.PHONY: verify
207-
verify: k8s-pin kind-verify-versions fmt generate manifests update-tls-profiles crd-ref-docs update-registryv1-bundle-schema verify-bingo #HELP Verify all generated code is up-to-date. Runs k8s-pin instead of just tidy.
203+
verify: tidy kind-verify-versions fmt generate manifests update-tls-profiles crd-ref-docs update-registryv1-bundle-schema verify-bingo #HELP Verify all generated code is up-to-date.
208204
git diff --exit-code
209205

210206
.PHONY: verify-bingo

‎cmd/operator-controller/main.go‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,6 @@ import (
6060
"github.com/operator-framework/operator-controller/internal/operator-controller/action"
6161
"github.com/operator-framework/operator-controller/internal/operator-controller/applier"
6262
"github.com/operator-framework/operator-controller/internal/operator-controller/authentication"
63-
"github.com/operator-framework/operator-controller/internal/operator-controller/authorization"
6463
"github.com/operator-framework/operator-controller/internal/operator-controller/catalogmetadata/cache"
6564
catalogclient "github.com/operator-framework/operator-controller/internal/operator-controller/catalogmetadata/client"
6665
"github.com/operator-framework/operator-controller/internal/operator-controller/contentmanager"
@@ -599,12 +598,6 @@ func (c *boxcutterReconcilerConfigurator) Configure(ceReconciler *controllers.Cl
599598
return err
600599
}
601600

602-
// determine if PreAuthorizer should be enabled based on feature gate
603-
var preAuth authorization.PreAuthorizer
604-
if features.OperatorControllerFeatureGate.Enabled(features.PreflightPermissions) {
605-
preAuth = authorization.NewRBACPreAuthorizer(c.mgr.GetClient())
606-
}
607-
608601
// TODO: better scheme handling - which types do we want to support?
609602
_ = apiextensionsv1.AddToScheme(c.mgr.GetScheme())
610603
rg := &applier.SimpleRevisionGenerator{
@@ -617,7 +610,6 @@ func (c *boxcutterReconcilerConfigurator) Configure(ceReconciler *controllers.Cl
617610
Scheme: c.mgr.GetScheme(),
618611
RevisionGenerator: rg,
619612
Preflights: c.preflights,
620-
PreAuthorizer: preAuth,
621613
FieldOwner: fieldOwner,
622614
}
623615
revisionStatesGetter := &controllers.BoxcutterRevisionStatesGetter{Reader: c.mgr.GetClient()}
@@ -721,17 +713,6 @@ func (c *helmReconcilerConfigurator) Configure(ceReconciler *controllers.Cluster
721713
return fmt.Errorf("unable to create helm action client getter: %w", err)
722714
}
723715

724-
// determine if PreAuthorizer should be enabled based on feature gate
725-
var preAuth authorization.PreAuthorizer
726-
if features.OperatorControllerFeatureGate.Enabled(features.PreflightPermissions) {
727-
preAuth = authorization.NewRBACPreAuthorizer(
728-
c.mgr.GetClient(),
729-
// Additional verbs / bundle manifest that are expected by the content manager to watch those resources
730-
authorization.WithClusterCollectionVerbs("list", "watch"),
731-
authorization.WithNamespacedCollectionVerbs("create"),
732-
)
733-
}
734-
735716
cm := contentmanager.NewManager(clientRestConfigMapper, c.mgr.GetConfig(), c.mgr.GetRESTMapper())
736717
err = c.finalizers.Register(controllers.ClusterExtensionCleanupContentManagerCacheFinalizer, finalizers.FinalizerFunc(func(ctx context.Context, obj client.Object) (crfinalizer.Result, error) {
737718
ext := obj.(*ocv1.ClusterExtension)
@@ -743,15 +724,13 @@ func (c *helmReconcilerConfigurator) Configure(ceReconciler *controllers.Cluster
743724
return err
744725
}
745726

