Skip to content

Commit bb4171f

Browse files
joelanfordjoelanford
committed
Revert ":sparkles: Wire up Service Account (#1038)"
This reverts commit 95b9f0d.
1 parent 95b9f0d commit bb4171f

File tree

7 files changed

+28
-238
lines changed

7 files changed

+28
-238
lines changed

‎cmd/manager/main.go

Lines changed: 0 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -22,17 +22,13 @@ import (
2222
"fmt"
2323
"os"
2424
"path/filepath"
25-
"time"
2625

2726
"github.com/spf13/pflag"
2827
"go.uber.org/zap/zapcore"
2928
apiextensionsv1client "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1"
3029
k8slabels "k8s.io/apimachinery/pkg/labels"
3130
"k8s.io/apimachinery/pkg/selection"
32-
"k8s.io/apimachinery/pkg/types"
33-
corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
3431
_ "k8s.io/client-go/plugin/pkg/client/auth"
35-
"k8s.io/client-go/rest"
3632
ctrl "sigs.k8s.io/controller-runtime"
3733
crcache "sigs.k8s.io/controller-runtime/pkg/cache"
3834
"sigs.k8s.io/controller-runtime/pkg/client"
@@ -46,7 +42,6 @@ import (
4642

4743
ocv1alpha1 "github.com/operator-framework/operator-controller/api/v1alpha1"
4844
"github.com/operator-framework/operator-controller/internal/action"
49-
"github.com/operator-framework/operator-controller/internal/authentication"
5045
"github.com/operator-framework/operator-controller/internal/catalogmetadata/cache"
5146
catalogclient "github.com/operator-framework/operator-controller/internal/catalogmetadata/client"
5247
"github.com/operator-framework/operator-controller/internal/controllers"
@@ -163,34 +158,9 @@ func main() {
163158
ext := obj.(*ocv1alpha1.ClusterExtension)
164159
return ext.Spec.InstallNamespace, nil
165160
})
166-
coreClient, err := corev1client.NewForConfig(mgr.GetConfig())
167-
if err != nil {
168-
setupLog.Error(err, "unable to create core client")
169-
os.Exit(1)
170-
}
171-
tokenGetter := authentication.NewTokenGetter(coreClient, authentication.WithExpirationDuration(1*time.Hour))
172-
173-
restConfigMapper := func(ctx context.Context, o client.Object, c *rest.Config) (*rest.Config, error) {
174-
cExt, ok := o.(*ocv1alpha1.ClusterExtension)
175-
if !ok {
176-
return c, nil
177-
}
178-
namespacedName := types.NamespacedName{
179-
Name: cExt.Spec.ServiceAccount.Name,
180-
Namespace: cExt.Spec.InstallNamespace,
181-
}
182-
token, err := tokenGetter.Get(ctx, namespacedName)
183-
if err != nil {
184-
return nil, fmt.Errorf("failed to extract SA token, %w", err)
185-
}
186-
tempConfig := rest.AnonymousClientConfig(c)
187-
tempConfig.BearerToken = token
188-
return tempConfig, nil
189-
}
190161
cfgGetter, err := helmclient.NewActionConfigGetter(mgr.GetConfig(), mgr.GetRESTMapper(),
191162
helmclient.StorageNamespaceMapper(installNamespaceMapper),
192163
helmclient.ClientNamespaceMapper(installNamespaceMapper),
193-
helmclient.RestConfigMapper(restConfigMapper),
194164
)
195165
if err != nil {
196166
setupLog.Error(err, "unable to config for creating helm client")

‎config/base/rbac/role.yaml

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,11 @@ metadata:
55
name: manager-role
66
rules:
77
- apiGroups:
8-
- apiextensions.k8s.io
8+
- '*'
99
resources:
10-
- customresourcedefinitions
10+
- '*'
1111
verbs:
12-
- get
12+
- '*'
1313
- apiGroups:
1414
- catalogd.operatorframework.io
1515
resources:
@@ -36,21 +36,13 @@ rules:
3636
- patch
3737
- update
3838
- watch
39-
- apiGroups:
40-
- ""
41-
resources:
42-
- serviceaccounts/token
43-
verbs:
44-
- create
4539
- apiGroups:
4640
- olm.operatorframework.io
4741
resources:
4842
- clusterextensions
4943
verbs:
5044
- get
5145
- list
52-
- patch
53-
- update
5446
- watch
5547
- apiGroups:
5648
- olm.operatorframework.io

‎config/samples/olm_v1alpha1_clusterextension.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,4 @@ spec:
77
packageName: argocd-operator
88
version: 0.6.0
99
serviceAccount:
10-
name: default
10+
name: argocd-installer

