OpenShift compatibility (#352)

Author: razvan

CHANGELOG.md

@@ -16,10 +16,11 @@
   This change is breaking, because - for security reasons - we default to the `cluster-internal` `ListenerClass`.
   If you need your cluster to be accessible from outside of Kubernetes you need to set `clusterConfig.listenerClass`
   to `external-unstable` or `external-stable` ([#350]).
-- `operator-rs` `0.31.0` -> `0.35.0` ([#322], [#326]).
+- `operator-rs` `0.31.0` -> `0.35.0` -> `0.40.2`  ([#322], [#326], [#352]).
 - Bumped stackable image versions to "23.4.0-rc2" ([#322], [#326]).
 - Fragmented `SupersetConfig` ([#323]).
 - Restructured documentation ([#344]).
+- Create `ServiceAccount` for Superset clusters. Use `build_rbac_resources()` from operator-rs ([#352])
 
 [#322]: https://github.com/stackabletech/superset-operator/pull/322
 [#323]: https://github.com/stackabletech/superset-operator/pull/323
@@ -29,6 +30,7 @@
 [#348]: https://github.com/stackabletech/superset-operator/pull/348
 [#349]: https://github.com/stackabletech/superset-operator/pull/349
 [#350]: https://github.com/stackabletech/superset-operator/pull/350
+[#352]: https://github.com/stackabletech/superset-operator/pull/352
 
 ## [23.1.0] - 2023-01-23
 

Cargo.lock

@@ -110,3 +110,88 @@ rules:
       - get
       - list
       - watch
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    resources:
+      - clusterroles
+    verbs:
+      - bind
+    resourceNames:
+      - {{ include "operator.name" . }}-clusterrole
+
+{{ if .Capabilities.APIVersions.Has "security.openshift.io/v1" }}
+---
+apiVersion: security.openshift.io/v1
+kind: SecurityContextConstraints
+metadata:
+  name: superset-scc
+  annotations:
+    kubernetes.io/description: |-
+      This resource is derived from hostmount-anyuid. It provides all the features of the
+      restricted SCC but allows host mounts and any UID by a pod.  This is primarily
+      used by the persistent volume recycler. WARNING: this SCC allows host file
+      system access as any UID, including UID 0.  Grant with caution.
+    release.openshift.io/create-only: "true"
+allowHostDirVolumePlugin: true
+allowHostIPC: false
+allowHostNetwork: false
+allowHostPID: false
+allowHostPorts: false
+allowPrivilegeEscalation: true
+allowPrivilegedContainer: false
+allowedCapabilities: null
+defaultAddCapabilities: null
+fsGroup:
+  type: RunAsAny
+groups: []
+priority: null
+readOnlyRootFilesystem: false
+requiredDropCapabilities:
+- MKNOD
+runAsUser:
+  type: RunAsAny
+seLinuxContext:
+  type: MustRunAs
+supplementalGroups:
+  type: RunAsAny
+volumes:
+- configMap
+- downwardAPI
+- emptyDir
+- hostPath
+- nfs
+- persistentVolumeClaim
+- projected
+- secret
+- ephemeral
+{{ end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "operator.name" . }}-clusterrole
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+      - secrets
+      - serviceaccounts
+    verbs:
+      - get
+  - apiGroups:
+      - events.k8s.io
+    resources:
+      - events
+    verbs:
+      - create
+{{ if .Capabilities.APIVersions.Has "security.openshift.io/v1" }}
+  - apiGroups:
+      - security.openshift.io
+    resources:
+      - securitycontextconstraints
+    resourceNames:
+      - superset-scc
+    verbs:
+      - use
+{{ end }}

deploy/helm/superset-operator/templates/roles.yaml

@@ -11,7 +11,7 @@ publish = false
 [dependencies]
 serde = "1.0"
 serde_json = "1.0"
-stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "0.39.0" }
+stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "0.40.2" }
 strum = { version = "0.24", features = ["derive"] }
 snafu = "0.7"
 tracing = "0.1"

rust/crd/Cargo.toml

@@ -16,13 +16,13 @@ futures = { version = "0.3", features = ["compat"] }
 indoc = "1.0"
 serde = "1.0"
 snafu = "0.7"
-stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "0.39.0" }
+stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "0.40.2" }
 stackable-superset-crd = { path = "../crd" }
 strum = { version = "0.24", features = ["derive"] }
 tokio = { version = "1.25", features = ["macros", "rt-multi-thread"] }
 tracing = "0.1"
 
 [build-dependencies]
 built = { version =  "0.5", features = ["chrono", "git2"] }
-stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "0.39.0" }
+stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "0.40.2" }
 stackable-superset-crd = { path = "../crd" }

rust/operator-binary/Cargo.toml

@@ -1,10 +1,10 @@
 use crate::util::{get_job_state, JobState};
 
