deploy sonataflow related rbac (#1187)

gazarenkov · github-actions[bot] · web-flow · commit dde7bb81ba85 · 2025-05-22T16:03:13.000Z
* deploy sonataflow related rbac

Signed-off-by: gazarenkov &lt;gazarenkov@gmail.com&gt;

* Regenerate bundle/installer manifests

Co-authored-by: gazarenkov &lt;gazarenkov@users.noreply.github.com&gt;

---------

Signed-off-by: gazarenkov &lt;gazarenkov@gmail.com&gt;
Co-authored-by: github-actions[bot] &lt;github-actions[bot]@users.noreply.github.com&gt;
Co-authored-by: gazarenkov &lt;gazarenkov@users.noreply.github.com&gt;
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
diff --git a/api/v1alpha2/zz_generated.deepcopy.go b/api/v1alpha2/zz_generated.deepcopy.go
diff --git a/api/v1alpha3/zz_generated.deepcopy.go b/api/v1alpha3/zz_generated.deepcopy.go
diff --git a/bundle/backstage.io/manifests/backstage-operator.clusterserviceversion.yaml b/bundle/backstage.io/manifests/backstage-operator.clusterserviceversion.yaml
@@ -35,7 +35,7 @@ metadata:
           }
         }
       ]
-    createdAt: "2025-05-12T12:54:39Z"
+    createdAt: "2025-05-21T20:27:26Z"
     description: Backstage Operator
     operators.operatorframework.io/builder: operator-sdk-v1.37.0
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
diff --git a/bundle/rhdh/manifests/backstage-operator.clusterserviceversion.yaml b/bundle/rhdh/manifests/backstage-operator.clusterserviceversion.yaml
@@ -39,7 +39,7 @@ metadata:
     categories: Developer Tools
     certified: "true"
     containerImage: registry.redhat.io/rhdh/rhdh-rhel9-operator:1.7
-    createdAt: "2025-05-12T12:54:40Z"
+    createdAt: "2025-05-21T20:27:25Z"
     description: Red Hat Developer Hub is a Red Hat supported version of Backstage.
       It comes with pre-built plug-ins and configuration settings, supports use of
       an external database, and can help streamline the process of setting up a self-managed
@@ -199,6 +199,44 @@ spec:
           - patch
           - update
           - watch
+        - apiGroups:
+          - sonataflow.org
+          resources:
+          - sonataflowplatforms
+          - sonataflows
+          verbs:
+          - create
+          - delete
+          - get
+          - list
+          - patch
+          - update
+          - watch
+        - apiGroups:
+          - networking.k8s.io
+          resources:
+          - networkpolicies
+          verbs:
+          - create
+          - delete
+          - get
+          - list
+          - patch
+          - update
+          - watch
+        - apiGroups:
+          - operator.knative.dev
+          resources:
+          - knativeeventings
+          - knativeservings
+          verbs:
+          - create
+          - delete
+          - get
+          - list
+          - patch
+          - update
+          - watch
         - apiGroups:
           - authentication.k8s.io
           resources:
diff --git a/config/profile/rhdh/kustomization.yaml b/config/profile/rhdh/kustomization.yaml
@@ -10,7 +10,7 @@ resources:
 - ../../rbac
 - ../../manager
 - namespace.yaml
-
+- plugin-rbac
 
 images:
 - name: controller
diff --git a/config/profile/rhdh/plugin-infra/kustomization.yaml b/config/profile/rhdh/plugin-infra/kustomization.yaml
@@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-- orchestrator/rbac-sonataflow.yaml
 - orchestrator/infra-sonataflow.yaml
 - orchestrator/infra-serverless.yaml
 
