Skip to content

add resource status to clusterpermission status - #81

Merged
openshift-merge-bot[bot] merged 1 commit into
open-cluster-management-io:mainfrom
zhiweiyin318:add-status
Dec 17, 2025
Merged

add resource status to clusterpermission status#81
openshift-merge-bot[bot] merged 1 commit into
open-cluster-management-io:mainfrom
zhiweiyin318:add-status

Conversation

@zhiweiyin318

@zhiweiyin318 zhiweiyin318 commented Dec 14, 2025

Copy link
Copy Markdown
Member

update status of clusterpermission, and add resourceStatus filed to show each rbac resources status.

@openshift-ci
openshift-ci Bot requested a review from elgnay December 14, 2025 13:52
@codecov

codecov Bot commented Dec 14, 2025 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.87%. Comparing base (c04d373) to head (5487504).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main      #81      +/-   ##
==========================================
+ Coverage   60.71%   60.87%   +0.16%     
==========================================
  Files           3        4       +1     
  Lines         756      933     +177     
==========================================
+ Hits          459      568     +109     
- Misses        266      320      +54     
- Partials       31       45      +14
Flag Coverage Δ
unit 60.87% <ø> (+0.16%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@zhiweiyin318

zhiweiyin318 commented Dec 14, 2025 •
edited
Loading

Copy link
Copy Markdown
Member Author

the old status:

status:
  conditions:
  - lastTransitionTime: "2025-12-08T05:13:41Z"
    message: |-
      Run the following command to check the ManifestWork status:
      kubectl -n local-cluster get ManifestWork example-permissions-e48e3 -o yaml
    reason: AppliedRBACManifestWork
    status: "True"
    type: AppliedRBACManifestWork

the new status:

status:
  conditions:
  - lastTransitionTime: "2025-12-14T13:42:34Z"
    message: |-
       Failed to apply manifest work
       Run the following command to check the ManifestWork status:
       kubectl -n local-cluster get ManifestWork example-permissions-e48e3 -o yaml
    reason: AppliedManifestWorkFailed
    status: "False"
    type: AppliedRBACManifestWork
  resourceStatus:
    clusterRoleBindings:
    - condition:
      - lastTransitionTime: "2025-12-14T13:42:34Z"
        message: 'Failed to apply manifest: ClusterRoleBinding.rbac.authorization.k8s.io
          "clusterpermission-sample" is invalid: roleRef: Invalid value: rbac.RoleRef{APIGroup:"rbac.authorization.k8s.io",
          Kind:"ClusterRole", Name:"clusterpermission-sample-2"}: cannot change roleRef'
        reason: FailedApplyManifest
        status: "False"
        type: Applied
      name: clusterpermission-sample
    clusterRoles:
    - condition:
      - lastTransitionTime: "2025-12-14T13:42:34Z"
        message: Apply manifest complete
        reason: AppliedManifestComplete
        status: "True"
        type: Applied
      name: clusterpermission-sample-2
    roleBindings:
    - condition:
      - lastTransitionTime: "2025-12-14T13:42:34Z"
        message: 'Failed to apply manifest: RoleBinding.rbac.authorization.k8s.io
          "clusterpermission-sample" is invalid: roleRef: Invalid value: rbac.RoleRef{APIGroup:"rbac.authorization.k8s.io",
          Kind:"ClusterRole", Name:"clusterpermission-sample-2"}: cannot change roleRef'
        reason: FailedApplyManifest
        status: "False"
        type: Applied
      name: clusterpermission-sample
      namespace: kube-system
    - condition:
      - lastTransitionTime: "2025-12-14T13:42:34Z"
        message: Apply manifest complete
        reason: AppliedManifestComplete
        status: "True"
        type: Applied
      name: clusterpermission-sample-2
      namespace: default
    roles:
    - condition:
      - lastTransitionTime: "2025-12-14T13:42:34Z"
        message: Apply manifest complete
        reason: AppliedManifestComplete
        status: "True"
        type: Applied
      name: clusterpermission-sample-2
      namespace: default
    - condition:
      - lastTransitionTime: "2025-12-14T13:42:34Z"
        message: Apply manifest complete
        reason: AppliedManifestComplete
        status: "True"
        type: Applied
      name: clusterpermission-sample-2
      namespace: kube-public