746-
// now initialize the helmApplier, assigning the potentially nil preAuth
747727
appl := &applier.Helm{
748728
ActionClientGetter: acg,
749729
Preflights: c.preflights,
750730
HelmChartProvider: &applier.RegistryV1HelmChartProvider{
751731
ManifestProvider: c.regv1ManifestProvider,
752732
},
753733
HelmReleaseToObjectsConverter: &applier.HelmReleaseToObjectsConverter{},
754-
PreAuthorizer: preAuth,
755734
Watcher: c.watcher,
756735
Manager: cm,
757736
}

‎docs/draft/howto/rbac-permissions-checking.md‎

Lines changed: 0 additions & 54 deletions
This file was deleted.

‎go.mod‎

Lines changed: 2 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@ require (
3131
github.com/stretchr/testify v1.11.1
3232
go.podman.io/image/v5 v5.39.1
3333
golang.org/x/exp v0.0.0-20260209203927-2842357ff358
34-
golang.org/x/mod v0.33.0
3534
golang.org/x/sync v0.20.0
3635
golang.org/x/tools v0.42.0
3736
helm.sh/helm/v3 v3.20.0
@@ -43,7 +42,6 @@ require (
4342
k8s.io/client-go v0.35.1
4443
k8s.io/component-base v0.35.1
4544
k8s.io/klog/v2 v2.130.1
46-
k8s.io/kubernetes v1.35.0
4745
k8s.io/utils v0.0.0-20260108192941-914a6e750570
4846
pkg.package-operator.run/boxcutter v0.10.0
4947
sigs.k8s.io/controller-runtime v0.23.1
@@ -53,10 +51,7 @@ require (
5351
sigs.k8s.io/yaml v1.6.0
5452
)
5553

56-
require (
57-
k8s.io/component-helpers v0.35.0 // indirect
58-
k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4 // indirect
59-
)
54+
require k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4 // indirect
6055

6156
require (
6257
cel.dev/expr v0.25.1 // indirect
@@ -227,6 +222,7 @@ require (
227222
go.yaml.in/yaml/v2 v2.4.3 // indirect
228223
go.yaml.in/yaml/v3 v3.0.4 // indirect
229224
golang.org/x/crypto v0.48.0 // indirect
225+
golang.org/x/mod v0.33.0 // indirect
230226
golang.org/x/net v0.50.0 // indirect
231227
golang.org/x/oauth2 v0.35.0 // indirect
232228
golang.org/x/sys v0.41.0 // indirect
@@ -244,7 +240,6 @@ require (
244240
gopkg.in/warnings.v0 v0.1.2 // indirect
245241
gopkg.in/yaml.v2 v2.4.0 // indirect
246242
gopkg.in/yaml.v3 v3.0.1 // indirect
247-
k8s.io/controller-manager v0.33.2 // indirect
248243
k8s.io/kubectl v0.35.0 // indirect
249244
oras.land/oras-go/v2 v2.6.0 // indirect
250245
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 // indirect
@@ -256,63 +251,3 @@ require (
256251
)
257252