‎hack/test/pre-upgrade-setup.sh

Lines changed: 1 addition & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -33,42 +33,6 @@ spec:
3333
insecureSkipTLSVerify: true
3434
EOF
3535

36-
kubectl apply -f - <<EOF
37-
apiVersion: v1
38-
kind: ServiceAccount
39-
metadata:
40-
name: upgrade-e2e
41-
namespace: default
42-
EOF
43-
44-
kubectl apply -f - <<EOF
45-
apiVersion: rbac.authorization.k8s.io/v1
46-
kind: ClusterRole
47-
metadata:
48-
name: upgrade-e2e
49-
rules:
50-
- apiGroups:
51-
- "*"
52-
resources:
53-
- "*"
54-
verbs:
55-
- "*"
56-
EOF
57-
58-
kubectl apply -f - <<EOF
59-
apiVersion: rbac.authorization.k8s.io/v1
60-
kind: ClusterRoleBinding
61-
metadata:
62-
name: upgrade-e2e
63-
subjects:
64-
- kind: ServiceAccount
65-
name: upgrade-e2e
66-
namespace: default
67-
roleRef:
68-
apiGroup: rbac.authorization.k8s.io
69-
kind: ClusterRole
70-
name: upgrade-e2e
71-
EOF
7236

7337
kubectl apply -f - << EOF
7438
apiVersion: olm.operatorframework.io/v1alpha1
@@ -80,7 +44,7 @@ spec:
8044
packageName: prometheus
8145
version: 1.0.0
8246
serviceAccount:
83-
name: upgrade-e2e
47+
name: default
8448
EOF
8549

8650
kubectl wait --for=condition=Unpacked --timeout=60s ClusterCatalog $TEST_CLUSTER_CATALOG_NAME

‎internal/controllers/clusterextension_controller.go

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -112,12 +112,11 @@ type Preflight interface {
112112
Upgrade(context.Context, *release.Release) error
113113
}
114114

115-
//+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clusterextensions,verbs=get;list;watch;update;patch
115+
//+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clusterextensions,verbs=get;list;watch
116116
//+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clusterextensions/status,verbs=update;patch
117117
//+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clusterextensions/finalizers,verbs=update
118118
//+kubebuilder:rbac:groups=core,resources=secrets,verbs=create;update;patch;delete;get;list;watch
119-
//+kubebuilder:rbac:groups=core,resources=serviceaccounts/token,verbs=create
120-
//+kubebuilder:rbac:groups=apiextensions.k8s.io,resources=customresourcedefinitions,verbs=get
119+
//+kubebuilder:rbac:groups=*,resources=*,verbs=*
121120

122121
//+kubebuilder:rbac:groups=catalogd.operatorframework.io,resources=clustercatalogs,verbs=list;watch
123122
//+kubebuilder:rbac:groups=catalogd.operatorframework.io,resources=catalogmetadata,verbs=list;watch

‎test/e2e/cluster_extension_install_test.go

Lines changed: 20 additions & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ import (
1616
"gopkg.in/yaml.v2"
1717
appsv1 "k8s.io/api/apps/v1"
1818
corev1 "k8s.io/api/core/v1"
19-
rbacv1 "k8s.io/api/rbac/v1"
2019
"k8s.io/apimachinery/pkg/api/errors"
2120
apimeta "k8s.io/apimachinery/pkg/api/meta"
2221
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -39,65 +38,7 @@ const (
3938
var pollDuration = time.Minute
4039
var pollInterval = time.Second
4140

