Nail/fission-src
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Error if rolebinding exists with different role reference in namespace (#2579)

Browse Source 
* added unit test for setup role binding method
* changes to throw an error in case of mismatch in cluster role name
* changes to add a check for role kind
This commit is contained in:
Shubham Bansal
2022-10-27 14:10:38 +05:30
committed by GitHub
parent ee790b3e1e
commit 3a9e5ab65d
3 changed files with 92 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/utils/rbacutils.go
+10
View File
@@ -252,6 +252,16 @@ func SetupRoleBinding(ctx context.Context, logger *zap.Logger, k8sClient kuberne
zap.String("role_binding_namespace", roleBindingNs))
return AddSaToRoleBindingWithRetries(ctx, logger, k8sClient, roleBinding, roleBindingNs, sa, saNamespace, role, roleKind)
}
if rbObj.RoleRef.Name != role || rbObj.RoleRef.Kind != roleKind {
logger.Error("rolebinding with different role references exists",
zap.String("role_binding", rbObj.Name),
zap.String("role_binding_namespace", roleBindingNs),
zap.String("roleref", role),
zap.String("roleref_kind", roleKind),
zap.String("old_roleref", rbObj.RoleRef.Name),
zap.String("old_roleref_kind", rbObj.RoleRef.Kind))
return fmt.Errorf("rolebinding %s in namespace %s exists with different roleref, retry by deleting existing rolebinding", rbObj.Name, roleBindingNs)
}
logger.Debug("service account already present in rolebinding so nothing to add",
zap.String("service_account_name", sa),
zap.String("service_account_namespace", saNamespace),