Add new operator capability to check if it has access to do an operation #2467
Conversation
|
cc @rashmichandrashekar :) |
jaronoff97
requested review from
pavolloffay,
rashmichandrashekar,
iblancasa and
swiatekm
this is how it looks in practice. I'm returning the go struct, lmk if you think i should do some work to return this in a better way. I didn't feel like we should be in the business of pretty printing a non-operator struct, but i can be swayed. |
This struct looks pretty small, I think we can do better. Maybe marshal it to yaml or json with an indent? Or at least display a single message with missing permissions in a list? |
I think the last option would be the most useful. |
|
|
…ion (open-telemetry#2467) * rbac pr testing * makefile convenience * Add test * add chlog * Add a comment * update to allow for policy rule checking * change package * lint fail * better formatting * don't use leading slash for empty group * add more detail for comment
Description:
Adds a new rbac package for checking if a given serviceaccount is able to do an RBAC gated action. This includes a warning for an upcoming target allocator capability (#2328) as an example ahead of that PRs merging.
Link to tracking Issue: closes #2426
Testing: unit tests were added, as well as manual testing in a kind cluster
Documentation: new admissions warnings!