Merge pull request #456 from Bobbins228/fix/helm-rbac-authbridge-scc

Fix(helm): align ClusterRole with controller-gen and add AuthBridge SCC

Author: pdettori

charts/kagenti-operator/templates/rbac/authbridge-scc.yaml

@@ -0,0 +1,75 @@
+{{- if and .Values.rbac.enable (.Capabilities.APIVersions.Has "security.openshift.io/v1") }}
+# SCC for AuthBridge proxy-sidecar containers in agent namespaces.
+# Custom SCC needed because restricted-v2 does not permit CSI volumes
+# (csi.spiffe.io for SPIRE workload API).
+# groups is empty -- the operator creates per-namespace RoleBindings at runtime.
+apiVersion: security.openshift.io/v1
+kind: SecurityContextConstraints
+metadata:
+  name: kagenti-authbridge
+  labels:
+    {{- include "chart.labels" . | nindent 4 }}
+    app.kubernetes.io/component: authbridge
+groups: []
+allowHostDirVolumePlugin: false
+allowHostIPC: false
+allowHostNetwork: false
+allowHostPID: false
+allowHostPorts: false
+allowPrivilegedContainer: false
+allowPrivilegeEscalation: false
+allowedCapabilities: []
+defaultAddCapabilities: []
+requiredDropCapabilities:
+  - ALL
+fsGroup:
+  type: RunAsAny
+runAsUser:
+  type: MustRunAsNonRoot
+seLinuxContext:
+  type: MustRunAs
+supplementalGroups:
+  type: RunAsAny
+seccompProfiles:
+  - runtime/default
+volumes:
+  - configMap
+  - csi
+  - downwardAPI
+  - emptyDir
+  - ephemeral
+  - persistentVolumeClaim
+  - projected
+  - secret
+---
+# ClusterRole granting "use" on the kagenti-authbridge SCC.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: system:openshift:scc:kagenti-authbridge
+  labels:
+    {{- include "chart.labels" . | nindent 4 }}
+    app.kubernetes.io/component: authbridge
+rules:
+  - apiGroups: ["security.openshift.io"]
+    resources: ["securitycontextconstraints"]
+    resourceNames: ["kagenti-authbridge"]
+    verbs: ["use"]
+---
+# Grants the operator SA "use" on the SCC so it can delegate via RoleBindings.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kagenti-operator-scc-authbridge
+  labels:
+    {{- include "chart.labels" . | nindent 4 }}
+    app.kubernetes.io/component: authbridge
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:openshift:scc:kagenti-authbridge
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.controllerManager.serviceAccountName }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}

