Repository navigation
fix(cli): the admin-less install keeps conformity's Role only when the account may grant it - #452
Merged
Merged
Conversation
…s profile kates deploy asks `kubectl auth can-i '*' '*' --all-namespaces` before anything else. A cluster admin gets the full profile, as before. Any other account is told why and, on a terminal, offered the admin-less profile; with --yes or without a terminal it stops and prints the command. `kates deploy --adminless` installs Kafka, Kafka Connect with its PostgreSQL, MirrorMaker 2, Apicurio, Kafka UI and Kates (rbac.scope=namespace) into one existing namespace (--namespace, default the kube context's). It skips every cluster-scoped step: Strimzi, cert-manager, Kyverno, monitoring, Litmus, node introspection and namespace creation, and refuses the flags that ask for them. Before installing it checks that Strimzi's resources exist and that the account may create what the stack needs in the namespace, naming what is missing. The Kafka version follows the repository's Strimzi pin, since the installed operator can't be read without cluster-wide reads, and the DNS domain is taken to be cluster.local.
…spaces `kates deploy --adminless` no longer forces --topology single. It follows --topology and the --*-ns flags as a full deploy does, so by default each component goes into its own namespace (Kafka, Connect, PostgreSQL, Kates, Kafka UI, MirrorMaker 2), all of which must exist. --topology single still puts everything in --namespace, or the kube context's namespace. The prerequisite check now asks, per namespace, for what is created there: the core resources in every one, and Strimzi's where each is made (the Kafka cluster, topics and users in the Kafka namespace, Connect's in the Connect namespace, MirrorMaker 2's in its own). A refusal names its namespace.
…e account may grant it The kates chart's namespace-scope Role in the Kafka namespace grants get on kafkas and list on kafkanodepools, pods, persistentvolumeclaims, podmonitors and endpointslices. RBAC lets an account create a Role only for permissions it holds, and the built-in admin role has no PodMonitor reads, so a team account's Kates install could be refused. `kates deploy --adminless` now asks `kubectl auth can-i` for each of those reads in the Kafka namespace. When all are held the Role is installed and conformity checks work. Otherwise Kates installs with rbac.kafkaNamespaceRole=false, and deploy names the missing reads and prints, before the install and again at the end, the `helm template ... | kubectl apply` command an account that holds them runs to turn conformity on.
# Conflicts: # cli/cmd/deploy.go # cli/cmd/deploy_adminless.go # cli/cmd/deploy_adminless_test.go # cli/cmd/deploy_components.go # docs/book/12-deployment.md
bmscomp
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Follow-up to #451.
kates deploy --adminlessinstalls Kates withrbac.scope=namespace, whose chart creates a read-only Role in the Kafka namespace for conformity checks. It grants get on kafkas and list on kafkanodepools, pods, persistentvolumeclaims, podmonitors and endpointslices. RBAC lets an account create a Role only for permissions it holds, and the built-inadminrole has no PodMonitor reads, so a team account's Kates install could be refused partway through.What changes
kates deploy --adminlessaskskubectl auth can-ifor each of those reads in the Kafka namespace.rbac.kafkaNamespaceRole=false. Deploy names the missing reads and prints, before the install and again at the end, thehelm template ... | kubectl applycommand that an account holding them runs to turn conformity on.Tests
TestRunDeploy_AdminlessConformityRoleFollowsTheGrantscovers both paths, the--setand the printed command.go vet,go test ./...,golangci-lint --new-from-rev=origin/main(0 issues),govulncheck.check-cli-style.sh,check-cli-compat.sh,check-book-style.sh../mvnw test.gen-version-matrix.sh --checkandgen-chart-table.sh --checkfail locally only because of a leftover untrackedcharts/miniodirectory, which CI's checkout doesn't have.*ITtests, native image, Kind integration tests, Docker builds, CodeQL and Trivy.The branch merged main after #451 squashed its first two commits. Squash with 5f035e5's message.