Correctly generate ClusterRole & CRB

Author: Weeblin

pkg/permissions/generate.go

@@ -74,10 +74,6 @@ func GenerateClusterRoles(dataGatherer []agent.DataGatherer) []rbac.ClusterRole
 	return out
 }
 
-// func SelectNamespace(all, include, exclude) selected {
-
-// }
-
 func GenerateClusterRoleBindings(clusterRoles []rbac.ClusterRole) []rbac.ClusterRoleBinding {
 	out := []rbac.ClusterRoleBinding{}
 	for _, cr := range clusterRoles {
@@ -88,7 +84,7 @@ func GenerateClusterRoleBindings(clusterRoles []rbac.ClusterRole) []rbac.Cluster
 			},
 
 			ObjectMeta: metav1.ObjectMeta{
-				Name: fmt.Sprintf("jetstack-secure-agent-%s-reader", cr.TypeMeta.Kind),
+				Name: cr.ObjectMeta.Name,
 			},
 
 			Subjects: []rbac.Subject{

pkg/permissions/generate_test.go

@@ -22,6 +22,16 @@ func TestGenerateRBAC(t *testing.T) {
 		{
 			description: "Generate RBAC struct for pods datagatherer",
 			dataGatherers: []agent.DataGatherer{
+				{
+					Name: "k8s/pods",
+					Kind: "k8s-dynamic",
+					Config: &k8s.ConfigDynamic{
+						GroupVersionResource: schema.GroupVersionResource{
+							Version:  "v1",
+							Resource: "pods",
+						},
+					},
+				},
 				{
 					Name: "k8s/secrets",
 					Kind: "k8s-dynamic",
@@ -32,8 +42,35 @@ func TestGenerateRBAC(t *testing.T) {
 						},
 					},
 				},
+				{
+					Name: "k8s/awspcaissuer",
+					Kind: "k8s-dynamic",
+					Config: &k8s.ConfigDynamic{
+						GroupVersionResource: schema.GroupVersionResource{
+							Group:    "awspca.cert-manager.io",
+							Version:  "v1",
+							Resource: "awspcaissuers",
+						},
+					},
+				},
 			},
 			expectedClusterRoles: []rbac.ClusterRole{
+				{
+					TypeMeta: metav1.TypeMeta{
+						Kind:       "ClusterRole",
+						APIVersion: "rbac.authorization.k8s.io/v1",
+					},
+					ObjectMeta: metav1.ObjectMeta{
+						Name: "jetstack-secure-agent-pods-reader",
+					},
+					Rules: []rbac.PolicyRule{
+						{
+							Verbs:     []string{"get", "list", "watch"},
+							APIGroups: []string{""},
+							Resources: []string{"pods"},
+						},
+					},
+				},
 				{
 					TypeMeta: metav1.TypeMeta{
 						Kind:       "ClusterRole",
@@ -50,6 +87,22 @@ func TestGenerateRBAC(t *testing.T) {
 						},
 					},
 				},
+				{
+					TypeMeta: metav1.TypeMeta{
+						Kind:       "ClusterRole",
+						APIVersion: "rbac.authorization.k8s.io/v1",
+					},
+					ObjectMeta: metav1.ObjectMeta{
+						Name: "jetstack-secure-agent-awspcaissuers-reader",
+					},
+					Rules: []rbac.PolicyRule{
+						{
+							Verbs:     []string{"get", "list", "watch"},
+							APIGroups: []string{"awspca.cert-manager.io"},
+							Resources: []string{"awspcaissuers"},
+						},
+					},
+				},
 			},
 			expectedClusterRoleBindings: []rbac.ClusterRoleBinding{
 				{
@@ -58,7 +111,28 @@ func TestGenerateRBAC(t *testing.T) {
 						APIVersion: "rbac.authorization.k8s.io/v1",
 					},
 					ObjectMeta: metav1.ObjectMeta{
-						Name: "jetstack-secure-agent-ClusterRole-reader",
+						Name: "jetstack-secure-agent-pods-reader",
+					},
+					Subjects: []rbac.Subject{
+						{
+							Kind:      "ServiceAccount",
+							Name:      "agent",
+							Namespace: "jetstack-secure",
+						},
+					},
+					RoleRef: rbac.RoleRef{
+						Kind:     "ClusterRole",
+						Name:     "jetstack-secure-agent-pods-reader",
+						APIGroup: "rbac.authorization.k8s.io",
+					},
+				},
+				{
+					TypeMeta: metav1.TypeMeta{
+						Kind:       "ClusterRoleBinding",
+						APIVersion: "rbac.authorization.k8s.io/v1",
+					},
+					ObjectMeta: metav1.ObjectMeta{
+						Name: "jetstack-secure-agent-secrets-reader",
 					},
 					Subjects: []rbac.Subject{
 						{
@@ -73,16 +147,36 @@ func TestGenerateRBAC(t *testing.T) {
 						APIGroup: "rbac.authorization.k8s.io",
 					},
 				},
+				{
+					TypeMeta: metav1.TypeMeta{
+						Kind:       "ClusterRoleBinding",
+						APIVersion: "rbac.authorization.k8s.io/v1",
+					},
+					ObjectMeta: metav1.ObjectMeta{
+						Name: "jetstack-secure-agent-awspcaissuers-reader",
+					},
+					Subjects: []rbac.Subject{
+						{
+							Kind:      "ServiceAccount",
+							Name:      "agent",
+							Namespace: "jetstack-secure",
+						},
+					},
+					RoleRef: rbac.RoleRef{
+						Kind:     "ClusterRole",
+						Name:     "jetstack-secure-agent-awspcaissuers-reader",
+						APIGroup: "rbac.authorization.k8s.io",
+					},
+				},
 			},
 		},
-		// Try adding more test cases
 	}
 
 	for _, input := range testCases {
 		gotClusterRoles := GenerateClusterRoles(input.dataGatherers)
 		gotClusterRoleBindings := GenerateClusterRoleBindings(gotClusterRoles)
 
-		td.Cmp(t, input.expectedClusterRoleBindings, gotClusterRoleBindings)
 		td.Cmp(t, input.expectedClusterRoles, gotClusterRoles)
+		td.Cmp(t, input.expectedClusterRoleBindings, gotClusterRoleBindings)
 	}
 }