charts/kagenti-operator/templates/rbac/role.yaml

@@ -9,6 +9,7 @@ rules:
   - ""
   resources:
   - configmaps
+  - secrets
   verbs:
   - create
   - delete
@@ -23,28 +24,16 @@ rules:
   - endpoints
   verbs:
   - get
-  - list
-  - watch
 - apiGroups:
   - ""
   resources:
   - namespaces
-  - services
   verbs:
   - create
   - get
   - list
   - patch
-  - update
   - watch
-- apiGroups:
-  - ""
-  - events.k8s.io
-  resources:
-  - events
-  verbs:
-  - create
-  - patch
 - apiGroups:
   - ""
   resources:
@@ -55,49 +44,25 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
 - apiGroups:
   - ""
   resources:
   - serviceaccounts
+  - services
   verbs:
   - create
   - get
   - list
   - update
   - watch
 - apiGroups:
-  - cert-manager.io
+  - ""
+  - events.k8s.io
   resources:
-  - certificates
-  - issuers
+  - events
   verbs:
   - create
-  - delete
-  - get
-  - list
   - patch
-  - update
-  - watch
-- apiGroups:
-  - cert-manager.io
-  resources:
-  - clusterissuers
-  verbs:
-  - get
-  - list
-  - watch
 - apiGroups:
   - agent.kagenti.dev
   resources:
@@ -162,6 +127,13 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - apps
+  resources:
+  - deployments/finalizers
+  - statefulsets/finalizers
+  verbs:
+  - update
 - apiGroups:
   - apps
   resources:
@@ -174,27 +146,22 @@ rules:
   - update
   - watch
 - apiGroups:
-  - apps
-  resources:
-  - deployments/finalizers
-  - statefulsets/finalizers
-  verbs:
-  - update
-- apiGroups:
-  - kuadrant.io
+  - cert-manager.io
   resources:
-  - kuadrants
+  - certificates
+  - issuers
   verbs:
   - create
+  - delete
   - get
   - list
   - patch
   - update
   - watch
 - apiGroups:
-  - discovery.k8s.io
+  - cert-manager.io
   resources:
-  - endpointslices
+  - clusterissuers
   verbs:
   - get
   - list
@@ -208,13 +175,33 @@ rules:
   - list
   - watch
 - apiGroups:
-  - mlflow.opendatahub.io
+  - discovery.k8s.io
   resources:
-  - mlflows
+  - endpointslices
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - k8s.keycloak.org
+  resources:
+  - keycloakrealmimports
+  - keycloaks
   verbs:
   - create
   - get
   - list
+  - patch
+  - update
+- apiGroups:
+  - kuadrant.io
+  resources:
+  - kuadrants
+  verbs:
+  - create
+  - get
+  - list
+  - patch
   - update
   - watch
 - apiGroups:
@@ -224,8 +211,18 @@ rules:
   verbs:
   - get
   - list
+  - update
   - watch
+- apiGroups:
+  - mlflow.opendatahub.io
+  resources:
+  - mlflows
+  verbs:
+  - create
+  - get
+  - list
   - update
+  - watch
 - apiGroups:
   - networking.k8s.io
   resources:
@@ -249,30 +246,15 @@ rules:
   - operator.openshift.io
   resources:
   - networks
-  - zerotrustworkloadidentitymanagers
-  verbs:
-  - get
-  - list
-- apiGroups:
-  - k8s.keycloak.org
-  resources:
-  - keycloakrealmimports
-  - keycloaks
   verbs:
-  - create
   - get
-  - list
-  - patch
-  - update
 - apiGroups:
-  - route.openshift.io
+  - operator.openshift.io
   resources:
-  - routes
+  - zerotrustworkloadidentitymanagers
   verbs:
-  - create
   - get
   - list
-  - update
 - apiGroups:
   - operator.tekton.dev
   resources:
@@ -290,17 +272,16 @@ rules:
   - get
 - apiGroups:
   - rbac.authorization.k8s.io
-  resources:
-  - clusterroles
   resourceNames:
-  - mlflow-operator-mlflow-integration
   - mlflow-operator-mlflow-edit
+  - mlflow-operator-mlflow-integration
+  resources:
+  - clusterroles
   verbs:
   - bind
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:
-  - roles
   - rolebindings
   verbs:
   - create
@@ -309,3 +290,22 @@ rules:
   - list
   - update
   - watch
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - roles
+  verbs:
+  - create
+  - get
+  - list
+  - update
+  - watch
+- apiGroups:
+  - route.openshift.io
+  resources:
+  - routes
+  verbs:
+  - create
+  - get
+  - list
+  - update

kagenti-operator/config/rbac/role.yaml

@@ -17,6 +17,12 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - endpoints
+  verbs:
+  - get
 - apiGroups:
   - ""
   resources:

kagenti-operator/internal/controller/agentcard_networkpolicy_controller.go

@@ -59,6 +59,7 @@ type AgentCardNetworkPolicyReconciler struct {
 	KubeAPIServerCIDRs []string
 }
 
+// +kubebuilder:rbac:groups=core,resources=endpoints,verbs=get
 // +kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch;update;patch
 // +kubebuilder:rbac:groups=agents.x-k8s.io,resources=sandboxes,verbs=get;list;watch