refactor: consolidate rbac resources

Author: maltesander

rust/operator-binary/src/controller.rs

@@ -17,10 +17,7 @@ use snafu::{ResultExt, Snafu};
 use stackable_operator::{
     cli::OperatorEnvironmentOptions,
     cluster_resources::ClusterResourceApplyStrategy,
-    commons::{
-        networking::DomainName, product_image_selection::ResolvedProductImage,
-        rbac::build_rbac_resources,
-    },
+    commons::{networking::DomainName, product_image_selection::ResolvedProductImage},
     crd::listener,
     kube::{
         Resource,
@@ -65,6 +62,7 @@ use crate::{
             resource::{
                 listener::build_broker_rolegroup_bootstrap_listener,
                 pdb::build_pdb,
+                rbac::{build_rbac_role_binding, build_rbac_service_account},
                 service::{build_rolegroup_headless_service, build_rolegroup_metrics_service},
                 statefulset::{
                     build_broker_rolegroup_statefulset, build_controller_rolegroup_statefulset,
@@ -489,11 +487,6 @@ pub enum Error {
         source: stackable_operator::client::Error,
     },
 
-    #[snafu(display("failed to build RBAC resources"))]
-    BuildRbacResources {
-        source: stackable_operator::commons::rbac::Error,
-    },
-
     #[snafu(display("failed to apply PodDisruptionBudget"))]
     ApplyPdb {
         source: stackable_operator::cluster_resources::Error,
@@ -541,7 +534,6 @@ impl ReconcilerError for Error {
             Error::ApplyServiceAccount { .. } => None,
             Error::ApplyRoleBinding { .. } => None,
             Error::ApplyStatus { .. } => None,
-            Error::BuildRbacResources { .. } => None,
             Error::ApplyPdb { .. } => None,
             Error::GetRequiredLabels { .. } => None,
             Error::InvalidKafkaCluster { .. } => None,
@@ -596,14 +588,11 @@ pub async fn reconcile_kafka(
 
     let mut ss_cond_builder = StatefulSetConditionBuilder::default();
 
-    let (rbac_sa, rbac_rolebinding) = build_rbac_resources(
-        kafka,
-        APP_NAME,
-        cluster_resources
-            .get_required_labels()
-            .context(GetRequiredLabelsSnafu)?,
-    )
-    .context(BuildRbacResourcesSnafu)?;
+    let required_labels = cluster_resources
+        .get_required_labels()
+        .context(GetRequiredLabelsSnafu)?;
+    let rbac_sa = build_rbac_service_account(&validated_cluster, required_labels.clone());
+    let rbac_rolebinding = build_rbac_role_binding(&validated_cluster, required_labels);
 
     let rbac_sa = cluster_resources
         .add(client, rbac_sa.clone())

rust/operator-binary/src/controller/build/resource/mod.rs

@@ -4,5 +4,6 @@ pub mod config_map;
 pub mod discovery;
 pub mod listener;
 pub mod pdb;
+pub mod rbac;
 pub mod service;
 pub mod statefulset;

rust/operator-binary/src/controller/build/resource/rbac.rs

@@ -0,0 +1,81 @@
+//! Builds the cluster-wide RBAC resources (`ServiceAccount` and `RoleBinding`).
+//!
+//! The names come from the v2 [`ResourceNames`](stackable_operator::v2::role_utils::ResourceNames)
+//! and are identical to the previously used `commons::rbac::build_rbac_resources`
+//! (`<cluster>-serviceaccount`, `<cluster>-rolebinding`, `<product>-clusterrole`), so switching to
+//! this builder does not rename any RBAC objects.
+
+use stackable_operator::{
+    builder::meta::ObjectMetaBuilder,
+    k8s_openapi::api::{
+        core::v1::ServiceAccount,
+        rbac::v1::{RoleBinding, RoleRef, Subject},
+    },
+    kvp::Labels,
+    v2::{builder::meta::ownerreference_from_resource, role_utils::ResourceNames},
+};
+
+use crate::controller::{ValidatedCluster, product_name};
+
+/// Type-safe RBAC resource names for this cluster.
+fn rbac_resource_names(validated_cluster: &ValidatedCluster) -> ResourceNames {
+    ResourceNames {
+        cluster_name: validated_cluster.name.clone(),
+        product_name: product_name(),
+    }
+}
+
+/// Builds the [`ServiceAccount`] shared by all role groups, named `<cluster>-serviceaccount`.
+pub fn build_rbac_service_account(
+    validated_cluster: &ValidatedCluster,
+    labels: Labels,
+) -> ServiceAccount {
+    let resource_names = rbac_resource_names(validated_cluster);
+
+    ServiceAccount {
+        metadata: ObjectMetaBuilder::new()
+            .name_and_namespace(validated_cluster)
+            .name(resource_names.service_account_name().to_string())
+            .ownerreference(ownerreference_from_resource(
+                validated_cluster,
+                None,
+                Some(true),
+            ))
+            .with_labels(labels)
+            .build(),
+        ..ServiceAccount::default()
+    }
+}
+
+/// Builds the [`RoleBinding`] (named `<cluster>-rolebinding`) that binds the
+/// [`ServiceAccount`] to the `<product>-clusterrole` `ClusterRole`.
+pub fn build_rbac_role_binding(
+    validated_cluster: &ValidatedCluster,
+    labels: Labels,
+) -> RoleBinding {
+    let resource_names = rbac_resource_names(validated_cluster);
+
+    RoleBinding {
+        metadata: ObjectMetaBuilder::new()
+            .name_and_namespace(validated_cluster)
+            .name(resource_names.role_binding_name().to_string())
+            .ownerreference(ownerreference_from_resource(
+                validated_cluster,
+                None,
+                Some(true),
+            ))
+            .with_labels(labels)
+            .build(),
+        role_ref: RoleRef {
+            api_group: "rbac.authorization.k8s.io".to_string(),
+            kind: "ClusterRole".to_string(),
+            name: resource_names.cluster_role_name().to_string(),
+        },
+        subjects: Some(vec![Subject {
+            kind: "ServiceAccount".to_string(),
+            name: resource_names.service_account_name().to_string(),
+            namespace: Some(validated_cluster.namespace.to_string()),
+            ..Subject::default()
+        }]),
+    }
+}