258253
retract v1.5.0 // contains filename with ':' which causes failure creating module zip file
259-
260-
replace k8s.io/api => k8s.io/api v0.35.0
261-
262-
replace k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.35.0
263-
264-
replace k8s.io/apimachinery => k8s.io/apimachinery v0.35.0
265-
266-
replace k8s.io/apiserver => k8s.io/apiserver v0.35.0
267-
268-
replace k8s.io/cli-runtime => k8s.io/cli-runtime v0.35.0
269-
270-
replace k8s.io/client-go => k8s.io/client-go v0.35.0
271-
272-
replace k8s.io/cloud-provider => k8s.io/cloud-provider v0.35.0
273-
274-
replace k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.35.0
275-
276-
replace k8s.io/code-generator => k8s.io/code-generator v0.35.0
277-
278-
replace k8s.io/component-base => k8s.io/component-base v0.35.0
279-
280-
replace k8s.io/component-helpers => k8s.io/component-helpers v0.35.0
281-
282-
replace k8s.io/controller-manager => k8s.io/controller-manager v0.35.0
283-
284-
replace k8s.io/cri-api => k8s.io/cri-api v0.35.0
285-
286-
replace k8s.io/cri-client => k8s.io/cri-client v0.35.0
287-
288-
replace k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.35.0
289-
290-
replace k8s.io/dynamic-resource-allocation => k8s.io/dynamic-resource-allocation v0.35.0
291-
292-
replace k8s.io/endpointslice => k8s.io/endpointslice v0.35.0
293-
294-
replace k8s.io/externaljwt => k8s.io/externaljwt v0.35.0
295-
296-
replace k8s.io/kms => k8s.io/kms v0.35.0
297-
298-
replace k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.35.0
299-
300-
replace k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.35.0
301-
302-
replace k8s.io/kube-proxy => k8s.io/kube-proxy v0.35.0
303-
304-
replace k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.35.0
305-
306-
replace k8s.io/kubectl => k8s.io/kubectl v0.35.0
307-
308-
replace k8s.io/kubelet => k8s.io/kubelet v0.35.0
309-
310-
replace k8s.io/kubernetes => k8s.io/kubernetes v1.35.0
311-
312-
replace k8s.io/metrics => k8s.io/metrics v0.35.0
313-
314-
replace k8s.io/mount-utils => k8s.io/mount-utils v0.35.0
315-
316-
replace k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.35.0
317-
318-
replace k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.35.0

