feat: Add ServiceAccount generation from WSA list

cmd/main.go

@@ -206,7 +206,7 @@ func main() {
 	}
 
 	// Create the rules engine instance
-	engine := rules.NewInMemoryEngine()
+	engine := rules.NewInMemoryEngine(mgr.GetClient())
 
 	if err := (&controller.WorkloadServiceAccountReconciler{
 		Client: mgr.GetClient(),

config/rbac/role.yaml

@@ -4,6 +4,15 @@ kind: ClusterRole
 metadata:
   name: manager-role
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts
+  verbs:
+  - create
+  - get
+  - list
+  - watch
 - apiGroups:
   - agent.octopus.com
   resources:
@@ -30,3 +39,21 @@ rules:
   - get
   - patch
   - update
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterroles
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - rolebindings
+  - roles
+  verbs:
+  - create
+  - get
+  - list
+  - watch

internal/controller/workloadserviceaccount_controller.go

@@ -38,6 +38,10 @@ type WorkloadServiceAccountReconciler struct {
 // +kubebuilder:rbac:groups=agent.octopus.com,resources=workloadserviceaccounts,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=agent.octopus.com,resources=workloadserviceaccounts/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=agent.octopus.com,resources=workloadserviceaccounts/finalizers,verbs=update
+// +kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch;create
+// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles,verbs=get;list;watch;create
+// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=rolebindings,verbs=get;list;watch;create
+// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles,verbs=get;list;watch
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to
 // move the current state of the cluster closer to the desired state.
@@ -46,32 +50,11 @@ func (r *WorkloadServiceAccountReconciler) Reconcile(ctx context.Context, req ct
 
 	log.Info("WorkloadServiceAccount reconciliation triggered")
 
-	wsaList := &agentoctopuscomv1beta1.WorkloadServiceAccountList{}
-	if err := r.List(ctx, wsaList, client.InNamespace(req.Namespace)); err != nil {
-		log.Error(err, "failed to list WorkloadServiceAccounts")
+	if err := r.Engine.Reconcile(ctx, req.Namespace); err != nil {
+		log.Error(err, "failed to reconcile ServiceAccounts from WorkloadServiceAccounts")
 		return ctrl.Result{}, err
 	}
 
-	log.Info("Found WSAs in namespace", "count", len(wsaList.Items))
-
-	for _, currentWSA := range wsaList.Items {
-		for _, project := range currentWSA.Spec.Scope.Projects {
-			log.Info("WSA has project scope", "wsa", currentWSA.Name, "project", project)
-		}
-		for _, environment := range currentWSA.Spec.Scope.Environments {
-			log.Info("WSA has environment scope", "wsa", currentWSA.Name, "environment", environment)
-		}
-		for _, tenant := range currentWSA.Spec.Scope.Tenants {
-			log.Info("WSA has tenant scope", "wsa", currentWSA.Name, "tenant", tenant)
-		}
-		for _, step := range currentWSA.Spec.Scope.Steps {
-			log.Info("WSA has step scope", "wsa", currentWSA.Name, "step", step)
-		}
-		for _, space := range currentWSA.Spec.Scope.Spaces {
-			log.Info("WSA has space scope", "wsa", currentWSA.Name, "space", space)
-		}
-	}
-
 	log.Info("Successfully reconciled WorkloadServiceAccounts")
 	return ctrl.Result{}, nil
 }

internal/controller/workloadserviceaccount_controller_test.go

@@ -28,6 +28,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	agentoctopuscomv1beta1 "github.com/octopusdeploy/octopus-permissions-controller/api/v1beta1"
+	"github.com/octopusdeploy/octopus-permissions-controller/internal/rules"
 )
 
 var _ = Describe("WorkloadServiceAccount Controller", func() {
@@ -68,9 +69,11 @@ var _ = Describe("WorkloadServiceAccount Controller", func() {
 		})
 		It("should successfully reconcile the resource", func() {
 			By("Reconciling the created resource")
+			engine := rules.NewInMemoryEngine(k8sClient)
 			controllerReconciler := &WorkloadServiceAccountReconciler{
 				Client: k8sClient,
 				Scheme: k8sClient.Scheme(),
+				Engine: &engine,
 			}
 
 			_, err := controllerReconciler.Reconcile(ctx, reconcile.Request{