Skip to content

Commit 70a5d0f

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #339 from openshift-bot/synchronize-upstream
NO-ISSUE: Synchronize From Upstream Repositories
2 parents d2ec96c + ea66f37 commit 70a5d0f

File tree

105 files changed

+17417
-2092
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

105 files changed

+17417
-2092
lines changed

‎.bingo/Variables.mk‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -59,11 +59,11 @@ $(KIND): $(BINGO_DIR)/kind.mod
5959
@echo "(re)installing $(GOBIN)/kind-v0.27.0"
6060
@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=kind.mod -o=$(GOBIN)/kind-v0.27.0 "sigs.k8s.io/kind"
6161

62-
KUSTOMIZE := $(GOBIN)/kustomize-v4.5.7
62+
KUSTOMIZE := $(GOBIN)/kustomize-v5.6.0
6363
$(KUSTOMIZE): $(BINGO_DIR)/kustomize.mod
6464
@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
65-
@echo "(re)installing $(GOBIN)/kustomize-v4.5.7"
66-
@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=kustomize.mod -o=$(GOBIN)/kustomize-v4.5.7 "sigs.k8s.io/kustomize/kustomize/v4"
65+
@echo "(re)installing $(GOBIN)/kustomize-v5.6.0"
66+
@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=kustomize.mod -o=$(GOBIN)/kustomize-v5.6.0 "sigs.k8s.io/kustomize/kustomize/v5"
6767

6868
OPERATOR_SDK := $(GOBIN)/operator-sdk-v1.39.1
6969
$(OPERATOR_SDK): $(BINGO_DIR)/operator-sdk.mod

‎.bingo/kustomize.mod‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
22

3-
go 1.20
3+
go 1.23.4
44

5-
require sigs.k8s.io/kustomize/kustomize/v4 v4.5.7
5+
require sigs.k8s.io/kustomize/kustomize/v5 v5.6.0

‎.bingo/kustomize.sum‎

Lines changed: 57 additions & 202 deletions
Large diffs are not rendered by default.

‎.bingo/variables.env‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ GORELEASER="${GOBIN}/goreleaser-v1.26.2"
2222

2323
KIND="${GOBIN}/kind-v0.27.0"
2424

25-
KUSTOMIZE="${GOBIN}/kustomize-v4.5.7"
25+
KUSTOMIZE="${GOBIN}/kustomize-v5.6.0"
2626

2727
OPERATOR_SDK="${GOBIN}/operator-sdk-v1.39.1"
2828

‎cmd/operator-controller/main.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -305,6 +305,9 @@ func run() error {
305305
}
306306
tokenGetter := authentication.NewTokenGetter(coreClient, authentication.WithExpirationDuration(1*time.Hour))
307307
clientRestConfigMapper := action.ServiceAccountRestConfigMapper(tokenGetter)
308+
if features.OperatorControllerFeatureGate.Enabled(features.SyntheticPermissions) {
309+
clientRestConfigMapper = action.SyntheticUserRestConfigMapper(clientRestConfigMapper)
310+
}
308311

309312
cfgGetter, err := helmclient.NewActionConfigGetter(mgr.GetConfig(), mgr.GetRESTMapper(),
310313
helmclient.StorageDriverMapper(action.ChunkedStorageDriverMapper(coreClient, mgr.GetAPIReader(), cfg.systemNamespace)),

‎commitchecker.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
expectedMergeBase: d873ec10844b1e18efe43a62dddca76bc24b1504
1+
expectedMergeBase: 6f3a121e4d5035e9f53f6d5aaeb8cad1841f649a
22
upstreamBranch: main
33
upstreamOrg: operator-framework
44
upstreamRepo: operator-controller

‎config/overlays/featuregate/synthetic-user-permissions/kustomization.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# kustomization file for secure OLMv1
2+
# DO NOT ADD A NAMESPACE HERE
3+
apiVersion: kustomize.config.k8s.io/v1beta1
4+
kind: Kustomization
5+
resources:
6+
- ../../../base/operator-controller
7+
- ../../../base/common
8+
components:
9+
- ../../../components/tls/operator-controller
10+
11+
patches:
12+
- target:
13+
kind: Deployment
14+
name: operator-controller-controller-manager
15+
path: patches/enable-featuregate.yaml
16+
- target:
17+
kind: ClusterRole
18+
name: operator-controller-manager-role
19+
path: patches/impersonate-perms.yaml

‎config/overlays/featuregate/synthetic-user-permissions/patches/enable-featuregate.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# enable synthetic-user feature gate
2+
- op: add
3+
path: /spec/template/spec/containers/0/args/-
4+
value: "--feature-gates=SyntheticPermissions=true"

‎config/overlays/featuregate/synthetic-user-permissions/patches/impersonate-perms.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# enable synthetic-user feature gate
2+
- op: add
3+
path: /rules/-
4+
value:
5+
apiGroups:
6+
- ""
7+
resources:
8+
- groups
9+
- users
10+
verbs:
11+
- impersonate