diff --git a/config/profile/rhdh/plugin-rbac/kustomization.yaml b/config/profile/rhdh/plugin-rbac/kustomization.yaml
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- rbac-sonataflow.yaml
+
+
diff --git a/config/profile/rhdh/plugin-rbac/rbac-sonataflow.yaml b/config/profile/rhdh/plugin-rbac/rbac-sonataflow.yaml
@@ -1,7 +1,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: rhdh-manager-sonataflow-role
+  name: manager-sonataflow-role
 rules:
   - apiGroups:
       - "sonataflow.org"
@@ -51,11 +51,11 @@ metadata:
     app.kubernetes.io/managed-by: kustomize
     app.kubernetes.io/name: clusterrolebinding
     app.kubernetes.io/part-of: backstage-operator
-  name: rhdh-manager-sonataflow-rolebinding
+  name: manager-sonataflow-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: rhdh-manager-sonataflow-role
+  name: manager-sonataflow-role
 subjects:
   - kind: ServiceAccount
     name: rhdh-controller-manager
diff --git a/dist/rhdh/install.yaml b/dist/rhdh/install.yaml
@@ -1409,6 +1409,50 @@ rules:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
+metadata:
+  name: rhdh-manager-sonataflow-role
+rules:
+- apiGroups:
+  - sonataflow.org
+  resources:
+  - sonataflowplatforms
+  - sonataflows
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - networkpolicies
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - operator.knative.dev
+  resources:
+  - knativeeventings
+  - knativeservings
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
 metadata:
   labels:
     app.kubernetes.io/component: rbac
@@ -1492,6 +1536,25 @@ subjects:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/instance: manager-rolebinding
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: clusterrolebinding
+    app.kubernetes.io/part-of: backstage-operator
+  name: rhdh-manager-sonataflow-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: rhdh-manager-sonataflow-role
+subjects:
+- kind: ServiceAccount
+  name: rhdh-controller-manager
+  namespace: rhdh-operator
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
 metadata:
   labels:
     app.kubernetes.io/component: rbac
diff --git a/docs/dynamic-plugins.md b/docs/dynamic-plugins.md
@@ -35,7 +35,7 @@ configMapGenerator:
 
 ### Plugin dependencies infrastructure
 
-If plugin dependencies require infrastructural resources (e.g., RoleBindings, CustomResources) and if the User (Administrator) wants it to be deployed (see Note below), they can be specified in the /config/profile/{PROFILE}/plugin-infra directory. To create these resources (along with the operator deployment), use the `make plugin-infra` command. 
+If plugin dependencies require infrastructural resources (e.g. other Operators to be installed) and if the User (Administrator) wants it to be deployed (see Note below), they can be specified in the /config/profile/{PROFILE}/plugin-infra directory. To create these resources (along with the operator deployment), use the `make plugin-infra` command. 
 
 **Note**: Be cautious when running this command on a production cluster, as it may reconfigure cluster-scoped resources.
 
@@ -108,8 +108,10 @@ The SonataFlowPlatform CR requires the SonataFlow operator to be installed. In a
 
 **Note:** Current Subscriptions configuration uses **Automatic** install plan (**spec.installPlanApproval: Automatic**), consider to change it to **Manual** if you want to control the installation of the operators (see [Operator Installation with OLM](https://olm.operatorframework.io/docs/tasks/install-operator-with-olm) for more details).
 
-Additionally, to enable the Backstage operator to work with the SonataFlow platform, its ServiceAccount must be granted the appropriate permissions. 
+**Note:** Using plugin infrastructure (plugin-infra) can be risky in production, as it modifies cluster-scoped resources.
+
+#### RBAC
 
-These manifests are defined as plugin infrastructure in the profile/rhdh/operator/plugin-infra/orchestrator directory.
+Additionally, to enable the Backstage operator to work with the SonataFlow platform, its ServiceAccount must be granted the appropriate permissions. 
 
-**Note:** Using plugin infrastructure (plugin-infra) can be risky in production, as it modifies cluster-scoped resources.
+These manifests are defined in the profile/rhdh/operator/plugin-rbac/rbac-sonataflow.yaml file which is applied along with the Backstage operator deployment.
diff --git a/internal/controller/plugin-deps.go b/internal/controller/plugin-deps.go
@@ -21,7 +21,7 @@ func (r *BackstageReconciler) applyPluginDeps(ctx context.Context, nsName types.
 
 	objects, err := model.GetPluginDeps(nsName.Name, nsName.Namespace, plugins)
 	if err != nil {
-		return fmt.Errorf("failed to read YAML files: %w", err)
+		return fmt.Errorf("failed to get plugin dependencies: %w", err)
 	}
 
 	// Process the objects as needed
diff --git a/pkg/model/plugin_deps.go b/pkg/model/plugin_deps.go
@@ -96,6 +96,8 @@ func getDepsFiles(root string, enabledPrefixes []string) ([]string, error) {
 				break
 			}
 		}
+
+		// TODO add some warning if file is not in the enabled list
 	}
 
 	return files, nil

Original file line number	Diff line number	Diff line change
`@@ -35,7 +35,7 @@ metadata:`
`35`	`35`	`}`
`36`	`36`	`}`
`37`	`37`	`]`
`38`		`- createdAt: "2025-05-12T12:54:39Z"`
	`38`	`+ createdAt: "2025-05-21T20:27:26Z"`
`39`	`39`	`description: Backstage Operator`
`40`	`40`	`operators.operatorframework.io/builder: operator-sdk-v1.37.0`
`41`	`41`	`operators.operatorframework.io/project_layout: go.kubebuilder.io/v4`