‎go.sum‎

Lines changed: 12 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -766,32 +766,26 @@ helm.sh/helm/v3 v3.20.0 h1:2M+0qQwnbI1a2CxN7dbmfsWHg/MloeaFMnZCY56as50=
766766
helm.sh/helm/v3 v3.20.0/go.mod h1:rTavWa0lagZOxGfdhu4vgk1OjH2UYCnrDKE2PVC4N0o=
767767
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
768768
honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
769-
k8s.io/api v0.35.0 h1:iBAU5LTyBI9vw3L5glmat1njFK34srdLmktWwLTprlY=
770-
k8s.io/api v0.35.0/go.mod h1:AQ0SNTzm4ZAczM03QH42c7l3bih1TbAXYo0DkF8ktnA=
771-
k8s.io/apiextensions-apiserver v0.35.0 h1:3xHk2rTOdWXXJM+RDQZJvdx0yEOgC0FgQ1PlJatA5T4=
772-
k8s.io/apiextensions-apiserver v0.35.0/go.mod h1:E1Ahk9SADaLQ4qtzYFkwUqusXTcaV2uw3l14aqpL2LU=
773-
k8s.io/apimachinery v0.35.0 h1:Z2L3IHvPVv/MJ7xRxHEtk6GoJElaAqDCCU0S6ncYok8=
774-
k8s.io/apimachinery v0.35.0/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
775-
k8s.io/apiserver v0.35.0 h1:CUGo5o+7hW9GcAEF3x3usT3fX4f9r8xmgQeCBDaOgX4=
776-
k8s.io/apiserver v0.35.0/go.mod h1:QUy1U4+PrzbJaM3XGu2tQ7U9A4udRRo5cyxkFX0GEds=
769+
k8s.io/api v0.35.1 h1:0PO/1FhlK/EQNVK5+txc4FuhQibV25VLSdLMmGpDE/Q=
770+
k8s.io/api v0.35.1/go.mod h1:28uR9xlXWml9eT0uaGo6y71xK86JBELShLy4wR1XtxM=
771+
k8s.io/apiextensions-apiserver v0.35.1 h1:p5vvALkknlOcAqARwjS20kJffgzHqwyQRM8vHLwgU7w=
772+
k8s.io/apiextensions-apiserver v0.35.1/go.mod h1:2CN4fe1GZ3HMe4wBr25qXyJnJyZaquy4nNlNmb3R7AQ=
773+
k8s.io/apimachinery v0.35.1 h1:yxO6gV555P1YV0SANtnTjXYfiivaTPvCTKX6w6qdDsU=
774+
k8s.io/apimachinery v0.35.1/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
775+
k8s.io/apiserver v0.35.1 h1:potxdhhTL4i6AYAa2QCwtlhtB1eCdWQFvJV6fXgJzxs=
776+
k8s.io/apiserver v0.35.1/go.mod h1:BiL6Dd3A2I/0lBnteXfWmCFobHM39vt5+hJQd7Lbpi4=
777777
k8s.io/cli-runtime v0.35.0 h1:PEJtYS/Zr4p20PfZSLCbY6YvaoLrfByd6THQzPworUE=
778778
k8s.io/cli-runtime v0.35.0/go.mod h1:VBRvHzosVAoVdP3XwUQn1Oqkvaa8facnokNkD7jOTMY=
779-
k8s.io/client-go v0.35.0 h1:IAW0ifFbfQQwQmga0UdoH0yvdqrbwMdq9vIFEhRpxBE=
780-
k8s.io/client-go v0.35.0/go.mod h1:q2E5AAyqcbeLGPdoRB+Nxe3KYTfPce1Dnu1myQdqz9o=
781-
k8s.io/component-base v0.35.0 h1:+yBrOhzri2S1BVqyVSvcM3PtPyx5GUxCK2tinZz1G94=
782-
k8s.io/component-base v0.35.0/go.mod h1:85SCX4UCa6SCFt6p3IKAPej7jSnF3L8EbfSyMZayJR0=
783-
k8s.io/component-helpers v0.35.0 h1:wcXv7HJRksgVjM4VlXJ1CNFBpyDHruRI99RrBtrJceA=
784-
k8s.io/component-helpers v0.35.0/go.mod h1:ahX0m/LTYmu7fL3W8zYiIwnQ/5gT28Ex4o2pymF63Co=
785-
k8s.io/controller-manager v0.35.0 h1:KteodmfVIRzfZ3RDaxhnHb72rswBxEngvdL9vuZOA9A=
786-
k8s.io/controller-manager v0.35.0/go.mod h1:1bVuPNUG6/dpWpevsJpXioS0E0SJnZ7I/Wqc9Awyzm4=
779+
k8s.io/client-go v0.35.1 h1:+eSfZHwuo/I19PaSxqumjqZ9l5XiTEKbIaJ+j1wLcLM=
780+
k8s.io/client-go v0.35.1/go.mod h1:1p1KxDt3a0ruRfc/pG4qT/3oHmUj1AhSHEcxNSGg+OA=
781+
k8s.io/component-base v0.35.1 h1:XgvpRf4srp037QWfGBLFsYMUQJkE5yMa94UsJU7pmcE=
782+
k8s.io/component-base v0.35.1/go.mod h1:HI/6jXlwkiOL5zL9bqA3en1Ygv60F03oEpnuU1G56Bs=
787783
k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
788784
k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
789785
k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4 h1:HhDfevmPS+OalTjQRKbTHppRIz01AWi8s45TMXStgYY=
790786
k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
791787
k8s.io/kubectl v0.35.0 h1:cL/wJKHDe8E8+rP3G7avnymcMg6bH6JEcR5w5uo06wc=
792788
k8s.io/kubectl v0.35.0/go.mod h1:VR5/TSkYyxZwrRwY5I5dDq6l5KXmiCb+9w8IKplk3Qo=
793-
k8s.io/kubernetes v1.35.0 h1:PUOojD8c8E3csMP5NX+nLLne6SGqZjrYCscptyBfWMY=
794-
k8s.io/kubernetes v1.35.0/go.mod h1:Tzk9Y9W/XUFFFgTUVg+BAowoFe+Pc7koGLuaiLHdcFg=
795789
k8s.io/utils v0.0.0-20260108192941-914a6e750570 h1:JT4W8lsdrGENg9W+YwwdLJxklIuKWdRm+BC+xt33FOY=
796790
k8s.io/utils v0.0.0-20260108192941-914a6e750570/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
797791
oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=

0 commit comments

Comments
 (0)