feat: implement cmpd's PolicyRules #8328
Conversation
cjc7373
changed the title
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #8328 +/- ##
==========================================
- Coverage 61.27% 61.15% -0.12%
==========================================
Files 351 352 +1
Lines 41752 41739 -13
==========================================
- Hits 25584 25527 -57
- Misses 13870 13900 +30
- Partials 2298 2312 +14
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
cjc7373
force-pushed
the
feature/rbac-for-component
branch
from
8c646de
to
ea9c0a7
Compare
|
relevant addon PR: apecloud/kubeblocks-addons#1197 |
| // Users can override the automatic ServiceAccount assignment by explicitly setting the name of | ||
| // an existed ServiceAccount in this field. | ||
| // If the field is not empty, the specified ServiceAccount will be used. And KubeBlocks will not | ||
| // create a ServiceAccount, nor create RoleBinding accordingly. |
There was a problem hiding this comment.
Should the controller still need to bind these rules defined in kubeblocks-cluster-pod-role in case they are not bound by the user?
There was a problem hiding this comment.
The rules in cmpd are the same.
There was a problem hiding this comment.
Since this field only involves the declaration of the service account (name) and does not pertain to the rules bound.
| // The service account will be bound to a default role named "kubeblocks-cluster-pod-role" which is installed together with KubeBlocks. | ||
| // If not specified, KubeBlocks automatically assigns a default ServiceAccount named "kb-{cluster.name}" | ||
| // If not specified, KubeBlocks automatically creates a default ServiceAccount named | ||
| // "kb-{cluster.name}-{component.name}", bound to a role with rules defined in ComponentDefinition's |
There was a problem hiding this comment.
As a further improvement, components with the same cmp can share a default service account.
| @@ -59,28 +55,5 @@ func skipSetCompOwnershipNFinalizer(obj client.Object) bool { | |||
| } | |||
|
|
|||
| func addFinalizer(obj client.Object, comp *appsv1.Component) { | |||
There was a problem hiding this comment.
Can be removed and use controllerutil.AddFinalizer directly.
Fixes #8310. Things done in this PR:
serviceAccountNamein cluster and component CR. KB now does not create rbac resources if user has specified a service account.kb-<clusterName>-<compName>.TODO: