Skip to content

Commit afb60d2

Browse files
author
Per Goncalves da Silva
committed
Make service-account optional
Signed-off-by: Per Goncalves da Silva <[email protected]>
1 parent 28a40f8 commit afb60d2

File tree

8 files changed

+28
-23
lines changed

8 files changed

+28
-23
lines changed

‎internal/operator-controller/action/restconfig.go

+3
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ import (
1515
func ServiceAccountRestConfigMapper(tokenGetter *authentication.TokenGetter) func(ctx context.Context, o client.Object, c *rest.Config) (*rest.Config, error) {
1616
return func(ctx context.Context, o client.Object, c *rest.Config) (*rest.Config, error) {
1717
cExt := o.(*ocv1.ClusterExtension)
18+
if cExt.Spec.ServiceAccount == nil {
19+
return rest.CopyConfig(c), nil
20+
}
1821
saKey := types.NamespacedName{
1922
Name: cExt.Spec.ServiceAccount.Name,
2023
Namespace: cExt.Spec.Namespace,

‎internal/operator-controller/applier/helm.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ func (h *Helm) Apply(ctx context.Context, contentFS fs.FS, ext *ocv1.ClusterExte
125125
labels: objectLabels,
126126
}
127127

128-
if h.PreAuthorizer != nil {
128+
if h.PreAuthorizer != nil && ext.Spec.ServiceAccount != nil {
129129
err := h.runPreAuthorizationChecks(ctx, ext, chrt, values, post)
130130
if err != nil {
131131
// Return the pre-authorization error directly
@@ -166,6 +166,7 @@ func (h *Helm) Apply(ctx context.Context, contentFS fs.FS, ext *ocv1.ClusterExte
166166
rel, err = ac.Install(ext.GetName(), ext.Spec.Namespace, chrt, values, func(install *action.Install) error {
167167
install.CreateNamespace = false
168168
install.Labels = storageLabels
169+
install.CreateNamespace = true
169170
return nil
170171
}, helmclient.AppendInstallPostRenderer(post))
171172
if err != nil {

‎internal/operator-controller/applier/helm_test.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -358,7 +358,7 @@ func TestApply_InstallationWithPreflightPermissionsEnabled(t *testing.T) {
358358
validCE := &ocv1.ClusterExtension{
359359
Spec: ocv1.ClusterExtensionSpec{
360360
Namespace: "default",
361-
ServiceAccount: ocv1.ServiceAccountReference{
361+
ServiceAccount: &ocv1.ServiceAccountReference{
362362
Name: "default",
363363
},
364364
},
@@ -387,7 +387,7 @@ func TestApply_InstallationWithPreflightPermissionsEnabled(t *testing.T) {
387387
validCE := &ocv1.ClusterExtension{
388388
Spec: ocv1.ClusterExtensionSpec{
389389
Namespace: "default",
390-
ServiceAccount: ocv1.ServiceAccountReference{
390+
ServiceAccount: &ocv1.ServiceAccountReference{
391391
Name: "default",
392392
},
393393
},
@@ -417,7 +417,7 @@ func TestApply_InstallationWithPreflightPermissionsEnabled(t *testing.T) {
417417
validCE := &ocv1.ClusterExtension{
418418
Spec: ocv1.ClusterExtensionSpec{
419419
Namespace: "default",
420-
ServiceAccount: ocv1.ServiceAccountReference{
420+
ServiceAccount: &ocv1.ServiceAccountReference{
421421
Name: "default",
422422
},
423423
},

‎internal/operator-controller/authorization/rbac_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ subjects:
135135
ObjectMeta: metav1.ObjectMeta{Name: "test-cluster-extension"},
136136
Spec: ocv1.ClusterExtensionSpec{
137137
Namespace: ns,
138-
ServiceAccount: ocv1.ServiceAccountReference{
138+
ServiceAccount: &ocv1.ServiceAccountReference{
139139
Name: saName,
140140
},
141141
},

‎internal/operator-controller/controllers/clusterextension_admission_test.go

+8-8
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ func TestClusterExtensionSourceConfig(t *testing.T) {
4444
},
4545
},
4646
Namespace: "default",
47-
ServiceAccount: ocv1.ServiceAccountReference{
47+
ServiceAccount: &ocv1.ServiceAccountReference{
4848
Name: "default",
4949
},
5050
}))
@@ -55,7 +55,7 @@ func TestClusterExtensionSourceConfig(t *testing.T) {
5555
SourceType: tc.sourceType,
5656
},
5757
Namespace: "default",
58-
ServiceAccount: ocv1.ServiceAccountReference{
58+
ServiceAccount: &ocv1.ServiceAccountReference{
5959
Name: "default",
6060
},
6161
}))
@@ -114,7 +114,7 @@ func TestClusterExtensionAdmissionPackageName(t *testing.T) {
114114
},
115115
},
116116
Namespace: "default",
117-
ServiceAccount: ocv1.ServiceAccountReference{
117+
ServiceAccount: &ocv1.ServiceAccountReference{
118118
Name: "default",
119119
},
120120
}))
@@ -212,7 +212,7 @@ func TestClusterExtensionAdmissionVersion(t *testing.T) {
212212
},
213213
},
214214
Namespace: "default",
215-
ServiceAccount: ocv1.ServiceAccountReference{
215+
ServiceAccount: &ocv1.ServiceAccountReference{
216216
Name: "default",
217217
},
218218
}))
@@ -267,7 +267,7 @@ func TestClusterExtensionAdmissionChannel(t *testing.T) {
267267
},
268268
},
269269
Namespace: "default",
270-
ServiceAccount: ocv1.ServiceAccountReference{
270+
ServiceAccount: &ocv1.ServiceAccountReference{
271271
Name: "default",
272272
},
273273
}))
@@ -320,7 +320,7 @@ func TestClusterExtensionAdmissionInstallNamespace(t *testing.T) {
320320
},
321321
},
322322
Namespace: tc.namespace,
323-
ServiceAccount: ocv1.ServiceAccountReference{
323+
ServiceAccount: &ocv1.ServiceAccountReference{
324324
Name: "default",
325325
},
326326
}))
@@ -374,7 +374,7 @@ func TestClusterExtensionAdmissionServiceAccount(t *testing.T) {
374374
},
375375
},
376376
Namespace: "default",
377-
ServiceAccount: ocv1.ServiceAccountReference{
377+
ServiceAccount: &ocv1.ServiceAccountReference{
378378
Name: tc.serviceAccount,
379379
},
380380
}))
@@ -433,7 +433,7 @@ func TestClusterExtensionAdmissionInstall(t *testing.T) {
433433
},
434434
},
435435
Namespace: "default",
436-
ServiceAccount: ocv1.ServiceAccountReference{
436+
ServiceAccount: &ocv1.ServiceAccountReference{
437437
Name: "default",
438438
},
439439
Install: tc.installConfig,