42-
func createServiceAccount(ctx context.Context, name types.NamespacedName) (*corev1.ServiceAccount, error) {
43-
sa := &corev1.ServiceAccount{
44-
ObjectMeta: metav1.ObjectMeta{
45-
Name: name.Name,
46-
Namespace: name.Namespace,
47-
},
48-
}
49-
err := c.Create(ctx, sa)
50-
if err != nil {
51-
return nil, err
52-
}
53-
cr := &rbacv1.ClusterRole{
54-
ObjectMeta: metav1.ObjectMeta{
55-
Name: name.Name,
56-
},
57-
Rules: []rbacv1.PolicyRule{
58-
{
59-
APIGroups: []string{
60-
"*",
61-
},
62-
Resources: []string{
63-
"*",
64-
},
65-
Verbs: []string{
66-
"*",
67-
},
68-
},
69-
},
70-
}
71-
err = c.Create(ctx, cr)
72-
if err != nil {
73-
return nil, err
74-
}
75-
crb := &rbacv1.ClusterRoleBinding{
76-
ObjectMeta: metav1.ObjectMeta{
77-
Name: name.Name,
78-
},
79-
Subjects: []rbacv1.Subject{
80-
{
81-
Kind: "ServiceAccount",
82-
Name: name.Name,
83-
Namespace: name.Namespace,
84-
},
85-
},
86-
RoleRef: rbacv1.RoleRef{
87-
APIGroup: "rbac.authorization.k8s.io",
88-
Kind: "ClusterRole",
89-
Name: name.Name,
90-
},
91-
}
92-
err = c.Create(ctx, crb)
93-
if err != nil {
94-
return nil, err
95-
}
96-
97-
return sa, nil
98-
}
99-
100-
func testInit(t *testing.T) (*ocv1alpha1.ClusterExtension, *catalogd.ClusterCatalog, *corev1.ServiceAccount) {
41+
func testInit(t *testing.T) (*ocv1alpha1.ClusterExtension, *catalogd.ClusterCatalog) {
10142
var err error
10243
extensionCatalog, err := createTestCatalog(context.Background(), testCatalogName, os.Getenv(testCatalogRefEnvVar))
10344
require.NoError(t, err)
@@ -108,18 +49,10 @@ func testInit(t *testing.T) (*ocv1alpha1.ClusterExtension, *catalogd.ClusterCata
10849
Name: clusterExtensionName,
10950
},
11051
}
111-
112-
defaultNamespace := types.NamespacedName{
113-
Name: clusterExtensionName,
114-
Namespace: "default",
115-
}
116-
117-
sa, err := createServiceAccount(context.Background(), defaultNamespace)
118-
require.NoError(t, err)
119-
return clusterExtension, extensionCatalog, sa
52+
return clusterExtension, extensionCatalog
12053
}
12154

122-
func testCleanup(t *testing.T, cat *catalogd.ClusterCatalog, clusterExtension *ocv1alpha1.ClusterExtension, sa *corev1.ServiceAccount) {
55+
func testCleanup(t *testing.T, cat *catalogd.ClusterCatalog, clusterExtension *ocv1alpha1.ClusterExtension) {
12356
require.NoError(t, c.Delete(context.Background(), cat))
12457
require.Eventually(t, func() bool {
12558
err := c.Get(context.Background(), types.NamespacedName{Name: cat.Name}, &catalogd.ClusterCatalog{})
@@ -130,26 +63,21 @@ func testCleanup(t *testing.T, cat *catalogd.ClusterCatalog, clusterExtension *o
13063
err := c.Get(context.Background(), types.NamespacedName{Name: clusterExtension.Name}, &ocv1alpha1.ClusterExtension{})
13164
return errors.IsNotFound(err)
13265
}, pollDuration, pollInterval)
133-
require.NoError(t, c.Delete(context.Background(), sa))
134-
require.Eventually(t, func() bool {
135-
err := c.Get(context.Background(), types.NamespacedName{Name: sa.Name, Namespace: sa.Namespace}, &corev1.ServiceAccount{})
136-
return errors.IsNotFound(err)
137-
}, pollDuration, pollInterval)
13866
}
13967

14068
func TestClusterExtensionInstallRegistry(t *testing.T) {
14169
t.Log("When a cluster extension is installed from a catalog")
14270
t.Log("When the extension bundle format is registry+v1")
14371

144-
clusterExtension, extensionCatalog, sa := testInit(t)
145-
defer testCleanup(t, extensionCatalog, clusterExtension, sa)
72+
clusterExtension, extensionCatalog := testInit(t)
73+
defer testCleanup(t, extensionCatalog, clusterExtension)
14674
defer getArtifactsOutput(t)
14775

14876
clusterExtension.Spec = ocv1alpha1.ClusterExtensionSpec{
14977
PackageName: "prometheus",
15078
InstallNamespace: "default",
15179
ServiceAccount: ocv1alpha1.ServiceAccountReference{
152-
Name: sa.Name,
80+
Name: "default",
15381
},
15482
}
15583
t.Log("It resolves the specified package with correct bundle path")
@@ -200,8 +128,8 @@ func TestClusterExtensionBlockInstallNonSuccessorVersion(t *testing.T) {
200128
t.Log("When a cluster extension is installed from a catalog")
201129
t.Log("When resolving upgrade edges")
202130

203-
clusterExtension, extensionCatalog, sa := testInit(t)
204-
defer testCleanup(t, extensionCatalog, clusterExtension, sa)
131+
clusterExtension, extensionCatalog := testInit(t)
132+
defer testCleanup(t, extensionCatalog, clusterExtension)
205133
defer getArtifactsOutput(t)
206134

