diff --git a/pkg/controller/operators/olm/operator_test.go b/pkg/controller/operators/olm/operator_test.go index d4b0c0c3a4..d8003c95d4 100644 --- a/pkg/controller/operators/olm/operator_test.go +++ b/pkg/controller/operators/olm/operator_test.go @@ -8,6 +8,7 @@ import ( "crypto/x509" "crypto/x509/pkix" "encoding/pem" + "errors" "fmt" "math" "math/big" @@ -51,6 +52,9 @@ import ( operatorsv1 "github.com/operator-framework/api/pkg/operators/v1" "github.com/operator-framework/api/pkg/operators/v1alpha1" + opregistry "github.com/operator-framework/operator-registry/pkg/registry" + clienttesting "k8s.io/client-go/testing" + "github.com/operator-framework/operator-lifecycle-manager/pkg/api/client/clientset/versioned" "github.com/operator-framework/operator-lifecycle-manager/pkg/api/client/clientset/versioned/fake" "github.com/operator-framework/operator-lifecycle-manager/pkg/controller/certs" @@ -65,8 +69,6 @@ import ( "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/ownerutil" "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/queueinformer" "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/scoped" - opregistry "github.com/operator-framework/operator-registry/pkg/registry" - clienttesting "k8s.io/client-go/testing" ) type TestStrategy struct{} @@ -933,8 +935,7 @@ func TestTransitionCSV(t *testing.T) { }, ObjectMeta: metav1.ObjectMeta{ Name: "default", - Namespace: namespace, - }, + Namespace: namespace}, Spec: operatorsv1.OperatorGroupSpec{}, Status: operatorsv1.OperatorGroupStatus{ Namespaces: []string{namespace}, @@ -2224,8 +2225,7 @@ func TestTransitionCSV(t *testing.T) { }, ObjectMeta: metav1.ObjectMeta{ Name: "default-2", - Namespace: namespace, - }, + Namespace: namespace}, Spec: operatorsv1.OperatorGroupSpec{}, Status: operatorsv1.OperatorGroupStatus{ Namespaces: []string{namespace}, @@ -2272,8 +2272,7 @@ func TestTransitionCSV(t *testing.T) { }, ObjectMeta: metav1.ObjectMeta{ Name: "default", - Namespace: namespace, - }, + Namespace: namespace}, Spec: operatorsv1.OperatorGroupSpec{}, Status: operatorsv1.OperatorGroupStatus{ Namespaces: []string{namespace, "new-namespace"}, @@ -3731,8 +3730,7 @@ func TestUpdates(t *testing.T) { }, ObjectMeta: metav1.ObjectMeta{ Name: "default", - Namespace: namespace, - }, + Namespace: namespace}, Spec: operatorsv1.OperatorGroupSpec{ TargetNamespaces: []string{namespace}, }, @@ -4422,8 +4420,7 @@ func TestSyncOperatorGroups(t *testing.T) { operatorGroup: &operatorsv1.OperatorGroup{ ObjectMeta: metav1.ObjectMeta{ Name: "operator-group-1", - Namespace: operatorNamespace, - }, + Namespace: operatorNamespace}, Spec: operatorsv1.OperatorGroupSpec{ Selector: &metav1.LabelSelector{ MatchLabels: map[string]string{"a": "app-a"}, @@ -4452,8 +4449,7 @@ func TestSyncOperatorGroups(t *testing.T) { operatorGroup: &operatorsv1.OperatorGroup{ ObjectMeta: metav1.ObjectMeta{ Name: "operator-group-1", - Namespace: operatorNamespace, - }, + Namespace: operatorNamespace}, Spec: operatorsv1.OperatorGroupSpec{ Selector: &metav1.LabelSelector{ MatchLabels: map[string]string{"a": "app-a"}, @@ -4494,7 +4490,40 @@ func TestSyncOperatorGroups(t *testing.T) { operatorGroup: &operatorsv1.OperatorGroup{ ObjectMeta: metav1.ObjectMeta{ Name: "operator-group-1", - Namespace: operatorNamespace, + Namespace: operatorNamespace}, + Spec: operatorsv1.OperatorGroupSpec{ + Selector: &metav1.LabelSelector{ + MatchLabels: map[string]string{"app": "app-a"}, + }, + }, + }, + k8sObjs: []runtime.Object{ + &corev1.Namespace{ + ObjectMeta: metav1.ObjectMeta{ + Name: operatorNamespace, + }, + }, + &corev1.Namespace{ + ObjectMeta: metav1.ObjectMeta{ + Name: targetNamespace, + Labels: map[string]string{"app": "app-a"}, + }, + }, + }, + }, + expectedStatus: operatorsv1.OperatorGroupStatus{ + Namespaces: []string{targetNamespace}, + LastUpdated: &now, + }, + }, + { + name: "MatchingNamespace/NoCSVs/CreatesClusterRoles", + expectedEqual: true, + initial: initial{ + operatorGroup: &operatorsv1.OperatorGroup{ + ObjectMeta: metav1.ObjectMeta{ + Name: "operator-group-1", + Namespace: operatorNamespace, Labels: map[string]string{"app": "app-a"}, }, Spec: operatorsv1.OperatorGroupSpec{ Selector: &metav1.LabelSelector{ @@ -4520,16 +4549,403 @@ func TestSyncOperatorGroups(t *testing.T) { Namespaces: []string{targetNamespace}, LastUpdated: &now, }, + final: final{objects: map[string][]runtime.Object{ + "": { + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "olm.og.operator-group-1.admin-8rdAjL0E35JMMAkOqYmoorzjpIIihfnj3DcgDU", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + }, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "olm.og.operator-group-1.edit-9lBEUxqAYE7CX7wZfFEPYutTfQTo43WarB08od", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + }, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "olm.og.operator-group-1.view-1l6ymczPK5SceF4d0DCtAnWZuvmKn6s8oBUxHr", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + }, + }, + }, + }, + }}, }, { - name: "MatchingNamespace/CSVPresent/Found", + // check that even if cluster roles exist without the naming convention, we create the new ones and leave the old ones unchanged + name: "MatchingNamespace/NoCSVs/KeepOldClusterRoles", expectedEqual: true, initial: initial{ operatorGroup: &operatorsv1.OperatorGroup{ ObjectMeta: metav1.ObjectMeta{ Name: "operator-group-1", - Namespace: operatorNamespace, + Namespace: operatorNamespace}, + Spec: operatorsv1.OperatorGroupSpec{ + Selector: &metav1.LabelSelector{ + MatchLabels: map[string]string{"app": "app-a"}, + }, }, + }, + k8sObjs: []runtime.Object{ + &corev1.Namespace{ + ObjectMeta: metav1.ObjectMeta{ + Name: operatorNamespace, + }, + }, + &corev1.Namespace{ + ObjectMeta: metav1.ObjectMeta{ + Name: targetNamespace, + Labels: map[string]string{"app": "app-a"}, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "operator-group-1-admin", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + }, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "operator-group-1-view", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + }, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "operator-group-1-edit", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + }, + }, + }, + }, + }, + expectedStatus: operatorsv1.OperatorGroupStatus{ + Namespaces: []string{targetNamespace}, + LastUpdated: &now, + }, + final: final{objects: map[string][]runtime.Object{ + "": { + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "olm.og.operator-group-1.admin-8rdAjL0E35JMMAkOqYmoorzjpIIihfnj3DcgDU", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + }, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "olm.og.operator-group-1.edit-9lBEUxqAYE7CX7wZfFEPYutTfQTo43WarB08od", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + }, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "olm.og.operator-group-1.view-1l6ymczPK5SceF4d0DCtAnWZuvmKn6s8oBUxHr", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + }, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "operator-group-1-admin", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + }, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "operator-group-1-view", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + }, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "operator-group-1-edit", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + }, + }, + }, + }, + }}, + }, + { + // ensure that ownership labels are fixed but user