[release-1.29] Fix serves metrics securely test (#1860)#1867

bundle/manifests/metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml → bundle/manifests/sailoperator-metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml

@@ -5,11 +5,11 @@ metadata:
   labels:
     app.kubernetes.io/component: kube-rbac-proxy
     app.kubernetes.io/created-by: sailoperator
-    app.kubernetes.io/instance: metrics-reader
+    app.kubernetes.io/instance: sailoperator-metrics-reader
     app.kubernetes.io/managed-by: helm
     app.kubernetes.io/name: clusterrole
     app.kubernetes.io/part-of: sailoperator
-  name: metrics-reader
+  name: sailoperator-metrics-reader
 rules:
 - nonResourceURLs:
   - /metrics

chart/templates/rbac/auth_proxy_client_clusterrole.yaml

@@ -4,11 +4,11 @@ metadata:
   labels:
     app.kubernetes.io/created-by: {{ .Values.name }}
     app.kubernetes.io/name: clusterrole
-    app.kubernetes.io/instance: metrics-reader
+    app.kubernetes.io/instance: {{ .Values.name }}-metrics-reader
     app.kubernetes.io/component: kube-rbac-proxy
     app.kubernetes.io/managed-by: helm
     app.kubernetes.io/part-of: {{ .Values.name }}
-  name: metrics-reader
+  name: {{ .Values.name }}-metrics-reader
 rules:
 - nonResourceURLs:
   - "/metrics"

tests/e2e/cleanup-ocp.sh

@@ -183,10 +183,10 @@ cleanup_cluster_resources() {
   echo "=== Cleaning up cluster-level resources ==="
 
   echo "Removing cluster role bindings..."
-  ${COMMAND} delete clusterrolebinding metrics-reader-rolebinding --ignore-not-found
+  ${COMMAND} delete clusterrolebinding metrics-reader-test-rolebinding --ignore-not-found
 
   echo "Removing cluster roles..."
-  ${COMMAND} delete clusterrole metrics-reader --ignore-not-found
+  ${COMMAND} delete clusterrole "${OPERATOR_NAME}-metrics-reader" --ignore-not-found
 }
 
 # Main cleanup flow following official documentation order

tests/e2e/operator/operator_install_test.go

@@ -22,6 +22,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strings"
 	"time"
 
 	"github.com/istio-ecosystem/sail-operator/pkg/env"
@@ -94,15 +95,18 @@ var _ = Describe("Operator", Label("smoke", "operator"), Ordered, func() {
 		})
 
 		It("serves metrics securely", func(ctx SpecContext) {
-			metricsReaderRoleName := "metrics-reader"
+			By("discovering the metrics reader ClusterRole installed on the cluster")
+			metricsReaderRoleName, err := discoverMetricsReaderClusterRole()
+			Expect(err).NotTo(HaveOccurred(), "metrics reader ClusterRole must exist")
+
 			metricsServiceName := deploymentName + "-metrics-service"
 
 			By("creating a ClusterRoleBinding for the service account to allow access to metrics")
-			err := k.CreateFromString(fmt.Sprintf(`
+			err = k.CreateFromString(fmt.Sprintf(`
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: metrics-reader-rolebinding
+  name: metrics-reader-test-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -207,6 +211,39 @@ func extractCRDNames(crdList *apiextensionsv1.CustomResourceDefinitionList) []st
 	return names
 }
 
+const metricsReaderClusterRoleLabel = "app.kubernetes.io/component=kube-rbac-proxy"
+
+// discoverMetricsReaderClusterRole lists ClusterRoles with the kube-rbac-proxy component label
+// (same as chart/bundle), then picks the one whose name ends with "-metrics-reader".
+func discoverMetricsReaderClusterRole() (string, error) {
+	out, err := k.GetClusterRoleNamesByLabel(metricsReaderClusterRoleLabel)
+	if err != nil {
+		return "", err
+	}
+	var matches []string
+	for _, line := range strings.Split(strings.TrimSpace(out), "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		name := line
+		if i := strings.LastIndex(line, "/"); i >= 0 {
+			name = line[i+1:]
+		}
+		if strings.HasSuffix(name, "-metrics-reader") {
+			matches = append(matches, name)
+		}
+	}
+	switch len(matches) {
+	case 0:
+		return "", fmt.Errorf("no *-metrics-reader ClusterRole under label %s", metricsReaderClusterRoleLabel)
+	case 1:
+		return matches[0], nil
+	default:
+		return "", fmt.Errorf("ambiguous *-metrics-reader ClusterRoles: %v", matches)
+	}
+}
+
 // serviceAccountToken returns a token for the specified service account in the given namespace.
 // It uses the Kubernetes TokenRequest API to generate a token by directly sending a request
 // and parsing the resulting token from the API response.

tests/e2e/util/kubectl/kubectl.go

@@ -214,6 +214,17 @@ func (k Kubectl) GetYAML(kind, name string) (string, error) {
 	return output, nil
 }
 
+// GetClusterRoleNamesByLabel runs `kubectl|oc get clusterrole -l <selector> -o name` (cluster-scoped; no namespace).
+func (k Kubectl) GetClusterRoleNamesByLabel(labelSelector string) (string, error) {
+	cmd := k.build(fmt.Sprintf(" get clusterrole -l %q -o name", labelSelector))
+	output, err := k.executeCommand(cmd)
+	if err != nil {
+		return "", fmt.Errorf("error listing clusterroles: %w, output: %s", err, output)
+	}
+
+	return output, nil
+}
+
 // GetPods returns the pods of a namespace
 func (k Kubectl) GetPods(args ...string) (string, error) {
 	cmd := k.build(fmt.Sprintf(" get pods %s", strings.Join(args, " ")))