-use crate::superset_controller::DOCKER_IMAGE_BASE_NAME;
+use crate::{rbac, superset_controller::DOCKER_IMAGE_BASE_NAME, APP_NAME};
 use snafu::{OptionExt, ResultExt, Snafu};
 use stackable_operator::commons::product_image_selection::ResolvedProductImage;
 use stackable_operator::{
-    builder::{ContainerBuilder, ObjectMetaBuilder},
+    builder::{ContainerBuilder, ObjectMetaBuilder, PodSecurityContextBuilder},
     client::Client,
     k8s_openapi::api::{
         batch::v1::{Job, JobSpec},
@@ -72,6 +72,14 @@ pub enum Error {
         source: stackable_superset_crd::druidconnection::Error,
         druid_connection: ObjectRef<DruidConnection>,
     },
+    #[snafu(display("failed to patch service account"))]
+    ApplyServiceAccount {
+        source: stackable_operator::error::Error,
+    },
+    #[snafu(display("failed to patch role binding"))]
+    ApplyRoleBinding {
+        source: stackable_operator::error::Error,
+    },
 }
 
 type Result<T, E = Error> = std::result::Result<T, E>;
@@ -96,6 +104,8 @@ impl ReconcilerError for Error {
             Error::DruidConnectionNoNamespace {
                 druid_connection, ..
             } => Some(druid_connection.clone().erase()),
+            Error::ApplyServiceAccount { .. } => None,
+            Error::ApplyRoleBinding { .. } => None,
         }
     }
 }
@@ -108,6 +118,21 @@ pub async fn reconcile_druid_connection(
 
     let client = &ctx.client;
 
+    let (rbac_sa, rbac_rolebinding) =
+        rbac::build_rbac_resources(druid_connection.as_ref(), APP_NAME);
+    client
+        .apply_patch(DRUID_CONNECTION_CONTROLLER_NAME, &rbac_sa, &rbac_sa)
+        .await
+        .context(ApplyServiceAccountSnafu)?;
+    client
+        .apply_patch(
+            DRUID_CONNECTION_CONTROLLER_NAME,
+            &rbac_rolebinding,
+            &rbac_rolebinding,
+        )
+        .await
+        .context(ApplyRoleBindingSnafu)?;
+
     if let Some(ref s) = druid_connection.status {
         match s.condition {
             DruidConnectionStatusCondition::Pending => {
@@ -172,6 +197,7 @@ pub async fn reconcile_druid_connection(
                         &druid_connection,
                         &resolved_product_image,
                         &sqlalchemy_str,
+                        &rbac_sa.name_any(),
                     )
                     .await?;
                     client
@@ -266,6 +292,7 @@ async fn build_import_job(
     druid_connection: &DruidConnection,
     resolved_product_image: &ResolvedProductImage,
     sqlalchemy_str: &str,
+    sa_name: &str,
 ) -> Result<Job> {
     let mut commands = vec![];
 
@@ -301,6 +328,13 @@ async fn build_import_job(
             containers: vec![container],
             image_pull_secrets: resolved_product_image.pull_secrets.clone(),
             restart_policy: Some("Never".to_string()),
+            service_account: Some(sa_name.to_string()),
+            security_context: Some(
+                PodSecurityContextBuilder::new()
+                    .run_as_user(1000)
+                    .run_as_group(0)
+                    .build(),
+            ),
             ..Default::default()
         }),
     };

rust/operator-binary/src/druid_connection_controller.rs

@@ -2,6 +2,7 @@ mod config;
 mod controller_commons;
 mod druid_connection_controller;
 mod product_logging;
+mod rbac;
 mod superset_controller;
 mod superset_db_controller;
 mod util;

rust/operator-binary/src/main.rs

@@ -0,0 +1,44 @@
+use stackable_operator::builder::ObjectMetaBuilder;
+use stackable_operator::k8s_openapi::api::core::v1::ServiceAccount;
+use stackable_operator::k8s_openapi::api::rbac::v1::{RoleBinding, RoleRef, Subject};
+use stackable_operator::kube::{Resource, ResourceExt};
+
+/// Obsolete: only used in the DB controller for historical reasons. Scheduled for deletion
+/// once the entire DB controller is deleted as discused here: <https://github.com/stackabletech/superset-operator/issues/351>
+///
+/// Build RBAC objects for the product workloads.
+/// The `rbac_prefix` is meant to be the product name, for example: zookeeper, airflow, etc.
+/// and it is a assumed that a ClusterRole named `{rbac_prefix}-clusterrole` exists.
+pub fn build_rbac_resources<T: Resource>(
+    resource: &T,
+    rbac_prefix: &str,
+) -> (ServiceAccount, RoleBinding) {
+    let sa_name = format!("{rbac_prefix}-sa");
+    let service_account = ServiceAccount {
+        metadata: ObjectMetaBuilder::new()
+            .name_and_namespace(resource)
+            .name(sa_name.clone())
+            .build(),
+        ..ServiceAccount::default()
+    };
+
+    let role_binding = RoleBinding {
+        metadata: ObjectMetaBuilder::new()
+            .name_and_namespace(resource)
+            .name(format!("{rbac_prefix}-rolebinding"))
+            .build(),
+        role_ref: RoleRef {
+            kind: "ClusterRole".to_string(),
+            name: format!("{rbac_prefix}-clusterrole"),
+            api_group: "rbac.authorization.k8s.io".to_string(),
+        },
+        subjects: Some(vec![Subject {
+            kind: "ServiceAccount".to_string(),
+            name: sa_name,
+            namespace: resource.namespace(),
+            ..Subject::default()
+        }]),
+    };
+
+    (service_account, role_binding)
+}