labels are preserved + name: "MatchingNamespace/NoCSVs/ClusterRoleOwnershipLabels", + expectedEqual: true, + initial: initial{ + operatorGroup: &operatorsv1.OperatorGroup{ + ObjectMeta: metav1.ObjectMeta{ + Name: "operator-group-1", + Namespace: operatorNamespace}, + Spec: operatorsv1.OperatorGroupSpec{ + Selector: &metav1.LabelSelector{ + MatchLabels: map[string]string{"app": "app-a"}, + }, + }, + }, + k8sObjs: []runtime.Object{ + &corev1.Namespace{ + ObjectMeta: metav1.ObjectMeta{ + Name: operatorNamespace, + }, + }, + &corev1.Namespace{ + ObjectMeta: metav1.ObjectMeta{ + Name: targetNamespace, + Labels: map[string]string{"app": "app-a"}, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "olm.og.operator-group-1.admin-8rdAjL0E35JMMAkOqYmoorzjpIIihfnj3DcgDU", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns-bob", + "olm.owner.kind": "OperatorGroup", + "not.an.olm.label": "true", + }, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "olm.og.operator-group-1.view-1l6ymczPK5SceF4d0DCtAnWZuvmKn6s8oBUxHr", + Labels: map[string]string{ + "olm.owner": "operator-group-5", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + "not.an.olm.label": "false", + "another.olm.label": "or maybe not", + }, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "olm.og.operator-group-1.edit-9lBEUxqAYE7CX7wZfFEPYutTfQTo43WarB08od", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroupKind", + }, + }, + }, + }, + }, + expectedStatus: operatorsv1.OperatorGroupStatus{ + Namespaces: []string{targetNamespace}, + LastUpdated: &now, + }, + final: final{objects: map[string][]runtime.Object{ + "": { + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "olm.og.operator-group-1.admin-8rdAjL0E35JMMAkOqYmoorzjpIIihfnj3DcgDU", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + "not.an.olm.label": "true", + }, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "olm.og.operator-group-1.edit-9lBEUxqAYE7CX7wZfFEPYutTfQTo43WarB08od", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + }, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "olm.og.operator-group-1.view-1l6ymczPK5SceF4d0DCtAnWZuvmKn6s8oBUxHr", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + "not.an.olm.label": "false", + "another.olm.label": "or maybe not", + }, + }, + }, + }, + }}, + }, + { + // if a cluster role exists with the correct name, use that + name: "MatchingNamespace/NoCSVs/DoesNotUpdateClusterRoles", + expectedEqual: true, + initial: initial{ + operatorGroup: &operatorsv1.OperatorGroup{ + ObjectMeta: metav1.ObjectMeta{ + Name: "operator-group-1", + Namespace: operatorNamespace}, + Spec: operatorsv1.OperatorGroupSpec{ + Selector: &metav1.LabelSelector{ + MatchLabels: map[string]string{"app": "app-a"}, + }, + }, + }, + k8sObjs: []runtime.Object{ + &corev1.Namespace{ + ObjectMeta: metav1.ObjectMeta{ + Name: operatorNamespace, + }, + }, + &corev1.Namespace{ + ObjectMeta: metav1.ObjectMeta{ + Name: targetNamespace, + Labels: map[string]string{"app": "app-a"}, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "olm.og.operator-group-1.admin-8rdAjL0E35JMMAkOqYmoorzjpIIihfnj3DcgDU", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + }, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "olm.og.operator-group-1.edit-9lBEUxqAYE7CX7wZfFEPYutTfQTo43WarB08od", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + }, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "olm.og.operator-group-1.view-1l6ymczPK5SceF4d0DCtAnWZuvmKn6s8oBUxHr", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + }, + }, + }}, + }, + expectedStatus: operatorsv1.OperatorGroupStatus{ + Namespaces: []string{targetNamespace}, + LastUpdated: &now, + }, + final: final{objects: map[string][]runtime.Object{ + "": { + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "olm.og.operator-group-1.admin-8rdAjL0E35JMMAkOqYmoorzjpIIihfnj3DcgDU", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + }, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "olm.og.operator-group-1.edit-9lBEUxqAYE7CX7wZfFEPYutTfQTo43WarB08od", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + }, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + ResourceVersion: "", + Name: "olm.og.operator-group-1.view-1l6ymczPK5SceF4d0DCtAnWZuvmKn6s8oBUxHr", + Labels: map[string]string{ + "olm.owner": "operator-group-1", + "olm.owner.namespace": "operator-ns", + "olm.owner.kind": "OperatorGroup", + }, + }, + }, + }, + }, + }, + }, + { + name: "MatchingNamespace/CSVPresent/Found", + expectedEqual: true, + initial: initial{ + operatorGroup: &operatorsv1.OperatorGroup{ + ObjectMeta: metav1.ObjectMeta{ + Name: "operator-group-1", + Namespace: operatorNamespace}, Spec: operatorsv1.OperatorGroupSpec{ Selector: &metav1.LabelSelector{ MatchLabels: map[string]string{"app": "app-a"}, @@ -4635,8 +5051,7 @@ func TestSyncOperatorGroups(t *testing.T) { operatorGroup: &operatorsv1.OperatorGroup{ ObjectMeta: metav1.ObjectMeta{ Name: "operator-group-1", - Namespace: operatorNamespace, - }, + Namespace: operatorNamespace}, Spec: operatorsv1.OperatorGroupSpec{ TargetNamespaces: []string{operatorNamespace, targetNamespace}, }, @@ -4739,8 +5154,7 @@ func TestSyncOperatorGroups(t *testing.T) { ObjectMeta: metav1.ObjectMeta{ Name: "operator-group-1", Namespace: operatorNamespace, - Labels: map[string]string{"app": "app-a"}, - }, + Labels: map[string]string{"app": "app-a"}}, Spec: operatorsv1.OperatorGroupSpec{}, }, clientObjs: []runtime.Object{}, @@ -4842,8 +5256,7 @@ func TestSyncOperatorGroups(t *testing.T) { }, ObjectMeta: metav1.ObjectMeta{ Name: "operator-group-1", - Namespace: operatorNamespace, - Labels: map[string]string{"app": "app-a"}, + Namespace: operatorNamespace, Labels: map[string]string{"app": "app-a"}, Annotations: map[string]string{ operatorsv1.OperatorGroupProvidedAPIsAnnotationKey: "missing.fake.api.group", }, @@ -4879,8 +5292,7 @@ func TestSyncOperatorGroups(t *testing.T) { Labels: map[string]string{"app": "app-a"}, Annotations: map[string]string{ operatorsv1.OperatorGroupProvidedAPIsAnnotationKey: "missing.fake.api.group", - }, - }, + }}, Spec: operatorsv1.OperatorGroupSpec{ StaticProvidedAPIs: true, }, @@ -4899,8 +5311,7 @@ func TestSyncOperatorGroups(t *testing.T) { operatorGroup: &operatorsv1.OperatorGroup{ ObjectMeta: metav1.ObjectMeta{ Name: "operator-group-1", - Namespace: operatorNamespace, - }, + Namespace: operatorNamespace}, Spec: operatorsv1.OperatorGroupSpec{}, }, clientObjs: []runtime.Object{}, @@ -5366,7 +5777,10 @@ func RequireObjectsInCache(t *testing.T, lister operatorlister.OperatorLister, n require.Failf(t, "couldn't find expected object", "%#v", object) } if err != nil { - return fmt.Errorf("namespace: %v, error: %v", namespace, err) + if apierrors.IsNotFound(err) { + return err + } + return errors.Join(err, fmt.Errorf("namespace: %v, error: %v", namespace, err)) } if doCompare { if !reflect.DeepEqual(object, fetched) { @@ -5440,8 +5854,7 @@ func TestCARotation(t *testing.T) { }, ObjectMeta: metav1.ObjectMeta{ Name: "default", - Namespace: namespace, - }, + Namespace: namespace}, Spec: operatorsv1.OperatorGroupSpec{}, Status: operatorsv1.OperatorGroupStatus{ Namespaces: []string{namespace}, diff --git a/pkg/controller/operators/olm/operatorgroup.go b/pkg/controller/operators/olm/operatorgroup.go index 90d2cb8994..92c70c649f 100644 --- a/pkg/controller/operators/olm/operatorgroup.go +++ b/pkg/controller/operators/olm/operatorgroup.go @@ -2,12 +2,15 @@ package olm import ( "context" + "crypto/sha256" "fmt" "hash/fnv" + "math/big" "reflect" "strings" - utillabels "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/kubernetes/pkg/util/labels" + "k8s.io/apimachinery/pkg/api/equality" + "github.com/sirupsen/logrus" corev1 "k8s.io/api/core/v1" rbacv1 "k8s.io/api/rbac/v1" @@ -18,20 +21,30 @@ import ( "k8s.io/apimachinery/pkg/labels" "k8s.io/apimachinery/pkg/util/errors" + utillabels "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/kubernetes/pkg/util/labels" + operatorsv1 "github.com/operator-framework/api/pkg/operators/v1" "github.com/operator-framework/api/pkg/operators/v1alpha1" + opregistry "github.com/operator-framework/operator-registry/pkg/registry" + "github.com/operator-framework/operator-lifecycle-manager/pkg/controller/install" "github.com/operator-framework/operator-lifecycle-manager/pkg/controller/operators/decorators" "github.com/operator-framework/operator-lifecycle-manager/pkg/controller/registry/resolver/cache" hashutil "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/kubernetes/pkg/util/hash" "github.com/operator-framework/operator-lifecycle-manager/pkg/lib/ownerutil" - opregistry "github.com/operator-framework/operator-registry/pkg/registry" ) const ( AdminSuffix = "admin" EditSuffix = "edit" ViewSuffix = "view" + + // kubeResourceNameLimit is the maximum length of a Kubernetes resource name + kubeResourceNameLimit = 253 + + // operatorGroupClusterRoleNameFmt template for ClusterRole names owned by OperatorGroups\ + // e.g. olm.og.my-group.admin- + operatorGroupClusterRoleNameFmt = "olm.og.%s.%s-%s" ) var ( @@ -66,6 +79,8 @@ func (a *Operator) syncOperatorGroups(obj interface{}) error { "namespace": op.GetNamespace(), }) + logger.Infof("syncing OperatorGroup %s/%s", op.GetNamespace(), op.GetName()) + // Query OG in this namespace groups, err := a.lister.OperatorsV1().OperatorGroupLister().OperatorGroups(op.GetNamespace()).List(labels.Everything()) if err != nil { @@ -981,59 +996,88 @@ func (a *Operator) updateNamespaceList(op *operatorsv1.OperatorGroup) ([]string, return namespaceList, nil } -func (a *Operator) ensureOpGroupClusterRole(op *operatorsv1.OperatorGroup, suffix string, apis cache.APISet) error { - clusterRole := &rbacv1.ClusterRole{ - ObjectMeta: metav1.ObjectMeta{ - Name: strings.Join([]string{op.GetName(), suffix}, "-"), - Labels: map[string]string{install.OLMManagedLabelKey: install.OLMManagedLabelValue}, - }, +func (a *Operator) getClusterRoleName(op *operatorsv1.OperatorGroup, roleType string) (string, error) { + roleSuffix := hash(fmt.Sprintf("%s/%s/%s", op.GetNamespace(), op.GetName(), roleType)) + // calculate how many characters are left for the operator group name + nameLimit := kubeResourceNameLimit - len(strings.Replace(operatorGroupClusterRoleNameFmt, "%s", "", -1)) - len(roleType) - len(roleSuffix) + if len(op.GetName()) < nameLimit { + return fmt.Sprintf(operatorGroupClusterRoleNameFmt, op.GetName(), roleType, roleSuffix), nil } - var selectors []metav1.LabelSelector - for api := range apis { - aggregationLabel, err := aggregationLabelFromAPIKey(api, suffix) - if err != nil { - return err - } - selectors = append(selectors, metav1.LabelSelector{ - MatchLabels: map[string]string{ - aggregationLabel: "true", - }, - }) - } - if len(selectors) > 0 { - clusterRole.AggregationRule = &rbacv1.AggregationRule{ - ClusterRoleSelectors: selectors, - } + return fmt.Sprintf(operatorGroupClusterRoleNameFmt, op.GetName()[:nameLimit], roleType, roleSuffix), nil +} + +func (a *Operator) ensureOpGroupClusterRole(op *operatorsv1.OperatorGroup, suffix string, apis cache.APISet) error { + // create target cluster role spec + var clusterRole *rbacv1.ClusterRole + clusterRoleName, err := a.getClusterRoleName(op, suffix) + if err != nil { + return err } - err := ownerutil.AddOwnerLabels(clusterRole, op) + aggregationRule, err := a.getClusterRoleAggregationRule(apis, suffix) if err != nil { return err } - existingRole, err := a.lister.RbacV1().ClusterRoleLister().Get(clusterRole.Name) + // get existing cluster role for this level (suffix: admin, edit, view)) + existingRole, err := a.lister.RbacV1().ClusterRoleLister().Get(clusterRoleName) if err != nil && !apierrors.IsNotFound(err) { return err } - if apierrors.IsNotFound(err) { - existingRole, err = a.opClient.KubernetesInterface().RbacV1().ClusterRoles().Create(context.TODO(), clusterRole, metav1.CreateOptions{}) - if err == nil { + + if existingRole != nil { + // if the existing role conforms to the naming convention, check for skew + cp := existingRole.DeepCopy() + if err := ownerutil.AddOwnerLabels(cp, op); err != nil { + return err + } + + // ensure that the labels and aggregation rules are correct + if labels.Equals(existingRole.Labels, cp.Labels) && equality.Semantic.DeepEqual(existingRole.AggregationRule, aggregationRule) { return nil } - if !apierrors.IsAlreadyExists(err) { - a.logger.WithError(err).Errorf("Create cluster role failed: %v", clusterRole) - return err + + cp.AggregationRule = aggregationRule + if _, err := a.opClient.UpdateClusterRole(cp); err != nil { + a.logger.WithError(err).Errorf("update existing cluster role failed: %v", clusterRole) } + return err } - if existingRole != nil && labels.Equals(existingRole.Labels, clusterRole.Labels) && reflect.DeepEqual(existingRole.AggregationRule, clusterRole.AggregationRule) { - return nil + clusterRole = &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{ + Name: clusterRoleName, + }, + AggregationRule: aggregationRule, } - if _, err := a.opClient.UpdateClusterRole(clusterRole); err != nil { - a.logger.WithError(err).Errorf("Update existing cluster role failed: %v", clusterRole) + if err := ownerutil.AddOwnerLabels(clusterRole, op); err != nil { return err } - return nil + + a.logger.Infof("creating cluster role: %s owned by operator group: %s/%s", clusterRole.GetName(), op.GetNamespace(), op.GetName()) + _, err = a.opClient.KubernetesInterface().RbacV1().ClusterRoles().Create(context.TODO(), clusterRole, metav1.CreateOptions{}) + return err +} + +func (a *Operator) getClusterRoleAggregationRule(apis cache.APISet, suffix string) (*rbacv1.AggregationRule, error) { + var selectors []metav1.LabelSelector + for api := range apis { + aggregationLabel, err := aggregationLabelFromAPIKey(api, suffix) + if err != nil { + return nil, err + } + selectors = append(selectors, metav1.LabelSelector{ + MatchLabels: map[string]string{ + aggregationLabel: "true", + }, + }) + } + if len(selectors) > 0 { + return &rbacv1.AggregationRule{ + ClusterRoleSelectors: selectors, + }, nil + } + return nil, nil } func (a *Operator) ensureOpGroupClusterRoles(op *operatorsv1.OperatorGroup, apis cache.APISet) error { @@ -1130,3 +1174,13 @@ func csvCopyPrototype(src, dst *v1alpha1.ClusterServiceVersion) { dst.Status.Reason = v1alpha1.CSVReasonCopied dst.Status.Message = fmt.Sprintf("The operator is running in %s but is managing this namespace", src.GetNamespace()) } + +func hash(s string) string { + return toBase62(sha256.Sum224([]byte(s))) +} + +func toBase62(hash [28]byte) string { + var i big.Int + i.SetBytes(hash[:]) + return i.Text(62) +} diff --git a/pkg/lib/ownerutil/util.go b/pkg/lib/ownerutil/util.go index dafaeaf8b0..6bbd7eb5f0 100644 --- a/pkg/lib/ownerutil/util.go +++ b/pkg/lib/ownerutil/util.go @@ -271,6 +271,11 @@ func CSVOwnerSelector(owner *operatorsv1alpha1.ClusterServiceVersion) labels.Sel