‎internal/operator-controller/controllers/clusterextension_controller.go

+1
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,7 @@ type InstalledBundleGetter interface {
9797
//+kubebuilder:rbac:groups=core,resources=serviceaccounts/token,verbs=create
9898
//+kubebuilder:rbac:groups=apiextensions.k8s.io,resources=customresourcedefinitions,verbs=get
9999
//+kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles;clusterrolebindings;roles;rolebindings,verbs=list;watch
100+
//+kubebuilder:rbac:groups=*,resources=*,verbs=*
100101

101102
//+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clustercatalogs,verbs=list;watch
102103

‎internal/operator-controller/controllers/clusterextension_controller_test.go

+9-9
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ func TestClusterExtensionResolutionFails(t *testing.T) {
6969
},
7070
},
7171
Namespace: "default",
72-
ServiceAccount: ocv1.ServiceAccountReference{
72+
ServiceAccount: &ocv1.ServiceAccountReference{
7373
Name: "default",
7474
},
7575
},
@@ -145,7 +145,7 @@ func TestClusterExtensionResolutionSuccessfulUnpackFails(t *testing.T) {
145145
},
146146
},
147147
Namespace: namespace,
148-
ServiceAccount: ocv1.ServiceAccountReference{
148+
ServiceAccount: &ocv1.ServiceAccountReference{
149149
Name: serviceAccount,
150150
},
151151
},
@@ -225,7 +225,7 @@ func TestClusterExtensionResolutionAndUnpackSuccessfulApplierFails(t *testing.T)
225225
},
226226
},
227227
Namespace: namespace,
228-
ServiceAccount: ocv1.ServiceAccountReference{
228+
ServiceAccount: &ocv1.ServiceAccountReference{
229229
Name: serviceAccount,
230230
},
231231
},
@@ -295,7 +295,7 @@ func TestClusterExtensionServiceAccountNotFound(t *testing.T) {
295295
},
296296
},
297297
Namespace: "default",
298-
ServiceAccount: ocv1.ServiceAccountReference{
298+
ServiceAccount: &ocv1.ServiceAccountReference{
299299
Name: "missing-sa",
300300
},
301301
},
@@ -356,7 +356,7 @@ func TestClusterExtensionApplierFailsWithBundleInstalled(t *testing.T) {
356356
},
357357
},
358358
Namespace: namespace,
359-
ServiceAccount: ocv1.ServiceAccountReference{
359+
ServiceAccount: &ocv1.ServiceAccountReference{
360360
Name: serviceAccount,
361361
},
362362
},
@@ -452,7 +452,7 @@ func TestClusterExtensionManagerFailed(t *testing.T) {
452452
},
453453
},
454454
Namespace: namespace,
455-
ServiceAccount: ocv1.ServiceAccountReference{
455+
ServiceAccount: &ocv1.ServiceAccountReference{
456456
Name: serviceAccount,
457457
},
458458
},
@@ -531,7 +531,7 @@ func TestClusterExtensionManagedContentCacheWatchFail(t *testing.T) {
531531
},
532532
},
533533
Namespace: installNamespace,
534-
ServiceAccount: ocv1.ServiceAccountReference{
534+
ServiceAccount: &ocv1.ServiceAccountReference{
535535
Name: serviceAccount,
536536
},
537537
},
@@ -611,7 +611,7 @@ func TestClusterExtensionInstallationSucceeds(t *testing.T) {
611611
},
612612
},
613613
Namespace: namespace,
614-
ServiceAccount: ocv1.ServiceAccountReference{
614+
ServiceAccount: &ocv1.ServiceAccountReference{
615615
Name: serviceAccount,
616616
},
617617
},
@@ -689,7 +689,7 @@ func TestClusterExtensionDeleteFinalizerFails(t *testing.T) {
689689
},
690690
},
691691
Namespace: namespace,
692-
ServiceAccount: ocv1.ServiceAccountReference{
692+
ServiceAccount: &ocv1.ServiceAccountReference{
693693
Name: serviceAccount,
694694
},
695695
},

‎internal/operator-controller/resolve/catalog_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -586,7 +586,7 @@ func buildFooClusterExtension(pkg string, channels []string, version string, upg
586586
},
587587
Spec: ocv1.ClusterExtensionSpec{
588588
Namespace: "default",
589-
ServiceAccount: ocv1.ServiceAccountReference{Name: "default"},
589+
ServiceAccount: &ocv1.ServiceAccountReference{Name: "default"},
590590
Source: ocv1.SourceConfig{
591591
SourceType: "Catalog",
592592
Catalog: &ocv1.CatalogFilter{

0 commit comments

Comments
 (0)