207135
t.Log("By creating an ClusterExtension at a specified version")
@@ -210,7 +138,7 @@ func TestClusterExtensionBlockInstallNonSuccessorVersion(t *testing.T) {
210138
Version: "1.0.0",
211139
InstallNamespace: "default",
212140
ServiceAccount: ocv1alpha1.ServiceAccountReference{
213-
Name: sa.Name,
141+
Name: "default",
214142
},
215143
}
216144
require.NoError(t, c.Create(context.Background(), clusterExtension))
@@ -249,8 +177,8 @@ func TestClusterExtensionForceInstallNonSuccessorVersion(t *testing.T) {
249177
t.Log("When a cluster extension is installed from a catalog")
250178
t.Log("When resolving upgrade edges")
251179

252-
clusterExtension, extensionCatalog, sa := testInit(t)
253-
defer testCleanup(t, extensionCatalog, clusterExtension, sa)
180+
clusterExtension, extensionCatalog := testInit(t)
181+
defer testCleanup(t, extensionCatalog, clusterExtension)
254182
defer getArtifactsOutput(t)
255183

256184
t.Log("By creating an ClusterExtension at a specified version")
@@ -259,7 +187,7 @@ func TestClusterExtensionForceInstallNonSuccessorVersion(t *testing.T) {
259187
Version: "1.0.0",
260188
InstallNamespace: "default",
261189
ServiceAccount: ocv1alpha1.ServiceAccountReference{
262-
Name: sa.Name,
190+
Name: "default",
263191
},
264192
}
265193
require.NoError(t, c.Create(context.Background(), clusterExtension))
@@ -297,8 +225,8 @@ func TestClusterExtensionForceInstallNonSuccessorVersion(t *testing.T) {
297225
func TestClusterExtensionInstallSuccessorVersion(t *testing.T) {
298226
t.Log("When a cluster extension is installed from a catalog")
299227
t.Log("When resolving upgrade edges")
300-
clusterExtension, extensionCatalog, sa := testInit(t)
301-
defer testCleanup(t, extensionCatalog, clusterExtension, sa)
228+
clusterExtension, extensionCatalog := testInit(t)
229+
defer testCleanup(t, extensionCatalog, clusterExtension)
302230
defer getArtifactsOutput(t)
303231

304232
t.Log("By creating an ClusterExtension at a specified version")
@@ -307,7 +235,7 @@ func TestClusterExtensionInstallSuccessorVersion(t *testing.T) {
307235
Version: "1.0.0",
308236
InstallNamespace: "default",
309237
ServiceAccount: ocv1alpha1.ServiceAccountReference{
310-
Name: sa.Name,
238+
Name: "default",
311239
},
312240
}
313241
require.NoError(t, c.Create(context.Background(), clusterExtension))
@@ -344,15 +272,15 @@ func TestClusterExtensionInstallSuccessorVersion(t *testing.T) {
344272
func TestClusterExtensionInstallReResolvesWhenCatalogIsPatched(t *testing.T) {
345273
t.Log("When a cluster extension is installed from a catalog")
346274
t.Log("It resolves again when a catalog is patched with new ImageRef")
347-
clusterExtension, extensionCatalog, sa := testInit(t)
348-
defer testCleanup(t, extensionCatalog, clusterExtension, sa)
275+
clusterExtension, extensionCatalog := testInit(t)
276+
defer testCleanup(t, extensionCatalog, clusterExtension)
349277
defer getArtifactsOutput(t)
350278

351279
clusterExtension.Spec = ocv1alpha1.ClusterExtensionSpec{
352280
PackageName: "prometheus",
353281
InstallNamespace: "default",
354282
ServiceAccount: ocv1alpha1.ServiceAccountReference{
355-
Name: sa.Name,
283+
Name: "default",
356284
},
357285
}
358286
t.Log("It resolves the specified package with correct bundle path")
@@ -423,16 +351,14 @@ func TestClusterExtensionInstallReResolvesWhenNewCatalog(t *testing.T) {
423351
Name: clusterExtensionName,
424352
},
425353
}
426-
sa, err := createServiceAccount(context.Background(), types.NamespacedName{Name: clusterExtensionName, Namespace: "default"})
427-
require.NoError(t, err)
428-
defer testCleanup(t, extensionCatalog, clusterExtension, sa)
354+
defer testCleanup(t, extensionCatalog, clusterExtension)
429355
defer getArtifactsOutput(t)
430356

431357
clusterExtension.Spec = ocv1alpha1.ClusterExtensionSpec{
432358
PackageName: "prometheus",
433359
InstallNamespace: "default",
434360
ServiceAccount: ocv1alpha1.ServiceAccountReference{
435-
Name: sa.Name,
361+
Name: "default",
436362
},
437363
}
438364
t.Log("It resolves the specified package with correct bundle path")

0 commit comments

Comments
 (0)