return labels.SelectorFromSet(OwnerLabel(owner, operatorsv1alpha1.ClusterServiceVersionKind)) } +// OperatorGroupOwnerSelector returns a label selector to find generated objects owned by owner +func OperatorGroupOwnerSelector(owner *operatorsv1.OperatorGroup) labels.Selector { + return labels.SelectorFromSet(OwnerLabel(owner, "OperatorGroup")) +} + // AddOwner adds an owner to the ownerref list. func AddOwner(object metav1.Object, owner Owner, blockOwnerDeletion, isController bool) { // Most of the time we won't have TypeMeta on the object, so we infer it for types we know about diff --git a/test/e2e/operator_groups_e2e_test.go b/test/e2e/operator_groups_e2e_test.go index feebdc0675..85b9cd85d3 100644 --- a/test/e2e/operator_groups_e2e_test.go +++ b/test/e2e/operator_groups_e2e_test.go @@ -340,27 +340,31 @@ var _ = Describe("Operator Group", func() { }) // validate provided API clusterroles for the operatorgroup - adminRole, err := c.KubernetesInterface().RbacV1().ClusterRoles().Get(context.TODO(), operatorGroup.Name+"-admin", metav1.GetOptions{}) - require.NoError(GinkgoT(), err) - adminPolicyRules := []rbacv1.PolicyRule{ - {Verbs: []string{"*"}, APIGroups: []string{mainCRD.Spec.Group}, Resources: []string{mainCRDPlural}}, - } - require.Equal(GinkgoT(), adminPolicyRules, adminRole.Rules) - - editRole, err := c.KubernetesInterface().RbacV1().ClusterRoles().Get(context.TODO(), operatorGroup.Name+"-edit", metav1.GetOptions{}) + existingClusterRoleList, err := c.KubernetesInterface().RbacV1().ClusterRoles().List(context.TODO(), metav1.ListOptions{ + LabelSelector: labels.SelectorFromSet(ownerutil.OwnerLabel(&operatorGroup, "OperatorGroup")).String(), + }) require.NoError(GinkgoT(), err) - editPolicyRules := []rbacv1.PolicyRule{ - {Verbs: []string{"create", "update", "patch", "delete"}, APIGroups: []string{mainCRD.Spec.Group}, Resources: []string{mainCRDPlural}}, - } - require.Equal(GinkgoT(), editPolicyRules, editRole.Rules) + require.Len(GinkgoT(), existingClusterRoleList.Items, 3) - viewRole, err := c.KubernetesInterface().RbacV1().ClusterRoles().Get(context.TODO(), operatorGroup.Name+"-view", metav1.GetOptions{}) - require.NoError(GinkgoT(), err) - viewPolicyRules := []rbacv1.PolicyRule{ - {Verbs: []string{"get"}, APIGroups: []string{"apiextensions.k8s.io"}, Resources: []string{"customresourcedefinitions"}, ResourceNames: []string{mainCRD.Name}}, - {Verbs: []string{"get", "list", "watch"}, APIGroups: []string{mainCRD.Spec.Group}, Resources: []string{mainCRDPlural}}, + for _, role := range existingClusterRoleList.Items { + if strings.HasSuffix(role.Name, "admin") { + adminPolicyRules := []rbacv1.PolicyRule{ + {Verbs: []string{"*"}, APIGroups: []string{mainCRD.Spec.Group}, Resources: []string{mainCRDPlural}}, + } + require.Equal(GinkgoT(), adminPolicyRules, role.Rules) + } else if strings.HasSuffix(role.Name, "edit") { + editPolicyRules := []rbacv1.PolicyRule{ + {Verbs: []string{"create", "update", "patch", "delete"}, APIGroups: []string{mainCRD.Spec.Group}, Resources: []string{mainCRDPlural}}, + } + require.Equal(GinkgoT(), editPolicyRules, role.Rules) + } else if strings.HasSuffix(role.Name, "view") { + viewPolicyRules := []rbacv1.PolicyRule{ + {Verbs: []string{"get"}, APIGroups: []string{"apiextensions.k8s.io"}, Resources: []string{"customresourcedefinitions"}, ResourceNames: []string{mainCRD.Name}}, + {Verbs: []string{"get", "list", "watch"}, APIGroups: []string{mainCRD.Spec.Group}, Resources: []string{mainCRDPlural}}, + } + require.Equal(GinkgoT(), viewPolicyRules, role.Rules) + } } - require.Equal(GinkgoT(), viewPolicyRules, viewRole.Rules) // Unsupport all InstallModes log("unsupporting all csv installmodes")