‎docs/draft/howto/use-synthetic-permissions.md‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
## Synthetic User Permissions
2+
3+
!!! note
4+
This feature is still in *alpha* the `SyntheticPermissions` feature-gate must be enabled to make use of it.
5+
See the instructions below on how to enable it.
6+
7+
Synthetic user permissions enables fine-grained configuration of ClusterExtension management client RBAC permissions.
8+
User can not only configure RBAC permissions governing the management across all ClusterExtensions, but also on a
9+
case-by-case basis.
10+
11+
### Update OLM to enable Feature
12+
13+
```terminal title=Enable SyntheticPermissions feature
14+
kubectl kustomize config/overlays/featuregate/synthetic-user-permissions | kubectl apply -f -
15+
```
16+
17+
```terminal title=Wait for rollout to complete
18+
kubectl rollout status -n olmv1-system deployment/operator-controller-controller-manager
19+
```
20+
21+
### How does it work?
22+
23+
When managing a ClusterExtension, OLM will assume the identity of user "olm:clusterextensions:<clusterextension-name>"
24+
and group "olm:clusterextensions" limiting Kubernetes API access scope to those defined for this user and group. These
25+
users and group do not exist beyond being defined in Cluster/RoleBinding(s) and can only be impersonated by clients with
26+
`impersonate` verb permissions on the `users` and `groups` resources.
27+
28+
### Demo
29+
30+
[![asciicast](https://asciinema.org/a/Jbtt8nkV8Dm7vriHxq7sxiVvi.svg)](https://asciinema.org/a/Jbtt8nkV8Dm7vriHxq7sxiVvi)
31+
32+
#### Examples:
33+
34+
##### ClusterExtension management as cluster-admin
35+
36+
To enable ClusterExtensions management as cluster-admin, bind the `cluster-admin` cluster role to the `olm:clusterextensions`
37+
group:
38+
39+
```
40+
apiVersion: rbac.authorization.k8s.io/v1
41+
kind: ClusterRoleBinding
42+
metadata:
43+
name: clusterextensions-group-admin-binding
44+
roleRef:
45+
apiGroup: rbac.authorization.k8s.io
46+
kind: ClusterRole
47+
name: cluster-admin
48+
subjects:
49+
- kind: Group
50+
name: "olm:clusterextensions"
51+
```
52+
53+
##### Scoped olm:clusterextension group + Added perms on specific extensions
54+
55+
Give ClusterExtension management group broad permissions to manage ClusterExtensions denying potentially dangerous
56+
permissions such as being able to read cluster wide secrets:
57+
58+
```
59+
apiVersion: rbac.authorization.k8s.io/v1
60+
kind: ClusterRole
61+
metadata:
62+
name: clusterextension-installer
63+
rules:
64+
- apiGroups: [ olm.operatorframework.io ]
65+
resources: [ clusterextensions/finalizers ]
66+
verbs: [ update ]
67+
- apiGroups: [ apiextensions.k8s.io ]
68+
resources: [ customresourcedefinitions ]
69+
verbs: [ create, list, watch, get, update, patch, delete ]
70+
- apiGroups: [ rbac.authorization.k8s.io ]
71+
resources: [ clusterroles, roles, clusterrolebindings, rolebindings ]
72+
verbs: [ create, list, watch, get, update, patch, delete ]
73+
- apiGroups: [""]
74+
resources: [configmaps, endpoints, events, pods, pod/logs, serviceaccounts, services, services/finalizers, namespaces, persistentvolumeclaims]
75+
verbs: ['*']
76+
- apiGroups: [apps]
77+
resources: [ '*' ]
78+
verbs: ['*']
79+
- apiGroups: [ batch ]
80+
resources: [ '*' ]
81+
verbs: [ '*' ]
82+
- apiGroups: [ networking.k8s.io ]
83+
resources: [ '*' ]
84+
verbs: [ '*' ]
85+
- apiGroups: [authentication.k8s.io]
86+
resources: [tokenreviews, subjectaccessreviews]
87+
verbs: [create]
88+
```
89+
90+
```
91+
apiVersion: rbac.authorization.k8s.io/v1
92+
kind: ClusterRoleBinding
93+
metadata:
94+
name: clusterextension-installer-binding
95+
roleRef:
96+
apiGroup: rbac.authorization.k8s.io
97+
kind: ClusterRole
98+
name: clusterextension-installer
99+
subjects:
100+
- kind: Group
101+
name: "olm:clusterextensions"
102+
```
103+
104+
Give a specific ClusterExtension secrets access, maybe even on specific namespaces:
105+
106+
```
107+
apiVersion: rbac.authorization.k8s.io/v1
108+
kind: ClusterRole
109+
metadata:
110+
name: clusterextension-privileged
111+
rules:
112+
- apiGroups: [""]
113+
resources: [secrets]
114+
verbs: ['*']
115+
```
116+
117+
```
118+
apiVersion: rbac.authorization.k8s.io/v1
119+
kind: RoleBinding
120+
metadata:
121+
name: clusterextension-privileged-binding
122+
namespace: <some namespace>
123+
roleRef:
124+
apiGroup: rbac.authorization.k8s.io
125+
kind: ClusterRole
126+
name: clusterextension-privileged
127+
subjects:
128+
- kind: User
129+
name: "olm:clusterextensions:argocd-operator"
130+
```
131+
132+
Note: In this example the ClusterExtension user (or group) will still need to be updated to be able to manage
133+
the CRs coming from the argocd operator. Some look ahead and RBAC permission wrangling will still be required.

0 commit comments

Comments
 (0)