@zhiweiyin318

zhiweiyin318 commented Dec 15, 2025

Copy link
Copy Markdown
Member Author

/assign @qiujian16
/assign @elgnay

please take a look and help review this PR. thanks.
cc @fxiang1 @mshort55

elgnay
elgnay reviewed Dec 16, 2025
View reviewed changes
Comment thread controllers/clusterpermission_status_controller.go
For(&workv1.ManifestWork{}).
Watches(
&workv1.ManifestWork{},
handler.EnqueueRequestsFromMapFunc(r.findClusterPermissionForManifestWork),

@elgnay elgnay Dec 16, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not use handler.EnqueueRequestForOwner{}?

@zhiweiyin318 zhiweiyin318 Dec 17, 2025

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

watch manifestwork with the clusterpermission owner, request key is the manifestwork name and namespace.

elgnay
elgnay reviewed Dec 16, 2025
View reviewed changes
Comment thread controllers/clusterpermission_status_controller.go Outdated
// SetupWithManager sets up the controller with the Manager.
func (r *ClusterPermissionStatusReconciler) SetupWithManager(mgr ctrl.Manager) error {
return ctrl.NewControllerManagedBy(mgr).
For(&workv1.ManifestWork{}).

@elgnay elgnay Dec 16, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the primary reconciliation subject of this controller? ManifestWork or ClusterPermission?

@zhiweiyin318 zhiweiyin318 Dec 17, 2025

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

manfiestwork.

elgnay
elgnay reviewed Dec 16, 2025
View reviewed changes
Comment thread controllers/clusterpermission_status_controller.go Outdated
if newStatus.ResourceStatus == nil {
newStatus.ResourceStatus = &cpv1alpha1.ResourceStatus{}
}
r.updateResourceStatus(newStatus.ResourceStatus, manifestWork)

@elgnay elgnay Dec 16, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why the resource status is updated only when Spec.Validate is false?

@zhiweiyin318 zhiweiyin318 Dec 17, 2025

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed that always update resorucestatus

@zhiweiyin318
zhiweiyin318 force-pushed the add-status branch 5 times, most recently from e1b2be5 to 9d2bf30 Compare December 16, 2025 15:33
mshort55
mshort55 approved these changes Dec 17, 2025
View reviewed changes

@mshort55 mshort55 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci

openshift-ci Bot commented Dec 17, 2025

Copy link
Copy Markdown

@mshort55: changing LGTM is restricted to collaborators

Details

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@zhiweiyin318
zhiweiyin318 force-pushed the add-status branch 2 times, most recently from a909172 to afa304b Compare December 17, 2025 04:13
@zhiweiyin318
add resource status to clusterpermission status
5487504 
Signed-off-by: Zhiwei Yin <zyin@redhat.com>
@elgnay

elgnay commented Dec 17, 2025

Copy link
Copy Markdown
Collaborator

/approve
/lgtm

@openshift-ci openshift-ci Bot added the lgtm label Dec 17, 2025
@openshift-ci

openshift-ci Bot commented Dec 17, 2025

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: elgnay, mshort55, zhiweiyin318

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-bot
openshift-merge-bot Bot merged commit 7f77607 into open-cluster-management-io:main Dec 17, 2025
8 checks passed
@zhiweiyin318
zhiweiyin318 deleted the add-status branch December 17, 2025 06:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@elgnay elgnay elgnay left review comments
+1 more reviewer
@mshort55 mshort55 mshort55 approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@qiujian16 qiujian16

@elgnay elgnay

Labels

approved lgtm

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@zhiweiyin318 @elgnay @mshort55 @qiujian16